Complex Multiplication and Class Fields

Q: Why does CM only occur for imaginary quadratic orders?

Because the endomorphism ring embeds in the endomorphisms of the complex torus, which forces it to be an order in an imaginary quadratic field for a curve over a field of characteristic zero. In positive characteristic supersingular curves have a larger, non-commutative endomorphism ring — a genuinely different phenomenon.

Q: How large can the CM discriminant be in practice?

The class polynomial's height grows with |D|, so practical construction uses discriminants with small class number where possible. Modern implementations handle class numbers into the thousands using small class invariants and analytic evaluation.

Q: Is the CM method a security concern in cryptography?

Curves with very small CM discriminant have extra structure that has been used in some attacks and speedups, so standards typically require a large CM discriminant. Curves generated by the CM method for pairing applications are chosen deliberately and analysed accordingly.

Executive summary

Extra endomorphisms force the j-invariant to be an algebraic integer

Most elliptic curves have only the multiplication-by-n endomorphisms. A curve with complex multiplication has more, and its endomorphism ring is an order in an imaginary quadratic field. The j-invariant of such a curve is then an algebraic integer generating the Hilbert class field of that quadratic field, with degree equal to the class number. Computing the minimal polynomial of that j-invariant gives a constructive route to curves with prescribed group order.

Learning objectives

Define complex multiplication and identify the endomorphism ring.
Relate CM curves to ideal classes of an imaginary quadratic order.
Compute a Hilbert class polynomial and state its degree.
Explain why Weber polynomials are preferred in practice.
Apply the CM method to construct a curve with a chosen order.

Section 01Endomorphisms

An endomorphism is a morphism of the curve to itself fixing the identity. Over a field of characteristic zero there are two possibilities.

GenericEnd(E) = ℤ

Only multiplication by integers. This is the case for almost all curves.

CMEnd(E) = an order in an imaginary quadratic field

Extra endomorphisms exist. The discriminant of that order is the CM discriminant, and it controls everything about the curve's arithmetic.

The integrality theorem

If E has CM by an order of discriminant D, then j(E) is an algebraic integer of degree h(D) over ℚ, and it generates the ring class field of that order. This is the central result linking elliptic curves to class field theory, and it is why h(−163) = 1 makes exp(π√163) nearly an integer.

Section 02Hilbert class polynomials

The Hilbert class polynomial H_D is the minimal polynomial of the j-invariant of a curve with CM by the order of discriminant D. Its roots correspond to the ideal classes.

AlgorithmComputing the Hilbert class polynomialin: D < 0 → out: H_D(x) ∈ ℤ[x] of degree h(D)

Enumerate the reduced binary quadratic forms of discriminant D; there are h(D) of them.
For each form (a, b, c), set τ ← (−b + √D)/(2a) in the upper half plane.
Evaluate j(τ) numerically to high precision, using the q-expansion with q = e^2πiτ. Convergence is rapid since |q| is small.
Form H_D(x) = ∏(x − j(τ_i)) numerically.
Round the coefficients to integers. Valid only if the precision provably exceeds the coefficient size.
Verify the polynomial is irreducible of degree h(D).

Coefficient growth is the limiting factor

The height of H_D grows roughly like √|D| log|D|, so for even moderate |D| the coefficients have thousands of digits. This is why alternative class invariants are used in practice.

Section 03Weber polynomials and smaller invariants

Weber's functions generate the same field but with much smaller coefficients — often smaller by a factor of dozens in height. The resulting Weber class polynomial is computed the same way, and the j-invariant is recovered from a root by an explicit rational transformation.

Class invariants in practice
Invariant	Relative height	Applicability
j-invariant	1 (baseline)	Always valid; the reference definition
Weber f functions	Roughly 1/36 to 1/72	Requires congruence conditions on D
Double eta quotients	Smaller still in favourable cases	Conditions on D and on the chosen primes
Atkin invariants	Small	Selected by the splitting behaviour of small primes

Always verify after transforming

Recovering j from a smaller invariant involves a transformation valid only under specific congruence conditions on D. Implementations must check those conditions and then confirm the resulting curve really has the intended CM discriminant, since an invalid transformation produces a plausible but wrong curve.

Section 04The CM method for curve construction

Stage 01Choose D and pFind D and a prime p with 4p = u² + |D|v², solved by Cornacchia's algorithm. The candidate group orders are then p + 1 ± u.
Stage 02Check the orderTest whether either candidate has the desired property — prime, or with a large prime factor. If not, try another p.
Stage 03Compute the class polynomialBuild H_D or a Weber equivalent, and find a root modulo p.
Stage 04Construct the curveDerive a and b from the root; test a random point to select between the curve and its twist.

Use

Elliptic curve primality proving

Atkin–Morain builds curves of known order over the candidate prime, avoiding the cost of general point counting entirely.

Use

Pairing-friendly curves

Curves with prescribed embedding degree for pairing-based cryptography are constructed by CM families.

Use

Prescribed group order

Where a specific group order or structure is required, the CM method supplies it directly rather than by search.

ReferenceFrequently asked questions

Why does CM only occur for imaginary quadratic orders?

Because the endomorphism ring embeds in the endomorphisms of the complex torus, which forces it to be an order in an imaginary quadratic field for a curve over a field of characteristic zero. In positive characteristic supersingular curves have a larger, non-commutative endomorphism ring — a genuinely different phenomenon.

How large can the CM discriminant be in practice?

The class polynomial's height grows with |D|, so practical construction uses discriminants with small class number where possible. Modern implementations handle class numbers into the thousands using small class invariants and analytic evaluation.

Is the CM method a security concern in cryptography?

Curves with very small CM discriminant have extra structure that has been used in some attacks and speedups, so standards typically require a large CM discriminant. Curves generated by the CM method for pairing applications are chosen deliberately and analysed accordingly.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Complex Multiplication and Class Fields. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat Complex Multiplication and Class Fields as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—class, section, complex, multiplication, curves—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Complex Multiplication and Class Fields?