%\documentstyle[mssymb,cyr]{article}
\documentstyle[mssymb,/usr2/tex/macros/old/cyr]{article}
%
\hyphenation{Shioda}
\def\MW{Mordell-\mbox{\kern-.16em}Weil}
\newcommand\TS{Tate-\v Safarevi\v c}
\newcommand\BW{Barnes-\mbox{\kern-.16em}Wall}
\newcommand{\be}{\begin{equation}}
\newcommand{\ee}{\end{equation}}
\newcommand{\ra}{\rightarrow}
\newcommand{\teq}{\!=\!}
\newcommand{\C}{{\bf C}}
\renewcommand{\P}{{\bf P}}
\newcommand{\Q}{{\bf Q}}
\newcommand{\R}{{\bf R}}
\newcommand{\Z}{{\bf Z}}
\newcommand{\Nmin}{{N_{\rm min}}}
\newcommand{\pinf}{{p_\infty}}
\newcommand{\bmu}{\mbox{\boldmath$\mu$}}
\newcommand{\Ht}{\hat{h}}
\newcommand{\Sha}{{\cyr Sh}}
\newcommand{\naive}{na\"\i ve\ }
\newcommand{\Aut}{\mathop{\rm Aut}\nolimits}
\newcommand{\End}{\mathop{\rm End}\nolimits}
\newcommand{\Hom}{\mathop{\rm Hom}\nolimits}
\newcommand{\Jac}{\mathop{\rm Jac}\nolimits}
\newcommand{\0}{^{\phantom0}}
%
\begin{document}

\begin{center}
\begin{Large}
\MW\ lattices in characteristic~2 \\
I: Construction and first properties

\vspace*{2ex}
\end{Large}

Noam D. Elkies
\end{center}

\vspace*{4ex}


{\bf Introduction.}  In a famous 1967 paper~\cite{T-S}
\v{S}afarevi\v{c} and Tate constructed elliptic curves
of arbitrarily large rank~$r$ over function fields of positive
characteristic.  The group of rational points of such a curve
yields a lattice in Euclidean space of dimension~$r$ via
the canonical N\'eron-Tate height.  It seems natural
to investigate the structure of this lattice, but curiously
it was not until about 1990 that such lattices were
examined in earnest.  Shioda~\cite{SHIODA:SPH} then found,
as part of his analysis of the N\'eron-Severi groups of
Fermat surfaces, a family of elliptic curves in characteristic
$\equiv5\bmod6$ similar to those of~\cite{T-S} whose associated
lattices produce sphere packings that improve on the previous
density records for many $r$ in the range
$80 \leq r \lesssim 1000$.  At about the same time I found
three such families with similar sphere-packing properties for
large~$r$, one of which turned out to be identical with Shioda's.
The other two families are in characteristic~2 and~3, and their
lattices also recover previously known records in ``small'' dimensions
$r\leq32$ in addition to improving records for larger~$r$.  Further
investigation revealed that these curves also provide fascinating
examples and test cases for the arithmetic of elliptic curves
over function fields.

This paper is the first of a series devoted to the characteristic-2
family.  (Oesterl\'e had already reported on it briefly
in~\cite{OESTERLE}.)  We begin with a quick summary of lattices in
Euclidean space and the associated sphere packings.  We then introduce
a family of hyperelliptic curves in characteristic~2, and use
them to construct potentially constant elliptic curves of
high rank analogous to those of~\cite{T-S} in odd characteristic.
By investigating the arithmetic of these curves we deduce lower
bounds on the sphere-packing densities of their \MW\ lattices
and compare these to the records listed in~\cite{C-S}.  Finally
we interpret the equality condition on our lower bound in terms
of a descent on the elliptic curve, and work out this descent
explicitly enough to describe in some detail the 64-dimensional
lattice which is the first one in our family to give a new record.
Along the way we announce a few results whose proofs we defer
to later papers of this series: some claims regarding isometries
acting on our lattices, comparisons between these lattices
in dimensions $\leq32$ and previously known lattices of the
same dimensions, and most notably the rapid growth of $|\Sha|$
for large~$r$.  With these exceptions, this paper is self-contained,
in the sense that each new result asserted is proved, sometimes
in more than one way.

{\bf Acknowledgements.}  John Conway and Neil Sloane's great
treatise~\cite{C-S} introduced me to the sphere-packing problem;
Michael Tsfasman's beautiful talk~\cite{TSF_JA} on arithmetic
constructions of lattices at the Journ\'ees Arithm\'etiques of~1989
gave the immediate impetus to look again at the \MW\ lattices of
potentially constant curves, which I had idly considered some years
earlier after reading~\cite{T-S} but abandoned for lack of technical
and computational tools; and Benedict Gross encouraged me
to pursue these lattices further even when I found that the
density bounds (see Thm.~1 below) were bad as $r\ra\infty$.
I would likely have never got my work on \MW\ lattices off the ground
without these three sources of inspiration.  I am also grateful
to Gross, as well as Tetsuji Shioda, for much valuable conversation
and correspondence on these matters, and to J.-P. Serre for first
writing me of Shioda's work and putting me in contact with him.

This work was made possible in part by funding from the Harvard
Society of Fellows, the National Science Foundation, and
the Packard Foundation.

\vspace*{2ex}

{\bf Lattices and sphere packings.}  We very briefly review
the ideas we need from~\cite[Ch.1]{C-S}.  We can take a {\sl lattice}
to be a finitely generated free abelian group $L\cong\Z^r$
equipped with a quadratic form $\|\cdot\|:L\ra\R$ whose extension
to~$L\otimes\R$ is positive definite.  This quadratic form identifies
$L\otimes\R$ with \hbox{$r$\/-dimensional} Euclidean space
$\R^r$ and~$L$ with a discrete co-compact subgroup of~$\R^r$
whose covolume is the positive square root of the
{\sl discriminant}\/~$\Delta$ of the bilinear form 
\be
\langle\cdot,\cdot\rangle:(v,v')\mapsto\frac12
(\|v+v'\|-\|v\|-\|v'\|)
\label{<>def}
\ee
on~$L$\/ associated to the quadratic form~$\|\cdot\|$.
The lattice (or the quadratic form) is said to be {\sl integral}\/
if $\langle v,v'\rangle\in\Z$ for all $v,v'\in L$, and {\sl even} if
$\|v\|$ is an even integer for all $v\in L$\/ (such~$L$\/ must be
integral, by~(\ref{<>def})).  

The {\sl packing radius} $\rho$ of a lattice~$L$ is the radius of
the largest open ball whose translates by~$L$ do not overlap,
giving rise to a ``sphere packing'' (actually a packing
of congruent balls) in $\R^r$.  This radius is half the
square root of the ``minimal norm'' (more properly, minimal
nonzero norm) of~$L$.  The balls centered at the lattice vectors
with this norm $\Nmin\teq4\rho^2$ are disjoint and tangent to the ball
about the origin; thus the number of minimal vectors is called
the {\sl kissing number} of the lattice.

We adopt the following terminology from~\cite{C-S}
for measuring the density of a (not necessarily lattice)
packing of congruent balls of radius~$\rho$ in~$\R^r$.
The {\sl center density} is the average number
of balls per unit volume, which for a lattice packing is
just $\Delta^{-1/2}$, the inverse of the covolume.  To obtain the
{\sl packing density} we multiply this by the volume $V_r\rho^r$
of the balls being packed, where $V_r=\pi^{r/2}/\Gamma(r/2+1)$ is
the volume of a unit ball in $\R^r$.  We eliminate the
factors of~$\pi$ by introducing the {\sl normalized center
density}~$\delta$, defined as the center density multiplied
by~$\rho^r$ or equivalently the packing density divided
by~$V_r$, and (unlike the center density) invariant
under scaling. For a lattice~$L$\/ as above we have
\be
\delta=\delta(L)=\Delta^{-1/2}(\Nmin/4)^{r/2}.
\label{deltadef}
\ee

Thus a lower bound on~$\Nmin$ and an upper bound on~$\Delta$
will guarantee a high density.  For lattices in higher dimensions
given by coordinates or matrices as in~\cite{C-S} it is easy
to find $\Delta$ but often hard, and probably computationally
intractable, to determine or even reasonably estimate $\Nmin$.
Curiously for the \MW\ lattices that Shioda and we construct
it is $\Delta$ that is hardest to evaluate, while the minimal norm
can be even simpler to determine than the rank~$r\;$!


{\bf A hyperelliptic curve.}
Fix a positive integer~$n$, let $q=2^n$, and let $k$ be the finite
field of $q^2$ elements.  Then there exists a supersingular elliptic
curve $E_0/k$ with trace~$-2q$, that is, with Frobenius endomorphism
equal to multiplication by~$-q$; indeed for $n$ odd we can and will
take $E_0$ to have Weierstrass form
\be
E_0: Y^2 + Y = X^3,
\label{Eodd}
\ee
and for $n$ even we take the quadratic twist
\be
E_0: Y^2 + Y = X^3 + a_6
\label{Eeven}
\ee
where $a_6\in k$ is chosen so that its trace from~$k$\/ to the
prime field $\Z/2\Z$ is~1.  Let $C/k$ be the
hyperelliptic curve with affine model
\be
C: u^2 + u = t^{q+1}.
\label{Ceq}
\ee
This curve has genus $g=q/2$, its regular differentials being
$P(t)\,dt$ with $P\in k[t]$ a polynomial of degree $<g$; the
hyperelliptic involution of~$C$\/ is
\be
\iota: (t,u)\mapsto(t,u+1).
\label{iota}
\ee
We then have:

{\bf Proposition 1.} {\em The curve $C$\/ has
$q^2+2gq+1=2q^2+1$ rational points over~$k$,
and its Jacobian $\Jac(C)$ is isogenous with $E_0^g$.}

{\em Proof}\/:  To count rational points, note that $t\mapsto t^{q+1}$
is the norm map from $k$\/ to its quadratic subfield; thus for all
$t\in k$, the element $t^{q+1}$ of that subfield can be written as
$u^2+u$ for some two distinct $u\in k$.  Thus $C$\/ has $2|k|=2q^2$
finite $k$\/-rational points, to which we add the single point at
infinity~$\pinf$ to obtain $2q^2+1$ as claimed.  Since this number
is also $q^2+2gq+1$, the maximum allowed by the Weil estimate, all the
eigenvalues of the Frobenius endomorphism of $\Jac(C)$ are $-q$.
Since the abelian variety $E_0^g$ of dimension~$g$ also has all
its eigenvalues of Frobenius equal $-q$, it follows from Tate's
theorem~\cite{TATETHM} that $\Jac(C)$ and $E_0^g$ are isogenous.~~$\Box$

{\em Remarks}: i) This Proposition can also be proved by noting that
$C$\/ is a quotient of the curve $u^q+u=t^{q+1}$, which is isomorphic
to the Fermat curve $F_{q+1}$.  Since it is known (again by counting
points and applying the Weil estimate) that $\Jac(F_{q+1})$ is
isogenous with a power of~$E_0$, it follows that this must also be
true for~$\Jac(C)$.  Still another approach is to exhibit, for generic
$p: (t,u)=(t_0,u_0)$ on~$C$, an explicit rational function on~$C$\/
whose divisor is $q(p)+(p^{q^2})-(q+1)(\pinf)$, namely the function
\be
\sum_{m=0}^{n-1} (t_0^q t)^{2^m} + u + u_0^q,
\label{funk}
\ee
which yields a direct, albeit ad-hoc, proof that the Frobenius
map $p\mapsto p^{q^2}$ on~$C$\/ multiplies divisors of degree zero
by~$-q$ modulo linear equivalence.

ii) As is true for $F_{q+1}$, once $q>2$ our curve has
many more automorphisms than the $84(g-1)$ allowed for a curve
of genus~$g$ in characteristic~zero.  Indeed, for each of
the $2q^3+2q^2$ ways to choose $a,b,c\in k$\/ such that
\be
a^{q+1}=1,\ c^2+c=b^{q+1}
\label{abc_cond}
\ee
we have an automorphism
\be
(t,u)\mapsto(a(t+b), u + \sum_{m=0}^{n-1} (b^q t)^{2^m} + c)
\label{abc_aut}
\ee
of~$C$.  (This uses implicitly the identity $b^{q^2}=b$ for $b\in k$.)
The normal subgroup of $2q^2$ automorphisms
with $a\teq1$ is an extraspecial 2-group $2_-^{1+2n}$ whose
nontrivial central element is the hyperelliptic involution~$\iota$.
Thus its representation on $T_l(\Jac(C))\otimes\Q_l$ is
the unique irreducible representation of dimension $2g=q$.
Note that since the Frobenius endomorphism commutes with
all these automorphisms we get by Schur's lemma an alternative
proof of the fact that Frobenius acts on $\Jac(C)$
by some scalar multiplication.  Van der Geer and van der Vlugt
investigate in~\cite{G-V} a family of hyperelliptic curves
in characteristic~2 which, like $C$, have genus $2^{n-1}$ and
automorphisms by this extraspecial 2-group; much of our discussion
of $C/k$ will also apply with little change to these curves over
the field of definition of their automorphism groups.

iii) For any factor~$f$\/ of $q+1$, the hyperelliptic curve $u^2+u=t^f$
of genus $g'=(f-1)/2$ is a quotient of~$C$\/ and thus has Jacobian
isogenous with $E_0^{g'}$.  Thus such curves can also be used to produce
\MW\ lattices. In general the lattices obtained from these curves
associated with proper factors of~$q+1$ are not as good as those
coming from~$C$\/ itself, but the factor $f=13$ of $2^6+1=65$ turns
out to yield a lattice homothetic with the Leech lattice of rank~24.

iv) Note that when $n=1$ the ``hyperelliptic'' curve~$C$\/
becomes the supersingular elliptic curve~$E_0$,
and (\ref{abc_aut}) gives its 24 automorphisms.


{\bf A potentially constant elliptic curve.}
Let $L$ be the commutative group $\Hom_k(\Jac(C),E_0)$.
Since $\Jac(C)$ is isogenous with $E_0^g$, this group
has the same rank as $\Hom_k(E_0^g,E_0)=(\End_k(E_0))^g$.  Now
$E_0$ is supersingular, so its group of $\bar k$\/-endomorphisms
has rank~4, and all these endomorphisms are defined over~$k$
because they commute with the Frobenius endomorphism (which is just
the scalar~$-q$).  We conclude that the rank of $(\End_k(E_0))^g$,
and thus also of $\Hom_k(\Jac(C),E_0)$, is
\be
r = 4g = 2q = 2^{n+1}.
\label{Lrank}
\ee

We next identify $L$ with the $k$\/-rational maps $f: C \ra E_0$
taking $\pinf$ to the origin~$\bf0$ of~$E_0$.  The embedding of $C$\/
into $\Jac(C)$ taking any $p\in C$ to the class of the divisor
$(p)-(\pinf)$ lets us restrict any homomorphism from $\Jac(C)$ to $E_0$
to a map $f:C\ra E_0$ with $f(\pinf)=0$.  To go the other way we can use
the group law on~$E_0$ to extend any map $f: C \ra E_0$ to a function
$f_+: {\rm Div}(C) \ra E_0$, which must satisfy $f_+(D)=f_+(D')$ for
any pair of linearly equivalent divisors $D,D'$; the restriction of
$f_+$ to the degree-zero divisors then descends to a homomorphism
$\Jac(C) \ra E_0$ whose restriction to the embedding of~$C$\/ is
$p\mapsto f(p)-f(\pinf)$, and thus coincides with~$f$\/ if
$f(\pinf)=\bf0$.  This concludes the construction, which also
lets us identify pointwise addition and subtraction of maps
$f:C \ra E_0$ with the group operations on~$L$.

In particular it follows that any $f: C \ra E_0$ with $f(\pinf)=\bf0$
must satisfy the identity
\be
f(p) = -f(\iota(p)).
\label{ident}
\ee
We may see this either by noting that the divisor $(p)+(\iota(p))$
is linearly equivalent to $2(\pinf)$, or more concretely by noting
that the map $f(p)+f(\iota(p)): C \ra E_0$ descends to
$C/\langle\iota\rangle = {\bf P}^1$ and is thus constant
(this is of course a special case of the proof of the fact
$D \sim D' \Rightarrow f_+(D) = f_+(D')$ used earlier).
Recalling that $-(x,y)=(x,y+1)$ on~$E_0$, this means that
either $f$\/ is the constant function $C\ra\bf0$ or
it is of the form
\be
f(t,u) = (x(t), y(t)+u),
\label{ftwist}
\ee
where $x,y$ are rational functions satisfying
\be
y^2 + y = x^3 + t^{q+1} + a_6
\label{Etwist}
\ee
with $a_6=0$ for $n$ odd and $a_6$ as in~(\ref{Eeven})
for $n$ even.  Conversely any pair $(x,y)$ of rational functions
satisfying~(\ref{Etwist}) yields a rational map~(\ref{ftwist})
that satisfies~(\ref{ident}) and thus (since $\bf0$ is the unique
fixed point of multiplication by~$-1$ on~$E_0$) takes $\pinf$ to~$\bf0$.

We regard (\ref{Etwist}) as a Weierstrass model for an elliptic curve
$E$\/ over the global field $K=k(t)$.  We then see that we have
identified its \MW\ group $E(K)$ with~$L$, and thus recognized it
as a free abelian group of rank~$r$.  (It is straightforward to check
that the group laws of $E(K)$ and~$L$ are compatible with our
identification.) Investigating further the arithmetic of this curve,
we note that it has constant $j$-invariant~$0$,
and thus is a potentially constant elliptic curve; indeed it
becomes isomorphic with the constant curve $E_0$ under the quadratic
extension~$K(u)=k(C)$ of~$K$.  Moreover the curve has good reduction
at all finite~$t$, and additive bad reduction at $t\teq\infty$.
The local reduction type at infinity may be determined by the change
of coordinates $(x,y) = (t^{2z} x_1, t^{3z} y_1)$ where $z$ is
the smallest integer such that $6z>q$, obtaining
\be
y_1^2 + t^{-3z} y_1 = x_1^3 + t^{q+1-6z} + t^{-6z} a_6
\label{Einf}
\ee
with discriminant $t^{-12z}$.  That this is a minimal model at infinity
may be checked for instance by Tate's formulas~\cite{TATEALG}.
These formulas also tell us the local reduction type:
if $n$ is even then $q\equiv4\bmod6$ and thus $q+1-6z = -1$,
whence we find reduction type~II, while if $n$ is odd then
$q\equiv2\bmod6$, so \hbox{$q+1-6z = -3$} and the reduction type
is~I$_0^*$.  In the latter case we can describe each of the three
nonidentity components of multiplicity one by
$x_1\equiv\xi t^{-1}\bmod t^{-2}$ or equivalently
\be
x = \xi t^{(q+1)/3} + O(t^{(q-2)/3})
\label{xcond}
\ee
at $t\teq\infty$, where $\xi$ is one of the three cube roots of unity.
In particular since \hbox{$\bmu_3\subset k$}\/ we see that each of these
components is defined over~$k$\/ and conclude that $c_\infty=1+3=4$
in this case.  Each nonidentity component~(\ref{xcond}) is represented
by a point in the \MW\ group $E(K)$, for instance the point
$(x,y) = (\xi t^{(q+1)/3},0)$; thus the narrow \MW\ group $L_0$,
consisting of solutions of~(\ref{Etwist}) which reduce on each
fiber to points on its identity component, is of index~4 in~$L$.
[For even $n$ every fiber of~$E$\/ has only one component and $L_0=L$.
For both even and odd~$n$, points on the identity component of~$E$\/
are characterized by the condition that $x_1$ have no zero at infinity,
or equivalently that $x$ have a pole at $t\teq\infty$ of order greater
than~$(q+1)/3$; note that in every solution of~(\ref{Etwist}) $x$
must either satisfy (\ref{xcond}) or have a pole of even order
$>(q+1)/3$ at infinity, because every pole of $y^2+y$ must have
even order, while $t^{q+1}$ has an odd-order pole at infinity.]


{\bf Heights and the \MW\ lattice of~$E$.}  The \naive height of
a point $(x,y)\in L$ is the degree of~$x$ as a rational function
of~$t$.  (We thus omit a factor of $\log|k|$ from both the \naive
and the canonical height: in our setting, with positive global
characteristic, that factor would achieve little but notational
clutter.  Of course both the \naive and the canonical heights
of the zero point of~$L$ are zero in either normalization.)
Recall that the canonical height can be characterized, following
Tate, as the unique function $\Ht: L \ra \R$ satisfying
both the identity
\be
\Ht(2P) = 4\Ht(P)
\label{Hident}
\ee
for all $P\in L$ and the condition that the difference between
$\Ht$\/ and the \naive height is bounded.  In our case we can
determine $\Ht$\/ explicitly:

{\bf Proposition 2.} {\em Let $P\in L$ be a nonzero point,
with coordinates $(x,y)$.  Then the canonical height of~$P$\/
under the above normalization is $\deg(x)$, i.e.\
the canonical and \naive heights on $E(K)$ coincide.  Furthermore
\be
\Ht(P) \geq \frac {q+1}{3}
\label{Hineq}
\ee
for all nonzero $P\in L$, and $\Ht(P)$ is even unless $n$ is odd
and $x$ satisfies (\ref{xcond}) for some $\xi\in\bmu_3$, in which
case $\Ht(P)$ is odd.}

{\em Proof}\/:  To identify the \naive and canonical heights we
need only show that the \naive height already satisfies the
identity~(\ref{Hident}).  This we do by using
the explicit addition law on~$E$ to compute that if $P$\/
has coordinates $(x,y)$ then $2P$\/ has coordinates
\be
(x^4, y^4 + x^6 + x^3 + 1)
\label{2P}
\ee
and noting that $\deg(x^4)=4\deg(x)$.  We have already used the
fact that every pole of $y^2+y$ has even order to show that
$x$ has a pole of order at least $(q+1)/3$ at infinity, from
which the estimate (\ref{Hineq}) follows, and also that the
order of this pole is either even or exactly equals $(q+1)/3$,
the latter being possible only for odd~$n$.  To complete the
determination of the parity of $\deg(x)=\Ht(P)$ note that any
pole of $x^3+t^{q+1}+a_6$, and thus also of~$x$, at a finite
$t\in\bar k$\/ must too have even order, and that the degree of~$x$
is its total number of poles counted with multiplicity.~~$\Box$

{\em Remarks}:  We can prove this Proposition, too, in several
alternative ways.  We could also obtain the formula for $\Ht$,
following N\'eron~\cite{NERON}, as a sum of local contributions,
using for instance the explicit formulas in~\cite{SILVERMAN_HT}; or,
as in \cite{SHIODA,SHIODA:SPH}, using intersection theory, which
also provides another interpretation of the estimate~(\ref{Hineq}).
Yet another route is to note that $\Ht(P)$ is half the canonical
height of the map $f:C\ra E_0$ associated to~$P$\/ when that map
is regarded as a point on the constant elliptic curve $E_0/k(C)$
(this because the extension $k(C)/K$\/ has degree~2),
and to show that this height is twice the degree of the rational
map~$f$, which again can be done either as in our proof above or
following either of the alternative approaches.  Each of these
two approaches also yields a general proof of the fact that $\Ht(P)$
is even for all $P\in L_0$.  Observe too that we can now give another
proof that $L$ is torsion-free: by~(\ref{Hineq}) 
all nonzero $P\in L$ have positive canonical height.

The canonical height is a positive-definite form on~$L$, giving
it the structure of a lattice in $\R^r$, the {\sl \MW\ lattice}
of~$E/K$.  We already have lower bounds on the minimal norms of~$L$
and~$L_0$, and know for $n$ odd that our bound $(q+1)/3$
on the minimal norm of~$L$ is attained by the points
$(x,y)=(\xi t^{(q+1)/3}, 0)$.  Even before estimating
the discriminants of these lattices we can already describe them
to some extent, finding a group of $48n(q^3+q^2)$ symmetries and,
for odd~$n$, comparing the sphere-packing densities
of the lattices $L_0,L$.

The symmetries come from three sources: automorphisms of the
hyperelliptic curve~$C$, of the elliptic curve~$E_0$, and of
the ground field~$k$.  Thus an automorphism~(\ref{abc_aut}) of~$C$\/
yields the map
\be
(x(t),y(t)) \mapsto
\bigl( x(a(t+b)), y(a(t+b)) + \sum_{m=0}^{n-1} (b^q t)^{2^m} + c \bigr)
\label{Caut}
\ee
from $L$ to itself which preserves the degree of~$x$ and thus
the height.  Likewise, given $a,b,c$ in the 4-element field
satisfying~(\ref{abc_cond}) with $n\teq1$ we have the isometry
\be
(x(t),y(t)) \mapsto \left( a(x(t)+b), y(t) + b^2 x(t) + c \right)
\label{Eaut}
\ee
of~$L$, commuting with all the isometries~(\ref{Caut}).
Finally let $\sigma$ be the automorphism of~$K$\/ that
fixes~$t$\/ and acts on~$k$\/ by $a\mapsto a^2$.  When $n$ is odd
it is clear that $\sigma$ induces an order-$2n$ isometry of~$L$,
because then the equation~(\ref{Etwist}) defining~$E$\/ is defined
over the 2-element prime field.  When $n$ is even we obtain instead
the isometry
\be
(x,y) \mapsto (\sigma(x), \sigma(y) + a_6)
\label{kaut}
\ee
of order $4n$ whose $(2n)$-th power is the isometry
\be
-\!1: (x,y) \mapsto (x,y+1)
\label{-1}
\ee
of~$L$ (because we chose $a_6$ so that
$\sum_{m=0}^{2n-1} \sigma^m(a_6)=1$).
Note that the groups (\ref{Caut},\ref{Eaut}) also contain
this isometry, with $(a,b,c)=(1,0,1)$.  Their normal subgroups of
isometries with $a\teq1$ generate the extraspecial 2-group
$2_+^{1+2(n+1)}$ whose action on the $2^{n+1}$-dimensional space
$L\otimes\R$ must give its unique irreducible representation
with nontrivial central character.

We have seen that $L_0$ has index 4 in $L$, and thus center density
$1/4$ as large as that of~$L$.  On the other hand its minimal
norm is at least \hbox{$(q+4)/(q+1)$} times larger.
Thus the normalized center density of $L_0$ is
\be
\frac14 \left(\frac{q+4}{q+1}\right)^{\!r/2} =
\frac14 \left(1 + \frac{3}{q+1}\right)^{\!q}
\label{ratio}
\ee
times that of~$L$.  The ratio~(\ref{ratio}) is $\geq1$ for all~$q$,
with equality only when $q\teq2$, and tends to $e^3/4=5.021\ldots$
as $q\ra\infty$.  Thus for $n>1$ the lattice $L_0$ always yields
a denser sphere packing than~$L$, albeit by a bounded factor.  The
points in $L - L_0$ may still find use as ``holes''$\!$, i.e.\
vectors in $L_0\otimes\R$ far from any point in~$L_0$: a dense sphere
packing of $\R^{r+1}$ might be obtained by stacking (``laminating'')
$r$-dimensional layers each consisting of $L_0$ or its translates by
a suitable hole.

We next begin our investigation of the discriminant~$\Delta(L)$
of~$L$ (a.k.a.\ the regulator of~$E/K$) by computing the L-function
$L(E/K,s)$.  A comparison of local factors shows that this is
the quotient of the L-functions of the constant curves $E_0/k(C)$
and~$E_0/K$.\footnote{Indeed this method shows that
for any elliptic curve over a global field~$F$\/ its L-function
as a curve over a separable quadratic extension~$F'$ of~$F$\/
factors as the product of the L-functions over~$F$\/ of the
original curve and its quadratic twist by $F'/F$.}  Thus since
$K$\/ is a rational function field the zeros of our L-function,
regarded as a polynomial in $|k|^{-s}$, are the products
of the inverses of the eigenvalues of Frobenius
of~$E_0$ and~$C$, counted according to multiplicity.
Since these eigenvalues all equal~$-q$ we conclude that we have
a zero of order $4g\teq r$ at $q^{-2}$, corresponding to $s\teq1$,
and no other zeros, so \hbox{$L(E/K,s)=(q^{-2s}-q^{-2})^r$}.
(At least for $n$ odd this could also be shown by regarding
(\ref{Etwist}) as a ``supersingular Delsarte surface'' as Shioda
does in odd characteristic~\cite{SHIODA:SPH}.)

But the conjecture of Birch and Swinnerton-Dyer, adapted by
Artin and Tate to the function field case~\cite{TATEBSD},
predicts that the rank of the \MW\ group of an elliptic curve
over a global field should equal the order of vanishing
at $s\teq1$ of its L-function, and that the regulator of
the curve should be the product of the leading term at $s\teq1$
of that L-function with certain arithmetic invariants of the curve.
We have seen that for our curve~$E/K$\/ the order of vanishing
equals the rank~$r$ as predicted.  It then follows from
Milne's theorem~\cite{MILNE} that the rest of the conjecture
is also true.  The usual statement of the formula uses the
definition of the canonical height that includes factors of $\log|k|$,
but these powers conveniently cancel a factor $(\log|k|)^r$ introduced
by differentiating the L-function $r$ times at $s\teq1$.  Using our
earlier observation about the discriminant of the minimal model of~$E$
at infinity, and recalling that $E(K)$ has trivial torsion,
we finally find
\be
\Delta(L) = q^{2 \lfloor q/6 \rfloor} / (c_\infty |\Sha|),
\label{Ldisc}
\ee
where $c_\infty=1$ or~4 according as~$n$ is even or odd, and
$\Sha$ is the \TS\ group of~$E/K$.  Since $|\Sha|\geq1$ we thus
have an upper bound on the discriminant.

Combining this with our estimates on $\Nmin$ we conclude:

{\bf Theorem 1.}  {\em Both $|\Sha|$ and $\Delta(L)$
are powers of~2.  The narrow \MW\ lattice~$L_0$ of~$E/K$ has
normalized center density
\be
\delta(L_0) \geq q^{-(q-4)/6} \left( \frac{q+2}{12} \right) ^ {\!q}
\label{Ldens_even}
\ee
for $\,n$ even, and
\be
\delta(L_0) \geq
\frac12 q^{-(q-2)/6} \left( \frac{q+4}{12} \right) ^ {\!q}
\label{Ldens_odd}
\ee
for $\,n$ odd.  Equality holds if and only if (\ref{Etwist})
has solutions in polynomials~$x(t),y(t)$ with $x$ of degree
$2(\lfloor q/6 \rfloor + 1)$ (in which case these
solutions give the minimal vectors of $L_0$) and $E/K$
has trivial \TS\ group.}

{\em Proof}\/:  The product $q^{2 \lfloor q/6 \rfloor} / c_\infty$
of $|\Sha|$ and $\Delta(L)$ is a power of 2.  Furthermore
$|\Sha|$ is an integer, and the index-$c_\infty$ sublattice~$L_0$
of~$L$ is even so has integral discriminant.  Since $c_\infty$
is a power of~2, then, so are $|\Sha|$ and $\Delta(L)$.
We obtain the inequality on $\delta(L_0)$ by
substituting into~(\ref{deltadef}) the lower bound~(\ref{Hineq})
on the minimal norm and the formula~(\ref{Ldisc}) for the discriminant,
noting that for $n$ odd the {\em narrow}\/ \MW\ lattice has
minimal norm at least $(q+4)/3$ and index~4 in~$L$.  For equality
to hold $\Sha$ must be trivial and the lower bound
$2(\lfloor q/6 \rfloor + 1)$ on $\Nmin$
must be attained.  Since that lower bound on
$\Ht\bigl((x,y)\bigr)=\deg(x)$ was the minimal order of the pole
of~$x$ at $t\teq\infty$, that lower bound is attained precisely
for those $(x,y)$ such that $x$ has a pole of that order at infinity
and no other poles, i.e.\ $x$ is a polynomial of that degree in~$t$,
in which case $y$ must also be a polynomial.~~$\Box\,\Box$

The lattice $L_0$ yields a sphere packing in dimension $2^{n+1}$
whose density equals the records listed in~\cite{C-S} for $n\leq4$
and improves on those records for $5\leq n\leq9$.
When $n=1$ the curves $C,E_0$ coincide so $L$ is just the
endomorphism ring of~$E_0$, which is the ring of Hurwitz
quaternions, homothetic as a lattice with the root lattice~$D_4$
of normalized center density $1/8$; the narrow \MW\ lattice $L_0$
consists of the inseparable endomorphisms, and is isometric
with~$D_4$, with deep holes at $L-L_0$.  When $n=2$ the \MW\ lattice
is isomorphic with the root lattice $E_8$ (with $\delta=1/16$);
this can be seen in several ways, for instance using Shioda's work
on rational elliptic surfaces.  When $n\teq3$, I can show that $L_0$
is isomorphic with the \BW\ lattice of dimension 16 and normalized
center density $1/16$, with some but not all its deep holes at $L-L_0$.
When $n\teq4$, I find that $L$ has the same density $(9/8)^8$, indeed
the same theta function, as Quebbemann's record lattice in
dimension~32, but is not isomorphic with it; furthermore the
scaled dual lattice 
\be
\{w\in L\otimes\R: \langle v,w \rangle \in 2\Z {\rm\ for\ all}\ v\in L\}
\label{Ldual}
\ee
of~$L$ is a third nonisomorphic lattice with the same theta series.

For $n=5,6,\ldots,11$ we find new lattices~$L_0$ with the following
parameters (we give the base-2 logarithm, rounded to two decimals,
of the lower bound~(\ref{Ldens_even}) or~(\ref{Ldens_odd}) on
the normalized center density~$\delta$):
$$
\begin{array}{c|ccccccc}
    n     &  5 &  6  &  7  &  8  &   9  &  10  &  11  \\ \hline
r=2^{n+1} & 64 & 128 & 256 & 512 & 1024 & 2048 & 4096 \\ \hline
\log_2\delta\geq &
 24.72 & 97.40 & 294.81 & 797.12 & 2012.25 & 4871.88 & 11439.76
\end{array}
$$
These improve considerably on the previous records listed
in~\cite{C-S}.  (For $n=5,6,7,11$ these records are
$\log_2(\delta)=22,\; 88,\; 270.89$, and~$11344$; for 
$n=8,9,10$ the previous record constructions do not work well
in dimension exactly $2^{n+1}$, but our $\delta$'s well exceed
even the normalized densities of packings in somewhat
higher dimensions listed in~\cite{C-S}.)  Note, however,
that in any dimension~$r$ there exist lattices, not explicitly
known for large~$r$, with packing density at least $2^{1-r}$
(Minkowski-Hlawka, cf.~\cite{EOR}); for $n=10,11$ this amounts
to normalized densities~$\delta$ larger than those of our \MW\ lattices.
Once $n\geq12$ the lower bounds~(\ref{Ldens_even},\ref{Ldens_odd})
are worse than both the Minkowski-Hlawka bounds and the explicit
lattices listed in~\cite{C-S}.  We have shown that for $n\geq9$
the \TS\ group of~$E/K$\/ is nontrivial and used this to improve
our bounds on $\delta(L)$, but even these new bounds (which increase
those of Thm.~1 by factors of $2^6,2^{20},2^{88}$ for $n=9,10,11$)
do not improve on Minkowski-Hlawka for $n=10,11$, nor on the
explicit lattices for $n\geq12$.  Of course these \MW\ lattices
are still of interest for the arithmetic of the elliptic curves~$E$.

The lattices constructed in~\cite{SHIODA:SPH} are the \MW\ lattices
of the potentially constant curves $y^2=x^3+1+t^{p+1}$ over the
field of $p^2$ elements where $p$ is a prime power congruent to~5
mod~6; these have rank $2p-2$, determinant $\leq p^{(p-5)/3}$
(with equality for prime~$p$), and minimal norm $(p+1)/3$.
These are closely analogous to the \MW\ lattices
of the curves~(\ref{Etwist}) and yield sphere packings
only slightly worse (by a factor $<e^{1/6}$)
in the few cases where the two constructions are
directly comparable, i.e.\ produce lattices in the same dimension
$2p-2=2^{n+1}$ --- with the exception of $n\teq2,p\teq5$ where both
lattices are isomorphic with~$E_8$.

{\bf The $\phi$-descent and the case $n\teq5$.}  To compute
$\Delta(L)$ from~(\ref{Ldisc}) we need to determine $|\Sha|$.
In general this promises to be a very difficult computation,
requiring repeated 2-power descents on a supersingular
curve in characteristic~2.  But it is much simpler to test
whether $\Sha$ is trivial, which we find to be the case for
first few~$n$.  We begin with the inseparable 2-isogeny
$\phi: E\ra E$\/ defined by
\be
\phi(x,y) = (x^2, y^2 + t^{q+1} + a_6).
\label{phidef}
\ee
This is inherited from the Frobenius isogeny
$(x,y)\mapsto(x^2,y^2+a_6)$ on~$E_0$, and thus satisfies
\be
\phi^2 = -2
\label{phi_sq}
\ee
as may also be seen from the explicit formula~(\ref{2P}) for
multiplication by~2 on~$E$.  We now observe that since $\Sha$
is a 2-group,
\be
|\Sha| = 1  \iff  |\Sha_2| = 1  \iff  |\Sha_\phi| = 1,
\label{triv_sha}
\ee
where $\Sha_2$ and $\Sha_\phi$ are respectively the subgroups
of~$\Sha$ killed by~2 and~$\phi$.  That is, $\Sha$ is trivial
if and only if the Selmer group for~$\phi$, which a priori
contains $L/\phi L$, is actually equal to $L/\phi L$.  Now
from~(\ref{phidef}) we have for all $P\in L$
\be
\Ht(\phi(P)) = \deg x(\phi(P)) = \deg x(P)^2 = 2\deg x(P) = 2\Ht(P).
\label{Ht.phi}
\ee
Thus $\phi$ is a norm-doubling map of~$L$, so in particular
$L/\phi L$\/ is an elementary abelian 2-group of rank
$r/2=2^n=q$, and $\Sha$ is trivial if and only if the Selmer
group for~$\phi$ has cardinality~$2^q$.

Fortunately we can describe the $\phi$-descent almost completely:

{\bf Theorem 2.}  {\em Let $k$\/ be a finite field of characteristic~2
and let $K$\/ be the rational function field $K=k(t)$.  Fix a polynomial
$A_6(t)$ of odd degree~$d$, and let $E/K$\/ be the elliptic curve
with Weierstrass model
\be
y^2+y=x^3+A_6.
\label{Egen}
\ee
Then $E$\/ admits an isogeny
\be
\phi: E \ra E,\quad (x,y) \mapsto (x^2,y^2+A_6)
\label{phi_gen}
\ee
with $\phi^2=-2$, and the $\phi$-descent map can be written as
\be
\epsilon: E(K) / \phi E(K) \hookrightarrow K / K^2,\quad
{\bf 0} \mapsto 0,\ (x,y) \mapsto x \bmod K^2
\label{phi_descent}
\ee
(with $K$\/ and $K^2$\/ considered as additive groups).
If $v$ is a finite place of~$K$\/ then the local Selmer group
of~$\phi$ at~$v$, i.e.\ the image $\epsilon(E(K_v)) \subset K_v/K_v^2$,
consists of the classes with $v$-integral representatives.  
Every element of the Selmer group at $t\teq\infty$ has a representative
$x_0$ of valuation $\geq -d/3$; furthermore, if this valuation equals
$-d/3$ then $x_0^3/A_6=1$ at $t=\infty$, and if it is strictly between
$-d/3$ and~$0$ then it is congruent to~$-d\bmod 4$.  Thus every nonzero
element of the global Selmer group for $\phi$ is has a unique
representative $x_0$ which is an odd polynomial\/\footnote{That is,
a polynomial of the form $f(t)=tg(t^2)$ for some polynomial~$g$;
in characteristic~2 the usual characterization $f(-t)=-f(t)$
of odd polynomials fails.}
in~$t$\/ of degree $\leq d/3$ which is congruent to~$d\bmod 4$
unless $\deg(x_0)=d/3$ and $x_0^3/A_6=1$ at $t=\infty$.
}

{\em Notes}\/:  We give this more general statement, allowing
polynomials $A_6$ other than $t^{q+1}+a_6$, because we need it
in subsequent papers (e.g.\ to realize the Leech lattice as
a \MW\ lattice) and the proof for $A_6=t^{q+1}+a_6$ extends
directly to arbitrary polynomials.
We require that $d$\/ be odd only for convenience:
for any $A_3\in K$, the change of coordinates
$(x,y)\leftrightarrow(x,y+A_3)$ in~(\ref{Egen}) yields the
equivalent Weierstrass form $y^2+y=x^3+A_6'$ where
$A_6'=A_6+A_3^2+A_3$, and for any polynomial~$A_6$ we can choose
a polynomial $A_3$ such that $A_6'$ has odd degree.

Since the squares in~$K$\/ are precisely the rational functions whose
differential vanishes, we may identify $K/K^2$ with the exact
differentials on the projective $t$\/-line.   This gives us a useful
alternative formulation of the $\phi$-descent~(\ref{phi_descent}):
$\epsilon(P)$ is the differential of $x(P)$.  The local
Selmer groups are then the regular exact differentials at finite
places, and a subgroup of the exact differentials with a pole
of degree at most $d/3 + 1$ at the place $t\teq\infty$.


{\em Proof}\/:  That $\phi$ is an isogeny satisfying $\phi^2=-2$
we verify as before by a direct computation.
For nonzero points $P,Q\in E(K)$ with $P+Q\neq\bf0$
the addition formula gives
\be
x(P+Q) = x(P) + x(Q) + m(P,Q)^2
\label{P+Q}
\ee
where $m(P,Q)$ is the slope of the line between~$P$\/ and~$Q$\/
(or of the tangent to~$E$\/ at~$P$\/ if $P=Q$\/).  Thus the map
$E(K)\ra K/K^2$ taking {\bf0} to~0 and nonzero~$P$\/ to the class
of $x(P)$ is a group homomorphism.  The kernel of this homomorphism
contains $\phi E(K)$ since (\ref{Egen}) exhibits $x(\phi(P))$ as
a square; conversely if $(x,y)\in E(K)$ with $x=x_1^2$ we take
$y_1=y+x_1^3$ and find the point $(x_1,y_1)$ on~$E(K)$ with
$\phi((x_1,y_1))=(x,y)$.  Thus the kernel of our homomorphism
equals $\phi E(K)$ so $\epsilon$ is indeed a well-defined
injection, so it gives the desired descent map.  Note that
this part holds for any field of characteristic~2 and any
element~$A_6$ of the field, so in particular we may use it
for the localizations~$K_v$ of~$K$.

Next let $v$ be a finite place of~$K$, and $x_0$ a $v$-integral
element of~$K_v$.  We can then choose $v$-integral $x_1,y_1\in K_v$
such that $x_1\equiv x_0 \bmod K_v^2$ and $y_1^2+y_1\equiv x_1^3+A_6
\bmod v$.  Then
\be
\eta := (x_1^3 + A_6) - (y_1^2+y_1)
\label{eta_def}
\ee
has positive $v$-valuation, and we can deform $(x_1,y_1)$ to the
$K_v$-integral point
\be
(x_1,y_1 + \sum_{m=0}^\infty \eta^{2^m})
\label{Kv_pt}
\ee
of~$E$\/ whose image under~$\epsilon$ is~$x_0\bmod K_v^2$,
confirming that $x_0+K_v^2$ is in the local Selmer group.  Conversely
let $(x,y)$ be any point in $E(K_v)$.  We may assume that $x$
has a pole at~$v$, else $x$ itself is a $v$-integral representative
of $x+K_v^2$.  Since $A_6$ is regular at~$v$, the pole of $x$ must
have even order, say $2z$, and then $y$ has a pole of order~$3z$
at~$v$.  Differentiating~(\ref{Egen}) we find that
\be
\frac{dy}{dt} = x^2 \frac{dx}{dt} + \frac{dA_6}{dt},
\label{diff}
\ee
whence $dx/dt$ vanishes at~$v$ to order at least $4z-(3z+1)\geq0$.
Thus in this case too we see that $x$ is $v$-integral modulo squares.

Finally let $v\teq v_\infty$ be the infinite place, and $P\teq(x,y)$
a nonzero point of~$E(K_v)$.  As in Prop.~2 we see that since $A_6$
has a pole at~$v_\infty$ of odd order~$d$, but $y^2+y$ cannot have
a pole of odd order there, it follows that either $x$ has valuation
exactly $-d/3$ with $x^3/A_6\equiv1\bmod v_\infty$ (in which case
we're done), or a pole of even order $2z>d/3$.  In the latter case,
$y$ has a pole of order~$3z$, when by~(\ref{diff}) the valuation of
$dx/dt$ at~$v_\infty$ is either $4z-d-1$ or (if $3z\geq q$)
at least $z-1$.  Thus in each case $\epsilon(P)$ lies in the subset
of $K_v/K_v^2$ specified in the statement of Thm.~2.   Since $K$\/
is a function field of genus~0, any $x\in K$\/ has a decomposition
into partial fractions which provides a representative of $x\bmod K^2$
whose pole at each place~$v$ has the same order as the best local
representative of $x\bmod K_v^2$; thus we can identify the
global Selmer group of~$\phi$ with the odd polynomials whose
class mod~$K_{v_\infty}^2$ is in the local Selmer group
at $v_\infty$.~~$\Box\,\Box$

We now return to our curves~(\ref{Etwist}) over the field~$k$\/ of
$q^2=2^{2n}$ elements:

{\bf Corollary.}  {\em For $n\leq3$ equality holds in the
estimates~(\ref{Ldens_even},\ref{Ldens_odd}) of Thm.~1
on $\delta(L_0)$.}

{\em Proof}\/:  In each case Thm.~2 gives a $(\Z/2)$-vector space
of dimension $r/2\teq2^n$ containing the Selmer group,
so $\Sha_\phi$ and thus also $\Sha$ is trivial, and we need
only exhibit a polynomial solution of~(\ref{Etwist}) whose
$x$-coordinate has degree $2(\lfloor q/6 \rfloor + 1)$.  Thus
for $n\teq1$ the Selmer group is contained in
$\{at|a\in k\}$, a $(\Z/2)$-vector space of dimension~2, and
$(x,y)=(t^2,t^3)$ is a minimal vector in~$L_0$ of norm~2.
For $n\teq2$ we get the 4-dimensional space $\{at|a\in k\}$,
and minimal vectors $(x,y)=(t^2+t+b,t^3+(b^8+1)t^2+bt+c)$
with $b\in k$ of trace~1 and $c^2+c=b^3+a_6$.  For $n\teq3$
we find the space $\{at^3+bt|a^4=a,b\in k\}$ of dimension $2+6=8$,
and a minimal vector $(x,y)=(t^4+t^2+t,t^6+t^5+t^4+t^3)$.~~$\Box$

(By regarding these minimal vectors as certain maps~(\ref{ftwist})
from the hyperelliptic curve~$C$\/ to~$E_0$ we could obtain a less
ad-hoc construction: for $n\teq1$ we have $C=E_0$ and the point
$(t^2,t^3)$ becomes the 2-isogeny~$\phi$; and for $n\teq2,3$
we get quotient maps $C\ra C/H \cong E_0$ where $H\subset 2_-^{1+2n}$
is a subgroup isomorphic to $(\Z/2)^{n-1}$ not containing the
involution~$\iota$.  For arbitrary~$n$ it turns out that such maps
generate a subgroup of~$L$ homothetic to the \BW\ lattice
of dimension $2^{n+1}$, a fact we shall demonstrate and exploit
in subsequent papers.)

A closer analysis of the $\phi$-descent at $v_\infty$ allows us
to show that equality holds in~(\ref{Ldens_even},\ref{Ldens_odd})
for several higher~$n$, at least through $n\teq6$.  We illustrate
in detail the case $n\teq5$, which is the first case in which we
obtain a lattice~$L_0$ whose density exceeds the records of~\cite{C-S}.

{\bf Proposition 3.}  {\em Let $k$\/ be the field of $2^{10}\teq1024$
elements, let $K$\/ be the rational function field $k(t)$,
and let $E$\/ be the elliptic curve $y^2+y=x^3+t^{33}$ over~$K$.
The Selmer group for the 2-isogeny $\phi:E\ra E$ is contained in,
and thus equal, to, the subspace of $K/K^2$ represented by the
polynomials
\be
\{ a_{11} t^{11} + a_9 t^9 + a_5 t^5 + a_9^4 t^3 + a_1 t :
a_3,a_5,a_9\in k, a_{11}^4=a_{11} \}
\label{Sel_phi}
\ee
(NB this is an elementary abelian 2-group of rank $2+10+10+10=32$).
The \TS\ group of $E/K$\/ is trivial.
The narrow \MW\ lattice~$L_0$ has rank\/~$64$, discriminant
$\Delta(L_0)=2^{52}$, minimal norm~$12$ and normalized
center density $\delta(L_0)=2^{-26} 3^{32}$.  The points
of the full \MW\ lattice~$L$\/ not contained in~$L_0$
are holes of norm~$11$; using these we can laminate $L_0$ to a
periodic nonlattice sphere packing in $\R^{65}$ of normalized
center density $3^{1/2} \delta(L_0)$.}

{\em Proof}\/: We already know that $L_0$ has rank $2^6=64$.  Once
we identify the space~(\ref{Sel_phi}) with the Selmer group,
the triviality of~$\Sha$ and the formula for the discriminant
will follow from~(\ref{triv_sha}) and~(\ref{Ldisc}), recalling
that $\Delta(L_0) = {[L:L_0]^2 \Delta(L)} = 2^4 \Delta(L)$.
By Thm.~2 the Selmer group is contained in the space of odd polynomials
of degree $\leq11$ in~$t$\/ whose $t^{11}$ coefficient is either zero
or a cube root of unity; furthermore for each cube root of unity~$\xi$
we have a point $(x,y)=(\xi t^{11},0)$ in~$E(K)$ whose image
under~$\epsilon$ is $\xi t^{11}$.  Thus we can subtract $a_{11} t^{11}$
from~(\ref{Sel_phi}) and consider only polynomials of degree $\leq 9$,
which by Thm.~2 must have degree 1, 5, or~9.  In the degree~1 case
there is nothing to prove.  To handle the remaining two cases and thus
complete the $\phi$-descent at infinity we shall use the following

{\bf Lemma.}  {\em Let $k$\/ be a perfect field of characteristic~2
and $(\eta_j)_{j=-\infty}^d$ any sequence of elements of~$k$.  Then
\be
\eta := \sum_{j=-\infty}^d \eta_j t^j \in k((t^{-1}))
\label{eta}
\ee
can be written as $y^2+y$ for some $y\in k((t))$ if and only if
$\eta_0 = y_0^2 + y_0$ for some $y_0\in k$\/, and, for each odd $j_0>0$,
\be
\sum_{m=0}^\infty (\eta_{2^m j_0})^{2^{-m}} = 0.
\label{eta_cond}
\ee
}

(Note that this sum is finite for each~$j$, and the fractional
exponents make sense in~$k$.)

{\em Proof}\/ of Lemma: Simply write $y=\sum_{j=-\infty}^{-d/2} y_j t^j$
and compare~(\ref{eta}) termwise with the power series
\be
y^2 + y = \sum_{j=-\infty}^{-d/2} y_j^2 t^{2j} + y_j t^j
= \sum_{j=-\infty}^d (y_j + y_{j/2}^2) t^j
\label{yy+y}
\ee
(where of course $y_j=0$ if $j$ exceeds $d/2$ or is not an integer).
This uniquely determines $y_j$ for $j<0$ by induction on~$j$ (or by
adapting the trick used in~(\ref{Kv_pt})); the condition
$\eta_0 = y_0^2+y_0$ comes from the constant coefficients;
and eliminating the undetermined coefficients $y\0_{2^m j_0}$
yields~(\ref{eta_cond}).

Now by comparing degrees in~(\ref{diff}) we see that if
$\epsilon((x,y))$ has degree~5 (or degree~9) then $x$ has
a pole of degree~14 (resp.~12) at infinity.  We expand $x$
in a Laurent series at infinity and apply our Lemma to $x^3+t^{33}$.
In the first case we write $x=\sum_{j=-\infty}^{14} x_j t^j$ with
$x_5,x_{14}\neq0$ and $x_j\teq0$ for odd $j>5$; then by taking
$j_0\teq31$ in the Lemma we find $x_3 x_{14}^2 = 0$, whence $x_3=0$.
In the second case we have $x=\sum_{j=-\infty}^{12} x_j t^j$ with
$x_9,x_{12}\neq0$ and $x_{11}\teq0$.  Taking $j=33,31,27$ in our Lemma
we obtain
\be
x_9\0 x_{12}^2 = 1, \quad
x_7\0 x_{12}^2 = x_3\0 x_{12}^2 + x_7\0 x_{10}^2 + x_9^3 = 0,
\label{endgame}
\ee
from which $x_7=0$ and $x_3=x_9^4$ as claimed.

We now know the rank and discriminant of~$L$.  The minimal norm is
at least 12 by Thm.~1; to prove that it equals 12 we need only exhibit
one point with that norm.  By adapting the criterion~(\ref{eta_cond})
to polynomials we compute that the degree-12 polynomial
\be
a^{-1} t^{12} + a^2 t^9 + a^5 t^6 + a^8 t^3 + c
\label{adhoc_x}
\ee
is the $x$-coordinate of a polynomial solution of $y^2+y=x^3+t^{33}$
provided\footnote{The condition on~$a$ means that $a^{33}$, the
norm of~$a$ from~$k$\/ to its 32-element subfield, is one of the
15 nonzero elements of that subfield whose trace is~0.}
\be
a^{495} + a^{231} + a^{99} + a^{33} + 1 = 0, \quad
c^8 + c^2 = a^{88} + a^{-11}.
\label{adhoc_cond}
\ee
Finally let $P_0\teq0,P_1,P_2,P_3$ be representatives of $L/L_0$.
Then the open balls of radius $(12/4)^{1/2}=\sqrt3$ in $\R^{64+1}$
centered at $L_0\times\{0\}$ and $(L_0+P_1)\times\{1\}$ are disjoint.
We cannot extend this to a 65-dimensional lattice, because the
next layer $(L_0+2P_1)\times\{2\}=L_0\times\{2\}$ would be too close
to~$L_0\times\{0\}$.  Still we can use the remaining two holes
$P_2,P_3$ to construct a periodic nonlattice packing of 65-dimensional
balls of radius~$\sqrt3$ centered at
\be
\bigcup_{j=0}^3 (L_0 + P_j) \times (4\Z + j)
\label{pack65}
\ee
since $4>\sqrt{12}$, and the normalized center density of this
packing is $\sqrt3$ times that of $L_0$.~~$\Box$

In fact it is feasible to compute the kissing number of these
packings of $\R^{64}$ and $\R^{65}$.  Thus the kissing number
of~$L_0$ or~$L$\/ is the number of polynomials $(x(t),y(t))$
over~$k$\/ with $x$ of degree~12 or~11 such that $y^2+y=x^3+t^{33}$.
This is tantamount to a system of simultaneous equations in the
coefficients of~$x,y$, whose solutions we (assisted by a computer)
may enumerate by eliminating all but a few of the variables and
solving for the rest by trying all values in~$k$.  We find that
$L$\/ and $L_0$ have kissing numbers $2^{13} 3^3 7\cdot 11=17031168$
and $2^{11} 3^4 7^2 11 = 89413632$ respectively, and the nonlattice
packing~(\ref{pack65}) has kissing number
\be
89413632 + \frac23 17031168 = 100767744
= 2^{11} 3^2 7 \!\cdot\! 11 \!\cdot\! 71.
\label{kiss65}
\ee
Thus our construction also yields new record kissing numbers in
dimensions~64 and~65.

\begin{thebibliography}{EOR}
\bibitem[C-S]{C-S} Conway, J.H., Sloane, N.J.A.: {\em Sphere Packings,
Lattices and Groups.}  New York: Springer 1993.
\bibitem[EOR]{EOR} Elkies, N.D., Odlyzko, A.M., and Rush, J.A.:
On the packing densities of superballs and other bodies.
{\em Invent.\ Math.}\ {\bf 105} (1991), 613--639.
\bibitem[G-\mbox{\kern-.15em}V]{G-V} van der Geer, G.,
and van der Vlugt, M.: Reed-Muller Codes and Supersingular Curves I.
{\em Compositio Math.}\ {\bf 84} (1992), 333--367.
\bibitem[Mi]{MILNE} Milne, J.: On a conjecture of Artin and Tate.
{\em Annals of Math.}\ {\bf 102} (1975), 517--533.
\bibitem[N\'e]{NERON} N\'eron, A: Quasi-fonctions et hauteurs sur les
vari\'et\'es ab\'eliennes.  {\em Annals of Math.}\ {\bf 82} (1965),
249--331.
\bibitem[Oe]{OESTERLE} Oesterl\'e, J.: Empilements de sph\`eres.
{\em Ast\'erisque} {\bf 189-90} (1990), 375--398
[= S\'eminaire Bourbaki 6/90, expos\'e 727].
\bibitem[\v{S}-T]{T-S} \v{S}afarevi\v{c}, I.R., Tate, J.T.: The rank of
elliptic curves.  {\em Soviet Math.\ Dokl.}\ {\bf 8} (1967), 917--920.
[trans.\ J.W.S.Cassels from {\em Dokl.\ Akad.\ Nauk SSSR} {\bf 175}
(1967) \#4.]
\bibitem[Sh1]{SHIODA} Shioda, T.: On the \MW\ lattices.
{\em Comment.\ Math.\ Univ.\ St.~Pauli} {\bf 39} (1990), 211--240.
\bibitem[Sh2]{SHIODA:SPH} Shioda, T.: \MW\ lattices and sphere
packings.  {\em Amer.\ J.\ Math.}\ {\bf 113} (1991), 931--948.
\bibitem[Si]{SILVERMAN_HT} Silverman, J.H.: Computing Heights on
Elliptic Curves.  {\em Math.\ of Computation} {\bf 51}
\#183 (July 1988), 339--358.
\bibitem[Ta1]{TATEBSD} Tate, J.: On the conjecture of Birch and 
Swinnerton-Dyer and a geometric analog.
{\em S\'em.\ Bourbaki} {\bf 306} (1965--66).
\bibitem[Ta2]{TATETHM} Tate, J.: Endomorphisms of Abelian Varieties
over Finite Fields.  {\em Invent.\ Math.}\ {\bf 2} (1966), 134--144.
\bibitem[Ta3]{TATEALG} Tate, J.: Algorithm for determining the type of a
singular fiber in an elliptic pencil, Lect.\ Notes in Math.\ 476
({\em Modular Functions of One Variable~IV}), 33--52 (1975).
\bibitem[Ts]{TSF_JA} Tsfasman, M.A.: Global fields, codes and sphere
packings.  {\em Ast\'erisque} {\bf 198-199-200} (1991;
proceedings of Journ\'ees Arithm\'etiques 1989), 373--396.
\end{thebibliography}

\vspace*{5ex}
\begin{small}
\noindent 
Dept.\ of Mathematics\\
Harvard University\\
Cambridge, MA 02138 USA\\ \\
November, 1993
\end{small}

\end{document}
