Supersingular Elliptic Curves Without Inseparable Small Degree Endomorphisms

1.1. Rank 3 Lattices and Ternary Quadratic Forms.

• A rank 3 quadratic lattice pairs a rank 3 lattice with an integral ternary quadratic form, whose minimum is its least nonzero integer-vector value.For an Eisenstein-reduced form, the diagonal coefficients give its successive minima, and its standard basis realizes them.Source: §1.1 · pp. 4–5

1.2. Voronoi Theory and the Perfect Form.

• Up to positive scaling and integral equivalence, Q0 is the unique perfect ternary quadratic form; a ternary form can be parameterized by its six evaluations on Q0's minimal vectors.These six integer coordinates uniquely determine the form hλ.Source: §1.2 · pp. 5–6

1.3. The Gross Lattice.

• The Gross lattice OT = τ(O) is a rank 3 trace-zero lattice isomorphic to O/Z, representing nonscalar endomorphisms of the curve under the Deuring correspondence.Here O is the curve's endomorphism ring and τ(x) = 2x − trd(x).Source: §1.3 · p. 6

2.1. An Integral Ternary-Form Reformulation.

• An isogeny to the Frobenius conjugate corresponds to an inseparable endomorphism, and the normalized determinant form on the Gross lattice has minimum δE.The criterion relates trace-zero endomorphisms of degree ℓp to rank 2 Gross-lattice sublattices of determinant 4ℓp.Source: §2.1 · pp. 6, 8
• A supersingular curve E/Fp has δE = n exactly when a positive definite integral ternary quadratic form has minimum n and discriminant p.This equivalence is Proposition 2.3.Source: §2.1 · p. 8

2.2. Constructing Curves at Prescribed Distances.

• Every finite nonempty set of positive integers occurs simultaneously as δE-values for supersingular curves in infinitely many prime characteristics.The construction uses one-parameter families of forms and the Chinese remainder theorem to choose a common prime discriminant.Source: §2.2 · p. 10
• For each positive integer n, infinitely many prime characteristics admit a curve with δE = n; for each k, sufficiently large primes in a suitable arithmetic progression admit curves realizing every value from 1 through k.These conclusions strengthen the cited conjectures about attainable δE-values.Source: §2.2 · p. 11
• The singleton construction yields prime candidates of size cubic in n, matching the Hermite lower bound up to a constant factor, but primality in the growing candidate interval is only heuristic.The text notes that the required estimate for this growing family of moduli is not proved, even under GRH.Source: §2.2 · p. 12
• Prescribing δE for one curve in characteristic p establishes δ(p) ≥ n but does not determine the maximum over all curves or resolve the conjectured surjectivity of p ↦ δ(p).Another curve in the same characteristic may have a larger δE.Source: §2.2 · p. 12

Explicit Convergence to the Perfect Form

• For n ≥ 25e^2, near-Hermite forms are integrally equivalent to nQ0 + hλ, with λmin = 0 and every coefficient of hλ bounded in absolute value by 57e.Thus the possible perturbations belong to a bounded finite set independent of n.Source: §3 · p. 13
• The leading discriminant contribution of hλ is wt(λ)n^2, and disc(Q) > 2(n + d)^3 forces wt(λ) > 6d.For sufficiently large n, the weight determines an interval of length comparable to n^2 containing the discriminant.Source: §3 · p. 16
• If λ ≥ 0, λmin = 0, and wt(λ) ≤ n, then nQ0 + hλ is positive definite with minimum n; if 2 wt(λ) < n, its six shortest vector pairs are those of S(Q0).For sufficiently large n, these shortest pairs can be recovered from the form and identify the λ-coordinates.Source: §3 · pp. 16–17

3. Explicit Convergence to the Perfect Form

• The constant 3000 keeps the hypothesis simple but is not optimal; for prime discriminants, it can be replaced by a substantially smaller computable bound.See Remark 4.3 for the prime-discriminant bound.Source: §3 · p. 19
• Theorem 3.7’s parameterization supports an algorithm to detect and construct supersingular curves with near-maximal δE and a count of primes p with near-maximal δ(p).These applications are developed in Sections 4 and 5, respectively.Source: §3 · p. 19

General near-maximal classification

• For each deficit d, a finite cubic family Pd characterizes primes for which some supersingular E/Fp has δE equal to the specified value.The criterion follows by parameterizing forms of minimum n and discriminant p as nQ0 + hλ, then testing whether p = Pλ(n).Source: §4 · pp. 19–20

Constructing the cubic families

• The families satisfy #Pd = O((d + 1)^4), and constructing Pd takes O((d + 1)^4 log^2(d + 1)) bit operations.The polynomials are computed from orbit representatives under the S4-action.Source: §4 · pp. 20–21

Algorithm for bounded deficits

• For every D ≥ 0, an algorithm detects whether δ(p) is within D of its upper bound using O((D + 1)^5 log^2 p) bit operations under the stated lower bound on p.The theorem’s lower-bound constants are inherited from a uniform bound and are not intended to be sharp.Source: §4 · p. 21

Maximal case: nine cubics

• For n ≥ 27 and 2n^3 ≤ p < 2(n + 1)^3, p is wisde exactly when p = Pi(n) for one of nine explicit cubics.The nine candidates are obtained after filtering the d = 0 family: 37 cubics have a fixed divisor and 23 others cannot take prime values for n ≥ 27.Source: §4 · p. 22

Distribution of maximal cases

• The classification gives an unconditional upper bound, showing wisde primes are asymptotically negligible among all primes; all but finitely many are covered by Corollary 4.4, with at most nine Pi(n) values per n.Source: §4 · p. 22

Prime values and infinitude

• Whether infinitely many primes are wisde is equivalent to whether at least one of the nine cubics takes prime values infinitely often, which remains unproved unconditionally.The Bateman–Horn conjecture implies infinitude; an unconditional proof would require establishing infinitely many prime values for an irreducible cubic without a fixed divisor.Source: §4 · pp. 22–24

5. Prime Characteristics Admitting Near-Maximal Frobenius Distance

• For almost all primes p, the gap Δ(p) is at least p^1/6−o(1), substantially larger than the conjectured O(log p) bound [3, Conjecture 6.8].The argument suggests, but does not prove, that Δ(p) = p^1/6+o(1).Source: §5 · pp. 24, 25, 27
• The proof first counts O(D^5) cubics, each with O(X^1/3) values, yielding a preliminary gap lower bound of p^2/15−o(1); concentration in their values improves it.The improved counting confines relevant primes in each interval to six subintervals of total length O(m(D+1)^2).Source: §5 · pp. 25–26
• For fixed D, relevant primes in each interval I_m lie in six subintervals of total length O(m(D+1)^2), using cubic evaluations Pλ(m−d).The interval is I_m = [2m^3, 2(m+1)^3).Source: §5 · pp. 25–26
• A heuristic predicts Δ(p) ≤ p^1/6+o(1) for almost all primes, assuming enough viable cubics and sufficiently well-distributed values.The required assumptions are unproved and not clearly available even under Bateman–Horn.Source: §5 · p. 27

Appendix A. Proof of Proposition 2.3

• For a supersingular curve E/Fp, the form QE on the exterior square of the trace-zero order is integral and positive definite, with min(QE) = δE.Its values are normalized determinants, represented by reduced norms divided by p.Source: Appendix A · pp. 28–29
• The Gram matrix of QE is 1/(4p) times the adjugate of the reduced-norm Gram matrix, and its discriminant is p.The determinant computation uses det(GOT) = 4p^2 and yields the discriminant assertion.Source: Appendix A · pp. 28–29
• Conversely, a positive definite integral ternary form of discriminant p gives a maximal order in Bp,∞ and hence a supersingular curve with δE equal to its minimum.The even Clifford correspondence constructs the order, and the Deuring correspondence supplies the curve.Source: Appendix A · pp. 29–30

Appendix B. A 256-Bit Example for Remark 2.7

• The example uses a 256-bit prime and returns a supersingular curve E/Fp2 with δE = n ≈ 284.The curve’s j-invariant is given in terms of the supplement’s field generator.Source: Appendix B · p. 30
• Finding the parameters and maximal order took 0.388 seconds.Source: Appendix B · p. 30
• The constructive Deuring step, using the implementation accompanying, took 13 minutes.Source: Appendix B · p. 30

Appendix C. Details for Lemma 3.1

• For a specified domain Dε, each point can be moved to a point (uD,v,w) in D with |u−uD| ≤ ε.The proof restricts the possible u-coordinates in D while holding v and w fixed.Source: Appendix C · p. 31
• The proof establishes d1((u,v,w), A) ≤ 4R(u,v,w) by dividing D according to the sign of u; for 0 ≤ u,v,w ≤ 1, a nearest point can be chosen among four points of A in {0,1}3.Source: Appendix C · p. 31
• The distance-bound proof reduces one region to checking nonnegativity of H on a polytope P, then uses concavity and its vertex values.The listed vertex values are 6, 3, 3, 0, 0, 0, and 4/27.Source: Appendix C · p. 32
• A unimodular coordinate change carries Q to nQ0 plus a residual form whose coefficients have absolute value below 57e.The residual diagonal coefficients satisfy 0 ≤ a ≤ b, and the cross-coefficients are bounded by the same 57e threshold.Source: Appendix C · pp. 32–33

• For fixed d ≥ 0, a finite procedure determines the least integer N_d with the stated property.Source: Appendix D · p. 33
• The threshold is defined to apply to every n ≥ N_d and every prime p satisfying the condition in the statement.Source: Appendix D · p. 33
• The procedure targets the least qualifying threshold, rather than merely providing a bound for N_d.Source: Appendix D · p. 33

• A positive definite integral ternary quadratic form of minimum n and discriminant p exists exactly when p=P_λ(n) for some λ ∈ Λ_d.Source: §D.1 · p. 34
• For n ≥ 25e^2, with e=d+1, forms in the interval 2(n+d)^3 < disc(Q) < 2(n+e)^3 can be represented as nQ_0+h_λ after normalization.The normalized tuple has the form λ=(0,a,b,a+t,b+s,a+b+r).Source: §D.1 · p. 34
• A finite search produces O(e^5) perturbations containing every possibility for the forms under consideration.The search applies the six A_3 centers and retains tuples with nonnegative coordinates and minimum zero.Source: §D.1 · p. 34
• For n ≥ 25e^2, solving the discriminant inequalities and testing minimum and prime discriminant finds all exceptions in that range.Source: §D.1 · p. 35
• For n < 25e^2, sign-normalized Eisenstein-reduced forms are enumerated and compared with P_λ(n); combining both ranges determines N_d.N_d is one more than the largest n that occurs as an exception.Source: §D.1 · p. 35
• Omitting the primality test gives the analogous bound for all discriminants.Source: §D.1 · p. 35

• The d=0 search found 42 distinct pairs (p,n) with n ≥ 25; all but (39313,26) satisfy p=P_i(n) for some 1 ≤ i ≤ 9.Source: §D.2 · p. 35
• The computational supplement implements the enumeration used in the search.Source: §D.2 · p. 35
• Every wisde prime with 27 ≤ n < 3000 has the form P_i(n) for some 1 ≤ i ≤ 9.Source: §D.2 · p. 35
• For n ≥ 27, if p=P_i(n) is prime, the constructed form has minimum n and the inequalities imply δ(p)=⌊3p/2⌋, so p is wisde.Source: §D.2 · pp. 35–36
• The exceptional pair (39313,26) makes the hypothesis n ≥ 27 sharp for Corollary 4.4, and N_0=27.Source: §D.2 · p. 36