Constructing all genus 2 curves with supersingular Jacobian

Abstract

L. Moret-Bailly constructed families ${\mathfrak {C}}\rightarrow {\mathbb {P}}^1$ of genus 2 curves with supersingular Jacobian. In this paper we first classify the reducible fibers of a Moret-Bailly family using linear algebra over a quaternion algebra. The main result is an algorithm that exploits properties of two reducible fibers to compute a hyperelliptic model for any irreducible fiber of a Moret-Bailly family.

1 Introduction

Let k be an algebraically closed field of characteristic $p>0$. Recall that an Abelian variety A/k is called supersingular if it is isogenous to a product of supersingular elliptic curves. The supersingular locus in the moduli space of g-dimensional principally polarized Abelian varieties has been intensively studied. Li and Oort [7] prove that the supersingular locus is birational to a variety explicitly described in terms of semi-linear algebra (Dieudonné theory). This allows one to determine the number of irreducible components of the supersingular locus and shows that it is equidimensional of dimension $\lfloor \frac{g^2}{4} \rfloor$.

If $g=2$ this result says more precisely that the supersingular locus is the union of rational curves, as was proven earlier by Katsura and Oort in [3]. They prove that every supersingular principally polarized Abelian variety is a fiber of one of the families ${\mathcal {A}}\rightarrow {\mathbb {P}}^1$ constructed by Moret-Bailly in [9]. Therefore the supersingular locus is the union of the images of the ${\mathbb {P}}^1$s from Moret-Bailly’s construction.

This construction works as follows for $p>2$ (the case $p=2$ is similar but slightly different): Indeed fix a supersingular elliptic curve E/k. Then the kernel of geometric Frobenius is $E[F]\cong \alpha _p$. Since ${{\,\mathrm{Hom}\,}}(\alpha _p, \alpha _p^2)=k^2$, the subgroup schemes isomorphic to $\alpha _p$ in $E^2$ are parametrized by ${\mathbb {P}}^1$. Moret-Bailly studies the Abelian scheme ${\mathcal {A}} \rightarrow {\mathbb {P}}^1$ obtained as a quotient of $E^2_{{\mathbb {P}}^1}$ by a certain finite flat group scheme. (Here and in the following for two k-schemes S and T the notation $S_T$ is an abbreviation for $S\times _k T$). This puts all the possible ways of taking a quotient of $E^2$ by $\alpha _p$ into a family of Abelian surfaces over ${\mathbb {P}}^1$.

Furthermore Moret-Bailly explains how to equip ${\mathcal {A}}$ with a principal polarization. For that purpose we need a polarization $\eta$ on $E^2$ with $\ker (\eta )=E^2[F]$. Then Moret-Bailly proves that $\eta _{{\mathbb {P}}^1}$ descends to a principal polarization $\lambda$ on ${\mathcal {A}}$. He shows that there exists a relative divisor ${\mathfrak {C}}\subset {\mathcal {A}}$ inducing $\lambda$, a “theta divisor”. The fibers of ${\mathfrak {C}} \rightarrow {\mathbb {P}}^1$ are either smooth curves of genus 2 or two elliptic curves intersecting transversely. In this way we get finitely many families of curves of genus 2 corresponding to the equivalence classes of $\eta$. (Here the equivalence relation is conjugation by $\text {Aut}(E^2)$. See [3, Theorem 5.7] for a discussion of the cardinality of the equivalence classes.) The Jacobians of those curves are supersingular as they are isogenous to $E^2$.

The goal of the present paper is to make this theory effective by giving an algorithm that computes all the non-singular fibers of a Moret-Bailly family ${\mathfrak {C}}\rightarrow {\mathbb {P}}^1$. For that purpose we need to be able to compute quotients by $\alpha _p$. In the paper [8] D. Lubicz and D. Robert spread the idea that separable isogenies between higher dimensional Abelian varieties should be computed using Mumford’s theory of theta groups. This point of view can be extended to inseparable isogenies.

Mumford defines for an ample line bundle ${\mathcal {L}}$ on an Abelian variety A, a group scheme ${\mathcal {G}}({\mathcal {L}})$ with center ${\mathbb {G}}_m$ (the so-called theta group). Furthermore ${\mathcal {G}}({\mathcal {L}})$ acts irreducibly on ${{\,\mathrm{H}\,}}^0(A, {\mathcal {L}})$ such that the center acts by multiplication. But he also shows that there exists only one representation of ${\mathcal {G}}({\mathcal {L}})$ with this property.

In the separable case, that is $\text {char}(k)\not \mid \deg {\mathcal {L}}$, Mumford proves that ${\mathcal {G}}({\mathcal {L}})$ is isomorphic to an explicit group ${\mathcal {G}}(\delta )$, a so-called Heisenberg group. He also writes down an explicit irreducible representation $V(\delta )$ of ${\mathcal {G}}(\delta )$ such that the center acts by multiplication. From the uniqueness of the representation one gets an isomorphism ${{\,\mathrm{H}\,}}^0(A,{\mathcal {L}})\cong V(\delta )$. That is a very important result and can be used to prove theorems in a purely algebraic fashion that were classically proven over ${\mathbb {C}}$ via the analytic theory of theta functions.

Unfortunately the structure theorem for theta groups fails in the inseparable case. However in our case we are lucky as the theta group we are using is nevertheless a Heisenberg group ${\mathbb {G}}_m \times \alpha _p \times \alpha _p$ with group law as explained in Definition 3.12.

To construct such an isomorphism with a Heisenberg group it turns out that we need two fibers of ${\mathfrak {C}}\rightarrow {\mathbb {P}}^1$, one for each copy of $\alpha _p$. Then we exploit that there are plenty ($5p-5>2$) of fibers that are as simple as possible, namely the reducible fibers. For that purpose we develop a classification of the reducible fibers in terms of linear algebra over the quaternion algebra $B={{\,\mathrm{End}\,}}(E)\otimes {\mathbb {Q}}$.

Using two reducible fibers also has the advantage that we can construct a rational function g on $E^2$ from them. This rational function will be interpreted as a section of a line bundle on $E^2$, via the correspondence between divisors and line bundles. Then we can construct further rational functions on $E^2$ by translating g using the group structure on $E^2$. In the end the desired curve can be obtained from the zero divisor of such a translate of g. We refer to the main body of the text for the details.

The outline of the paper is as follows: In chapter 1 we prove some results about Hermitian lattices over maximal orders in quaternion algebras. These are analogous to similar statements for Hermitian lattices over the ring of integers of a number field and the proofs work the same way. In chapter 2 we recall some facts about group schemes related to $\alpha _p$. In chapter 3 we introduce theta groups, which are the cornerstone of our method. The theory is usually formulated in terms of line bundles. Unfortunately we need to prove some technical compatibilities when we translate from line bundles to divisors.

Chapter 4 discusses the main theorems. First we classify the reducible fibers of a Moret-Bailly family and give an algorithm that computes them. Then we bootstrap ourselves and use two reducible fibers to compute all the irreducible fibers.

2 Hermitian Forms over Quaternion Algebras

In this section let R be a Dedekind ring with field of fractions K and B a quaternion algebra over K, i.e., a central simple K-algebra with $[B:K]=4$. Denote by $\overline{(\cdot )}$ the standard involution on B. Let further ${\mathsf {O}}$ be a maximal R-order of B. Later we will only consider the case, where $R={\mathbb {Z}}$ or a localization ${\mathbb {Z}}_{(l)}$ and B is the unique quaternion algebra over ${\mathbb {Q}}$ ramified only at $(p,\infty )$. However as it does not lead to additional difficulties we will present all the statements in most general form. The goal of this section is to prove the Lemma 1.5 about Hermitian forms over ${\mathsf {O}}$. It says that for a perfect hermitian pairing $(\cdot , \cdot )$ on an ${\mathsf {O}}$-module M and a primitive vector $v\in M$ there exists a $w\in M$ with $(v,w)=1$. This lemma is analogous to the similar statement over the ring of integers of a number field and the proof works the same way.

We first need some definitions concerning ${\mathsf {O}}$-modules. We will freely use the notions of projective modules (see [6, Chapter 1.2]) and invertible fractional ideals (see [2, p. 220]).

Definition 1.1

Let M be a finitely generated projective right ${\mathsf {O}}$-module. An element $v\in M$ is called a primitive vector if the following two conditions are satisfied:

• ${{\,\mathrm{Ann}\,}}_{\mathsf {O}}(v)=0$

• If $v=v' a$ for some $v'\in M, a\in {\mathsf {O}}$, then $a\in {\mathsf {O}}^\times$.

Notice that the first condition follows from the second if B is a division algebra. We are now ready to discuss Hermitian forms.

Definition 1.2

A Hermitian ${\mathsf {O}}$-lattice is a finitely generated projective right ${\mathsf {O}}$-module M together with a pairing $(\cdot ,\cdot ): M\times M\longrightarrow {\mathsf {O}}$ such that for all $v,v_1,v_2\in M, \lambda _1, \lambda _2\in {\mathsf {O}}$

• (i) $(\cdot ,\cdot )$ is linear in the second component:

  $$\begin{aligned} (v,v_1 \lambda _1+v_2 \lambda _2)=(v,v_1) \lambda _1+(v,v_2)\lambda _2\, . \end{aligned}$$

• (ii) $(\cdot ,\cdot )$ is semilinear in the first component:

  $$\begin{aligned} (v_1 \lambda _1+v_2 \lambda _2,v)=\overline{\lambda _1} (v_1,v) +\overline{\lambda _2}(v_2,v). \end{aligned}$$

• (iii) $(\cdot ,\cdot )$ is hermitian symmetric: $(v_1,v_2)=\overline{(v_2,v_1)}.$

A pairing satisfying (i) and (ii) is called a sesquilinear pairing.

Lemma 1.3

Let M be a projective right ${\mathsf {O}}$-module. Then

$$\begin{aligned} M^{\dagger }=\left\{ \phi :M\longrightarrow {\mathsf {O}}|\, \phi (v_1 \lambda _1+v_2 \lambda _2)=\overline{\lambda _1} \phi (v_1)+\overline{\lambda _2} \phi (v_2) \right\} \end{aligned}$$

is naturally a projective right ${\mathsf {O}}$-module. To give a sesquilinear pairing on M is equivalent to giving a linear map $M\longrightarrow M^{\dagger }$.

Proof

Clear. $\square$

Definition 1.4

We say that a sesquilinear pairing on M is non-degenerate (resp. perfect) if the induced map $M\longrightarrow M^{\dagger }$ is injective (resp. bijective).

Lemma 1.5

Assume now that every invertible fractional left ${\mathsf {O}}$-ideal is free. Let M be a projective right ${\mathsf {O}}$-module such that $M\otimes _R K$ is a free B-module. Let further $(\cdot ,\cdot )$ be a perfect sesquilinear pairing on M. Let $v\in M$ be a primitive vector. Then there exists a $w\in M$ such that $(w,v)=1$.

Proof

Let $\phi$ be the image of v under the map $M\longrightarrow M^{\dagger }$ induced by the pairing $(\cdot ,\cdot )$. Denote by $I\subseteq {\mathsf {O}}$ the image of $\phi$. Then I is naturally a left ideal of ${\mathsf {O}}$ (notice that the anti-linearity of $\phi$ interchanges left and right.). We claim that $KI=B$. Indeed KI is a left ideal of B. By Wedderburn’s theorem B is either a division algebra or a $2\times 2$-matrix algebra over K. If B is a division algebra there is nothing to show. Assume now that $B=M_{2,2}(K)$ is a matrix algebra over K. Suppose by way of contradiction that $KI\ne B$. It is well known and can be shown using elementary linear algebra that every proper left ideal of a matrix algebra $M_{n,n}(K)$ over a field is of the form $M_{n,n}(K) A$ where ${{\,\mathrm{rk}\,}}A < n$. Therefore there is a matrix $A\in M_{2,2}(K)$ with ${{\,\mathrm{rk}\,}}A<2$ such that $KI=B A$. Choose a basis $e_1,\ldots , e_d$ of the free B-module $M\otimes _R K$. Consider the B-antilinear map $\phi _K: M\otimes K \longrightarrow B$ obtained by extension of scalars. Since ${{\,\mathrm{im}\,}}(\phi _K)=KI$, there exist $r_1,\ldots , r_d\in B$ such that $\phi _K(e_i)=r_i A$. This implies that $\phi _K$ is the map $M\otimes K \longrightarrow B,\, \sum _{i=1}^d e_i \lambda _i\mapsto \overline{\lambda _i} r_i A$. Hence there is a $\phi '\in M^{\dagger }\otimes K=(M\otimes K)^{\dagger }$ such that $\phi =\phi ' A$. On the other hand clearly $M\otimes K \longrightarrow M^{\dagger }\otimes K$ is an isomorphism. Therefore there is an $v'\in M\otimes K$ such that $v=v' A$. But since A is not of full rank there exists an $r\in B\setminus \{0 \}$ such that $A r=0$. By multiplying with an element in R we can assume that $r\in {\mathsf {O}}$. Then one has $vr=0$ contradicting the primitivity of v. We thus conclude that $KI=B$.

By [2, Theorem 7] this implies that I is an invertible left ideal. Since we assumed that all invertible left ideals are principal, there exists an $a\in {\mathsf {O}}$ such that $I={\mathsf {O}} a$. As $KI=B$ the element a cannot be a zero-divisor. Therefore $N(a)=a {\overline{a}} \ne 0$. Now the map $\phi ':M\longrightarrow {\mathsf {O}},\, w\mapsto \phi (w) \frac{{\overline{a}}}{N(a)}$ is well-defined and gives an element in $M^{\dagger }$ satisfying $\phi =\phi ' a$. Because the pairing $(\cdot , \cdot )$ is perfect, the map $M\longrightarrow M^{\dagger }$ is an isomorphism. Denote by $v'$ the pre-image of $\phi '$. Then $v=v' a$ and by the primitivity of v we conclude that $a\in {\mathsf {O}}^\times$. Therefore $I={\mathsf {O}}$ and hence by the definition of I there exists an element $w\in M$ with $(w,v)=1$. $\square$

3 Affine Group Schemes

In this chapter we recall some well-known facts about the group scheme $\alpha _p$ and related group schemes we will use. Throughout this chapter k will be a field of characteristic $p>0$ and S a scheme over k.

Definition 2.1

An $\alpha$-group scheme of rank r over S is a finite flat group scheme G over S, such that there exists an fppf-covering $T\rightarrow S$ such that $G\times _S T\cong \alpha _{p, T}^r$ as T-group schemes.

Theorem 2.2

The functor

that sends G to ${\text {Lie}}(G)^{\vee }$ is a rank preserving anti-equivalence of categories.

Proof

Indeed we claim that the inverse functor

is defined as follows: For a locally free sheaf of finite rank ${\mathcal {F}}$ on S we define the following coherent sheaf of ${\mathcal {O}}_S$-Hopf algebras ${\mathcal {A}}=\oplus _{i=0}^{p-1} \text {Sym}^i({\mathcal {F}})$. The multiplication on ${\mathcal {A}}$ is given by $\text {Sym}^i({\mathcal {F}})\otimes \text {Sym}^j({\mathcal {F}}) \rightarrow \text {Sym}^{i+j}({\mathcal {F}})$ if $i+j<p$ and $\text {Sym}^i({\mathcal {F}})\otimes \text {Sym}^j({\mathcal {F}}) \rightarrow 0$ if $i+j \geqslant p$. The comultiplication is defined as follows: One can easily show that there is a unique algebra map $c:{\mathcal {A}}\rightarrow {\mathcal {A}}\otimes _{{\mathcal {O}}_S} {\mathcal {A}}$ such that $c_{|{\mathcal {F}}}$ equals $({{\,\mathrm{id}\,}},{{\,\mathrm{id}\,}}):{\mathcal {F}}\rightarrow ({\mathcal {F}}\otimes {\mathcal {O}}_S)\oplus ( {\mathcal {O}}_S\otimes {\mathcal {F}}) \subset {\mathcal {A}}\otimes {\mathcal {A}}$. The counit is the map ${\mathcal {A}}\rightarrow {\mathcal {O}}_S$ that projects onto the first summand. Then we define $\alpha ({\mathcal {F}})=\underline{\text {Spec}}_S({\mathcal {A}})$. This defines an $\alpha$-group scheme of rank $\text {rk}({\mathcal {F}})$.

It is clear that both maps are contravariant functors. [1, exposé VII_A, Theorem 7.4] implies that $\alpha (\cdot )$ is an anti-equivalence with inverse $\text {Lie}(\cdot )^\vee$. $\square$

Notice that the previous theorem implies that $\alpha$-group schemes are isomorphic to $\alpha _p^r$ locally for the Zariski topology (instead of fppf).

Definition 2.3

For a locally free sheaf ${\mathcal {F}}$ we define the corresponding $\alpha$-group scheme $\alpha ({\mathcal {F}})$ as in the previous proof.

The previous theorem can be used to compute an isomorphism $G\cong \alpha _p$ for a group scheme which is abstractly isomorphic to $\alpha _p$ but no isomorphism is given a priori.

Lemma 2.4

Let G be a finite group scheme over a field k which is isomorphic to $\alpha _p$. Suppose the Hopf-Algebra of G is given as $A_G=k[t]/(t^p)$ (but the comultiplication does not have to be $t\mapsto t\otimes 1 +1 \otimes t$).

Let $\omega =\sum _{i=0}^{p-1} a_i t^i dt$ be a non-zero invariant differential form. Then there is a unique isomorphism

$$\begin{aligned} \iota :G\longrightarrow \alpha _p={{\,\mathrm{Spec}\,}}k[x]/(x^p) \end{aligned}$$

with $\iota ^*(dx)=\omega$. It is given by

$$\begin{aligned} x\mapsto \sum _{i=0}^{p-2} \frac{a_i t^{i+1}}{i+1}\, , \end{aligned}$$

i.e. the logarithm of G which is defined as the integral of $\omega$.

Furthermore $a_{p-1}=0$.

Proof

The existence and uniqueness of $\iota$ follows from Theorem 2.2. The explicit formula is an elementary computation. $\square$

We will also need a fact about extensions of group schemes.

Theorem 2.5

Let G be a finite commutative group scheme over k and

$$\begin{aligned} 0\longrightarrow {\mathbb {G}}_m \longrightarrow E \longrightarrow G \longrightarrow 0 \end{aligned}$$

an extension in the category of commutative group schemes. Suppose k is perfect and G is unipotent. Then the extension is uniquely split.

Proof

See [1, exposé XVII, Théorème 6.1.1(C)]. $\square$

Remark 2.6

Notice that over a non-perfect field there is a non-split extension of $\alpha _p$ by ${\mathbb {G}}_m$.

4 Theta Groups

In this section we are going to recall the facts about theta groups needed for chapter 4. Let A/k be an Abelian variety and ${\mathcal {L}}$ a line bundle on A. The theta group of ${\mathcal {L}}$ is a group that naturally encodes the geometric interplay of ${\mathcal {L}}$ with the group structure of A. The theta group satisfies nice properties under pullback. Therefore it is a useful theoretical as well as practical tool for studying a situation where a polarization is descended along an isogeny as in Moret-Bailly’s construction. For this reason Moret-Bailly also uses theta groups in [9].

The theory of theta groups is due to Mumford and was developed in the case where $\text {char}(k) \not \mid \deg ({\mathcal {L}})$ in [10]. The general case is explained in a letter from Mumford to Sekiguchi published in [12]. Our exposition follows [14]. Notice that Sekiguchi’s definition of a Heisenberg group differs from the one used here.

4.1 Definition

Let A/k be an Abelian variety and ${\mathcal {L}}$ a line bundle. The line bundle induces a homomorphism $\lambda _{\mathcal {L}}:A\longrightarrow A^\vee ,\, x \mapsto {\mathcal {L}}\otimes t^*_x {\mathcal {L}}^{-1}$. We denote the kernel of $\lambda _{\mathcal {L}}$ by $K({\mathcal {L}})$. By [11, p. 57] the line bundle ${\mathcal {L}}$ is ample if and only if $\lambda$ is an isogeny and ${{\,\mathrm{H}\,}}^0(A, {\mathcal {L}})\ne 0$.

Definition 3.1

Let A/k be an Abelian variety and ${\mathcal {L}}$ a line bundle. Then we define the theta group of ${\mathcal {L}}$ via the functor of points

$$\begin{aligned} \begin{aligned} {\mathcal {G}}({\mathcal {L}}): \{\text {Sch} /k\}\longrightarrow \{\text {Groups}\}\\ T\mapsto \Big \lbrace (x,\phi )| x\in A(T)\text { and }&\phi : {\mathcal {L}}_T {\mathop {\longrightarrow }\limits ^{\sim }} t_x^* {\mathcal {L}}_T\\&\text { an isomorphism of line bundles on } A\times T\Big \rbrace \,. \end{aligned} \end{aligned}$$

The group structure is defined by $(x_1,\phi _1)\cdot (x_2,\phi _2)=(x_1+x_2,t_{x_2}^*\phi _1\circ \phi _2)$.

Lemma 3.2

The functor ${\mathcal {G}}({\mathcal {L}})$ is represented by a group scheme over k. There is an exact sequence of group schemes

$$\begin{aligned} 0 \longrightarrow {\mathbb {G}}_m\longrightarrow {\mathcal {G}}({\mathcal {L}})\longrightarrow K({\mathcal {L}}) \longrightarrow 0 \end{aligned}$$

where the map ${\mathcal {G}}({\mathcal {L}})\rightarrow K({\mathcal {L}})$ is given by $(x,\phi ) \mapsto x$.

Proof

See [14, Lemma 8.2]. $\square$

Definition/Proposition 3.3

If ${\mathcal {L}}$ is ample, then ${\mathbb {G}}_m$ is equal to the center of ${\mathcal {G}}({\mathcal {L}})$. Therefore the commutator map will factor through a non-degenerate alternating pairing

$$\begin{aligned} e^{\mathcal {L}}:K({\mathcal {L}})\times K({\mathcal {L}}) \rightarrow {\mathbb {G}}_m \end{aligned}$$

called the commutator pairing.

Proof

See [14, Corollary 8.20]. $\square$

4.2 Theta Groups and Pullback

Proposition 3.4

Let A be an Abelian variety over a field k and ${\mathcal {L}}$ be a line bundle on A. Let ${\mathcal {H}}\subset K({\mathcal {L}})$ be a closed subgroup scheme. Denote the quotient map $A \rightarrow B=A/{\mathcal {H}}$ by $\pi$. Then there is a natural bijection

Proof

See [14, Theorem 8.10]. $\square$

Corollary 3.5

Suppose further that ${\mathcal {L}}$ is ample and $K({\mathcal {L}})$ is unipotent. Then a line bundle ${\mathcal {L}}_B$ on B with $\pi ^* {\mathcal {L}}_B \cong {\mathcal {L}}$ exists if and only if ${\mathcal {H}}\subset K({\mathcal {L}})$ is isotropic under the commutator pairing on $K({\mathcal {L}})$. Furthermore ${\mathcal {L}}_B$ is then unique.

Proof

Follows easily from Theorem 2.5. $\square$

Definition 3.6

A level subgroup $\tilde{{\mathcal {H}}}\subset {\mathcal {G}}({\mathcal {L}})$ is a subgroup scheme such that ${\mathbb {G}}_m \cap \tilde{{\mathcal {H}}}=\{1\}$.

A level subgroup will map isomorphically onto its image under ${\mathcal {G}}({\mathcal {L}}) \rightarrow K({\mathcal {L}})$. Let us denote the image by ${\mathcal {H}}$. By Proposition 3.4 the level subgroup $\tilde{{\mathcal {H}}}$ will determine a descended line bundle on $A/{\mathcal {H}}$.

Definition/Proposition 3.7

A subgroup $\tilde{{\mathcal {H}}}\subset {\mathcal {G}}({\mathcal {L}})$ is called a maximal level subgroup if it is a level subgroup satisfying one (and hence both) of the following two equivalent properties:

• (i) $\sharp (\tilde{{\mathcal {H}}})^2=\sharp (K({\mathcal {L}}))$. Here and in the rest of the article $\sharp (\cdot )$ denotes the rank of a finite group scheme.

• (ii) Denote by ${\mathcal {H}}$ the image of $\tilde{{\mathcal {H}}}$ under ${\mathcal {G}}({\mathcal {L}})\rightarrow K({\mathcal {L}})$. Then ${\mathcal {H}}^\perp ={\mathcal {H}}$. The orthogonal complement should be taken with respect to the commutator pairing on $K({\mathcal {L}})$.

If furthermore k is algebraically closed then (i) and (ii) are equivalent to

• (iii) $\tilde{{\mathcal {H}}}$ is maximal in the set of level subgroups ordered by inclusion.

Proof

See [14, Lemma 8.22]. $\square$

For our applications it will be useful to translate the Proposition 3.4 into the language of divisors. This leads to the following definition:

Definition 3.8

Let A/k be an Abelian variety and ${\mathcal {H}}\subset A$ be a subgroup scheme. A closed subscheme $Z\subset A$ is called ${\mathcal {H}}$-invariant if the scheme theoretic preimages of Z under the two maps

$$\begin{aligned} \text {pr}_2: {\mathcal {H}}\times A \rightarrow A,\, m: {\mathcal {H}}\times A \rightarrow A,\, (h,a)\mapsto h+a \end{aligned}$$

agree.

For the proof of the next proposition we need a technical definition taken from [11, p. 104]. The reader who does not want to study this proof can skip the definition. It will not be used in other parts of the paper.

Definition 3.9

Let A/k be an Abelian variety, ${\mathcal {H}}\subset A$ be a subgroup scheme and ${\mathcal {F}}$ a coherent sheaf on A. A lift of the action $m: {\mathcal {H}}\times A \rightarrow A$ to ${\mathcal {F}}$ is an isomorphism $\lambda :\text {pr}_2^*({\mathcal {F}}) {\mathop {\rightarrow }\limits ^{\sim }} m^*({\mathcal {F}})$ of sheaves on ${\mathcal {H}} \times A$ such that the following diagram of sheaves on ${\mathcal {H}}\times {\mathcal {H}} \times A$ commutes:

where $\xi ={{\,\mathrm{pr}\,}}_{23}\circ \, m,\, \eta =(m_{12}\times {{\,\mathrm{id}\,}}_A)\circ m=({{\,\mathrm{id}\,}}_{{\mathcal {H}}}\times m_{23})\circ m$.

We can now state the translation of Proposition 3.4 into the language of divisors.

Proposition 3.10

Let A/k be an Abelian variety and ${\mathcal {H}}\subset A$ be a finite subgroup scheme. Suppose an effective divisor $D\subset A$ is ${\mathcal {H}}$-invariant. Denote by ${\mathcal {L}}={\mathcal {O}}(D)$ and $\pi : A \rightarrow B=A/{\mathcal {H}}$ the natural quotient map.

• ${\mathcal {H}}\subset K({\mathcal {L}})$ and there is a natural homomorphism ${\mathcal {H}}\rightarrow {\mathcal {G}}({\mathcal {L}})$ splitting the exact sequence in Lemma 3.2 over ${\mathcal {H}}$.

• ${\mathcal {M}}={\mathcal {O}}(\pi (D))$ is a line bundle satisfying ${\mathcal {L}}\cong \pi ^* {\mathcal {M}}$. Under the bijection in Proposition 3.4 this corresponds to the splitting ${\mathcal {H}}\rightarrow {\mathcal {G}}({\mathcal {L}})$ above.

Proof

This is well-known and similar ideas are contained in [10]. As we could not find a proof in the literature we will indicate it here. The reader can skip the proof as it is quite technical and the techniques will not be used in the rest of the paper. Indeed consider the two maps $\text {pr}_2, m: {\mathcal {H}} \times A \rightarrow A$. Then both maps are flat: Indeed flatness of $\text {pr}_2$ is clear and flatness of m follows from the commutative diagram

Flatness implies that the natural map $\text {pr}_2^* {\mathcal {O}}(D) \rightarrow {\mathcal {O}}(\text {pr}_2^{-1}(D))$ is an isomorphism and similarly $m^* {\mathcal {O}}(D)\cong {\mathcal {O}}(m^{-1}(D))$. Because we assumed D to be ${\mathcal {H}}$-invariant, one has $\text {pr}_2^{-1}(D)=m^{-1}(D)$. Therefore we obtain an isomorphism $\lambda :\text {pr}_2^* {\mathcal {O}}(D) {\mathop {\rightarrow }\limits ^{\sim }} m^* {\mathcal {O}}(D)$. By the definition of the theta group, this isomorphism determines a map of schemes $s:{\mathcal {H}}\rightarrow {\mathcal {G}}({\mathcal {L}})$. We check that s is a group homomorphism. Indeed this means that the two maps $s\circ m_{{\mathcal {H}}},\, m_{{\mathcal {G}}({\mathcal {L}})\circ (s\times s)} : {\mathcal {H}}\times {\mathcal {H}} \rightarrow {\mathcal {G}}({\mathcal {L}})$ are equal. Considered as an element in ${\mathcal {G}}({\mathcal {L}})({\mathcal {H}} \times {\mathcal {H}})$ the first map corresponds to the isomorphism $(m_{1,2}\circ {{\,\mathrm{id}\,}}_A)^* \lambda$. The other map is the product of the elements $s\circ {{\,\mathrm{pr}\,}}_1,\, s\circ {{\,\mathrm{pr}\,}}_2$ in ${\mathcal {G}}({\mathcal {L}})({\mathcal {H}} \times {\mathcal {H}})$. By the definition of the group law on the theta group this product corresponds to the isomorphism $({{\,\mathrm{id}\,}}_{{\mathcal {H}}}\times m_{23})^*(\lambda )\circ {{\,\mathrm{pr}\,}}_{23}^*(\lambda )$. We are therefore reduced to proving that the following diagram of sheaves on ${\mathcal {H}}\times {\mathcal {H}} \times A$ commutes:

where $\xi ={{\,\mathrm{pr}\,}}_{23}\circ m,\, \eta =(m_{12}\times {{\,\mathrm{id}\,}}_A)\circ m=({{\,\mathrm{id}\,}}_{{\mathcal {H}}}\times m_{23})\circ m$. Indeed this is true because ${{\,\mathrm{pr}\,}}_3^{-1}(D)=\xi ^{-1}(D)=\eta ^{-1}(D)$ and all the maps are induced from the equality of these divisors. Therefore s must be a group homomorphism.

It is clear that the composition ${\mathcal {H}} \rightarrow {\mathcal {G}}({\mathcal {L}})\rightarrow K({\mathcal {L}}) \subset A$ is the natural inclusion. Thus ${\mathcal {H}}\subset K({\mathcal {L}})$ and ${\mathcal {H}}\rightarrow {\mathcal {G}}({\mathcal {L}})$ is a splitting of the exact sequence in Lemma 3.2 over ${\mathcal {H}}$.

We will now prove the second part of the proposition. It is clear that we can instead consider ${\mathcal {L}}={\mathcal {O}}(-D)$. In the first part of the proof we constructed a group homomorphism ${\mathcal {H}}\rightarrow {\mathcal {G}}({\mathcal {L}})$ splitting the exact sequence in Lemma 3.2 over ${\mathcal {H}}$. Then Proposition 3.4 gives a line bundle ${\mathcal {M}}$ on B such that ${\mathcal {L}}\cong \pi ^* {\mathcal {M}}$. We have to show that ${\mathcal {M}}={\mathcal {O}}(-\pi (D))$. Indeed by the proof of Proposition 3.4 (for which we refer to [14, Theorem 8.10]) the group homomorphism ${\mathcal {H}}\rightarrow {\mathcal {G}}({\mathcal {L}})$ determines a lift of the multiplication action of ${\mathcal {H}}$ to ${\mathcal {L}}$. It is not difficult to check that this lift of the action is given by the isomorphism $\lambda$ from above. Furthermore the natural inclusion $\iota :{\mathcal {O}}(-D)\rightarrow {\mathcal {O}}_A$ is equivariant for this action, since this is equivalent to the commutativity of

where we use the equality ${\mathcal {O}}_{{\mathcal {H}}\times A}={{\,\mathrm{pr}\,}}_2^*{\mathcal {O}}_A= m^* {\mathcal {O}}_A$. Now by [11, p. 104, Theorem 1] ${\mathcal {M}}=\pi _* ({\mathcal {L}})^{{\mathcal {H}}}$ where $\pi _* ({\mathcal {L}})^{{\mathcal {H}}}\subseteq \pi _* ({\mathcal {L}})$ is the subsheaf of ${\mathcal {H}}$-invariant sections as defined in the proof of the quoted theorem. But since the inclusion ${\mathcal {O}}(-D)\subset {\mathcal {O}}_A$ is ${\mathcal {H}}$-equivariant we have

$$\begin{aligned} {\mathcal {M}}=\pi _*({\mathcal {L}})^{{\mathcal {H}}}=\pi _*({\mathcal {O}}(-D))\cap \pi _*({\mathcal {O}}_A)^{{\mathcal {H}}}=\pi _*({\mathcal {O}}(-D))\cap {\mathcal {O}}_B\,. \end{aligned}$$

Because $\pi$ is finite and thus affine, the latter sheaf equals the coherent sheaf of ideals whose vanishing set is the closed set $\pi (D)$ (this can be checked on affine opens). We conclude ${\mathcal {M}}={\mathcal {O}}(-\pi (D))$. This finishes the proof of the proposition. $\square$

Proposition 3.11

Let A be an Abelian variety over an algebraically closed or finite field k. Let ${\mathcal {L}}$ be a line bundle on A such that $K({\mathcal {L}})$ contains a non-zero Abelian subvariety $B\subseteq A$. Denote by $\pi : A\longrightarrow A/B$ the quotient map. Then there is a line bundle ${\mathcal {L}}_0$ on A algebraically equivalent to ${\mathcal {O}}_A$ and a line bundle ${\mathcal {L}}_{A/B}$ on A/B such that ${\mathcal {L}}\cong {\mathcal {L}}_0\otimes \pi ^* {\mathcal {L}}_{A/B}$.

Proof

The case where k is algebraically closed is given as an exercise in [14, 11.3]. As there is not proof given there we shall include it here: Consider the restriction ${\mathcal {L}}_{|B}$. Since $B\subseteq K({\mathcal {L}})$, the line bundle ${\mathcal {L}}_{|B}$ is algebraically equivalent to ${\mathcal {O}}_B$. Therefore it gives an element in $B^\vee (k)={{\,\mathrm{Pic}\,}}^0(B)(k)$. Consider the exact sequence

$$\begin{aligned} 0\longrightarrow (A/B)^\vee \longrightarrow A^\vee \longrightarrow B^\vee \longrightarrow 0\,. \end{aligned}$$

Since k is finite or algebraically closed the sequence

$$\begin{aligned} 0\longrightarrow (A/B)^\vee (k) \longrightarrow A^\vee (k) \longrightarrow B^\vee (k) \longrightarrow 0 \end{aligned}$$

is exact by Lang’s theorem or Hilbert’s Nullstellensatz respectively. Therefore there is a line bundle ${\mathcal {L}}_0 \in A^\vee (k)$ such that $({\mathcal {L}}_0^{-1}\otimes {\mathcal {L}})_{|B}\cong {\mathcal {O}}_B$. It remains to show that ${\mathcal {L}}_0^{-1}\otimes {\mathcal {L}}$ descends to A/B. Indeed after replacing ${\mathcal {L}}$ with ${\mathcal {L}}_0^{-1}\otimes {\mathcal {L}}$ we will now assume that ${\mathcal {L}}_{|B} \cong {\mathcal {O}}_B$. Consider the exact sequence

$$\begin{aligned} 0\longrightarrow {\mathbb {G}}_m \longrightarrow {\mathcal {G}}({\mathcal {L}})\longrightarrow K({\mathcal {L}}) \longrightarrow 0 \end{aligned}$$

and push it out along $B\subseteq K({\mathcal {L}})$:

$$\begin{aligned} 0\longrightarrow {\mathbb {G}}_m \longrightarrow {\mathcal {G}}({\mathcal {L}})_{|B}\longrightarrow B \longrightarrow 0\,. \end{aligned}$$

The resulting exact sequence is the sequence of ${\mathcal {G}}({\mathcal {L}}_{|B})$ on B. This is the extension corresponding to ${\mathcal {L}}_{|B}$ under the identification $B^\vee (k)= {{\,\mathrm{Ext}\,}}^1(B,{\mathbb {G}}_m)$. Therefore the exact sequence splits. This implies that B lifts to a level group in ${\mathcal {G}}({\mathcal {L}})$. We conclude that ${\mathcal {L}}$ descends to A/B. $\square$

Definition 3.12

Let ${\mathcal {H}}$ be a finite k-group scheme. We will define a group scheme ${\mathcal {G}}({\mathcal {H}})$, the so called Heisenberg group associated to ${\mathcal {H}}$: As a scheme

$$\begin{aligned} {\mathcal {G}}({\mathcal {H}})={\mathbb {G}}_m \times {\mathcal {H}} \times {\mathcal {H}}^D \end{aligned}$$

and the group structure is defined on T-valued points by

$$\begin{aligned} (r, h, \chi )\cdot (r', h', \chi ')=(r r' \chi (h'), h+h', \chi +\chi ') \end{aligned}$$

where ${\mathcal {H}}^D$ denotes the Cartier dual of ${\mathcal {H}}$. We use the identification ${\mathcal {H}}^D(T)={{\,\mathrm{Hom}\,}}_T({\mathcal {H}}_T, {\mathbb {G}}_{m,T} )$.

Notice that Heisenberg groups have very similar properties as the theta group of an ample line bundle. However such a theta group will not always be isomorphic to a Heisenberg group. On the other hand it will be isomorphic to a Heisenberg group if the degree of ${\mathcal {L}}$ is not divisible by the characteristic of the ground field. Another example will be the line bundle appearing in the construction of Moret-Bailly although in this case $\deg {\mathcal {L}}=p$. There is the following characterization for the theta group being a Heisenberg group:

Lemma 3.13

Let ${\mathcal {L}}$ be an ample line bundle on an Abelian variety A. Suppose there are two maximal level subgroups $\tilde{{\mathcal {H}}}_1, \tilde{{\mathcal {H}}_2} \subset {\mathcal {G}}({\mathcal {L}})$ with $\tilde{{\mathcal {H}}}_1\cap \tilde{{\mathcal {H}}_2}=\{1\}$ (scheme-theoretic intersection). Then $\tilde{{\mathcal {H}}}_1\cong \tilde{{\mathcal {H}}}_2^D$ and ${\mathcal {G}}({\mathcal {L}})\cong {\mathcal {G}}(\tilde{{\mathcal {H}}}_1)$.

Proof

Follows immediately from the proof of [14, Lemma 8.24]. The assumption that k is algebraically closed is not needed for the part we use. $\square$

4.3 Representations of the Theta group

In this section we recall the important properties of the action of ${\mathcal {G}}({\mathcal {L}})$ on the global sections ${{\,\mathrm{H}\,}}^0(A, {\mathcal {L}})$. First there is the following definition:

Definition 3.14

Let ${\mathcal {L}}$ be a line bundle on an Abelian variety A/k. We say that a linear representation of ${\mathcal {G}}({\mathcal {L}})$ has weight $n\in {\mathbb {Z}}$ if the restriction to ${\mathbb {G}}_m$ is the character $z\mapsto z^n$.

Theorem 3.15

Let ${\mathcal {L}}$ be an ample line bundle on an Abelian variety A/k. Then there is a natural absolutely irreducible weight 1 representation of the group scheme ${\mathcal {G}}({\mathcal {L}})$ on ${{\,\mathrm{H}\,}}^0(A, {\mathcal {L}})$.

Proof

See [12, p. 710]. $\square$

Theorem 3.16

Let ${\mathcal {L}}$ be an ample line bundle on an Abelian variety A/k. Then there is a unique absolutely irreducible weight 1 representation V of ${\mathcal {G}}({\mathcal {L}})$. Its dimension is $\dim (V)=\sqrt{\sharp ( K({\mathcal {L}}))}=\deg ({\mathcal {L}})$.

Proof

The existence of such a representation follows from Theorem 3.15. The uniqueness is proven in [14, Theorem 8.32] in the case where k is algebraically closed. We claim that the general case can be deduced using descent.¹ Indeed suppose V, W are two absolutely irreducible ${\mathcal {G}}({\mathcal {L}})$-modules of weight 1. Then $V\otimes {\overline{k}} ,W\otimes {\overline{k}}$ are irreducible ${\mathcal {G}}({\mathcal {L}})_{{\overline{k}}}$-modules of weight 1. By the quoted theorem in the case where the ground field is algebraically closed $V\otimes {\overline{k}}$ and $W\otimes {\overline{k}}$ are isomorphic. The next Lemma 3.17 implies that V and W are isomorphic as ${\mathcal {G}}({\mathcal {L}})$-modules. This proves the claim. $\square$

Lemma 3.17

Let k be a field and G an affine group scheme over k and V, W be two irreducible G-modules. Suppose that $V\otimes {\overline{k}}$ and $W\otimes {\overline{k}}$ are isomorphic as $G_{{\overline{k}}}$-modules. Then V and W are isomorphic as G-modules.

Proof

Consider the k-vector space ${{\,\mathrm{Hom}\,}}_G(V,W)$ of G-equivariant k-linear maps. By Schur’s lemma it suffices to show that ${{\,\mathrm{Hom}\,}}_G(V,W)\ne \{0\}$.

Indeed ${{\,\mathrm{Hom}\,}}_G(V,W)$ equals the vector space of k-linear maps $\varphi :V\rightarrow W$ such that the following diagram commutes:

where $A_G$ denotes the Hopf-algebra of G and the vertical arrows are induced from the action of G on V (resp. W).

This description of ${{\,\mathrm{Hom}\,}}_G(V,W)$ implies that for any field extension $k'/k$ one has

$$\begin{aligned} {{\,\mathrm{Hom}\,}}_{G_{k'}}(V\otimes k', W\otimes k')={{\,\mathrm{Hom}\,}}_G(V,W)\otimes k'\,. \end{aligned}$$

Since by assumption $V\otimes {\overline{k}}$ and $W\otimes {\overline{k}}$ are isomorphic as $G_{{\overline{k}}}$-modules we obtain ${{\,\mathrm{Hom}\,}}_{G_{{\overline{k}}}}(V\otimes {\overline{k}}, W\otimes {\overline{k}})\ne \{0\}$. Therefore ${{\,\mathrm{Hom}\,}}_G(V,W)\ne \{0\}$ and the lemma follows. $\square$

The representation of the theta group can be used to characterize the image of the global sections under pullback.

Proposition 3.18

Let $\pi :A\rightarrow B$ be a finite surjective map of Abelian varieties with kernel ${\mathcal {H}}$. Let further ${\mathcal {M}}$ be an ample line bundle on B. Then the image of

$$\begin{aligned} \pi ^*: {{\,\mathrm{H}\,}}^0(B, {\mathcal {M}}) \rightarrow {{\,\mathrm{H}\,}}^0(A, \pi ^* {\mathcal {M}}) \end{aligned}$$

is ${{\,\mathrm{H}\,}}^0(A, \pi ^* {\mathcal {M}})^{\tilde{{\mathcal {H}}}}$ where $\tilde{{\mathcal {H}}}\subset {\mathcal {G}}(\pi ^* {\mathcal {M}})$ is the level subgroup over ${\mathcal {H}}$ coming from Proposition 3.4.

Proof

Mumford uses this without proof in [10, §1, Theorem 4]. The result follows from the proof of Proposition 3.4, which we do not discuss, and [11, p. 104, Theorem 1]. $\square$

We will also need a result about the action of the level group when we have a situation as in Proposition 3.10.

Proposition 3.19

Let A/k be an Abelian variety and ${\mathcal {H}}\subset A$ be a finite subgroup scheme. Suppose an ample effective divisor $D\subset A$ is ${\mathcal {H}}$-invariant.

Then the action of the level group $\tilde{{\mathcal {H}}}\subset {\mathcal {G}}({\mathcal {O}}(D))$ coming from Proposition 3.10 on ${{\,\mathrm{H}\,}}^0(A, {\mathcal {O}}(D))$ is given by the translation action of ${\mathcal {H}}$ on the function field K(A).

Proof

From the proof of Proposition 3.10 we get a lift of the translation action of ${\mathcal {H}}$ to the sheaf ${\mathcal {O}}(D)$. Furthermore we have seen there that the inclusion ${\mathcal {O}} \rightarrow {\mathcal {O}}(D)$ is equivariant for this action. By taking the stalk at the generic point of ${\mathcal {O}} \rightarrow {\mathcal {O}}(D)$ we see that the action on global sections induced by the action of ${\mathcal {H}}$ on the sheaf ${\mathcal {O}}(D)$ is given by translation of rational functions. On the other hand one can check using the definitions that the action of ${\mathcal {H}}$ on global sections induced from the action on the sheaf ${\mathcal {O}}(D)$ coincides with the restriction of the representation of the theta group to the level group $\tilde{{\mathcal {H}}}$. $\square$

5 The Construction of Moret-Bailly

Let k be an algebraically closed field of characteristic $p>2$. Fix a supersingular elliptic curve E/k defined over ${\mathbb {F}}_p$ such that the relative Frobenius satisfies $F^2+p=0$. All schemes in this section will be k-schemes to allow ourselves to apply theorems for schemes over algebraically closed fields. However as we see later everything will be defined over ${\mathbb {F}}_{p^2}$.

5.1 Notation

We shall fix the following notation for the rest of the article.

• E is a supersingular elliptic curve defined over ${\mathbb {F}}_p$ such that the relative Frobenius satisfies $F^2+p=0$.

• ${\mathsf {O}}=\text {End}(E)$ and $B={\mathsf {O}}\otimes {\mathbb {Q}}$. Notice that the conditions on E imply that all the endomorphism of E are defined over ${\mathbb {F}}_{p^2}$.

• There is an additive bijection

  $$\begin{aligned}&\gamma : \text {Mat}_{m,n}({\mathsf {O}}){\mathop {\rightarrow }\limits ^{\sim }}\text {Hom}(E^n,E^m) \\&\quad \Phi =(\varphi _{ij})\mapsto \left( \psi :E^n\rightarrow E^m,\, (P_1,\ldots , P_n)\mapsto \left( \sum _{j=1}^n \varphi _{1j}(P_j)), \ldots , \sum _{j=1}^n \varphi _{mj}(P_j)\right) \right) \,. \end{aligned}$$

  This bijection turns matrix multiplication into composition of maps. Notice that we use the convention that maps should be composed from right to left.

• $\mu : E^2\rightarrow (E^2)^\vee$ denotes the natural product polarization.

• The map

  $$\begin{aligned} f\mapsto (\mu \circ \gamma (f):E^2\rightarrow (E^2)^\vee ) \end{aligned}$$

  is a bijection from the set of positive definite hermitian matrices in $M_{2,2}({\mathsf {O}})$ to the set of polarizations on $E^2$.

• Let A be an Abelian variety. By an elliptic curve $E_1\subset A$ we mean a closed subscheme which is a smooth curve of genus 1 with a distinguished rational point, but not necessarily the origin. Thus $E_1$ does not have to be an Abelian subvariety.

5.2 Results of Moret-Bailly

In this section we recall the construction of the families of Moret-Bailly. All the results in this section are taken from [9]. Thus they are just stated here without proof for the convenience of the reader and to fix the notation.

Consider the $\alpha$-group scheme $\alpha ({\mathcal {O}}(1))$ over ${\mathbb {P}}^1$ (see Definition 2.3 for the notation). The map ${\mathcal {O}}^2\rightarrow {\mathcal {O}}(1)$ induces a map of ${\mathbb {P}}^1$-group schemes $\alpha ({\mathcal {O}}(1))\rightarrow \alpha _{p, {\mathbb {P}}^1}^2$. After choosing an isomorphism $E[F]\cong \alpha _p$ there is a composed map $\iota : \alpha ({\mathcal {O}}(1))\rightarrow E^2_{{\mathbb {P}}^1}$. The map will depend on the choice of the isomorphism $E[F]\cong \alpha _p$, but its image will not. By [1, exposé 5 Théorème 4.1] the quotient $E^2_{{\mathbb {P}}^1}/\iota (\alpha ({\mathcal {O}}(1)))$ exists. It is an Abelian scheme over ${\mathbb {P}}^1$.

Definition 4.1

We define ${\mathcal {A}}=E^2_{{\mathbb {P}}^1}/\iota (\alpha ({\mathcal {O}}(1)))$.

Moret-Bailly proved that one can put a principal polarization on ${\mathcal {A}}$:

Lemma 4.2

Let $\eta$ be a polarization on $E^2$ such that $\ker (\eta )=E^2[F]$. Then $\eta _{{\mathbb {P}}^1}$ descends to a principal polarization $\lambda$ on the Abelian scheme ${\mathcal {A}}\rightarrow {\mathbb {P}}^1$.

Proof

For the proof we refer to [9, §1.4]. $\square$

The next proposition explains the properties of the polarization $\lambda$ on the Abelian scheme ${\mathcal {A}}\rightarrow {\mathbb {P}}^1$:

Theorem 4.3

There exists a symmetric divisor ${\mathfrak {C}}$ on ${\mathcal {A}}$ that is relatively ample and flat over ${\mathbb {P}}^1$ and induces the polarization $\lambda$. Then we have the following properties:

• The generic fiber of ${\mathfrak {C}} \rightarrow {\mathbb {P}}^1$ is a smooth geometrically connected curve of genus 2.

• $5p-5$ fibers of ${\mathfrak {C}} \rightarrow {\mathbb {P}}^1$ are of the form $E_1\cup E_2$ where $E_1,E_2$ are elliptic curves intersecting transversely in a point contained in ${\mathcal {A}}[2]$. We are going to refer to these fibers as the reducible fibers. By [3, formula 3.3] the reducible fibers are fibers over ${\mathbb {F}}_{p^2}$-valued points of ${\mathbb {P}}^1$ (necessary but not sufficient condition).

Denote by ${\mathfrak {D}}$ the preimage of ${\mathfrak {C}}$ under $E^2_{{\mathbb {P}}^1}\rightarrow {\mathcal {A}}$. Then ${\mathfrak {D}}$ is a symmetric divisor on $E^2_{{\mathbb {P}}^1}$ that is relatively ample and flat over ${\mathbb {P}}^1$ and induces the polarization $\eta _{{\mathbb {P}}^1}$. Furthermore we have the following properties:

• The generic fiber of ${\mathfrak {D}} \rightarrow {\mathbb {P}}^1$ is a singular geometrically integral curve of geometric genus 2 and arithmetic genus $p+1$.

• $5p-5$ fibers of ${\mathfrak {D}} \rightarrow {\mathbb {P}}^1$ are of the form $E_1\cup E_2$ where $E_1,E_2$ are elliptic curves intersecting with multiplicity p in one of 10 points contained in $E^2[2]$.

Proof

See [9, §2.1]. $\square$

Notice that ${\mathfrak {C}}$ is not unique but only unique up to translating by a 2-torsion point.

5.3 Reducible Fibers I: Classification of reducible fibers

Proposition 4.4

Let $f\in M_{2,2}({\mathsf {O}})$ be a hermitian positive definite matrix inducing a polarization $\eta$ on $E^2$ with kernel $E^2[F]$. Then there exists an ample divisor $D=E_1+E_2$ inducing the polarization $\eta$ where $E_1,E_2$ are elliptic curves intersecting in the origin with multiplicity p. To give such a decomposition is equivalent to writing $f=f_1+f_2$ where $f_1,f_2\in M_{2,2}({\mathsf {O}})$ are hermitian rank 1 matrices with integral entries.

Furthermore if we are given $f_1,f_2$ as above then $E_i=\ker (\gamma (f_i))$. In particular the $E_i$ and D are defined over ${\mathbb {F}}_{p^2}$.

Proof

The existence of an ample divisor D of the form $D=E_1+E_2$ with above properties follows from Theorem 4.3. We prove now that to give such a divisor is equivalent to writing $f=f_1+f_2$ with $f_1,f_2\in M_{2,2}({\mathsf {O}})$ hermitian of rank 1. Indeed consider the map

$$\begin{aligned} r:\text {NS}(E^2)\longrightarrow {{\,\mathrm{End}\,}}(E^2),\, D \mapsto \mu ^{-1} \circ \lambda _{{\mathcal {O}}(D)} \end{aligned}$$

where $\mu$ denotes the natural product polarization on $E^2$. By [11, p. 174, Theorem 2 and p. 214, Theorem 3] r is an injective homomorphism and $\text {im}(r)$ is the subgroup of endomorphisms fixed by the Rosati involution induced by $\mu$. Under the identification ${{\,\mathrm{End}\,}}(E^2)=M_{2,2}({\mathsf {O}})$ the Rosati involution is given by the hermitian transpose. The desired bijection is defined by $f_i=r(E_i),\, i=1,2$.

We prove that this bijection has the right properties. Indeed suppose we are given an ample divisor $D=E_1+E_2$ inducing the polarization $\eta$. We have to show that $f_i=r(E_i)$ have rank 1 for $i=1,2$. To show this notice first that clearly $E_i\subseteq \ker (\gamma (f_i)),\, i=1,2$. Furthermore by Poincaré’s reducibility theorem $E^2$ is isogenous to $E_1\times E_2$ and therefore $E_1, E_2$ must be supersingular. Therefore there is an isogeny $E\longrightarrow E_i$. The composed map $E\rightarrow E_i \hookrightarrow E^2$ corresponds to a $v_i\in {\mathsf {O}}^2\setminus \{0\}$. Now $f_i v_i=0$ proving that ${{\,\mathrm{rk}\,}}f_i \leqslant 1$. Since certainly $f_i\ne 0$ we deduce ${{\,\mathrm{rk}\,}}f_i=1$.

Conversely suppose we are given $f_1,\,\,f_2\in M_{2,2}({\mathsf {O}})$ hermitian of rank 1 such that $f=f_1+f_2$. Consider $D_i=r^{-1}(f_i),\, i=1,2$. We have to show that the $D_i$ are algebraically equivalent to elliptic curves with the required properties. Indeed as ${{\,\mathrm{rk}\,}}f_i=1$, there exist $v_i\in {\mathsf {O}}^2\setminus \{0\}$ such that $f_i v_i=0$. The $v_i$ correspond to maps $E\longrightarrow E^2$ whose image $E_i$ is an elliptic curve satisfying $E_i\subset \ker (\gamma (f_i))$. It follows from Proposition 3.11 that $D_i$ is algebraically equivalent to $n_i E_i$ for some $n_i\in {\mathbb {Z}}$. On the other hand

$D.D=2\deg (D)=2\sqrt{\deg \eta }=2p=2n_1 n_2 E_1.E_2$. Therefore

$$\begin{aligned} (1,1,p),(1,p,1),(p,1,1),(-1,-1,p),(-1,-p,1),(-p,-1,1) \end{aligned}$$

are all the possibilities for $(n_1,n_2, E_1.E_2)$. The last three possibilities are excluded by ampleness of D. The 2nd and 3rd would imply $E_1[p]\subseteq \ker (\gamma (f_1))\cap \ker (\gamma (f_2))\subseteq \ker (\eta )$ respectively $E_2[p]\subseteq \ker (\eta )$ contradicting $\ker (\eta )=E^2[F]$. This shows that $D=E_1+E_2$ and $E_1. E_2 = p$.

We will now prove that $E_i=\ker (\gamma (f_i))$. Indeed denote by ${\mathcal {L}}_i={\mathcal {O}}(E_i)$ the line bundle corresponding to $E_i$. Since $f_i=\mu ^{-1}\circ \lambda _{{\mathcal {L}}_i}$, the claim is equivalent to $K({\mathcal {L}}_i)=E_i$. Thus we will compute $K({\mathcal {L}}_i)$. Indeed clearly $E_i\subset K({\mathcal {L}}_i)$ and $K({\mathcal {L}}_i)\ne E^2$ because $E_i$ is not algebraically equivalent to 0. Therefore $G=K({\mathcal {L}}_i)/E_i$ is finite. On the other hand if $\pi : E^2 \rightarrow E^2/E_i$ denotes the natural quotient map, then ${\mathcal {L}}_i=\pi ^* {\mathcal {O}}(0)$. By Proposition 3.4$E_i$ lifts to a level subgroup in ${\mathcal {G}}({\mathcal {L}}_i)$. We compute the centralizer ${\mathfrak {C}}(E_i)$ in ${\mathcal {G}}({\mathcal {L}}_i)$. For this we note that the commutator pairing factors through $E_i\times G \rightarrow {\mathbb {G}}_m$. This induces a group homomorphism $E_i \rightarrow G^D$. But $E_i$ is proper and geometrically connected and $G^D$ is finite. Therefore $E_i \rightarrow G^D$ is trivial. We conclude ${\mathfrak {C}}(E_i)={\mathcal {G}}({\mathcal {L}}_i)$. Using [14, Proposition 8.15] one obtains ${\mathbb {G}}_m={\mathcal {G}}({\mathcal {O}}(0_{E^2/E_i}))={\mathfrak {C}}(E_i)/E_i$. This implies $G=0$ and we have proven $E_i=\ker (\gamma (f_i))$. $\square$

Corollary 4.5

In the notation of the previous proposition, the scheme theoretic intersection ${\mathcal {H}}=E_1 \cap E_2 \subset E^2$ is a closed subgroup scheme isomorphic to $\alpha _p$. The quotient $A=E^2/{\mathcal {H}}$ is isomorphic to $E_1^{(p)}\times E_2^{(p)}$. Also $\eta$ descends along the isogeny $E^2\rightarrow A$ to a principal polarization $\lambda$ on A. In particular $(A,\, \lambda )$ is a fiber of the Moret-Bailly family constructed from $E^2, \eta$. Furthermore $\lambda$ is the natural product polarization on $E_1^{(p)}\times E_2^{(p)}$.

Proof

Choose a uniformizer ${\mathfrak {z}}\in {\mathcal {O}}_{E_1,0}$. Since $E_1,E_2$ intersect with multiplicity p, the intersection ${\mathcal {H}}=E_1\cap E_2$ is given by the image of the closed immersion ${{\,\mathrm{Spec}\,}}({\mathcal {O}}_{E_1,0}/{\mathfrak {z}}^p) \hookrightarrow E_1$. Therefore ${\mathcal {H}}=E_1[F]$ as a closed subscheme. We conclude that ${\mathcal {H}}$ is a closed subgroup scheme isomorphic to $\alpha _p$.

Consider the quotient $A=E^2/{\mathcal {H}}$ and denote the quotient map by $\pi : E^2\rightarrow A$. Now because ${\mathcal {H}}\subset E_1$ and ${\mathcal {H}}\subset E_2$ is a subgroup scheme, the divisor D is ${\mathcal {H}}$-invariant. Therefore by Proposition 3.10${\mathcal {O}}(D)$ descends along $\pi$ to the line bundle ${\mathcal {O}}(\pi (D))$. Since D induces the polarization $\eta$, $\eta$ thus descends to a polarization $\lambda$ induced by $\pi (D)$ on A. Computing degrees yields that $\lambda$ is a principal polarization. On the other hand ${\mathcal {O}}(D)=\pi ^* {\mathcal {O}}(\pi (D))$ implies $D=\pi ^{-1}(\pi (D))$. Therefore the map $D \rightarrow \pi (D)$ is a finite radicial map of degree p being the pull-back of such a map. Thus $\pi (D)=E_1^{(p)} + E_2^{(p)}$ and by a result of A. Weil $A\cong E_1^{(p)}\times E_2^{(p)}$ and $\lambda$ is the natural product polarization. $\square$

Corollary 4.6

In the notation of the previous proposition there is a bijective map

Proof

Proposition 4.4 and Corollary 4.5 give us such a map. We claim that the map is injective. Indeed suppose that the two pairs $\{f_1,f_2\}$ and $\{f_1', f_2'\}$ map to the same element in the target. Define D to be the divisor $\ker (\gamma (f_1))+\ker (\gamma (f_2))$ on $E^2$ and similarly $D'=\ker (f_1')+\ker (f_2')$. Define further ${\mathcal {H}}=\ker (\gamma (f_1))\cap \ker (\gamma (f_2))$ and ${\mathcal {H}}'=\ker (f_1')\cap \ker (f_2')$. Then one has ${\mathcal {H}}={\mathcal {H}}'$ as subgroup schemes because $\{f_1,f_2\}$ and $\{f_1', f_2'\}$ map to the same element in the target. Denote by $\pi : E^2\rightarrow E^2/{\mathcal {H}}$ the quotient map. Then $\pi (D), \, \pi (D')$ induce the same principal polarization. Therefore there exists a 2-torsion point P such that $\pi (D)=t_P (\pi (D'))$. But the two components of $\pi (D)$ (resp. $\pi (D')$) intersect only at 0. Therefore one must have $P=0$. This implies $\pi (D)=\pi (D')$. But by Proposition 3.10 one has $D=\pi ^{-1}(\pi (D))$ (resp. $D'=\pi ^{-1}(\pi (D)')$) and thus we conclude $D=D'$. Proposition 4.4 gives $\{f_1,f_2\}=\{f_1',f_2'\}$ as unordered pairs. This proves the injectivity. We prove the surjectivity. Indeed let $x\in {\mathbb {P}}^1$ be a point such that ${\mathfrak {C}}_x$ is reducible. Consider the divisor ${\mathfrak {D}}_x$ on $E^2$. By Theorem 4.3${\mathfrak {D}}_x$ is the union of two elliptic curves intersecting at a 2-torsion point $P\in E^2[2]$. Define $D=t_P({\mathfrak {D}}_x)$. Then D is an ample divisor inducing the polarization $\eta$ and the union of two elliptic curves intersecting at the origin. Proposition 4.4 gives the desired preimage $\{f_1,f_2\}$ under our map. $\square$

We further investigate these decompositions $f=f_1+f_2$ from the proposition.

Proposition 4.7

Let $f\in M_{2,2}({\mathsf {O}})$ be a hermitian positive definite matrix inducing a polarization $\eta$ on $E^2$ with kernel $E^2[F]$. Consider the hermitian lattice $L=({\mathsf {O}}^2,f)$. To write $f=f_1+f_2$ where $f_1,f_2\in M_{2,2}({\mathsf {O}})$ are hermitian rank 1 matrices is equivalent to giving two sublattices $I_1, I_2\subseteq L$ with the following properties (i)–(iii). If $I_1,I_2$ satisfy (i) and (ii), then condition (iii) is equivalent to (iii’):

• (i) $I_1,I_2$ are invertible right-${\mathsf {O}}$-modules.

• (ii) $I_1\perp I_2$ with respect to f.

• (iii) $L/(I_1\oplus I_2) \cong {\mathsf {O}}/F$.

• (iii’) $I_2$ is primitive and for every $v\in I_1$ one has $v^{\dagger } f v=p [I_1:v {\mathsf {O}}]$.

The bijection is defined as follows: Given $f_1,f_2$ we define $I_i=\ker (f_i),\, i=1,2$ considered as an ${\mathsf {O}}$-submodule of ${\mathsf {O}}^2$.

Conversely given $I_1,I_2$ there is a direct sum decomposition

$$\begin{aligned} L \otimes B=(I_1 \otimes B) \oplus (I_2 \otimes B)\,. \end{aligned}$$

Denote by $P_i\in M_{2,2}(B)$ the matrices of the projection maps onto the two factors respectively. Then one defines $f_1=P_2^{\dagger } f P_2,\, f_2=P_1^{\dagger } f P_1$.

Proof

“$\Rightarrow$” Suppose we have a decomposition $f=f_1+f_2$ where $f_i\in M_{2,2}({\mathsf {O}})$ are hermitian rank 1 matrices with integral entries. Then we define $I_i=\ker (f_i)$ considered as an ${\mathsf {O}}$-submodule of ${\mathsf {O}}^2$. It is clear that property i) holds. For showing ii) we take $v_1\in I_1,v_2\in I_2$ arbitrary. Then $v_1^{\dagger } f v_2= v_1^{\dagger } f_1 v_2+v_1^{\dagger } f_2 v_2=v_2^{\dagger } f_1 v_1=0$ using the definition of the $I_i$.

We turn to property iii): Indeed i) and ii) imply the direct sum decomposition

$$\begin{aligned} L \otimes B=(I_1 \otimes B) \oplus (I_2 \otimes B)\,. \end{aligned}$$

Denote by $P_i\in M_{2,2}(B)$ the matrices of the projection maps onto the two factors respectively. Then one has the identities . From this we deduce $f_1=f_1(P_1+P_2)=f_1 P_2$ and similarly $f_2=f_2 P_1$. This implies $f P_2=f_1 P_2 + f_2 P_2=f_1$ and similarly $f P_1 =f_2$. We will now deduce iii) by considering the localization at all prime numbers l. Indeed notice first that $I_1\subset L$ is a primitive submodule, i.e., $L/I_i$ is torsion free. This implies that also $I_{1,(l)} \subset L_{(l)}$ is primitive. Furthermore since ${\mathbb {Z}}_{(l)}$ is a DVR, $I_{1,(l)}$ is free, generated by $v_1\in I_{1,(l)}$, say. Assume first that $l\ne p$. Then since $\ker (\eta )=E^2[F]$ and $l\ne p$, the pairing on $L_{(l)}$ is perfect. Thus by Lemma 1.5 there exists an $w\in L_{(l)}$ such that $w^{\dagger } f v_1=1$. On the other hand $P_1$ is the orthogonal projection onto the subspace generated by $v_1$ and thus by basic linear algebra $P_1= \frac{v_1 v_1^{\dagger } f}{v_1^{\dagger } f v_1}$. We now compute $w^{\dagger } f_2 w = w^{\dagger } f P_1 w=\frac{w^{\dagger } f v_1 v_1^{\dagger } f w}{v_1^{\dagger } f v_1}=\frac{1}{v_1^{\dagger } f v_1}\in {\mathbb {Z}}_{(l)}$. This implies that $v_1^{\dagger } f v_1\in {\mathbb {Z}}_{(l)}^\times$. Therefore $P_1\in M_{2,2}({\mathsf {O}}_{(l)})$. Similarly one proves $P_2\in M_{2,2}({\mathsf {O}}_{(l)})$. This implies $L_{(l)}=I_{1,(l)}\oplus I_{2,(l)}$. It remains to consider the case $l=p$. Then the pairing given by f induces a map $L\longrightarrow L^{\dagger }$ with image $L^{\dagger } F$. The same argument as in Lemma 1.5 shows the existence of a $w\in L$ such that $w^{\dagger } f v_1=F$. We now compute $w^{\dagger } f_2 w = w^{\dagger } f P_1 w=\frac{w^{\dagger } f v_1 v_1^{\dagger } f w}{v_1^{\dagger } f v_1}=\frac{F {\overline{F}}}{v_1^{\dagger } f v_1}=\frac{p}{v_1^{\dagger } f v_1}\in {\mathbb {Z}}_{(p)}$. This implies that $P_1=\frac{v_1 v_1^{\dagger } f}{v_1^{\dagger } f v_1}\in \frac{F}{p} M_{2,2}({\mathsf {O}}_{(p)})$ because $f\in F M_{2,2}({\mathsf {O}})$. Similarly $P_2\in \frac{F}{p} M_{2,2}({\mathsf {O}}_{(p)})$. We conclude that $L_{(p)}/(I_{1,(p)}\oplus I_{2,(p)})$ is killed by F. This implies that $L_{(p)}/(I_{1,(p)}\oplus I_{2,(p)})$ is either ${\mathsf {O}}/F$ or $({\mathsf {O}}/F)^2$. However the second case is impossible because of the primitivity of $I_{1,(p)}$. This proves iii).

“$\Leftarrow$”: Conversely suppose we are given $I_1$ and $I_2$ satisfying i)-iii). There is a direct sum decomposition

$$\begin{aligned} L \otimes B=(I_1 \otimes B) \oplus (I_2 \otimes B)\,. \end{aligned}$$

Denote by $P_i\in M_{2,2}(B)$ the matrices of the projection maps onto the two factors respectively. Then one defines $f_1=P_2^{\dagger } f P_2,\, f_2=P_1^{\dagger } f P_1$. By construction one has $f_1 P_1=f_2 P_2=0$. From these equalities and one easily infers $f=f_1+f_2,\, f_1=f P_2,\, f_2=f P_1$. It remains to show $f_1, f_2\in M_{2,2}({\mathsf {O}})$. Indeed from ii) one gets $P_1,P_2\in \frac{F}{p} M_{2,2}({\mathsf {O}})$. Hence one obtains $f_1=f P_2,\, f_2=f P_1\in M_{2,2}({\mathsf {O}})$.

We show now that for $I_1, I_2$ satisfying conditions i)-iii) property iii’) holds true. Indeed we have already explained in this proof why $I_2$ must be primitive. We prove now the formula $v^{\dagger } f v = p [I_1: v {\mathsf {O}}],\, \forall v \in I_1$ by comparing the l-adic valuations of both sides for all prime numbers. Since $I_{1,(l)}, I_{2,(l)}$ are free, there exist $v_1\in I_{1,(l)},\, v_2\in I_{2,(l)}$ such that $I_{1,(l)}=v_1 {\mathsf {O}}_{(l)}, I_{2,(l)}=v_2 {\mathsf {O}}_{(l)}$. Because $I_1\perp I_2$, the matrix representing the hermitian form on $I_{1,(l)}\oplus I_{2,(l)}$ induced by f is of the form

$$\begin{aligned} \begin{pmatrix} d_1 &{} 0\\ 0 &{} d_2 \end{pmatrix} \end{aligned}$$

with $d_1,d_2\in {\mathbb {Z}}_{(l)}$. Assume first that $l\ne p$. Then the hermitian pairing on $I_{1,(l)}\oplus I_{2,(l)}$ is perfect an thus $d_1,d_2 \in {\mathbb {Z}}_{(l)}$. This implies $\nu _l(v^{\dagger } f v) = \nu _l( [I_1: v {\mathsf {O}}]),\, \forall v \in I_1$. Assume now that $l=p$. Then as F|f we must have $p| d_1, d_2$. On the other hand the map $I_{1,(p)}\oplus I_{2,(p)} \longrightarrow I_{1,(p)}^{\dagger }\oplus I_{2,(p)}^{\dagger }$ induced by f has cokernel of length 4 over the local ring ${\mathsf {O}}_{(p)}$ with maximal ideal $F {\mathsf {O}}_{(p)}={\mathsf {O}}_{(p)} F$: This follows from $L/(I_1\oplus I_2)={\mathsf {O}}/F$ and ${{\,\mathrm{im}\,}}(L \longrightarrow L^{\dagger }) = L^{\dagger } F$. This implies that $\nu _p(d_1 d_2)=\nu _p(F^4)=2$. Therefore $\nu _p(d_1)=\nu _p(d_2)=1$. We conclude $\nu _p(v^{\dagger } f v) = 1+\nu _p( [I_1: v {\mathsf {O}}]),\, \forall v \in I_1$. Since the sign of $v^{\dagger } f v$ is positive we have proven $v^{\dagger } f v = p [I_1: v {\mathsf {O}}],\, \forall v \in I_1$.

Next we prove that for $I_1, I_2$ satisfying conditions (i), (ii), (iii’) property (iii) holds true. Indeed given $I_1, I_2$ we define $f_1, f_2$ by the formulae above. We claim that $f_1, f_2$ have integral coefficients. This is proven by localizing at all prime numbers l. Using the same notation as in the previous paragraph we have $f_1=\frac{f v_1 v_1^{\dagger } f}{v_1^{\dagger } f v_1}$. The matrix coefficients of numerator have l-adic valuation $\geqslant \nu _l(p)$, while the denominator has $\nu _l(v_1^{\dagger } f v_1)=\nu _l(d_1)=\nu _l(p)$. This implies that $f_1\in M_{2,2}({\mathsf {O}})$. Therefore also $f_2=f-f_1\in M_{2,2}({\mathsf {O}})$. Furthermore by construction $I_i \subseteq \ker (f_i)$. Equality holds because all the lattices are primitive sublattices. Therefore by the direction “$\Rightarrow$” we already proved, $I_1, I_2$ satisfy conditions (i)–(iii). $\square$

Corollary 4.8

Using the notation of the previous proposition, the isomorphism classes of the elliptic curves $E_i$ in Proposition 4.4 are determined as follows: By a result of Deuring there is a bijection between isomorphism classes of invertible right-${\mathsf {O}}$-modules and isomorphism classes of supersingular elliptic curves over $\overline{{\mathbb {F}}_{p}}$. Then $E_i$ is the elliptic curve corresponding to $I_i$ under this bijection.

In particular one has $E_i\cong E$ if and only if $I_i$ is free as a ${\mathsf {O}}$-module generated by some vector $v_i\in {\mathsf {O}}^2$. In this case the map $E_i\hookrightarrow E^2$ is the one given by the vector $v_i$.

Proof

We have to show that the bijection

maps $I_1$ to the elliptic curve $E_1$. Indeed choose $v\in I_1\setminus \{0\}$. Then $v\in {\mathsf {O}}^2$ determines a map $\phi : E\rightarrow E^2$. Since $v\in I_1=\ker (f_1)$, one has ${{\,\mathrm{im}\,}}(\phi )\subseteq E_1$. Since $v\ne 0$ the map $\phi :E\longrightarrow E_1$ is an isogeny. One checks that $\phi$ is the isogeny constructed from the invertible left ${\mathsf {O}}$-ideal

$$\begin{aligned} \{a\in B | v a \in I_1 \}^{-1} \end{aligned}$$

in the construction in [15, Section 42.2]. $\square$

Example 4.9

Consider for example $E/{\mathbb {F}}_3$ with Weierstraß equation $y^2=x^3-x$. Choose a square root of -1 in ${\mathbb {F}}_9$ and denote it by i. Then E has the endomorphism $x\mapsto -x, \, y\mapsto i y$ defined over ${\mathbb {F}}_9$ also denoted i by abuse of notation. Therefore E has CM by the order ${\mathbb {Z}}[i]$. Since (3) is inert in ${\mathbb {Q}}(i)$ the curve E is supersingular and

$$\begin{aligned} {{\,\mathrm{End}\,}}(E)\otimes {\mathbb {Q}} = {\mathbb {Q}}[i,F]/(iF+Fi) \end{aligned}$$

is the endomorphism algebra. We can take

$$\begin{aligned} f=\begin{pmatrix} 3 &{} (1+i)F\\ -(1+i)F&{} 3 \end{pmatrix}\,. \end{aligned}$$

Then one decomposition as in the proposition is

$$\begin{aligned} f_1=\begin{pmatrix} 2 &{} (1+i)F\\ -(1+i)F&{} 3 \end{pmatrix},\quad f_2=\begin{pmatrix} 1&{} 0\\ 0 &{} 0 \end{pmatrix}\,. \end{aligned}$$

One computes that $I_1=\begin{pmatrix} -F\\ 1+i \end{pmatrix} {\mathsf {O}}$ and $I_2=\begin{pmatrix} 0\\ 1 \end{pmatrix} {\mathsf {O}}$. Hence

$$\begin{aligned} P_1=\begin{pmatrix} 1 &{} 0\\ \frac{(1+i)F}{3} &{} 0 \end{pmatrix},\, P_2=\begin{pmatrix} 0 &{} 0\\ \frac{-(1+i)F}{3} &{} 1 \end{pmatrix}\,. \end{aligned}$$

One checks that the formulas $f_1=P_2^{\dagger } f P_2,\, f_2=P_1^{\dagger } f P_1$ are indeed satisfied.

The following algorithm computes for a given f and an invertible right ${\mathsf {O}}$-module I all the sublattices $I_1\oplus I_2$ with properties (i)–(iii) of the last proposition with $I_1\cong I$. As it turns out this computation reduces to a short vector problem.

Proof

We prove the correctness of the algorithm. First we claim that the length of every vector in $I^{-1}\oplus I^{-1}$ is divisible by $p[I:{\mathsf {O}}]$. Indeed it suffices to show this for every localization at a prime number l. There exists an $a\in {\mathsf {O}}_{(l)}$ such that $I^{-1}={\mathsf {O}}_{(l)} a$. Therefore every element in $I^{-1}_{(l)}\oplus I^{-1}_{(l)}$ is of the form va for $v\in {\mathsf {O}}_{(l)}^2$. This implies that $\nu _l ((va)^{\dagger } f (va))=\nu _l(N(a) v^{\dagger } f v)\geqslant \nu _l(N(a))+\nu _l(p)=\nu _l([{\mathsf {O}}:I^{-1}])+\nu _l(p)=\nu _l([I:{\mathsf {O}}])+\nu _l(p)$. Since l was an arbitrary prime we conclude that the length of every vector in $I^{-1}\oplus I^{-1}$ is divisible by $p[I:{\mathsf {O}}]$. This implies that $S=\{v \in I^{-1}\oplus I^{-1}| v^{\dagger } f v = p [I:{\mathsf {O}}]\}$. In particular S will either be empty or the set of shortest vectors.

Let $v\in S$. Then we define $I_1=v I \subset {\mathsf {O}}^2$ and $I_2$ to be the f-orthogonal complement of $I_1$. Then $I_1,I_2$ are right ${\mathsf {O}}$-submodules of ${\mathsf {O}}^2$ satisfying i), ii), iii’). By Proposition 4.7 this corresponds to a decomposition $f=f_1+f_2$ where $f_1$ is given by the formula $\frac{f v v^{\dagger } f}{v^{\dagger } f v}$.

Conversely suppose we are given a decomposition $f=f_1+f_2$ with $I_1=\ker (f_1)\cong I$. Then $I_1$ will satisfy property iii’) of Proposition 4.7. This implies that a generator of the free rank 1 ${\mathsf {O}}_L(I)$-module²$I_1 I^{-1}$ occurs in S. This proves that $\{(f_1=\frac{f v v^{\dagger } f}{v^{\dagger } f v}, f_2=f-f_1)| v\in S\}$ gives all pairs as in Proposition 4.4 such that $\ker (f_1)\cong I$. Notice that this list will contain some duplicate elements. $\square$

5.4 Reducible Fibers II: Role of 2-torsion

Using the same situation as in Sect. 4.2 we want to further understand the reducible fibers of ${\mathfrak {D}}\rightarrow {\mathbb {P}}^1$. Notice that this is not fully answered by Proposition 4.4: If $D=E_1 \cup E_2$ is a reducible fiber of ${\mathfrak {D}}\rightarrow {\mathbb {P}}^1$, then $E_1$ and $E_2$ do not necessarily intersect in the origin but rather some point in $E^2[2]$. In this section we explain how to compute this 2-torsion point. First we need a definition:

Definition 4.10

Let A be an Abelian variety and D a symmetric divisor on A. Define the function $e^D_*: A[2]\rightarrow \{\pm 1\}, \, P \mapsto (-1)^{m_D(P)-m_D(0)}$ where $m_D(P)$ denotes the multiplicity of D at P.

The function $e^D_*$ has the following properties:

Proposition 4.11

Let A be an Abelian variety and D a symmetric divisor on A. Denote ${\mathcal {L}}={\mathcal {O}}(D)$.

• (i) $e^D_*$ depends only on ${\mathcal {L}}$.

• (ii) D is rationally equivalent to 0 if and only if D is algebraically equivalent to 0 and $e^D_*(P)=1,\, \forall P\in A[2]$.

• (iii) $e^D_*$ is a quadratic function whose associated bilinear form is the restriction of the commutator pairing on $K({\mathcal {L}}^2)$ to A[2].

• (iv) $e^D_*$ is locally constant in families, i.e., if S is a k-scheme and ${\mathfrak {D}}\subset A\times _k S$ is a symmetric divisor flat over S, then for any $P\in A[2](k)$ the function $|S|\rightarrow \{\pm 1\},\, x\mapsto e^{{\mathfrak {D}}_x}_*(P)$ is locally constant.

Proof

The first assertion is true because Mumford gives another definition for $e^D_*$ in terms of ${\mathcal {L}}$ and shows in [10, §2, Proposition 2] that it is equivalent to our definition. The second assertion follows from [10, §2, First Properties, iv)]. For the third assertion see [10, Corollary 1, p. 314]. For the fourth assertion notice that it follows easily from Mumford’s alternative definition that $|S|\rightarrow \{\pm 1\},\, x\mapsto e^{{\mathfrak {D}}_x}_*(P)$ is continuous in the Zariski topology. Here $\{\pm 1\}$ is considered as a closed subset of ${\mathbb {G}}_m$. $\square$

Corollary 4.12

Two fibers of ${\mathfrak {D}}\rightarrow {\mathbb {P}}^1$ are rationally equivalent divisors in $E^2$.

Proof

Indeed by Theorem 4.3 they both induce the polarization $\eta$. Therefore they are algebraically equivalent. Notice that by assumption ${\mathfrak {D}}$ is symmetric and thus Proposition 4.11 applies. By parts ii) and iv) we conclude that the fibers are rationally equivalent. $\square$

Remark 4.13

Although one could infer the corollary from the fact that the base of ${\mathfrak {D}}\rightarrow {\mathbb {P}}^1$ is a rational curve, we prefer this more involved argument because it generalizes to Li’s and Oort’s higher dimensional theory.

Definition 4.14

• For $y\in {\mathbb {P}}^1(k)$ arbitrary we denote ${\mathcal {L}}={\mathcal {O}}({\mathfrak {D}}_y)$. By corollary 4.12 this line bundle is independent of y. The letter ${\mathcal {L}}$ is reserved for this line bundle for the rest of this paper.

• Denote by

  $$\begin{aligned} e^{\mathfrak {D}}_*: E^2[2] \rightarrow \{\pm 1\} \end{aligned}$$

  the function $e^{\mathfrak {D}}_*=e^{{\mathfrak {D}}_y}_*$ for any $y\in |{\mathbb {P}}^1|$.

We are now ready to describe the formula for the 2-torsion point that is the intersection point of the components of a reducible fiber. Using the previous proposition this boils down to linear algebra over ${\mathbb {F}}_2$.

Consider a divisor $D=E_1\cup E_2$ as in Proposition 4.4. By Corollary 4.5 there is a point $x\in {\mathbb {P}}^1({\mathbb {F}}_{p^2})$ such that ${\mathcal {A}}_x\cong E_1^{(p)} \times E_2^{(p)}$ with the product polarization.

Lemma 4.15

Using the notation preceding the lemma there is a unique point $P\in E^2[2]$ such that $t_P(D)={\mathfrak {D}}_x$. Furthermore P can be computed as follows: Choose a basis ${\mathfrak {B}}$ of $E[2]^2$ as an ${\mathbb {F}}_2$-vector space. Take upper triangular matrices ${\mathfrak {Q}}, Q \in M_{4,4}({\mathbb {F}}_2)$ such that the quadratic functions $e^{{\mathfrak {D}}}_*$ and $e^{D}_*$ are given by $e^{\mathfrak {D}}_*( (v)_{\mathfrak {B}})=(-1)^{v^t {\mathfrak {Q}} v},\, e^{D}_*( (v)_{\mathfrak {B}})=(-1)^{v^t Q v}$. ${\mathfrak {Q}}+Q$ is a diagonal matrix and denote its diagonal by the vector $d\in {\mathbb {F}}_2^4$. Then

$$\begin{aligned} (Q+Q^t)^{-1} d \end{aligned}$$

is the coordinate vector of the point P in the basis ${\mathfrak {B}}$.

Proof

We know that ${\mathcal {A}}_x\cong E_1^{(p)} \times E_2^{(p)}$ and the polarization $\lambda _x$ is the product polarization by Corollary 4.5. Therefore $\lambda _x$ is induced by the symmetric divisor $E_1^{(p)} \times \{0\}+\{0\} \times E_2^{(p)}$. By assumption ${\mathfrak {C}}_x$ is another symmetric divisor inducing $\lambda _x$. Because two symmetric divisors inducing the same polarization are translates by a 2-torsion point, there exists a $P\in A_x[2]$ such that ${\mathfrak {C}}_x=t_P(E_1^{(p)} \times \{0\}+\{0\} \times E_2^{(p)})$. Now $E^2[2]\cong A_x[2]$ canonically, so by abuse of notation denote the preimage of P under this isomorphism also by P. Then $t_P(D)={\mathfrak {D}}_x$.

This proves the existence of P. To prove uniqueness it suffices to establish the formula. Indeed it is clear that $e^{\mathfrak {D}}_*(\cdot )=e^{t_P(D)}(\cdot )=e^{D}_*(P+\cdot )$. We claim that P is uniquely characterized by this property. This is a question about quadratic forms over ${\mathbb {F}}_2$. Define now $L={\mathcal {O}}(E_1+E_2)$. Then ${\mathcal {L}}, L$ are ample symmetric line bundles inducing the polarization $\eta$. Thus ${\mathcal {L}}, L$ are algebraically equivalent and by part (ii) of Proposition 4.11 one has ${\mathcal {L}}^2\cong L$. Part (iii) of Proposition 4.11 gives:

$$\begin{aligned} e_*^{\mathfrak {D}}(P_1+P_2)=e_*^{\mathfrak {D}}(P_1) e_*^{\mathfrak {D}}(P_2) e^{{\mathcal {L}}^2}(P_1,P_2)\, \forall P_1,P_2\in E^2[2] \end{aligned}$$

and similarly for D. Since ${\mathcal {L}}^2\cong L^2$, this implies that the bilinear forms associated to the quadratic functions $e_*^{\mathfrak {D}}, e_*^{D}$ agree. From that one deduces ${\mathfrak {Q}}+{\mathfrak {Q}}^t=Q+Q^t$ and thus ${\mathfrak {Q}}+Q$ is indeed a diagonal matrix.

On the other hand $e^{{\mathcal {L}}^2}(\cdot , \cdot )_{|{E^2[2]}}$ is non-degenerate because it is the restriction of a non-degenerate pairing to the 2-primary part. Therefore $Q+Q^t$ is invertible. We conclude that $P=((Q+Q^t)^{-1} d)_{\mathfrak {B}}$ is well-defined. An elementary computation shows that P is the unique point in $E^2[2]$ satisfying $e^{\mathfrak {D}}_*(\cdot )=e^{D}_*(P+\cdot )$ $\square$

5.5 Reducible Fibers III: Theta groups

In this section we continue our study of the reducible fibers of the map ${\mathfrak {D}}\rightarrow {\mathbb {P}}^1$. For the main algorithm it will be important to understand how two reducible fibers can be used to pin down an isomorphism of ${\mathcal {G}}({\mathcal {L}})$ with the Heisenberg group ${\mathcal {G}}(\alpha _p)$.

Suppose we are given two distinct reducible fibers ${\mathfrak {D}}_x, {\mathfrak {D}}_{x'}$. Then Corollary 4.5 gives a subgroup scheme ${\mathcal {H}} \subset E^2$ isomorphic to $\alpha _p$ such that ${\mathfrak {D}}_x$ is ${\mathcal {H}}$-invariant. Similarly we get ${\mathcal {H}}' \subset E^2$ isomorphic to $\alpha _p$ such that ${\mathfrak {D}}_{x'}$ is ${\mathcal {H}}'$-invariant. By Proposition 3.10${\mathcal {H}}$ and ${\mathcal {H}}'$ uniquely lift to level subgroups $\tilde{{\mathcal {H}}}$ (resp. $\tilde{{\mathcal {H}}'}$) inside ${\mathcal {G}}({\mathcal {L}})$.

Proposition 4.16

Use the notation preceding the proposition. For any isomorphism ${\mathcal {H}}{\mathop {\rightarrow }\limits ^{\sim }} \alpha _p$ there is a unique isomorphism $\phi :{\mathcal {G}}({\mathcal {L}}){\mathop {\rightarrow }\limits ^{\sim }} {\mathcal {G}}(\alpha _p)$ such that $\phi (\tilde{{\mathcal {H}}})=\{1\}\times \alpha _p \times \{0\}, \phi (\tilde{{\mathcal {H}}'})=\{1\}\times \{0\} \times \alpha _p$ and the diagram

commutes.

Proof

Immediate consequence of Lemma 3.13 and Corollary 4.5. $\square$

Remark 4.17

Notice that we do not fix an isomorphism ${\mathcal {H}}' \cong \alpha _p$, instead such an isomorphism is then determined by $\phi$. In our thesis we will explain how this isomorphism can be computed. One has to make the commutator pairing on ${\mathcal {G}}({\mathcal {L}})$ explicit. There are two distinct formulas for this computation. The first involves certain translation invariant vector fields on $E^2$. The second uses the action of Frobenius and certain endomorphisms of E on de Rham cohomology.

5.6 Construction of irreducible fibers

We drop now the assumption that k is algebraically closed. Instead k is any field containing ${\mathbb {F}}_{p^2}$. In this section we will explain our algorithm that constructs all the irreducible fibers of a Moret-Bailly family. To define a Moret-Bailly family one needs an hermitian positive definite matrix $f\in M_{2,2}({\mathsf {O}})$ inducing a polarization $\eta$ on $E^2$ with kernel $E^2[F]$. The basic idea is to use the information obtained from two reducible fibers of the family ${\mathfrak {D}} \rightarrow {\mathbb {P}}^1$. In order to obtain two reducible fibers we need to decompositions $f=f_1+f_2=f_1'+f_2'$ as in Proposition 4.4. The fibers will be distinct if and only if the sets $\{f_1,f_2\}$ and $\{f_1',f_2'\}$ are distinct by Corollary 4.6.

Now given $\{f_1,f_2\}$ (resp. $\{f_1',f_2'\}$) we can compute the corresponding reducible fiber $D_0$ (resp. $D_\infty$). From the divisor $D_0$ we can construct a subgroup scheme ${\mathcal {H}}\cong \alpha _p$ of $E^2$ using Corollary 4.5. Then using Lemma 2.4 we can choose an isomorphism of Hopf algebras $A_{{\mathcal {H}}}\cong k[z]/(z^p)$ such that the comultiplication is given by $z\mapsto z\otimes 1 + 1 \otimes z$. The next theorem explains how to compute the other fibers $D_x$ for $x=[t:1]\in {\mathbb {P}}^1(k)\setminus \{ [1:0]\}$. Indeed since all the $D_x$ are rationally equivalent it suffices to determine a rational function $g_x\in K(E^2)$ such that $(g_x)=D_x-D_0$. To start with there exists a rational function $g\in K(E^2)$ such that $(g)=D_{\infty }- D_0$. We claim that we can compute $g_x$ from g:

Theorem 4.18

In the notation preceding the Theorem let $g_{\mathcal {H}} \in K(E^2)\otimes _k A_{{\mathcal {H}}}$ denote the image of g under the map $K(E^2)\rightarrow K(E^2)\otimes _k A_{{\mathcal {H}}}$ describing the translation action of ${\mathcal {H}}$ on $E^2$.

Then if one takes $g_x\in K(E^2)$ to be the image of $g_{\mathcal {H}}$ under the $K(E^2)$-linear map

$$\begin{aligned} K(E^2)\otimes A_{{\mathcal {H}}} \rightarrow K(E^2) \end{aligned}$$

$$\begin{aligned} \rho \otimes z^{2i}\mapsto \frac{(2i)! (-t)^i \rho }{i! 2^i},\, \rho \otimes z^{2i+1} \mapsto 0 \end{aligned}$$

one has $(g_x)= D_x-D_0$

Proof

From the divisor $D_\infty$ we can construct a subgroup scheme ${\mathcal {H}}'\subset E^2$ using Corollary 4.5. Consider the line bundle ${\mathcal {L}}={\mathcal {O}}(D_0)$. There exists a unique level subgroup over ${\mathcal {H}}$ (resp. ${\mathcal {H}}'$) in ${\mathcal {G}}({\mathcal {L}})$ that we will by abuse of notation denote using the same letter. From Proposition 4.16 we get an isomorphism ${\mathcal {G}}({\mathcal {L}})\cong {\mathcal {G}}({\mathcal {H}})={\mathbb {G}}_m\times {\mathcal {H}} \times {\mathcal {H}}^D$ that maps ${\mathcal {H}}$ to $\{1\}\times {\mathcal {H}} \times \{0\}$ and ${\mathcal {H}}'$ maps to $\{1\} \times \{0\} \times {\mathcal {H}}^D$. By Theorem 3.15 there is an absolutely irreducible weight 1 representation of ${\mathcal {G}}({\mathcal {L}})$ on ${{\,\mathrm{H}\,}}^0(E^2,{\mathcal {L}})$. By Theorem 3.16 (or Riemann-Roch) we have $\dim _k({{\,\mathrm{H}\,}}^0(E^2,{\mathcal {L}}))=p$. On the other hand ${\mathcal {G}}({\mathcal {H}})$ also has a weight 1 representation on the p-dimensional k-vector space $A_{{\mathcal {H}}^D}$ given by

$$\begin{aligned} ((c, h, \chi )f)(\chi _0)=c \cdot \chi _0(h)\cdot f(\chi +\chi _0) \end{aligned}$$

for any k-scheme T and $c\in {\mathbb {G}}_m(T), h\in {\mathcal {H}}(T), \chi \in {\mathcal {H}}^D(T), \chi _0\in {\mathcal {H}}^D(T), f\in A_{{\mathcal {H}}^D}\otimes {{\,\mathrm{H}\,}}^0(T, {\mathcal {O}}_T)= {{\,\mathrm{Hom}\,}}_{\text {Sch}}({\mathcal {H}}^D_T, {\mathbb {A}}^1_T)$. Then Theorem 3.16 implies that there exists an isomorphism of k-vector spaces

$$\begin{aligned} \psi : A_{{\mathcal {H}}^D}{\mathop { \longrightarrow }\limits ^{\sim }} {{\,\mathrm{H}\,}}^0(E^2, {\mathcal {L}}) \end{aligned}$$

that identifies the two representations. By Schur’s lemma $\psi$ is uniquely determined up to a scalar.

We have $(A_{{\mathcal {H}}^D})^{{\mathcal {H}}^D}=k$. On the other hand we claim that ${{\,\mathrm{H}\,}}^0(E^2, {\mathcal {L}})^{{\mathcal {H}}'}=k g$. Indeed g gives an element in ${{\,\mathrm{H}\,}}^0(E^2, {\mathcal {L}})={{\,\mathrm{H}\,}}^0(E^2, {\mathcal {O}}(D_0))$. Furthermore g is ${\mathcal {H}}'$-invariant by Proposition 3.10 because it maps to 1 under the isomorphism ${{\,\mathrm{H}\,}}^0(E^2, {\mathcal {O}}(D_0)){\mathop {\rightarrow }\limits ^{\sim }} {{\,\mathrm{H}\,}}^0(E^2, {\mathcal {O}}(D_\infty )),\, \rho \mapsto g^{-1} \rho$. This proves the claim. Now the claim implies that we can without loss assume $\psi (1)=g$. Consider now the action of ${\mathcal {H}}$ on $A_{{\mathcal {H}}^D}$ given by restricting the representation of ${\mathcal {G}}({\mathcal {H}})$. This determines a map

$$\begin{aligned} A_{{\mathcal {H}}^D}\rightarrow A_{{\mathcal {H}}^D}\otimes A_{{\mathcal {H}}}\,. \end{aligned}$$

It follows from the definition of the representation of ${\mathcal {G}}({\mathcal {H}})$ that this map is given by multiplying with the element in $A_{{\mathcal {H}}^D}\otimes A_{{\mathcal {H}}}=A_{{\mathcal {H}}}^\vee \otimes A_{{\mathcal {H}}}$ which comes from Cartier duality. To make this explicit notice that we have chosen an isomorphism ${\mathcal {H}}\cong \alpha _p$. The autoduality of $\alpha _p$ gives an isomorphism ${\mathcal {H}}^D\cong \alpha _p$. This gives a generator of $A_{{\mathcal {H}}^D}$ that we will also denote by z (this can not cause any confusion). Then the map

$$\begin{aligned} A_{{\mathcal {H}}^D}\rightarrow A_{{\mathcal {H}}^D}\otimes A_{{\mathcal {H}}} \end{aligned}$$

is given by multiplication with $\exp (z\otimes z)\in A_{{\mathcal {H}}^D}\otimes A_{{\mathcal {H}}}$. In particular 1 maps to $\exp (z\otimes z)$. Here $\exp (\cdot )$ denotes the usual exponential series. Notice that the expression $\exp (z\otimes z)$ is well-defined although $\text {char}(k)=p$ since $z^p=0$.

On the other hand ${\mathcal {H}}$ also acts on ${{\,\mathrm{H}\,}}^0(E^2, {\mathcal {L}})$ by restricting the action of ${\mathcal {G}}({\mathcal {L}})$. This gives a map

$$\begin{aligned} {{\,\mathrm{H}\,}}^0(E^2, {\mathcal {L}})\rightarrow {{\,\mathrm{H}\,}}^0(E^2, {\mathcal {L}}) \otimes A_{{\mathcal {H}}}\,. \end{aligned}$$

By Proposition 3.19 this action is given by the translation action on $K(E^2)$ using the identification

$$\begin{aligned} {{\,\mathrm{H}\,}}^0(E^2,{\mathcal {L}})={{\,\mathrm{H}\,}}^0(E^2, {\mathcal {O}}(D_0))=\{\rho \in K(E^2)| (\rho )+D_0 \text { is effective}\}\,. \end{aligned}$$

In particular g maps to $g_{{\mathcal {H}}}$ under this map. Because the isomorphism $\psi$ is equivariant, one has $(\psi \otimes {{\,\mathrm{id}\,}}_{A_{{\mathcal {H}}}})(\exp (z\otimes z))=g_{{\mathcal {H}}}$.

We will now focus on the point $x=[t:1]\in {\mathbb {P}}^1$. Indeed this point determines a map $\alpha _p \rightarrow \alpha _p \times \alpha _p,\, s\mapsto (ts, s)$. Let us denote by ${\mathcal {H}}_x$ the image of the composition $\alpha _p\rightarrow \alpha _p \times \alpha _p \cong {\mathcal {H}}\times {\mathcal {H}}^D$. By Lemma 4.2 and Proposition 3.4 there is a unique level subgroup in ${\mathcal {G}}({\mathcal {H}})$ above ${\mathcal {H}}_x$. We will denote by abuse of notation this level subgroup by ${\mathcal {H}}_x$. Its image under the isomorphism ${\mathcal {G}}({\mathcal {H}}) \cong {\mathcal {G}}({\mathcal {L}})$ is also denoted ${\mathcal {H}}_x$. Now the desired rational function $g_x$ will be a generator of the 1-dimensional vector space ${{\,\mathrm{H}\,}}^0(E^2, {\mathcal {L}})^{{\mathcal {H}}_x}$ (see Proposition 3.18). On the other hand $(A_{{\mathcal {H}}^D})^{{\mathcal {H}}_x}$ is generated by the element $\exp (\frac{-tz^2}{2})$, see [9, proof of Proposition 1.5]. Therefore we can take $g_x=\psi (\exp (\frac{-t z^2}{2}))$. The theorem follows because $\exp (\frac{-t z^2}{2})\in A_{{\mathcal {H}}^D}$ is the image of $\exp (z\otimes z)$ under the map $A_{{\mathcal {H}}^D}\otimes A_{{\mathcal {H}}} \rightarrow A_{{\mathcal {H}}^D}$

$\rho \otimes z^{2i}\mapsto \frac{(2i)! (-t)^i \rho }{i! 2^i},\, \rho \otimes z^{2i+1} \mapsto 0$. $\square$

Remark 4.19

Notice that the coordinate system on ${\mathbb {P}}^1$ used in the previous theorem is not the same as the coordinate system in section 4.1. For the coordinate system in section 4.1 a point $[t_0:t_1]$ corresponds to the embedding $\alpha _p {\mathop {\hookrightarrow }\limits ^{(t_0,t_1)}} \alpha _p^2 \cong E^2[F]$, where the last isomorphism comes from an isomorphism $\alpha _p \cong E[F]$.

On the other hand for the coordinate system in the previous theorem a point $[t_0:t_1]$ corresponds to the embedding $\alpha _p {\mathop {\hookrightarrow }\limits ^{(t_0,t_1)}} \alpha _p^2 \cong {\mathcal {H}}\times {\mathcal {H}}'=E^2[F]$, where the isomorphism $\alpha _p \cong {\mathcal {H}}'$ is the one induced by Proposition 4.16 from the choice of an isomorphism $\alpha _p\cong {\mathcal {H}}$.

With the first coordinate system one can directly write down the image of $\alpha _p \hookrightarrow E^2$ as a closed subgroup scheme. This is not possible with the second coordinate system. It is possible to compute the change of coordinates matrix, see also Remark 4.17.

We are ready to explain the main algorithm.

Proof

We prove the correctness of the algorithm. Indeed Theorem 4.18 gives us a rational function $g_x$ such that $(g_x)={\mathfrak {D}}_x - {\mathfrak {D}}_0$. Therefore ${\mathfrak {D}}_x = {\mathcal {V}}(g_x)$. The map ${\mathfrak {D}}_x\rightarrow {\mathfrak {C}}_x$ is purely inseparable of degree p. By [13, Tag 0CCX] there is an isomorphism ${\mathfrak {C}}_x \cong {\mathfrak {D}}_x^{\text {norm},(p)}$. $\square$

Remark 4.20

The algorithm constructs the divisor ${\mathfrak {D}}_x$ without making any field extensions. Indeed notice that the condition $F^2+p=0$ implies that all endomorphism and all the 2-torsion points of E are defined over ${\mathbb {F}}_{p^2}$ because the $p^2$-Frobenius acts trivially. It follows that ${\mathfrak {D}}\subset E^2$ is defined over ${\mathbb {F}}_{p^2}$ as a closed subscheme. This implies that ${\mathfrak {C}}$ and the map ${\mathfrak {C}}\rightarrow {\mathbb {P}}^1$ are also defined over ${\mathbb {F}}_{p^2}$. The algorithm correctly computes the fibers of this map up to isomorphism over the ground field (not over its algebraic closure).

Remark 4.21

Notice that steps 1-6 are independent of x. Thus after performing steps 1-6 we can quickly compute many fibers.

In fact we could theoretically even construct the generic fiber (or a model for ${\mathfrak {C}}\rightarrow {\mathbb {P}}^1$) by applying the algorithm to the generic point. However this is very expensive in practice because normalizing the very singular curve ${\mathfrak {D}}_x$ will take too long over a function field. By replacing step 8 with a technique that avoids normalization one can remedy this (see the author’s PhD thesis for details).

5.7 Examples

We have implemented Algorithms 1 and 2 in MAGMA. The source code is available on GitHub via https://github.com/Andreas-Pieper/Supersingular. We present some examples that we computed using these programs.

Example 4.22

Consider $p= 1601$ and $B=\left( \frac{-3,-p}{{\mathbb {Q}}} \right) =\langle 1,i,j,k \rangle _{{\mathbb {Q}}}$ with multiplication given by $i^2=-3,j^2=-p, ij=k=-ji$ and the maximal order ${\mathsf {O}}=\langle 1, \frac{1}{2} + \frac{1}{2}i, \frac{1}{2} + \frac{1}{6} i + \frac{1}{2}j + \frac{1}{6}k, -\frac{1}{2} + \frac{1}{6}i - \frac{1}{3} k \rangle _{{\mathbb {Z}}}$ of B. This maximal order contains j, which generates a two-sided ideal of reduced norm p, and thus there exists a supersingular elliptic curve $E/\overline{{\mathbb {F}}}_p$ defined over ${\mathbb {F}}_p$ with endomorphism algebra ${\mathsf {O}}$ (see [15, Lemma 42.4.1]). The geometric Frobenius will satisfy $F^2+p=0$ because of the Hasse-Weil bound. Choose the matrix

$$\begin{aligned} f=\begin{pmatrix} 1601 &{} 40j\\ -40j &{} 1601 \end{pmatrix}\in M_{2,2}({\mathsf {O}})\,. \end{aligned}$$

We apply Algorithm 1 to f and all the right ideal classes of ${\mathsf {O}}$ and find $8000=5p-5$ decompositions $f=f_1+f_2$ as in Proposition 4.7. The first few are:

$$\begin{aligned}&f_1\in \Big \lbrace \begin{pmatrix} 1601 &{} 40j\\ -40j &{} 1600 \end{pmatrix}, \, \begin{pmatrix} 1054 &{} \frac{27}{2} - \frac{1}{6}i + \frac{53}{2}j - \frac{1}{6}k\\ \frac{27}{2} + \frac{1}{6}i - \frac{53}{2} j + \frac{1}{6}k &{} 1067 \end{pmatrix} \\&\quad \begin{pmatrix} 1094 &{} 13 + 27j\\ 13 - 27j &{} 1067 \end{pmatrix}, \, \begin{pmatrix} 1054 &{} \frac{27}{2} + \frac{1}{6} i + \frac{53}{2}j + \frac{1}{6} k\\ \frac{27}{2} - \frac{1}{6} i - \frac{53}{2} j - \frac{1}{6} k &{} 1067 \end{pmatrix}, \ldots \Big \rbrace \,. \end{aligned}$$

The computation took 4min 50s on a 3.10GHz dual Intel processor.

Example 4.23

Consider $p=5$. The field extension ${\mathbb {F}}_{5^2}/{\mathbb {F}}_5$ is generated by a primitive third root of unity $\zeta _3\in {\mathbb {F}}_{5^2}$. We will take the supersingular elliptic curve $E/ \overline{{\mathbb {F}}}_5: y^2=x^3+1$. Its endomorphism algebra is a maximal order in

$$\begin{aligned} B={\mathbb {Q}}[\zeta _3, F]/(\zeta _3^2+\zeta _3+1, F^2+5, \zeta _3 F - F \zeta _3^2) \end{aligned}$$

where $\zeta _3$ is the endomorphism $E\rightarrow E,\, (x,y)\mapsto (\zeta _3 x, y)$ and F is the geometric Frobenius.

We apply Algorithm 2 with input

$$\begin{aligned} f= & {} \begin{pmatrix} 5 &{} 2 F\\ -2F &{} 5 \end{pmatrix}\in M_{2,2}({\mathsf {O}}) \\ f_1= & {} \begin{pmatrix} 4 &{} 2 F\\ -2F &{} 5 \end{pmatrix},\, f_2=\begin{pmatrix} 1&{} 0\\ 0 &{} 0 \end{pmatrix}\in M_{2,2}({\mathsf {O}}) \\ f_1'= & {} \begin{pmatrix} 5 &{} 2 F\\ -2F &{} 4 \end{pmatrix},\, f_2'=\begin{pmatrix} 0 &{} 0\\ 0 &{} 1 \end{pmatrix}\in M_{2,2}({\mathsf {O}})\,. \end{aligned}$$

And $x=[a:1]\in {\mathbb {P}}^1({\mathbb {F}}_{5^4})$, where $a\in {\mathbb {F}}_{5^4}$ is a root of the irreducible polynomial $x^4 + 4x^2 + 4x + 2 \in {\mathbb {F}}_5[x]$. The resulting curve ${\mathfrak {C}}_x$ is computed on a 3.10GHz dual Intel processor in 4.5s. We get the hyperelliptic model

$$\begin{aligned} {\mathfrak {C}}_x: y^2= & {} (4a^3 + 3a^2 + 1) x^5 + (4 a^3 + a^2 + 4a + 3) x^4 \\&+ (3a^3 + 3a^2 + 2a) x^3+ (4a^3 + 4a^2)x^2+ \\&(4a^3 + 2a^2 + 3a + 3)x + (3a^3 + 3a + 3)\,. \end{aligned}$$

N.B.: The coefficients on the right are expressed in the ${\mathbb {F}}_5$-basis $a^3,a^2,a,1$ of ${\mathbb {F}}_{5^4}$. Replacing a by another element of ${\mathbb {F}}_{5^4}$ does not give a curve with a supersingular Jacobian in general.

Remark 4.24

The matrices f describing the polarization $\eta$ were found by hand in these examples. In general for a fixed p there are finitely many choices for f up to conjugation by $\text {Gl}_2({\mathsf {O}})$. These are in bijection with the set of isomorphism classes of quaternion hermitian lattices in a fixed genus. There is an algorithm which computes a list of representatives for the isomorphism classes. This uses the so-called method of neighboring lattices. The method was developed by M. Kneser for the classification of quadratic lattices over ${\mathbb {Z}}$ (see [4]).

The method generalizes to quaternion hermitian lattices by using the general strong approximation theorem of M. Kneser [5] applied to the group of isometries of a quaternion hermitian lattice. The quaternion hermitian case is less technical because the latter group is simply-connected whereas $\text {SO}_n$ is not.