A Study on

Theoretical and Practical Aspects of Weil-Restrictions of Varieties

Claus Diem

Dissertation

A Study on

Theoretical and Practical Aspects of Weil-Restrictions of Varieties

Dissertation zur Erlangung des Grades eines Doktors der Naturwissenschaften

Dem Fachbereich 6 (Mathematik und Informatik) der Universität-Gesamthochschule Essen

vorgelegt von

Claus Diem aus Frankfurt am Main

Februar 2001

Die Disputation fand am 31.5.2001 statt.

Die Gutachter waren: Prof. Dr. Dr. hc Gerhard Frey, Universität-Gesamthochschule Essen Prof. Dr. Barry Green, Universiteit Stellenbosch, Süd-Afrika Prof. Dr. Eckart Viehweg, Universität-Gesamthochschule Essen

Zusammenfassung

Für eine feste endliche, separable Körpererweiterung K|k kann man jeder quasi-projektiven K-Varietät auf funktorielle Weise eine quasiprojektive k-Varietät höherer Dimension, die sogenannte Weil-Restrik-tion, zuordnen.

Diese Arbeit ist dem Studium verschiedener Aspekte dieser Varietäten gewidmet. Der Schwerpunkt liegt zuerst auf Resultaten rein theoretischer Natur. Später werden diese Resultate angewandt, um potentielle Angriffe auf das diskrete Logarithmus-Problem in Klassengruppen von Kurven über endlichen Nicht-Primkörpern darzulegen.

Ich habe diese Arbeit selbstständig verfasst und dabei keine anderen als die in der Literaturliste aufgeführten Hilfsmittel benutzt.

Claus Diem Essen, Februar 2001

Contents

Foreword iii

1 Basic properties of Weil-restrictions 1

1.1 Definition and construction of Weil-restrictions . . . . . . . . . . . 2 1.1.1 Base-extension and base-change . . . . . . . . . . . . . . . . 2 1.1.2 Base-restriction . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.1.3 Weil-restrictions of schemes . . . . . . . . . . . . . . . . . . 6 1.1.4 The étale case . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.1.5 The Galois case . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.2 Pull-back of sheaves to the Weil-restriction . . . . . . . . . . . . . 18 1.2.1 Pull-back of modules . . . . . . . . . . . . . . . . . . . . . . 18 1.2.2 The Picard functor and the Picard scheme . . . . . . . . . . 21 1.2.3 The Picard functor of the Weil-restriction . . . . . . . . . . 22

1.3 Weil-restrictions of abelian varieties . . . . . . . . . . . . . . . . . 25 1.3.1 Weil-Restrictions and dual abelian varieties . . . . . . . . . 25 1.3.2 The Galois-operation on geometric points . . . . . . . . . . 26 1.3.3 The functor “Weil-restriction” . . . . . . . . . . . . . . . . 26 1.3.4 Weil-restrictions of a polarized abelian varieties . . . . . . . 27 1.3.5 Weil-restrictions of abelian varieties over finite fields …. 28

2 Weil-restrictions of old abelian varieties 33

2.1 The endomorphism ring . . . . . . . . . . . . . . . . . . . . . . . . 34 2.1.1 The endomorphism ring as skwe-group-ring . . . . . . . . . 34 2.1.2 The Rosati involution, isotypic components and

orthogonality . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.1.3 The cyclic case . . . . . . . . . . . . . . . . . . . . . . . . . 41

2.2 The Néron-Severi group of a product of isomorphic elliptic curves . 44 2.2.1 The Néron-Severi group and the endomorphism ring …. 44 2.2.2 A basis for the Néron-Severi group . . . . . . . . . . . . . . 47 2.2.3 The Néron-Severi group of a twist . . . . . . . . . . . . . . 48

2.3 The Néron-Severi group of the trace-zero-hypersurface . . . . . . . 49 2.3.1 The canonical polarization of the trace-zero-hypersurface . 49 2.3.2 A basis for the Néron-Severi group . . . . . . . . . . . . . . 51 2.3.3 Complex multiplication . . . . . . . . . . . . . . . . . . . . 58

2.4 Curves on the trace-zero-hypersurface for degree 3 . . . . . . . . . 60 2.4.1 The trace-zero-hypersurface for char(k) ≠ 2, 3 . . . . . . . . 60 2.4.2 The curve defined by σ(Y) = Y . . . . . . . . . . . . . . . . 66

3 Coverings of curves and the discrete-logarithm problem 71

3.1 Coverings as curves on the Weil-restriction . . . . . . . . . . . . . . 72 3.1.1 Curves with Jacobians which are new abelian varieties … 74 3.1.2 Curves which are defined over the small field . . . . . . . . 74

3.2 Coverings of curves whose Jacobian variety is a simple new abelian variety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 3.2.1 Construction of coverings . . . . . . . . . . . . . . . . . . . 78 3.2.2 An application . . . . . . . . . . . . . . . . . . . . . . . . . 82

3.3 Coverings of curves defined over the small field . . . . . . . . . . . 84 3.3.1 Construction of coverings . . . . . . . . . . . . . . . . . . . 84 3.3.2 An application . . . . . . . . . . . . . . . . . . . . . . . . . 87

A Appendix 93

A.1 Some results about the Picard scheme . . . . . . . . . . . . . . . . 93 A.1.1 The dimension of the Picard scheme . . . . . . . . . . . . . 93 A.1.2 The Picard scheme of a product . . . . . . . . . . . . . . . 96

A.2 Some results about abelian varieties . . . . . . . . . . . . . . . . . 97 A.2.1 Isogenies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 A.2.2 The Néron-Severi group and polarizations . . . . . . . . . . 98 A.2.3 Products and the Rosati involution . . . . . . . . . . . . . . 103 A.2.4 Orthogonal complements and the Complete Reducibility

Theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 A.2.5 The decomposition of the endomorphism ring of an abelian

variety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 A.2.6 Ample sheaves . . . . . . . . . . . . . . . . . . . . . . . . . 108 A.2.7 Principally polarized abelian surfaces . . . . . . . . . . . . . 108

A.3 Some results about schemes and varieties . . . . . . . . . . . . . . 111

A.3.1 Regular function fields and geometrically irreducible

varieties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 A.3.2 Pull-back of effective divisors . . . . . . . . . . . . . . . . . 112 A.3.3 Galois-operation and descent . . . . . . . . . . . . . . . . . 113 A.3.4 Schemes over finite fields . . . . . . . . . . . . . . . . . . . 114

Bibliography 117

Foreword

For a fixed finite, separable extension of fields K|k, one can attach in a functorial way to every quasi-projective K-variety a higher-dimensional quasi-projective k-variety, the so-called Weil-restriction.

This work is devoted to the study of various aspects of these varieties. At first, the emphasis is on purely theoretical results. Later these results are applied to outline potential attacks on the discrete-logarithm problem in class groups of curves over finite non-prime fields.

Historical background and motivation

Let K|k be a finite Galois extension of fields, X′ a quasi-projective K-variety. ^{1} Then there exists a quasi-projective k-variety W which has in particular the properties that X′(K) ≃ W (k) and W_{K} = W ⊗_{k} K is a product of Galoisconjugates of X′. Within the framework of arithmetic algebraic geometry, W is defined by the property that for all k-schemes Z, there exists a functorial bijection W (Z) ≅ X′(Z ⊗_{k} K).

To prove the existence of W one can for example define a certain 1-cocycle datum for a product of Galois-conjugates of X′ and then apply “descent” as in A.Weil’s paper “The field of definition of a variety”; see [We-F]. Although Weil does not state it explicitly, his paper even contains a construction of W as a subvariety of some concrete projective space; see proof of [We-F, Proposition 1]. In honor of him, W is often called the Weil-restriction of X′ (with respect to K|k). (Here, the word “restriction” refers to the fact that the base-field is “restricted” from K to k.) We follow this terminology.

Weil-restrictions of abelian varieties were studied to solve various problems of arithmetic algebraic geometry and thus also number theory. Prominent examples are Milne’s proof that the conjectures of Birch and Swinnerton-Dyer for abelian varieties over the rationals imply the conjectures for abelian varieties over all number fields and Honda’s theorem about the classification of isogeny classes of abelian varieties over finite fields; see [Mi-AA] and [Ho] respectively.

1Throughout this work, if we are given an extension of fields K|k, we will denote varieties over k by X, Y, etc., and varieties over K by X′, Y′, etc.

With the rise of arithmetic algebraic geometry, Weil-restrictions were shown to exist in a much a more general context. A construction of the Weil-restriction in a very general setting can be found in the book “Néron Models” by Bosch, Lütkebohmert and Raynaud; see [BLR, 7.6].

After Weil-restrictions where successfully studied to solve problems of “pure mathematics” for decades, a new direction of research was shown by Frey in a talk in 1998; see [Fr]. He suggested to use Weil-restrictions of elliptic curves both as a tool to construct as well as to break discrete-logarithm problems.

The general idea for the use of Weil-restrictions as a means to construct attacks on the discrete-logarithm problem in the group of rational points of an elliptic curve over a finite non-prime field is that as an abelian variety of dimension greater than 1, a Weil-restriction has “more structure” than the original elliptic curve.

In particular, Frey noted that for a fixed elliptic curve and a fixed constant field extension, it should be possible to transform the DL-problem in the group of rational points into DL-problems in class groups of curves on the Weil-restriction. Thus it should in principle be possible to transform the original DL-problem into DL-problems in class-groups of curves of higher genera over a smaller field. If one finds a suitable curve on the Weil-restriction whose genus is not too high, it should be more efficient to solve the DL-problem in this curve than in the original elliptic curve. This is suggested by the results of Gaudry and Enge; see [En], [EG], [Gau].

As discrete-logarithm problems are one of the bases of public-key cryptography (another one being the factorization problem), this shows that Weil-restriction may be relevant from an applied point of view as well.

The first results in this direction were obtained by Galbraith and Smart, and the first major paper in this new direction was written by Gaudry, Hess and Smart; see [GHS].

Introduction

In this work we study Weil-restrictions of varieties both from a pure as well as from an applied point of view. In particular, we show how questions on Weil-restrictions of abelian varieties motivated by the cryptoanalytical applications outlined above can often be proven directly from the defining functorial properties.

Conversely, the problem of finding curves of low genus on Weil-restrictions of a (non-singular, projective, geometrically integral) curve X′ is by the defining functorial property equivalent to finding certain coverings of X′. Most of the time it is probably easier to find these coverings of X′ (where one can use Galois theory) than to find curves on the Weil-restriction using hyperplane-sections.

Thus when trying to transform the DL-problem in the class group of curve X′ over a non-prime finite field into a potentially easier DL-problem in a class group of a curve defined over a smaller field, we emphasis on a Galois-theoretic approach. We would like to regard the Weil-restriction as being only a tool providing the necessary background to motivate that we indeed transform the original DL-problem into an equivalent problem.

The work consists of three chapters and an appendix. Each chapter has its own introduction. The main results are mostly stated in or around a “theorem”. ^{2} Whenever stating a theorem, we have tried to include all necessary conditions to understand the context properly.

In the chapter one, we first give basic definitions related to Weil-restrictions of varieties and schemes. After having given two constructions of the Weil-restriction in rather abstract settings, we study its first properties. Then we restrict ourselves to a projective variety X′/K with a rational point and study the Weil-restriction of X′ with respect to a Galois field extension K|k. We analyze the Picard functor of the Weil-restriction W and relate it to the restriction of the Picard functor of X′. In the third section we first give an introduction to Weil-restrictions of abelian varieties. Then we derive the structure of the endomorphism ring of Weilrestrictions of an abelian variety over finite fields.

For the second chapter, let K|k be a Galois field extension of perfect fields and let A be an abelian k-variety, ^{3} W the Weil-restriction of A_{K} with respect to K|k. In the first section, we give a description of End_{k}(W) as a skew-group-ring over End_{K}(A_{K}). We then restrict ourselves to the case that A is an elliptic curve E. Then W is isogenous to the product of E and an abelian variety N called its trace-zero-hypersurface. We study the Néron-Severi group of N and in particular the polarizations of N. As a first step towards the determination of the Néron-Severi group of N we include a study of the Néron-Severi group of a product of elliptic curves. In the last section of this chapter, we study an affine open part of N with explicit equations for the particular case that the extension degree [K : k] equals 3.

The third chapter is entirely devoted to cryptoanalytical applications. Let k be a finite field, K|k a field extension of prime degree n. Let X′ be a non-singular, geometrically irreducible curve over K. Assume that X′ has “cryptographically good” properties. In particular, the group Cl^{0}(X′) of classes of divisors of degree 0 should have a large prime factor. Let C be a non-singular, geometrically irreducible curve over k with a covering C ⊗_{k} K ⟶ X′. Using this covering, we have an explicit morphism from Cl^{0}(X′) to Cl^{0}(C). The hope is that if the genus of C is not “too large”, perhaps the discrete-logarithm problem in the group Cl^{0}(C) is “easier” than the discrete-logarithm problem in the original group Cl^{0}(X′). Applying results of the previous two chapters, we will give theoretical results predicting when the large prime factor to be preserved under the morphism to Cl^{0}(C). Then we use Galois theory to construct rather explicitly some examples.

2A Less important result is called “proposition”, a smaller or more technical result is called “lemma”. The reader should keep in mind however that when we cite a result and call it “proposition” or “lemma” it may in fact be a theorem deeper and more important than the “theorems”

in this work.

3In our terminology, A_{K} is an old abelian variety. Thus the title of the chapter.

Acknowledgments

First and foremost, I thank my supervisor, Prof. Dr. Dr. h.c. G. Frey, for suggesting the initial direction for this work, his enthusiasm and the ideas he gave me in numerous discussions.

With great pleasure, I thank my wife, Marianne, for her understanding and support.

I thank Prof. Dr. B. Green for his great hospitality during my stay at the Universiteit van Stellenbosch in South Africa and N. Naumann for the fruitful cooperation.

Additionally, I thank (in alphabetical order): Dr. S. Galbraith, Prof. Dr. R. Göbel, Dr. F. Hess, Prof. Dr. U. Jansen, Prof. Dr. E. Kani, Prof. Dr. K. Künnemann, Prof. Dr. W. Lütkebohmert, Prof. Dr. G. Michler, Dr. S. Müller-Stach, Prof. Dr. F. Pop, Prof. Dr. H. Stichtenoth, Prof. Dr. E. Viehweg.

I would like to express my gratitude for financial support by the Friedrich-Naumann-Stiftung, the Deutsche Forschungsgemeinschaft DFG and the Volkswagen Stiftung. The funds of the first two bodies were made available by the Bundesrepublik Deutschland and the Land Nordrhein-Westfalen.

The Institut für Experimentelle Mathematik in Essen provided excellent working conditions.

Needless to say, it is often impossible to try to give credit to specific persons if an idea or a method has been “in the public domain” for a certain time. However, we try to state to whom rather concrete and recent results which we have included in our work or on which our results are built are due.

• The content of Section 1.1 is mostly standard and well-known.

• Subsection 1.3.5 is joint work with N. Naumann.

• Over finite fields, the dimensions of the simple isogeny-factors of W in Corollary 2.8 were first established by N. Naumann.

• Equations (2.20) in Section 2.4 are due to a variety of people, including G. Frey, N. Naumann and the author.

• Morphism (3.1) is due to F. Hess; see [GHS].

• The example in Subsection 3.2.2 is due to S. Galbraith, F. Hess and N. Smart for characteristic 2; see [GHS].

• The idea to use Lemma 3.11 in the proof of Proposition 3.12 was pointed out to the author by H. Stichtenoth.

Notations

Isomorphisms

We use three different signs to denote isomorphisms: If we merely want to indicate that two objects X and Y are isomorphic with some isomorphism we write X ≈ Y. Most of the time, the isomorphism will be in a certain (obvious) sense “canonical”. If this is the case, we write X ≃ Y. If we want to stress that an isomorphism is in a certain sense functorial, we write “≅”. – Thus if we are given two categories 𝒞, 𝒟, two functors ℱ, 𝒢 : 𝒞 ⟶ 𝒟, an isomorphism of functors ℱ ≈ 𝒢 and X a 𝒞-object, we write ℱ(X) ≅ 𝒢(X).

Let 𝒞 be a category, ℰns the category of sets, ℱ : 𝒞 ⟶ ℰns a contravariant functor. Let F be a 𝒞-object, u ∈ ℱ(F). Then by

φ : Hom(−, F) ⟶ ℱ, φ(α) := ℱ(α)(u)

a natural transformation is defined. Recall that if φ is an isomorphism, one says that F with the universal element u represents ℱ.

Now assume that we know that ℱ is representable. Then the representing object F with u is unique up to a unique isomorphism. ^{4} We think of F and u as being fixed. Thus, if F′ with u′ is some object representing ℱ, we write F ≃ F′.

Rings and Schemes

All rings and schemes considered in this work are assumed to be contained in some fixed universe.

If k is a field, we fix an algebraic closure and denote it by \overline{k}. The separable closure of k inside \overline{k} will be denoted by k^{sep}.

All schemes will assumed to be locally Noetherian, i.e. we will work entirely in the category of locally Noetherian schemes which are contained in some fixed universe.

Fix some scheme S and let X be an S-scheme. Then for any S-scheme T, we call the S-morphisms from T to X T -valued points of X. Let Y be another S-scheme. Any S-morphism X ⟶ Y induces by “push-forward” a functorial morphism (in T) from the T -valued points of X to the T -valued points of Y. Conversely, any such functorial morphism determines an S-morphism from X to Y. ^{5} We will often use this fact to construct morphisms from X to Y. When we do so we speak of .-valued points for T -valued points for some T.

4One speaks of “the” representing object. Note however that if one speaks of “the” or “a”

representing object one always means an object with a fixed universal element.

If X and Y are S-schemes, then the T -valued points of product X ×_{S} Y will be be denoted by (P, Q), where P ∈ X(T), Q ∈ Y (Q) (analogous notation for products consisting of more factors).

If X and Z are S-schemes, we denote the product X ×_{S} Z also by X_{Z}. If we use this notation, we think of X as being fixed and Z as being variable.

In the context of schemes, all rings will automatically assumed to be commutative. Let A be a (commutative) ring. Let X be an A-scheme, by which we mean a scheme over Spec(A). Let B be an A-algebra. Then we denote Spec(X) ×_{Spec(A)} Spec(B) by X ⊗_{A} B or simply by X_{B}.

Let ι : X ↪ Y be a closed immersion, α : Z ⟶ Y some morphism. Then by α^{−1}(X) we always mean the scheme-theoretic preimage, i.e. α^{−1}(X) := X ×_{Y} Z where the product is taken relative to ι and α. If α is also a closed immersion, we denote X ×_{Y} Z also by X ∩ Z.

Following [Ha, II,4,p.103], a quasi-projective morphism X ⟶ Y is a morphism which factors into an open immersion followed by a projective morphism. Likewise, an immersion is a morphism which factors into an open immersion followed by a closed immersion.

Let k be a field. A k-variety X is a separated and reduced scheme of finite type over k. Note that we do not assume X to be irreducible or geometrically reduced. Similarly, a k-curve is a separated and reduced scheme of finite type over k which is equidimensional and of dimension 1.

If X is an irreducible K-variety, we denote its function field by k(X). Note that X is geometrically integral (i.e. geometrically reduced, geometrically irreducible) iff k(X)|k is regular.

Galois coverings

Let h : S′ ⟶ S be a Galois covering of schemes with Galois group G (in the sense of [SGA I, V]). This means by definition (in particular) that there is a fixed injective anti-homomorphism G ↪ Aut_{S}(S′).

This anti-homomorphism induces a homomorphism G^{opp} ↪ Aut_{S}(S′). We identify G^{opp} with its image.

We denote the elements of G by bold letters. The corresponding operators of h are usually denoted by the same symbol in “usual” letters, i.e. we have an injective anti-homomorphism σ ↦ σ.

5This is a trivial fact from category theory: For any category 𝒞, the functor X ↦ Hom(−, X)

is a full and faithful. A less trivial fact is that it suffices to define a morphism of schemes on ring-valued points.

If G is commutative, we identify G with G^{opp} and denote the elements of G also by “usual” letters.

Now let S′ = Spec(K) and S = Spec(k) be spectra of fields. Then h is determined by the field homomorphism h^{#} : k ↪ K.

The extension K|k given by h^{#} is finite and Galois with Galois group G, the galois group of h. (In particular, we denote the automorphisms of the extension K|k also by bold letters.) The anti-homomorphism G ⟶ Aut_{S}(S′) is given by σ ↦ σ where σ is given by σ = σ^{#} ∈ G = Aut(K|k).

The Picard group

Let X be a scheme. Sheaves on X are denoted by ℒ, ℳ, etc.

The Picard group is the group of isomorphism classes of invertible sheaves on X, denoted Pic(X). Its elements are denoted by \overline{ℒ}, \overline{ℳ}, etc.

A morphism ψ : X ⟶ Y induces a group-homomorphism ψ^{∗} : Pic(Y) ⟶ Pic(X).

Let k be a field and let X be a non-singular, geometrically reduced, geometrically irreducible, projective k-variety with a k-rational point. Let 𝒫ic(X) be the Picard functor Z ↦Pic(X ×_{k} Z)/p_{Z}^{∗}Pic(Z), where p_{Z} : X ×_{k} Z ⟶ Z is the projection. We denote the elements of 𝒫ic(X)(Z) by \overline{\overline{ℒ}}, \overline{\overline{ℳ}}, etc. Under our assumptions on X, the Picard-functor is representable, and we denote a representing object of 𝒫ic(X) by Pic(X) and the universal element by \overline{\overline{𝒫}}. The Picard-scheme, Pic^{0}(X), is the connected component of the zero of Pic(X). We still denote the universal element by \overline{\overline{𝒫}}. Under the isomorphism Hom(−, Pic(X)) ≃ 𝒫ic(X), Hom(−, Pic^{0}(X)) corresponds to a functor which we denote by 𝒫ic^{0}(X).

Let X, Y be k-varieties as above, ψ : X ⟶ Y a morphism. Then the “pull-back” 𝒫ic(Y) ⟶ 𝒫ic(X) induced by ψ is denoted by ψ^{∗} and so is the corresponding morphism between the Picard schemes. ^{6}

Abelian varieties

Let k be a field. An abelian k-variety is a geometrically integral, projective kgroup-variety. The addition on A is denoted by “+”.

Let A be an abelian k-variety.

If we speak of the endomorphism ring of A we mean the ring of endomorphisms of A over k, i.e. the endomorphisms of A\overline{k} defined over k. It is denoted by End_{k}(A). Likewise, the endomorphism algebra of A is the ring End_{k}^{0}(A) := End_{k}^{0}(A) ⊗_{ℤ} ℚ.

If we say that two abelian k-varieties are isogenous or isomorphic, we mean isogenous or isomorphic as abelian k-varieties. We denote isogeny by ∼.

The same applies also to complex multiplication: By saying that an elliptic k-curve has complex multiplication, we mean that E\overline{k} has complex multiplication and the complex multiplication is defined over k.

6A brief exposé of the Picard functor and the Picard scheme can be found in subsection 1.2.2.

Let Z be some k-scheme, P a Z-valued point of A. Then the translation by P is the morphism T_{P} = id_{A_{Z}} + P ∘ p_{Z} : A_{Z} ⟶ A_{Z}, where p_{Z} : A_{Z} ⟶ Z is the projection.

A dual abelian variety is denoted by Â, the universal divisional correspondence by 𝒫. By definition, 𝒫ic^{0}(A)(Z) ≅ Â(Z) where Z is a k-scheme.

If α : A ⟶ B is a morphism, the dual morphism is denoted by α̂. With other words, α̂ : B̂ ⟶ Â is just another notation for α^{∗} : Pic^{0}(B) ⟶ Pic^{0}(A).

Let ℳ be an invertible sheaf on A. Then ϕ_{ℳ} : A ⟶ Â is the morphism associated to the natural transformation Hom_{k}(−, A) ⟶ 𝒫ic^{0}(A) with is given on Z-valued points by P ↦ T_{P}^{∗}q_{Z}^{∗}(\overline{ℳ}) ⊗ q_{Z}^{∗}(\overline{ℳ})^{−1}, where q_{Z} : A_{Z} ⟶ A is the projection.

Following [Mi-A], a polarization of A is a morphism φ from A to its dual Â such that φ ⊗_{k} id\overline{k} = ϕ_{ℳ} : A\overline{k} ⟶ Â\overline{k} for some ample sheaf ℳ on A\overline{k}.

The group NS(A) := Pic(A)/Pic^{0}(A) is called Néron-Severi group.

For any natural number n, we denote the (scheme-theoretic) kernel of ·n : A ⟶ A by A[n].

Let K|k be a finite field extension, A′ an abelian K-variety. Then, if A′ is defined over k, i.e. if there exists an abelian k-variety A such that A′ ≈ A ⊗_{k} K, we say that A is an old abelian variety (relative to K|k). If A′ is not isogenous to an abelian variety defined over k or some proper intermediate field λ of K|k, then we call A′ a new abelian variety (relative to K|k).

Note that if the extension degree [K : k] is prime, every abelian K-variety is either a new abelian variety or it is isogenous (not necessarily isomorphic) to an old abelian variety.

Chapter 1

Basic properties of Weil-restrictions

Introduction and results

Let k be a field, K|k a finite separable field extension and X′/K a quasi-projective variety. The base-restriction of X′ with respect to K|k is the functor ℛes_{k}^{K}(X′) defined by ℛes_{k}^{K}(X′)(Z) := X′(Z ⊗_{k} K) for any k-scheme Z. It can be shown that the functor ℛes_{k}^{K}(X′) is represented by a k-variety Res_{k}^{K}(X′), the so-called Weil-restriction of X′; see Proposition 1.4.

In the first section of this chapter we give two constructions of the Weilrestriction in a more general situation and show basic properties of it.

In the second section we “pull-back” the invertible sheaves on X′ to invertible sheaves on the Weil-restriction. It follows in particular that the Weil-restriction of a quasi-projective variety with a fixed immersion into some projective space is in a canonical way immersed in some higher dimensional projective space; see Proposition 1.13.

Let K|k be a finite Galois extension, let X′ be a non-singular, projective Kvariety with a K-rational point. We show that under certain conditions on X′, the Weil-restriction of the Picard scheme of X′ is an abelian variety which is canonically isomorphic to the Picard scheme of the Weil-restriction of X′. This is rather obvious for abelian varieties where the Picard scheme is nothing but the dual abelian variety; see Proposition 1.20. It is also true if char(k) = 0 or X′ ; \overline{K} has a “smooth, proper global lifting”; see Theorem 1, p. 25. (This assumption is always fulfilled if X′ is a curve.) The proof relies on the fact that the Picard scheme of a product of varieties over an algebraically closed field is – under our assumptions – reduced and isomorphic to the product of the Picard schemes of the factors.

In the third section, we begin with the study of the Weil-restriction of abelian varieties. Using the results of the previous section, we show how the Weilrestriction of X′ inherits the polarizations of X′. In particular, if X′ is principally polarized, so is the Weil-restriction.

We then derive the structure of the endomorphism algebra of the Weil-restric-tion of an abelian variety with respect to an extension of finite fields (see Theorem 2, p. 29) and show that for prime extension degree [K : k], the Weil-restriction of an abelian K-variety which is not isogenous to an abelian variety defined over k is simple (see Theorem 3, p. 31).

The study of the Weil-restriction of abelian varieties will be continued in the next chapter where we consider the Weil-restriction of an abelian variety which is defined over k. (Such abelian varieties will be called old abelian varieties.)

1.1 Definition and construction of Weil-restrictions

In this section, we give the definition of “base-restriction” of a functor. Then we show how to construct the Weil-restriction of a quasi-projective scheme with respect to a finite and locally free morphism via “restriction of scalars”. Here, we follow [BLR, 7.6]. In the case that the base-morphism is étale, we show how to construct the Weil-restriction via a “geometrical approach”. We then restrict ourselves to the case that the base-morphism is Galois and show how the “geometric construction” is related to the construction via “restriction of scalars”. Finally we show how the arithmetic operation of the Galois group induces a geometric operation on the Weil-restriction.

We start more abstractly with an abstract category instead of a subcategory of the category of locally Noetherian schemes. This abstract setting is in no way more difficult.

In order to define base-restriction properly, we first define the functor “basechange”. This is done in the first subsection.

1.1.1 Base-extension and base-change

We fix some universe 𝒰 and denote the category of sets which are contained in this universe by ℰns.

Let 𝒞 be a category whose objects are contained in 𝒰.

Let 𝒟 be another category whose objects are contained in 𝒰. Then for some functors ℱ, 𝒢 : 𝒞 ⟶ ℰns, the natural transformations between ℱ and 𝒢 form a set. Thus the covariant functors from 𝒞 to 𝒟 form a category, denoted Hom(𝒞, 𝒟). Analogously, the contravariant functors form a category, denoted Hom^{opp}(𝒞, 𝒟).

If X and Y are two objects of 𝒞, we denote the set of morphisms between X and Y by Hom(X, Y). An S-object is a morphism α : X ⟶ S, and a morphism between S-objects α : X ⟶ S and β : Y ⟶ S is a morphism φ : X ⟶ Y such that β ∘ φ = α.

As usual, we write X for X ⟶ S and Hom_{S}(X, Y) for the set of morphisms of S-objects X and Y. For any S ∈ 𝒞 let 𝒞/S be the category of S-objects.

Definition Let ℱ, 𝒢 : 𝒞 ⟶ ℰns be contravariant functors, α : ℱ ⟶ 𝒢 a natural transformation, T some object of 𝒞 and t ∈ 𝒢(T). Then id_{T} ↦ t defines a natural transformation β : Hom(−, T) ⟶ 𝒢, γ ∈ Hom(Z, T) ↦ 𝒢(γ)(t) ∈ 𝒢(Z).

\xymatrix{ & ℱ \ar[d]_{α} \\ Hom(−, T) \ar[r]^{β}_{id↦t} & 𝒢}

Now let ℱ ×_{𝒢} T : 𝒞/T ⟶ ℰns be defined as follows:

ℱ ×_{𝒢} T (Z) = ℱ ×_{𝒢} T (γ) := {f ∈ ℱ(Z)|α_{Z}(f) = β_{Z}(γ)}, γ : Z ⟶ T a T -object

and for a morphism f : Y ⟶ Z of T -objects by ℱ ×_{𝒢} T (f) := ℱ(f)|_{ℱ×_{𝒢} T (Y)}

Assume that in 𝒞 fiber products exist, i.e. for all S ∈ 𝒞, products exist in the category 𝒞/S. Let ℱ be represented by (F, u) with u ∈ ℱ(F), 𝒢 by (G, v) with v ∈ 𝒢(G). Let F ×_{G} T be the fiber product of the morphism F ⟶ G which is associated to α : ℱ ⟶ 𝒢 and the morphism T ⟶ G which is associated to β : Hom(−, T) ⟶ G, let x : F ×_{G} T ⟶ F, y : F ×_{G} T ⟶ T be the structural morphisms. Then ℱ ×_{𝒢} T is represented by (F ×_{G} T, ℱ(x)(u)), where we regard F ×_{G} T as a T -scheme via y.

Definition Let ℱ : 𝒞/S ⟶ ℰns be a contravariant functor. The base-extension of ℱ with respect to a morphism T ⟶ S is the functor ℱ×_{S}T = ℱ_{T} : 𝒞/T ⟶ ℰns defined by

ℱ_{T} (Z) := ℱ(Z), Z a T -object

and for a morphism f : Y ⟶ Z of T -objects by ℱ_{T} (f) := ℱ(f) : ℱ(Y) ⟶ ℱ(Z)

Note that this definition can be regarded as a special case of the preceding definition with 𝒞/S instead of 𝒞 and with 𝒢 the trivial functor which assigns to every object the set of one element.

(−)_{T} is a covariant functor from the category Hom^{opp}(𝒞/S, ℰns) to the category Hom^{opp}(𝒞/T, ℰns). The images of group-objects are group-objects.

Again assume that in 𝒞 fiber products exist. Let T ⟶ S be a morphism and let X be an S-object. If Z is a T object, then Hom_{S}(Z, X)_{T} = Hom_{S}(Z, X) ≃ Hom_{T} (Z, X ×_{S} T), i.e. Hom_{S}(−, X)_{T} is represented by some product X ×_{S} T (regarded as T -object) with the structural morphism X ×_{S} T ⟶ X.

Since by assumption the objects of 𝒞 form a set, we can apply the axiom of choice. For every X, we choice products X ×_{S} T (together with the structural morphisms).

Now let f : X ⟶ Y be an S-morphism. Then we define f ×_{S} T to be the unique morphism such that the diagram

\xymatrix{Hom(−, X ×_{S} T) \ar[d]^{Hom_{T} (−,f×_{S}T)} \ar[r]^{∼} & Hom(−, X)_{T} \ar[d]^{Hom_{S}(−,f)_{T}} \\ Hom(−, Y ×_{S} T) \ar[r]^{∼} & Hom(−, Y)_{T}}

is commutative.

We obtain the functor base-change −×_{S}T : 𝒞/S ⟶ 𝒞/T, and by construction, we have a natural isomorphism

Hom_{T} (−, X ×_{S} T) ≅ Hom_{S}(−, X)_{T} .

By considering the image of id_{X×_{S}T}, we see that the diagram

\xymatrix{X ×_{S} T \ar[r] \ar[d]^{f×_{S}T} & X \ar[d]^{f} \\ Y ×_{S} T \ar[r] & Y}

is commutative. Since by definition f ×_{S} T is also a T -morphism,

f ×_{S} T = f ×_{S} id_{T} .

1.1.2 Base-restriction

Let 𝒞 be again a category whose objects are contained in the universe 𝒰 and in which fiber products exist. Let h : S′ ⟶ S be a morphism in 𝒞. Let ℱ′ : 𝒞/S′ ⟶ ℰns be a contravariant functor.

Definition The base-restriction of ℱ′ with respect to h is the following contravariant functor ℛes_{S}^{S′}(ℱ′) = ℛes^{h}(ℱ′) : 𝒞/S ⟶ ℰns:

ℛes^{h}(ℱ′)(Z) := ℱ′(Z ×_{S} S′), Z an S-object and for a morphism f : Y ⟶ Z of S-objects by ℛes^{h}(X′)(f) := ℱ′(f ×_{S} id_{S′}) : ℱ′(Z ×_{S} S′) ⟶ ℱ′(Y ×_{S} S′).

In particular ℛes^{h}(ℱ′)(S) = ℱ′(S′). ℛes^{h} is a covariant functor from the category Hom^{opp}(𝒞/S′, ℰns) to the category Hom^{opp}(𝒞/S, ℰns).

The images of group-objects are group-objects and ℛes^{h} restricts to a covariant functor from the category Hom^{opp}(𝒞/S′, ℰns) to the category Hom^{opp}(𝒞/S, ℰns).

Note In [BLR] base-restriction is called “direct image” and is denoted by h_{∗}ℱ.

Let X′ ∈ 𝒞/S′. Then X′ induces the functor Hom_{S′}(−, X′) : 𝒞/S′ ⟶ ℰns. We denote ℛes^{h}(Hom_{S′}(−, X′)) by ℛes^{h}(X′) = ℛes_{S}^{S′}(X′). So ℛes^{h}(X′)(Z) = Hom_{S′}(Z ×_{S} S′, X′) = X′(Z ×_{S} S′)

With this definition, ℛes^{h} is a covariant functor form the category 𝒞/S′ to the category Hom^{opp}(𝒞/S, ℰns).

“Base-extension” commutes with “base-restriction”:

Lemma 1.1 Let T ⟶ S be a morphism, T′ := T ×_{S} S′. Then

(ℛes_{S}^{S′}(ℱ′))_{T} ≅ ℛes_{T}^{T′}(ℱ′_{T′}).

(Functorially in ℱ′.)

Proof Let Z be a T -scheme. Then

ℛes_{T}^{T′}(ℱ′_{T′})(Z) =^{Def} ℱ′_{T′}(Z ×_{T} T′) = ℱ′(Z ×_{T} T′) ≅

ℱ′(Z ×_{S} S′) = ℛes_{S}^{S′}(ℱ′)(Z) = (ℛes_{S}^{S′}(ℱ′))_{T} (Z).

□

Lemma 1.2 Let T ⟶ S, T′ := T ×_{S} S′. Let α : X′ ⟶ T′. Then

ℛes_{T}^{T′}(X′) = ℛes_{S}^{S′}(X′) ×_{ℛes_{S}^{S′}(T′)} T.

Here the right-hand side is defined by ℛes(α) and id ∈ ℛes_{S}^{S′}(T′)(T) (which defines the natural transformation Hom_{S}(−, T) ⟶ ℛes_{S}^{S′}(T′)).

Proof Let γ : Z ⟶ T′ be some T′-scheme. Then

ℛes_{T}^{T′}(Z) = Hom_{T′}(Z ×_{T} T′, X′) =

{β ∈ Hom_{S′}(Z ×_{T} T′, X′)| α ∘ β = γ ×_{T} T′, i.e. ℛes_{S}^{S′}(α)(β) = γ ×_{T} T′} = ℛes_{S}^{S′}(X′) ×_{ℛes_{S}^{S′}(T′)} T (Z).

□

Let ℱ : 𝒞/S ⟶ ℰns be a functor. Then the morphisms ℱ(Z) ⟶ ℱ(Z ×_{S} S′) = ℱ_{S′}(Z ×_{S} S′) induce a natural transformation

ℱ ⟶ ℛes_{S}^{S′}(ℱ_{S′}).

This is natural in ℱ. Thus we get a natural transformation

id ⟶ ℛes_{S}^{S′}((.)_{S′}),

where id is the identity functor on the category Hom^{opp}(𝒞/S, ℰns).

Let X be an S-scheme. Then by this construction we get a natural transformation

Hom_{S}(−, X) ⟶ ℛes_{S}^{S′}(X ×_{S} S′).

given by α ↦ α×_{S} id_{S′}. It is defined by mapping the identity on X to the identity on X ×_{S} S′, and it is natural in X.

Lemma 1.3 If the morphism S′ ⟶ S is faithful (i.e. if the functor − × S′ : 𝒞/S ⟶ 𝒞/S′ is faithful), then the natural transformation Hom(−, X) ⟶ ℛes_{S}^{S′}(X ×_{S} S′) is injective.

□

1.1.3 Weil-restrictions of schemes

In the following and in the rest of the paper we will use the above definitions only for the category 𝒮ch of locally Noetherian schemes which are contained in the fixed universe 𝒰.

We will see that within this category for special h and quite general X′, the base-restriction ℛes^{h}(X′) is representable. We call a representing object the Weilrestriction of X′ with respect to h : S′ ⟶ S and denote it by Res_{S}^{S′}(X′).

Idea of the construction by restriction of scalars

Assume that S =Spec(A), S′ =Spec(B), where B = Aα_{1} ⊕ ⋯ ⊕ Aα_{n} is a finite and free n-dimensional A-module. Let X′ =Spec(B[X_{1}, …, X_{m}]/(f_{1}, …, f_{l})) be affine and of finite type. The coordinates X_{i} define a closed immersion X′ ⟶ 𝔸_{B}^{m} = Spec(B[X_{1}, …, X_{m}]). We use this immersion to define a scheme W which represents ℛes_{S}^{S′}(X′), the Weil-restriction of X′ with respect to S′ ⟶ S. It can be constructed by “restriction of scalars”:

Fix some A-algebra C. The idea is to express the m coordinates of some C ⊗_{A} B-valued point P of 𝔸_{A}^{m} in the basis (α_{1}, …, α_{n}) of the A-algebra B. This gives a point p in 𝔸_{A}^{nm}, and expanding out the “equations” f_{i} in the new variables gives equations f_{i,j}, i = 1, …, l, j = 1, …, n. Now P satisfies the f_{i} iff p satisfies the f_{i,j}. One then proves that the scheme constructed in this way has the correct property not only for every A-algebra C but for any S-scheme Z.

An example

We give a small example to present the idea:

Let K|k be a quadratic field extension with K = k(α) where α^{2} = a ∈ k. Let V′ be the affine variety in 𝔸_{K}^{2} given by XY = 1. We are interested in the C ⊗_{k} K-valued points of this variety (for any k-algebra C). Let P be an arbitrary C ⊗_{k} K-valued point of 𝔸_{K}^{2} with coordinates X = X(P), Y = Y (P), X = x_{1} ⊗_{k} 1+x_{2} ⊗_{k} α, Y = y_{1} ⊗_{k} 1+y_{2} ⊗_{k} α. (With x_{i}, y_{i} ∈ k.) Then the defining equation XY = 1 becomes

(x_{1}y_{1} + ax_{2}y_{2} − 1) ⊗_{k} 1 + (x_{1}y_{2} + x_{2}y_{1}) ⊗_{k} α = 0.

This equation is satisfied iff (x_{1}, x_{2}, y_{1}, y_{2}) satisfies

x_{1}y_{1} + ax_{2}y_{2} = 1, x_{1}y_{2} + x_{2}y_{1} = 0

Let W be the k-scheme defined by these equations. From the construction, W (C) ≅ V′(C ⊗_{k} K) for all k-algebras C. From a general argument (which we will formalize below), it follows that one can generalize this functorial isomorphism from affine k-schemes to arbitrary schemes. It follows that W is the Weil-restriction of X′ with respect to K|k.

We will now formalize these ideas and prove that the variety W constructed in this way has indeed the correct properties for any S-scheme Z.

Formal construction

Let S =Spec(A), S′ =Spec(B) where the ring B is a free A module on the bases α_{1}, …, α_{n} as above. Let also X′ be as above. For each i = 1, …, l, let f_{i,j} ∈ A[x_{1,1}, …, x_{m,n}] be defined by

\begin{matrix}f_{i,1}α_{1} + ⋯ + f_{i,n}α_{n} = f_{i}(x_{1,1}α_{1} + ⋯ + x_{1,n}α_{n}, …, x_{m,1}α_{1} + ⋯ + x_{m,n}α_{n}) \\ ∈ B[x_{1,1}, …, x_{m,n}], \end{matrix}

where the right-hand side is the image of f_{i} under the map

B[X_{1}, …, X_{m}] ⟶ B[x_{1,1}, …, x_{m,n}], X_{i} ↦ x_{i,1}α_{1} + ⋯ + x_{i,n}α_{n}.

Let W :=Spec(A[x_{1,1}, …, x_{n,m}]/(f_{i,j})_{i=1,...,l, j=1,...,l}).

Now, if C is any A-algebra, then C ⊗_{A} B = C ⊗_{A} α_{1} ⊕ ⋯ ⊕ C ⊗_{A} α_{n}, and it is immediate that a C ⊗_{A} B-valued point of X′ (i.e. a solution of f_{i}, i = 1, …, n in C ⊗_{A} B) corresponds under “restriction of scalars” to exactly one C-valued point of W (i.e. to a solution of the f_{i,j}, i = 1, … k, j = 1, …, n in C). This correspondence is functorial in C. Thus W (with the natural transformation “restriction of scalars”) represents ℛes_{S}^{S′}(X′) in the category of affine schemes.

Now let Z be an arbitrary S-scheme and let Z×_{S}S′ ⟶ X′ be an S′-morphism. Then any open affine part Z^{a} of Z induces a morphism Z^{a} ×_{S} S′ ⟶ X′ and thus a morphism Z^{a} ⟶ W. If Z^{b} is another open affine part of Z, then we also get a morphism Z^{b} ⟶ W and from the functoriality of the construction, it follows that both morphisms agree on the intersection Z^{a} ∩ Z^{b} (because they agree on all open, affine subsets of the intersection). Thus by glueing we get a morphism Z ⟶ W. This construction is again functorial in Z. Moreover, any morphism Z ⟶ W determines again by functoriality and by glueing a unique morphism Z ⟶ X′. So, W is indeed a representing object for the functor ℛes_{S}^{S′}(X′).

[The last step follows from fact that ℛes_{S}^{S′}(X′) has the “sheaf property with respect to the Zariski topology” i.e. one can glue morphisms (see [BLR, p.194]) and the general fact that if an affine scheme represents a functor in the category of affine schemes and the functor has the sheaf property with respect to the Zariski topology than the scheme represents the functor in the full category of schemes.]

With this construction, the Weil-restriction of an affine scheme regarded as closed subscheme of m-dimensional affine space is canonically a closed subscheme of m · n-dimensional affine space.

Proposition 1.4 ([BLR, 7.6, Theorem 4]) Let S, S′ be schemes, h : S′ ⟶ S a morphism which is finite and locally free. Let X′ be an S′-scheme (locally) of finite type. Assume that for each s ∈ S and each finite set of points M ⊂ X′ ×_{S} Spec(κ(s)) (where κ(s) is the residue class field at s), there is an affine open subscheme U′ of X′ containing M. (E.g. X′ is a quasi-projective S′-scheme.) Then the base-restriction is representable by an S-scheme (locally) of finite type, i.e. the Weil-restriction of X′ with respect to h exists and is (locally) of finite type. ^{1}

proof (outline) We can assume that S and S′ are affine and that S′ ⟶ S is finite and free. For affine X′, one can construct the Weil-restriction by “restriction of scalars”. For general X′, one glues the representing objects of the open affine parts of X′ to get a scheme W. This can be done since the Weil restriction of an open inclusion is an open inclusion. Then one constructs a natural transformation Hom(−, W) ⟶ ℛes_{S}^{S′}(X′) using the fact that W has the “sheaf-property with respect to the Zariski-topology”. Now one uses the assumption to show that this natural transformation is a bijection. □

For the rest of this subsection, let S′ ⟶ S be finite and locally free and let X′ be an S′-scheme which fulfills the assumptions of the proposition.

We denote an S-scheme which represents ℛes^{h}(X′) by Res_{S}^{S′}(X′). We will often abbreviate it by W. By definition as a representing object of ℛes_{S}^{S′}(X′), there is a universal morphism u = u_{X′} : Res_{S}^{S′}(X′) ×_{S} S′ ⟶ X′ such that if Y is any S-scheme and c : Y ×_{S} S′ ⟶ X′ is a morphism, there is a unique morphism b : Y ⟶ W such that c = u ∘ (b ×_{S} id_{S′}) : Y ×_{S} S′ ⟶ X′. As usual, (Res_{S}^{S′}(X′), u) is unique up to unique isomorphism.

1In [BLR], the proposition is stated without the assumption “locally of finite type”. That the Weil-restriction is locally of finite type if X′ is follows easily from the construction. That the Weil-restriction is of finite type if X′ is, is a more difficult result. – It follows from [BLR, 7.6, Proposition 5 (e)] and our general assumption that all schemes considered be locally Noetherian.

Further properties of the Weil-restriction depending on properties of X′ and the base-morphism S′ ⟶ S are given in [BLR, 7.6, Proposition 5]. In the subsequent parts of this work, we will restrict ourself to the case that S is connected, X′ is quasi-projective over S′ and the basemorphism is étale. Under these assumptions, we will proof all properties of the Weil-restriction we need.

\xymatrix{Y ×_{S} S′ \ar[rr]^{c} \ar[r]_{b×_{S}id_{S′}} \ar[d] & Res_{S}^{S′}(X′) ×_{S} S′ \ar[r]^{u} \ar[d] & X′ \\ Y \ar[r]^{∃! b} & Res_{S}^{S′}(X′)}  (1.1)

If S, S′ and X′ are affine (with notations as above) and Res_{S}^{S′}(X′) is constructed by “restriction of scalars” as above, then u is given by

\begin{matrix}B[X_{1}, …, X_{m}]/(f_{i})_{i=1,...,l} ⟶ B[x_{1,1}, …, x_{m,n}]/(f_{i,j})_{i=1,...,l,j=1,...,n}, \\ X_{i} ↦ α_{1}x_{i,1} + ⋯ + α_{n}x_{i,n}. \end{matrix}  (1.2)

Let Y′ be another S′-scheme which fulfills the assumptions of the proposition. As said above, every S′-morphism γ : X′ ⟶ Y′ induces a natural transformation ℛes_{S}^{S′}(γ) : ℛes_{S}^{S′}(X′) ⟶ ℛes_{S}^{S′}(Y′) which is given by “push-forward”. This natural transformation corresponds to a morphism Res_{S}^{S′}(γ) : Res_{S}^{S′}(X′) ⟶ Res_{S}^{S′}(Y′). By the universal property of Res_{S}^{S′}(Y′), the morphism in the lowest line of the following commutative diagram exists, is unique and equal to Res_{S}^{S′}(γ).

\xymatrix{ & X′ \ar[rr]^{γ} &  & Y′ \\ Res_{S}^{S′}(X′) ×_{S} S′ \ar[d] \ar[ur]_{u_{X′}} \ar[rr] &  & Res_{S}^{S′}(Y′) ×_{S} S′ \ar[d] \ar[ur]_{u_{Y′}} \\ Res_{S}^{S′}(X′) \ar[rr]^{Res_{S}^{S′}(γ)} &  & Res_{S}^{S′}(Y′)}  (1.3)

Let S = Spec(A), S′ = Spec(B) be affine, where B is a free A-module on the generators α_{1}, …, α_{n}. Let X′ = Spec(B[X_{1}, …, X_{m}]/(f_{1}, …, f_{l})), Y′ = Spec (B[Y_{1}, …, Ym̃]/(g_{1}, …, gl̃)). Let γ : X′ ⟶ Y′ be given by Y_{i} ↦ h_{i}(X_{1}, …, X_{m}). Then γ u_{X′} is given by Y_{i} ↦ h_{i}(α_{1}x_{1,1} + ⋯ + α_{n}x_{1,n}, …, α_{1}x_{m,1} + ⋯ + α_{n}x_{m,n}). Let h_{i,j} be defined by h_{i}(α_{1}x_{1,1} + ⋯ + α_{n}x_{1,n}, …, α_{1}x_{m,1} + ⋯ + α_{n}x_{m,n}) = h_{i,1}α_{1} + … + h_{i,n}α_{n}. Then Res_{S}^{S′}(γ) is given by y_{i,j} ↦ h_{i,j}.

Let S be connected. Let X be an S-scheme and let X′ := X ×_{S} S′. (Again assume that X′ ⟶ S′ fulfills the assumptions of the proposition.) By assumption, the morphism S′ ⟶ S is flat and surjective, thus it is faithfully flat. In particular, it is faithful, i.e. the functor − ×_{S} T is faithful. By Lemma 1.3 the natural transformation Hom(−, X) ↪ ℛes_{S}^{S′}(X) is injective. We get a morphism ι : X ⟶ Res_{S}^{S′}(X′) which is uniquely defined by

id_{X′} = u ∘ (ι ×_{S} id_{S′})  (1.4)

and which is injective on .-valued points.

Lemma 1.5 Let S be connected and let X ⟶ S be separated such that X ×_{S} S′ ⟶ S′ fulfills the assumptions of the proposition. Then ι : X ⟶ Res_{S}^{S′}(X ×_{S} S′) is a closed immersion.

Proof Since X ⟶ S is separated, so is Res_{S}^{S′}(X′) ⟶ S′; see [BLR, 7.6, Proposition 5], under the assumption that X′ is quasi-projective over S′ and S′ ⟶ S is étale, this follows also from the construction of W in the next subsection.

Now (1.4) implies that ι ×_{S} id_{S′} is a closed immersion:

The morphism (of topological spaces) ι×_{S}id_{S′} is injective. Since Res_{S}^{S′}(X′) ⟶ S′ is separated, the subset U′ := {x ∈ Res_{S}^{S′}(X′)| (ι ×_{S} id_{S′}) ∘ u(x) = x} of Res_{S}^{S′}(X′) is closed. If C′ is a closed subset of X′, then ι×_{S}id_{S′}(C′) = U′∩u^{−1}(C′), and since U′ is closed, this is also closed in Res_{S}^{S′}(X′) ×_{S} S′. Thus ι ×_{S} id_{S′} is an injective, closed morphism of topological spaces.

For all x′ ∈ X′, (1.4) induces an isomorphism of local rings

\xymatrix{𝒪_{X′,x′} \ar[r]^{u^{#}} & 𝒪_{X′,(ι×_{S}id_{S′})(x′)} \ar[r]^{(ι×_{S}id_{S′})} & 𝒪_{X′,x′}.}

Thus ι^{#} : 𝒪_{ℛes_{S}^{S′}(X′)×_{S}S′} ⟶ ι^{∗}(𝒪_{X′}) is surjective.

This means that ι ×_{S} id_{S′} is a closed immersion. Since the morphism S′ ⟶ S is faithfully flat, we obtain that ι : X ⟶ Res_{S}^{S′}(X′) is a closed immersion; see [SGA I, VIII, Corollaire 5.5.]. □

1.1.4 The étale case

Now let S be connected and let S′ ⟶ S be an étale covering, i.e. a finite, flat and unramified morphism; see [SGA I, I] for details. (For example, S′ and S could be spectra of fields, and S′ ⟶ S could be induced by a finite separable field extension.)

Let X′ be a quasi-projective S′-scheme. We will give an alternative construction of the Weil-restriction in this case. In this construction we will define a T′-scheme W′ for some Galois covering T′ ⟶ S and a Galois-operation on W′. By [SGA I, V], the quotient scheme of W′ under the Galois-operation exists. This quotient scheme will be the Weil-restriction.

Note that under our assumption that all schemes considered be locally Noetherian, “finite and flat” is equivalent to “finite and locally free”; see [Ha, III, Proposition 9.2. (e)]. Thus we will consider a special case of the situation in Proposition 1.4.

Base-change by étale coverings

Before we come to the construction of the Weil-restriction via Galois-operation, we first fix some notation.

Let T′ be an S-scheme and let σ : T′ ⟶ S′ be an étale covering of S-schemes. ^{2} Then let σ^{−1}(X′) be the T′-scheme defined by the following Cartesian diagram ^{3}

\xymatrix{σ^{−1}(X′) \ar[r] \ar[d] & X′ \ar[d] \\ T′ \ar[r]^{σ} & S′.}  (1.5)

We denote the morphism σ^{−1}(X′) ⟶ X′ in the first row of (1.5) by σ.

Let σ : T′ ⟶ S′, τ : T′ ⟶ T′ be S-morphisms. Then (στ)^{−1}(X′) and τ^{−1}(σ^{−1}(X′)) are naturally isomorphic as S′-schemes. We denote the composition

(στ)^{−1}(X′) ≃ τ^{−1}(σ^{−1}(X′)) ⟶^{τ} σ^{−1}(X′) also by τ.

If σ is an isomorphism, we denote (σ^{−1})^{−1}(X) also by σ(X).

By base-change, an S′-morphism α : X′ ⟶ Y′ induces an S′-morphism α^{σ} : σ^{−1}(X′) ⟶ σ^{−1}(Y′). If σ is an isomorphism, then α^{σ} = σ^{−1}ασ. In this case, we denote α^{σ^{−1}} also by σ(α).

With this definition, p^{σ} : σ^{−1}(X′) ⟶ S′ is the left hand side morphism in (1.5).

Let S = Spec(A), S′ = Spec(B) and T′ = Spec(C) be affine. Let X′ = Spec(B[x_{1}, …, x_{m}]/(f_{1}, …, f_{l})) be affine and of finite type. Then σ : T′ ⟶ S′ is given by an A-morphism σ^{#} : B ⟶ C.

Let σ : T′ ⟶ S′ be as above and extend the morphism σ^{#} : B ⟶ C to an “arithmetic” A-morphism σ^{#} : B[x_{1}, …, x_{m}] ⟶ C[x_{1}, …, x_{m}] given by B ∋ b ↦ σ^{#}(b), x_{i} ↦ x_{i}. Then the diagram

\xymatrix{C[x_{1}, …, x_{m}]/(σ^{#}(f_{1}), …, σ^{#}(f_{l})) & B[x_{1}, …, x_{m}]/(f_{1}, …, f_{l}) \ar[l]_{σ^{#}} \\ C \ar[u] & B \ar[l]^{σ^{#}} \ar[u]}

is co-Cartesian and thus defines the underlying ring of σ^{−1}(X′). If S, S′, T′ or X′ are not affine, σ^{−1}(X′) and the morphisms of diagram (1.5) can be defined like this locally.

2The morphism σ : T′ ⟶ S′ might also be a pro-étale covering, i.e. a projective limit of étale coverings (provided T′ is still locally Noetherian). For example, S′ ⟶ S might be defined by a finite separable extension of fields K|k, and σ : T′ ⟶ S′ might correspond to an inclusion of K into k^{sep}.

3The S′-scheme σ^{−1}(X′) with the morphisms as in the diagram is unique up to a unique S′-isomorphism. In the following we will assume that for all S-schemes S′ and T′, S′-schemes X′ and S-morphisms σ : T′ ⟶ S′ we have chosen such a σ^{−1}(X′).

Note that in the case that σ : T′ ⟶ S′ is an isomorphism, the following diagram is Cartesian.

[figure: X′; X′; S′; σ^{−1}; T′; σ; S′.]  (1.6)

Thus σ^{−1}(X′) is (canonically isomorphic to) X′ regarded as T′-scheme via the structure morphism X′ ⟶ S′ ⟶^{σ^{−1}} T′.

Construction

We now construct the Weil-restriction of X′ with respect to S′ ⟶ S via Galoisoperation. If S′ ⟶ S is itself Galois, the construction is relatively easy and will be described in the next subsection. Here we continue with the general case.

We first need the following lemma which is a generalization of the fact that for every finite separable field extension K|k there exists a splitting field. This means that there exists a finite Galois field extension L|k, included in \overline{k}, such that the image of all inclusions of K|k into \overline{k} is contained in L.

Lemma 1.6 There exists a connected Galois covering f : T′ ⟶ S such that:

Fixing a geometric point P_{0} of S and a geometric point Q_{0} of T′ over P_{0}, every geometric point P′ of S′ over P_{0} defines by Q_{0} ↦ P′ a unique morphism T′ ⟶ S′ over S.

Proof This follows from the construction of the étale fundamental group π_{1}(S, P_{0}); see [SGA I, V,4,g)]. [If S′ is connected, in the terms of the étale fundamental group, S′ ⟶ S corresponds to a conjugacy class in π_{1}(S, P_{0}) of subgroups of finite index. T′ corresponds to the intersection of all subgroups in the conjugacy class. This is a normal subgroup of π_{1}(S, P_{0}) of finite index.] □

Fix such a T′ with Galois group G. This means by definition that there is a fixed injective anti-homomorphism G ↪ Aut_{S}(T′). [Since T′ is connected, this is an isomorphism.] ^{4}

This anti-homomorphism induces a homomorphism G^{opp} ↪ Aut_{S}(T′), where G^{opp} is the opposite group of G (i.e. there is an anti-isomorphism G ⟶^{∼} G^{opp}). We identify G^{opp} with its image.

We denote the elements of G by bold letters and the corresponding elements of the opposite group G^{opp} by usual letters, i.e. we have an injective anti-homo-morphism σ ↦ σ.

4In [SGA I, V], the Galois group operates from the right. Writing all homomorphisms from the left, we obtain an anti-homomorphism G ↪ Aut_{S}(T′).

Let

W′ := ∏_{σ:T ⟶S′} σ^{−1}(X′). ^{5}

For future application, we fix the notation that p_{σ} : W′ ⟶ σ^{−1}(X′) is the projection to the “σ-th” factor.

Now define a Galois-operation of W′ which is compatible with the operation of G on f : T′ ⟶ S as follows:

For τ ∈ G, let τ̃ : ∏_{σ:T′⟶S′} σ^{−1}(X′) ⟶ ∏_{σ:T′⟶S′} σ^{−1}(X′) be defined on .-valued points by (P_{σ})_{σ} ↦ (τ ∘ P_{στ})_{σ}, i.e.

p_{σ} ∘ τ̃ = τ ∘ p_{στ} .  (1.7)

Lemma 1.7 The map G^{opp} ⟶ Aut_{S}(W′), τ ↦ τ̃ is a group-homomorphism.

Proof

τ̃_{1} ∘ (τ̃_{2} ∘ (P_{σ})_{σ}) = τ̃_{1} ∘ (τ_{2} ∘ P_{στ_{2}})_{σ} =
(τ_{1}τ_{2} ∘ P_{στ_{1}τ_{2}})_{σ} = τ̃_{1}τ_{2} ∘ (P_{σ})_{σ}

□

Since we assumed that X′ is quasi-projective, so is W′ and the quotient scheme W := W′/G under this operation exists; see [SGA I, V, Proposition 1.8]. Moreover, since the operation is compatible with the Galois-operation on f : T′ ⟶ S, the quotient scheme is an S-scheme with W ×_{S} T′ ≃ W′.

We now show that W is the Weil-restriction of X′ with respect to S′ ⟶ S. Let Z be some S-scheme. We will establish a functorial bijection between the

Z ×_{S} S′-valued points of the S′-scheme X′ and the Galois invariant Z ×_{S} T′-valued points of the T′-scheme W′. (These points are functorially in bijection with the Z-valued points of W.)

We start with the Z ×_{S} S′-valued points of X′. If P is such a point, then (P^{σ})_{σ} is Galois-invariant. (In fact, for τ ∈ G, τ̃ ∘ (P^{σ})_{σ} ∘ τ^{−1} = (τP^{στ} τ^{−1})_{σ} = (P^{σττ^{−1}})_{σ} = (P^{σ})_{σ}.)

Lemma 1.8 The map P ↦ (P^{σ})_{σ} is an bijection between the Z ×_{S} S′-valued points of X′ and the Galois-invariant Z ×_{S} T′-valued points of W′.

Proof The map is obviously injective. We now show that all Galois-invariant Z ×_{S} T′-valued points of W′ have this form.

Let (P_{σ})_{σ} be a Z ×_{S} T′-valued point of W′. Then this point is Galois invariant iff (τP_{στ} τ^{−1})_{σ} = (P_{σ})_{σ} for all τ ∈ G, i.e. P_{στ} = P_{σ}^{τ} for all τ ∈ G. Assume that this is the case.

5Here and for the rest of the subsection, morphisms are always assumed to be S-morphisms.

Let S′_{i}, i = 1, … be the connected components of S′, ι_{i} : S′_{i} ↪ S′ the immersions. Let σ_{i}^{(0)}, σ_{i}^{(1)}, … be the S-morphisms T ⟶ S′_{i}. The sets {ι_{i}σ_{i}^{(j)} | j = 0, …} are the orbits of the operation of G on the set of σ : T′ ⟶ S′.

Fix some i. We will show that there is some Z ×_{S} S′_{i}-valued point P_{i} of

X′_{i} := ι_{i}^{−1}(X′) with P_{ι_{i}σ_{i}^{(j)}} = P_{i}^{σ_{i}^{(j)}} for all j. By the universal property of the disjoint union, the ι_{i}P_{i} define a morphism P : Z ×_{S} S′_{i} ⟶ X′ with P^{σ} = P_{σ} for all σ : T′ ⟶ S′.

Now, σ_{i}^{(0)} : T′ ⟶ S′_{i} is a connected Galois covering, let H_{i} ≤ G be its Galois group. Then σ_{i}^{(0)}^{−1}(X_{i}) ⟶ X′_{i} and Z ×_{S} T′ ⟶ Z ×_{S} S′_{i} are also Galois with the same Galois group.

For all τ ∈ H_{i}, P_{ι_{i}σ_{i}^{(0)}}^{τ} = P_{ι_{i}σ_{i}^{(0)}τ} = P_{ι_{i}σ_{i}^{(0)}}. Thus P_{ι_{i}σ_{i}^{(0)}} = P_{i}^{σ_{i}^{(0)}} for some

Z ×_{S} S_{i}-valued point P_{i} of X′_{i}. Because G operates transitively on the σ_{i}^{(j)}, we

also have P_{ι_{i}σ_{i}^{(j)}} = P_{i}^{σ_{i}^{(j)}} for all j. □

We have thus seen that W is the Weil-restriction of X′ with respect to S′ ⟶ S. The Weil-restriction is again quasi-projective, and if X′ is projective, it is also projective. In Subsection 1.2.1, we will show that if we fix some immersion of X′ into a projective space, W is immersed in some concrete higher-dimensional projective space, the immersion being canonical up to an isomorphism of the surrounding projective space.

After we have constructed W, equation (1.7) can be reinterpreted by

p_{σ}^{τ} = p_{στ}  (1.8)

or – what is the same –

τ(p_{σ}) = p_{στ^{−1}}.  (1.9)

Let u : W ⟶ X′ be the universal morphism. Then by definition, u corresponds to the identity on W, which is of course given by (p_{σ})_{σ} : W′ ⟶ W′. It follows that

u^{τ} = p_{τ} .  (1.10)

By construction, W is quasi-projective and in particular separated. Many other properties of X′ carry over to W′ and then to W:

Lemma 1.9 Let S be connected and let h : S′ ⟶ S be étale. Let X′ be a quasiprojective S′-scheme and let W be the Weil-restriction of X′ with respect to h. Then

• If X′ is projective, so is W.

• If X′ is of finite type, so is W.

• If X′ is reduced, so is W.

• If X′ is flat, so is W.

• If X′ is smooth, so is W.

Lemma 1.10 Let h : S′ ⟶ S be given by a separable finite extension of fields. Then

• If X′ is geometrically irreducible, so is W.

• If X′ is geometrically reduced, so is W.

□

We now review the Weil-restriction as a functor. Let γ : X′ ⟶ Y′ be an S′-morphism. By diagram (1.3), Res_{S}^{S′}(γ) : Res_{S}^{S′}(X′) ⟶ Res_{S}^{S′}(Y′) is the morphism which corresponds to the Res_{S}^{S′}(X′) ×_{S} S′-valued point γu of X′.

By the above construction, especially (1.10), this is given by

Res_{S}^{S′}(γ) ×_{S} T′ = ((γu)^{σ})_{σ} = (γ^{σ}p_{σ})_{σ} : ∏_{σ} σ^{−1}(X′) ⟶ ∏_{σ} σ^{−1}(Y′). (1.11)

Let h : S′ ⟶ S still be étale. Let n be the degree of h (i.e. the number of geometric points over some geometric point of S).

Let X be a quasi-projective S-scheme, X′ := X ×_{S} S′.

The quasi-projective S-scheme X is in particular separated, and by Lemma 1.5, the injective natural transformation Hom_{S}(−, X) ↪ ℛes_{S}^{S′}(X′) corresponds to a closed immersion ι : X ⟶ Res_{S}^{S′}(X′). After a base change T′ ⟶ S as above, Res_{S}^{S′}(X′) is isomorphic to X_{T′}^{n}, and ι ×_{S} id_{T′} = (id)_{i=1}^{n} : X_{T′} ⟶ X_{T′}^{n}. This shows again that ι×_{S} id_{T′} is a closed immersion, and as S′ ⟶ S is faithfully flat, so is ι : X ⟶ Res_{S}^{S′}(X′).

1.1.5 The Galois case

We now restrict ourselves to the case that the base-morphism S′ ⟶ S is Galois.

Let h : S′ ⟶ S be Galois with Galois group G. Again let X′ be a quasiprojective S′-scheme. Then the “geometric construction” of the Weil-restriction becomes much easier:

Let W′ := ∏_{σ∈G^{opp}} σ^{−1}(X′). As above, define a Galois-operation on W′ by τ ↦ τ̃ where τ̃: (P_{σ})_{σ∈G^{opp}} ↦ (τ ∘ P_{στ})_{σ∈G^{opp}}.

Since by assumption X′ and thus also W′ is quasi-projective, the quotient scheme W := W′/G exists; see [SGA I, V, Proposition 1.8]. We will now show that W which universal element u := o_{id} is the Weil-restriction of W′ with respect to S′ ⟶ S.

Fix some S-scheme Z. Then the Z ×_{S} S′-valued points of W′ which are Galois-invariant are exactly the points of the form (P_{σ})_{σ∈G^{opp}} = (P^{σ})_{σ∈G^{opp}} = (σ^{−1}(P))_{σ∈G^{opp}}, where P is a Z ×_{S} S′-valued point of X′.

Thus P ↦ (σ^{−1}(P))_{σ∈G^{opp}} is a bijection between the Z ×_{S} S′-valued points of X′ and the Galois-invariant Z ×_{S} S′-valued points of W′. On the other hand, by Galois theory the Galois-invariant Z ×_{S} S′-valued points of W′ are in bijection with the Z-valued points of W.

The bijection between the Z ×_{S} S′-valued points of X′ and the Z-valued points of W is natural in Z. Moreover, the identity of W corresponds to the projection p_{id} from W′ to X’.

So, W = W′/G with universal element u = p_{id} is the Weil-restriction for X′ with respect to S′ ⟶ S.

Remark This construction is of course closely related to the construction in the étale case. For example, equations (1.7) to (1.11) still hold. However, the two constructions are only equal if S′ is connected.

Comparison

Again let S′ ⟶ S be Galois with Galois group G and let X′ be a quasi-projective S′-scheme. We show how the first construction arises in a natural way if one tries to find W starting from W′ and the Galois action.

Since a Galois covering is by definition étale and finite, it is also locally free (finite and flat is equivalent to finite and locally free [Ha, III, Proposition 9.2.]).

Assume that S = Spec(A), S′ = Spec(B) and X′ are affine and that B is free over A, B = α_{1}A ⊕ ⋯ ⊕ α_{n}A and X′ =Spec(B[X_{1}, …, X_{m}]/(f_{1}, …, f_{l})) as in the “Formal construction” of Subsection 1.1.3. This presentation of X′ defines a closed immersion X′ ↪ 𝔸_{B}^{m}, and if we fix this immersion, σ^{−1}(X) is also immersed in 𝔸_{B}^{m}, and W′ = ∏_{σ∈G^{opp}} σ^{−1}(X′) is a closed immersion of 𝔸_{B}^{m}^{G^{opp}} = Spec(B[{x_{i,σ}}_{i=1,...,m, σ∈G^{opp}}]). The closed immersion of W′ is defined by the presentation B[{x_{i,σ}}_{i=1,...,m, σ∈G^{opp}}]/((σ^{#}(f_{i}))(x_{1,σ}, …, x_{m,σ})_{i=1,...,l, σ∈G^{opp}}) of Spec(W′).

We try to find an affine A-scheme W and a B-isomorphism ρ : W ⊗_{A} B ≈ W′ where under the isomorphism ρ, the Galois-operation on W′ corresponds to the natural operation of W ⊗_{A} B induced by the operation G on B. If we have such an isomorphism, W with p_{id} ∘ ρ as universal element is the Weil-restriction of X′ with respect to S′ ⟶ S. (Unique up to a unique isomorphism.)

We think of W′ with its concrete representation as immersed in 𝔸_{𝔹}^{m}^{G^{opp}}. We are searching for a closed subscheme W^{∗} of some affine B-space which is as closed subscheme defined over A and an isomorphism between W^{∗} and W′ which is Galois-invariant. (Where the Galois-operation on W^{∗} is the one induced by the canonical one of the affine space.)

We know already that Res_{A}^{B}(X′) ⊗_{A} B as constructed in Subsection 1.1.3 is such an affine scheme. It is embedded in 𝔸_{B}^{mn}. The coordinate ring of 𝔸_{B}^{m}^{G^{opp}} is the free B-algebra on x_{i,σ}, i = 1, …, m, σ ∈ G^{opp} and the coordinate ring of 𝔸_{B}^{mn} is the free B-algebra on x_{1,1}, …, x_{m,n}.

The invertible matrix

( σ^{#}(α_{1}) ; ⋮ ; σ^{#}(α_{n}) )_{σ∈G^{opp}}

defines an isomorphism

\begin{matrix}ρ^{#} : B[\{x_{i,σ}\}_{i=1,...,m, σ∈G^{opp}}] ⟶ B[\{x_{i,j}\}_{i=1,...,m, j=1,...,n}] \\ x_{i,σ} ↦ σ^{#}(α_{1})x_{i,1} + ⋯ + σ^{#}(α_{n})x_{i,n}. \end{matrix}

And this induces an isomorphism

ρ : 𝔸_{B}^{mn} ⟶ 𝔸_{B}^{m}^{G^{opp}}.

Let i = 1, …, l. Then under ρ^{#}, σ^{#}(f_{i})(x_{1,σ}, …, x_{m,σ}) is mapped to σ^{#}(α_{1})f_{i,1} + ⋯ + σ^{#}(α_{n})f_{i,n}, where the f_{i,j} are defined as in Subsection 1.1.3. As the matrix (α_{i,σ})_{i,σ} is invertible, the ideal generated by these elements for all σ ∈ G^{opp} equals the ideal generated by f_{i,1}, …, f_{i,n}. Therefore, the ideal generated by (σ^{#}(f_{i}))(x_{1,σ}, …, x_{m,σ}) for i = 1, …, l, σ ∈ G^{opp} is mapped to the ideal generated by f_{i,j} for i = 1, …, l, j = 1, …, n.

Thus ρ identifies the Weil-restriction W′ with Res_{A}^{B}(X′) ⊗_{A} B as constructed in Subsection 1.1.3. It is also Galois invariant, as can be seen as follows:

ρ^{#}τ^{#}(x_{i,σ}) = ρ^{#}(x_{i,στ}) = τ^{#}σ^{#}(α_{1})x_{i,1} + ⋯ + τ^{#}σ^{#}(α_{n})x_{i,n} = τ^{#}ρ^{#}(x_{i,σ})

Arithmetic becomes geometric operation

Let S′ ⟶ S be Galois with Galois group G. ^{6} Let X be a quasi-projective S-scheme, X′ := X ×_{S} S′. For τ ∈ G^{opp}, let

s_{τ} : W′ = X′^{G^{opp}} ⟶ W′ = X′^{G^{opp}}

be given on .-valued points by

(P_{σ})_{σ∈G^{opp}} ↦ (P_{στ})_{σ∈G^{opp}}.

Then the Galois-operation on W_{S′} = W′ = X′^{G^{opp}} is given by τ ↦ τ̃ = τs_{τ} = s_{τ} τ. where τ : X′^{G^{opp}} ⟶ X′^{G^{opp}} is the “canonical” arithmetical operation induced by base-change from S′ ⟶ S.

For any S-scheme Z, G operates on ℛes_{S}^{S′}(X′)(Z) = Hom_{S′}(Z ×_{S} S′, X ×_{S} S′) by

τ(P) = τP τ^{−1}.

6For the moment and the next Lemma, S′ ⟶ S might also be a pro-Galois covering.

These operations define an automorphism of the functor ℛes_{S}^{S′}(X′) which we denote again by τ, and G^{opp} ⟶ Aut(ℛes_{S}^{S′}(X′)) is a group-homomorphism. Let ℛes_{S}^{S′}(X′)(Z)^{G} be the set of Galois-invariant elements, and let ℛes_{S}^{S′}(.)^{G} be the functor defined by ℛes_{S}^{S′}(X′)^{G}(Z) := ℛes_{S}^{S′}(X′)(Z)^{G}.

Lemma 1.11 The inclusion Hom_{S}(−, X) ↪ ℛes_{S}^{S′}(X′) induces a bijection

Hom_{S}(−, X) ≅ ℛes_{S}^{S′}(X′)^{G},

natural in X.

□

The automorphism τ of the functor ℛes_{S}^{S′}(X′) defines an S-automorphism of the representing object Res_{S}^{S′}(X′) which we denote by a_{τ}.

We want to calculate how a_{τ} operates on Res_{S}^{S′}(X_{S′}) ×_{S} S′ ≅ ∏_{σ∈G^{opp}} X_{S′} = X_{S′}^{G^{opp}}.

We have τ(u) = τ(p_{id}) = p_{τ^{−1}} by (1.8). The S-morphism a_{τ} of Res_{S}^{S′}(X′) is the Res_{S}^{S′}(X′)-valued point of Res_{S}^{S′}(X′) which corresponds to τ(u). So a_{τ} = (τ(u)^{σ})_{σ∈G^{opp}} = ((p_{τ^{−1}})^{σ})_{σ∈G^{opp}} = (p_{τ^{−1}σ})_{σ∈G^{opp}} (The last equation is again (1.8).)

Lemma 1.12 a_{τ} operates on .-valued points by (P_{σ})_{σ∈G^{opp}} ↦ (P_{τ^{−1}σ})_{σ∈G^{opp}}. In particular, the group-homomorphism G ⟶ Aut(ℛes_{S}^{S′}(X′)) ≃ Aut_{S}(Res_{S}^{S′}(X′)) is injective.

Compare this operation with the operation of s_{τ}!

Let X be a group-scheme. Then the map P ↦ ∑_{σ∈G^{opp}} σ(P) defines a natural transformation ℛes_{S}^{S′}(X′) ⟶ ℛes_{S}^{S′}(X′)(.)^{G} and thus by Lemma 1.11 a morphism

ℛes_{S}^{S′}(X′) ⟶ Hom_{S}(−, X),  (1.12)

which is natural in X. The composition Hom_{S}(−, X) ↪ ℛes_{S}^{S′}(X′) ⟶ Hom_{S}(−, X) is given by multiplication with |G|.

1.2 Pull-back of sheaves to the Weil-restriction

1.2.1 Pull-back of modules

Let S be connected and S′ ⟶ S étale, X′ a quasi-projective S′-scheme, W = Res_{S}^{S′}(X′). Let T′ be as in Lemma 1.6 so that W_{T′} ≃ ∏_{σ} σ^{−1}(X′).

Let ℒ be an quasi-coherent 𝒪_{X′}-module on X′. Then ℒ_{W_{T′}} := ⨂_{σ} p_{σ}^{∗}σ^{∗}(ℒ) is an 𝒪_{W_{T′}} -module with

τ^{−1 ∗} ⨂_{σ} p_{σ}^{∗}σ^{∗}(ℒ) ≃ ⨂_{σ} τ^{−1 ∗}p_{σ}^{∗}σ^{∗}(ℒ) ≃^{(1.7)} ⨂_{σ} p_{στ^{−1}}^{∗}τ^{−1 ∗}σ^{∗}(ℒ) ≃

⨂_{σ} p_{στ^{−1}}^{∗}(στ^{−1})^{∗}(ℒ) ≃ ⨂_{σ} p_{σ}^{∗}σ^{∗}(ℒ).

Let w_{τ} be the isomorphism from right to left. Then τ ↦ w_{τ} defines a 1-cocycle-datum for the 𝒪_{W_{S′}} -module ℒ_{W_{S′}}. Thus ℒ_{W_{S′}} is a G-sheaf. Now, by Proposition A.30, it “descends” to an 𝒪_{X′}-module ℒ_{W} on W.

This module is (up to unique isomorphism) independent of the choice of T′. For, assume the construction was performed with two different f_{1} : T′_{1} ⟶ S, f_{2} : T′_{2} ⟶ S. Call the resulting sheaves ℒ_{W}^{(1)} and ℒ_{W}^{(2)}. Then there exists a f_{3} : T′_{3} ⟶ S (again Galois and connected) such that f_{3} factors through f_{1} and f_{2}. Now the pull-backs of ℒ_{W}^{(1)} and ℒ_{W}^{(2)} to W ×_{S} T′_{3} are naturally isomorphic and thus so are ℒ_{W}^{(1)} and ℒ_{W}^{(2)}.

Let S and thus S′ be affine. By construction, if ℒ is a very ample invertible sheaf, then ℒ_{W_{T′}} = ⨂_{σ} p_{σ}^{∗}σ^{∗}(ℒ) is very ample and so is ℒ_{W}. Since a sheaf is ample, if some power is very ample, ℒ_{W} is ample, if ℒ is ample.

The canonical embedding

Now let S′ ⟶ S be defined by a finite, separable extension of fields K|k of degree n, let L|K be a splitting field of K|k, and denote the Galois group of L|k by G. Let X′ be a separated quasi-projective K-scheme with a fixed immersion X′ ⟶ ℙ_{K}^{m}.

Then for σ : Spec(L) ⟶ Spec(K) (over Spec(k)), σ^{−1}(X) is immersed in ℙ_{L}^{m}, and via the Segre-embedding, W_{L} is immersed in ℙ_{L}^{(m+1)^{n}−1}. – We want to show that W is also immersed in (m + 1)^{n} − 1-dimensional projective space. ^{7}

The immersion X′ ⟶ ℙ_{K}^{m} corresponds to a very ample sheaf ℒ with global sections M_{0}, …, M_{m} which generate ℒ. The ring Γ(X, ℒ) is included in Γ(σ^{−1}(X), σ^{∗}(ℒ)). If we identify Γ(X, ℒ) with its image, the M_{i} are again global sections which generate σ^{∗}(ℒ).

Let i run through all maps

(Spec(L) ⟶ Spec(K) (over Spec(k)) ⟶ {0, …, m}, σ ↦ i_{σ}.

Then the M_{i} are global sections of σ^{∗}(ℒ) which generate the sheaf. The Segreembedding is defined by the (m + 1)^{n} global sections ⊗_{σ}M_{i_{σ}} of ℒ_{W_{L}} = ⨂_{σ} σ^{∗}(ℒ), which generate the sheaf.

7The following argumentation is inspired by A.Weil’s original use of the Weil-restriction in [We-F].

Now, Γ(W, ℒ_{W}) is included in Γ(W_{L}, ℒ_{W_{L}}), and we want to find (m + 1)^{n} global sections of ℒ_{W} such that all ⊗_{σ}M_{i_{σ}} are linear combinations of these (and vice versa).

The L-module ℒ_{W_{L}} is isomorphic to the pull-back of ℒ_{W} to W_{L}. For the following argumentation we will identify these two sheaves on W_{L}. There is a Galois-operation on Γ(W_{L}, ℒ_{W_{L}}) and

Γ(W_{L}, ℒ_{W_{L}})^{G} = Γ(W, ℒ_{W}).

(See the remark following Proposition A.30 for details.) Conversely,

Γ(W_{L}, ℒ_{W_{L}}) ≃ Γ(W, ℒ_{W}) ⊗_{k} L

Here we use that “taking global sections commutes with flat base-change”, i.e cohomology commutes with flat base-change” for the special case of 0-dimensional cohomology groups; see [Ha, III, Proposition 9.3].

More generally, if H is any subgroup of G and L^{H} the corresponding fixed field,

Γ(W_{L}, ℒ_{W_{L}})^{H} ≃ Γ(W, ℒ_{W}) ⊗_{k} L^{H}.  (1.13)

Call the (m + 1)^{n} global sections ⊗_{σ}(M_{i_{σ}}) of ℒ_{W_{L}} P_{l}, l = 1, …, (m + 1)^{n}. The Galois group G operates on the set of P_{l}.

For some l, let G_{l} be the stabilizer of P_{l} in G, k_{l} the fixed field of G_{l} in L, let [k_{l} : k] = d. Choose a basis β_{1}, …, β_{d} of k_{l}|k. Then by (1.13), there exist Q_{1}^{(l)}, …, Q_{d}^{(l)} ∈ Γ(W, ℒ_{W}) with

P_{l} = ∑_{j=1}^{d} β_{j} Q_{j}^{(l)}.

For σ ∈ G, let σ^{#} denote the corresponding operation on ℒ_{W_{L}}. The orbit of P_{l} under G has exactly d elements and τ^{#}(P_{l}) = ∑_{j=1}^{d} τ^{#}(β_{j}) Q_{j}^{(l)} for all τ ∈ G.

Choose from every orbit of the operation of G on the set of L_{l} one representative. Call this set P_{l_{1}}, P_{l_{2}}, . . .. Then the Q_{j}^{(l_{i})} are (m + 1)^{n} global section of ℒ_{W} which span the same linear space in Γ(W_{L}, ℒ_{W_{L}}) as the P_{l} do.

We obtain an immersion W ⟶ ℙ_{k}^{(m+1)^{n}−1} which is canonical up to an isomorphism of ℙ_{k}^{(m+1)^{n}−1}. Moreover, after base-change and identification of W_{L} with ∏_{σ∈G} σ^{−1}(X), this immersion is up to an isomorphism of ℙ_{k}^{(m+1)^{n}−1} the Segre embedding.

Proposition 1.13 Let K|k be a finite separable extension of fields. Let X′ be a separated quasi-projective K-scheme with a fixed immersion X′ ⟶ ℙ_{K}^{m}. Then the Weil-restriction of X′ with respect to K|k is immersed in ℙ_{k}^{(m+1)^{n}−1}. This immersion is canonical up to an isomorphism of ℙ_{k}^{(m+1)^{n}−1}.

Pull-back of Weil-divisors

Let K|k be a separable field extension, let L|k be a splitting field. Let X′ be a nonsingular k-variety. Then Weil-divisor classes correspond to classes of invertible sheaves. Let the invertible sheaf ℒ by defined by the effective Weil divisor B which we regard as (not necessarily reduced) closed subscheme of X′. Then by Proposition A.29, the sheaf ℒ_{W_{L}} is defined by the closed subscheme D := ∑_{σ} p_{σ}^{−1}σ^{−1}(B). The operation of σ̃ on W′_{L} induces an operation on D. The immersion D ⟶ W_{L} is now invariant under this operation, and D descends. It defines the sheaf ℒ(B)_{W} on W.

1.2.2 The Picard functor and the Picard scheme

We include the following subsection mainly for notational reasons.

Let k be a field, let X be a geometrically integral non-singular projective kvariety with a k-rational point P_{0}.

Definitions We denote the isomorphism class of an invertible sheaf ℒ on some k-scheme by \overline{ℒ}. For any scheme Y, the isomorphism classes of invertible sheaves on Y form a set, and with the operation of the tensor product, this set is an abelian group, the so-called Picard group of Y, denoted Pic(Y).

Let 𝒫ic(X) be the contravariant group-functor which is defined as follows: For any k-scheme Z, let p_{Z} : X×_{k}Z ⟶ Z be the projection. Let 𝒫ic(X)(Z) :=

Pic(X ×_{k} Z)/p_{Z}^{∗}Pic(Z). We will denote this quotient by Pic(X ×_{k} Z)/Pic(Z) and its elements by \overline{\overline{ℒ}}, \overline{\overline{ℳ}}, etc.

For any morphism α : Y ⟶ Z, 𝒫ic(X)(α) is defined by (id_{X} ×_{k} α)^{∗} : Pic(X ×_{k} Z)/Pic(Z) ⟶ Pic(X ×_{k} Y)/Pic(Y). (Consistently, we would have to write \overline{(id_{X} ×_{k} α)^{∗}} or even more accurately \overline{\overline{(id_{X} ×_{k} α)^{∗}}} but we omit the bar.)

Note that p_{Z} ∘ (P_{0} ×_{k} id_{Z}) = id_{Z} implies that (P_{0} ×_{k} id_{Z})^{∗} ∘ p_{Z}^{∗} = id_{Pic(Z)}. Thus Pic(X ×_{k} Z)/p_{Z}^{∗}Pic(Z) is functorially isomorphic to the subgroup of \overline{ℳ} ∈ Pic(X ×_{k} Z) such that (P_{0} ×_{K} id_{Z})^{∗}(\overline{ℳ}) = 0.

The association X ↦ 𝒫ic(X) defines a contravariant functor from the category of punctured geometrically integral projective k-varieties to the category of contravariant functors from the category of k-schemes to the category of abelian groups. If α : X ⟶ Y is a morphism, we denote 𝒫ic(α) : 𝒫ic(Y) ⟶ 𝒫ic(X) by α^{∗}.

Proposition 1.14 Under the above conditions on X, 𝒫ic(X) is represented by a k-group-scheme Pic(X) which is locally of finite type.

Proof First see [BLR, 8.1, Proposition 4] and then [BLR, 8.2, Theorem 3]. □

Let \overline{𝒫} ∈ Pic(X ×_{k} Pic(X)) be a representative of the universal element \overline{\overline{𝒫}} ∈ Pic(X ×_{k} Pic(X))/Pic(Pic(X)).

Let 𝒫ic^{0}(X) be defined by: For any k-scheme Z, let 𝒫ic^{0}(X)(Z) be the subgroup of \overline{\overline{ℳ}} ∈ 𝒫ic(X)(Z) for which there exists a connected k-scheme T with two Zrational points α, β : Z ⟶ T and an \overline{\overline{𝒩}} ∈ 𝒫ic(X)(T) such that (id_{X} ×_{k}α)^{∗}(\overline{\overline{𝒩}}) = 0 and (id_{X} ×_{k} β)^{∗}(\overline{\overline{𝒩}}) = \overline{\overline{ℳ}}.

Definition The Picard scheme Pic^{0}(X) is the identity component of Pic(X).

It is immediate that Pic^{0}(X) with the restriction of \overline{\overline{𝒫}} represents 𝒫ic^{0}(X). We denote the restriction of \overline{𝒫} still by \overline{𝒫}.

Because Pic^{0}(X) has a k-rational point, it is also geometrically connected; see Lemma A.28.

Proposition 1.15 Again under the above conditions on X, Pic^{0}(X) is a projective k-group-scheme.

Proof See [BLR, 8.4, Theorem 3]. □

In the case that X is a curve, the Picard scheme is geometrically reduced, thus it is an abelian variety, called the Jacobian variety of X, denoted in this work by J(X); see [Mi-J] for a detailed account about the Jacobian variety.

Base change

Let k ⟶ λ be a morphism of fields. Then X_{λ} has a λ-rational point, and for all λ-schemes Z, Pic(X_{λ} ×_{λ} Z)/Pic(Z) ≃ Pic(X ×_{k} Z)/Pic(Z), therefore 𝒫ic(X_{λ}) ≃ 𝒫ic(X)_{λ}.

Let \overline{𝒫} ∈ Pic(X ×_{k} Pic(X)) be the representative of the universal element defined above, let \overline{𝒫_{λ}} be the pull-back of \overline{𝒫} to Pic(X ×_{k} Pic(X)⊗_{k} λ) ≃ Pic(X_{λ} ×_{λ} Pic(X)_{λ}). This represents an element \overline{\overline{𝒫_{λ}}} ∈ Pic(X_{λ} ×_{λ} Pic(X)_{λ})/Pic(Pic(X)_{λ}). With this element, 𝒫ic(X_{λ}) is represented by Pic(X)_{λ}.

An important special case of this is the following:

Let K|k be a Galois field extension, σ ∈ Gal(K|k). Let X′ be a non-singular projective K-variety with a K-rational point. Consider X′/K and the corresponding automorphism σ : Spec(K) ⟶ Spec(K) as a special case of the above result. It follows that 𝒫ic(σ^{−1}(X′)) is represented by (σ^{−1}(Pic(X′)), σ^{∗}(\overline{\overline{𝒫}})), and analogously, 𝒫ic^{0}(σ^{−1}(X′)) is represented by σ^{−1}(Pic(X′)^{0}).

1.2.3 The Picard functor of the Weil-restriction

In this subsection we study the relationship between the Picard-functor and the Weil-restriction.

Let K|k be a finite Galois field extension, X a geometrically integral, nonsingular, projective k-variety with a k-rational point.

Since Pic(X) is the disjoint union of projective schemes, its Weil-restriction exists. By Lemma 1.11, we have a natural transformation

Hom_{k}(−, Pic(X)) ≃ ℛes_{k}^{K}(Pic(X)_{K})^{G} ≃ ℛes_{k}^{K}(Pic(X_{K}))^{G},  (1.14)

and by (1.12) we have a morphism

ℛes_{k}^{K}(Pic(X_{K})) ⟶ Hom_{k}(−, Pic(X))  (1.15)

We define a Galois-operation on the functor ℛes_{k}^{K}(𝒫ic(X_{K})): For σ ∈ G, let σ : X ×_{k} Z ⊗_{k} K ≃ (X ⊗_{K} ×_{K}Z_{K}) be the “natural” operation induced by basechange, i.e. σ = id_{X}×_{k}id_{Z}×_{k}σ or – what is the same – σ = (id_{X}×_{k}σ)×_{K}(id_{Z}×_{k}σ). Now let σ ∈ G operate on Pic(X ×_{k} Z ⊗_{k} K))/Pic(Z ⊗_{k} K) ≃ Pic((X ⊗_{k} K) ×_{K} (Z ⊗_{k} K))/Pic(Z ⊗_{k} K) by σ^{−1}^{∗}.

Lemma 1.16 The Galois-operation on ℛes_{k}^{K}(Pic(X_{K})) corresponds to the Galois-operation on the functor ℛes_{k}^{K}(𝒫ic(X_{K})).

Proof Let \overline{𝒫_{K}} ∈ Pic(X_{K} ×_{K} Pic(X)_{K}) be the representative of the universal element of 𝒫ic(X_{K}) constructed above. Then \overline{𝒫_{K}} by construction is invariant under the Galois-operation.

Let α : Z ⊗_{k} K ⟶ Pic(X_{K}) be a K-morphism, σ ∈ G. Then by definition, id_{X_{K}} ×_{K} σ(α) = σ ∘ (id_{X_{K}} ×_{K} α) ∘ σ^{−1}. Thus

(id_{X_{K}} ×_{K} σ(α) )^{∗} (\overline{\overline{𝒫_{K}}}) = σ^{−1}^{∗} (id_{X_{K}} ×_{K} α)^{∗} σ^{∗} (\overline{\overline{𝒫_{K}}}) =
σ^{−1}^{∗} (id_{X_{K}} ×_{K} α)^{∗} (\overline{\overline{𝒫_{K}}})

□

Let q_{K} : X_{K} ⟶ X be the projection. Then it follows from (1.14) that q_{K}^{∗} induces an isomorphism

q_{K}^{∗} : 𝒫ic(X) ˜ ⟶ℛes_{k}^{K}(𝒫ic(X_{K}))^{G}.  (1.16)

Note that this means in particular that every sheaf on X_{K} whose isomorphism class is invariant under G descends to a sheaf on X. This is a stronger statement than Galois-descent of quasi-coherent modules.

Let \overline{\overline{ℳ′}} ∈ ℛes_{k}^{K}(𝒫ic(X_{K}))(Z) = 𝒫ic(X_{K})(Z ×_{k} K). Then ∑_{σ∈G^{opp}} σ^{∗}(\overline{\overline{ℳ′}}) ∈ ℛes_{k}^{K}(𝒫ic(X_{K}))^{G}, thus there exists an \overline{ℳ} ∈ 𝒫ic(X)(Z) with (q_{K}×_{k}id_{Z})^{∗}(\overline{\overline{ℳ}}) = \overline{\overline{ℳ′}}.

Definition We call the element \overline{\overline{ℳ}} just defined the norm of \overline{\overline{ℳ′}} and denote it by N(\overline{\overline{ℳ′}}). ^{8}

We get a natural transformation

𝒩 : ℛes_{k}^{K}(𝒫ic(X_{K})) ⟶ 𝒫ic(X),

which we also call norm.

Via the representing objects, this natural transformation corresponds to (1.15).

8In [EGA II, 6.5], the norm of an invertible sheaf is defined in a more general situation. Note however that our definition applies for classes of sheaves.

Now let X′ be any geometrically integral, non-singular, projective K-variety with a K-rational point P_{0}, let W = Res_{k}^{K}(X′) be the Weil-restriction of X′ with respect to K|k. By definition of W, it has a k-rational point.

Consider the natural transformation

\xymatrix{𝒯 : ℛes_{k}^{K}(𝒫ic(X′)) \ar[r]^{ℛes_{k}^{K}(u^{∗})} & ℛes_{k}^{K}(𝒫ic(W_{K})) \ar[d]^{\overline{\overline{ℳ′}} ↦⨂_{σ∈G^{opp}} σ^{∗}(\overline{\overline{ℳ′}} )} \ar[dd]_{𝒩} \\  & ℛes_{k}^{K}(𝒫ic(W_{K}))^{G} \ar[d]_{∼}^{_{q_{K}^{∗}_{−1}}} \\  & 𝒫ic(W).}  (1.17)

Lemma 1.17 𝒯 is injective.

Proof Let Z be a k-scheme. Then τ ∈ G operates on Pic(W_{K} ×_{K} Z_{K}) ≃ Pic(W ×_{k} Z ⊗_{k} K) by τ^{−1∗}. (Where τ is the “natural” operation on W ×_{k} Z ⊗_{k} K.)

Now (W ×_{k} Z)_{K} ≃ ∏_{σ} σ^{−1}(X′ ×_{K} Z_{K}). Under this isomorphism, τ operates on Pic(∏_{σ} σ^{−1}(X′ ×_{K} Z_{K})) by τ^{−1∗}, where τ̃ is the “twisted” operation as in the construction of the Weil-restriction in the Galois case.

Under the identification of (W ×_{k}Z)_{K} with ∏_{σ} σ^{−1}(X′×_{K}Z_{K}), ∑_{σ∈G^{opp}} σ^{∗}(.)∘ ℛes_{k}^{K}(u^{∗}) : ℛes_{k}^{K}(𝒫ic(X′))(Z) ⟶ ℛes_{k}^{K}(𝒫ic(W_{K}))^{G}(Z) is given by

Pic(X′ ×_{K} Z_{K})/Pic(Z_{K}) ⟶ (Pic( ∏_{σ∈G^{opp}} σ^{−1}(X′ ×_{K} Z_{K}))/Pic(Z_{K}))^{G}

\overline{\overline{ℳ}} ↦ ∑_{σ∈G^{opp}} σ^{∗}(p_{id}^{∗}(\overline{\overline{ℳ}})) = ∑_{σ∈G^{opp}} p_{σ}^{∗}(σ^{∗}(\overline{\overline{ℳ}})).

By assumption X′ has a K-rational point P_{0}, and σ^{−1}(P_{0}) is a k-rational point of σ^{−1}(X′). These rational points define a closed immersion ι = (ι_{σ})_{σ} : X′ ⟶ ∏_{σ} σ^{−1}(X′), given by ι_{id} = id_{X′}, ι_{σ} = σ^{−1}(P) for σ ≠ id. Now (ι ×_{k} id_{Z})^{∗} ∘ ∑_{σ∈G^{opp}} σ^{∗}(.) ∘ (u ×_{k} id_{Z})^{∗} is the identity on ℛes_{k}^{K}(𝒫ic(X′))(Z). □

The functor 𝒯 restricts to a natural transformation 𝒯 : ℛes_{k}^{K}(𝒫ic^{0}(X′)) ⟶ 𝒫ic^{0}(ℛes_{k}^{K}(X′)), and this induces a morphism between the corresponding representing objects.

T : Res_{k}^{K}(Pic^{0}(X′)) ⟶ Pic^{0}(Res_{k}^{K}(X′))

After the base change K|k, T becomes the canonical morphism

U : ( ∏_{σ∈G^{opp}} σ^{−1}(Pic^{0}(X′)) ⟶ Pic^{0}( ∏_{σ∈G^{opp}} σ^{−1}(X′))),

induced by p_{σ}^{∗} : σ^{−1}(Pic^{0}(X′)) ⟶ Pic^{0}(∏_{σ} σ^{−1}(X′)).

We are interested whether 𝒯 or – what is the same – T is an isomorphism. We only have to check this for U or U ⊗_{K} id\overline{K}.

The phrase “smooth proper global lifting” used in the following theorem is defined in Subsection A.1.1. Under this condition, U ⊗_{K} id\overline{K} is an isomorphism of abelian varieties; see Proposition A.4. It thus follows the following theorem.

Theorem 1 Let K|k be a finite Galois field extension, let X′ be an integral nonsingular projective K-variety with a K-rational point. Assume that char(k) = 0 or that X′ ; \overline{K} has a smooth proper global lifting. Then T : Res_{k}^{K}(Pic^{0}(X′)) ⟶ Pic^{0}(Res_{k}^{K}(X′)) is an isomorphism of abelian varieties.

Corollary 1.18 Let X′ be a geometrically integral non-singular projective Kcurve with a K-rational point. Then T is an isomorphism of abelian varieties.

Proof If char(k) > 0, every such curve has a smooth, proper global lifting; see [Po, Satz 10.1]. □

Corollary 1.19 Let X′ be a curve as above. Then N ∘ u^{∗} : Pic^{0}(X′) ⟶ Pic^{0}(Res_{k}^{K}(X′)) is an isomorphism.

1.3 Weil-restrictions of abelian varieties

In this section, we study first properties of the Weil-restriction of abelian varieties with respect to a finite separable field extension. In the next chapter, we will study the Weil-restriction of old abelian varieties – i.e. abelian varieties which are defined over k – more in depth.

Let K|k be a separable extension of fields, A′ an abelian K-variety. Let W be the Weil-restriction of A′ with respect to K|k. Then

W_{k^{sep}} ≃ ∏_{σ : Spec(k^{sep}) ⟶ Spec(K) (over Spec(k))} σ^{−1}(A′),

thus W is also an abelian variety.

1.3.1 Weil-Restrictions and dual abelian varieties

Let K|k be Galois, A′ an abelian K-variety.

Since the product of a dual abelian variety of a product of abelian varieties is the product of the duals, the morphism U on the previous page is an isomorphism. Thus the morphism T defined in the last subsection is an isomorphism.

Proposition 1.20 Let K|k be a finite Galois field extension, let A′ be an abelian variety. Then T : Res_{k}^{K}(Â′) ⟶ { \atop Res_{k}^{K}(A′)} is an isomorphism of abelian varieties.

□

1.3.2 The Galois-operation on geometric points

The following Proposition is well known; see for example [Mi-AA, par. 1].

Proposition 1.21 Let k be perfect. The Galois-operation on Res_{k}^{K}(A′)(\overline{K}) is the induced representation of the one of A′(\overline{K})

Res_{k}^{K}(A′)(\overline{K}) ≃ Ind_{ℤ[Gal(\overline{K}|K)]}^{ℤ[Gal(\overline{K}|k)]}(A′(\overline{K}))

and the same is true for the Tate-module

T_{l}(Res_{k}^{K}(A′)(\overline{K})) ≃ Ind_{ℤ_{l}[Gal(\overline{K}|K)]}^{ℤ_{l}[Gal(\overline{K}|k)]}(T_{l}(A′ ; \overline{K}))

for every prime l.

In particular, if K|k is an extension of finite fields, the characteristic polynomials of the relative Frobenius morphisms are related by

χ_{Res_{k}^{K}(A′)/k}(X) = χ_{A′/K}(X^{n}).

Proof We only show the first isomorphism, the proof of the second is analogous.

The Galois-operation of Gal(\overline{K}|k) on Res_{k}^{K}(A′)(\overline{K}) ≃ ∏_{σ} σ^{−1}(A′)(\overline{K}) is given by τ ↦ ((P_{σ})_{σ} ↦ (τ(P_{στ}))_{σ}).

Let ι^{#} : K ↪ \overline{K} be the inclusion, corresponding to ι : Spec(\overline{K}) ⟶ Spec(K). The immersion ι^{−1}(A′) ↪ ∏_{σ} σ^{−1}(A′) ≃ W_{K} to the factor “ι” induces an injection A′(\overline{K}) ↪ ∏_{σ} σ^{−1}(A′)(\overline{K}) ≃ W_{K}(\overline{K}) which is compatible with the operation of ℤ[Gal(\overline{K}|K)]. By the universal property of the induced representation, we have a ℤ[Gal(\overline{K}|k)]-module-homomorphism

Ind_{ℤ[Gal(\overline{K}|K)]}^{ℤ[Gal(\overline{K}|k)]}(A′(\overline{K})) ⟶ Res_{k}^{K}(A′)(\overline{K}). (∗)

Now for every inclusion σ^{#} : K ↪ \overline{K} (over k), let σ′ be a continuation to a \overline{K}-automorphism (i.e. σ^{#} = σ′ι^{#} : K ⟶ \overline{K} or – what is the same – σ = ισ′ : Spec(\overline{K}) ⟶ Spec(K)).

On the left-hand side of (*), every element has a unique representation in the form ∑_{σ} σ′(P_{σ}) with P_{σ} ∈ A′(\overline{K}). Such an element is mapped to the element (σ′(P_{σ}))_{σ}. Also every element of the left-hand side has this form for unique P_{σ}.

We thus have an isomorphism. □

1.3.3 The functor “Weil-restriction”

We have already seen that ℛes_{k}^{K} is a functor and so is Res_{k}^{K}. It restricts to a functor from the category of abelian K-varieties to the category of abelian kvarieties which respects the addition.

For abelian K-varieties A′, B′, the homomorphism of abelian groups Res_{k}^{K} : Hom_{K}(A′, B′) ⟶ Hom_{k}(Res_{k}^{K}(A′), Res_{k}^{K}(B′)) extends canonically to a homomorphism Res_{k}^{K} : Hom_{K}^{0}(A′, B′) ⟶ Hom_{k}^{0}(Res_{k}^{K}(A′), Res_{k}^{K}(B′)). Thus the functor Res_{k}^{K} extends to a functor from the “category of abelian K-varieties up to isogeny” to the category of abelian “category of abelian k-varieties up to isogeny”. ^{9}

In particular, Res_{k}^{K} is a ring-homomorphism from End_{K}(A′) to End_{k}(Res_{k}^{K}(A′)) and from End_{K}^{0}(A′) to End_{k}^{0}(Res_{k}^{K}(A′)).

Let K|k be Galois. Let A′, B′ be abelian K-varieties. Then

Hom_{K}(Res_{k}^{K}(A′)_{K}, Res_{k}^{K}(B′)_{K}) ≃ Hom_{K}( ∏_{ν∈G^{opp}} ν^{−1}(A′), ∏_{σ∈G^{opp}} σ^{−1}(B′)) ≃

⨁_{σ,ν∈G^{opp}} Hom_{K}(ν^{−1}(A′), σ^{−1}(B′));

see equation (A.3) in Subsection A.2.3.

Let α : A′ ⟶ B′ be a morphism. Then by (1.11), Res_{k}^{K}(α) ⊗_{k} id_{K} is given by the diagonal “matrix” (σ^{−1}(α)δ_{σ,ν})_{σ,ν∈G^{opp}} ∈ ⨁_{σ,ν∈G^{opp}} Hom_{K}(ν^{−1}(A′), σ^{−1}(B′)).

Now let α : A′ ⟶ B′ be an isogeny. Then Res_{k}^{K}(α) : Res_{k}^{K}(A′) ⟶ Res_{k}^{K}(B′) is also an isogeny.

For every k-scheme Z, we have the commutative diagram

[figure: 0; ker(α)(Z ⊗_{k} K); ∼; A′(Z ⊗_{k} K); ∼; B′(Z ⊗_{k} K); ∼; 0; Res_{k}^{K}(ker(α))(Z); Res_{k}^{K}(A′)(Z); Res_{k}^{K}(B′)(Z).]

Since the first row is exact (in the category of abelian groups), so is the last. Thus the kernel of the isogeny Res_{k}^{K}(α) is Res_{k}^{K}(ker(α)).

1.3.4 Weil-restrictions of a polarized abelian varieties

Let K|k be a Galois field extension, A′ an abelian K-variety, Â′ the dual abelian variety. By Proposition 1.20, Res_{k}^{K}(Â′) is (canonically isomorphic to) the dual abelian variety of Res_{k}^{K}(A′).

Let φ : A′ ⟶ Â′ be a polarization of A′, defined by an ample sheaf ℒ on A′ ; \overline{K}, i.e. φ ⊗_{K} id\overline{K} = ϕ_{ℒ} : A′ ; \overline{K} ⟶ Â′\overline{K}. ^{10} As above, this induces an isogeny

Res_{k}^{K}(φ) : Res_{k}^{K}(A′) ⟶ Res_{k}^{K}(Â′) ≃ { \atop Res_{k}^{K}(A′)}

which has by the above remarks kernel Res_{k}^{K}(ker(φ)). We show now that this morphism is again a polarization.

9The category of abelian k-varieties up to isogeny consists of all abelian k-varieties, where for two abelian k- varieties A and B, the set of morphisms is Hom_{k}^{0}(A, B); cf. [Mu, par. 19], see also Subsection A.2.1.

10For a polarization φ of A′, we do not require that there exists a sheaf defined over K which defines φ; see Subsection A.2.2 for details.

Let σ ∈ G^{opp}. As at the end of Subsection 1.2.2, we regard σ^{−1}(Â′) as the dual abelian variety of σ^{−1}(A′).

Let σ′ be a Spec(\overline{K})-automorphism with σ′^{#}|_{K} = σ^{#}. Then by Lemma A.9, φ^{σ} ⊗_{K} id\overline{K} = ϕ_{ℒ}^{σ′} = ϕ_{σ′^{∗}(ℒ)} . (In particular, the class of σ′^{∗}(ℒ) in the Néron-Severi group is independent of the choice of σ′.)

After base-change, we get

Res_{k}^{K}(φ) ⊗_{k} id_{K} = (φ^{σ} ∘ p_{σ})_{σ∈G^{opp}} : ∏_{σ∈G^{opp}} σ^{−1}(A′) ⟶ ∏_{σ∈G^{opp}} σ^{−1}(Â′).

This is a “product polarization” defined by the ample sheaf

ℒ_{W\overline{k}} := ⨂_{σ}(p_{σ} ⊗_{K} id\overline{K})^{∗}σ′^{∗}(ℒ) = ⨂_{σ} σ̃′^{∗}(p_{id} ⊗_{K} id\overline{K})^{∗}(ℒ)

on W\overline{k}.

If one starts with an ample sheaf ℒ on A′, then the polarization Res_{k}^{K}(φ) is defined by the ample sheaf ℒ_{W_{K}} := ⨂_{σ} σ^{∗}p_{id}^{∗}(ℒ) on W_{K}. The class of ℒ_{W_{K}} in the Picard group is invariant under the Galois-operation and thus this construction defines an ample sheaf on W. (This follows also directly from the results in Subsection 1.2.1.)

Proposition 1.22 Let K|k be a finite Galois field extension, A′ an abelian variety over K. If φ is a (principal) polarization on A′ (defined by a sheaf over K), then Res_{k}^{K}(φ) is a (principal) polarization on Res_{k}^{K}(A′) (defined by a sheaf over k).

Thus “Weil-restriction” is a functor from the category of polarized abelian Kvarieties (with polarizations defined by a sheaf over K) ^{11} to the category of polarized abelian k-varieties (with polarizations defined by a sheaf over k). The images of principally polarized abelian K-varieties are principally polarized.

1.3.5 Weil-restrictions of abelian varieties over finite fields ^{12}

Let K|k be a finite extension of finite fields of degree n. Let A′ be an abelian variety over K of dimension d, W the Weil-restriction of A′ with respect to K|k.

We now study the endomorphism algebra ^{13} and the isogeny decomposition of W.

In the next chapter, we will study the same question for Weil-restrictions of abelian varieties with respect to an arbitrary Galois extension K|k under the assumption that the abelian K-variety A′ is defined over k.

11For definition of the category of polarized abelian varieties see Subsection A.2.2 in the appendix.

12This subsection is joint work with N.Naumann.

13Recall the following definitions: The endomorphism ring of an abelian variety A over a field k is the ring of endomorphisms of A over k, i.e. the endomorphisms of A\overline{k} defined over k. It is denoted by End_{k}(A). The endomorphism algebra of A is the ring End_{k}^{0}(A) := End_{k}(A) ⊗_{ℤ} ℚ.

In the following, we make use of various concepts of “Frobenius morphisms”; see Subsection A.3.4 for details.

Identify Gal(K|k) with its dual and denote by σ_{k}^{K} ∈ Gal(K|k) the Frobenius automorphism, defining a Spec(k)-automorphism σ_{k}^{K} of Spec(K). By base-change, this induces the arithmetic Frobenius isomorphism σ_{k}^{K} : σ_{k}^{K}^{−1}(A′) ⟶ A′.

We also have the geometric Frobenius endomorphism π_{k} : A′ ⟶ σ_{k}^{K}^{−1}(A′) which is an isogeny of p-power degree whose kernel is connected. Just as for every isogeny, there exists a π_{k}^{−1} ∈ Hom0 ; \overline{k}(σ_{k}^{−1}(A′ ; \overline{k}), A′ ; \overline{k}) which is a left- and right-inverse for π_{k}; see Lemma A.7.

Analogously, we have a geometric Frobenius endomorphism π_{k} : W ⟶ W. Let π_{K} be the geometric Frobenius endomorphism of A′. Then the image of π_{K}

under the ring-homomorphism Res_{k}^{K} equals the endomorphism π_{k}^{n} of W. (In fact, after base-change, Res_{k}^{K}(π_{K}) as well as π_{k}^{n} is represented by the diagonal matrix π_{K}I.) Thus the ring-homomorphism Res_{k}^{K} : End_{K}(A′) ⟶ End_{k}(W) restricts to an inclusion ℤ[π_{K}] ⟶ End_{k}(W), given by π_{K} ↦ π_{k}^{n}. This ring-homomorphism extends to a ring-homomorphism ℤ[π_{K}][X]/(X^{n} − π_{k}) ⟶ End_{k}(W), given by X ⟶ π_{k}.

The geometric Frobenius endomorphism π_{k} of W commutes with all endomorphisms of W. Thus by the universal property of the tensor product (see [FD, proposition 3.2]), the ring-homomorphisms End_{K}(A′) ⟶ End_{k}(W), λ ↦ Res_{k}^{K}(λ) and ℤ[π_{K}][X]/(X^{n} − π_{K}) ⟶ End_{k}(W), X ↦ π_{k} induce a ringhomomorphism

End_{K}(A′) ⊗_{ℤ[π_{K}]} ℤ[π_{K}][X]/(X^{n} − π_{K}) ⟶ End_{k}(W), λ ↦ Res_{k}^{K}(λ), X ↦ π_{k}.

Theorem 2 Let K|k be an extension of finite fields of degree n. Let A′ be an abelian K-variety, W the Weil-Restriction of A′ with respect to K|k. Then

End_{K}^{0}(A′) ⊗_{ℚ[π_{K}]} ℚ[π_{K}][X]/(X^{n} − π_{K}) ⟶ End_{k}^{0}(W), λ ↦ Res_{k}^{K}(λ), X ↦ π_{k}

is an isomorphism.

Proof By the defining property of the Weil-restriction, as abelian groups,

Hom_{k}^{0}(W, W) ≃ Hom_{K}^{0}(∏_{i=0}^{n−1} σ_{k}^{K}^{−i}(A′), A′) via a ↦ p_{id} ∘ (a ⊗_{k} id_{K}).  (1.18)

We show that the homomorphism of abelian groups

Hom_{K}^{0}(A′, A′) ⊗_{ℚ[π_{K}]} ℚ[π_{K}][X]/(X^{n} − π_{K}) ⟶ Hom_{k}(W, W) ≃

Hom_{K}^{0}(∏_{i=0}^{n−1} σ_{k}^{K}^{−i}(A′), A′) ≃ ⨁_{i=0}^{n−1} Hom_{K}^{0}(σ_{k}^{K}^{−i}(A′), A′) (1.19)

¿from left to right is an isomorphism.

Let σ_{k} ∈ Gal(\overline{k}|k) again be the Frobenius automorphism. Again by basechange, this induces the arithmetic Frobenius automorphism σ_{k} : W\overline{k} ⟶ W\overline{k}.

The morphism π_{k} : W ⟶ W is uniquely determined by the fact that it operates on \overline{k}-valued points P of W\overline{k} as the inverse of the arithmetic Frobenius isomorphism: π_{k} ∘ P = σ_{k}^{−1}(P) = P^{σ_{k}}; see Lemma A.32.

Let P = (P_{i})_{i=0}^{n−1} be a \overline{k}-valued point of W\overline{k} ≃ ∏_{i=0}^{n−1} σ_{k}^{K}^{−i}(A′)\overline{K}. Then by definition of the Galois-operation on W\overline{k}, σ_{k}(P) = (σ(P_{i+1}))_{i=0}^{n−1} (where P_{n} = P_{0}). Thus π_{k} ∘ P = σ_{k}^{−1}(P) = (σ_{k}^{−1}(P_{i−1}))_{i=0}^{n−1} = (π_{k} ∘ P_{i−1})_{i=0}^{n−1}.

Thus under the isomorphism W_{K} ≃ ∏_{i=0}^{n−1} σ_{k}^{K}^{−i}(A′), the geometric Frobenius endomorphism π_{k} of W is given by the “matrix”

( \begin{matrix}0 & ⋯ & ⋯ & π_{k} \\ π_{k} & 0 & ⋯ & 0 \\ 0 & ... & ... & ⋮ \\ 0 & ... & π_{k} & 0 \end{matrix} ) .

For some λ ∈ End_{K}^{0}(A′), Res_{k}^{K}(λ) is given by the diagonal “matrix”

( \begin{matrix}λ \\ & σ_{k}^{K}^{−1}(λ) \\ & & . & . & . \\ & & & & & σ_{k}^{K}^{1−n}(λ) \end{matrix} ) .

Let x be the image of X in ℚ[π_{K}][X]/(X^{n} − π_{K}). Let λ_{1}x + λ_{2}x^{2} + ⋯ + λ_{n}x^{n} ∈ Hom_{K}^{0}(A′, A′)⊗_{ℚ[π_{K}]}ℚ[π_{K}][X]/(X^{n}−π_{K}) where λ_{i} ∈ End_{K}^{0}(A′). Such an element is mapped under the homomorphism of in the theorem to an endomorphism of W which is represented by the “matrix”

( \begin{matrix}λ_{n} π_{k}^{n} & λ_{n−1} π_{k}^{n−1} & ⋯ & λ_{2} π_{k}^{2} & λ_{1} π_{k} \\ σ_{k}^{K}^{−1}(λ_{1}) π_{k} & σ_{k}^{K}^{−1}(λ_{n}) π_{k}^{n} & & σ_{k}^{K}^{−1}(λ_{3}) π_{k}^{3} & σ_{k}^{K}^{−1}(λ_{2}) π_{k}^{2} \\ ⋮ & & ... & & ⋮ \\ σ_{k}^{K}^{2−n}(λ_{n−2}) π_{k}^{n−2} & σ_{k}^{K}^{2−n}(λ_{n−3}) π_{k}^{n−3} & & σ_{k}^{K}^{2−n}(λ_{n}) π_{k}^{n} & σ_{k}^{K}^{2−n}(λ_{n−1}) π_{k}^{n−1} \\ σ_{k}^{K}^{1−n}(λ_{n−1}) π_{k}^{n−1} & σ_{k}^{K}^{1−n}(λ_{n−2}) π_{k}^{n−2} & ⋯ & σ_{k}^{K}^{1−n}(λ_{1}) π_{k} & σ_{k}^{K}^{1−n}(λ_{n}) π_{k}^{n} \end{matrix} ) .

The elements of Hom_{K}^{0}(A′, A′) ⊗_{ℚ[π_{K}]} ℚ[π_{K}][X]/(X^{n} − π_{K}) have a unique representation as λ_{1}x + λ_{2}x^{2} + ⋯ + λ_{n}x^{n} where λ_{i} ∈ End_{K}^{0}(A′). Under homomorphism (1.19), this element corresponds to the first row in the above matrix, i.e. to the row vector ( λ_{n}π_{k}^{n} λ_{n−1}π^{n−1} ⋯ λ_{1}π_{k} ). Now, every element of ⨁_{i=0}^{n−1} Hom_{K}^{0}(σ_{k}^{K}^{−i}(A′), A′) has this form with unique λ_{i}. Thus (1.19) is an isomorphism. □

Remark Since the geometric Frobenius endomorphism has degree a power of p := char(k), we obtain in fact an isomorphism

(End_{K}(A′) ⊗_{ℤ[π_{K}]} ℤ[π_{K}][X]/(X^{n} − π_{K})) ⊗_{ℤ} ℤ[1/p] ⟶ End_{k}(W) ⊗_{ℤ} ℤ[1/p].

Corollary 1.23 End_{k}^{0}(W) is commutative iff End_{K}^{0}(A′) is commutative.

□

Now assume that A′ is a simple new abelian variety ^{14} with commutative endomorphism ring.

We are interested in the question whether W is simple. This is the case iff End(W) ≃ End_{K}^{0}(A′/K)[X]/(X^{n} − π_{K}) ≃ ℚ[π_{K}]/(X^{n} − π_{K}) is a field, i.e. iff X^{n} − π_{K} is irreducible over End_{K}^{0}(A′) ≃ ℚ[π_{K}].

So, W is not simple iff X^{n} − π_{K} is reducible over End_{K}^{0}(A′) ≃ ℚ[π_{K}]. Under the condition 4 ∤ n, this is equivalent to the existence of a β ∈ ℚ[π_{K}] and a prime divisor q of n with β^{q} = π_{K}; see [Lo, par. 14, Satz 2].

We claim that under the assumptions on A′ and the additional assumption 4 ∤ n, W is simple. ^{15}

Assume that 4 ∤ n and W is not simple so that β^{q} = π_{K} for some prime q|n and β ∈ ℚ[π_{K}] (so that ℚ[π_{K}] = ℚ[β]). Let λ|k be the intermediate field of K|k with [K : λ] = q. We claim that A′ is isogenous to an abelian variety defined over λ.

Let V be the Weil-restriction of A′ with respect to K|λ. Then χ_{V/λ}(X) = χ_{A′/K}(X^{q}), and β is a root of χ_{V/λ}, the characteristic polynomial of the Frobenius of V; see Proposition 1.21. So V contains a simple abelian variety A such that the characteristic polynomial of the Frobenius of A has β as a root. The endomorphism ring of A is commutative (since the endomorphism ring of V is) and thus isomorphic to ℚ[β] = ℚ[π_{K}]. This is a number field of degree 2d over ℚ, thus A has dimension d. So A ⊗_{λ} K is a d-dimensional abelian subvariety of V ⊗_{λ} K ≃ ∏_{i=0}^{n−1} σ_{λ}^{K}^{−i}(A′), thus A ⊗_{λ} K ≈ σ_{λ}^{K}^{−i}(A′) for some i. Now, σ_{λ}^{K}^{−i}(A′) ∼ A′ via the i-power of the (geometric) Frobenius endomorphism relative to λ. Thus A ⊗_{λ} K ∼ A′.

We proved:

Theorem 3 Let K|k be an extension of finite fields of degree n and assume 4 ∤ n. If A′ is a simple new abelian variety over K with commutative endomorphism ring (i.e. A′ might be a non-super-singular elliptic curve), then the Weil-restriction of A′ with respect to K|k is simple.

14We fixed the following definition: If A′ is defined over k, i.e. if there exists an abelian kvariety A such that A′ ≈ A ⊗_{k} K, then we say that A is an old abelian variety (relative to K|k).

If A′ is not isogenous to an abelian variety defined over k or some proper intermediate field λ of K|k, then we call A′ a new abelian variety (relative to K|k).

15The following proof is inspired by the proof of the “arithmetical part” of Honda’s Theorem; cf. [Ho]. As stated by Honda, the argument goes back to Tate.

32 Chapter 1. Basic Properties of Weil-Restrictions

Weil-restrictions of old abelian varieties

Introduction and results

In this chapter, we continue with the study of Weil-restrictions of abelian varieties. We restrict ourselves to the following situation:

Let K|k be a finite Galois field extension, A an abelian k-variety. ^{1} Let W be the Weil-restriction of A_{K} with respect to K|k.

We begin with the determination of the ring of endomorphisms of W over k. The result is that this ring is canonically isomorphic to the so-called skewgroup-ring of End_{K}(A_{K}) with the group Gal(K|k) and the natural operation of Gal(K|k) on End_{K}(A_{K}); see Theorem 4, p. 35.

We then restrict ourselves even further to the case that A is an elliptic curve E and K|k is a cyclic field extension of odd degree of perfect fields. In this case, W is isogenous to a product of the elliptic curve E itself and the so-called tracezero-hypersurface N. If E has no complex multiplication, than N is simple; see Theorem 5, p. 42. ^{2}

Our goal is then to study polarizations of N. In particular, we want to know if there exist principal polarizations on N.

In order to do so we study in an excursus first the Néron-Severi group of a product of elliptic curves. For each element of the Néron-Severi group we give an explicit divisor which defines the given element; see Theorem 6, p. 48.

There exists a canonical polarization on N, and this polarization has kernel E[n] = E ∩ N. It follows in particular, that after a choice of a generator of Gal(K|k), N is canonically isomorphic to its dual; see Proposition 2.17.

However, the existence of this isomorphism does not mean that N is always principally polarized as one sees from the following result:

1According to our terminology, A_{K} is then an old abelian K-variety. Thus the title of this chapter.

2By saying that all elliptic k-curve has complex multiplication, we mean that E\overline{k} has complex multiplication and the complex multiplication is defined over k.

If E has no complex multiplication then N is not principally polarized. If n is prime, it is isogenous to a principally polarized abelian variety iff the group scheme E[n] contains a non-trivial sub-group scheme over k; see Corollary 2.26, p. 58 to Theorem 7, p. 57.

If E has complex multiplication, the situation is more complicated. For n = 3, we give an explicit criterion whether the abelian surface N is principally polarized; see Theorem 8, p. 59.

In the last section of this chapter, we specialize to the case n = 3 so that N is an abelian surface. We give explicit equations for an affine, open part of N and try to find curves of genus 2 on N whose existence was predicted by the previous results. The curves constructed will also serve as examples in the next chapter.

2.1 The endomorphism ring

Throughout this section, let K|k be a finite Galois extension of fields of degree n with Galois group G, and let A be an abelian k-variety of dimension d. Let W be the Weil-restriction of A_{K} := A ⊗_{k} K with respect to K|k.

We want to determine the structure of the endomorphism ring of W, and determine in which isogeny factors W splits.

2.1.1 The endomorphism ring as skwe-group-ring

Recall that in Subsection 1.1.5, we have seen that the arithmetic operation of G on A_{K} induces a geometric operation on W. If τ ∈ G, the corresponding k-automorphism of W is denoted by a_{τ}.

Lemma 2.1 Let τ ∈ G, λ ∈ End_{K}(A_{K}). Then a_{τ} ∘Res_{k}^{K}(λ) = Res_{k}^{K}(τ(λ))∘a_{τ} ∈ Aut_{k}(W).

Proof We check the relation for the corresponding automorphisms of the functor ℛes_{k}^{K}(A_{K}). Let Z be a k-scheme, P ∈ ℛes_{k}^{K}(A_{K})(Z). Then

\begin{matrix}(a_{τ} λ)(P) = τ ∘ λ ∘ P ∘ τ^{−1} = τ ∘ λ ∘ τ^{−1} ∘ τ ∘ P ∘ τ^{−1} \\ = τ(λ) ∘ τ ∘ P ∘ τ^{−1} = (τ(λ) a_{τ})(P) \end{matrix}

□

To formulate the result about the structure of the endomorphism ring of W, we need a generalization of the concept of a group ring first.

Definition ^{3} Let Λ be a ring, G a group, t : G ⟶ Aut(Λ) a group-homo-morphism. The image of σ ∈ G under t will again be denoted by σ. Following [Kar], we define the skew-group-ring Λ^{t}[G] to be the following ring: ^{4} The underlying set is Λ^{G}, i.e. the set of functions (λ_{σ})_{σ∈G} : G ⟶ Λ. The addition is defined pointwise, just as for the “usual” group ring. Also as usually, for τ ∈ G, let τ ∈ Λ^{t}[G] also denote the function σ ↦ δ_{σ,τ} ∈ Λ^{t}[G]. Here, δ_{σ,τ} is the “Kronecker delta”, δ_{τ,τ} = 1 and δ_{σ,τ} = 0 if σ ≠ τ. The multiplication is defined by ∑_{σ∈G} λ_{σ} σ · ∑_{ν∈G} μ_{ν} ν = ∑_{σ,ν∈G} λ_{σ} σ(μ_{ν}) σν.

Lemma 2.2 Λ^{t}[G] is a ring.

Proof We only have to check the associativity of the multiplication. Using the fact that t is a group-homomorphism, one calculates on generating elements (of the abelian group Λ^{t}[G])

\begin{matrix}(λ σ · β τ) · γ υ = λ σ(β) στ · γ υ = \\ λ σ(β) στ(γ) στυ = λ σ · β τ(γ) τυ = λ σ · (β τ · γ υ) \end{matrix}

□ Λ^{t}[G] has the following universal property:

Lemma 2.3 Let B be a ring, f : Λ ⟶ B be a ring-homomorphism, and let g : G ⟶ B^{∗} be a group-homomorphism. Assume that for λ ∈ Λ, τ ∈ G, g(τ) f(λ) = f(τ(λ)) g(τ). Then there is a unique ring-homomorphism Λ^{t}[G] ⟶ B with λ ↦ f(λ) and τ ↦ g(τ).

□

Now let G be the Galois group as above, t : G^{opp} ⟶ Aut(End_{K}(A_{K})) the natural operation given by σ ↦ (λ ↦ σ(λ) = σλσ^{−1}). From Lemmata 2.1 and 2.3 it follows that ∑_{σ∈G^{opp}} λ_{σ} σ ↦ ∑_{σ∈G^{opp}} Res_{k}^{K}(λ_{σ}) a_{σ} defines a ring-homomorphism

End_{K}(A_{K})^{t}[G^{opp}] ⟶ End_{k}(W).  (2.1)

Theorem 4 Let K|k be a finite Galois extension of fields with Galois group G, A an abelian variety over k, W the Weil-restriction of A_{K} with respect to K|k, t : G^{opp} ⟶ Aut(End_{K}(A_{K})) the natural operation. Then End_{K}(A_{K})^{t}[G^{opp}] ⟶ End_{k}(W) is an isomorphism.

Proof Analogously to the proof of Theorem 2, we make use of the isomorphism Hom_{k}(W, W) ≃ Hom_{K}(A_{K}^{G^{opp}}, A_{K}) ≃ ⨁_{σ∈G^{opp}} Hom_{K}(A_{K}, A_{K}) on the righthand side.

3This definition is a special case of the more general definition of a crossed product (with respect to some operation); cf. [Kar, Chapter 10, 2].

4In [CR], the same ring is called twisted group ring. However, in [Kar], this word is reserved for the special case of a crossed product with respect to a trivial Galois-operation.

By (1.9), the image of some σ ∈ G^{opp} in Hom_{K}(A_{K}^{G^{opp}}, A_{K}) is p_{σ^{−1}}, corresponding to the row vector which is zero except at the “σ-th” entry where it is 1.

Thus the image of ∑_{σ∈G^{opp}} λ_{σ}σ (where λ_{σ} ∈ End_{K}(A_{K})) is ∑_{σ∈G^{opp}} λ_{σ^{−1}} p_{σ}, corresponding to the row vector (λ_{σ^{−1}})_{σ∈G^{opp}}.

It is thus immediate that we have an isomorphism. □

By tensoring the above isomorphism over ℤ with ℚ, we get

Corollary 2.4 End_{K}^{0}(A_{K})^{t}[G^{opp}] ⟶ End_{k}^{0}(W) is an isomorphism.

We know that the ring End_{k}^{0}(W) is semi-simple. Thus the skew-group-ring End_{K}^{0}(A_{K})^{t}[G^{opp}] is semi-simple.

It can be proven more generally that every skew-group-ring of a semisimple ring in which the group order is (finite and) invertible is semisimple or even more generally that every crossed product of a semisimple ring is semisimple; see [Kar, Volume I, Chapter 10, Corollary 2.5].

We now want to study the ring-homomorphism ^{5}

End_{K}(A_{K})^{t}[G^{opp}] ⟶^{∼} End_{k}(W) ↪
End_{K}(W_{K}) ≃ End_{K}(A_{K}^{G^{opp}}) ≃ M_{G^{opp}}(End_{K}(A_{K})).

(2.2)

For σ ∈ G^{opp}, let ι_{σ} : A_{K} ⟶ A_{K}^{G^{opp}} be the immersion to the “σ-th” factor, and let p_{σ} : ∏_{σ∈G^{opp}} A_{K} ⟶ A_{K} be the projection to the “σ-th” factor. Now, End_{K}(A_{K}^{G^{opp}}) ⟶ M_{G^{opp}}(End_{K}(A_{K})), ψ ↦ (p_{σ}ψι_{ν})_{σ,ν∈G^{opp}} is a ringhomomorphism; see Subsection A.2.3.

We denote the matrix corresponding to a_{τ} by A_{τ} and the matrix corresponding to Res_{k}^{K}(λ) by J(λ).

We have already established in Subsection 1.3.3 that J(λ) is the diagonal matrix (σ^{−1}(λ)δ_{σ,ν})_{σ,ν∈G^{opp}}.

We want to determine to which matrix the endomorphism a_{τ} corresponds. First of all, p_{σ} : W_{K} ≃ A_{K}^{G^{opp}} ⟶ A_{K} corresponds to the row-vector (δ_{σ,ν})_{ν∈G}.

Recall that a_{τ} = (p_{τ^{−1}σ})_{σ∈G}; see Lemma 1.12. Thus

A_{τ} = (δ_{τ^{−1}σ,ν})_{σ,ν∈G} = (δ_{σ,τν})_{σ,ν∈G}.  (2.3)

Before continuing we want to clarify the definition of the left regular (matrix) representation.

5Let Λ be a ring and Σ a finite set. Then by M_{Σ}(Λ) we mean the ring consisting of: The set of functions a = (a_{σ,τ})_{σ,τ∈Σ} : Σ × Σ ⟶ Λ with pointwise addition and multiplication defined by (a · b)_{σ,τ} := ∑_{γ∈Σ} a_{σ,γ}b_{γ,τ}. After the choice of a bijection of Σ with the numbers 1, …, |Σ|, M_{Σ}(Λ) is canonically isomorphic to M_{|Σ|}(Λ), the matrix ring in |Σ| variables.

The left regular (matrix) representation

Let Λ be a ring. If Λ ⟶ Ξ is a homomorphism of rings, we can regard Ξ as Λ-right module, and if we do so, we write End_{Λ}^{r}(Ξ) for the ring of endomorphisms.

Now let Λ ⟶ Ξ be a homomorphism of rings and assume additionally that Ξ is as Λ-right module free on a finite set of generators Σ, i.e. Ξ ≃ Λ^{Σ} as Λright modules. Multiplication of elements of Ξ from the left on itself induces a ring-homomorphism

L : Ξ ⟶ End_{Λ}^{r}(Ξ) ≃ End_{Λ}^{r}(Λ^{Σ}),  (2.4)

the left regular representation.

For a fixed basis Σ, the right-hand side of (2.4) is canonically isomorphic to the matrix ring M_{Σ}(Λ). The isomorphism M_{Σ}(Λ) ˜ ⟶End_{Λ}^{r}(Λ^{Σ}) is given as follows: To every matrix (a_{σ,ν})_{σ,ν∈Σ} associate the endomorphism (x_{σ})_{σ∈Σ} ↦ (∑_{ν∈Σ} a_{σ,ν}x_{ν})_{σ∈Σ}. (This is given on the basis elements ν = (δ_{σ,ν})_{σ∈Σ} by ν ↦ ∑_{σ∈Σ} σ a_{σ,ν}.) The inverse is

End_{Λ}^{r}(Λ^{Σ}) ⟶ M_{Σ}(Λ), a ↦ (α_{σ,ν})_{σ,ν∈Σ} with α_{σ,ν} ∈ Λ

and a(ν) = ∑_{σ∈Σ} σ α_{σ,ν} (2.5)

By composition of (2.4) with (2.5), we get the left regular matrix representation (with respect to the basis Σ).

l : Ξ ⟶ M_{Σ}(Λ).

(In particular, for Λ = Ξ and Σ = {1}, the left regular matrix representation is the identity on Λ.)

We now apply these concepts in the context of the skew-group-ring. Let G be a finite group, t : G ⟶ Aut(Λ) be a homomorphism, Λ^{t}[G] the corresponding skew-group-ring.

We calculate explicitly the left regular representation l : Λ^{t}[G] ⟶ End_{Λ}^{r}(Λ^{t}[G]) and the left regular matrix representation L : Λ^{t}[G] ⟶ M_{G}(Λ) with respect to the basis G.

Let τ ∈ G. Then l(τ) : ν ↦ τν = ∑_{σ∈G} σδ_{σ,τν} and thus

L(τ) = (δ_{σ,τν})_{σ,ν∈G}.

Let λ ∈ Λ. Then l(λ) : ν ↦ λ ν = ν ν^{−1}(λ) and thus

L(λ) = (σ^{−1}(λ) δ_{σ,ν})_{σ,ν∈G}.

So

L(∑_{σ∈G} λ_{σ}σ) = (∑_{σ∈G} σ^{−1}(λ_{σ})δ_{σ,σν})_{σ,ν∈G} = (σ^{−1}(λ_{σν^{−1}}))_{σ,ν∈G}.

We are now going to relate these definitions and calculations with our situation. So let Λ := End_{K}(A_{K}), G the Galois group and t : G^{opp} ⟶ End_{K}(A_{K}) the natural operation. Let L be the left regular matrix representation of Λ^{t}[G] ≃ End_{k}(W) with respect to the basis G^{opp}. Then L(τ) = A_{τ} and L(λ) = J(λ). Thus:

Proposition 2.5 Homomorphism (2.2) is the left regular matrix representation of the skew-group-ring End_{K}(A_{K})^{t}[G^{opp}] with respect to the basis G^{opp}.

2.1.2 The Rosati involution, isotypic components and orthogonality

The Rosati involution

Let φ : A_{K} ⟶ Â_{K} be a polarization. Then Res_{k}^{K}(φ) : W ⟶ Ŵ is also a polarization; see Subsection 1.3.4.

We want to calculate how the Rosati involution of W with respect to Res_{k}^{K}(φ) is given under the isomorphism of Corollary 2.4.

Let us denote the Rosati involution by (…)′.

First of all, the (defining) equation λ′ = φ^{−1}λ̂φ where λ ∈ End_{K}^{0}(A_{K}) implies

Res_{k}^{K}(λ′) = Res_{k}^{K}(φ)^{−1} ∘ Res_{k}^{K}(λ̂) ∘ Res_{k}^{K}(φ) = Res_{k}^{K}(λ)′.

To calculate the Rosati involution of a_{τ}, we use the inclusion of End_{k}^{0}(W) into the matrix ring M_{G^{opp}}(End_{K}^{0}(A)) and the fact that Res_{k}^{K}(φ) ⊗_{k} id_{K} is a product polarization, and calculate the Rosati involution with the help of Lemma A.16.

Since a_{τ} corresponds to the matrix A_{τ} = (δ_{σ,τν})_{σ,ν∈G^{opp}} (see (2.3)), a′_{τ} corresponds to the matrix (δ_{ν,τσ})_{σ,ν∈G^{opp}} = (δ_{τ^{−1}ν,σ})_{σ,ν∈G^{opp}} = (δ_{σ,τ^{−1}ν})_{σ,ν∈G^{opp}} = A_{τ^{−1}}. Thus

a′_{τ} = a_{τ^{−1}}.

Since the Rosati involution is an anti-ring-endomorphism, this implies:

Proposition 2.6 Let K|k be a finite Galois field extension with Galois group G, A an abelian k-variety, W the Weil-restriction of A_{K} with respect to K|k. Let φ : A ⟶ Â be a polarization. Let λ ↦ λ′ be the Rosati involution associated to φ. Then under the isomorphism of Corollary 2.4, the Rosati involution associated to the polarization Res_{k}^{K}(φ) : W ⟶ Ŵ is given by ∑_{σ∈G^{opp}} λ_{σ} σ ↦ ∑_{σ∈G^{opp}} σ^{−1}λ′_{σ} = ∑_{σ∈G^{opp}} σ^{−1}(λ′_{σ}) σ^{−1}.

Dimensions of components

From now on, let k be perfect.

As in the above proposition, let A be an abelian k-variety, K|k a galois field extension of degree n with galois group G, W the Weil-restriction of A_{K} with respect to K|k, let t : G^{opp} ⟶ End_{K}(A_{K}) be the natural operation.

Let D ⊆ End_{K}^{0}(A_{K}) be a subring which is a division ring and which is invariant under the operation t.

Let ⨁_{i=1}^{s} Λ_{i} ≃ D^{t}[G^{opp}] be a decomposition of the D^{t}[G^{opp}]-right module D^{t}[G^{opp}], where we regard the Λ_{i} as submodules of D^{t}[G^{opp}]. This defines partition of unity 1 = ∑_{i} e_{i} where the e_{i} are pairwise orthogonal and idempotent and e_{i} ∈ Λ_{i}. Now, Λ_{i} = e_{i} D^{t}[G^{opp}], and conversely, if we are given a decomposition of the unity 1 = ∑_{i} e_{i} with pairwise orthogonal idempotents e_{i}, Λ_{i} := e_{i} D^{t}[G^{opp}] defines a decomposition of the D^{t}[G^{opp}]-right module D^{t}[G^{opp}].

Via the inclusion D^{t}[G^{opp}] ↪ End_{K}^{0}(A_{K})^{t}[G^{opp}] ≃ End_{k}^{0}(W), we can regard the e_{i} to be elements of End_{k}^{0}(W). For each i, let c_{i} ∈ ℕ such that c_{i}e_{i} ∈ End_{k}(W).

Now let W_{i} := c_{i}e_{i}(W). Then ⨁_{i=1}^{s} W_{i} ∼ W. (Conversely, such an isogeny decomposition where the W_{i} are abelian subvarieties of W defines a partition of unity and thus a decomposition of End_{K}^{0}(A_{K}) as right-End_{K}^{0}(A_{K}) module; see A.2.5 for details.)

Proposition 2.7 Let D ⊆ End_{K}^{0}(A_{K}) be a subring which is a division ring which is invariant under the operation t on End_{K}^{0}(A_{K}). Let ⨁_{i=1}^{s} Λ_{i} ≃ D^{t}[G^{opp}] be a decomposition of the D^{t}[G^{opp}]-right module D^{t}[G^{opp}]. This corresponds to the partition of unity 1 = ∑_{i} e_{i}. Let W_{i} := c_{i}e_{i}(W) as above. Then W_{i}_{K} ≈ A_{K}^{n_{i}} where

n_{i} = dim_{D}(Λ_{i}).

Proof Choose a bijection of G^{opp} with the set {1, …, n}. Then A_{K}^{G^{opp}} ≃ A_{K}^{n}.

Let l and L be the left regular (matrix) representations of End_{K}^{0}(A_{K})^{t}[G^{opp}], l_{D} and L_{D} the left regular (matrix) representations of D^{t}[G^{opp}] (both regular matrix representations with respect to the basis G^{opp}). Let ι_{M} : M_{G^{opp}}(D) ⟶ M_{G^{opp}}(End_{K}^{0}(A_{K})) be the canonical inclusion. Then L = ι_{M} L_{D}.

By construction l_{D}(e_{i}) is the identity on Λ_{i} and zero on all Λ_{j} for j ≠ i.

Let n_{i} be the dimension of the D-module Λ_{i}. For each i, choose a basis (b_{i}^{(j)})_{j=1,...,n_{i}} of the D-module Λ_{i}. Then all n elements b_{i}^{(j)} define a basis of the D-module D^{t}[G^{opp}]. With respect to this basis, the matrix associated to l_{D}(e_{i}) is zero outside a block of size n_{i} where it is the identity matrix.

We now have two matrix representations of l_{D}(e_{i}) with respect to different bases, and via a base change matrix, we can transform one into the other: There exists an invertible matrix B such that BL_{D}(e_{i})B^{−1} is zero outside a block of size n_{i} where it is the identity matrix. By multiplying B with a constant in ℕ, we can assume that all entries of B lie in D ∩ End_{K}(A_{K}).

Let b be the endomorphism of A_{K}^{G^{opp}} ≃ A_{K}^{n} which is associated to ι_{M}(B). By our notational conventions, the endomorphism associated to the matrix L(e_{i}) = ι_{M}L_{D}(e_{i}) is e_{i} ⊗_{k} id_{K}. We see that b^{−1}(e_{i} ⊗_{k} id_{K})b is the projection of A_{K}^{G^{opp}} ≃ A_{K}^{n} to A_{K}^{n_{i}}. Thus the image of b^{−1}c_{i}(e_{i} ⊗_{k} id_{K})b is A_{K}^{n_{i}}, and the image of c_{i} e_{i} ⊗_{k} id_{K} is isomorphic to A_{K}^{n_{i}}. □

Remark Let A be simple, D = End_{K}^{0}(A_{K}). Assume that all e_{i} in the above proposition are central. Then all Λ_{i} as above are rings and ⨁_{i=1}^{s} Λ_{i} ≃ D^{t}[G^{opp}] is an isomorphism of rings. Further, the W_{i} = c_{i}e_{i}(W) are generated by the isotypic components of W and Λ_{i} ≃ End_{k}^{0}(W_{i}). So in particular, the number n_{i} in the above proposition satisfies n_{i} = dim_{D}(End_{k}^{0}(W_{i})).

The Rosati involution and representation theory

In Subsection A.2.5, the following is shown:

A decomposition of an abelian variety into isotypic components corresponds to the partition of unity 1 = ∑_{i} e_{i} into central simple pairwise orthogonal idempotents. (The decomposition of the abelian variety as well as the partition of unity are unique up to a permutation.)

Further, the isotypic components are orthogonal with respect to any polarization. This corresponds to the fact that for any Rosati involution e_{i} = e′_{i}.

We now want to show how for the Weil-restriction W the orthogonality of the isotypic components is closely related to a well-known result from representation theory.

To use this result, we make the assumption, that A is simple, the endomorphism ring of A_{K} is commutative and all endomorphisms of A_{K} are defined over k. Fix a polarization φ on A.

Under our assumptions, End_{k}^{0}(W) is isomorphic to the “ordinary” group ring End_{K}^{0}(A_{K})[G^{opp}].

We fix an inclusion of End_{K}^{0}(A_{K}) into \overline{ℚ}. Then the Rosati involution operates on End_{K}^{0}(A_{K}) by conjugation.

Let (…)′ be the involution of \overline{ℚ}[G^{opp}] given by ∑_{σ∈G^{opp}}λ_{σ}σ ↦ ∑_{σ∈G^{opp}} \overline{λ_{σ}}σ^{−1}. Note that by Proposition 2.6, this involution restricts to the Rosati involution on End_{K}^{0}(A_{K})[G^{opp}].

Let χ_{j}, j = 1, … be the character maps of G^{opp}. And let 1 = ∑_{j} e^{(j)} be the decomposition of the unity in the ring \overline{ℚ}[G^{opp}]. Then by representation theory, e^{(j)} = ∑_{σ∈G^{opp}} \frac{1}{n}χ_{j}(1)χ_{j}(σ^{−1}) σ; see [La, XVIII, Proposition 4.4.].

This implies e^{(j)}′ = ∑_{σ∈G^{opp}} \frac{1}{n}σ^{−1}\overline{χ_{j}(1)}\overline{χ_{j}(σ^{−1})} = ∑_{σ∈G^{opp}} \frac{1}{n}χ_{j}(1)χ_{j}(σ) σ^{−1} = e^{(j)}.

The central idempotents e_{i} of the group ring End_{K}(A_{K})[G^{opp}] have the form ∑_{γ} e^{(i_{γ})}, where all i_{γ} are distinct. Thus e_{i} = e′_{i} for the Rosati involution with respect to Res_{k}^{K}(φ), which is consistent with the result e_{i} = e′_{i} for general abelian varieties and any polarization.

2.1.3 The cyclic case

Let k still be a perfect field. We now apply the above results to the case that G is cyclic.

We identify G with G^{opp} and fix some generator σ ∈ G. Let a = a_{σ} ∈ End_{k}(W) be the automorphism corresponding to σ. (Since G is commutative, a_{σ} = s_{σ}^{−1}; see p. 17)

Denote the residue class of X in ℚ[X]/(X^{n} − 1) by x. Then we have an inclusion

ℚ[X]/(X^{n} − 1) ⟶ End_{K}^{0}(A_{K})^{t}[G], x ↦ σ.

The polynomial X^{n} − 1 splits over ℤ[X]

X^{n} − 1 = ∏_{d|n} Φ_{d}

Here, Φ_{d} is the d-th cyclotomic polynomial, a normalized and irreducible polynomial of degree φ(d) whose roots are the primitive d-th roots of unity. So ℚ[X]/Φ_{d} = ℚ(ζ_{d}).

Let Φ′_{d} := (X^{n} − 1)/Φ_{d}. By the Euclidian algorithm, there exist Ψ_{d} ∈ ℚ[X] with ∑_{d|n} Ψ_{d}Φ′_{d} = 1. Let E_{d} := Ψ_{d} Φ′_{d}. Then the E_{d}(x) ∈ ℚ[X]/(X^{n}−1) are pairwise orthogonal idempotents and define a partition of unity. The decomposition corresponding to this partition is

ℚ[X]/(X^{n} − 1) ≃ ∏_{d|n} ℚ[X]/Φ_{d} = ∏_{d|n} ℚ(ζ_{d}).

(This is nothing but the Chinese Remainder Theorem in this particular case.)

Let W_{d} := c_{d} E_{d}(a)(W) for suitable c_{d} ∈ ℕ. We then have an isogeny decomposition

W ∼ ∏_{d|n} W_{d},

and by Proposition 2.7, the W_{d} are abelian varieties with W_{d}_{K} ≈ A_{K}^{φ(d)}.

We also have W_{d} = Φ′_{d}(a)(W). – We only have to show that c_{d}Φ′_{d}(a)(W) ⊆ W_{d}. This follows from Φ′_{d}(x) = (∑_{f|n} Ψ_{f}(x)Φ′_{f}(x))Φ′_{d}(x) = Ψ_{d}(x)Φ′_{d}^{2}(x) = E_{d}(x)Φ′_{d}(x).

It is clear that W_{d} is also the reduced identity component of the kernel of c_{d}(id− E_{d}(a)) = c_{d} ∑_{f|n,f≠d} Ψ_{f}(a)Φ′_{f}(a) = (c_{d} ∑_{f|n, f≠d} Ψ_{f}(a) ∏_{g|n, g≠d,f} Φ_{g}(a)) Φ_{d}(a). It is also the reduced identity component of the kernel of Φ_{d}(a). – We only have to show that W_{d} is contained in this kernel. But since W_{d} = Φ′_{d}(a)(W) and Φ′_{d}(x)Φ_{d}(x) = 0, this is obvious.

Let W′_{d} be the abelian subvariety which is generated by the W_{f}, f|n, f ≠ d. Then W′_{d} = (id − E_{d}(a))(W) = (∑_{f≠d} E_{f})(W). Analogously to the above arguments one shows that W′_{d} = Φ_{d}(a)(W) and that W′_{d} is the reduced identity component of the kernel of Φ′_{d}(a).

We now want to study whether the W_{d} are simple or split further. We make the following assumptions.

A_{K} is a simple abelian variety whose endomorphism are all defined over k and whose endomorphism ring is commutative.

Note that if k is finite, all endomorphisms of A_{K} are automatically defined over k if we assume End_{K}(A_{K}) to be commutative.

Also if A is a non-super-singular elliptic curve over any field and n is odd, then all endomorphism of A_{K} are defined over k. This is because under this condition, End(A_{K}) is either ℤ or a quadratic order, thus the only possible nontrivial automorphism of End_{K}(A_{K}) has order 2, and consequently the kernel of the representation Gal(K|k) ⟶ Aut(End_{K}(A_{K})) is trivial.

Under the assumptions, we have the isomorphisms

End_{k}^{0}(A_{k})[X]/(X^{n} − 1) ≃ End_{K}^{0}(A_{K})[G] ≃ End_{k}^{0}(W) x  ↦  σ  ↦  a .

Let Φ_{d} split into the product of the non-trivial irreducible polynomials Φ_{d}^{(1)}, Φ_{d}^{(2)}, …, Φ_{d}^{(r_{d})} over End_{k}^{0}(A). Let Φ_{d}^{(i)} := (X^{n}−1)/Φ_{d}^{(i)}. Since X^{n}−1 is in characteristic 0 a separable polynomial, the Φ_{d}^{(i)} are all different for all d and i, and there exist Ψ_{d}^{(i)} with ∑_{d|n} ∑_{1=i}^{r_{d}} Ψ_{d}^{(i)}Φ′_{d}^{(i)} = 1. Let E_{d}^{(i)} := Ψ_{d}^{(i)}Φ′_{d}^{(i)}.

Then again by Proposition 2.7, W_{d}^{(i)} := E_{d}^{(i)}(a)(W) is an abelian variety with W_{d K}^{(i)} ≈ A_{K}^{deg(Φ_{d}(i))}. The abelian subvariety W_{d}^{(i)} is simple and its endomorphism ring is isomorphic to the integral commutative ring End_{k}(A)[X]/Φ_{d}^{(i)}. Since End_{k}(W) is communtative, the W_{d}^{(i)} are pairwise non-isogenous and they are thus the isotypic components of W.

As above, one sees that W_{d}^{(i)} = Φ_{d}^{′(i)}(a)(W) and that W_{d}^{(i)} is the reduced identity component of the kernel of Φ_{d}^{(i)}(a).

The component W_{d} is simple iff Φ_{d} is irreducible over End_{k}^{0}(A), i.e. iff End_{k}^{0}(A) and ℚ(ζ_{d}) are linearly disjoint. ^{6} If we fix an inclusion of End_{k}^{0}(A) into \overline{ℚ}, this is the case iff End_{k}^{0}(A) ∩ ℚ(ζ_{d}) = ℚ.

It particular, non of the W_{d} splits if End_{k}^{0}(A) = ℚ as is the case if A is an elliptic curve without complex multiplication.

We proved:

Theorem 5 Let K|k be a finite cylcic field extension of degree n of perfect fields. Let A be an abelian variety over a field k.

Let W be the Weil-restriction of A_{K} with respect to K|k. For all d|n, W contains canonically an abelian subvariety W_{d} with W_{d}_{K} ≈ A_{K}^{φ(d)}, and W is isogenous to the product of the W_{d}. Here, W_{1} = A itself.

Assume in addition that A_{K} is simple, End_{K}^{0}(A_{K}) is commutative and all endomorphisms of A_{K} are defined over k. Fix an inclusion of End_{K}^{0}(A_{K}) into \overline{ℚ}.

6For definition of “linear disjoint” see Subsection A.3.1 in the appendix.

Then the isotypic components of W are all simple, and its endomorphism rings are all commutative. For each d, W_{d} is simple iff End_{k}^{0}(A) ∩ ℚ(ζ_{d}) = ℚ.

Let A be a non-super-singular elliptic curve with complex multiplication (defined over k). Fix an inclusion of End_{k}(A) into \overline{ℚ}.

Then End_{k}^{0}(A) is a imaginary quadratic extension of ℚ. Now End_{k}^{0}(A) and ℚ(ζ_{d}) are not linearly disjoint iff End_{k}^{0}(A) ⊆ ℚ(ζ_{d}). If this is the case then Φ_{d} splits into two polynomials of degree \frac{1}{2}φ(d).

Let A still be a non-super-singular elliptic curve and let k be finite. Then End_{k}^{0}(A) = ℚ[α] where α is a root of the characteristic polynomial of the Frobenius. Thus Φ_{d} splits iff α ∈ ℚ(ζ_{d}).

Corollary 2.8 Under the assumptions of the theorem, let A be a non-super-singular elliptic curve with End_{k}(A) = End_{K}(A_{K}) (this condition is automatically satisfied over finite fields or if n is odd).

Then for each d, W_{d} is not simple iff A_{K} has complex multiplication and End_{k}^{0}(A) ⊆ ℚ(ζ_{d}). If this is the case, W_{d} contains canonically two simple nonisogenous abelian subvarieties with dimension \frac{φ(d)}{2}, and W_{d} is isogenous to the product of these abelian subvarieties. ^{7}

The trace-zero-hypersurface

Let again A be an abelian k-variety.

By the above argumentation, W is isogenous to W_{1} which is isomorphic to A itself and W′_{1}, the abelian subvariety of W generated by W_{d} for d|n and d ≠ 0. Now Φ_{1} = X − 1 and Φ′_{1} = X^{n−1} + ⋯ + 1 and thus W_{1} = (a^{n−1} + ⋯ + id)(W), W′_{1} = (a − id)(W), and W_{1} is the reduced itentity component of the kernel of a − id and W′_{1} is the reduced itentity component of the kernel of a^{n−1} + ⋯ + id.

Now both these kernels are in fact itself equal to W_{1}, W′_{1} respectively. This is obvious for W_{1}, since ker(a − id) is by definition equal to A embedded in W. But it is also true for W′_{1}:

Let N := ker(Φ′_{1}(a)) = ker(a^{n−1} + ⋯ + id). Let Σ_{n} := {0, …, n − 1} and consider the isomorphism W\overline{k} ≃ EG ; \overline{k} ≃ EΣ_{n} ; \overline{k} where the “σ^{i}-th” factor corresponds to the i-the factor. Under this isomorphism, N\overline{k} corresponds to ker(p_{0}+⋯+p_{n−1}), where for i = 0, …, n − 1, the p_{i} : EΣ_{n} ; \overline{k} ⟶ E\overline{k} are the projections. Now ker(p_{0} +

⋯ + p_{n−1}) ⟶ En−1 ; \overline{k}, P = (P_{0}, …, P_{n−1}) ↦ (P_{1}, …, P_{n−1}) is an isomorphism.

As W′_{1} = N = ker(Φ′_{0}(a)) = ker(a^{n−1} + ⋯ + id), we call N the trace-zero-hypersurface of W (although this term is not completely accurate if dim(A) > 1).

Note that W is isogenous to A ×_{k} N but not isomorphic to it, for N ∩ A :=

N ×_{W} A = ker(\overbrace{id_{A} + ⋯ + id_{A}}^{n times}) = ker([n]) = A[n].

7Over finite fields, the dimensions of the simple isogeny-factors of W in Corollary 2.8 were first established by N. Naumann using the l-adic representation; see [Na].

This fact makes the study of N particularly interesting, and we will concentrate on this object for the rest of the chapter.

The following result gives a flavor of the consequent results about N.

Let φ : A ⟶ Â be a polarization of A, defined by the ample sheaf ℒ on A\overline{k}. As said above, Res_{k}^{K}(φ) : W ⟶ Ŵ is also a polarization, defined by the sheaf ℒ_{W\overline{k}}.

We are interested in the kernel of the polarization ι̂_{N} Res_{k}^{K}(φ) ι_{N} defined by ι_{N}^{∗}(ℒ_{W\overline{k}}).

Proposition 2.9 A ∩ N = A[n] is immersed in ker(ι̂_{N} Res_{k}^{K}(φ) ι_{N}). If φ is a principal polarization, they are equal.

Proof The first statement follows from Lemma A.19, the second from Lemma A.23 with f = id − a^{n−1}. (It is N = im(f), and further f = f′ by proposition 2.6 and ker(f′) = ker(f) = A.) □

Let E be a non-super-singular elliptic curve, N the associated trace-zero-hyper-surface. We want to study the Néron-Severi group of N via a “geometric” approach. In order to do so, we now study the Néron-Severi group of the product of isomorphic elliptic curves.

2.2 The Néron-Severi group of a product of isomorphic elliptic curves

Let E be an elliptic curve over a perfect field K, let n be a natural number. In this section, we want to study the various properties of the endomorphism ring and the Néron-Severi group of E^{n}.

In the first subsection, we put the results of [Mu, p.208-210] into more concrete terms. In the second subsection, we give a basis for the Néron-Severi group of E^{n}, then in the show the Néron-Severi group on an abelian variety which is a twist of E^{n} (i.e. which is after a base-change isomorphic to E^{n}) can (in principle) be calculated. This result will be the basis of the calculations of the next section.

2.2.1 The Néron-Severi group and the endomorphism ring

The canonical product polarization of E^{n}

Let p_{i} : E^{n} ⟶ E be the projections and let ι_{i} : E ↪ E^{n} be the immersions onto the “i-th factor”.

Let D_{i} be the divisor ^{8} p_{i}^{−1}(0) = E × E × ⋯ × E × 0 × E ⋯ E (0 in the i-th position), D := ∑_{i=1}^{n} D_{i}.

8Since abelian varieties are non-singular, effective (Weil- or Cartier)-divisors are in bijection

Let φ : E ⟶ Ê be the canonical principal polarization defined by the ample divisor (0). The divisor D defines the “canonical” product polarization of E^{n}, let φ_{n} : E^{n} ⟶ Ê^{n} denote this polarization. Since (0) defines a principal polarization of E, φ_{n} is a principal polarization, i.e. φ_{n} an isomorphism. (Corresponding to the fact that D has Euler-characteristic n!.) ^{9}

The Galois group Gal(\overline{K}|K) operates on NS(En ; \overline{K}), and we have an inclusion ϕ : NS(En ; \overline{K})^{Gal(\overline{K}|K)} ⟶ Hom_{K}(E^{n}, Ê^{n}), \overline{ℳ} ↦ ϕ\overline{ℳ} . By composition with the homomorphism φ_{n}^{−1}, NS(En ; \overline{K})^{Gal(\overline{K}|K)} becomes a subgroup of End_{K}(E^{n}) ≃ M_{n}(End_{K}(E)). ^{10} Its image equals the subgroup of elements which are fixed under the Rosati involution; see Lemma A.14. ^{11}

The Rosati involution

If λ ∈ End_{K}^{0}(E), let \overline{λ} denote the corresponding conjugated element. (If E is super-singular, let \overline{λ} be the conjugated element in the field extension ℚ(λ).) Then the Rosati involution of E (with respect to the ample divisor (0)) is given by λ ↦ \overline{λ}.

The following lemma is a special case of Lemma A.16:

Lemma 2.10 The Rosati involution of E^{n} with respect to ℒ(D) is given by A ↦ \overline{A}^{⊤} (transposition and conjugation) on M_{n}(End_{K}^{0}(E)).

So if E is non-super-singular, NS(En ; \overline{K})^{Gal(\overline{K}|K)} is isomorphic to the group of hermitian matrices of M_{n}(End_{K}(E^{n})).

The degree and the Euler-characteristic

Let us state how the degree and the Euler-characteristic of a divisor can be calculated if it is given as an element of M_{n}(End_{K}(E^{n})). We follow the ideas of [Mu, p.209].

First, we need to know how the degree of an endomorphism given as an element of M_{n}(End_{K}(E^{n})) can be calculated. On End_{K}(E), the degree of λ ∈ End_{K}(E) is given by deg(λ) = λ\overline{λ}.

Lemma 2.11 Assume that E is non-super-singular. The degree function of E^{n} is given on M_{n}(End_{K}(E)) by deg(A) = det(A) \overline{det(A)}.

with closed subschemes of pure codimension 1. We will also call such subschemes (effective)

divisors. We will use that for some surjection a : A ⟶ B of non-singular, connected varieties A, B and some closed subscheme of pure codimension 1 D of B, the “pull-back” of the Cartierdivisor associated to D corresponds to the scheme-theoretic inverse image a^{−1}(D); see Subsection A.3.2.

9This section relies on Subsection A.2.2 in the appendix.

10It it important here that D defines a principal polarization.

11We will see that NS(E^{n}) ↪ NS(En ; \overline{K})^{Gal(\overline{K}|K)} is an isomorphism.

Proof The equation is true for singular matrices (which correspond to endomorphism with non-finite kernel and thus have by definition degree 0).

Further, the equation is true for diagonal matrices (the value on both sides being the product over the squares of the norms of the diagonal elements), for upper/lower triangular matrices with diagonal elements all 1 (the value on both sides being 1) and for permutation matrices (where the value on both sides is again 1).

Let A be non-singular. By the complete Gauß-Algorithm, there exist B_{i}, i = 1, …, m which are diagonal matrices or upper/lower triangular with diagonal elements 1 or permutation matrices such that B_{m} ⋯ B_{1} A = aI, where a ∈ ℕ.

Since the equation is multiplicative on both sides and true for all B_{i} and for aI, it is also true for A. □

Remark If E is super-singular, a similar result holds: If we chose a quadratic field extension F inside End_{K}^{0}(E), then M_{n}(F) is a subgroup of M_{n}(End_{K}^{0}(E)). On this group, the lemma holds. (To calculate the degree for the whole group End_{K}^{0}(E^{n}), one has to use the so-called reduced norm.)

For any divisor C on E^{n}, the degree of C (i.e. the degree of ϕ_{ℒ(C)} ) is the degree of the endomorphism φ_{n}^{−1} ∘ ϕ_{ℒ(C)} of E^{n}. If this endomorphism corresponds to the matrix A with entries in a commutative subring of End_{K}(E), by the Riemann-Roch-theorem and the above result, χ(ℒ(C))^{2} = deg(ℒ(C)) = det(A)\overline{det(A)}, thus |χ(ℒ(C))| = |det(A)|.

Lemma 2.12 Again let C be a divisor on E^{n}. Assume that E is non-super-singular or that C fulfills the conditions of the above remark. Then χ(ℒ(C)) = det(A).

This follows from the following lemma.

Lemma 2.13 Let the notations and the conditions on C be as above. Then χ(ℒ(D)^{z} ⊗ ℒ(C)) = det(zI + A) = p_{−A}(z), where p_{−A} is the characteristic polynomial of the matrix −A.

Proof For any z ∈ ℤ, |χ(ℒ(D)^{z} ⊗ ℒ(C))| = |χ(ℒ(zD + C))| = |det(zI + A)| by linearity and the above result. So we only have to check that the sign is correct.

By the Riemann-Roch theorem, z ↦ χ(ℒ(D)^{z} ⊗ ℒ(C)) = \frac{1}{n!}(zD + C)^{n} is a polynomial function of degree n, and \frac{1}{n!}(zD + C)^{n} = \frac{1}{n!}(z^{n}(D)^{n}+(lower order terms))= z^{n}+ (lower order terms). Analogously, p_{−A}(z) = z^{n}+ (lower order terms). Thus for large z, p_{−A}(z) and χ(ℒ(D)^{z} ⊗ ℒ(C)) are both positive, and thus they are equal for these z. Especially, they are equal for infinitely many z, and being polynomial functions they are equal. □

Lemma 2.14 Let the notations and the conditions on C be as above, and further assume ℒ(C) to be non-degenerate. Then i(ℒ(C)), the index of ℒ(C), is the number of negative eigenvalues of A. In particular, ℒ(C) is ample iff det(A) ≠ 0 and the eigenvalues of A are all positive.

Proof By Proposition A.25 (cf. [Mu, par. 16, p. 155]) and the above lemma, the index is the number of positive roots of p_{−A}, i.e. the number of positive eigenvalues of −A, i.e. the number of negative eigenvalues of A. The second statement is a reformulation of Lemma A.26. □

2.2.2 A basis for the Néron-Severi group

For each i = 1, ..., n, let λ_{i} ∈ End_{K}(E). Let not all λ_{i} be 0. Let \underline{λ} := (λ_{1}, …, λ_{n}) and let λ := λ_{1}p_{1} + ⋯ + λ_{n}p_{n} : E^{n} ⟶ E be the corresponding morphism.

Now the closed subscheme C(\underline{λ}) := ker(λ) is purely n − 1-dimensional and is thus an effective divisor on E^{n}. The .-valued points of C(\underline{λ}) are

{P = (P_{1}, …, P_{n})| λ_{1} ∘ P_{1} + λ_{2} ∘ P_{2} + ⋯ + λ_{n} ∘ P_{n} = 0}.

Proposition 2.15 The class of the sheaf ℒ(C(\underline{λ})) (in NS(E^{n})) corresponds to the endomorphism with the matrix

( \begin{matrix}\overline{λ_{1}}λ_{1} & \overline{λ_{1}}λ_{2} & ⋯ & \overline{λ_{1}}λ_{n} \\ \overline{λ_{2}}λ_{1} & \overline{λ_{2}}λ_{2} & ⋯ & \overline{λ_{2}}λ_{n} \\ ⋮ & ⋮ & ... & ⋮ \\ \overline{λ_{n}}λ_{1} & \overline{λ_{n}}λ_{2} & ⋯ & \overline{λ_{n}}λ_{n} \end{matrix} ) = ( \overline{λ_{1}} ; \overline{λ_{2}} ; ⋮ ; \overline{λ_{n}} ) ( λ_{1} λ_{2} ⋯ λ_{n} ) .

Proof In the notation of Subsection A.2.3, we have to show that φ_{n}^{−1}ϕ_{ℒ(C(λ))} = λ′λ.

We may assume that K is algebraically closed. We use that for all K-valued points P of E^{n} and endomorphisms λ, λ ∘ T_{P} = T_{λ∘P} ∘ λ.

Now, for every K-valued point P of E^{n}, ϕ_{ℒ(C(\underline{λ}))} ∘P is defined by T_{P}^{−1}(C(\underline{λ}))− C(\underline{λ}) = T_{P}^{−1}λ^{−1}(0)−λ^{−1}(0) = λ^{−1}(T_{λ∘P}^{−1} (0)−(0)). Thus ϕ_{ℒ(C(\underline{λ}))} = λ̂φλ = φ_{n}λ′λ. □

Notation Let λ ∈ End_{K}(E) and 1 ≤ i < j ≤ n. Let C_{i,j}^{λ} be the divisor associated with the closed subscheme

{P = (P_{1}, …, P_{n})|P_{i} + λ ∘ P_{j} = 0}.

Then the by the above results the matrix of C is zero but at the entries (i, i), (i, j), (j, i), (j, j). Here it looks like

( \begin{matrix}1 & λ \\ \overline{λ} & λ\overline{λ} \end{matrix} )

We see that the group of endomorphisms of E^{n} invariant under the Rosati involution is generated by the endomorphisms corresponding to D_{i} and C_{i,j}^{λ}. So NS(E^{n}) ≃NS(En ; \overline{K})^{Gal(\overline{K}|K)}. We can give a basis for NS(E^{n}) in terms of a basis of End_{K}(E).

Theorem 6 Let K be a perfect field and let E be a non-super-singular elliptic K-curve. Then NS(E^{n}) ≃ NS(En ; \overline{K})^{Gal(\overline{K}|K)}.

With the above notations,

• if E has no complex multiplication (over K), then D_{i} for i = 1, …, n and C_{i,j}^{1} for i < j is a basis for NS(E^{n}).

• if End_{K}(E) is an order in a quadratic imaginary field and κ, λ is a basis of End_{K}(E), then D_{i} for i = 1, …, n and C_{i,j}^{κ}, C_{i,j}^{λ} for i < j is a basis for NS(E^{n}).

• if End_{K}(E) is an order in a quaternion algebra and κ, λ, μ, ν is a basis of End_{K}(E), then D_{i} for i = 1, …, n and C_{i,j}^{κ}, C_{i,j}^{λ}, C_{i,j}^{μ}, C_{i,j}^{ν} for i < j is a basis for NS(E^{n}).

2.2.3 The Néron-Severi group of a twist

Let K|k be a Galois field extension of odd degree and let E be a non-super-singular elliptic curve over k. Let A be an abelian k-variety such that A_{K} ≈ E_{K}^{n}. We want to calculate the Néron-Severi-group of A as a subgroup of End_{K}(E_{K}^{n}) ≃ M_{n}(End_{K}(E_{K})).

By Lemma A.11, the Néron-Severi-group of A consists of those elements of the Néron-Severi-group of A_{K} ≈ E_{K}^{n} which are invariant under the Galois-action. For each σ ∈ G, we have an arithmetic operation of A_{K}/K. Under the isomorphism A_{K} ≈ E_{K}^{n} this operation corresponds to an automorphism σ̃ on E_{K}^{n}. σ̃ is of the form s_{σ}σ with σ the canonical automorphism of E_{K}^{n}/K and s_{σ} a K-automorphism of E_{K}^{n}.

Under our assumption that E be non-super-singular and n be odd, all endomorphisms of E_{K} are defined over k. So also all endomorphisms of E_{K}^{n} are defined over k and so all elements of NS(E_{K}^{n}) are invariant under σ and in order to determine the invariant elements under the action of σ̃ we have to calculate which elements are invariant under s_{σ} for all σ ∈ G.

A special case of Proposition A.15 is:

Let x ∈ NS(E_{K}^{n}), corresponding to a hermitian matrix X ∈ M_{n}(End_{k}(E)). Then s_{σ}^{∗}(x) corresponds to the matrix \overline{S_{σ}}^{⊤}XS_{σ}.

This implies:

Proposition 2.16 Let K|k be a Galois field extension of with Galois group G of odd degree. Let E be a non-super-singular elliptic curve over k. Let A be an abelian k-variety such that A_{K} ≈ E_{K}^{n}. Assume that all K-endomorphisms of E_{K} are defined over k. For each σ ∈ G, the Galois-operation on A_{K}/K is defined by σ̃ = σs_{σ} where s_{σ} is a K-automorphism of E^{n} corresponding to a matrix S_{σ} ∈ M_{n}(End_{K}(E_{K})).

Let x ∈ NS(E^{n}), corresponding to a hermitian matrix X ∈ M_{n}(End_{k}(E)). Then x ∈ NS(A) iff for all σ ∈ G,

\overline{S_{σ}}^{⊤}XS_{σ} = X.

2.3 The Néron-Severi group of the trace-zero-hypersurface

In this section, we study the Néron-Severi group of the trace-zero-hypersurface N of the Weil-restriction of a non-super singular elliptic curve with respect to a cyclic Galois extension of odd degree. In particular, we want to know if N has a principal polarization; see Subsection 1.3.4.

Let K|k be a cyclic Galois extension of degree n with Galois group G. Identify G with G^{opp} and let σ be a generating element of G.

Let E be an elliptic curve, W be the Weil-restriction of E_{K} := E ⊗_{k} K with respect to K|k. Let N be the trace-zero-hypersurface, ι_{N} : N ↪ W the embedding.

2.3.1 The canonical polarization of the trace-zero-hypersurface

Let φ be the canonical principal polarization of E. Then Res_{k}^{K}(φ) is a principal polarization of W.

As in the end of Subsection 2.1.3, let Σ_{n} denote the set {0, …, n − 1}. Then W_{K} ≃ E_{K}^{Σ_{n}}, and under this identification Res_{k}^{K}(φ) is defined by the divisor D := ∑_{i} D_{i} where D_{i} := p_{i}^{−1}(0). (This divisor is Galois-invariant under the “twisted operation” and descends to a divisor on W.)

We call the pull-back of the polarization Res_{k}^{K}(φ) the canonical polarization of N. Since W is not the product of E and N but only isogenous to the product, the pull-back of this polarization is not principal.

Recall that with Proposition 2.9, the kernel of this polarization is

K(ι_{N}^{∗}(ℒ(D))) = E ∩ N = E[n].  (2.6)

This implies:

Proposition 2.17 After the choice of the generator σ of Gal(K|k), N is canonically isomorphic to its dual.

Proof Since the polarization ϕ_{ι_{N}^{∗} ℒ(D)} has kernel E[n], N̂ is canonically isomorphic to N/E[n].

Now choose a generator σ of Gal(K|k). The morphism a_{σ} − id : N ⟶ N has kernel E[n]. Thus this morphism induces an isomorphism of N with N/E[n]. □

We can give a sufficient condition so that N is isogenous to a principally polarized abelian variety.

Proposition 2.18 Let K|k be an extension of prime degree l. If the group scheme E[l] has a non-trivial subgroup over k - e.g. if k contains an l-torsion-point of E or if char(k) = l, then N is isogenous to a principally polarized abelian variety.

Proof Any non-trivial subgroup of the group E[l] is automatically a maximal isotropic subgroup of ι_{N}^{∗}(ℒ(D)); see [Mu, p.233-234]. ^{12} If E has a k-rational l-torsion point, then this point defines a prime subgroup. If char(k) = l, then the Frobenius endomorphism of E is purely inseparable and has degree l. Its kernel defines a non-trivial (connected) subgroup of E[l]. □

To give an idea of the methods employed in this chapter, we give a new proof of equation (2.6).

If we identify W_{K} ≃ E_{K}^{G} with E_{K}^{Σ_{n}} where the “σ^{i}-th” factor corresponds to the i-th factor, then for any K-scheme S, the S-valued points of A_{K} are P = (P_{0}, …, P_{n−1}) where P_{i} ∈ E_{K}(S) and P_{0} + ⋯ + P_{n−1} = 0. So via P = (P_{0}, …, P_{n−1}) ↦ (P_{1}, …, P_{n−1}), N_{K} is identified with E_{K}^{n−1}.

Under this identification of N_{K} with E_{K}^{n−1} the divisor ι_{N}^{−1}(D) is given by ∑_{i=1}^{n−1} D_{i} + C where C is the kernel of p_{0} + ⋯ + p_{n−1}. By Proposition 2.15, the corresponding matrix is

( \begin{matrix}2 & 1 & ⋯ & 1 & 1 \\ 1 & 2 & ... & 1 & 1 \\ ⋮ & ... & ... & ... & ⋮ \\ 1 & 1 & ... & 2 & 1 \\ 1 & 1 & ⋯ & 1 & 2 \end{matrix} ) .

By subtracting the lines one sees that all .-valued points of the kernel have the from P = (P_{1}, …, P_{1}). Then one sees that P_{1} ∈ E[n]. □

We identify N_{K} with E_{K}^{n−1} as in the above proof. Then σ operates on N_{K} by σ̃ = σs, where σ is the canonical arithmetic automorphism of E_{K}^{n−1}/K and the automorphism s is given by

(P_{1}, …, P_{n−1}) ↦ (P_{2}, P_{3}, …, P_{n−1}, −P_{1} − ⋯ − P_{n−1}).

12In [Mu] it is proven that over an algebraically closed field every abelian variety is isogenous to a principally polarized abelian variety. This is not true over an arbitrary groundfield, the reason being that the kernel of a polarization need not have a non-trivial subgroup.

This corresponds to the matrix

S = ( \begin{matrix}0 & 1 & ... & 0 \\ ⋮ & ... & ... & 0 \\ 0 & ... & 0 & 1 \\ −1 & −1 & ⋯ & −1 \end{matrix} ) .  (2.7)

As a special case of Proposition 2.16 we get:

Proposition 2.19 Let K|k be a cyclic Galois extension of perfect fields and let E be a non-super-singular elliptic curve. Assume that all K-endomorphism of E_{K} are defined over k. Let N be the trace-zero-hypersurface of the Weil-restriction with respect to K|k. Let S be defined as in equation (2.7). Then the Néron-Severi group of N corresponds to the subgroup of hermitian matrices X with entries in End_{k}(E) which satisfy

S^{⊤}XS = X.

2.3.2 A basis for the Néron-Severi group

From now on we assume that the degree n is odd and that E is non-super singular.

Recall that under our assumption that n be odd, all K-endomorphism of E_{K} are defined over k.

Let n = 2m + 1. Then N is an abelian variety of dimension 2m, N_{K} ≃ E_{K}^{2m}. We want to define a basis of NS(E^{2m}) = NS(E_{K}^{2m}) which is permuted under the operation of the Galois group of K over k, i.e. if x is an element of the basis, then s^{∗}(x) shall also be an element of the basis. Then the linear invariants of this basis form a basis of NS(N_{K})^{Gal(K|k)} ≃ NS(N).

We consider the case that E has no complex multiplication first. In this case NS(E^{2m}) is the group of symmetric 2m × 2m-matrices with entries in ℤ, and so we want to find a basis for this group such that if X is an element of this basis, S^{⊤}XS is also an element of this basis.

Let E_{ij} be the matrix which is zero except at the entry (i, j) where it is 1. Let A_{i,j} be the matrix which is zero except at (i, j) and (j, i) where it is 1. (If

i = j there is only one non-zero entry.) So A_{i,i} = E_{i,i} and A_{i,j} = E_{i,j} + E_{j,i} for i ≠ j. The m(2m + 1) matrices A_{i,j} for 1 ≤ i ≤ j ≤ n form a basis of the free abelian group of symmetric matrices with entries in ℤ. For any symmetric matrix X, let X = ∑_{i≤j} X(i, j)A_{i,j} where X(i, j) ∈ ℤ. We also write X(j, i) for X(i, j) (i ≤ j).

Let B_{l} := ∑_{i=1,··· ,2m} −E_{i,l} + ∑_{j=1,··· ,2m} −E_{l,j} =

( l-th column −1 ⋮ −1 l-th row −1 ⋯ −1  −2  1 ⋯ 1 −1 ⋮ −1 ) .

Let V := ∑_{1≤i,j≤2m} E_{i,j} = ((1)) be the matrix whose entries are all 1.

Lemma 2.20 Let m be a number. Then A_{i,j} for i ≤ j, j − i ≠ m, m + 1, B_{l} for l ≠ m, m + 1 and V form a basis for the free abelian group of symmetric 2m × 2m-matrices with entries in ℤ.

Proof The set defined in the lemma consists of m(2m + 1) − (2m − 1) of the form A_{i,j}, 2m − 2 elements of the form B_{l} and V, thus the total number of elements is m(2m + 1) – as required for a basis.

We have to check that that the base change matrix from the basis A_{i,j}, i, j = 1, …, n to the elements in the lemma is invertible.

For this, we only have to check that the following 2m − 1 × 2m − 1-matrix is invertible:

( \begin{matrix}B_{1}(1, m + 1) & ⋯ & B_{m−1}(1, m + 1) & B_{m+2}(1, m + 1) & ⋯ & B_{2m}(1, m + 1) & V (1, m + 1) \\ ⋮ & & ⋮ & ⋮ & & ⋮ & ⋮ \\ B_{1}(m, 2m) & ⋯ & B_{m−1}(m, 2m) & B_{m+2}(m, 2m) & ⋯ & B_{2m}(m, 2m) & V (m, 2m) \\ B_{1}(1, m + 2) & ⋯ & B_{m−1}(1, m + 2) & B_{m+2}(1, m + 2) & ⋯ & B_{2m}(1, m + 2) & V (1, m + 2) \\ ⋮ & & ⋮ & ⋮ & & ⋮ & ⋮ \\ B_{1}(m − 1, 2m) & ⋯ & B_{m−1}(m − 1, 2m) & B_{m+2}(m − 1, 2m) & ⋯ & B_{2m}(m − 1, 2m) & V (m − 1, 2m) \end{matrix} )

This is

( \begin{matrix}B_{1} & B_{2} & ··· & B_{m−1} & B_{m+2} & ··· & B_{2m−1} & B_{2m} & V \\ ↓ & ↓ & & ↓ & ↓ & & ↓ & ↓ & ↓ \\ −1 & & & & 0 & ⋯ & ⋯ & 0 & 1 \\ & −1 & & & −1 & & & & 1 \\ & & ... & & & ... & & & ⋮ \\ & & & −1 & & & −1 & & 1 \\ 0 & ⋯ & ⋯ & 0 & & & & −1 & 1 \\ −1 & & & & −1 & & & & 1 \\ & −1 & & & & ... & & & 1 \\ & & ... & & & & −1 & & ⋮ \\ & & & −1 & & & & −1 & 1 \end{matrix} ) .

Except for the sign this has the same determinant as

( \begin{matrix}1 & & & & 0 & ⋯ & ⋯ & 0 & 1 \\ & 1 & & & 1 & & & & 1 \\ & & ... & & & ... & & & ⋮ \\ & & & 1 & & & 1 & & 1 \\ 0 & ⋯ & ⋯ & 0 & & & & 1 & 1 \\ 0 & & & & 1 & & & & 0 \\ & 0 & & & −1 & ... & & & 0 \\ & & ... & & & ... & 1 & & ⋮ \\ & & & 0 & & & −1 & 1 & 0 \end{matrix} ) .

And the determinant of this matrix is

det ( \begin{matrix}& & & 1 & 1 \\ 1 & & & & 0 \\ −1 & ... & & & 0 \\ & ... & 1 & & ⋮ \\ & & −1 & 1 & 0 \end{matrix} ) = det ( \begin{matrix}1 \\ −1 & ... \\ & ... & 1 \\ & & −1 & 1 \end{matrix} ) = 1.

□

We now check that this basis is permuted under the Galois-operation, i.e. if X is an element of the basis, then S^{⊤}XS is another element of the basis.

We do some calculations first. Let j < 2m. Then E_{i,j}S = E_{i,j+1}. E_{i,2m}S = ∑_{j=1,...,2m} −E_{i,j}. Let i < 2m. Then S^{⊤}E_{i,j} = E_{i+1,j}. S^{⊤}E_{2m,j} = ∑_{i=1,...,2m} −E_{i,j}.

It follows Let i, j < 2m. Then S^{⊤}E_{i,j}S = E_{i+1,j+1}. Let i < 2m. Then S^{⊤}E_{i,2m}S = S^{⊤}(∑_{j=1,...,2m} −E_{i,j}) = ∑_{j=1,...,2m} −E_{i+1,j}. Let j < 2m. Then S^{⊤}E_{2m,j}S = S^{⊤}E_{2m,j+1} = ∑_{i=1,...,2m} −E_{i,j+1}. S^{⊤}E_{2m,2m}S = S^{⊤}(∑_{j=1,...,2m} −E_{2m,j}) = ∑_{i,j=1,...,2m} E_{i,j}.

And this implies Let i < 2m. Then S^{⊤}(∑_{j=1,...,2m} E_{i,j})S = ∑_{j=1,...,2m−1} E_{i+1,j+1} + ∑_{j=1,...,2m} −E_{i+1,j} = −E_{i+1,1}. S^{⊤}(∑_{j=1,...,2m} E_{2m,j})S = ∑_{i=1,...,2m, j=1,...,2m−1} −E_{i,j+1} + ∑_{i,j=1,...,2m} E_{i,j} = ∑_{i=1,...,2m} E_{i,1}. Let j < 2m. Then S^{⊤}(∑_{i=1,...,2m} E_{i,j})S = ∑_{i=1,...,2m−1} E_{i+1,j+1} + ∑_{i=1,...,2m} −E_{i,j+1} = −E_{1,j+1}. S^{⊤}(∑_{i=1,...,2m} E_{i,2m})S = ∑_{i=1,...,2m−1 j=1,...,2m} −E_{i+1,j} + ∑_{i,j=1,...,2m} E_{i,j} = ∑_{j=1,...,2m} E_{1,j}. And S^{⊤}(∑_{i,j=1,...,2m} E_{i,j})S = (S^{⊤}(∑_{i=1,...,2m−1} ∑_{j=1,...,2m} E_{i,j})S + S^{⊤}(∑_{j=1,...,2m} E_{2m,j})S = (∑_{i=1,...,2m−1} −E_{i+1,1}) + (∑_{i=1,...,2m} E_{i,1}) = E_{1,1}.

It follows:

Lemma 2.21 Let 1 < i ≤ j. Then S^{⊤}A_{i,j}S = A_{i+1,j+1}. S^{⊤}A_{2m,2m}S = V. S^{⊤}V S = A_{1,1}. Let i < 2m. Then S^{⊤}A_{i,2m}S = B_{i+1}. S^{⊤}B_{2m}S = B_{1}. Let l < 2m. Then S^{⊤}B_{l}S = A_{1,l+1}.

With this result it is easy to give a basis of NS(N) as a subgroup of M_{2m×2m}(ℤ). For the convenient notation let for l = 0, …, 2m − 1 V_{l} := ∑_{i=1,...,2m−l} A_{i,i+l}.

So if we call the main-diagonal the 0-diagonal and give numbers 1, …, 2m − 1 to the upper diagonals and numbers −1, …, −2m + 1 to the lower diagonals, then V_{i} is zero except at the ith and −ith diagonal where all entries are 1.

It follows from the lemma that the following matrices define a basis of NS(N): V_{0} + ∑_{i=0,...,2m−1} V_{i}. V_{1} + B_{1} + B_{2m} if m ≥ 2. V_{l} + V_{2m−l+1} + B_{l} + B_{2m−l+1} for l = 2, …, m − 1 (if 2 ≤ l ≤ m − 1, then m + 1 < 2m − l + 1 ≤ 2m − 1).

We now study the case that E has complex multiplication (over k). Since we assumed that E is non-super-singular, End_{k}(E) is an order in an imaginary quadratic field. There exists an λ ∈End_{k}(E) such that 1, λ is a basis of the free abelian group End_{k}(E). (If (1, λ′) is a basis of the main order and f is the conductor of the order then (1, fλ′) is a basis of End_{k}(E).)

With respect to this λ we want to define a basis of the free abelian group of hermitian n × n-matrices with entries in ℤ[λ] =End_{k}(E). The basis defined above will be a part of the new basis. Then we will show that the new elements of the basis are also permuted by the Galois action.

Let i ≠ j. Let A_{i,j}^{λ} be the matrix which is zero except at the places (i, j) and (j, i). At the place (i, j) it has value λ, at place (j, i) is has value \overline{λ}. So A_{i,j} := λE_{i,j} + \overline{λ}E_{j,i}.

A_{i,j} (i ≤ j), A_{i,j}^{λ} (i < j) is a basis for the group of hermitian n × n-matrices with entries in ℤ[λ]. If X is any such matrix we define X(i, j, λ) by X = ∑_{i≤j} X(i, j)A_{i,j} + ∑_{i<j} X(i, j, λ)A_{i,j}^{λ}.

Let B_{l}^{λ} := ∑_{i=1,··· ,2m} −λE_{i,l} + ∑_{j=1,...,2m} −\overline{λ}E_{l,j} =

( l-th column −λ ⋮ −λ _{l-th row} −\overline{λ} ⋯ −\overline{λ} −λ − \overline{λ} −\overline{λ} ⋯ −\overline{λ} −λ ⋮ −λ ) .

Let V^{λ} := ∑_{l=1,...,2m}(λ + \overline{λ})A_{l,l} + ∑_{1≤j<i≤2m} A_{i,j}^{λ} =

( \begin{matrix}λ + \overline{λ} & λ & … & λ \\ \overline{λ} & ... & ... & ⋮ \\ ⋮ & ... & ... & λ \\ \overline{λ} & ... & \overline{λ} & λ + \overline{λ} \end{matrix} ) .

Lemma 2.22 A_{i,j} for i ≤ j, j − i ≠ m, m + 1, B_{l} for l ≠ m, m + 1, V, A_{i,j}^{λ} for i < j, j − 1 ≠ m, m + 1, B_{l}^{λ} for l ≠ m, m + 1 and V^{λ} form a basis for the free abelian group of hermitian 2m × 2m-matrices with entries in ℤ[λ].

Proof We only have to check that the matrix

( \begin{matrix}B_{1}^{λ}(1, m + 1, λ) & … & B_{m−1}^{λ}(1, m + 1, λ) & B_{m+2}^{λ}(1, m + 1, λ) & … & & B_{2m}^{λ}(1, m + 1, λ) & V^{λ}(1, m + 1, λ) \\ ⋮ & & ⋮ & ⋮ & & ⋮ & & ⋮ \\ B_{1}^{λ}(m, 2m, λ) & … & B_{m−1}^{λ}(m, 2m, λ) & B_{m+2}^{λ}(m, 2m, λ) & … & & B_{2m}^{λ}(m, 2m, λ) & V^{λ}(m, 2m, λ) \\ B_{1}^{λ}(1, m + 2, λ) & … & B_{m−1}^{λ}(1, m + 2, λ) & B_{m+2}^{λ}(1, m + 2, λ) & … & & B_{2m}^{λ}(1, m + 2, λ) & V^{λ}(1, m + 2, λ) \\ ⋮ & & ⋮ & ⋮ & & & ⋮ & ⋮ \\ B_{1}^{λ}(m − 1, 2m,λ) & … & B_{m−1}^{λ}(m − 1, 2m,λ) & B_{m+2}^{λ}(m − 1, 2m,λ) & … & & B_{2m}^{λ}(m − 1, 2m,λ) & V^{λ}(m − 1, 2m,λ) \end{matrix} )

is invertible. But this is the same matrix as the one considered in Lemma 2.20. □

Lemma 2.23 Let i < j < 2m. Then S^{⊤}A_{i,j}^{λ}S = A_{i+1,j+1}^{λ}. Let i < 2m. Then S^{⊤}A_{i,2m}^{λ}S = B_{i+1}^{λ}. S^{⊤}B_{2m}^{λ}S = B_{1}^{λ}. Let l < 2m. Then S^{⊤}B_{l}^{λ}S = A_{1,l+1}^{λ}. S^{⊤}V^{λ}S = V^{λ}.

Proof Everything is proven by the calculations preceeding Lemma 2.21 but the last equation. Now, S^{⊤}(∑_{1≤i≤j≤2m} E_{i,j})S = S^{⊤}(∑_{1≤i≤j≤2m−1} E_{i,j})S+S^{⊤}(∑_{i=1,...,2m} E_{i,2m})S = ∑_{2≤i≤j≤2m} E_{i,j} + ∑_{1≤j≤2m} E_{1,j} = ∑_{1≤i≤j≤2m} E_{i,j} and S^{⊤}(∑_{1≤j≤i≤2m} E_{i,j})S = S^{⊤}(∑_{1≤j≤i≤2m−1} E_{i,j})S + S^{⊤}(∑_{j=1,...,2m} E_{2m,j})S = ∑_{2≤j≤i≤2m} E_{i,j} + ∑_{1≤i≤2m} E_{i,1} = ∑_{1≤j≤i≤2m} E_{i,j}. This implies S^{⊤}V^{λ}S = V^{λ}. □

Let for l = 1, …, 2m V_{l}^{λ} := ∑_{l=1,...,2m−l} A_{i,i+l}^{λ}. Then the following matrices define a basis of NS(N): V_{0} + ∑_{i=0,...,2m−1} V_{i} V_{1} + B_{1} + B_{2m} if m ≥ 2 V_{l} + V_{2m−l+1} + B_{l} + B_{2m−l+1} for l = 2, …, m − 1 (if 2 ≤ l ≤ m − 1, then m + 1 < 2m − l + 1 ≤ 2m − 1) V_{1}^{λ} + B_{1}^{λ} + B_{2m}^{λ} if m ≥ 2 V_{l}^{λ} + V_{2m−l+1}^{λ} + B_{l}^{λ} + B_{2m−l+1}^{λ} for l = 2, …, m − 1 (if 2 ≤ l ≤ m − 1, then m + 1 < 2m − l + 1 ≤ 2m − 1) V^{λ} = (λ + \overline{λ})V_{0} + ∑_{l=1,...,2m−1} V_{l}^{λ}.

We get the following proposition:

Proposition 2.24 Let K|k be a cyclic Galois extension of perfect fields of degree n = 2m + 1. Let E be a non-super-singular elliptic curve over k. Let N be the trace-zero-hypersurface of the Weil-Restriction of E_{K} with respect to K|k. Then NS(N), the Néron-Severi group of N, equals NS(N)^{Gal(\overline{k}|k)} and is canonically a subgroup of the matrix group M_{2m×2m}(End_{k}(E)). Under this inclusion, the free abelian group NS(N) has the following basis:

If E has no complex multiplication: F_{0} := V_{0} + ∑_{l=0,...,2m−1} V_{l} – this defines the canonical polarization of N F_{1} := V_{1} + B_{1} + B_{2m} if m ≥ 2 F_{l} := V_{l} + V_{2m−l+1} + B_{l} + B_{2m−l+1} for l = 2, …, m − 1 (if 2 ≤ l ≤ m − 1, then m + 1 < 2m − l + 1 ≤ 2m − 1). In particular, NS(N) is m-dimensional.

If E has complex multiplication and 1, λ is a basis of End_{k}(E): F_{0}, …, F_{m−1} and F_{0}^{λ} := (λ + \overline{λ})V_{0} + ∑_{l=1,...,2m−1} V_{l}^{λ}. F_{1}^{λ} := V_{1}^{λ} + B_{1}^{λ} + B_{2m}^{λ} if m ≥ 2 F_{l}^{λ} := V_{l}^{λ} + V_{2m−l+1}^{λ} + B_{l}^{λ} + B_{2m−l+1}^{λ} for l = 2, …, m − 1 In particular, NS(N) is 2m-dimensional.

In this proposition, we use the same notations as above, i.e. B_{l} := ∑_{i=1,··· ,2m} −E_{i,l} + ∑_{j=1,...,2m} −E_{l,j} B_{l}^{λ} := ∑_{i=1,··· ,2m} −λE_{i,l} + ∑_{j=1,...,2m} −\overline{λ}E_{l,j} V_{l} := ∑_{i=1,...,2m−l} E_{i,i+l} + ∑_{j=1,...2m−l} E_{j+l,j} for l ≥ 0 V_{l}^{λ} := ∑_{i=1,...,2m−l} λE_{i,i+l} + ∑_{j=1,...,2m−l} \overline{λ}E_{j+l,j} for l ≥ 1.

Definition Let 𝒢_{m} be the subgroup of M_{2m×2m}(ℤ) which is generated by the matrices F_{0}, …, F_{m}. We have seen that F_{0}, …, F_{m} is a basis for this group.

Let N be the trace-zero-hypersurface as above. Then NS(N) is embedded in M_{n}(End_{k}(E)), and the elements of NS(N) which correspond under this injection to elements of 𝒢_{m} define a subgroup of NS(N) which we call the generic part of NS(N). Loosely speaking, the elements of the generic part of NS(N) are those elements which “do not come from complex multiplication”. In particular, if E has no complex multiplication, the generic part of NS(N) is the full group.

Theorem 7 Let K|k be a cyclic Galois extension of perfect fields of odd degree n. Let E be a non-super-singular elliptic curve over k. Let N be the trace-zero-hypersurface of the Weil-Restriction of E_{K} with respect to K|k. Then NS(N), the Néron-Severi group of N, equals NS(N\overline{k})^{Gal(\overline{k}|k)}.

If E has no complex multiplication (over k), the kernel of any element of NS(N) contains the group scheme E ∩ N = E[n] of n-torsion points of E.

If E has complex multiplication, the statement is true for all elements of the generic part of NS(N) defined above.

Proof Let n = 2m + 1. Under the isomorphism N_{K} ≃ E_{K}^{2m}, the .-valued points of E_{K}[n] correspond to the .-valued points of E_{K}^{2m} which are of the form (P, …, P) for P ∈ E_{K}[n]. We claim that for l = 0, …, m − 1, the sum of all the columns of

F_{l} is a vector of the form n ( a_{1} ; ⋮ ; a_{2m} ) with a_{i} ∈ ℤ. It follows from this claim that

all .-valued points of E[n] are mapped to zero under every element of the generic part of NS(N).

The claim is obviously true for F_{0}; see Proposition 2.9 with the second proof, p. 50.

We make two definitions: First, for every symmetric 2m × 2m-matrix X, we denote ∑_{j=1,...,2m} X(i, j) by X^{(i)}. The claim is then that for all l = 1, …, m, i = 1, …, 2m, F_{l}^{(i)} is divisible by n. Second, for 1 ≤ i ≤ j ≤ 2m let χ_{[i,j]} := ∑_{γ=i,...,j} δ_{γ,.} : {1, …, 2m} ⟶ ℤ, i.e. χ_{[i,j]}(μ) = 1 iff i ≤ μ ≤ j and 0 otherwise. (1 ≤ μ ≤ 2m)

Then V_{l}^{(.)} = χ_{[1,2m−l]} + χ_{[l+1,2m]}.

In particular, V_{1}^{(1)} = 1, V_{1}^{(i)} = 2 for 2 ≤ i ≤ 2m − 1, V_{1}^{(2m)} = 1. Thus V_{1}^{(i)} = 2 − δ_{1,i} − δ_{2m,i}.

Further, for l = 2, ≤ m − 1, 1 ≤ i ≤ 2m, (V_{l} + V_{2m−l+1})^{(i)} = (χ_{[1,2m−l]} + χ_{[l+1,2m]} + χ_{[1,l−1]} + χ_{[2m−l+2,2m]})(i) = 2 − δ_{l,i} − δ_{2m−l+1,i}.

It follows for l = 1, … m − 1 : For i ≠ l, 2m − l + 1 is F_{l}^{(i)} = 2 + B_{l}(i, l) + B_{2m−l+1}(i, 2m − l + 1) = 2 − 2 = 0. F_{l}^{(l)} = 1 + ∑_{j=1,...,2m} B_{l}(l, j) + B_{2m−l+1}(l, 2m − l + 1) = 1 − (2m + 1) − 1 = −(2m + 1) = −n. F_{l}^{(2m−l+1)} = 1 + ∑_{j=1,...,2m} B_{2m−l+1}(2m − l + 1, j) + B_{l}(2m − l + 1, l) = 1 − (2m + 1) − 1 = −(2m + 1) = −n. □

If follows:

Corollary 2.25 No element of the generic part of NS(N) defines a principal polarization.

We already know that the canonical polarization has kernel E[n]. So:

Corollary 2.26 Let E have no complex multiplication (over k). Then N is not principally polarized. If n is a prime, N is isogenous to a principally polarized abelian variety iff E[n] has a non-trivial sub-groupscheme over k.

2.3.3 Complex multiplication

Let K|k be as above and let E be a non-super-singular elliptic curve with complex multiplication (over k). We want to study whether the trace-zero-hypersurface N is principally polarized. Since NS(N) ≃ NS(N\overline{k})^{Gal(\overline{k}|k)}, all polarizations of N are defined by ample sheaves on N itself.

With Proposition 2.24 and the help of Lemmata 2.12 and 2.14 the question whether N has a principal polarization is equivalent to a numerical conditions:

There exists a sheaf with Euler characteristic 1 iff the polynomial equation of degree 2m in 2m variables

det(x_{0}F_{0} + ⋯ + x_{m−1}F_{m−1} + y_{0}F_{0}^{λ} + ⋯ + y_{m−1}F_{m−1}^{λ}) = ±1

is solvable in the integers.

A solution to this equation defines a principal polarization iff x_{0}F_{0} + ⋯ + x_{m−1}F_{m−1} + y_{0}F_{0}^{λ} + y_{m−1}F_{m−1}^{λ} has only positive eigenvalues. (Of course, this implies that the determinant had to be 1 in the above equation.)

We now perform these calculations explicitely for n = 3.

Under our assumption of non-super-singularity, End_{k}(E) is an order in the imaginary quadratic field End_{k}^{0}(E). Let End_{k}^{0}(E) = ℚ(\sqrt{D}), D < 0 and let δ := \sqrt{D}. There exists an f ∈ ℕ such that End_{k}(E) is of the form ℤ + f𝒪 where 𝒪 is the main order in the field End_{k}^{0}(E) (i.e. it is the normal closure of ℤ). The number f is called the conductor of the order.

D ≡ 2, 3 mod 4 Then 1, fδ is a basis of End_{k}(E).

Note that if X is some 2 × 2-matrix with det(X) > 0 then either X or −X has positive eigenvalues. So there exists a principal polarization on N iff

1 =^{!} det(xF_{0} + yF_{0}^{fδ}) = det ( \begin{matrix}2x & x + yfδ \\ x − yfδ & 2x \end{matrix} ) = 3x^{2} + y^{2}f^{2}D

is solvable for x, y ∈ ℤ.

D ≡ 1 mod 4 Then 1, f \frac{1+δ}{2} is a basis of End_{k}(E).

xF_{0} + yF_{0}^{f \frac{1+δ}{2}} = ( \begin{matrix}2x + yf & x + yf \frac{1+δ}{2} \\ x + yf \frac{1−δ}{2} & 2x + yf \end{matrix} )

The determinant of this matrix is

4x^{2} + 4xyf + y^{2}f^{2} − x^{2} − xyf \frac{1 + δ}{2} − xyf \frac{1 − δ}{2} − y^{2}f^{2} \frac{1 − D}{4} =

3x^{2} + xy(4f − f) + y^{2}f^{2} \frac{4 − 1 + D}{4} =

3x^{2} + 3xyf + y^{2}f^{2} \frac{3 + D}{4}

So in this case N has a principal polarization iff

3x^{2} + 3xyf + y^{2}f^{2} \frac{3 + D}{4} = 1

is solvable with x, y ∈ ℤ.

Theorem 8 Let K|k be a Galois field extension of perfect fields of degree 3. Let E be a non-super-singular elliptic curve over k. Let N be the trace-zero-surface of the Weil-restriction of E_{K} with respect to K|k.

If E has no complex multiplication (over k), then the Néron-Severi group of N is a free abelian group on 1 generator, generated by an ample sheaf with kernel E[3]. In particular, N is not principally polarized.

If E has complex multiplication (over k), then NS(N) is a free abelian group on 2 generators. Let End_{k}^{0}(E) = ℚ(\sqrt{D}), D < 0. Let f be the conductor of the order End_{k}(E). Then:

If D ≡ 2, 3 mod 4, then N is principally polarized iff 3x^{2} + y^{2}f^{2}D = 1 is solvable in ℤ.

If D ≡ 1 mod 4 then N is principally polarized iff 3x^{2} + 3xyf + y^{2}f^{2} \frac{3+D}{4} = 1 is solvable in ℤ.

2.4 Curves on the trace-zero-hypersurface for degree 3

For this section, let K|k be a Galois field extension of perfect fields of degree 3, E an elliptic k-curve, W the Weil-restriction of A_{K} with respect to K|k and N the trace-zero-hypersurface on W. ^{13}

We want to study the trace-zero-surface N using explicit equations and thereby relate the results of the previous section with explicit calculations on N.

By a theorem of A.Weil, a principal polarization of an abelian surface A over some field k is defined by a proper geometrically reduced curve on A which is either non-singular, geometrically irreducible and of genus 2 or geometrically the pointed union of two elliptic curves. In the first case, A is the Jacobian of this curve, in the second A\overline{k} is isomorphic to the direct product of the two elliptic curves; see Proposition A.27 in Subsection A.2.7 in the appendix.

Now let A be a simple abelian surface which is isogenous to a principally polarized abelian surface Ã, i.e. there exists an isogeny π : Ã ⟶ A. Assume that π is not an isomorphism. Then if the polarization on Ã is given by a geometrically irreducible curve, the image of this curve on A is a singular curve whose normalization has genus 2, and if the polarization on Ã is given geometrically by two elliptic curves, the images of these elliptic curves are still elliptic curves, but they intersect in more than one point.

We want to find these curves in cases in which we know that the trace-zero-hypersurface is isogenous to a principally polarized abelian variety.

We will succeed insofar as for char(k) = 3, we will find a curve on N whose normalization has genus 2. If char(k) > 3, ζ_{3} ∈ k and the x-coordinate of a 3torsion point lies in k, we will find such a curve after possibly a quadratic extension of k.

Before starting with the concrete calculations we remark that by Corollary 2.8 if E is non-super-singular and ζ_{3} ∉ End_{k}(E), N is simple. Now, curves with j-invariant 0 have an endomorphism algebra which contains ζ_{3}. Thus with [Mu, Appendix I, p.258, Corollary], we conclude that if k is finite, N is simple provided that E is non-super-singular and E\overline{k} is not isogenous to an elliptic curve with j-invariant 0.

2.4.1 The trace-zero-hypersurface for char(k) ≠ 2, 3 ^{14}

Let char(k) ≠ 2, 3 and assume that the 3-rd roots of unity are contained in k. We want to calculate equations of the trace-zero-hypersurface N.

13If S is a closed subscheme of a variety V, we say that S is on V.

14The results in this subsection are based on calculations by G.Frey and N.Naumann. Some corrections and additional remarks are due to the author.

Let ζ_{3} ∈ k be a third root of unity. (If k = 𝔽_{p}, p prime, this means that p ≡ 1 mod 3.) By Kummer-theory, there exists an α ∈ k with α^{3} = a ∈ k. Let σ ∈ Gal(K|k) be given by σ(α) = ζ_{3}α.

Let the elliptic curve E be defined by the affine equation

Y^{2} = X^{3} + AX + B,  (2.8)

where A, B ∈ k.

According to the “construction of the Weil-restriction by restriction of scalars” (see Subsection 1.1.3), we make the substitutions

\begin{aligned}X & = & x_{0} ⊗_{k} 1 + x_{1} ⊗_{k} α + x_{2} ⊗_{k} α^{2} \\ Y & = & y_{0} ⊗_{k} 1 + x_{1} ⊗_{k} α + x_{2} ⊗_{k} α^{2} \end{aligned}  (2.9)

and get the equation

\begin{matrix}(y_{0} ⊗_{k} 1 + x_{1} ⊗_{k} α + x_{2} ⊗_{k} α^{2})^{2} = \\ (x_{0} ⊗_{k} 1 + x_{1} ⊗_{k} α + x_{2} ⊗_{k} α^{2})^{3} + A(x_{0} ⊗_{k} 1 + x_{1} ⊗_{k} α + x_{2} ⊗_{k} α^{2}) + B ⊗_{k} 1. \end{matrix}

Expanding out this equation, we get:

\begin{aligned}y_{0}^{2} + 2ay_{1}y_{2} & = & x_{0}^{3} + ax_{1}^{3} + a^{2}x_{2}^{3} + 6ax_{0}x_{1}x_{2} + Ax_{0} + B, \\ ay_{2}^{2} + 2y_{0}y_{1} & = & 3x_{0}^{2}x_{1} + 3ax_{0}x_{2}^{2} + 3ax_{1}^{2}x_{2} + Ax_{1}, \\ y_{1}^{2} + 2y_{0}y_{2} & = & 3x_{0}^{2}x_{2} + 3x_{0}x_{1}^{2} + 3ax_{1}x_{2}^{2} + Ax_{2}. \end{aligned}  (2.10)

This system of equations defines an open, affine part W_{0} of the Weil-restriction of W in 𝔸_{k}^{6}, the 6-dimensional affine space over k. (The closed subset W \W_{0} is equal to the support of the divisor D defining the “canonical” polarization of W.)

We want to calculate the intersection of the trace-zero-hypersurface N with W_{0}. We will denote this surface by N_{0}. We think of N_{0} as a surface in 𝔸_{k}^{6}.

The trace zero-hypersurface is defined by expanding the equation ^{15}

P ⊕ σ(P) = ⊖σ^{2}(P),

(P a A ⊗_{k} K-valued point of E for some k-algebra A.)

(2.11)

Let P be a A ⊗_{k} K-valued point of E which corresponds to a A-valued point on W_{0} and satisfies this equation for the X-coordinate, i.e.:

X(P ⊕ σ(P)) = X(⊖σ^{2}(P)) = X(σ^{2}(P))  (2.12)

Then P satisfies (2.11) or it satisfies

P ⊕ σ(P) = σ^{2}(P)  (2.13)

If this is the case, P = σ^{2}(P) ⊖ σ(P), and thus the A-valued point of W corresponding to P factors through E. This means that P = σ(P) = σ^{2}(P), and substituting this into (2.13), we get P = 0, the zero on E. But this is not possible since the zero on E corresponds to a point of W which does not lie on W_{0}. Thus we may use equation (2.12) instead of (2.11).

15In this section, in order to distinguish the addition on E from addition of coordinates, we write ⊕ for the addition on E.

We now want to use the “usual” group law on an elliptic curve E with Weierstraß-equation given as above; see [Si, III,2]. For a \overline{k}-valued point P, let (x(P), y(P)) denote the coordinates. Then, if P_{1}, P_{2} are two \overline{k}-valued points with x(P_{1}) ≠ x(P_{2}),

x(P_{1} ⊕ P_{2}) = (\frac{y(P_{2}) − y(P_{1})}{x(P_{2}) − x(P_{1})})^{2} − x(P_{1}) − x(P_{2}).  (2.14)

To use this formula, we restrict ourselves from A ⊗_{k} K-valued points as above to \overline{k} ⊗_{k} K ≃ \overline{k}^{3}-valued points. This is possible because the subvariety N_{0} of W_{0} is uniquely determined by its \overline{k}-valued points.

Let P_{1} and P_{2} be two \overline{k}^{3}-valued points with x-coordinate x(P_{i}) = (x^{(1)}(P_{i}), x^{(2)}(P_{i}), x_{3}^{(3)}(P_{i})). Then because of the isomorphism E(\overline{k}^{3}) ≃ E(\overline{k})^{3}, equation (2.14) remains valid if x_{i}(P_{1}) ≠ x_{i}(P_{2}) for i = 1, 2, 3.

Let X = x_{0} ⊗_{k} 1 + x_{1} ⊗_{k} α + x_{2} ⊗_{k} α^{2} ∈ \overline{k} ⊗_{k} K. Then X corresponds to (x^{(1)}, x^{(2)}, x^{(3)}) ∈ \overline{k}^{3} where x^{(i)} = (id\overline{k} ⊗_{k} σ^{i−1})(X) = x_{0} + ζ_{3}^{i−1}αx_{1} + ζ_{3}^{2(i−1)}α^{2}x_{2}.

Let P ∈ E(\overline{k}⊗_{k}K) with x-coordinate X = x_{0}⊗_{k}1+x_{1}⊗_{k}α+x_{2}⊗_{k}α^{2} ∈ \overline{k}⊗_{k}K. We want to apply the group law (2.14) to X and σ(X). This is possible if x^{(i)} ≠ x^{(j)} for i, j with i ≠ j. We have

\begin{matrix}x^{(i)} = x^{(j)} ⟷ \\ x_{0} + ζ^{i−1}αx_{1} + ζ_{3}^{i−1}α^{2}x_{2} = x_{0} + ζ_{3}^{j−1}αx_{1} + ζ_{3}^{j−1}α^{2}x_{2} ⟷ \\ (ζ_{3}^{i−1} − ζ_{3}^{j−1})x_{1} = α(ζ_{3}^{2(i−1)} − ζ_{3}^{2(j−1)})x_{2}. \end{matrix}  (2.15)

Thus the group law (2.14) remains valid outside the intersection of W_{0} with the three hyperplanes in 𝔸_{k}^{6} defined by (2.15). We denote the union of these hyperplanes by H. We resrict ourselves to the subvariety W_{0}\H.

Now equation (2.12) is equivalent to

(\frac{σ(Y) − Y}{σ(X) − X} )^{2} = X + σ(X) + σ^{2}(X).  (2.16)

Under the substitutions (2.9), this is equivalent to

((y_{1} −ζ_{3}y_{1})⊗_{k} α+(y_{2} −ζ_{3}^{2}y_{2})⊗_{k} α^{2})^{2} = 3x_{0}((x_{1} −ζ_{3}x_{1})⊗_{k} α+(x_{2} −ζ_{3}^{2}x_{2})⊗_{k} α^{2})^{2}.

Expanding out one obtains

\begin{matrix}(1 − ζ_{3})(1 − ζ_{3}^{2})a (y_{1}y_{2} − 3x_{0}x_{1}x_{2}) ⊗_{k} 1 + (1 − ζ_{3}^{2})^{2}a (y_{2}^{2} − 3x_{0}x_{2}^{2}) ⊗_{k} α+ \\ (1 − ζ_{3})^{2}a (y_{1}^{2} − 3x_{0}x_{1}^{2}) ⊗_{k} α^{2} = 0. \end{matrix}

Thus as a subvariety of W_{0}\H, N_{0}\H is defined by

\begin{aligned}y_{1}y_{2} & = & 3x_{0}x_{1}x_{2} \\ y_{1}^{2} & = & 3x_{0}x_{1}^{2} \\ y_{2}^{2} & = & 3x_{0}x_{2}^{2}. \end{aligned}  (2.17)

We can insert these equations into (2.10). Thus N_{0}\H is defined (as a subvariety of 𝔸_{k}^{6}\H) by (2.17) and

\begin{aligned}y_{0}^{2} & = & x_{0}^{3} + ax_{1}^{3} + a^{2}x_{2}^{3} + Ax_{0} + B \\ 2y_{0}y_{1} & = & 3x_{0}^{2}x_{1} + 3ax_{1}^{2}x_{2} + Ax_{1} \\ 2y_{0}y_{2} & = & 3x_{0}^{2}x_{2} + 3ax_{1}x_{2}^{2} + Ax_{2}. \end{aligned}  (2.18)

Note that the variety defined by (2.17) and (2.18) in 𝔸_{k}^{6} contains E, thus it is not birational to N_{0}.

Now regard the projection

q : 𝔸_{k}^{6} ⟶ 𝔸_{k}^{4}, (x_{0}, x_{1}, x_{2}, y_{0}, y_{1}, y_{2}) ↦ (x_{0}, x_{1}, x_{2}, y_{0}).

The restriction of q to the variety defined by (2.17) and (2.18) is an isomorphism outside y_{0} = 0, because for y_{0} ≠ 0, we can divide the last two equations of (2.18) by 2y_{0} and thus obtain equations for y_{1} and y_{2}. (For y_{0} = 0, the projection induces a 2-fold covering: For y_{0} = 0, equation (2.18) imposes no condition on y_{1}, y_{2}, and by (2.17), (y_{1}, y_{2}) is only determined up to a sign.)

Multiplying the resulting equations by 4y_{0}^{2} and dividing by x_{1}x_{2}, x_{1}^{2} and x_{2}^{2} respectively (which is possible outside H), (2.17) becomes

(3x_{0}^{2} + 3ax_{1}x_{2} + A)^{2} = 12x_{0}y_{0}^{2}.  (2.19)

Thus under q, N_{0}\(H ∪ {y_{0} = 0}) is isomorphic to the variety defined by this equation and the first equation of (2.18), i.e. to the variety defined by the following equations in 𝔸_{k}^{4}\(q(H) ∪ {y_{0} = 0}).

\begin{aligned}y_{0}^{2} & = & x_{0}^{3} + ax_{1}^{3} + a^{2}x_{2}^{3} + Ax_{0} + B \\ (3x_{0}^{2} + 3ax_{1}x_{2} + A)^{2} & = & 12x_{0}(x_{0}^{3} + ax_{1}^{3} + a^{2}x_{2}^{3} + Ax_{0} + B) \end{aligned}  (2.20)

Let N_{1} be the variety defined by these two equations in 𝔸_{k}^{4}. We now want to show that N_{1} has only one irreducible component and thus is birational to N_{0} = N ∩W_{0} or – what is the same – to N.

The second equation defines by Krull’s Principal Ideal Theorem ([Ei, Theorem 10.1]) a subscheme of pure dimension 2 in 𝔸_{k}^{3}; the projection r : 𝔸_{k}^{4} ⟶ 𝔸_{k}^{3} : (x_{0}, x_{1}, x_{2}, y_{0}) ↦ (x_{0}, x_{1}, x_{2}) restricts to a finite (thus surjective) morphism of degree 2 from N_{1} to the scheme defined by the second equation.

We study the scheme defined by the second equation first. We know that this scheme is outside r ∘ q(H) isomorphic to r ∘ q(N_{0}). If it had more than one component, the additional component would have to be contained in r∘q(H). Since it has pure dimension 2, the additional component would have to be the image of one component of H under r ∘ q. But the intersection of the scheme defined by the second equation with H is at most 1-dimensional and so the scheme does not have such a component.

Since no component of the variety defined by the second equation lies in r ∘ q(H), no component of N_{1} lies in r^{−1}(rq(H)) = p(H). Thus N_{1} is birational to N_{0}, more precisely, the restriction of p to N_{1} is a birational map to N_{1} which is an isomorphism outside H ∪ {y_{0} = 0}.

There is a fibration by projection onto x_{0}. We will now examine the resulting curves if we fix x_{0}. The intersection of these curves with p(H) and y_{0} = 0 respectively is 0-dimensional and so these curves are birational to curves which lie on N. ^{16}

Let x_{0} ≠ 0 be fixed.

By (2.19), the fibers under the projections to x_{0} consist (geometrically) of two isomorphic components – defined by the second equation of (2.20) (which might itself be reducible), both defined over k(\sqrt{12x_{0}}).

Let C_{0} denote the affine k-scheme defined by the second equation. We claim that C_{0} is a geometrically irreducible, geometrically reduced k-curve.

Proof Let f(x_{1}, x_{2}) := (3x_{0}^{2} + 3ax_{1}x_{2} + A)^{2} − 12x_{0}(x_{0}^{3} + ax_{1}^{3} + a^{2}x_{2}^{3} + Ax_{0} + B) be the defining polynomial of C_{0}.

Consider the morphism C_{0}\overline{k} ⟶ 𝔸1 ; \overline{k} defined by (x_{1}, x_{2}) ↦ x_{1}, corresponding to the inclusion \overline{k}[x_{1}] ↪ \overline{k}[x_{1}, x_{2}]/(f).

Under all specializations \overline{k}[x_{1}] ⟶ \overline{k} as well as under the inclusion \overline{k}[x_{1}] ⟶ \overline{k}(x_{1}), the polynomial f has degree 3.

Thus for some topological point x of 𝔸1 ; \overline{k}, the fiber of the morphism C_{0}\overline{k} ⟶ 𝔸1 ; \overline{k} at the fixed point x is given by a 3-dimensional algebra over the corresponding residue class field at x.

In particular, the generic points of C_{0}\overline{k} are mapped to the generic point of 𝔸1 ; \overline{k}. This implies that the scheme C_{0}\overline{k} is irreducible iff the fiber over the generic

point of 𝔸1 ; \overline{k} is, i.e. if the nilideal in the spectrum of the algebra \overline{k}(x_{1})[x_{2}]/(f) is prime. Further, since \overline{k}[x_{1}, x_{2}]/(f) ⟶ \overline{k}(x_{1})[x_{2}]/(f) is an inclusion, the scheme C_{0}\overline{k} is reduced iff the algebra \overline{k}(x_{1})[x_{2}]/(f) is.

Thus C_{0}\overline{k} is integral iff the algebra \overline{k}(x_{1})[x_{2}]/(f) is a field. This is the case iff the polynomial f is irreducible over \overline{k}(x_{1}).

Now, if f was reducible over \overline{k}(x_{1}), it would contain a factor of degree 1. This would mean that the the reduced algebra (\overline{k}(x_{1})[x_{2}]/(f))^{red} splits into the direct sum of \overline{k}(x_{1}) and another \overline{k}(x_{1})-algebra which would imply that C_{0}red ; \overline{k} would contain a rational curve. This rational curve would be birational to a curve on the abelian surface N\overline{k} which is impossible. □

Let C be the closure of C_{0} in ℙ_{k}^{2}. This means that C is obtained by writing the second equation of (2.20) in homogeneous form (where x_{0} is a constant), i.e. C is given by

(3x_{0}^{2}z^{4} + 3ax_{1}x_{2} + Az^{4})^{2} = 12x_{0}(x_{0}^{3}z^{4} + ax_{1}^{3}z + a^{2}x_{2}^{3}z + (Ax_{0} + B)z^{4}).

Setting z = 0, we obtain

(3ax_{1}x_{2})^{2} = 0.

16We use the following fact: Let V be a proper k-variety, C a smooth k-curve, C_{0} an open, affine part of C and C_{0} ⟶ V a k-morphism. Then this morphism can be extended to a k-morphism C ⟶ V.

Thus there are two points at infinity: [1 : 0 : 0] and [0 : 1 : 0].

The derivative with respect to z is for z = 0

12x_{0}(ax_{1}^{3} + a^{2}x_{2}^{3}),

and this is non-zero for the two points at infinity. Thus there are no singularities of C at infinity.

The geometric operation a_{σ} on W defined by the arithmetic operation σ on A_{K} is given by (y_{0}, x_{0}, x_{1}, x_{2}) ↦ (y_{0}, x_{0}, ζ_{3}x_{1}, ζ_{3}^{2}x_{2}). Analogously, one gets an operation on C. In particular, singularities outside (x_{1}, x_{2}) = (0, 0) occur in triples.

Now, the arithmetic genus of C_{0} is \frac{(4−1)(4−2)}{2} = 3, and this is equal to the genus of the normalization of C_{0} plus the singularity degree. (And the singularity degree is larger or equal the number of singularities.) Thus if C_{0} had singularities outside (0, 0), it would be a rational curve. But on the other hand, C is birational to a curve on the abelian variety N. Thus it cannot be a rational curve since there are no such curves on abelian varieties.

Thus the only possible singularity of C_{0} is (x_{1}, x_{2}) = (0, 0).

Specializing the defining equation to this point, we get:

(3x_{0}^{2} + A)^{2} = 12x_{0}(x_{0}^{3} + Ax_{0} + B),

i.e.

3x_{0}^{4} + 6Ax_{0}^{2} + 12Bx_{0} − A^{2} = 0

This is the 3^{rd} division polynomial of E; see [Si, III,10,Exercise 3.7]. Thus (0, 0) is a point on C iff x_{0} is the x-coordinate of a 3-torsion point. We now check if (0, 0) is a singularity: The derivatives of the defining equation of C with respect to x_{1} and x_{2} to the point (0, 0) are both 0. Thus if (0, 0) is a point on C_{0}, it is a singularity.

Assume that this is the case and furthermore that ζ_{3} ∉ End\overline{k}(E\overline{k}). Then by Theorem 5, N ⊗_{k} k(\sqrt{12x_{0}}) is simple and the genus of the normalization of C is 2.

If x_{0} is not the x-coordinate of a 3-torsion point, C_{0} is non-singular. Being a quadric curve in ℙ_{k(\sqrt{12x_{0}})}^{2}, it is a so-called canonical curve; see [Ha, IV, Example 5.2.1.].

We get the following result:

For any x_{0} ≠ 0, there are two curves on N ⊗_{k} k(\sqrt{12x_{0}}) which are birational to the curve C (which depends on x_{0}). If x_{0} ≠ 0 is not the x-coordinate of a 3-torsion point, C is a non-singular curve which is a so-called canonical curve of genus 3. However, if x_{0} is the x-coordinate of a 3-torsion point, C is singular, and under the assumption ζ_{3} ∉ End\overline{k}(E\overline{k}), the genus of the normalization of C is 2.

Now let x_{0} = 0.

Then the second equation of (2.20) becomes

3ax_{1}x_{2} + A = 0.

Let A ≠ 0. Substituting x_{2} = −\frac{A}{3a}x_{1}^{−1} into the first equation of (2.20), we get (with x_{0} = 0)

y_{0}^{2} = ax_{1}^{3} − \frac{A^{3}}{27a^{2}} x_{1}^{−3} + B.

Multiplication by x_{1}^{4} and substitution y = y_{0}x_{1}^{2} gives

y^{2} = ax_{1}^{7} + Bx_{1}^{4} − \frac{A^{3}}{27a}x_{1}.  (2.21)

Let C be the projective closure of C_{0} in ℙ_{k}^{2}. Then C is either a rational curve or a hyperelliptic curve whose normalization has genus ≤ 3. The first case is impossible since it is a curve on an abelian surface.

So, if the discriminant of the polynomial on the right-hand side is non-zero, the normalization of C has genus 3, and in general it is a hyperelliptic curve whose normalization has genus ≤ 3. If N is simple, then the normalization of C has genus 2 or 3.

If N is simple, this curve is defined even without the assumption ζ_{3} ∈ k. One takes the intersection of N with the surface defined by “expanding out” σ(Y) = Y. The normalization of the resulting curve is still hyperelliptic, since every non-singular curve with genus ≥ 2 which is hyperelliptic over some field is hyperelliptic wherever it is defined. (This holds since its function field contains a unique rational subfield of index 2.)

For A = 0 i.e. j = 0, we get two elliptic curves. Note that in this case ζ_{3} ∈ End_{k}^{0}(E) and thus this is consistent with the decomposition of W in Subsection 2.1.3.

By (2.16), condition x_{0} = 0 is – outside of H – equivalent to Y = σ(Y). Thus we get the following result:

Under the condition j ≠ 0, the intersection of N with the subvariety of W defined by Y = σ(Y) is a hyperelliptic curve C whose normalization has genus ≤ 3. (3 is the “generic” case.)

We now translate the idea of intersecting N_{0} with the variety defined by “expanding out” σ(Y) = Y to characteristic 2 and 3.

The curves constructed in this way will also be used as examples in the next chapter (Section 3.3) where we outline attacks on the DL-problem in E(K).

2.4.2 The curve defined by σ(Y ) = Y

We explain the idea first independently of the characteristic.

Let E be given by the following affine Weierstraß-equation:

Y^{2} + A_{1}XY + A_{3}Y = X^{3} + A_{2}X^{2} + A_{4}XA_{6},  (2.22)

where all A_{i} lie in k.

We now intersect the subvariety of W_{0} which is given by the expansion of the equation

Y = σ(Y)  (2.23)

with N_{0}, the open, affine part of the trace-zero-hypersurface N.

We restrict ourselves to the affine parts W_{0}\H and N_{0}\H of W and N defined as above.

To define N_{0}, we can just as for char(k) > 3 restrict ourselves to the equation for the X-coordinate. Under (2.23), we have

X(P ⊕ σ(P)) = −A_{2} − X − σ(X).

Thus under (2.23), we get the following easy defining equation for N_{0}.

X + σ(X) + σ^{2}(X) = −A_{2}  (2.24)

Let C_{0} be the subscheme of W_{0} which is defined by (2.23) and (2.24). It will turn out to be a curve.

char(k) > 3

This case was treated above. Stating with an elliptic curve with j-invariant ≠ 0 defined by equation (2.8), we obtain a curve which is (possibly after a base-change k(ζ_{3})|k) birational to the curve given by (2.21).

char (k) = 2

Again assume that ζ_{3} ∈ k and assume that j ≠ 0. (If ζ_{3} is not contained in k, the curve C_{0} is after the base-change k(ζ_{3})|k given by the equations which now follow.)

Let α, a and σ be defined as above. Let E be given by an affine equation

Y^{2} + XY = X^{3} + A_{2}X^{2} + B,  (2.25)

where A_{2}, B ∈ k, B ≠ 0; see [Si, Appendix A, Proposition 1.1. (c)].

Again we make the substitutions (2.9). Then the subscheme C_{0} is given by

y_{1} = y_{2} = 0, x_{0} = −A_{2} = A_{2},

and (2.25) becomes

\begin{matrix}(1 ⊗ y_{0})^{2} + (1 ⊗ A_{2} + α ⊗ x_{1} + α^{2} ⊗ x_{2})(1 ⊗ y_{0}) = \\ (1 ⊗ A_{2} + α ⊗ x_{1} + α^{2} ⊗ x_{2})^{3} + A_{2}(1 ⊗ A_{2} + α ⊗ x_{1} + α^{2} ⊗ x_{2})^{2} + B. \end{matrix} (2.26)

This expands to the following three equations, which describe C_{0} in 𝔸_{k}^{4}.

\begin{matrix}y_{0}^{2} + A_{2}y_{0} = A_{2}^{3} + ax_{1}^{3} + a^{2}x_{2}^{3} + A_{2}^{2} + B \\ x_{1}y_{0} = A_{2}^{2}x_{1} + aA_{2}x_{2}^{2} + ax_{1}^{2}x_{2} + aA_{2}x_{2}^{2} \\ x_{2}y_{0} = A_{2}^{2}x_{2} + A_{2}x_{1}^{2} + ax_{1}x_{2}^{2} + A_{2}x_{1}^{2} \end{matrix}  (2.27)

The second and third equation can be simplified to

\begin{matrix}x_{1}y_{0} = A_{2}^{2}x_{1} + ax_{1}^{2}x_{2} \\ x_{2}y_{0} = A_{2}^{2}x_{2} + ax_{1}x_{2}^{2}, \end{matrix}  (2.28)

and for (x_{1}, x_{2}) ≠ (0, 0), this is equivalent to

y_{0} = A_{2}^{2} + ax_{1}x_{2}.

Substituting this into the first equation of (2.27), we get the following equation for C_{0}

A_{2}^{4} + a^{2}x_{1}^{2}x_{2}^{2} + A_{2}^{3} + aA_{2}x_{1}x_{2} = A_{2}^{3} + ax_{1}^{3} + a^{2}x_{2}^{3} + A_{2}^{2} + B.

The scheme C_{0} is a geometrically irreducible, geometrically reduced curve. The proof of this fact is analogous to the one on page 64.

The curve C_{0} is an open affine part of the projective curve C defined by the corresponding homogeneous equation

a^{2}x_{1}^{2}x_{2}^{2} + aA_{2}x_{1}x_{2}z^{2} + ax_{1}^{3}z + a^{2}x_{2}^{3}z + (A_{2}^{2} + A_{2}^{4} + B)z^{4} = 0.  (2.29)

As this equation has degree 4, C has arithmetic genus 3. Just as in the case of char(k) > 3 discussed above, singularities outside infinity and (0, 0) have to occur in triples. So again, if the curve had such singularities, the genus of its normalization would be 0, what is impossible. Thus the only possible singularities are (0, 0) and the points at infinity.

We examine the singularities at infinity. The curve C has the infinite points [1 : 0 : 0] and [0 : 1 : 0]. Taking the derivative of (2.29) with respect to z (note that char(k) = 2) gives

ax_{1}^{3} + a^{2}x_{2}^{3}.

This is ≠ 0 for both infinite points ≠ 0. Thus C has no singularities at infinity.

We now look at the possible singularity at (0, 0). Firstly, (0, 0) would have to lie on C_{0}. Thus

A_{2}^{2} + A_{2}^{4} + B = 0.

Secondly, the derivatives with respect to x_{1} and x_{2} at (0, 0) would both have to be 0. This implies A_{2} = 0 and thus also B = 0. This is impossible because it would mean that E is singular.

We arrive at the following characterization of the curve C:

C is a canonical curve of degree 4 and genus 3 which is the normalization of a curve on N. char(k) = 3

Now let k be a field with characteristic 3. According to Artin-Schreier theory, K|k is generated by some α with α^{3} − α = a ∈ k. The Galois group is generated by σ with σ(α) = α + 1.

For later use, we calculate

\begin{matrix}σ(α^{2}) = (α + 1)^{2} = α^{2} − α + 1 \\ σ^{2}(α^{2}) = (σ^{2}(α))^{2} = (α − 1)^{2} = α^{2} + α + 1 \end{matrix}  (2.30)

and

\begin{matrix}α^{3} = α + a \\ α^{4} = α^{2} + αa \\ α^{5} = α^{2}a + α + a \\ α^{6} = α^{2} − αa + a^{2}. \end{matrix}  (2.31)

Let E be given by the equation

Y^{2} = X^{3} + A_{2}X^{2} + B,  (2.32)

where according to the assumptions A_{2}, B ∈ k and are both non-zero; see [Si, Appendix A, Proposition 1.1. (c)].

Again under the substitutions (2.9), (2.24) becomes

x_{2} = A_{2}, y_{1} = y_{2} = 0,

and (2.32) gives

1 ⊗ y_{0}^{2} = 1 ⊗ x_{0}^{3} + (α ⊗ x_{1}^{3} + 1 ⊗ ax_{1}^{3}) + (α^{2}A_{2}^{3} − α ⊗ aA_{2}^{3} + 1 ⊗ a^{2}A_{2}^{3})
+A_{2}[1 ⊗ x_{0}^{2} + α^{2} ⊗ x_{1}^{2} + α^{2}A_{2}^{2} + α ⊗ aA_{2}^{2}
−α ⊗ x_{0}x_{1} − α^{2} ⊗ A_{2}x_{0} − α ⊗ A_{2}x_{1} − 1 ⊗ aA_{2}x_{1}] + B

Thus C_{0} is given by the following three equation in 𝔸_{k}^{4}.

\begin{matrix}y_{0}^{2} = x_{0}^{3} + ax_{1}^{3} + a^{2}A_{2}^{3} + A_{2}x_{0}^{2} − aA_{2}^{2}x_{1} + B \\ 0 = x_{1}^{3} − aA_{2}^{3} + aA_{2}^{3} − A_{2}x_{0}x_{1} − A_{2}^{2}x_{1} \\ 0 = A_{2}^{3} + A_{2}x_{1}^{2} + A_{2}^{3} − A_{2}^{2}x_{0}. \end{matrix}  (2.33)

The third equation can be divided by A_{2} ≠ 0 and is equivalent to

0 = x_{1}^{2} − A_{2}^{2} − A_{2}x_{0}.

This equation also implies the second equation of (2.33) and is equivalent to

x_{0} = A_{2}^{−1}x_{1}^{2} − A_{2}.  (2.34)

This implies

x_{0}^{2} = A_{2}^{−2}x_{1}^{4} + x_{1}^{2} + A_{2}^{2}.  (2.35)

If we insert (2.34) and (2.35) in the first equation of (2.33), we are given the curve C_{0}, described by

y_{0}^{2} = A_{2}^{−3}x_{1}^{6} − A_{2}^{3} + ax_{1}^{3} + a^{2}A_{2}^{3} + A_{2}^{−1}x_{1}^{4} + A_{2}x_{1}^{2} + A_{2}^{3} − aA_{2}^{2}x_{1} + B,

i.e.

y_{0}^{2} = A_{2}^{−3}x_{1}^{6} + A_{2}^{−1}x_{1}^{4} + ax_{1}^{3} + A_{2}x_{1}^{2} − aA_{2}^{2}x_{1} + a^{2}A_{2}^{3} + B.  (2.36)

This is a hyperelliptic curve of degree 6.

Let C be the projective closure of C_{0} in ℙ_{k}^{2}. We obtain the following characterization of C:

The normalization of C is a hyperelliptic curve of genus 1 or 2. (If N is simple, the genus is 2.) In particular, if N is simple, it is isogenous to the Jacobian variety of the normalization of C.

Coverings of curves and the discrete-logarithm problem

Introduction and results

This chapter is devoted to cryptoanalytic applications.

Let k be a finite field, K|k a field extension of prime degree n. Let X′ be a nonsingular, geometrically irreducible (i.e. geometrically integral), proper curve over K. ^{1} Assume that X′ has “cryptographically good” properties. Especially, the group Pic^{0}(X′) ≅Cl^{0}(K(X′)) should have a large prime factor. We try to transform the discrete-logarithm problem in Cl^{0}(K(X′)) into the discrete-logarithm problem in Cl^{0}(k(C)) for a suitable non-singular, geometrically irreducible, proper k-curve C.

The idea is that if the genus of C is not “too large”, perhaps the discretelogarithm problem in the group Cl^{0}(k(C)) is “easier” than the discrete-logarithm problem in the original group Cl^{0}(K(X′)). This is suggested by [En], [EG] and [Gau].

In [GHS], the following approach was introduced:

Let C_{K} ⟶ X′ be a covering. Then K(X′) is included in K(C_{K}). Consider the group-homomorphism

norm_{K(C_{K})|k(C)} ∘ con_{K(C_{K})|K(X′)} : Cl^{0}(K(X′)) ⟶ Cl^{0}(k(C)).  (3.1)

Two conditions should be fulfilled:

1. The large prime factor of Cl^{0}(K(X′)) is preserved.

2. The curve C has “reasonably nice” cryptographic properties. Especially the genus of C should not be “too large” in relation to n and the genus of X′. For example, if we consider a family of curves X′ for different extension degree n, by the state of the art of cryptoanalysis in class groups of high genus curves, the genus of C should be at most quadratic in n; see [En]. Other interesting properties of C are hyperellipticity or automorphisms.

1In this chapter, X′ or X always denotes a curve and never a variable.

For 1., no “theoretical result” is known to the author. ^{2} However, using the Weil-restriction of J(X′) with respect to K|k, we motivate very strongly that the kernel of (3.1) is small in certain situations; see Subsections 3.1.1 and 3.1.2, especially Theorem 9, p. 77.

Then we show how to use Galois theory to construct appropriate coverings of curves (or equivalently finite extensions of function fields of transcendence degree 1). In the case that the Jacobian J(X′) is a new abelian variety (for definition see foreword), we give the construction of [GHS] as an example. For the case that X′ is already defined over k, we first proof a theoretical result (Theorem 9, p. 77), then we give examples based this result (see Subsection 3.3).

3.1 Coverings as curves on the Weil-restriction

Let k be a finite field of characteristic p, K|k be an extension of finite fields of prime degree n. Identify Gal(K|k) with its opposite group and denote the Frobenius automorphism of K|k by σ_{k}^{K}.

Let X′ be a geometrically integral, proper, non-singular curve over K with a K-rational point P_{0}. Let W be the Weil-restriction of X′ with respect to K|k.

Let C be a non-singular, irreducible proper curve over k. (We do not assume that C is geometrically irreducible.) Then by the definition of the Weil-restriction, k-morphisms C ⟶ W are in bijection to K-morphisms C_{K} := C ⊗_{k} K ⟶ X′: If c : C_{K} ⟶ X′ is a K-morphism, then there is a unique b : C ⟶ W such that c = u ∘ (b ⊗ id_{K}).

Again let c : C_{K} ⟶ X′ be a K-morphism, and let b : C ⟶ W be the unique morphism with c = u ∘ (b ⊗_{k} id_{K}). Then the image of c is a point iff c factors through the structure morphism C_{K} ⟶ Spec(K) iff b factors through the structure morphism C ⟶ Spec(k) iff the image of b on W is a point. ^{3} Thus:

Lemma 3.1 c is dominant iff the image of b on W is a curve.

From now on, let c be a dominant, finite morphism. We call such a morphism a covering of non-singular, proper, irreducible curves.

2Of course, it is possible to check that the large prime factor is preserved in specific cases, for example with the help of a computer.

3More generally, let D be some k-scheme. Then by functoriality, b : C ⟶ W has the form b = ed for some d : C ⟶ D and e : D ⟶ W iff c has the form c = f ∘ (d ⊗ id_{K}) for some d : C ⟶ D, f : D ⊗_{k} K ⟶ X′. (In fact, f = u ∘ (e ⊗_{k} id_{K}).)

We have a commutative diagram

\xymatrix{C_{K} \ar[rr]^{c} \ar[r]_{b⊗_{k}id_{K}} \ar[d] & W_{K} \ar[r]^{u} \ar[d] & X′ \\ C \ar[r]^{b} & W.}

This induces a commutative diagram

\xymatrix{Pic^{0}(C_{K}) \ar[d]^{N} & Pic^{0}(W_{K}) \ar[l]^{(b⊗_{k}id_{K})^{∗}} \ar[d]^{N} & Pic^{0}(X′) \ar[ll]_{c^{∗}} \ar[l]^{u^{∗}} \\ Pic^{0}(C) & Pic^{0}(W). \ar[l]^{b^{∗}}}

We have already seen that the group-homomorphism N∘u^{∗} : Pic^{0}(X′) ⟶Pic^{0}(W) is bijective; see Corollary 1.19. In the case that X′ is an elliptic curve E′, this homomorphism is – under the identifications of E′ and W with its duals via their canonical principal polarizations – nothing but the canonical isomorphism E′(K) ˜ ⟶W (k).

If k(C), K(C_{K}) and K(X′) are the function fields of C, C_{K} and X′ respectively, then N ∘ c^{∗} corresponds to

norm_{K(C_{K})|k(C)} ∘ con_{K(C_{K})|K(X′)} : Cl^{0}(K(X′)) ⟶ Cl^{0}(k(C)).  (3.2)

We want to study the kernel of (3.2) or – equivalently – the kernel of N∘c^{∗} : Pic^{0}(X′) ⟶Pic^{0}(C).

We note first that in practice we can restrict ourselves to the case that C is geometrically irreducible. For, let that not be the case. Let λ := k(C) ∩ \overline{k}, where \overline{k} is the algebraic closure of k (intersection in some common overfield). We now make the assumption that n does not divide [λ : k]. (To use this construction for an attack on the DLP in Cl^{0}(K(X′)), [λ : k] should be much smaller than n.) The fields K and λ are linearly disjoint over k, i.e. K ⊗_{k} λ is a field, denoted Kλ. If we consider C as a λ-curve, it is geometrically irreducible and C_{K} = C ⊗_{k} K ≃ C ⊗_{λ} (K ⊗_{k} λ) ≃ C ⊗_{λ} Kλ. ^{4} As

norm_{K(C_{K})|k(C)} ∘ con_{K(C_{K})|K(X′)} =
norm_{Kλ(C_{K})|λ(C)} ∘ con_{Kλ(C_{K})|Kλ(X_{λ})} ∘ con_{Kλ(X′_{λ})|K(X′)} :
Cl^{0}(K(X′)) ⟶ Cl^{0}(k(C)),

4For definition of “linear disjoint” see Subsection A.3.1 in the appendix.

we only have to consider the kernel of (3.2) for geometrically irreducible curves.

Let C be a geometrically irreducible (i.e. geometrically integral) k-curve.

The kernel of N∘c^{∗} : Pic^{0}(X′) ⟶ Pic^{0}(C) is isomorphic to the kernel of b^{∗} : Pic^{0}(W) ⟶ Pic^{0}(C). Let J(C) be the Jacobian variety of C. Then this kernel is isomorphic to the kernel of b^{∗} : Pic^{0}(W)(k) ⟶ J(C)(k). (This holds even if C has no k-rational points. In this case, we still have an injective homomorphism Pic^{0}(C) ⟶ J(C)(k); see [Mi-J, Remark 1.5.].)

By Corollary 1.18, Pic^{0}(W) is an abelian variety which is canonically isomorphic Res_{k}^{K}(J(X)), the Weil-restriction of the Jacobian variety of X′. To study the kernel of b^{∗} : Pic^{0}(W)(k) ⟶ J(C)(k), we ask if the morphism b^{∗} : Pic^{0}(W) ⟶ J(C) is an isogeny on large isogeny factors of Pic^{0}(W). If this is the case and Pic^{0}(X′) ≃ Pic^{0}(W) has a large prime factor, then we expect that this prime factor is preserved under b^{∗} and thus under N ∘ c^{∗}, i.e. under (3.2).

We make the following general assumption:

The Jacobian variety of X′ is simple and its endomorphism ring is commutative.

The assumption that the Jacobian variety is simple is natural in the case of a cryptographic application since Pic^{0}(X′) should have a large prime factor.

The second condition is for example fulfilled if X′ is a non-super-singular elliptic curve.

3.1.1 Curves with Jacobians which are new abelian varieties

Let X′ be a curve which is not defined over k such that its Jacobian J(X′) is a new abelian variety, i.e. J(X′) is not isogenous to an abelian variety defined over k. For example, X′ could be an elliptic curve which is not isogenous to an elliptic curve defined over k.

In this case, Pic^{0}(W) ≃ Res_{k}^{K}(J(X′)) is simple; see Corollary 1.18 and Theorem 3.

So in this case, the kernel of (3.2) is bounded by the separability degree of the morphism from Pic^{0}(W) onto its image in J(C′). Thus we expect the kernel of c^{∗} to be small. In particular, if Pic^{0}(X′) contains a large prime factor, as is the case in cryptographic applications, then we expect this factor to be preserved.

3.1.2 Curves which are defined over the small field

Let X be a curve over k, X′ := X ⊗_{k} K. We assumed that X′ has a K-rational point P_{0}. Let ι : X′ ⟶ J(X′) be the embedding defined by P_{0} ↦ 0.

Diagram (3.1) extends to the following diagram

\xymatrix{C_{K} \ar[rr]^{c} \ar[dr]^{b⊗_{k}id_{K}} \ar[dd] &  & X_{K} \ar[rr]^{ι} &  & J(X_{K}) \\  & X_{K}^{n} \ar[dd] \ar[ur]_{u} \ar[rr] &  & J(X_{K})^{n} \ar[dd] \ar[ur] \\ C \ar[dr]^{b} \\  & W \ar[rr]^{j:=Res_{k}^{K}(ι)} &  & V := Res_{k}^{K}(J(X_{K})).}

Lemma 3.2 j^{∗} := Res_{k}^{K}(ι)^{∗} : V̂ = { \atop Res_{k}^{K}(J(X_{K}))} ⟶ Pic^{0}(W) is an isomorphism of abelian varieties.

Proof This follows from the diagram

\xymatrix{Res_{k}^{K}(J(X_{K})) \ar[d]^{T} & Res_{k}^{K}({ \atop J(X_{K})}) \ar[l]_{Res_{k}^{K}(ι^{∗})}^{∼} \ar[d]^{T} \\ Pic^{0}(W) & { \atop Res_{k}^{K}(J(X_{K}))} \ar[l]^{j^{∗}}} .

Here, the down-arrows are the morphisms defined in Subsection 1.2.3. They are isomorphism since X_{K} is a curve and J(X_{K}) an abelian variety; see Corollary 1.18 and Proposition 1.20. □

Instead of asking which isogeny factors of Pic^{0}(W) are preserved under b^{∗} : Ŵ ⟶ J(C), we now ask which isogeny factors of Res_{k}^{K}(J(X_{K})) are preserved under b^{∗} ∘ j^{∗} : V̂ ⟶ J(C). This approach is more convenient since V = Res_{k}^{K}(J(X_{K})) is itself an abelian variety.

We already assumed that J(X_{K}) is simple and that the endomorphism ring of J(X_{K}) is commutative. We now assume furthermore that – after an inclusion of End_{k}^{0}(J(X)) into \overline{ℚ} – End_{k}^{0}(J(X)) ∩ ℚ(ζ_{n}) = ℚ. Then we know by Theorem 5 that V has exactly two simple isogeny factors, J(X) itself and the trace-zero-hypersurface N. We expect the kernel of b^{∗} to be small if the image of N under b^{∗} ∘ j^{∗} is non-trivial.

There exists an extension λ|k of degree prime to n = [K : k] such that C_{λ} has a λ-rational point P and such that End_{λK}(J(X′)_{λK}) is still commutative (i.e. End_{λK}(J(X′)_{λK}) = End_{K}(J(X′))).

[Proof If λ|k has degree m and there exists no two roots x_{1}, x_{2} of the characteristic polynomial of the Frobenius of J(X′) (in \overline{ℚ}) and no l such that ζ_{m}^{l}x_{1} = x_{2}, then the roots of the characteristic polynomial of the Frobenius of J(X′_{λK}) are distinct. Choose such an extension λ|k whose degree is high enough (and prime to n) such that by the “Riemann-hypothesis”, C_{λ} has a λ-rational point.]

Now K|k and λ|k are linearly disjoint, so if Kλ is some composite of K|k and λ|k, then Kλ ≃ K ⊗_{k} λ and Kλ|λ is again a field extension of degree n.

Since “base-restriction” commutes with “base-extension” (see Lemma 1.1), V_{λ} is again isogenous to J(X_{K})_{λ} × N_{λ} and N_{λ} is again simple.

Let β := j ∘b. The morphism β^{P} := T_{(−β⊗_{k}id_{λ})∘P} ∘(β ⊗_{k} id_{λ}) : C_{λ} ⟶ V_{λ} maps the λ-rational point P of C_{λ} to 0. Let f^{P} : C_{λ} ⟶ J(C)_{λ} be the immersion defined by P ↦ 0. By the universal property of the Jacobian (see [Mi-J, Proposition 6.1]), there exists a unique morphism of abelian varieties γ^{P} : J(C_{λ}) ⟶ V_{λ} such that

\xymatrix{J(C)_{λ} \ar[dr]^{γ^{P}} \\ C_{λ} \ar[u]_{f^{P}} \ar[r]^{β^{P}} & V_{λ}.}

After dualizing, we obtain

\xymatrix{{ \atop J(C)}_{λ} \ar[d]^{f^{P ∗}} \\ J(C)_{λ} & V̂_{λ}, \ar[l]_{β^{∗}} \ar@{-->}[ul]_{γ^{P ∗}}}

where f^{P ∗} : { \atop J(C)_{λ}} ⟶ J(C)λ is the canonical isomorphism. In the last line we can write β^{∗} instead of β^{P ∗} since T_{−β∘P}^{∗} : 𝒫ic^{0}(V_{λ}) ⟶ 𝒫ic^{0}(V_{λ}) is the identity by the definition of 𝒫ic^{0}(V_{λ}).

In particular, ker(β^{∗}) = ker(γ^{P ∗}). Under the identification of V_{λ} with V̂_{λ} via the principal polarization induced by the canonical principal polarization of J(X′), the reduced connected component of the zero of ker(β^{∗}) is the orthogonal complement of the image of γ^{P}; see Subsection A.2.4 in the appendix, in particular Lemma A.22, i.e. β^{P}^{∗} induces an isogeny of γ^{P} (J(C))_{λ} with its image and is trivial on the orthogonal complement of this abelian subvariety.

We are mainly interested in the question whether β^{∗} induces an isogeny of N_{λ} with its image, i.e. if the image of γ^{P} contains N_{λ}.

Now, the image of γ^{P} is the smallest abelian subvariety of N_{λ} which contains β^{P} (C). Thus N_{λ} is not contained in the image of γ^{P} iff β^{P} (C) is contained in J(X)_{λ}.

We identified Gal(K|k) with its opposed group and denote the Frobenius automorphism of K|k by σ_{k}^{K} ∈ Gal(K|k). The automorphism σ_{k}^{K} of K induces an automorphism of Spec(K), and this induces the “arithmetic Frobenius automorphism” of J(X_{K}) which we also denote by σ_{k}^{K}; cf. Subsection A.3.4.

Let a = a_{σ_{k}^{K}} be the k-automorphism of V corresponding to the automorphism σ_{k}^{K} on J(X′); see subsection 1.1.5. Then β^{P} (C) is contained in J(X)_{λ} iff ((a ⊗_{k} id_{λ}) − id) ∘ β^{P} (C_{λ}) is a point, i.e. iff (((a − id) ∘ β) ⊗_{k} id_{λ})(C_{λ}) is a point, i.e. iff (a − id) ∘ β(C) is a point.

Let p_{k} : C ⟶ Spec(k), p_{K} : C_{K} ⟶ Spec(K) be the structure morphisms.

Then (a−id)∘β(C) is a point ⟷ (a−id)∘β factors through p_{k} ⟷ there exists a q ∈ V (k) with a ∘ β − β = q ∘ p_{k}.

For q ∈ V (k), let Q := u∘(q⊗_{k} id_{K}) be the corresponding element in J(X)(K). Then the last equation is equivalent to σ_{k}^{K}(ιc) − ιc = Q ∘ p_{K}, i.e. σ_{k}^{K}(ιc) = T_{Q} ∘ ιc by the definition of T_{Q}.

Similar arguments for J(X) instead of N lead to

Proposition 3.3 Let c : C ⟶ X′ be a morphism where C is a curve. Then β^{∗} : V ⟶ J(C) induces an isogeny of

• N with its image iff there does not exist a Q ∈ J(X)(K) with σ_{k}^{K}(ιc) − ιc = Q ∘ p_{K}, i.e. σ_{k}^{K}(ιc) = T_{Q} ∘ ιc,

• J(X) with its image iff there does not exist a Q ∈ J(X)(K) with ιc + ⋯ + σ_{k}^{K}^{n−1}(ιc) = Q ∘ p_{K}.

So if there does not exist a Q ∈ J(X)(K) with σ_{k}^{K}(ιc) = T_{Q} ∘ ιc, then the kernel of

norm_{K(C_{K})|k(C)} ∘ con_{K(C_{K})|K(X_{K})} : Cl^{0}(K(X_{K})) ⟶ Cl^{0}(k(C))

is bounded by the separability degree of the isogeny β^{∗} between N and its image times Pic^{0}(X). So we expect the kernel to be small.

In particular, if Pic^{0}(X_{K}) contains a large prime factor, as is the case in cryptographic applications, then we expect that this prime factor is preserved.

Theorem 9 Let K|k be an extension of finite fields of prime degree n. Let σ_{k}^{K} be the Frobenius automorphism of K|k. Let X be a non-singular, proper, geometrically irreducible curve over k of genus g with a k-rational point P_{0}. Assume that the Jacobian J(X_{K}) of X_{K} is simple, and the endomorphism ring of J(X_{K}) is commutative. Assume further that – after an inclusion of End_{k}^{0}(J(X)) into \overline{ℚ} – End_{k}(J(X)) ∩ ℚ(ζ_{n}) = ℚ.

Let W be the Weil-restriction of X_{K} with respect to K|k. Then Pic^{0}(W) is an n · g-dimensional abelian variety which is canonically isogenous to J(X) ×_{k} N, where N is a simple (n − 1) · g-dimensional abelian variety.

Let C be a non-singular, proper, geometrically irreducible curve over k, and let c : C ⟶ X be a covering.

Assume that C has an automorphism t of degree n which is not an c-automor-phism, i.e. such that c ∘ t ≠ c and that there does not exist a Q ∈ J(X)(K) such that ιct ⊗_{k} id_{K} = T_{Q} ∘ (ιc ⊗_{k} id_{K}).

Let C^{t} be the twist of C with respect to K|k and t, i.e. C^{t} = C_{K}/ < σ_{k}^{K}t >. Then C^{t} is a non-singular, geometrically irreducible curve, and t defines an automorphism on C^{t} of order n.

Then the morphism c ⊗_{k} id_{K} : C_{K}^{t} ≃ C_{K} ⟶ X_{K} induces a morphism b^{t} : C^{t} ⟶ W.

\xymatrix{C_{K}^{t} \ar[rr]^{c} \ar[r]_{b^{t}⊗_{k}id_{K}} \ar[d] & W_{K} \ar[r]^{u} \ar[d] & X_{K} \\ C^{t} \ar[r]^{b^{t}} & W}

Now, the morphism b^{t∗} : Pic^{0}(W) ⟶ J(C^{t}) induces an isogeny of N with its image. ^{5}

Proof We only have to check the last statement. By Proposition 3.3, we have to show that there does not exist a Q ∈ J(X)(K) with

σ_{k}^{K}(ιc ⊗_{k} id_{K})(t^{−1} ⊗_{k} id_{K})σ_{k}^{K}^{−1} = T_{Q} ∘ (ιc ⊗_{k} id_{K}). (*)

Now, σ_{k}^{K}(ιc ⊗_{k} id_{K})(t^{−1} ⊗_{k} id_{K})σ_{k}^{K}^{−1} = ιct^{−1} ⊗_{k} id_{K}. Thus (*) is equivalent to T_{−Q} ∘ (ιc ⊗_{k} id_{K}) = (ιct ⊗_{k} id_{K}). This is impossible by assumption. □

Remark Under the assumption that ct ≠ c, the condition that there does not exist a Q ∈ J(X)(K) with ιct⊗_{k} id_{K} = T_{Q} ∘(ιc⊗_{k} id_{K}) is especially fulfilled under one of the following two conditions:

• t has a geometric fixed point

• J(X)(K) does not have an element of order n

Proof Firstly, if t has a geometric fixed point, and the equation is satisfied for some Q, then Q = 0 thus ιc = ιct. Since ι is an immersion, c = ct, contradicting the assumption.

Secondly, if a Q exists then it follows that ιc ⊗_{k} id_{K} = σ_{k}^{K}^{n}(ιc ⊗_{k} id_{K}) = T_{nQ} ∘ (ιc ⊗_{k} id_{K}). Let P ∈ C(\overline{k}). Then (ιc ⊗_{k} id\overline{k}) ∘ P = nQ + (ιc ⊗_{k} id\overline{k}) ∘ P thus nQ = 0. □

3.2 Coverings of curves whose Jacobian variety is a simple new abelian variety

3.2.1 Construction of coverings

Let K|k be an extension of finite fields of prime degree n, let X′ be a geometrically irreducible curve over K with a K-rational point.

5In particular, in the context of the theorem, if Pic^{0}(X_{K}) has a large prime factor, then we expect this prime factor to be preserved under N∘c^{∗} : Pic^{0}(X_{K}) ⟶ Pic^{0}(C).

General assumptions for this section Assume that J(X′) is a simple new abelian variety, i.e. that it is not isogenous to an abelian variety defined over k. (This implies that X′ is not defined over k, i.e. there exists no k-curve X with X_{K} ≈ X′.) Assume that the endomorphism ring of J(X′) is commutative.

Let K(X′) be the function field of X′. Suppose that K(X′)|K(x) is an abelian extension, included in K(x)^{sep}|K(x), and the degree [K(X′) : K(x)] is prime to n. As above, we denote the Frobenius automorphism of K|k by σ_{k}^{K}.

Let L′ = K(X′)σ_{k}^{K}(K(X′)) ⋯ σ_{k}^{K}^{n−1}(K(X′)) be the Galois closure of K(X′) over k(x) in K(x)^{sep}.

Then by Galois theory, we get the exact sequence

1 ⟶ Gal(L′|K(x)) ⟶ Gal(L′|k(x)) ⟶ Gal(K|k) ⟶ 1.  (3.3)

Lemma 3.4 Sequence (3.3) splits.

Proof Note that Gal(L′|K(x)) is isomorphic to (Gal(K(X′)|K(x)))^{m} for some m ≤ n. The order of this group is prime to n, since by assumption [K(X′) : K(x)] is prime to n. Thus the lemma follows from the following group-theoretic lemma. □

Lemma 3.5 Let 1 ⟶ A ⟶ E ⟶ G ⟶ 1 be an exact sequence of finite groups where A is abelian, G is cyclic and the order of A is prime to the order of G. Then this sequence splits.

Proof First let A be a general abelian group. Then if an extension E of G by A is given, G operates on A by taking preimages and conjugation inside E. Such an operation given, the extensions E of G by A are classified by the elements of H^{2}(G, A), the trivial element in this group corresponding to the semi-direct product defined by the given operation of G on A; see [Se, VII,par. 3].

We now show that under the assumption that the orders of G and A are coprime, H^{2}(G, A) is trivial. Thus every extension of G by A is a semi-direct product.

Firstly, H^{2}(G, A) is annihilated by the order of G; see [Se, VIII, par. 2, p.130, Corollary 1]. Secondly, H^{2}(G, A) ≃ Ĥ^{0}(G, A) = A^{G}/N(A) (see [Se, VIII, par. 4, p.133, Corollary]), and this group being the quotient of a subgroup of A is annihilated by the exponent of A.

Since the orders of A and G where assumed to be coprime, H^{2}(G, A) = 1. □

Assume that L′|K(x) is regular over K. ^{6}

6For definition of “regular” see Subsection A.3.1 in the appendix.

Fix a section of (3.3). Let L be the fixed field of the subgroup of Gal(L′|k(x)) defined by this section. Then by construction, L and K(x) are linearly disjoint over k(x) and LK = L′. Thus L′|K(x) is defined over k.

Note however, that L′|K(x) is not defined over k with its Galois group. For if this was the case, every subextension of L′|K(x) would be defined over k thus K(X′)|k(x) would be defined over k which is by assumption not the case.

Because of the simplicity of the Weil-restriction the map

norm_{KL|L} ∘ con_{KL|K(X′)} : Cl^{0}(K(X′)) ⟶ Cl^{0}(L)

is expected to have small kernel.

Now assume that L′|K(x) is not regular. The argumentation is now similar to the one on page 73: Assume further that [L′ ∩ \overline{k} : K] is prime to n. (In fact, to use this construction as an attack on the DLP in Cl^{0}(K(X′)), [L′ ∩ \overline{k} : K] should be much smaller than n.) Then there exists an extension of finite fields λ|k such that K ⊗_{k} λ ≃ λK = L′ ∩ \overline{k}. Now L′|Kλ is regular, and L′|λ(x) is Galois. By the same arguments as above, there exists a regular subextension L|λ with L ⊗_{λ} Kλ ≃ KL = L′. Therefore L ⊗_{k} K ≃ L ⊗_{λ} (K ⊗_{k} λ) ≃ L′.

Because of the simplicity of the Weil-restriction of X′_{λ}, with respect to Kλ|λ, we still expect the kernel of

norm_{KL|L} ∘ con_{KL|K(X′)} = norm_{KL|L} ∘ con_{KλKL|Kλ(X′)} ∘ con_{Kλ(X′)|K(X′)} :
Cl^{0}(X′) ⟶ Cl^{0}(L)

to be small.

Geometric interpretation of the construction

Let L′ still be the Galois closure of K(X′)|k(x). Assume that [L′ ∩ \overline{k} : K] is prime to n. We have seen that in this case there exists a function field L|k with L ⊗_{k} K ≃ LK = L′. The diagram

[figure: L ⊗_{k} K; K(X′); L; K(x); k(x)]

corresponds to a diagram

\xymatrix{C_{K} := C ⊗_{k} K \ar[d]^{c} \ar[dr] \\ X′ \ar[d] & C \ar[dd] \\ ℙ_{K}^{1} \ar[dr] \\  & ℙ_{k}^{1}}  (3.4)

of coverings of irreducible non-singular proper curves. (C is geometrically irreducible iff L|k is regular, that is, if L′|K is regular.)

Let W be the Weil-restriction of X′ with respect to K|k, b : C ⟶ W the morphism corresponding to c : C_{K} ⟶ X′.

If we consider C as a covering of ℙ_{k}^{1}, then c ∈ ℛes_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X′). By Lemma 1.2, this is equal to ℛes_{k}^{K}(X′)×_{ℛes_{ℙ^{1}_{k}}^{ℙ^{1}_{K}}(X′)} ℙ_{k}^{1}. So b : C ⟶ W factors through W ×_{Res_{k}^{K}(ℙ^{1})}ℙ_{k}^{1} ≃

Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X′).

We get the following diagram of coverings

\xymatrix{C ⊗_{k} K \ar[d] \ar[dr] \\ X′ ×_{ℙ_{K}^{1}} σ_{k}^{K}(X′) ×_{ℙ_{K}^{1}} ⋯ ×_{ℙ_{K}^{1}} σ_{k}^{K}^{n−1}(X′) \ar[d]^{p_{id}} \ar@{-->}[dr] & C \ar[d] \\ X′ \ar[d] & Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X′) \ar[dd] \\ ℙ_{K}^{1} \ar[dr] \\  & ℙ_{k}^{1},}

where C ⊗_{k} K ⟶ X′ ×_{ℙ_{K}^{1}} σ_{k}^{K}(X′) ×_{ℙ_{K}^{1}} ⋯ ×_{ℙ_{K}^{1}} σ_{k}^{K}^{n−1}(X′) is given by (σ_{k}^{K}^{i}(a))_{i=0,...,n−1}. By construction, this morphism identifies an open part of C_{K} with the open part of one component of X′ ×_{ℙ_{K}^{1}} σ_{k}^{K}(X′) ×_{ℙ_{K}^{1}} ⋯ ×_{ℙ_{K}^{1}} σ_{k}^{K}^{n−1}(X′) (since K(X′) ⊗_{K(x)} σ_{k}^{K}(K(X′)) ⊗_{K(x)} ⋯ ⊗_{K(x)} σ_{k}^{K}^{n−1}(K(X′)) ⟶ K(C) is sur-

jective) and the same is true for C and Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X′).

In particular, C ⟶ Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X′) induces a closed immersion of an open part

of C. So is also Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X′) ≃ W ×_{Res_{k}^{K}(ℙ^{1})} ℙ_{k}^{1} ⟶ Res_{k}^{K}(X′), since ℙ_{k}^{1} ⟶ Res_{k}^{K}(ℙ_{K}^{1}) is (see Lemma 1.5) and “closed immersion” is stable under base-change (see [Ha, II,ex. 3.11.]). Thus:

Proposition 3.6 b : C ⟶ W induces a closed immersion of an open part of C.

3.2.2 An application

Let n be odd. Let H′ be a hyperelliptic curve as above. A Weierstraß-equation of H′ defines a covering H′ ⟶ ℙ_{K}^{1} of degree 2. Let L′ be the Galois closure of K(H′)|K(x). Then if L′|K(x) is regular, by the general theory presented above, it can be defined over k. ^{7}

char(k) = 2

Let the elliptic K-curve E′ be given by the Weierstraß-equation

y^{2} + xy = x^{3} + αx^{2} + β; α, β ∈ K

So K(E′)|k(x) is a (Galois) extension of degree 2, and via this extension we regard K(E′) as a intermediate field of K(x)^{sep}|K(x). After division by x^{2} and substitution s := y/x + β^{\frac{1}{2}} /x, the extension K(E′)|K(x) is given by

s^{2} + s + β^{\frac{1}{2}} x^{−1} + α + x = 0.

(Note that since K is perfect, β^{\frac{1}{2}} ∈ K.) Thus the Galois closure L′ of K(E′)|K(x) is given by the Artin-Schreier equation

s_{0}^{2} + s_{0} + β^{\frac{1}{2}} x^{−1} + α + x = 0
s_{1}^{2} + s_{1} + σ_{k}^{K}^{1}(β)^{\frac{1}{2}} x^{−1} + σ_{k}^{K}^{1}(α) + x = 0
⋮
s_{n−1}^{2} + s_{n−1} + σ_{k}^{K}^{n−1}(β)^{\frac{1}{2}} x^{−1} + σ_{k}^{K}^{n−1}(α) + x = 0

with s_{0} = s. It is shown in [GHS] that L′ is a regular field extension of K(z) of degree ≤ 2^{n}, and furthermore that it is hyperelliptic and that its genus is bounded by 2^{n−1}.

More precisely, let

U := span_{𝔽_{2}}(\{σ_{k}^{K}^{i}(β)^{\frac{1}{2}} x^{−1} + σ_{k}^{K}^{i}(α) + x\}_{i=0,...,n−1}),
U′ := span_{𝔽_{2}}(\{(σ_{k}^{K}^{i}(β)^{\frac{1}{2}} , σ_{k}^{K}^{i}(α), 1)\}_{i=0,...,n−1}).

Let m :=dim_{𝔽_{2}}(U/𝒫(\overline{K(x)}) ∩ U) =dim_{𝔽_{2}}(U′/U′ ∩ \{(0, 𝒫(ξ), 0), ξ ∈ \overline{K}\}), where 𝒫(ξ) := ξ^{2} + ξ. Then it follows from Artin-Schreier theory that 2^{m} = [L′ : K(x)]; see [Ne, IV, (3.3) with (3.4)] for the statement of the Artin-Schreier theory we use here. Calculations show that g(L) = g(L′) = 2^{m−1} or g(L) = g(L′) = 2^{m−1} − 1.

7This construction was introduced by Galbraith and Smart and analyzed in detail by Gaudry, Hess and Smart in characteristic 2; cf. [GHS]. Additional remarks were made by Menezes and Qu; cf. [MQ]. It was generalized to certain hyperelliptic curves of characteristic 2 by Galbraith; cf. [Gal]. The analysis in the odd-characteristic case is due to the author.

For n prime to 2, let φ_{2}(n) := ord(2) for 2 ∈ (ℤ/nℤ)^{∗}.

Then for k = 𝔽_{2}, m can only assume the values φ_{2}(n)i + 1 for i ≥ 1, thus g(L) = 2^{φ_{2}(n)i} or g(L) = 2^{φ_{2}(n)i} − 1; see [MQ].

Let n = 127. Then φ_{2}(n) = 7, and for this value of n, an explicit extension K(E′)|K(x) can be constructed for which L has genus 2^{7} − 1 = 127; see [GHS].

char(k) ≠ 2

Let n still be odd. Let H′ be a hyperelliptic curve of genus g which satisfies the “general assumptions”. Let H′ be given by the Weierstraß-equation

y^{2} = f(x),

where f is a polynomial of degree 2g + 1 or 2g + 2. Again regard K(H′) as an intermediate field of K(x)^{sep}|k(x), let L′ be the Galois closure of K(H′)|K(x) inside K(x)^{sep}.

We identify the places of \overline{K}(x)|\overline{K} with \overline{K} ∪ \{∞\} (via x). Let e_{1}, e_{2}, … ∈ \overline{K} and possibly ∞ be the ramified places of the extension \overline{K}L′|\overline{K}(x). (The place ∞ is ramified iff deg(f) = 2g + 1.)

The absolute Galois-group Gal(\overline{K}|K) operates on the covering and thus also on the ramified places. It fixes ∞ and operates on the e_{i}.

On the other hand, the set S := \{e_{1}, e_{2}, …\} is not invariant under Gal(\overline{K}|k). For if it was, f(x) = (x − e_{1})(x − e_{2}) ⋯ would have coefficients in k, and thus H′ would be defined over k.

Assume that σ_{k}(e_{1}), …, σ_{k}(e_{l}) ∉ S and σ_{k}(e_{l+1}), … ∈ S. Then all elements σ_{k}^{i}(e_{j}), i = 0, …, n − 1, j = 1, …, l are distinct and for i ≥ 1, they do not lie in S.

Lemma 3.7 L′|K(x) is regular over K and has degree 2^{n}.

proof (by induction) Let i = 2, …, n. Assume that L′ ⋯ σ_{k}^{K}^{i−1}(L′)|K(x) is regular over K and has degree 2^{i−1}. This is equivalent to [\overline{K}L′ ⋯ σ_{k}^{i−1}(\overline{K}L′) : \overline{K}(x)] = 2^{i−1}. Now σ_{k}^{i}(e_{1}) is in the ramification locus of σ_{k}^{i}(\overline{K}L′)|\overline{K}(x) but not in the ramification locus of \overline{K}L′ ⋯ σ_{k}^{i−1}(\overline{K}L′)|\overline{K}(x). Thus σ_{k}^{i}(\overline{K}L′) cannot be contained in \overline{K}L′ ⋯ σ_{k}^{i}(\overline{K}L′), and thus they are linearly disjoint over \overline{K}(x), defining an extension of degree 2^{i}. This implies that L′ ⋯ σ_{k}^{K}^{i−1}(L′) is regular of degree 2^{i}. □.

By the general theory, there exists a regular extension L|k(x) such that K⊗L ≃ KL = L′. The ramification of L|k(x) or – what is the same – the ramification of L′|K(X) can be calculated using Abhyankar’s Lemma; see [Po, Lemma (2.14)].

Lemma 3.8 (Abhyankar) Let F be a field, \overline{F} a Galois closure of F, v a discrete valuation of F of rank 1. Let F_{1}, F_{2} be finite Galois extension fields of F in \overline{F}. Let v_{1}, v_{2} be extensions of v in F_{1}, F_{2}, e_{1} = e(v_{1}|v), e_{2} = e(v_{2}|v) the corresponding ramification indices. Assume that v is tamely ramified in F_{1}|F and in F_{2}|F and that e_{1} divides e_{2}.

Then: If F′ is the composite of F_{1} and F_{2} in \overline{F} and v′ is an extension of v in F′, then v′ is unramified in the extension F′|F_{2}.

With this lemma, we conclude that all ramification indices of the ramified places of \overline{K}L′|\overline{K}(X) are 2.

Let r be the number of ramified places of \overline{K}L′|\overline{K}(x). Then r equals the number of elements in the set {σ_{k}^{K}^{i}(e_{j})| i = 0, …, n − 1, j = 1, 2, …}(∪{∞}). So by the remarks before Lemma 3.7,

2g + n + 1 ≤ r ≤ (2g + 2)n.

The lower bound is obtained if the degree of f is 2g + 1 and all e_{i} lie in k expect one (which lies in K), the upper bound is obtained if the degree of f is 2g + 2 and no e_{i} lies in k.

With the Riemann-Hurwitz-formula we calculate

g(L) = g(L′) = 2^{n}(0−1)+ \frac{1}{2}r \frac{e − 1}{e}2^{n} +1 = −2^{n} +r2^{n−2} = 2^{n−2}(r −4)+1. (3.5)

So

2^{n−2}(2g + n − 3) + 1 ≤ g(L) ≤ 2^{n−1}((g + 1)n − 2) + 1.

In particular, let H′ be an elliptic curve. Then there always exists a Weierstraßequation such that f has degree 3. So 3 + n ≤ r ≤ 3n + 1 and

2^{n−2}(n − 1) + 1 ≤ g(L) ≤ 3 · 2^{n−2}(n − 1) + 1.

3.3 Coverings of curves defined over the small field

3.3.1 Construction of coverings

Let still K|k be a prime extension of finite fields of characteristic p, n := [K : k], X a non-singular, proper, geometrically irreducible curve over k with a k-rational point. Assume that End_{K}(J(X_{K})) is commutative and – after an inclusion of End_{k}^{0}(J(X)) into \overline{ℚ} – End_{k}^{0}(J(X)) ∩ ℚ(ζ_{n}) = ℚ. As proven in Theorem 5, under these assumptions, the trace-zero-hypersurface of the Weil-restriction of J(X_{K}) with respect to K|k is simple.

We want to construct coverings of X which fulfill the conditions of Theorem 9, i.e. we want to construct coverings c : C ⟶ X such that C has an automorphism t with c ∘ t ≠ c. Furthermore we want that t has a geometric fixed point. (If Cl^{0}(X_{K}) has no element of order n, this assumption is not needed.)

Analogously to Subsection 3.2.1, let k(X) be the function field of X, k(X)|k(x) an extension, included in k(x)^{sep}|k(x), such that n divides [k(X) : k(x)]. Let L be the Galois closure of k(X)|k(x) in k(x)^{sep}.

Assume that n does not divide [L : k(X)]. Then L|k(x) has an automorphism of order n which does not fix K(X) which we denote by t^{#}. Assume that this automorphism is contained in some inertia group of L|k(x) or that Cl^{0}(X_{K}) has no element of order n. Let C be a proper, non-singular model of k(X), c : C ⟶ X the covering corresponding to the extension k(C)|k(X). Let t be the automorphism of C corresponding to t^{#}.

Now, if L|k is regular, we can apply Theorem 9. (If L|k is not regular but L is regular over some extension λ|k such that n does not divide [λ : k], we can work over λ instead of k and then still apply the theorem.)

A first example

Let c : E ⟶ E be the identity and let t : E ⟶ E be the elliptic involution, i.e. t ∘ P = −P. Now if K|k is a field extension of degree 2 (not necessarily of finite fields) then by the theorem, the twist of E by the involution is mapped into the Weil-restriction. By construction, this morphism is given by the closed immersion (id, −id) : E_{K} ⟶ E_{K}^{2} ≃ W_{K}. This corresponds to the well-known fact that the trace-zero-hypersurface is isomorphic to E^{t}, and W is isogenous to E ×_{k} E^{t}.

Geometric interpretation of the construction

Let c : C ⟶ X be the covering defined by L|k(X). The field extension k(X)|k(x) defines a covering X ⟶ ℙ_{k}^{1}. Let W be the Weil-restriction of X_{K} with respect to K|k, b : C ⟶ W the morphism corresponding to c ⊗_{k} id_{k} : C_{K} ⟶ X_{K}. Let b^{t} : C^{t} ⟶ W be the morphism corresponding to C_{K}^{t} ≃ C_{K} ⟶ X_{K} as in Theorem 9.

Then both b and b^{t} factor through the closed immersion Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X_{K}) ⟶

Res_{k}^{K}(X_{K}).

We want to give conditions under which b^{t} induces a closed immersion of an open part of C^{t}. This is the case iff b^{t} ⊗_{k} id_{K} = (ct^{i−1} ⊗_{k} id_{K})_{i=0}^{n−1} : C_{K}^{t} ≃

C_{K} ⟶ Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(X_{K}) ⊗_{k} K ≃ \overbrace{X_{K} ×_{ℙ_{K}^{1}} ⋯ ×_{ℙ_{K}^{1}} X_{K}}^{n fold} induces a closed immersion of an open part of C_{K}^{t}. This in turn is the case iff the ring-homomorphism

\overbrace{K(X_{K}) ⊗_{K(x)} ⋯ ⊗_{K(x)} K(X_{K})}^{n fold} ⟶ KL induced by t^{#}^{i}ι^{#} for i = 0, …, n − 1

is surjective (where ι^{#} : k(x) ↪ k(X) is the inclusion).

Proposition 3.9 Let [k(X) : k(x)] = n. Then b^{t} : C^{t} ⟶ Res_{k}^{K}(X_{K}) induces a closed immersion of an open part of C^{t}.

Proof Let ι_{i}^{#}, i = 1, …, n : k(x) ⟶ k(X) be the inclusions. We know that t operates non-trivially on the set of ι_{i}^{#}. Thus by assumption, it operates by cyclic permutation, i.e. the set of t^{#}^{i}ι^{#} for i = 0, …, n − 1 equals the set of ι_{i}^{#} for i = 1, …, n.

Thus the ring-homomorphism \overbrace{k(X) ⊗_{k(x)} ⋯ ⊗_{k(x)} k(X)}^{n fold} ⟶ L induced by t^{#}^{i}ι^{#} for i = 0, …, n − 1 equals (up to permutation of the factors) the ringhomomorphism induced by the injections ι_{i}^{#}. We know that this homomorphism is surjective. (L is generated by the roots of a primitive element of k(X)|k(x).) □

A second example

Let E be a non-super-singular elliptic curve which is not isogenous to an elliptic curve with j-invariant ≠ 0. A Weierstraß-equation of E defines a field extension k(E)|k(y) of degree 3. Since by assumption k(E) does not have an automorphism of order 3, this extension is non-Galois.

Let L be a Galois closure of this extension. Then L|k(E) is an extension of degree 2, the Galois group of K(E)|k(y) is isomorphic to the symmetric group on three elements.

There are two possibilities: 1. L = λ(E_{λ}), where λ|k is the unique extension of degree 2, 2. L is regular over k. Since L has an automorphism of order 3 and we assumed that E does not have j-invariant 0, the first case is impossible. Thus L|k(E) is regular.

Let c : C ⟶ E be the covering of non-singular, proper, irreducible curves which corresponds to the extension L|k(E). Since we assumed that E is not isogenous to a curve with j-invariant 0, the genus of C is at least 2.

Let K|k be the field extension of degree 3 and let σ_{k}^{K} be the Frobenius automorphism of K|k. Let t ∈ Gal(L|k(x)) be of of the two elements of exact order 3. Let C^{t} be the twisted curve defined by σ_{k}^{K} ↦ tσ_{k}^{K}. By construction, just as C, C^{t} is a covering of ℙ_{k}^{1}.

If we substitute t be t^{2}, the other element of exact order 3 in Gal(L|k(x)), we obtain another covering C^{t^{2}} ⟶ ℙ_{k}^{1}. However, the elements t and t^{2} are conjugated in Gal(L|k(x)), st = t^{2}s for some element s of order 2 in Gal(L|k(x)) and such an s defines an isomorphism from C_{K}^{t} ⟶ ℙ_{K}^{1} to C_{K}^{t^{2}} ⟶ ℙ_{K}^{1} which is compatible with the Galois-operation. Therefore the two ℙ_{k}^{1}-coverings C^{t} and C^{t^{2}} are isomorphic. [This corresponds to the fact that there are exactly two elements in the pointed set H^{1}(Gal(K|k), Aut(C_{K} ⟶ ℙ_{K}^{1}).]

The covering C^{t} ⟶ ℙ_{k}^{1} corresponds to a morphism b^{t} : C^{t} ⟶ Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E_{K}). (Where E_{K} ⟶ ℙ_{K}^{1} is the covering induced by the extension K(E_{K})|K(y).) By Proposition 3.9, this morphism induces a closed immersion of an open part of C^{t}.

All in all, the reducible K-curve Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E_{K})_{K} ≃ E_{K} ×_{ℙ_{K}^{1}} E_{K} ×_{ℙ_{K}^{1}} E_{K} has five irreducibility components: E_{K} itself, and four components which are birational to C_{K}. [The ring K(E_{K}) ×_{K(x)} K(E_{K}) ×_{K(x)} K(E_{K}) is isomorphic to K(E_{K}) × L^{3}.] One of the components of Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E_{K})_{K} ≃ E_{K} ×_{ℙ_{K}^{1}} E_{K} ×_{ℙ_{K}^{1}} E_{K} is the image of C_{K}^{t} ≃ C_{K} under b^{t} ⊗_{k} id_{K} = (c, ct, ct^{2}). The other components which are isomorphic to C_{K} are the images of C_{K} under (ct, c, c), (c, ct, c), (c, c, ct) respectively. These components are permuted under the Galois-operation on Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E_{K})_{K}.

They descend to an irreducible k-curve on Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E_{K}) which is birational to C_{K} considered as k-curve. Thus apart from E itself, the image of C^{t} is the only geometrically irreducible k-curve on Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E_{K}).

Let E be given by a “nice” Weierstraß-equation as in [Si, Appendix A, Proposition 1.1]. Then C^{t} is birational to the geometrically irreducible curves constructed in Subsection 2.4.2, the last subsection of the previous chapter. (In particular, the image of C^{t} in Res_{k}^{K}(E_{K}) under b^{t} lies on the trace-zero-hypersurface of E.) If char(k) = 3, it is birational to the curve given by (2.36). If char(k) > 3 and the third roots of unity are contained in k, it is birational to the curve given by (2.21). If char(k) = 2, again under the assumption that the third roots of unity are contained in k, it is birational to the curve given by (2.29).

In particular:

• If char(k) ≠ 2, 3, C^{t} is a hyperelliptic curve of genus ≤ 3.

• If char(k) = 2, C^{t} is a “canonical curve” of genus 3.

• If char(k) = 3, C^{t} is a curve of genus 2.

3.3.2 An application

Definition For n prime to p, let φ_{p}(n) := ord(p) for p ∈ (ℤ/nℤ)^{∗}. We might call φ_{p} the local Euler-function for p.

Lemma 3.10 𝔽_{p}(ζ_{m}) = 𝔽_{p^{φp(m)}}.

Let c : Gal(𝔽_{p}(ζ_{m})|𝔽_{p}) ⟶ (ℤ/mℤ)^{∗} be the m-th cyclotomic character, i.e. σ(ζ_{m}) = ζ_{m}^{c(σ)}. Then c induces a bijection of Gal(𝔽_{p}(ζ_{m})|𝔽_{p}) with the subgroup generated by p in (ℤ/mℤ)^{∗}. □

For the following construction, let n be an odd prime and assume that the n-th roots of unity are contained in k, i.e. k contains 𝔽_{p^{φp(n)}}.

Let H be a hyperelliptic k-curve and let g(x, y) be some Weierstraß-“equation” (i.e. polynomial) defining H. Let L be a Galois closure of the extension of k(x) given by z^{n} = x, g(z, y) = 0.

L

k(H)

2

k(z)

n

k(x)

Let ζ = ζ_{n} be an n-th root of unity in \overline{k}. Then the field L is given by the equations

z^{n} = x, g(z, y_{0}) = 0, g(ζz, y_{1}) = 0, …, g(ζ^{n−1}z, y_{n−1}) = 0 (with y_{0} = y).

So L|k(H) is a composite of extensions of degree 2, and [L : k(H)] = 2^{a} for some a ≤ n − 1.

The place 𝔭_{0} is ramified in L|k(x), its ramification index equals n. Let t^{#} be an element of the inertia group of L|k(x) of order n. Now t^{#} does not fix k(H) because [L : k(H)] = 2^{a} and n is odd, and t^{#} has a fixed point.

Let λ := L∩\overline{k} (intersection in some common overfield) be the Galois closure of k in L. Then the extension L|λ(H_{λ}) and the automorphism t fulfill the requirements of the theorem.

Let ι^{#} : k(H) ⟶ L be the inclusion. Then the set t^{#}ι^{#}(k(H)) equals the set of images of k(H) under all inclusions into L (over k(x)). Thus the homomorphism

\overbrace{k(H) ⊗_{k(x)} ⋯ ⊗_{k(z)} k(H)}^{n fold} ⟶ L induced by t^{#}^{i}ι^{#} is surjective, and as in the case of Proposition 3.9, b^{t} : C^{t} ⟶ Res_{k}^{K}(X_{K}) induces a closed immersion of an open part of C^{t}.

It is a priori not clear whether L|k is regular. However, since Gal(L|k(z)) has exponent 2, if L|k is not regular, it is regular over the unique extension of k of degree 2.

As above, let λ be the Galois closure of k in L. Then L and λ(z) are linearly disjoint over λ(x). Thus [L : k(x)] = [L : λ(z)] · [λ(x) : k(z)] = [\overline{k}L : \overline{k}(z)] · [λ : k] and [λ : k] = \frac{[\overline{k}L:\overline{k}(z)]}{[L:k(z)]}.

We now address the extension-degrees in question for special Weierstraßequations. Then we calculate the genus of L (which equals the genera of C and C^{t}).

char(k) = 2

We still assume that the n-th roots of unity are contained in k.

Let E be an elliptic curve, given by the Weierstraß-equation

y^{2} + xy = x^{3} + αx^{2} + β; α, β ∈ k

After division by x^{2} and substitution s := y/x + β^{\frac{1}{2}} /x, the extension k(E)|k(x) is given by the Artin-Schreier equation

s^{2} + s + β^{\frac{1}{2}} x^{−1} + α + x = 0.

Now substitute x by z. Then the extension L|k(x) defined above is given by

z^{n} = x
s_{0}^{2} + s_{0} + β^{\frac{1}{2}} z^{−1} + α + z = 0
s_{1}^{2} + s_{1} + β^{\frac{1}{2}} (ζz)^{−1} + α + ζz = 0
⋮
s_{n−1}^{2} + s_{n−1} + β^{\frac{1}{2}} (ζ^{n−1}z)^{−1} + α + ζ^{n−1}z = 0

with s_{0} = s.

Let U′ be the 𝔽_{2}-vector space

U′ := span_{𝔽_{2}}(\{β^{\frac{1}{2}} ζ^{−i}, α, ζ^{i})\}_{i=0,...,n−1}) ⊆ \overline{𝔽_{2}}^{3}.

Let 𝒫(ξ) := ξ^{2} + ξ. By Artin-Schreier theory in the form of [Ne, IV, (3.3) with (3.4)], [L : k(z)] = 2^{d} with d = dim_{𝔽_{2}}(U′/U′ ∩ \{(0, 𝒫(ξ), 0)|ξ ∈ k\}), [L\overline{k} : \overline{k}] = 2^{m} with m = dim_{𝔽_{2}}(U′/U′ ∩ \{(0, ξ, 0)|ξ ∈ \overline{k}\}). Let

V′ := span_{𝔽_{2}}(\{β^{\frac{1}{2}} ζ^{−i}, ζ^{i})\}_{i=0,...,n−1}).

Then m = dim_{𝔽_{2}}(V′).

φ_{2}(n) ≤ m ≤ 2φ_{2}(n)  (3.6)

The second inequality follows from the inclusion V′ ⊆ β^{\frac{1}{2}} 𝔽_{2}(ζ) ⊕ 𝔽_{2}(ζ). The first inequality follows from projection of V′ onto 𝔽_{2}(ζ) (projection to the second coordinate).

Of course, since we only have n generating vectors, we also have the inequality dim_{𝔽_{2}}(U′) ≤ n which is for example a better bound if φ_{2}(n) = n − 1.

We now study over which constant field L is regular. We have the following cases:

case 1: α = 0. In this case, [L : k(x)] = [\overline{k}L : \overline{k}(x)] = dim(V′) = m and the extension L|k is regular.

case 2: α ≠ 0. Since the sum over all n-th roots of unity is 0, (0, α, 0) ∈ U′. Now the extension L|k is regular iff α ∈ 𝒫(k), and it is regular over the constant field extension of degree 2 otherwise.

We calculate the genus of L. We use the following lemma. ^{8} Lemma 3.11 (Accola; Kani; Garcia, Stichtenoth) Let λ be a field, l a prime number, m a natural number and L|λ(z) a Galois extension, regular over λ, with Galois group isomorphic to (ℤ/lℤ)^{m}. Then L|λ(z) has exactly e := (l^{m} −1)/(l−1) subfields L_{i}|λ(z) with [L_{i} : k(z)] = l. We have

8This idea was pointed out to the author by H. Stichtenoth.

g(L) = ∑_{i=1}^{e} g(L_{i}).

Proof See [GS, Theorem 2.1] with [Kan, Theorem 1]. (The conditions on λ stated in [GS] are not necessary.) □

We apply this lemma with l = 2, L, m as above and λ the Galois closure of k in L.

Then e = 2^{m} − 1 and all L_{i}|λ(z) are Artin-Schreier extensions. – They correspond bijectively to cyclic subgroups of V′, i.e. to non-trivial elements of V′. Such an element (β^{\frac{1}{2}} c_{i}, d_{i}) ∈ V′ defines an extension L_{i}|λ(z) given by the Artin-Schreier equation

t^{2} + t + β^{\frac{1}{2}} c_{i}z^{−1} + d_{i}z = 0.

Thus g(L_{i}) ≤ 1 and we get the following proposition.

Proposition 3.12 Either L|k is regular or it is regular over the constant field extension of degree 2. Let m := dim_{𝔽_{2}}(V′). Then [L\overline{k} : \overline{k}(x)] = 2^{m}, and L has genus ≤ 2^{m} − 1 ≤ 2^{2φ_{2}(n)} − 1.

We can now apply Theorem 9. We have motivated: ^{9}

Proposition 3.13 Let n be an odd prime number. Let E be an elliptic curve over 𝔽_{2^{φ_{2}(n)}} such that E(𝔽_{2^{φ_{2}(n)n}}) contains a prime factor of order ∼ 2^{φ_{2}(n)n−φ_{2}(n)}. Then a geometrically irreducible curve C^{t} of genus ≤ 2^{2cφ_{2}(n)} − 1 defined over 𝔽_{2^{2φ_{2}(n)}} with an automorphism of order n can be constructed such that via the homomorphism (3.2), we expect the DL-problem in E(𝔽_{2^{φ_{2}(n)n}}) to be transformed into the DL-problem of Cl^{0}(C^{t}).

An interesting special case is the following: Let n = 2^{c} − 1 be a prime number. Then φ_{2}(n) = c since 2^{c} = n + 1 ≡ 1 mod n. So:

Let n = 2^{c} − 1, be a prime number, e.g. n = 3, 7, 31, 127. Let E be an elliptic curve over 𝔽_{2^{c}} such that E(𝔽_{2^{cn}}) contains a prime factor of order ∼ 2^{cn−c}. Then a geometrically irreducible curve C^{t} of genus ≤ 2^{2c} − 1 defined over 𝔽_{2^{2c}} with an automorphism of order n can be constructed such that via the homomorphism (3.2), we expect the DL-problem in E(𝔽_{2^{cn}}) to be transformed into the DL-problem of Cl^{0}(C^{t}).

9We write “motivated” instead of “proven” because the result relies on the fact that we expect the large prime factor in E(K) to be preserved; see Theorem 9 for details.

In particular, let E be a curve defined over 𝔽_{2^{5}} such that E(𝔽_{2^{155}}) contains a prime factor of order 2^{150}. Then we have associated to E a geometrically irreducible curve C^{t} of genus ≤ 2^{10} − 1, defined over 𝔽_{2^{10}} with an automorphism of order 31, such that via the homomorphism (3.2), the DL-problem in E(𝔽_{2^{155}}) is expected to be transformed into the DL-problem of Cl^{0}(C^{t}).

char(k) ≠ 2

Let k(H) be a hyperelliptic function field of genus g and let k(H)|k(z) be a degree-2 extension defined by a Weierstraß-equation of degree d := 2g + 1 or d := 2g + 2 (in z). We identify the places of \overline{k}(z)|\overline{k} with \overline{k} ∪ \{∞\} (via z).

Then \overline{k}(E)|\overline{k}(z) is ramified over d places e_{1}, e_{2}, …, e_{d} ∈ \overline{k} and additionally over ∞ if d is odd.

There are several different cases depending on whether some ramification points lie in the same orbit under of the action of the Galois group of k(z)|k(x). The most generic one is the following:

All e_{i} lie in different orbits of the Galois group of k(z)|k(x).

There are two sub-cases:

case 1: e_{i} ≠ 0 for all i. Then \overline{k}L|\overline{k}(z) is ramified at (2g + 1)n + 1 or (2g + 2)n places (depending on whether the Weierstraß-“equation” (i.e. polynomial) has odd or even order).

case 2: e_{i} = 0 for some e_{i}. Then \overline{k}L|\overline{k}(z) is ramified at 2gn+2 or (2g +1)n+1 places.

In both cases, exactly as in the proof of Lemma 3.7, one sees that L|k(z) is regular and has degree 2^{n}.

Using Abhyankar’s Lemma (Lemma 3.8), we conclude that the ramification order at the ramified places is always 2. We can calculate the genus of L (which equals the genera of C and C^{t}) using formula (3.5):

g(L) = 2^{n−2}(r − 4) + 1,

where r is the number of ramified places in L|k(z). Thus 2gn + 2 ≤ r ≤ (2g + 2)n and

2^{n−1}(gn − 1) + 1 ≤ g(L) ≤ 2^{n−1}((g + 1)n − 2).

92 Chapter 3. Coverings of curves and the DL-problem

Appendix A

Some auxiliary results

A.1 Some results about the Picard scheme

The functor 𝒫ic(X) of a non-singular, projective, integral k-variety X with a k-rational point as well as the group-schemes Pic(X) and Pic^{0}(X), the Picard scheme, where already introduced in Subsection 1.2.2. Here we give some additional properties. We are only interested in “geometric” questions like the dimension of Pic^{0}(X), so we work over an algebraically closed field only.

A.1.1 The dimension of the Picard scheme

Let k be an algebraically closed field, X a non-singular, projective, integral kvariety.

The dimension of the Picard scheme Pic^{0}(X) can be calculated via étale cohomology or via the étale fundamental group.

Lemma A.1 For any prime l ≠ char(k): ^{1}

dim(Pic^{0}(X)) = \frac{1}{2}dim_{ℚ_{l}}(H^{1}(X_{ét}, ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l}) =
\frac{1}{2}dim_{ℚ_{l}}(Hom_{cont}(π_{1}(X), ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l})

Proof of the first equation Let n ∈ ℕ with char(k) ∤ n. The Kummer exact sequence (in the étale topology)

0 ⟶ μ_{n} ⟶ 𝔾_{m} ⟶^{·n} 𝔾_{m} ⟶ 0

1We should write the fundamental group relative to some base point. However the fundamental groups relative to different base points are (non-canonically) isomorphic.

gives rise to a long exact sequence

0 ⟶ μ_{n}(X) ⟶ Γ(X, 𝒪_{X})^{∗}  ⟶^{·n} Γ(X, 𝒪_{X})^{∗} ⟶
H^{1}(X_{ét}, μ_{n}) ⟶ H^{1}(X_{ét}, 𝔾_{m}) ⟶ H^{1}(X_{ét}, 𝔾_{m}) ⟶ ⋯
∥∼  ∥∼
Pic(X)  ⟶^{·n}  Pic(X)

Since X is projective, ·n : Γ(X, 𝒪_{X})^{∗} ⟶ Γ(X, 𝒪_{X})^{∗} ≃ k^{∗} is an isomorphism. We thus have an isomorphism

H^{1}(X_{ét}, μ_{n}) ˜ ⟶Pic(X)_{n}^{2}

Choosing an isomorphism μ_{n} ⟶ ℤ/nℤ we get a non-canonical isomorphism

H^{1}(X_{ét}, ℤ/nℤ) ≈ Pic(X)_{n}.

Now let l ≠char(k) be a prime. We can choose isomorphism μ_{l^{i}} ˜ ⟶ℤ/l^{i}ℤ in a way that is compatible with the projective systems. Taking the limit, we obtain an isomorphism

H^{1}(X_{ét}, ℤ_{l}) ˜ ⟶T_{l}(Pic(X)).^{3}

It follows

H^{1}(X_{ét}, ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l} ≈ T_{l}(Pic(X)) ⊗_{ℤ_{l}} ℚ_{l} ≃ T_{l}(Pic^{0}(X)) ⊗_{ℤ_{l}} ℚ_{l} ≃
T_{l}(Pic^{0}(X)^{red}) ⊗_{ℤ_{l}} ℚ_{l}

On the other hand, Pic^{0}(X)^{red} is an abelian variety and with [Mi-A, Theorem 15.1], we can conclude that

dim(Pic^{0}(X)) = dim(Pic^{0}(X)^{red})

\frac{1}{2}dim_{ℚ_{l}}T_{l}(Pic(X)) ⊗_{ℤ_{l}} ℚ_{l} = \frac{1}{2}dim_{ℚ_{l}}H^{1}(X_{ét}, ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l}

Proof of the second equation (outline) There is a canonical isomorphism

Hom_{cont}(π_{1}(X), ℤ_{l}) ≃ H^{1}(X_{ét}, ℤ_{l})

This follows from the following facts:

- H^{1}(X_{ét}, ℤ/nℤ) ≃H^{1}^{∨} (X_{ét}, ℤ/nℤ). ^{4} [Mi-É, III.2, Theorem 2.17.]

2For some abelian group G, we denote the kernel of the multiplication of n by G_{n}. In particular, if A is an abelian variety over the algebraically closed field k, then A[n](k) ≃ A(k)_{n}.

3For an abelian group G and some prime l, we denote lim_{⟵i} G_{l^{i}} by T_{l}(G). In particular, if A is an abelian variety over the algebraically closed field k, then T_{l}(A) = T_{l}(A(k)).

4We use the same notation for a finite group, the corresponding group scheme and the corresponding étale/flat sheaf over some scheme.

- The set of isomorphism classes of principal homogeneous spaces for ℤ/nℤ

over X is in bijection with H^{1}^{∨}(X_{et}, ℤ/nℤ). [Mi-É, III.4, Corollary 4.7., Remark 4.8.]

- Principal homogeneous spaces for ℤ/⋉ℤ over X correspond to Galois coverings of X with given Galois action of ℤ/nℤ and vice versa, and the set of isomorphism classes of these is in bijection with Hom_{cont}(π_{1}(X), ℤ/nℤ). ([SGA I, V.2] and definition of the étale fundamental group) □

If Pic(X) is reduced (smooth) – thus an abelian variety – can also be read of from cohomology:

Lemma A.2

dim(Pic^{0}(X)) ≤ dim_{k}H^{1}(X, 𝒪_{X})

Equality holds iff Pic^{0}(X) is reduced. In particular, this is the case if char(k) = 0.

Proof See [BLR, 8.4, Theorem 1]. The last statement follows from the fact that all projective group schemes over fields in characteristic zero are reduced. □

For the following proposition we need the definition:

Definition Let char(k) > 0, let X be a projective k-variety. A smooth proper global lifting is a separated scheme 𝒳 defined over the spectrum of a discrete valuation ring R such that

• The function field of R has characteristic zero and the residue field is k

• The “geometric fiber” 𝒳_{0} := 𝒳 ⊗_{R} k is isomorphic to X

• 𝒳 is smooth and proper over SpecR.

Let 𝒳_{η} := 𝒳 ⊗_{R} Quot(R) be the “generic fiber” of 𝒳. Then in particular, 𝒳_{η} is a non-singular, proper, integral Quot(R)-variety. We denote 𝒳_{η} ⊗_{Quot(R)} \overline{Quot(R)} be \overline{𝒳_{η}}.

Remark We will use that the Picard-scheme of 𝒳_{η} exists and is proper. Since up to now we have only talked about the Picard-scheme of a projective non-singular integral variety, we assume furthermore that the generic fiber of 𝒳_{η} is projective. However, the Picard-scheme also exists in the proper case and is proper; see [BLR, 8.2. Theorem 3 ,8.4, Theorem 3].

Lemma A.3 Let k be a field with positive characteristic. Let X have a smooth proper global lifting. Then Pic^{0}(X) is reduced.

Proof By Lemma A.2 we have to show that dim(Pic^{0}(X)) = dimH^{1}(X, 𝒪_{X}).

Let 𝒳 be a global lifting for k over the spectrum of the discrete valuation ring R.

Let l ≠char(k) be a prime. By the above lemmata,

\frac{1}{2}dim_{ℚ_{l}}H^{1}(\overline{𝒳_{η}}_{ét}, ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l} = dim\overline{Quot(R)}H^{1}(\overline{𝒳_{η}}, 𝒪_{𝒳_{η}} ).

We now use the theorems of cohomology and base change to “transfer” this equation to 𝒳_{0} ≈ X.

dim\overline{Quot(R)}H^{1}(\overline{𝒳_{η}}, 𝒪_{𝒳_{η}} ) = dim_{Quot(R)}H^{1}(𝒳_{η}, 𝒪_{𝒳_{η}} ) = dim_{k}H^{1}(𝒳_{0}, 𝒪_{𝒳_{η}} )

The first equation is a special case of [Ha, III, Proposition 9.3], and the second equation follows from [Ha, III, Corollary 12.9].

By [Mi-É, VI, Corollary 4.2],

H^{1}(\overline{𝒳_{η}}_{ét}, ℤ/nℤ) ≅ H^{1}(𝒳_{0}_{ét}, ℤ/nℤ).

These equations imply

dim(Pic^{0}(X)) = \frac{1}{2}dim_{ℚ_{l}}(H^{1}(X_{ét}, ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l}) = dim_{k}H^{1}(X, 𝒪_{X}).

Thus by Lemma A.2, X is reduced. □

A.1.2 The Picard scheme of a product

Let k be an algebraically closed field and let X_{1}, X_{2} be two non-singular projective integral k-varieties. Let P_{1} and P_{2} be k-rational points of X_{1}, X_{2} respectively. Let q_{i} : X_{1} ×_{k} X_{2} ⟶ X_{i} (i = 1, 2) be the projections.

Let Z be a k-scheme. By bull-back, we have morphisms

Pic(X_{1} ×_{k} Z)/Pic(Z) × Pic(X_{1} ×_{k} Z)/Pic(Z) ⟶ Pic(X_{1} ×_{k} X_{2} ×_{k} Z)/Pic(Z)

(\overline{\overline{ℳ_{1}}}, \overline{\overline{ℳ_{2}}}) ↦ \overline{\overline{q_{1}^{∗}(ℳ_{1}) ⊗ q_{2}^{∗}(ℳ_{2})}}.

By applying (P_{i} ×_{k} id_{Z})^{∗} we see that these morphism are injective.

Thus we get an injective natural transformation

𝒰 : 𝒫ic(X_{1}) × 𝒫ic(X_{1}) ⟶ 𝒫ic(X_{1} ×_{k} X_{2}).

This induces a morphism

U : Pic^{0}(X_{1}) × Pic^{0}(X_{1}) ⟶ Pic^{0}(X_{1} ×_{k} X_{2}).

Proposition A.4 If k has characteristic zero or if X_{1} and X_{2} have smooth proper global liftings, then U is an isomorphism between abelian varieties.

In general, U induces an isomorphism between the corresponding reduced objects, which are abelian varieties.

Proof By Lemma A.1,

dim(Pic^{0}(X_{1} ×_{k} X_{2})) = \frac{1}{2}dim_{ℚ_{l}}(Hom_{cont}(π_{1}(X_{1} ×_{k} X_{2}), ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l}) =

\frac{1}{2}dim_{ℚ_{l}}(Hom_{cont}(π_{1}(X_{1}) × π_{1}(X_{2}), ℤ_{l}) ⊗_{ℤ_{l}} ℚ_{l}) =

\frac{1}{2}dim_{ℚ_{l}}(Hom_{cont}(π_{1}(X_{1}), ℤ_{l}) × Hom_{cont}(π_{1}(X_{2}), ℤ_{l})) ⊗_{ℤ_{l}} ℚ_{l}) =
dim(Pic^{0}(X_{1})) · dim(Pic^{0}(X_{2})).

(A.1)

Here we use

π_{1}(Pic^{0}(X_{1}) ×_{k} Pic^{0}(X_{2})) ≅ π_{1}(Pic^{0}(X_{1})) × π_{1}(Pic^{0}(X_{2}))

(relative so some base points); see [SGA I, X, Corollaire 1.7].

Alternatively, we could also use the Künneth-formula of étale cohomology to derive (A.1).

Since k is an algebraically closed field, the corresponding reduced objects on both sides are abelian varieties. U has trivial kernel, thus induces an isomorphism of abelian varieties.

If X_{1} and X_{2} have global liftings, so has the product and by Lemma A.3, both sides are reduced, thus U is an isomorphism. □

Remark If X_{1} and X_{2} are irreducible non-singular curves, then a smooth global lifting exists; see [Po, Satz 10.1]. Thus in this case, U is an isomorphism of abelian varieties.

A.2 Some results about abelian varieties

The results is this section are mostly well-known. Some of the results are discussed in [Mu] over algebraically closed fields at least implicitly. However, for most of the results we lack a suitable reference and because of that we include them with proofs.

A.2.1 Isogenies

Let K be a field, A, B and C three abelian K-varieties.

Lemma A.5 Let α, β : B ⟶ C be some morphisms, π : A ⟶ B an isogeny. Assume that απ = βπ. Then α = β.

Proof π is surjective on \overline{K}-valued points, and thus α = β : B(\overline{K}) ⟶ C(\overline{K}). This implies α = β : B ⟶ C. □

We also have the following analogous result:

Lemma A.6 Let α, β : A ⟶ B be some morphisms, π : B ⟶ C an isogeny. Assume that πα = πβ. Then α = β.

Proof Since π : b ⟶ C is an isogeny, ker(π) is a closed subscheme of ker([n]) for some n ∈ ℕ. Thus there exists a ρ : C ⟶ B such that ρπ = n id_{C}. Thus [n] α = [n] β, so α[n] = β[n]. Since [n] is an isogeny, we get α = β by the preceding lemma. □

For any two abelian varieties A and B, let as usual Hom_{K}^{0}(A, B) := Hom_{K}(A, B) ⊗_{ℤ} ℚ. Hom_{K}(A, B) is a free abelian group (since [n] = n id is an isogeny), thus Hom_{K}(A, B) ⟶ Hom_{K}^{0}(A, B) is an inclusion.

If α : A ⟶ B, q ∈ ℚ, we write q α for α ⊗ q.

The class of abelian varieties with morphisms between two abelian varieties A and B being Hom_{K}^{0}(A, B) forms a category which is called the “category of abelian varieties up to isogeny”; cf. [Mu, par. 19].

Lemma A.7 Let π : A ⟶ B be an isogeny. We want to show that π has a unique inverse in the category of abelian varieties up to isogeny. By this we mean the following: There exists a ρ ∈ Hom_{K}^{0}(B, A) with ρπ = id_{A}, πρ = id_{B}. Moreover, ρ is uniquely determined by πρ = id_{A} or ρπ = id_{B}.

Proof There exists some isogeny ρ : B ⟶ A and some n ∈ ℕ with ρπ = n id_{A}. Thus \frac{1}{n}ρπ = id_{A}, i.e. \frac{1}{n}ρ is the left inverse of π in the category of abelian varieties up to isogeny. Now, \frac{1}{n}β is also the right inverse for π. In fact, πρπ = nπ, and by Lemma A.5, πρ = n id_{B}. Again by the preceding lemmata, the left and right inverses of π in the category of abelian varieties up to isogeny are unique. Thus ρ is the unique inverse of π in the category of abelian varieties up to isogeny. □

We will denote the inverse of the isogeny π by π^{−1}.

The next lemma is now obvious.

Lemma A.8 Let π : A ⟶ B be an isogeny of abelian varieties. Then End_{K}^{0}(A) ⟶ End_{K}^{0}(B) α ↦ παπ^{−1} is an isomorphism.

□

Remark Let the kernel of π : A ⟶ B be contained in ker([n]) for some n ∈ ℕ. For example, A and B might be elliptic curves and π an isogeny of degree n.

Then the above lemma may be strengthened in the following way: For some ring Λ and an element f ∈ Λ, let Λ_{(f)} be the localization of Λ at the multiplicative set {f^{i}|i ≥ 0}. Then π induces an isomorphism End(A)_{(f)} ⟶ End(B)_{(f)}.

A.2.2 The Néron-Severi group and polarizations

Let k be a field and let A be an abelian k-variety, Â the dual variety. Let ℒ be an invertible sheaf on A. Let ϕ_{ℒ} : A ⟶ Â be the morphism which is associated to the natural transformation Hom(−, A) ⟶ 𝒫ic^{0}(A), given for Z-valued points P by P ↦ T_{P}^{∗}q_{Z}^{∗}(\overline{ℒ}) ⊗ q_{Z}^{∗}(\overline{ℒ})^{−1}, where q_{Z} : A ×_{k} Z ⟶ A is the projection. The map ϕ : Pic(A) ⟶ Hom_{K}(A, Â) itself is a group homomorphism. The kernel of ϕ is Pic^{0}(A), the group of classes of invertible sheaves on A being algebraically equivalent to 𝒪_{𝒜} .

The group Pic(A)/Pic^{0}(A) is called the Néron-Severi group of A, denoted NS(A). As usual, we denote NS(A) ⊗_{ℤ} ℚ by NS^{0}(A). If x ∈ NS(A) is given by some sheaf ℳ on A, we denote ϕ_{ℳ} also by ϕ_{x}. By construction, the map ϕ : NS(A) ⟶ Hom_{k}(A, Â) is an injective group homomorphism. It extends to an injective group homomorphism ϕ : NS^{0}(A) ⟶ Hom_{k}^{0}(A, Â).

Let K|k be an algebraic field extension. Let A′ be an abelian K-variety. As usual, any k-morphism σ : Spec(K) ⟶ Spec(K) induces an isomorphism σ^{∗} : Pic(A′) ⟶ Pic(σ^{−1}(A′)). This isomorphism corresponds to the isomorphism σ^{−1}(…) = (…)^{σ} : Pic(A′) ⟶ Pic(σ^{−1}(A′)). (For K|k Galois and A′ = A_{K} this is a special case of Lemma 1.16, if one forgets the last equality of the proof of Lemma 1.16, this proof also implies the general case.)

Lemma A.9 Let σ be a k-automorphism of Spec(K), let ℒ be an invertible sheaf on A′. Then

ϕ_{σ^{∗}(ℒ)} = σ^{−1}ϕ_{ℒ} σ = σ^{−1}(ϕ_{ℒ}) = ϕ_{ℒ}^{σ} : σ^{−1}(A′) ⟶ σ^{−1}(Â′).

Proof Let σ′^{#} be a k-automorphism with σ′^{#}|K = σ^{#}. This defines a Kautomorphism σ′ of Spec(\overline{K}). Denote the pull-back of ℒ to A′ ; \overline{K} again by ℒ. Applying the base change \overline{K}|K to the above equality, we get the following equality of morphisms of abelian \overline{K}-varieties, which is equivalent to the equality in the statement of the lemma.

ϕ_{σ′^{∗}(ℒ)} = σ′^{−1}ϕ_{ℒ} σ′ = σ′^{−1}(ϕ_{ℒ}).

We show that this equality holds for \overline{K}-valued points. This implies the equality in the statement of the lemma.

Let P be a \overline{K}-valued point of σ^{−1}(A′ ; \overline{K}) ≃ σ′^{−1}(A′)\overline{K}. We use that σ′T_{P} σ′^{−1} =

σ′(T_{P}) = T_{σ′(P)} : A′ ; \overline{K} ⟶ A′ ; \overline{K}.

Now, ϕ_{σ′^{∗}(ℒ)} ∘ P (which is a \overline{K}-valued point of σ^{′−1}(Â′\overline{K})) corresponds to the class of sheaves T_{P}^{∗}(σ′^{∗}(\overline{ℒ}))⊗σ′^{∗}(\overline{ℒ})^{−1} = (σ′T_{P})^{∗}(\overline{ℒ})⊗σ′^{∗}(\overline{ℒ})^{−1} = (T_{σ′(P)}σ′)^{∗}(\overline{ℒ})⊗ σ′^{∗}(\overline{ℒ})^{−1} = σ′^{∗}(T_{σ′(P)}^{∗}(\overline{ℒ}) ⊗ \overline{ℒ}^{−1}). This sheaf in turn corresponds to σ′^{−1}(ϕ_{ℒ} ∘ σ′(P)) = σ′^{−1} ∘ ϕ_{ℒ} ∘ σ′ ∘ P ∘ σ′^{−1} ∘ σ′ = σ′^{−1}(ϕ_{ℒ}) ∘ P. □

Galois extensions

Now let K|k be Galois. Let A be an abelian k-variety, A′ = A_{K}.

Then the last lemma implies in particular that Pic^{0}(A_{K}) is invariant under pull-back by σ. (This follows for example also from the fact that the operation of G on Pic(A_{K})(K) restricts to an operation on Pic^{0}(A_{K})(K) = Â(K).)

Since Pic^{0}(A) = Pic^{0}(A_{K})∩Pic(A), NS(A) is naturally a subgroup of NS(A_{K}). Because Pic^{0}(A) is invariant under the Galois-operation, G operates on NS(A_{K}).

With the notations as in the lemma, ℒ defines an element in NS(A_{K})^{G} iff ϕ_{ℒ} is invariant under G, i.e. iff it is defined over k.

We want to study the cokernel of the injective group homomorphism

NS(A) ↪ NS(A_{K})^{G}.  (A.2)

Lemma A.10 The cokernel of (A.2) has exponent 2.

Proof This is a special case of [Mu, 20, p.188, Theorem 2]:

Let x ∈ NS(A_{K})^{G}. This induces the morphism ϕ_{x} : A ⟶ Â.

Choose a prime l ≠char(k). The bilinear form e_{l}(., ϕ_{x}(.)) on T_{l}(A\overline{K}) is skewsymmetric since ϕ_{x} ⊗_{k} id_{K} = ϕ_{ℒ} on A_{K}. Let 𝒫 be a universal divisional correspondence on A × Â, and let ℳ := (id, ϕ_{x})^{∗}(𝒫). Then one calculates that 2e_{l}(., ϕ_{x}(.)) = e_{l}(., ϕ_{ℳ} (.)). It follows that 2ϕ_{x} = ϕ_{ℳ} because of the non-degeneracy of e_{l}.

This implies that \overline{ℳ} is class of 2x in NS(A_{K})^{G}. □

Warning The proof of the remark following [Mu, par. 20, p.188, Theorem 2] (i.e. [Mu, par. 23, p.231, Theorem 3]) does not hold since it is assumed that Pic(A) is divisible. Thus one cannot conclude that the cokernel of (A.2) is trivial.

Now we study the cokernel of (A.2) with a cohomological approach.

By definition of the Néron-Severi group we have a short exact sequence

1 ⟶ Pic^{0}(A_{K}) ⟶ Pic(A_{K}) ⟶ NS(A_{K}) ⟶ 1.

Taking invariants under the action by the Galois group G, we get a long exact sequence

1 ⟶ Pic^{0}(A) ⟶ Pic(A) ⟶ NS(A_{K})^{G} ⟶
H^{1}(G, Pic^{0}(A_{K})) ⟶ H^{1}(G, Pic(A_{K})) ⟶ ⋯

Thus coker(Pic(A) ⟶ NS(A_{K})^{G}) = ker(H^{1}(G, Pic^{0}(A_{K})) ⟶ H^{1}(G, Pic(A_{K}))).

Lemma A.11 If the order of G is finite and odd then NS(A) ⟶ NS(A_{K})^{G} is an isomorphism.

Proof We already know that the cokernel has exponent 2. On the other hand, since G is a finite group and the order of G odd, so are the orders of its Tatecohomology groups; see [Se, VIII, 2, p.130, Corollary 1]. Thus the cokernel has to be trivial. □

Lemma A.12 Let k be finite. Then H^{1}(Gal(\overline{k}|k), A(\overline{k})) = 0 and thus NS(A) ⟶ NS(A\overline{k})^{Gal(\overline{k}|k)} is an isomorphism.

Proof We only have to show the result for all finite subextensions. Let K|k be such a subextension with Galois group G.

Every 1-cocycle (P_{σ})_{σ∈G} defines by σ ↦ T_{P_{σ}} (= translation by P_{σ}) a twist of A_{K}. Such a twist is isomorphic to A iff (P_{σ})_{σ∈G} is a 1-coboundary, i.e. if there exists a Q ∈ A(K) with σ^{−1}(Q) − Q = P_{σ} for all σ ∈ G, i.e. iff σ^{−1}(Q) = T_{P_{σ}} ∘ Q, i.e. iff Q = σ ∘ T_{P_{σ}} ∘ Q ∘ σ^{−1}. And this means that Q is invariant under the Galois-operation of G on A_{K} and thus is a k-rational point of A.

Now, a theorem by S.Lang says that over a finite field k, all k-schemes which are “geometrically” abelian varieties have a rational point; see [Mu, p.205, Theorem 3].

So (P_{σ})_{σ∈G} is a 1-coboundary and thus H^{1}(G, A_{K}) is trivial.

Note: The argument can be reformulated by saying that all principal homogeneous spaces of A_{K} are equivalent, or – what is the same – that the Weil-Châtelet-group of A is trivial; see [Si, X, 3] for details, the results formulated there hold for general abelian varieties. □

The Néron-Severi group as functor

Lemma A.13 Let ψ : A ⟶ B be a morphism of abelian k-varieties, x ∈ NS^{0}(B_{k^{sep}})^{Gal(k^{sep}|k)}, given by some \overline{ℒ} ∈ Pic(B_{k^{sep}}). Then

ϕ_{ψ^{∗}(ℒ)} = ψ̂ ⊗_{k} id_{k^{sep}} ∘ ϕ_{ℒ} ∘ ψ ⊗_{k} id_{k^{sep}} : A_{k^{sep}} ⟶ Â_{k^{sep}}.

The proof is analogous to the one of Lemma A.9.

We can assume that k = \overline{k}.

Let P be a k = \overline{k}-valued point of A. We use that ψ T_{P} = T_{ψ∘P} ψ.

Now, ϕ_{ψ^{∗}(ℒ)} ∘ P (which is a k-valued point of Â) corresponds to the class of sheaves T_{P}^{∗}(ψ^{∗}(\overline{ℒ}))⊗ψ^{∗}(\overline{ℒ})^{−1} = (ψT_{P})^{∗}(\overline{ℒ})⊗ψ^{∗}(\overline{ℒ})^{−1} = (T_{ψ∘P} ψ)^{∗}(\overline{ℒ})⊗ψ^{∗}(\overline{ℒ})^{−1} = ψ^{∗}(T_{ψ∘P}^{∗} (\overline{ℒ}) ⊗ \overline{ℒ}^{−1}). This sheaf in turn corresponds to ψ̂ϕ_{ℒ} ψ ∘ P. □

In particular, Pic^{0}(A) is invariant under ψ^{∗}. Thus NS is a contravariant functor from the category of abelian k-varieties to the category of abelian groups. (And so are NS^{0}, NS((.)_{k^{sep}})^{Gal(k^{sep}|k)} and NS^{0}((.)_{k^{sep}})^{Gal(k^{sep}|k)}.)

If ψ : A ⟶ B, the corresponding homomorphism between Néron-Severi groups will also be denoted by ψ^{∗}.

Polarizations and the category of polarized abelian varieties

Definition [Mi-A, 13] A polarization of A is a morphism φ : A ⟶ Â such that φ⊗_{k} id\overline{k} = ϕ_{ℒ} : A\overline{k} ⟶ A\overline{k} for some ample sheaf ℒ on A\overline{k}. A principal polarization is a polarization with trivial kernel.

By Lemma A.9, ϕ induces a bijection between the subset of element of NS(A_{k^{sep}})^{Gal(k^{sep}|k)} defined by ample sheaves and the set of polarizations on A.

Definition The category of polarized abelian varieties over k consists of the following:

Objects are abelian varieties A with some element x ∈ NS(A\overline{k}) where x is defined by an ample sheaf and – after the choice of a dual abelian variety Â – ϕ_{x} : A\overline{k} ⟶ Â\overline{k} is defined over k. (If k is perfect, this is the same as saying that x ∈ NS(A\overline{k})^{Gal(\overline{k}|k)}.)

The morphisms between two objects (A, x) and (B, y) are morphisms α : A ⟶ B with α^{∗}(x) = y. ^{5}

Analogously, one defines the category of polarized abelian varieties with polarizations defined by sheaves over k. Here, the objects are abelian varieties A with some x ∈ NS(A). The morphisms are defined as above.

There is a forget-functor from the category of polarized abelian varieties with polarizations defined by sheaves over k to the category of polarized abelian varieties varieties. This functor is fully faithful.

And there is a forget-functor from the category of polarized abelian varieties to the category of abelian varieties. This functor is also faithful and for a fixed abelian variety A, the preimages under this functor correspond in a natural way to the polarizations on A.

The results about the Néron-Severi group translate to results of polarizations. For example, if φ : A ⟶ Â is a polarization, then 2φ is defined by a sheaf on A. And if k is finite, every polarization is defined by a sheaf on A.

The proof is [Mu, 20, p.188, Theorem 2] again plus the fact that “ample” is a geometric property and depends only on the class of a sheaf in the Néron-Severi group.

For the next two lemmata, let k be perfect.

Lemma A.14 Let φ : A ⟶ Â be a polarization. This polarization induces an injective group homomorphism NS^{0}(A\overline{k})^{Gal(\overline{k}|k)} ⟶ End_{k}^{0}(A). The image of this inclusion consists of the elements of End_{k}^{0}(A) which are fixed by the Rosati involution (with respect to φ).

Now let φ be a principal polarization. Then we have an injective group homomorphism NS(A\overline{k})^{Gal(\overline{k}|k)} ⟶ End_{k}(A). Again, the image of this inclusion consists of the elements which are fixed by the Rosati involution (with respect to φ).

Proof Both statements follow from the corresponding statements over algebraically closed fields by taking Galois-invariants. Thus we restrict ourselves to algebraically closed fields.

5With this definition for the category of polarized abelian varieties we avoid the (simultaneous)

choosing of a dual abelian variety for every abelian variety.

Let k be algebraically closed. The first statement is well-known; see [Mu, p.190 (3)]. For the second statement, let λ ∈ End(A). By the first statement, there exists an n ∈ ℕ and sheaf ℳ on A such that φ^{−1}ϕ_{ℳ} = nλ, i.e. ϕ_{ℳ} = nφλ. Since φ is an isomorphism, ker(ϕ_{ℳ} ) contains A[n], the group scheme of n-torsion points of A. Since we assumed k to be algebraically closed, by [Mu, par. 23, p.231, Theorem 3], there exists a sheaf 𝒩 on A such that \overline{𝒩}^{n} = \overline{ℳ}, and the class of this sheaf in the Néron-Severi group is mapped to λ. □

Lemma A.15 Let φ be a polarization on A. With respect to this polarization, let (…)′ denote the Rosati involution.

Let x ∈ NS(A\overline{k})^{Gal(\overline{k}|k)} corresponding under the polarization φ to the endomorphism m on A. Let ψ be an endomorphism on A. Then ψ^{∗}(x) corresponds – again under φ – to ψ′mψ ∈ End_{k}^{0}(A).

Proof The element in End_{k}^{0}(A) we are looking for is φ^{−1}ϕ_{ψ^{∗}(x)}, and this equals φ^{−1}ψ̂ϕ_{x}ψ = φ^{−1}ψ̂φφ^{−1}ϕ_{x}ψ = ψ′mψ. □

A.2.3 Products and the Rosati involution

Let k be a field, let B_{i} for i = 1, …, n and A_{j} for j = 1, …, m be abelian kvarieties. Let A := ∏_{j=1,...,m} A_{j}, B := ∏_{i=1,...,n} B_{i}. Let ι_{j}^{A} : A_{j} ⟶ A be the inclusions and let p_{j}^{A} : A ⟶ A_{j} be the projections. (Similar definitions for B.) Then, since a finite product of abelian varieties is also the sum of the these abelian varieties in the category of abelian varieties,

\begin{matrix}Hom_{k}(A, B) & ⟶ & ⨁_{i,j} Hom_{k}(A_{j}, B_{i}) \\ ψ & ↦ & (p_{i}^{B}ψι_{j}^{A})_{i=1,...,n, j=1,...,m} \end{matrix}  (A.3)

is an isomorphism. (The same is true for the corresponding groups Hom_{k}^{0}(…, …) of both sides.)

Thus every morphism from A to B is uniquely determined by its “matrix”, and conversely, every “matrix” determines a morphism. Further, the composition of morphisms corresponds to the usual composition of matrices.

In particular, under (A.3), End_{k}(A) is isomorphic to the “matrix ring” ⨁_{i,j} Hom_{k}(A_{j}, A_{i}).

There is a notational difficulty: For j = 1, a morphism ψ = (ψ_{1}, …, ψ_{n}) : A ⟶ B = ∏_{i=1,...,n} B_{i} is represented by the column vector

( ψ_{1} ; ψ_{2} ; ⋮ ; ψ_{n} ) .

We now want to study how the Rosati involution with respect to a product polarization operates on the “matrices”. It is convenient to generalize the concept of a “Rosati involution” first.

Let X and Y be abelian k-varieties with fixed polarizations φ_{X} : X ⟶ X̂, φ_{Y} : Y ⟶ Ŷ. Then for every ψ ∈ Hom_{k}^{0}(X, Y), we denote φ_{X}^{−1}ψ̂φ_{Y} ∈ Hom_{k}^{0}(Y, X) by ψ′ and call it the Rosati involution with respect to the polarizations φ_{X} and φ_{Y}.

Now for i = 1, …, n, j = 1, …, m, let φ_{B_{i}} : B_{i} ⟶ B̂_{i} and φ_{A_{j}} : A_{j} ⟶ Â_{j} be polarizations. Let φ_{A} : A ⟶ Â and φ_{B} : B ⟶ B̂ be the corresponding product polarizations.

Lemma A.16 Let ψ ∈ Hom_{k}^{0}(A, B) be by the “matrix” (ψ_{i,j})_{i=1,...,n, j=1,...,m}, ψ_{i,j} ∈ Hom_{k}^{0}(A_{j}, B_{i}). Then with respect to φ_{A} and φ_{B}, the Rosati involution of ψ is given by the “matrix” (ψ′_{j,i})_{i=1,...,m, j=1,...,n} with ψ′_{j,i} ∈ Hom_{k}^{0}(B_{j}, A_{i}).

Proof Under the identification of Â with ∏_{j=1,...,n} Â_{j}, p̂_{j}^{A} equals (by definition)

ιÂ ; j. Analogously, p̂Â ; j = ιˆÂ ; j = ι_{j}^{A} and thus pÂ ; j = ι̂_{j}^{A}. Further, φι_{j}^{B} = ιB̂ ; jφ_{B_{j}} and

φ_{A_{i}}p_{i}^{A} = pÂ ; iφ, i.e. p_{i}^{A}φ_{A}^{−1} = φ_{A_{i}}^{−1}pÂ ; i.

We have to show that p_{i}^{A}ψ′ι_{j}^{B} = ψ′_{j,i}. Now,

\begin{matrix}p_{i}^{A}ψ′ι_{j}^{B} = p_{i}^{A}φ_{A}^{−1}ψ̂φ_{B}ι_{j}^{B} = φ_{A_{i}}^{−1}pÂ ; iψ̂ιB̂ ; jφ_{B_{j}} = φ_{A_{i}}^{−1}ι̂_{i}^{A}ψ̂p̂_{j}^{B}φ_{B_{j}} = \\ φ_{A_{i}}^{−1}{ \atop (p_{j}^{B}ψι_{i}^{A})}φ_{B_{j}} = φ_{A_{i}}^{−1}ψ̂_{j,i}φ_{B_{j}} = ψ′_{j,i} \end{matrix}

□

A.2.4 Orthogonal complements and the Complete Reducibility Theorem

In this subsection, let k be a perfect field. Let X be an abelian variety over k. Let λ|k be a subfield of \overline{k}|k, ℒ an an ample sheaf on X_{λ} defining a polarization φ : X ⟶ X̂. Let Y be an abelian subvariety of X, let ι_{Y} : Y ↪ X be the inclusion, and let ι̂_{Y} : X̂ ⟶ Ŷ be the corresponding dual morphism.

The sheaf ι_{Y}^{∗} (ℒ) is again ample (this is true for any pull-back of an ample sheaf), and by Lemma A.13, the polarization defined by ι_{Y}^{∗} (ℒ) can be calculated as follows:

Lemma A.17 ι̂_{Y}φι_{Y} ⊗_{k} id_{λ} = ϕ_{ι_{Y}^{∗} (ℒ)} . In particular, K(ℒ) = ker(ι̂_{Y}φι_{Y}) ⊗_{k} id_{λ}.

Definition Let Z be the reduced connected component of the zero of φ^{−1}(ker(ι̂_{Y})) = ker(ι̂_{Y}φ). With other words, it is reduced induced closed subscheme associated to the connected component of the zero of ker(ι̂_{Y}φ). (Thus there exists a natural closed immersion Z ↪ ker(ι̂_{Y}φ).) We call Z the orthogonal complement of Y in X with respect to ℒ. The reduced and irreducible sub-group scheme Z of X is geometrically irreducible by lemma A.28 and geometrically reduced because we assumed k to be perfect, thus Z is an abelian variety. From this it also follows that “orthogonal complement” commutes with base extension (of fields). Since ϕ_{ι_{Y}^{∗}} is surjective, ι̂_{Y} is surjective.

Let l ≠char(k) be a prime. Let E^{ℒ} be the Riemann form associated with ℒ and l; cf. [Mu, p.186]. The term “orthogonal complement” is justified by the following lemma.

Lemma A.18 Z\overline{k} is the largest abelian subvariety Z′ ; \overline{k} of X\overline{k} with the property that

E^{ℒ} (Y\overline{k}, Z′ ; \overline{k}) = 1.

Proof Let P ∈ T_{l}(X\overline{k}), Q ∈ T_{l}(Y\overline{k}). Then

E_{X\overline{k}}^{ℒ}(T_{l}(ι_{Y})(Q), P) = e_{l}_{X\overline{k}}(T_{l}(ι_{Y})(Q), T_{l}(ϕ_{ℒ})(P)) = e_{l}_{Y\overline{k}}(Q, T_{l}(ι̂_{Y})T_{l}(ϕ_{ℒ})(P)).

So,

E_{X\overline{k}}^{ℒ}(T_{l}(ι_{Y} Y\overline{k}), P) = 1 ⟷ e_{l}_{Y\overline{k}}(T_{l}(Y\overline{k}), T_{l}(ι̂ϕ_{ℒ})(P)) = 1 ⟷ T_{l}(ι̂ϕ_{ℒ})(P) = 1.

Especially, the orthogonal complement Z\overline{k} of Y\overline{k} has the desired property. On the other hand, if Z′ ; \overline{k} is any abelian subvariety with E^{ℒ} (Y\overline{k}, Z′ ; \overline{k}) = 1, then T_{l}(Z′ ; \overline{k}) ⊆ T_{l}(ϕ_{ℒ}^{−1}(ker(ι̂))). This implies T_{l}(Z′ ; \overline{k}) ⊆ T_{l}(Z\overline{k}).

[Assume P ∈ T_{l}(Z′ ; \overline{k}), P ∉ T_{l}(Z\overline{k}). Let i > 0 such that l^{i}P = 0. For all m ∈ ℕ,

let Q_{m} ∈ T_{l}(Z′ ; \overline{k}) with l^{im}Q_{m} = P. Then for m_{1} < m_{2}, Q_{m_{2}}−Q_{m_{1}} ∉ T_{l}(Z\overline{k}) because

otherwise P = l^{im_{2}}(Q_{m_{2}} − Q_{m_{1}}) ∈ T_{l}(Z\overline{k}). So all sets Q_{m_{1}} + T_{l}(Z\overline{k}), Q_{m_{2}} + T_{l}(Z\overline{k}) are disjoint. By construction they are also contained in T_{l}(ϕ_{ℒ}^{−1}(ker(ι̂))), thus this set has infinitely many elements, a contradiction.]

Now the result follows by the injectivity of the l-adic representation. □

Lemma A.19 Y ∩ Z := Y ×_{X} Z =: ι_{Y}^{−1}(Z) is a closed subscheme of ker(ι̂_{Y}φι_{Y}).

Proof The closed immersion Z ↪ ker(ι̂_{Y}φ) induces a closed immersion ι_{Y}^{−1}(Z) ↪ ι_{Y}^{−1}(ker(ι̂_{Y}φ)) = ker(ι̂_{Y}φι_{Y}). (“Closed immersion” is “stable under base extension”.) □

Since ι_{Y_{λ}}^{∗}(ℒ) is ample, so K(ι_{Y_{l}}^{∗}(ℒ)) is finite, and so is Y ×_{X} Z. This implies the “Complete Reducibility Theorem”.

Proposition A.20 [Mu, p.173] Let (X, φ) be a polarized abelian k-variety and Y an abelian subvariety, Z the orthogonal complement of Z with respect to ℒ. Then dim(X) = dim(Y) + dim(Z) and X is isogenous to Y ×_{k} Z.

Remark Let ι : Y ×_{k} Z ⟶ X be the isogeny, defined by ι_{X} and ι_{Y}. Then under this isogeny, φ becomes a product polarization, i.e. ι̂φι is a product polarization. This is obvious since by definition of Z, ι̂_{Z}φι_{Y} = 0 and similarly with Y and Z interchanged, since the definition is “orthogonal complement” is symmetric by Lemma A.18 for example.

Already assuming the Complete Reducibility Theorem, one can easily proof

Lemma A.21 Let X and Z be abelian k-varieties, p : X ⟶ Z a surjective morphism. Then p̂: X̂ ⟶ Ẑ has finite kernel.

Proof Let Y be the reduced connected component of the zero of the kernel of p : X ⟶ Z, ι_{Z′} : Z′ ↪ X the orthogonal complement of Y with respect to some polarization. Then the kernel of pι_{Z′} : Z′ ⟶ Z is immersed in Z′ ∩ ker(p) which is finite since Z′ ∩ Y is finite. So pι_{Z′} : Z′ ⟶ Z is an isogeny, and so is ι_{Z′} p̂: Z ⟶ Z′. Thus p̂ has finite kernel. □

This implies:

Lemma A.22 Let (X, φ), (X̃, φ̃) be a principally polarized abelian k-varieties, let f : X̃ ⟶ X and f′ := φ^{−1}f̂φ the “Rosati involution” of f with respect to φ and φ̃, Y := im(f). Then the orthogonal complement of Y is the reduced connected component of the zero of ker(f′).

Proof Let f = ι_{Y} g, where g : X ⟶ Y is surjective. The orthogonal complement is given as the reduced connected component of the kernel of ι̂_{Y}φ, which by the last lemma is the same as the reduced connected component of the zero of the kernel of φ^{−1}ĝι̂_{Y}φ = φ^{−1}ι̂_{Y} gφ = f′. □

Lemma A.23 Let (X, φ) be a principally polarized abelian k-variety, f an endomorphism, f′ the Rosati involution with respect to φ. Assume that ker(f′) is reduced and irreducible. Let Y = im(f) and Z = ker(f′). Then Y ∩Z := Y ×_{k} Z = ker(ι̂_{Y}φι_{Y}).

Proof As above, let f = ι_{Y} g. Since by assumption ker(f′) = ker(φ^{−1}ĝι̂_{Y}φ) is reduced and irreducible, so is ker(ι̂_{Y}φ). Thus Z = ker(ι̂_{Y}φ) and Y ∩Z = ι_{Y}^{−1}(Z) = ι_{Y}^{−1}(ker(ι̂_{Y}φ) = ker(ι̂_{Y}φι_{Y}). □

A.2.5 The decomposition of the endomorphism ring of an abelian variety

Let A be an abelian variety over a perfect field k.

Let A^{(i)} ↪ A, i = 1, … be abelian subvarieties such that the induced morphism ∏_{i} A^{(i)} ⟶ A is an isogeny. Let e^{(i)}, i = 1, … be the elements of End_{k}(A) which correspond under the isogeny to the projections on the left hand side. Then 1 = ∑_{i} e^{(i)} and the e^{(i)} are idempotent. Now if a^{(i)} ∈ ℕ such that a_{i}e^{(i)} are morphisms, then A^{(i)} = a^{(i)}e^{(i)}(A) and A^{(i)} is the reduced connected component of the zero of the kernel of a^{(i)}(1 − e^{(i)}).

Conversely, if a decomposition of the unity 1 = ∑_{i} e^{(i)} where the e_{i} are idempotent is given, define A_{(i)} := a^{(i)}e^{(i)}(A) for suitable a^{(i)} ∈ ℕ. Then again ∏_{i} A^{(i)} ∼ A and the e^{(i)} correspond to the projections on the left hand side.

Now fix a polarization φ on A. With the help of the Complete Reducibility Theorem, A can be decomposed into a product of simple abelian varieties.

There exist simple abelian subvarieties ι_{i,j} : A_{i,j} ↪ A with A_{i,j} ∼ A_{i′,j′} iff i = i′ such that the ι_{i,j} induce an isogeny

∏_{i=1}^{s} ∏_{j=1}^{k_{i}} A_{i,j} ∼ A  (A.4)

and such that A′_{i,j} :=( abelian variety generated by A_{i′,j′} for (i, j) ≠ (i′, j′)) is orthogonal of A_{i,j} with respect to φ. Under this isogeny, φ becomes a product polarization on the left-hand side. In particular, the projections on the left-hand side are invariant under the Rosati involution. As above, let e_{i,j} be the idempotents in End_{K}(A_{K}) which correspond to these projections. Then also the e_{i,j} are invariant under the Rosati involution, e′_{i,j} = e_{i,j}, and thus by Lemma A.22, A′_{i,j} is the orthogonal complement of A_{i,j}.

Let A_{i} be the abelian subvariety generated by the A_{i,1}, …, A_{i,k_{i}}. Then the A_{i}s are independent of the particular decomposition chosen. We call them the isotypic components of the abelian variety A (over k).

A ∼ ∏_{i=1}^{s} A_{i}  (A.5)

Let A′_{i} := abelian subvariety in A generated by the A_{j}, j ≠ i.

Decomposition (A.4) induces an isomorphism

End_{k}^{0}(A) ≃ ∏_{i=1}^{s} End_{k}^{0}(A_{i}).  (A.6)

The End_{k}^{0}(A_{i}) are simple rings (simple meaning that they do not have a proper two sided ideal) with End^{0}(A_{i}) ≈ M_{k_{i}}(D_{i}), where D_{i} ≈ End_{k}^{0}(A_{A_{i,j}}) is a division ring.

It is a fact from the theory of semisimple rings that (A.6) is the unique way to decompose End_{K}^{0}(A_{K}) into a product of simple rings (i.e. the if a decomposition End_{K}^{0}(A_{K}) ≃ ∏_{i} R_{i} is given, the R_{i} are uniquely determined inside End_{k}^{0}(A) up to a permutation); see [FD, Theorem 1,13].

Now let e_{i} be the image of the unity of End_{k}^{0}(A_{i}) in End_{k}^{0}(A) under the above isomorphism. Then the e_{i} are central and idempotent and 1 = ∑_{1=1}^{s} e_{i}, and again e′_{i} = e_{i} and A_{i} is orthogonal to A′_{i}.

Now all polarizations of ∏_{i=1}^{s} A_{i} are multiples of product polarizations and, in particular, e_{i} = e′_{i} and the A_{i} are orthogonal with respect to any polarization.

Proof End_{k}^{0}(∏_{i=1}^{s} A_{i}) ≃ ∏_{i=1}^{s} End_{k}^{0}(A_{i}). This implies NS^{0}(∏_{i=1}^{s} A_{i}\overline{k})^{Gal(\overline{k}|k)} ≃ ∏_{i=1}^{s} NS_{k}^{0}(A_{i}\overline{k})^{Gal(\overline{k}|k)}. (Use the characterization [Mu, p.208, application III] with the product polarization φ on the left-hand side and the φ_{i} on the right-hand side; see also Proposition A.9.)

Now, classes of ample sheaves on the left hand side correspond to tuples of classes of ample sheaves on the right hand side. These classes on the left hand side define multiples of polarizations, and on the right hand side, they define multiples of product polarizations. □

A.2.6 Ample sheaves

Let K be a field and let A be an abelian K-variety of dimension n with an ample sheaf ℒ.

Recall the Vanishing Theorem:

Proposition A.24 [Mu, par. 16, p.150] Let ℳ be a non-degenerate invertible sheaf on A, i.e. K(ℳ) is finite.

Then there exists a unique integer i(ℳ), 0 ≤ i(ℳ) ≤ n, called the index of ℳ, such that H^{p}(X, ℳ) = 0 for p ≠ i(ℳ) and H^{i(ℳ)} (X, ℳ) ≠ 0.

The index can be calculated as follows:

Proposition A.25 [Mu, par. 16, p.155] With ℒ and ℳ as above, the function z ↦ χ(ℒ^{z} ⊗ ℳ) is a polynomial function of degree n whose roots are all real and non-zero. The index i(ℳ) is the number of positive roots.

This implies:

Lemma A.26 Let ℳ be a non-degenerate invertible sheaf on A. The following are equivalent:

1. ℳ is ample, i.e. a power of ℳ is very ample.

2. ℳ is defined by an effective divisor.

3. The index i(ℳ) is 0, i.e. H^{0}(X, ℳ) ≠ 0 and H^{p}(X, ℳ) = 0 for p ≠ 0.

4. The polynomial χ(ℒ^{z} ⊗ ℳ) has only negative roots.

Proof 2. ⟷ 3. ⟷ 4. follows from the Vanishing Theorem.

1. ⟶ 3.: By the Vanishing Theorem applied to the ample sheaf ℳ (!) and the non-degenerate sheaf ℳ, the index i(ℳ) is equal to the number of positive roots of the polynomial defined by z ↦ χ(ℳ^{z} ⊗ ℳ) = χ(ℳ^{z+1}) =^{Riemann-Roch} (z + 1)^{n}χ(ℳ). The roots of this polynomial are all at −1 < 0, so the index is zero.

2. ⟶ 1.: see [Mu, p. 60, application 1]. □

A.2.7 Principally polarized abelian surfaces

The following proposition is due to A.Weil. Because Weil uses in his proof his own language which is out of fashion today, we include a proof.

Proposition A.27 (A. Weil) [We-T, Satz 2] Let A be an abelian surface over an algebraically closed field k. Let ℒ be an ample sheaf on A which defines a principal polarization. Then ℒ is defined by an effective divisor D which is unique up to translation.

Either D is a non-singular geometrically irreducible proper curve of genus 2, and if ι : D ⟶ A is the inclusion, ι^{∗} : A ⟶ J(D) is an isomorphism.

Or A is isomorphic to the product E ×_{k} E′ of elliptic curves, and via this isomorphism, D has the form E ×_{k} a + a′ ×_{k} a′ where a, a′ are two points on E, E′ respectively.

Before we come to the proof of this proposition, we show how the arithmetic genus of a curve on an abelian surface A can be calculated from the Eulercharacteristic of the sheaf it defines on A.

Let D be a (not necessarily irreducible) curve on A. Then we have the exact sequence

0 ⟶ ℒ(−D) ⟶ ℒ(A) ⟶ 𝒪_{D} ⟶ 0.

Here, we make the usual identification of 𝒪_{D} with ι_{∗}(𝒪_{D}) where ι : D ⟶ A is the inclusion. [Ha, Remark 2.10.1] This identification is justified by the fact that H^{i}(D, 𝒪_{D}) = H^{i}(A, ι_{∗}𝒪_{D}). [Ha, III,Lemma 2.10]

By the additivity of the Euler-characteristic we get

χ(ℒ(−D)) + χ(𝒪_{D}) = χ(𝒪_{A}) = 0.

Because of the Riemann-Roch Theorem, χ(ℒ(−D)) = \frac{1}{2}(D, D) = χ(ℒ(D)) and thus

χ(𝒪_{D}) = −χ(ℒ(D)).

In particular, if D is connected, H^{1}(D, 𝒪_{D}) = χ(ℒ(D)) + 1.

proof of the proposition Let D be an effective divisor defining ℒ, unique up to translation on A. Let D = ∑_{i=1}^{l} n_{i}D_{i}, where n_{i} > 1 and D_{i}, i = 1, …, l are irreducible proper curves. Then by the Riemann-Roch Theorem

2 = (D, D) = ∑_{i,j} n_{i}n_{j}(D_{i}, D_{j}).

We claim that there are only two cases:

l = 1, n_{1} = 1, (D_{1}, D_{1}) = 2, and D_{1} is a non-singular geometrically irreducible proper curves of genus 2

l = 2, n_{1} = n_{2} = 1, (D_{1}, D_{1}) = 0, (D_{2}, D_{2}) = 0, (D_{1}, D_{2}) = 1, and D_{1}, D_{2} are elliptic curves

Without loss of generality, we can assume that (D_{1}, D_{1}) ≠ 0 or (D_{1}, D_{2}) ≠ 0. Assume that (D_{1}, D_{1}) ≠ 0. Since again by the Riemann-Roch Theorem, the

self-intersection of any divisor on an abelian surface is divisible by 2, (D_{1}, D_{1}) = 2, thus n_{1} = 1 and (D_{1}, D_{i}) = 0 for i > 1. Now D_{1} is an ample divisor, and by the criterion of Nakai-Moishezon [Ha, V,Theorem 1.10], k = 1. By the remarks before the proof of the proposition, the arithmetic genus of D is 2. The geometric genus of the normalization of D is also 2, and so D itself is non-singular. For assume that the genus of the normalization would be 0 or 1. It cannot be zero because there exist no rational curves on abelian varieties, and it cannot be 1 because then than the map from the normalization of D to A would be the inclusion of an elliptic curve combined with a translation in A. In particular, D would be an elliptic curve and its arithmetic genus would be 1, not 2.

Now assume that (D_{1}, D_{2}) ≠ 0. Then (D_{1}, D_{2}) = 1, n_{1} = n_{2} = 1 and D_{1} + D_{2} is ample. Now (D_{1} + D_{2}, D_{i}) = 0 for any i > 2 and by the criterion of Nakai-Moishezon, k = 2. By the remarks before the proof, the arithmetic genera of D_{1}, D_{2} are 1. The geometric genera can again not be 0, so D_{1} and D_{2} are elliptic curves.

In the case l = 2, D_{1} and D_{2} intersect in one point and A has the universal property of the sum of D_{1} and D_{2} in the category of abelian varieties.

We come back to the case k = 1. We want to proof that ι^{∗} : A ⟶ J(D) is an isomorphism. Let P ∈ D(\overline{k}), f^{P} : D ⟶ J(D) be the canonical immersion defined by P ↦ 0. By a translation of A, we can assume that ι(P) = 0 on A. By the universal property of the Jacobian, there exists a morphism α^{P} : J(D) ⟶ A with α^{P} ∘ f^{P} = ι.

We already know that α^{P} is an isogeny and claim that it is in fact an isomorphism. Then α̂ and also ι^{∗} are isomorphisms.

f^{P} induces a morphism ϕ : D ×_{k} D ⟶ J(D), given on .-valued points by (Q, R) ↦ P + Q. This factors through D ×_{k}^{S} D, the symmetric product. The induced morphism D ×_{k}^{S} D ⟶ J(D) is birational, thus the degree of ϕ is 2.

The composition α^{P} ∘ ϕ is given by (Q, R) ⟶ ι ∘ Q + ι ∘ R. We claim that the degree of α^{P} ∘ ϕ is 2, thus the degree of α^{P} is 1.

The divisor D is algebraically equivalent to (−id_{A})^{−1}(D) (see [Mu, par. 8, p.75, (iv)]), and this divisor is algebraically equivalent to (−id_{A})^{−1}(D) + T for all T ∈ A(\overline{k}).

Thus the equation (D, D) = 2 implies (D, (−id_{A})^{−1}(D) + T) = 2 for any T ∈ A(\overline{k}). There exists an open subset U ⊆ A such that for T ∈ U(\overline{k}), D and (−id_{A})^{−1}(D) + T intersect transversely. Thus for T ∈ U(\overline{k}), there exist exactly 2 points (P, Q) ∈ (D ×_{k} D)(\overline{k}) with ϕ ∘ (P, Q) = ι ∘ P + ι ∘ Q = T.

Since U is dense in A, the degree of the morphism ϕ : D ×_{k} D ⟶ A is 2. □

Remark Let the conditions be as in the proposition but let k be an arbitrary field. Then again ℒ is defined by an effective divisor D, unique up to translation.

Now, D is a geometrically reduced proper curve. There are two cases: Either D is geometrically irreducible, non-singular and has genus 2 or it is geometrically the pointed union of two elliptic curves. In the first case, A is again isomorphic to J(D) (over k).

A.3 Some results about schemes and varieties

In this section we present some results from various sources as well as some other rather technical results.

A.3.1 Regular function fields and geometrically irreducible varieties

Definition Let K|k be an algebraic extension, let L|k be any extension. Then K and L are linearly disjoint over k iff K ⊗_{k} L is a field.

Assume that this is the case and let K and L be included in some common overfield. Then the compositum KL of K and L in this overfield together with the inclusions K ⟶ KL and L ⟶ KL is (canonically isomorphic to) the tensor product of K and L over k, K ⊗_{k} L ≃ KL.

Again let K and L be included in some common overfield and assume that K|k is Galois. Then K and L are linearly disjoint iff K ∩ L = k; see [La, VII, par. 3,4]. ^{6}

An function field L|k is called regular over k, if L and \overline{k} are linearly disjoint over k. An extension L|k(x) is called regular iff L|k is regular or – what is the same – if L and \overline{k}(x) are linearly disjoint over k(x).

Let K|k be an algebraic field extension. A regular extension L′|K(x) is said to be defined over k, if there exists a subextension L|k(x) of L′|k(x) which is linearly disjoint from K(x)|k(x) with LK = L′. (This implies that L|k(x) is regular.)

A regular extension L′|K(x) is said to be defined over k with its Galois group, if there exists such a subextension L|k(x) which is Galois.

All the above statements can easily be translated into statements about varieties. For example, Let X′ be an irreducible k-variety. Then X is geometrically integral iff the function field k(X)|k is regular.

Lemma A.28 Let X be a connected k-scheme with a k-rational point. Then X is geometrically connected. If additionally X is smooth (and thus irreducible) it is geometrically irreducible.

Proof We have to show that X ⊗_{k} k^{sep} is irreducible.

Let K|k be some finite Galois extension with Galois group G. Then so is X ⊗_{k} K ⟶ X. (Galois is stable under base extension.) So (X ⊗_{k} K)/G ≃ X.

6Caution! The notation KL does not mean that K and L are necessarily linearly disjoint.

It can also just be the compositum in a common overfield. We write KL ≃ K ⊗_{k} L if K and L are linearly disjoint.

This means in particular that the underlying topological space of X is the quotient of the underlying topological space of X ⊗_{k} K by G. Thus G operates transitively on the components of X ⊗_{k} K.

Let P : Speck ⟶ X be a k-rational point. By base change, P defines a Krational point of X ⊗_{k} K which we also denote by P. Let X′_{0} be the component of the image of P in X ⊗_{k} K.

Now assume that X ⊗_{k} K has more than one component.

Let τ ∈ G^{opp} such that τ moves X_{0} to another component. Then the image of τP is not in X_{0}, and so is the image of τ ∘ P = τP τ^{−1}, a contradiction, since also P = τ(P).

Since K|k was arbitrary finite Galois, X ⊗_{k} k^{sep} is connected.

If X is smooth, so is X ⊗_{k} k^{sep}, and thus is is connected. □

A.3.2 Pull-back of effective divisors

Let k be a field and let X be a non-singular connected (irreducible) k-variety. Then the group of Weil-divisors and Cartier-divisors on X are isomorphic. [Ha, Proposition 6.11.] Under this isomorphism, effective Weil-divisors correspond to effective Cartier-divisors, and they correspond to closed subschemes of X of pure codimension 1.

We will now discuss the last isomorphism in greater detail.

Let D be a closed subscheme of pure codimension 1. Then there exists an open covering U_{i} of X such that on every U_{i}, D is defined by a single element f_{i} ∈ Γ(U_{i}, 𝒪_{U_{i}}^{∗}). Let 0 denote the k-rational point of 𝔸_{k}^{1} corresponding to k[x] ⟶ k, x ↦ 0. Then f_{i} defines a morphism U_{i} ⟶ 𝔸_{k}^{1} and D|_{U_{i}} = f_{i}^{−1}(0). ^{7} Now the covering (U_{i})_{i} and the (f_{i})_{i} define the corresponding Cartier-divisor which we denote by D^{C}.

Now let Y be another non-singular connected k-variety and let a : Y ⟶ X be a morphism. Then a^{−1}(D)|_{a^{−1}(U_{i})} = a^{−1}f_{i}^{−1}(0) = (f_{i}a)^{−1}(0). (The last equality is equivalent to a^{−1}(U_{i}) ×_{U_{i}} (U_{i} ×_{𝔸_{k}^{1}} 0) = a^{−1}(U_{i}) ×_{𝔸_{k}^{1}} 0.)

Assume that a(Y) ⊈ D as sets. (Since we assumed that Y is irreducible this is equivalent to that the inverse image of D in Y is not the whole space.) This condition is especially fulfilled if a is an immersion and the support of D (i.e. the corresponding reduced subscheme) does not contain Y or if a is surjective.

Then f_{i}a ≠ 0 and a^{−1}(D) is again a subscheme of pure codimension 1, and the corresponding Cartier-divisor is defined by the open covering a^{−1}(U_{i}) of Y and the set (f_{i}a)_{i}. This divisor is usually denoted by a^{∗}(D^{C}). Thus a^{−1}(D)^{C} = a^{∗}(D^{C}).

The groups of Weil-divisor classes, Cartier divisor classes and classes invertible sheaves are also naturally isomorphic.

7Recall that for a closed immersion of schemes ι : X ↪ Y, and some morphism a : Z ⟶ Y, by a^{−1}(X) we always mean the scheme-theoretic preimage, i.e. α^{−1}(X) := X ×_{Y} Z where the product is taken relative to ι and α.

Furthermore, again under the condition a(Y) ⊈ D, we have a^{∗}(ℒ(D^{C})) ≃ ℒ(a^{∗}(D^{C})). Thus

Lemma A.29 Let X, Y be nonsingular connected varieties, a : Y ⟶ X a morphism. Let D be a subscheme on X, purely of codimension 1, let D^{C} be the associated Cartier divisor. Assume that the support of D does not contain the set a(Y).

Then a^{−1}(D)^{C} = a^{∗}(D^{C}) and a^{∗}(ℒ(D^{C})) ≃ ℒ(a^{−1}(D)^{C}).

Remark If X is an abelian variety and Y ⟶ X is a closed immersion, then the condition of the proposition can always be fulfilled by translating D.

A.3.3 Galois-operation and descent

Let X and Y be schemes and let π : X ⟶ Y be a Galois covering with Galois group G. For any quasi-coherent 𝒪_{X}-sheaf ℒ and σ ∈ G, choose a pull-back via σ : Y ⟶ X. As usual, denote this sheaf by σ^{∗}(ℒ).

Now let ℒ be a quasi-coherent 𝒪_{X}-module on X.

For any σ, τ ∈ G and any morphism a : ℒ ⟶ τ^{−1}^{∗}(ℒ), denote by τ(a) the composition σ^{−1}^{∗}(ℒ) ⟶ σ^{−1}^{∗}(τ^{−1}^{∗}(ℒ)) ≃ (στ)^{−1}^{∗}(ℒ), where the first morphism is defined by base-change.

Then a 1-cocycle datum of ℒ is a map G ∈ τ ↦ a_{τ}, where a_{τ} is an 𝒪_{X}- morphism ℒ ⟶ (σ^{−1})^{∗}(ℒ) such that for all σ, τ ∈ G, a_{στ} = σ(a_{τ}) ∘ a_{σ} : ℒ ⟶ (στ)^{−1}^{∗}(ℒ).

A quasi-coherent 𝒪_{X}-module ℒ on X with a 1-cocycle datum is called a quasicoherent G-sheaf.

Proposition A.30 The functor ℱ ↦ π^{∗}(ℱ) is an equivalence of categories of quasi-coherent 𝒪_{Y} -modules and that of quasi-coherent G-sheaves on X. Coherent sheaves correspond to coherent sheaves and locally free sheaves correspond to locally free sheaves of the same rank.

Proof This is a special case of the “faithfully flat descent” of 𝒪_{X}-modules; see [BLR, par. 6.1]. □

Caution! The proposition would be wrong if one would call an 𝒪_{𝒳} -module a G-sheaf if its class is invariant under pull-back by elements of G. Note however that the following proposition is a special case of formula (1.16):

Proposition A.31 Let K|k be a Galois field extension. Let Y be a projective kvariety with a k-rational point. Let ℒ be an invertible free sheaf on Y ⊗_{k} K, such that for every σ ∈ Gal(K|k), σ^{∗}(ℒ) ≈ ℒ. Then ℒ is isomorphic to the inverse image of a sheaf on Y.

Remark A 1-cocycle-datum on a 𝒪_{X}-sheaf can be interpreted as follows:

By definition, (σ^{−1})^{∗}(ℒ) = (σ^{−1})^{−1}(ℒ)⊗_{(σ^{−1})^{−1}(𝒪_{X})} 𝒪_{X}. Now, (σ^{−1})^{−1}(𝒪_{X}) is canonically isomorphic to σ_{∗}(𝒪_{X}), and the same is true for ℒ. Thus (σ^{−1})^{∗}(ℒ) ≃ σ_{∗}(ℒ) ⊗_{σ_{∗}(𝒪_{X})} 𝒪_{X}, where σ_{∗}(𝒪_{X}) ⟶ 𝒪_{X} is given by σ^{#}^{−1}. This means that ℒ is canonically isomorphic to σ_{∗}(ℒ) regarded as 𝒪_{X} module via σ^{#} : 𝒪_{X} ⟶ σ_{∗}(𝒪_{X}). Under this identification, the 𝒪_{X}-morphism a_{σ} : ℒ ⟶ σ^{−1}^{∗}(ℒ) corresponds to a morphism a_{σ} : ℒ ⟶ σ_{∗}(ℒ) with a_{σ}(λx) = σ^{#}(λ)a_{σ}(x) for λ ∈ 𝒪_{X}(U), x ∈ ℒ(U), U open in X.

Now, π_{∗}(ℒ) = π_{∗}σ_{∗}(ℒ) and a_{σ} becomes an automorphism of π_{∗}(ℒ), which we denote by σ^{#}. This morphism satisfies σ^{#}(λx) = σ^{#}(λ)σ^{#}(x), where λ ∈ π_{∗}(𝒪_{Y})(U), x ∈ π_{∗}(ℒ)(U), U open in Y. We thus have a G-operation on π_{∗}(ℒ) which “covers” the G-operation on π_{∗}(𝒪_{X}). Taking invariants, we get a presheaf π_{∗}(ℒ)^{G} which is in fact a sheaf because σ^{#}(x) = x is a local property.

If ℳ is a 𝒪_{X}-sheaf on X, (π_{∗}(π^{∗}(ℳ)))^{G} ≃ ℳ. If ℒ is a 𝒪_{Y} -sheaf on Y with a 1-cocycle datum, and ℳ is a 𝒪_{X}-sheaf on X such that π^{∗}(ℳ) ≈ ℒ such that under the isomorphic the cocycle-data of the two sheaves agree, then ℳ ≃ (π_{∗}(π^{∗}(ℳ)))^{G} ≈ π_{∗}(ℒ)^{G}. Thus ℒ = π^{∗}(ℳ) ≈ π^{∗}(π_{∗}(ℒ)^{G}).

A.3.4 Schemes over finite fields

Definitions Let q be the power of a prime number p, k the finite field with q elements, K|k an algebraic extension of fields. We identify the Galois group Gal(K|k) with its dual and denote its elements with usual letters. The Frobenius automorphism of K|k is denoted by σ_{k}^{K}.

There exist two (or even three) different concepts of Frobenius morphisms for K-schemes. We want to distinguish between them carefully.

Let X′ be a K-scheme.

The k-automorphism σ_{k}^{K} of K induces an automorphism of Spec(K) which we again denote by σ_{k}^{K}. We call the automorphism σ_{k}^{K} : σ_{k}^{K}^{−1}(X′) ⟶ X′ the arithmetic Frobenius isomorphism.

Let F_{k}^{K} be the automorphism of X′ which is defined as follows: F_{k}^{K} is the identity on the underlying topological space and it is given by f ↦ f^{q} on 𝒪_{X′}.

By definition, we have a commutative diagram

\xymatrix{X′ \ar[r]^{F_{k}^{K}} \ar[d] & X′ \ar[d] \\ Spec(K) \ar[r]^{σ_{k}^{K}} & Spec(K).}

In particular, if the extension K|k is non-trivial, F_{k}^{K} is not a Spec(K)-morphism.

Now define the geometric Frobenius morphism by π_{k} := σ_{k}^{K}^{−1} ∘ F_{k}^{K} : X′ ⟶ σ_{k}^{K}^{−1}(X′) – this is a K-morphism.

Let X′ be affine and of finite type, K[x_{1}, …, x_{m}]/(f_{1}, …, f_{l}) a presentation of the coordinate ring of X′. Then the coordinate ring of σ^{−1}(X′) is given by K[x_{1}, …, x_{m}]/(σ_{k}^{K}^{#}(f_{1}), …, σ_{k}^{K}^{#}(f_{l})), and π_{k} is given by the identity on K and x_{i} ↦ x_{i}^{q}. For a general K-scheme X′ of finite type, π_{k} is defined like this locally.

The definition of π_{k} behaves well with respect to base-change: If L|K is some algebraic field extension, then (σ_{k}^{K}^{−1} ∘ F_{k}^{K}) ⊗_{K} id_{L} = σ_{k}^{L}^{−1} ∘ F_{k}^{L} : X′ ⟶ σ_{k}^{K}^{−1}(X′) ⊗_{K} L ≃ σ_{k}^{L}^{−1}(X′ ⊗_{K} L).

Note In [Ha], the morphism F_{k}^{K} is called “Frobenius morphism” and the geometric Frobenius morphism π_{k} is called “K-linear Frobenius morphism”; see [Ha, IV, 2, p. 301].

In [Mi-A], the “Frobenius morphism” is only defined for the case that k = K, and under this assumption, σ_{k}^{K} is trivial and F_{k}^{K} and π_{k} agree; see [Mi-A, par. 20].

In [Mu], the “Frobenius morphism” is first defined for k = K and then generalized to \overline{k}-schemes which are defined over k. Again it equals the geometric Frobenius morphism π_{k}.

From now on, we restrict ourselves to the case K = \overline{k}. We write σ_{k} for the arithmetic Frobenius automorphism σ\overline{k} ; k and denote F \overline{k} ; k by F_{k}.

Let P be a \overline{k}-valued point of X′. Then F_{k} ∘ P ∘ σ_{k}^{−1} = P. In fact, the left-hand side is also a \overline{k}-valued point of X′ and its image coincides with the one of P.

The equation F_{k} ∘ P = P ∘ σ_{k} implies π_{k} ∘ P = σ_{k}^{−1} ∘ F_{k} ∘ P = σ_{k}^{−1} ∘ P ∘ σ_{k} = σ_{k}^{−1}(P) = P^{σ_{k}}.

Lemma A.32 Let X′ be a \overline{k}-scheme. Then for all \overline{k}-valued points P of X′,

π_{k} ∘ P = σ_{k}^{−1}(P) = P^{σ_{k}} ∈ σ_{k}^{−1}(X′).

If X′ is an irreducible variety, the field extension \overline{k}(σ_{k}(X′))|\overline{k}(X′) is purely inseparable. If X′ is an abelian variety, then π_{k} is an isogeny of p-power degree whose kernel is connected (local in the language of [Mu]).

□

Lemma A.33 Let V′ and W′ be \overline{k}-varieties, λ : V′ ⟶ W′ a \overline{k}-morphism. Then λ^{σ_{k}} π_{k} = π_{k} λ : V′ ⟶ σ_{k}^{−1}(W′).

Proof We only have to show this for \overline{k}-rational points. Let P ∈ V′(\overline{k}). Then

λ^{σ_{k}} ∘ π ∘ P = λ^{σ_{k}} ∘ P^{σ_{k}} = (λ ∘ P)^{σ_{k}} = π_{k} ∘ λ ∘ P.

□ This implies:

Lemma A.34 Let V, W be k-varieties, λ : V\overline{k} ⟶ W\overline{k} a morphism. Then λ is defined over k iff π_{k} λ = λ π_{k}.

□ Using Lemma A.8, we also get

Lemma A.35 Let A′ be an abelian \overline{k}-variety, λ ∈ End0 ; \overline{k}(A′). Then λ^{σ_{k}} =

π λ π^{−1} ∈ End0 ; \overline{k}(σ_{k}^{−1}(A′)).

□

Remark A consequence of Lemma A.32 is that for an abelian k-variety A, the operation of the two Frobenius morphisms π_{k} and σ_{k} on the Tate-module (for some prime l) are equal (where σ_{k} operates by (…)^{σ_{k}}). Because of this, we speak of the operation of the Frobenius on the Tate-module and the characteristic polynomial of this operation.

Bibliography

[BLR] Bosch, S. Lütkebohmert W., Raynaud, M.: Néron Models, Springer-Verlag, Berlin (1980)

[CR] Curtis, W., Reiner, I.: Methods of Representation Theory, Wiley, New York (1988)

[EGA II] Grothendieck, A. mit Dieudonné, J.: Elementes de Geometrie Algebrique II, Publications Mathematiqués 8, IHES (1961)

[Ei] Eisenbud, D.: Commutative Algebra, Springer-Verlag, New York (1996)

[En] Enge, A.: Computing discrete logarithms in high-genus hyperelliptic Jacobians in provably subexponential time, Combinatorics and Optimization Research Report CORR 99-04, University of Waterloo (1999), to be published in Mathematics of Computation

[EG] Enge, A, Gaudry, P.: A general framework for subexponential discrete logarithm algorithms, Laboratoire d’Informatique, Ecole Polytechnique (2000)

[FD] Farb, B., Dennis, K.: Noncommutative Algebra, Springer-Verlag, New York (1993)

[Fr] Frey, G., How to disguise an elliptic curve (Weil descent), Talk at the 2nd Elliptic Curve Cryptography Workshop (ECC ’98) in Waterloo, www.cacr.math.uwaterloo.ca/conferences/1998/ecc98/slides.html

[Gal] Galbraith, S.: Weil Descent of Jacobians, preprint (2000)

[Gau] Gaudry, P.: An algorithm for solving the discrete log problem on hyperelliptic curves, Advances in Cryptology, Eurocrypt’2000, Springer-Verlag, LNCS 1807, 19-34 (2000)

[GHS] Gaudry, P., Hess, F., Smart, N.P.: Constructive and destructive facets of Weil descent on elliptic curves, preprint (2000)

[GS] Garcia, A., Stichtenoth, H.: Elemetary Abelian p-Extensions of Algebraic Function Fields, Manuscripta math. 72, 67-79, Springer-Verlag (1991)

118 Appendix A. Some Auxiliary Results [Ha] Hartshorne, R.: Algebraic Geometry, Springer-Verlag, New York (1977)

[Ho] Honda, T.: Isogeny classes of abelian varieties over finite fields, J. Math. Soc. Japan 20 (1968)

[Kan] Kani, E.: Relations Between the Genera and between the Hasse-Witt Invariants of Galois Coverings of Curves, Canad.Math.Bull. 28, 321-327 (1985)

[Kar] Karpilovsky, G.: Group Representations, North-Holland, Amsterdam (1992)

[La] Lang S.: Algebra, 3. Edition, Addison-Wesley, Reading (1993)

[Lo] Lorenz, F.: Algebra I, Spektrum Akademischer Verlag Berlin (1996) [Mi-AA] Milne, J.S.: On the Arithmetic of Abelian Varieties, Inventiones math.

17, 177-190 (1972)

[Mi-A] Milne, J.S.: Abelian Varieties, Cornell, G., Silverman, J. (ed.) et al.:

Arithmetic Geometry, Springer-Verlag, New York (1986)

[Mi-É] Milne, J.S.: Étale Cohomology, Princeton University Press, Princeton

(1980)

[Mi-J] Milne, J.S.: Jacobian Varieties, Cornell, G., Silverman, J. (ed.) et al.:

Arithmetic Geometry, Springer-Verlag, New York (1986)

[Mu] Mumford, D.: Abelian Varieties, Tata Institute for Fundamental Research, Bombay (1970)

[MQ] Menezes, A., Qu, M.: Analysis of the Weil Descent Attack of Gaudry, Hess and Smart, preprint (2000)

[Na] Naumann, N.: Weil-Restriktion, “Diplomarbeit” at the Universität-GHS Essen, Essen (1999)

[Ne] Neukirch, J.: Algebraische Zahlentheorie, Springer-Verlag, Berlin (1991)

[Po] Popp, H.: Fundamentalgruppen algebraischer Mannigfaltigkeiten, Springer-Verlag, Berlin (1970)

[Se] Serre, J.-P.: Local Fields, Springer-Verlag, New York (1976) [SGA I] Grothendieck, A.: Séminaire de Geometrie Algebrique 1960-61:

Revêtements Etales et Groupe Fondamentale (SGA I), Institut des Hautes Etudes Scientifiques, Paris (1961)

[Si] Silverman, J.: The Arithmetic of Elliptic Curves, Springer-Verlag, New-York (1986)

[We-F] Weil, A.: The field of definition of a variety, Amer. J. of Maths. 78, 509-524 (1958)

[We-T] Weil, A.: Zum Beweis des Torellischen Satzes, Gött. Nachr. 2, 33-53