Extra endomorphisms force the j-invariant to be an algebraic integer
Most elliptic curves have only the multiplication-by-n endomorphisms. A curve with complex multiplication has more, and its endomorphism ring is an order in an imaginary quadratic field. The j-invariant of such a curve is then an algebraic integer generating the Hilbert class field of that quadratic field, with degree equal to the class number. Computing the minimal polynomial of that j-invariant gives a constructive route to curves with prescribed group order.
Learning objectives
- Define complex multiplication and identify the endomorphism ring.
- Relate CM curves to ideal classes of an imaginary quadratic order.
- Compute a Hilbert class polynomial and state its degree.
- Explain why Weber polynomials are preferred in practice.
- Apply the CM method to construct a curve with a chosen order.
Section 01Endomorphisms
An endomorphism is a morphism of the curve to itself fixing the identity. Over a field of characteristic zero there are two possibilities.
Only multiplication by integers. This is the case for almost all curves.
Extra endomorphisms exist. The discriminant of that order is the CM discriminant, and it controls everything about the curve's arithmetic.
If E has CM by an order of discriminant D, then j(E) is an algebraic integer of degree h(D) over ℚ, and it generates the ring class field of that order. This is the central result linking elliptic curves to class field theory, and it is why h(−163) = 1 makes exp(π√163) nearly an integer.
Section 02Hilbert class polynomials
The Hilbert class polynomial HD is the minimal polynomial of the j-invariant of a curve with CM by the order of discriminant D. Its roots correspond to the ideal classes.
- Enumerate the reduced binary quadratic forms of discriminant D; there are h(D) of them.
- For each form (a, b, c), set τ ← (−b + √D)/(2a) in the upper half plane.
- Evaluate j(τ) numerically to high precision, using the q-expansion with q = e2πiτ. Convergence is rapid since |q| is small.
- Form HD(x) = ∏(x − j(τi)) numerically.
- Round the coefficients to integers. Valid only if the precision provably exceeds the coefficient size.
- Verify the polynomial is irreducible of degree h(D).
The height of HD grows roughly like √|D| log|D|, so for even moderate |D| the coefficients have thousands of digits. This is why alternative class invariants are used in practice.
Section 03Weber polynomials and smaller invariants
Weber's functions generate the same field but with much smaller coefficients — often smaller by a factor of dozens in height. The resulting Weber class polynomial is computed the same way, and the j-invariant is recovered from a root by an explicit rational transformation.
| Invariant | Relative height | Applicability |
|---|---|---|
| j-invariant | 1 (baseline) | Always valid; the reference definition |
| Weber f functions | Roughly 1/36 to 1/72 | Requires congruence conditions on D |
| Double eta quotients | Smaller still in favourable cases | Conditions on D and on the chosen primes |
| Atkin invariants | Small | Selected by the splitting behaviour of small primes |
Recovering j from a smaller invariant involves a transformation valid only under specific congruence conditions on D. Implementations must check those conditions and then confirm the resulting curve really has the intended CM discriminant, since an invalid transformation produces a plausible but wrong curve.
Section 04The CM method for curve construction
- Stage 01Choose D and pFind D and a prime p with 4p = u² + |D|v², solved by Cornacchia's algorithm. The candidate group orders are then p + 1 ± u.
- Stage 02Check the orderTest whether either candidate has the desired property — prime, or with a large prime factor. If not, try another p.
- Stage 03Compute the class polynomialBuild HD or a Weber equivalent, and find a root modulo p.
- Stage 04Construct the curveDerive a and b from the root; test a random point to select between the curve and its twist.
Elliptic curve primality proving
Atkin–Morain builds curves of known order over the candidate prime, avoiding the cost of general point counting entirely.
Pairing-friendly curves
Curves with prescribed embedding degree for pairing-based cryptography are constructed by CM families.
Prescribed group order
Where a specific group order or structure is required, the CM method supplies it directly rather than by search.
ReferenceFrequently asked questions
Why does CM only occur for imaginary quadratic orders?
Because the endomorphism ring embeds in the endomorphisms of the complex torus, which forces it to be an order in an imaginary quadratic field for a curve over a field of characteristic zero. In positive characteristic supersingular curves have a larger, non-commutative endomorphism ring — a genuinely different phenomenon.
How large can the CM discriminant be in practice?
The class polynomial's height grows with |D|, so practical construction uses discriminants with small class number where possible. Modern implementations handle class numbers into the thousands using small class invariants and analytic evaluation.
Is the CM method a security concern in cryptography?
Curves with very small CM discriminant have extra structure that has been used in some attacks and speedups, so standards typically require a large CM discriminant. Curves generated by the CM method for pairing applications are chosen deliberately and analysed accordingly.
NavigateContinue in this stream
Curated next steps from this page. The site also surfaces algorithmically related reading below.
ProvenanceSources and further reading
This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.