Chapter 1

Introduction

Definition 1.1 An elliptic curve E over a field k of characterstic ≠ 2 is defined by an equation

y^{2} = x^{3} + ax^{2} + bx + c,

where the cubic on the right has distinct roots.

Remarks:

1. There are several ways of defining elliptic curves. We have chosen the definition above because it is the most concrete, and requires no further explanation.

2. An alternative definition is that an elliptic curve over a field k is a non-singular cubic curve over k containing at least one point defined over k. By a cubic curve we mean a curve defined by a cubic polynomial

ax^{3} + bx^{2}y + cxy^{2} + dy^{3} + ex^{2} + fxy + gy^{2} + hx + iy + j = 0.

We will see in Chapter 2 exactly what is meant by non-singular; but informally it means that the curve does not cross itself like

y^{2} = x^{3} + x,

or have a cusp like

y^{2} = x^{3}.

We shall see too that the curve

y^{2} = x^{3} + ax^{2} + bx + c

is non-singular precisely when the cubic on the right is separable, ie has distinct roots.

428–99 1–1 3. The additive group on an elliptic curve is most naturally seen in this

context; if P, Q, R are three points defined over k (ie with coordinates in k) on the cubic curve then P + Q + R = 0 if and only if P, Q, R are collinear.

Note one subtle (and important) point about this definition: if P, Q are two points on the curve defined over k then the line P Q meets the curve in a third point defined over k. This follows from the fact that if two of the roots α, β of the cubic polynomial

p(x) = Ax^{3} + Bx^{2} + Cx + D (A, B, C, D ∈ k)

lie in k then so does the third root γ, since

α + β + γ = −B/A.

It follows that the points defined over k form a group. Since a curve defined over k is also defined over any extension field K ⊃ k, there is a group E(K) defined for each such field.

In particular, in the rational case k = ℚ which specially concerns us we can consider the groups over ℚ, ℝ and ℂ, as well as over the p-adic fields ℚ_{p} which we shall introduce in Chapter ??. Each of these groups tells us something about the elliptic curve we are studying.

4. We’ve skated over one difficulty; the line P Q may not meet the curve again. We have to pass from affine to projective geometry, in effect adding a line at infinity where P Q can meet the curve in this case. All this will be detailed in Chapter 2

5. There is an even more general definition. To every curve there corresponds a non-negative integer g, the genus of the curve. An elliptic curve over k is a curve of genus 1 over k containing at least one point defined over k.

(The reason for adding the condition that the curve must contain a point over k is that the set of points defined over k form an abelian group, as we have said; and a group, by definition, must be non-empty.)

Lines and conics are curves of genus 0. Such curves are said to be rational, since the points on the curve can be parametrised by rational functions, at least if k is algebraically closed. For example, the circle x^{2} + y^{2} = 1 can be parametrised by

x = \frac{t^{2} − 1}{t^{2} + 1}, y = \frac{2t}{t^{2} + 1}.

428–99 1–2 From this point of view, elliptic curves are the least complicated curves after the conics studied by the ancient Greeks.

Our earlier definitions of an elliptic curve were set in the plane; but this definition — an elliptic curve is a curve of genus 1 — extends to curves in any number of dimensions.

6. An elliptic curve defined by an equation

y^{2} = x^{3} + ax^{2} + bx + c

is said to be in Weierstrass normal form, or just normal form.

If the characteristic of k is ≠ 2 or 3, we can simplify this equation by the change of coordinate x′ = x+a/3, making the coefficient of x^{2} zero, ie bringing the equation to the form

y^{2} = x^{3} + bx + c.

We shall say that the curve in this case is in Weierstrass reduced form, or just reduced form.

7. Although we excluded fields k of characteristic 2 in our definition above, we do consider elliptic curves over such fields. But in this case we have to allow the equation to take the more general form

y^{2} + c_{1}xy + c_{3} = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}.

(We shall see in due course the reason for this rather curious numbering of the coefficients. Note that there is no coefficient c_{5}.)

We shall say that the curve in this case is in Weierstrass general form.

Note that if the characteristic of k is not 2 then we can bring the equation above to standard form by ‘completing the square’ on the left:

(y + c_{1}x/2 + c_{3}/2)^{2} = x^{3} + (c_{2} + c_{1}^{2}/4)x^{2} + (c_{4} + c_{1}c_{3}/2)x + (c_{6} + c_{3}^{2}/4),

ie by the change of coordinate y′ = y + c_{1}x/2 + c_{3}/2.

8. There is another way of looking at elliptic curves, through the theory of doubly periodic functions f(z) of a complex variable. Although this does not lend itself to a definition, it was in fact the origin of the theory of elliptic curves, as well as the explanation for the use of the word ‘elliptic’.

428–99 1–3 The familiar trigonometric functions cos x, sin x, tan x, etc, are singly periodic functions f(x) of a real variable:

f(x + 2π) = f(x).

By analogy, we say that f(z) is doubly periodic, with periods ω_{1}, ω_{2} (where ω_{1}/ω_{2} ∉ ℝ), if

f(z + ω_{1}) = f(z), f(z + ω_{2}) = f(z).

It turns out (as we shall see in Chapter 8) that all such functions can be expressed in terms of one such function, Weierstrass’ elliptic function

φ(z) = φ_{ω_{1},ω_{2}}(z).

More precisely, if f(z) is even then it is a rational function of φ(z):

f(z) = \frac{P (φ(z)}{Q(φ(z)}

where P (w), Q(w) are polynomials.

As we shall see, φ(z) and its derivative φ′(z) satisfy an equation

φ′(z)^{2} = 4φ(z)^{3} + Bφ(z) + C.

(This is where the term elliptic comes from; because of this relation the function φ(z) can be used to compute integrals around an ellipse.)

We see from this equation that the points (φ(z), φ′(z)/2) parametrise the elliptic curve

y^{2} = x^{3} + bx + c,

where b = B/4, c = C/4 — much as (cos t, sin t) parametrises the circle x^{2} + y^{2} = 1. It turns out that every elliptic curve over ℂ can be parametrized by a Weierstrass elliptic function in this way; and this provides a powerful analytical tool for studying elliptic curves.

1.1 The discriminant

Since our definition requires that the cubic polynomial

p(x) = x^{3} + ax^{2} + bx + c

on the right hand side of our equation should be separable, ie should have distinct roots, it is useful to establish a criterion for this.

428–99 1–4 Definition 1.2 Suppose the polynomial

f(x) = x^{n} + c_{1}x^{n−1} + ⋯ + c_{n}

has roots α_{1}, …, α_{n}. The discriminant of f is defined to be

D(f) = ∏_{i<j}(α_{i} − α_{j})^{2}.

Equivalently,

D(f) = (−1)^{n(n−1)/2} ∏_{i≠j}(α_{i} − α_{j}),

where now each pair occurs twice, once as α_{i} − α_{j} and once as α_{j} − α_{i}. The following is an immediate consequence of the definition.

Proposition 1.1 The polynomial f(x) is separable (has distinct roots) if and only if

D(f) ≠ 0.

Since D(f) is a symmetric function of the roots (ie any permutation of the roots leaves D(f) unchanged) it is expressible as a polynomial in the coefficients of f:

D(f) = D(c_{1}, …, c_{n}).

To determine this polynomial explicitly we start with the following result.

Proposition 1.2 The polynomial f(x) has a multiple root if and only if f(x) and its derivative f′(x) have a factor in common:

f(x) separable ⟺ gcd(f, f′) = 1.

Proof ▶ Suppose first that f(x) has a multiple root, say

f(x) = (x − α)^{r}g(x).

Then

f′(x) = (x − α)^{r−1} (g(x) + (x − α)g′(x)) .

Thus if r > 1,

(x − α) | gcd(f(x), f′(x)).

Conversely, suppose this is so. If

f(x) = (x − α)g(x)

428–99 1–5 then

f′(x) = g(x) + (x − α)g′(x)

and so

(x − α) | f′(x) ⟹ (x − α) | g(x)
⟹ (x − α)^{2} | f(x).

◀

As this suggests, the discriminant of a polynomial is closely related to the resultant of two polynomials, which tells us if those polynomials have a root in common.

Definition 1.3 Suppose the polynomials

f(x) = x^{m} + a_{1}x^{m−1} + ⋯ + a_{m}, g(x) = x^{n} + b_{1}x^{n−1} + ⋯ + b_{n}.

have roots

α_{1}, …, α_{m} and β_{1}, …, β_{n},

respectively. Then the resultant R(f, g) of f and g is defined to be

R(f, g) = ∏_{1≤i≤m,1≤j≤n}(β_{j} − α_{i}).

The following result is immediate.

Proposition 1.3 The polynomials f(x), g(x) have a root in common if and only if R(f, g) = 0.

Now

f(x) = (x − α_{1}) ⋯ (x − α_{m}), g(x) = (x − β_{1}) ⋯ (x − β_{n}).

Thus

R(f, g) = g(α_{1})g(α_{2}) ⋯ g(α_{m}).

Since the expression on the right is symmetric in α_{1}, …, α_{m}, it follows that R(f, g) can be expressed as a polynomial in the coefficients of f and g.

428–99 1–6 Proposition 1.4 The resultant R(f, g) can be expressed as an (m + n) × (m + n) determinant:

R(f, g) = det (\begin{matrix}1 & a_{1} & a_{2} & … & a_{m} & 0 & … & 0 \\ 0 & 1 & a_{1} & … & a_{m−1} & a_{m} & … & 0 \\ & & & … \\ 0 & 0 & 0 & … & & … & a_{m−1} & a_{m} \\ 1 & b_{1} & b_{2} & … & b_{n} & 0 & … & 0 \\ 0 & 1 & b_{1} & … & b_{n−1} & b_{n} & … & 0 \\ & & & … \\ 0 & 0 & 0 & … & & … & b_{n−1} & b_{n} \end{matrix})

Proof ▶ Let us denote this determinant by S(f, g). Suppose f(x) and g(x) have a root, say t, in common. Consider the m + n equations

t^{m−1}f(t) = 0
t^{m−2}f(t) = 0
…
f(t) = 0
t^{n−1}g(t) = 0
t^{n−2}g(t) = 0
…
g(t) = 0

as linear equations in t^{m+n−1}, t^{m+n−2}, …, 1. The determinant of these linear equations is precisely S(f, g). Thus S(f, g) = 0 if f(x) and g(x) have a root in common.

This will certainly be the case if any of the mn relations

α_{i} − β_{j} = 0 (1 ≤ i ≤ m, 1 ≤ j ≤ n)

holds. It follows by the Remainder Theorem that each of these is a factor of S(f, g); and so

R(f, g) | S(f, g).

But now if we express the coefficients of f(x) and g(x) in terms of the α’s and β’s we see that R(f, g) and S(f, g) are of the same degree in β_{1}, …, β_{n}; and on comparing the coefficients of β_{1}^{m} … β_{n}^{m} in R(f, g) and S(f, g) we conclude that

R(f, g) = S(f, g).

◀

428–99 1–7

Let us apply this argument to the polynomials f(x), f′(x). We have seen that f(x) has a repeated root if D(f) = 0; and we have also seen that f(x) has a repeated root if R(f, f′) = 0. It is not surprising therefore to find that there is a relation between these entities.

Proposition 1.5 If f(x) is a monic polynomial then

D(f) = (−1)^{n(n−1)/2}R(f, f′).

Proof ▶ On differentiating

f(x) = ∏(x − α_{i})

and setting x = α_{j},

f′(α_{j}) = ∏_{i≠j}(α_{j} − α_{i}).

It follows that

R(f, f′) = ∏_{j} f′(α_{j})

= ∏_{i≠j}(α_{j} − α_{i})

= (−1)^{n(n−1)/2} ∏_{j<i}(α_{j} − α_{i})^{2}

= (−1)^{n(n−1)/2}D(f).

In other words,

D(f) = (−1)^{n(n−1)/2}R(f, f′).

◀

Now we can apply this result to our cubic. First we consider the reduced case.

Proposition 1.6 The discriminant of the polynomial

f(x) = x^{3} + bx + c

is

D(f) = −(4b^{3} + 27c^{2}).

428–99 1–8 Proof ▶ We have

f′(x) = 3x^{2} + b,

and so

D(f) = −R(f, f′)

= − det (\begin{matrix}1 & 0 & b & c & 0 \\ 0 & 1 & 0 & b & c \\ 3 & 0 & b & 0 & 0 \\ 0 & 3 & 0 & b & 0 \\ 0 & 0 & 3 & 0 & b \end{matrix})

= −4b^{3} − 27c^{2}.

◀

It is probably a good idea to remember the discriminant in this reduced case, but not the more general case we turn to now.

Proposition 1.7 The discriminant of the polynomial

f(x) = x^{3} + ax^{2} + bx + c

is

D(f) = −4a^{3}c + 18abc − 4b^{3} − 27c^{2}.

Proof ▶ We could determine this in the same way, by computing the determinant

D(f) = − det (\begin{matrix}1 & a & b & c & 0 \\ 0 & 1 & a & b & c \\ 3 & 2a & b & 0 & 0 \\ 0 & 3 & 2a & b & 0 \\ 0 & 0 & 3 & 2a & b \end{matrix}) .

Alternatively, it may be simpler to observe that D(f) is left unaltered by the “change of origin” x′ = x + a/3, since this leaves each factor (α_{i} − α_{j}) unchanged. Thus we can derive the formula for D(f) from the reduced case a = 0 by substituting b − a^{2}/3 for b and c + 2a^{3}/27 − ab/3 for c:

D(f) = −4 (b − a^{2}/3)^{3} − 27 (c + 2a^{3}/27 − ab/3)^{2} .

In either case, the details are left to you! ◀

428–99 1–9

1.2 Weights

The transformation

x ↦ d^{2}x, y ↦ d^{3}y

leaves our equation in standard form, taking

y^{2} = x^{3} + ax^{2} + bx + c

into

y^{2} = x^{3} + a′x^{2} + b′x + c′

where

a′ = d^{2}a, b′ = d^{4}b, c′ = d^{6}c.

We may say that the terms a, b, c have weights 2, 4, 6 respectively. The various invariants we shall meet — in particular the discriminant defined above — are all homogeneous, ie consist of terms of the same weight. This offers a valuable check on the sometimes complicated formulae we shall encounter.

In particular, we see that the disciminant is of weight 12. So it could not contain, for example, a term a^{2}b, since that has weight 8.

428–99 1–10

Introduction

A simple geometric construction allows us to add points on an elliptic curve — that is, a non-singular cubic curve. The resulting abelian group is the basis for the application of elliptic curves in cryptography, number theory and elsewhere.

Our aim in this Chapter is to explain informally — so for the moment we are not on oath! — how points are added, and why this operation is associative. Then in Chapter 3, when we have the tools of projective geometry at our disposal, we can set the theory on a rigorous footing.

1.1 The operation ∗

Let Γ be a cubic curve over the field k defined by a polynomial equation

f(x, y) = 0,

where f(x, y) is a polynomial of degree 3 with coefficients in k, say

f(x, y) = a_{1}x^{3} + a_{2}x^{2}y + a_{3}xy^{2} + a_{4}y^{3} + a_{5}x^{2} + a_{6}xy + a_{7}y^{2} + a_{8}x + a_{9}y + a_{10}.

Let Γ(k) denote the set of points P = (x, y) ∈ Γ defined over k, ie with coordinates x, y ∈ k.

Suppose P, Q ∈ Γ(k). Let ℓ be the line P Q if P ≠ Q, or the tangent at P if P = Q. Then ℓ meets Γ in a third point R ∈ Γ(k).

For if ℓ is the line

y = mx + d

then

m = \frac{y_{2} − y_{1}}{x_{2} − x_{1}}

428–99 1–1 if P ≠ Q; while

m = \frac{(∂f/∂x)_{P}}{(∂f/∂y)_{P}}

if P = Q. In either case,

m ∈ k;

and so also

d = y_{1} − mx_{1} ∈ k.

But P Q meets Γ where

u(x) = f(x, mx + d) = 0.

Now u(x) is a cubic polynomial, say

u(x) = b_{0}x^{3} + b_{1}x^{2} + b_{2}x + b_{3},

with coefficients b_{0}, b_{1}, b_{2}, b_{3} ∈ k.

If the roots of this equation are x_{1}, x_{2}, x_{3} then

x_{1} + x_{2} + x_{3} = −\frac{b_{1}}{b_{0}} ∈ k.

Thus

x_{1}, x_{2} ∈ k ⟹ x_{3} = −(x_{1} + x_{2} + b_{1}/b_{0}) ∈ k.

Since

y_{3} = mx_{3} + d ∈ k,

it follows that

R = (x_{3}, y_{3}) ∈ Γ(k),

as we claimed.

We set

R = P ∗ Q.

Evidently this binary operation is commutative:

Q ∗ P = P ∗ Q.  (∗1)

Moreover, the relation between P, Q, R is symmetric:

R = P ∗ Q ⟹ P = Q ∗ R ⟹ Q = R ∗ P.

In other words,

P ∗ (P ∗ Q) = Q.  (∗2)

It follows from this that

P ∗ Q = P ∗ R ⟺ Q = R.  (∗3)

We have skated round two problems in the discussion above:

428–99 1–2 1. The line P Q may not meet the curve Γ again, since the coefficient of x^{3}

in the polynomial u(x) may vanish, leaving a quadratic with the two solutions x_{1}, x_{2}.

For example, consider the curve

x^{2} = y^{3} + 1.

The points P = (2, 3), Q = (−2, 3) lie on this curve; but the line

y = 3

joining them only meets the curve at these two points.

As we shall see in Chapter 2, we can solve this problem completely by passing to the projective plane – in effect adding a ‘line at infinity’ to the affine plane k^{2}. Now every line P Q in the projective plane does meet the curve in three points, the third point perhaps being on the line at infinity.

2. More seriously, in the case P = Q the tangent at P may be undefined.

This happens if

∂f/∂x = ∂f/∂y = 0

at this point. Such a point is said to be singular.

We have to restrict ourselves to non-singular curves, ie those without singular points. That is why we define an ‘elliptic curve’ as a nonsingular cubic curve. This again will be dealt with in Chapter 2.

1.2 Addition

The operation ∗ is not associative. For if it were it would follow from (∗1) that if S = P ∗ P then

S ∗ Q = (P ∗ P) ∗ Q = P ∗ (P ∗ Q) = Q

for all Q, which is absurd.

Remarkably though, if we choose any point O ∈ Γ(k), and set

P + Q = O ∗ (P ∗ Q)

for P, Q ∈ Γ(k) then the operation + is not only commutative — that is obvious — but is also associative:

P + (Q + R) = (P + Q) + R

428–99 1–3 for all P, Q, R ∈ Γ. That is far from obvious.

It is clear however that O is a neutral (or zero) element with respect to this operation:

O + P = O ∗ (O ∗ P) = P,

by (∗1). Moreover, if we set

S = O ∗ O

then the point

P′ = S ∗ P

is the additive inverse of P. For

P′ ∗ P = (S ∗ P) ∗ P = S

and so

P′ + P = O ∗ S = O ∗ (O ∗ O) = O.

Thus we may write

−P = S ∗ P.

It follows that if the operation is associative then it defines an abelian group on Γ(k).

It might seem surprising that we can choose any point O ∈ Γ as the neutral (or zero) point. However, that is not really so. For if we have an abelian group structure on a set A then we take any element a ∈ A and define a new abelian group structure on A by the operation

x † y = x + y − a.

It is readily verified that this new operation is associative:

(x † y) † z = x + y + z − 2a = x † (y † z).

Moreover

x † a = x + a − a = x,

so the element a is the new zero element; and if we set

x′ = −x + 2a

then

x + x′ = x + (−x) + 2a − a = a,

ie x′ is the inverse of x with respect to the new operation.

In effect, all that we have done is to ‘move the origin’ from 0 to a, through the transformation

x ↦ x − a.

428–99 1–4

1.3 The choice of O

Recall that we can choose any point O ∈ Γ(k) as the zero point of our group. What is the best choice?

We saw that

−P = S ∗ P,

where S = O ∗ O (ie S is the point where the tangent at O meets Γ again).

It turns out that life is much simpler if we can choose O so that S = O, ie

O ∗ O = O.

That is, the tangent at O meets Γ in three coincident points: O, O, O. In other words, O is a point of inflexion (or flex) on Γ.

For then, as we have seen,

−P = O ∗ P.

It also follows in this case that

P + Q + R = 0 ⟺ P, Q, R are collinear.

For if P, Q, R are collinear then

R = P ∗ Q ⟹ O ∗ R = O ∗ (P ∗ Q)
⟹ −R = P + Q
⟹ P + Q + R = 0.

Conversely, if P + Q + R = 0 then

P + Q + R = 0 ⟹ −R = P + Q
⟹ O ∗ R = O ∗ (P ∗ Q)
⟹ R = P ∗ Q
⟹ P, Q, R collinear

However, in general a cubic Γ over k does not contain a point of inflexion over k. In fact, Γ may contain no points defined over k at all — let alone points of inflexion — as for example the curve

Γ : x^{3} + 2y^{3} = 4

over ℚ. For if (x, y) ∈ Γ, where x, y ∈ ℚ, then we can write

x = \frac{X}{Z} , y = \frac{Y}{Z} ,

428–99 1–5 where X, Y, Z ∈ ℤ and gcd(X, Y, Z) = 1; and now

X^{3} + 2Y^{3} = 4Z^{3}.

Evidently 2 | X, say X = 2X′. Then

4X′^{3} + Y^{3} = 2Z^{3}.

It follows that 2 | Y, say Y = 2Y′. But now

2X′^{3} + 4Y′^{3} = Z^{3}.

Hence 2 | Z; and so 2 | X, Y, Z, contradicting our assumption that gcd(X, Y, Z) = 1.

On the other hand, we shall show in Chapter 3 that if the elliptic curve E does contain a point P ∈ E(k) then we can find a birational transformation over k taking E into another elliptic curve E′ over k having a point of inflexion O ∈ E′(k). Moreover, this birational transformation preserves the group structure; so nothing is lost, from our point of view, in passing from E to E′.

We may describe an elliptic curve with this property (having a point of inflexion O defined over the base field) as Weierstrassian, since in this case — as we shall see in Chapter 3 — the equation of the curve can be taken in a simple form, due to Weierstrass.

In the rest of the course we shall assume that every elliptic curve E is Weierstrassian, unless the contrary is stated.

1.4 Associativity

There are several ways of showing that our addition is associative. But since we defined addition geometrically, it is appropriate to give a geometric proof of associativity. For the moment, we merely sketch the proof; we shall fill in the details in Chapter 3.

We want to show that

P + (Q + R) = (P + Q) + R

ie

O ∗ (P ∗ (O ∗ (Q + R))) = O ∗ ((O ∗ (P ∗ Q) ∗ R).

Since

O ∗ X = O ∗ Y ⟺ X = Y,

428–99 1–6 we can ‘hive off’ the last O∗; it is sufficient to show that

P ∗ (Q + R) = (P + Q) ∗ R.

There is an equivalent, more symmetric, form of this identity: for any 4 points X, Y, Z, T ∈ E,

(X ∗ Y) ∗ (Z ∗ T) = (X ∗ Z) ∗ (Y ∗ T).  (∗4)

To see that this follows from the associative law, note first that it is sufficient to prove the result in any extension of the ground field k; so we may assume that k is algebraically closed. In that case we can certainly find a point of inflexion O ∈ E; and on taking this as our zero point,

X ∗ Y = O ∗ (X + Y) = −(X + Y).

Thus

(X ∗ Y) ∗ (Z ∗ T) = X + Y + Z + T = (X ∗ Z) ∗ (Y ∗ T).

Conversely, suppose this result holds. On taking X = O, Y = P ∗Q, Z = Q ∗ R, T = Q, we derive the required result:

(P + Q) ∗ R = (Q + R) ∗ P.

It remains to prove the identity (∗4).

The general cubic curve Γ, as we saw, is defined by 10 coefficients:

Γ : a_{1}x^{3} + a_{2}x^{2}y + a_{3}xy^{2} + a_{4}y^{3} + a_{5}x^{2} + a_{6}xy + a_{7}y^{2} + a_{8}x + a_{9}y + a_{10} = 0.

Suppose we are given 8 points P_{1}, P_{2}, P_{3}, P_{4}, P_{5}, P_{6}, P_{7}, P_{8} in the plane, no three of which are collinear. Let us also suppose that there is an elliptic curve E, ie a non-singular cubic, passing through these 8 points.

The cubic Γ passes through a given point P if the coefficients (a_{1}, …, a_{10}) satisfy a certain homogeneous linear equation. Thus Γ will pass through the 8 points if the 10 coefficients satisfy 8 homogeneous linear equations.

Now we know from linear algebra that the solutions of m linear homogeneous equations in n unknowns form a vector space of dimension ≥ n − m. Thus the cubics passing through our 8 points form a vector space of dimension d ≥ 2.

Suppose first that d > 2. We shall show that this leads to a contradiction. For in this case we can impose 2 further homogeneous linear equations; in particular we can find a cubic Γ passing through any further two points Q, R.

428–99 1–7

Let us choose these two points on the line ℓ = P_{1}P_{2}, say, then this line will meet Γ in 4 points, and so will lie wholly in Γ, which must therefore be degenerate:

Γ = ℓC,

where C is a conic.

But this conic C must pass through the 6 points P_{3}, P_{4}, P_{5}, P_{6}, P_{7}, P_{8}. Now a general conic is defined by 6 coefficients:

C : b_{1}x^{2} + b_{2}xy + b_{3}y^{2} + b_{4}x + b_{5}y + b_{6} = 0.

It follows that we can always find a conic passing through 5 points Q_{1}, Q_{2}, Q_{3}, Q_{4}, Q_{5}.

In fact, if no 3 of these 5 points are collinear, then there is exactly one such conic. For if there were two we would have a pencil

C = μ_{1}C_{1} + μ_{2}C_{2};

and we could find a conic in this pencil passing through any further point R. But now if we choose R on ℓ = Q_{1}Q_{2}, say, then the line ℓ meets C in 3 points, and so lies wholly in C. Thus C is degenerate:

C = ℓm,

and the line m must pass through Q_{3}, Q_{4}, Q_{5}, contrary to our assumption that these points were not collinear.

Let C be the conic determined by the points P_{4}, P_{5}, P_{6}, P_{7}, P_{8}. Then it follows from the argument above that this conic passes through P_{3}. But there was nothing special about our choice of P_{1}, P_{2} out of the 8 points; we could equally well have chosen P_{2}, P_{3} and P_{1}, P_{3}, in which case we would conclude that C passed through P_{1} and P_{2}. It follows that all 8 points must lie on the conic C.

But a conic C and a cubic Γ meet in at most 6 points, unless the cubic is degenerate and contains the conic:

Γ = ℓC.

Thus all the cubics in our pencil must be degenerate. But that is impossible, since we supposed that there was a non-degenerate cubic (the elliptic curve E) passing through the 8 points.

We have shown, therefore, that d = 2, ie the pencil of cubics through the 8 points takes the form

Γ = λ_{1}Γ_{1} + λ_{2}Γ_{2}.

Now Γ_{1} and Γ_{2} meet in at most 9 points. For on eliminating y say from the equations for Γ_{1} and Γ_{2} we obtain a polynomial equation of degree 9 in x,

428–99 1–8 to which the x-coefficients of P_{1}, …, P_{8} provide 8 solutions. It follows that there is a 9th solution, giving a 9th common point P_{9} on Γ_{1} and Γ_{2}. (It also follows — although we make no use of this — that if P_{1}, …, P_{8} ∈ Γ(k) then P_{9} ∈ Γ(k), by the same argument we used to show that if P, Q ∈ Γ(k) then P ∗ Q ∈ Γ(k).)

We have proved (more-or-less) the remarkable result that given any 8 points P_{1}, …, P_{8} (no 3 of which are collinear) there exists a unique 9th point P_{9} with the property that every cubic Γ through P_{1}, …, P_{8} also passes through P_{9}.

To prove the associative law, we apply this result to the 8 points

X, Y, Z, T, X ∗ Y, X ∗ Z, Y ∗ T, Z ∗ T.

These points all lie on the elliptic curve E, of course, and they also lie on 2 sets of 3 lines, as follows

ℓ  m  n
ℓ′ X  Y X ∗ Y
m′ Z  T Z ∗ T
n′ X ∗ Z Y ∗ T

Now consider the 3 cubics

E, ℓmn, ℓ′m′n′.

Each of these passes through the 8 points, and so belongs to the pencil defined by those points. Hence

E = λℓmn + λ′ℓ′m′n′

for some λ, λ′ ∈ k.

Moreover, E and ℓmn meet in the further point

(X ∗ Y) ∗ (Z ∗ T) ∈ E ∩ ℓmn;

while E and ℓ′m′n′ meet in the further point

(X ∗ Z) ∗ (Y ∗ T) ∈ E ∩ ℓ′m′n′;

It therefore follows from our argument above that

(X ∗ Y) ∗ (Z ∗ T) = (X ∗ Z) ∗ (Y ∗ T).

This establishes the identity (∗4), and so the associativity of our addition.

428–99 1–9

From Affine to Projective Geometry

2.1 Projective spaces

One of the great discoveries of the Italian school of algebraic geometry around the turn of the century was that life becomes much easier if one “completes” the affine space k^{n} by adding “points at infinity” to form the projective space ℙ^{n}(k).

Suppose V is a vector space over the field k. The associated projective space ℙV is the set of 1-dimensional subspaces of V. In other words, ℙV is the quotient-set

ℙV = (V − {0}) /k^{×},

where k^{×} denotes the multiplicative group on the set k − {0}.

Thus each non-zero vector v ∈ V defines a point of ℙV; 2 non-zero vectors u, v defining the same point if they are scalar multiples of one another, ie

v = ρu (ρ ∈ k^{×}).

The dimension of ℙV is defined to be

dim ℙV = dim V − 1.

Each r-dimensional vector subspace U ⊂ V defines an (r − 1)-dimensional projective subspace of ℙV.

We define n-dimensional projective space ℙ^{n}(k) over k to be

ℙ^{n}(k) = ℙ(k^{n+1}) = (k^{n+1} − {0}) /k^{×}.

428–99 2–1 Each point of ℙ^{n}(k) is represented by a set of n + 1 homogeneous coordinates

[X_{1}, …, X_{n}, X_{n+1}].

not all 0. Proportional coordinates define the same projective point:

ρ[X_{1}, …, X_{n}, X_{n+1}] = [ρX_{1}, …, ρX_{n}, ρX_{n+1}] = [X_{1}, …, X_{n}, X_{n+1}].

There is a natural embedding of the affine space k^{n} into the projective space ℙ^{n}(k),

k^{n} ⊂ ℙ^{n}(k),

defined by the injective map

(x_{1}, …, x_{n}) ↦ [x_{1}, …, x_{n}, 1].

The points of ℙ^{n}(k) not in k^{n}, namely the points of the form

[X_{1}, …, X_{n}, 0]

are called ‘points at infinity’. They form an (n − 1)-dimensional projective subspace of ℙ^{n}(k).

2.2 The Projective Plane

We shall be mainly concerned with geometry in the projective plane

ℙ^{2}(k) = {[X, Y, Z] : X, Y, Z ∈ k]}.

We identify the affine plane k^{2} with the subset Z ≠ 0 of ℙ^{2}(k), by the map

(x, y) ↦ [x, y, 1] : k^{2} → ℙ^{2}(k).

The points of ℙ^{2}(k) not in k^{2} form the line at infinity Z = 0.

Each affine line

ax + by + c = 0

in the affine plane k^{2} extends to the projective line

aX + bY + cZ = 0

in ℙ^{2}(k), with the addition of a point [−b, a, 0] at infinity.

In general each linear homogenous equation

aX + bY + cZ = 0

428–99 2–2 defines a line in the projective plane ℙ^{2}(k). Each such line except for the line at infinity Z = 0 intersects the affine subspace k^{2} ⊂ ℙ^{2}(k) in an affine line.

Any 2 distinct projective lines

aX + bY + cZ = 0, a′X + b′Y + c′Z = 0

intersect in a point; while any 2 distinct points in ℙ^{2}(k) define a unique projective line. This perfect duality between points and lines (or in n dimensions, between points and (n − 1)-dimensional subspaces) is a minor advantage of projective geometry.

Two affine lines are parallel if and only if the corresponding projective lines meet on the line at infinity.

2.3 The Projective Group

An invertible (non-singular) linear map

t : V → V

induces a map

t̄: ℙV → ℙV,

where ℙV is the corresponding projective space. Such a map is called a projective transformation.

Two linear maps t, ρt (ρ ∈ k^{×}) define the same linear transformation. Thus the projective transformations form the projective group

P GL(V) = GL(V)/k^{×}.

In particular

P GL(n, k) = GL(n + 1, k)/k^{×}.

If P_{1}, P_{2}, P_{3}, P_{4} are 4 points in the projective plane, no 3 of which are collinear, and Q_{1}, Q_{2}, Q_{3}, P_{4} is a second similar set, then there is a unique projective transformation sending

P_{1} ↦ Q_{1}, P_{2} ↦ Q_{2}, P_{3} ↦ Q_{3}, P_{4} ↦ Q_{4}.

For if we choose coordinates

P_{i} = [X_{i}, Y_{i}, Z_{i}] (i = 1, 2, 3, 4)

then

[X_{4}, Y_{4}, Z_{4}] = a_{1}[X_{1}, Y_{1}, Z_{1}] + a_{2}[X_{2}, Y_{2}, Z_{2}] + a_{3}[X_{3}, Y_{3}, Z_{3}]

428–99 2–3 for some a_{i} ∈ k; and the a_{i} are all non-zero since no 3 of the points are collinear. But now we can take a_{i}[X_{i}, Y_{i}, Z_{i}] to represent P_{i}; and then

P_{4} = P_{1} + P_{2} + P_{3}.

Similarly we can choose coordinates to represent the second set with

Q_{4} = Q_{1} + Q_{2} + Q_{3}.

Each point P can now be written in the form

P = λ_{1}P_{1} + λ_{2}P_{2} + λ_{3}P_{3}.

and the required projective transformation is then given by

P ↦ Q = λ_{1}Q_{1} + λ_{2}Q_{2} + λ_{3}Q_{3}.

In projective geometry, two curves — or other geometric entities — which can be mapped into one another by projective transformations are regarded as ‘the same’.

2.4 Affine and Projective Varieties

An affine variety in k^{n} is defined by a set of simultaneous polynomial equations

P_{1}(x_{1}, …, x_{n}) = 0, …, P_{r}(x_{1}, …, x_{n}) = 0.

(In general one is interested in the solutions of these equations not only in k, but also in its algebraic closure k̄.) Algebraic geometry is the study of varieties.

We shall only be concerned with the simplest of varieties, namely curves in 2 dimensions defined by a single polynomial equation

F (x, y) = 0.

When we pass to projective space ℙ^{n}(k) we deal exclusively with homogeneous polynomials P (X_{1}, …, X_{n}, X_{n+1}), ie those with all terms of the same total degree, eg X^{2}Y +XZ^{2} +2Y^{3}. If P (X_{1}, …, X_{n}, X_{n+1}) is a homogeneous polynomial of degree d then

P (ρX_{1}, …, ρX_{n}, X_{n+1}) = ρ^{d}P (X_{1}, …, X_{n}, X_{n+1}).

Thus it makes sense to speak of the points in projective space ℙ^{n}(k) satisfying the equation P (X_{1}, …, X_{n}, X_{n+1}) if (and only if) P is homogeneous.

428–99 2–4

If p(x_{1}, …, x_{n}) is a polynomial in k^{n} of degree d then the corresponding homogeneous polynomial is

P [X, Y, Z] = Z^{d}p(X/Z, Y/Z).

For example, the homogeneous form of the polynomial

p(x, y) = y^{2} − x^{3} − ax^{2} − bx − c

of degree 3 is

P (X, Y, Z) = Y^{2}Z − X^{3} − aX^{2}Z − bXZ^{2} − cZ^{3}.

If effect we replace x and y by X and Y, and multiply each term by a power of Z to bring it up to degree d.

In this way, every affine variety V in k^{n} extends to a projective variety V̄ in ℙ^{n}(k), with

V̄ ∩ k^{n} = V :

ie the restriction of the projective variety V̄ to affine space is just the affine variety V. In general V̄ will contain additional ‘points at infinity’.

2.5 Tangents to a projective curve

Suppose γ is an affine curve in k^{2} defined by the equation

f(x, y) = 0.

Let Γ be the corresponding projective curve in ℙ^{2}(k), defined by the ‘homogenised’ equation

F (X, Y, Z) = 0,

where

F (x, y, 1) ≡ f(x, y).

We assert that the tangent to Γ at the point P = [X_{0}, Y_{0}, Z_{0}] is the line

\frac{∂F}{∂X} X + \frac{∂F}{∂Y} Y + \frac{∂F}{∂Z} Z = 0,

where the partial differential coefficients are computed at the point [X_{0}, Y_{0}, Z_{0}].

Let us verify that this is indeed the projective line corresponding to the usual tangent, if P is a point in the affine plane.

428–99 2–5

First note an important identity satisfied by the partial differential coefficients of a homogeous polynomial F (x, y, z). If F is of degree d then

F (ρX, ρY, ρZ) = ρ^{d}F (X, Y, Z).

Differentiating with respect to ρ and setting ρ = 1,

\frac{∂F}{∂X} X + \frac{∂F}{∂Y} Y + \frac{∂F}{∂Z} Z = dF (X, Y, Z).

The tangent to the affine curve f(x, y) = 0 at the point (x_{0}, y_{0}) is

y − y_{0} = \frac{dy}{dx}(x − x_{0}).

Differentiating f(x, y) = 0 with respect to x,

\frac{∂f}{∂x} + \frac{∂f}{∂y} \frac{dy}{dx} = 0.

Thus the tangent can be written

\frac{∂f}{∂x}(x − x_{0}) + \frac{∂f}{∂y} (y − y_{0}) = 0,

or

\frac{∂f}{∂x}x + \frac{∂f}{∂y} y = \frac{∂f}{∂x}x_{0} + \frac{∂f}{∂y} y_{0}.

Now

(\frac{∂F}{∂x} )_{(x_{0},y_{0},1)} = (\frac{∂f}{∂x})_{(x_{0},y_{0})} ,

since F (x, y, 1) = f(x, y). Moreover

\frac{∂F}{∂X} x_{0} + \frac{∂F}{∂Y} y_{0} + \frac{∂F}{∂Z} = 0,

since F (x_{0}, y_{0}, 1) = 0. Thus the affine tangent can be written in the form

\frac{∂f}{∂x}x + \frac{∂f}{∂y} y + \frac{∂f}{∂z} = 0;

corresponding to the projective line

\frac{∂F}{∂X} X + \frac{∂F}{∂Y} Y + \frac{∂F}{∂Z} Z = 0,

as we claimed.

428–99 2–6 This tangent is defined unless

\frac{∂F}{∂X} = \frac{∂F}{∂Y} = \frac{∂F}{∂Z} = 0,

In this case we say that P is a singular point on the curve. A curve is said to be non-singular if contains no singular points, either in k or in any extension field of k.

We say that the curve F (X, Y, Z) = 0 is degenerate if the polynomail F factorises:

F (X, Y, Z) = G(X, Y, Z)H(X, Y, Z).

A degenerate curve is always singular. For the points where the constituents meet,

G(X, Y, Z) = H(X, Y, Z) = 0,

are necessarily singular.

2.6 The characteristic 2 case

Now that we have defined what we mean by a singular point or a singular curve we can extend our definition of an elliptic curve over k to the case where char(k) = 2.

Definition 2.1 An elliptic curve over a field k is given by an equation

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6} (c_{1}, c_{2}, c_{3}, c_{4}, c_{6} ∈ k)

subject to the condition that the curve must be non-singular.

Note that the new definition is equivalent to our original definition of an elliptic curve when char(k) ≠ 2. For in that case we can complete the square on the left, and bring the equation to standard form; and we have seen that the curve is non-singular in this case precisely when the condition in our original definition — that the cubic on the right should be separable — is satisfied.

First we verify that there is no singularity at infinity.

Proposition 2.1 The curve

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

meets the line at infinity in just one point, [0, 1, 0]. This is a point of inflection on the curve, and is non-singular.

428–99 2–7 Proof ▶ The homogeneous form of the curve in this case is

F (X, Y, Z) = Y^{2}Z + c_{1}XY Z + c_{3}Y Z^{2} − X^{3} − c_{2}X^{2}Z − c_{4}XZ^{2} − c_{6}Z^{3} = 0.

This meets the line at infinity Z = 0 where

X^{3} = 0,

ie thrice at the point [0, 1, 0], which is thus a point of inflection. To see that this point is non-singular, note that

\frac{∂F}{∂Z} = Y^{2} + c_{1}XY + 2c_{3}Y Z − c_{2}X^{2} − 2c_{4}XZ − 3c_{3}Z^{2}

= 1

at [0, 1, 0], since all the terms except the first vanish. ◀

Now suppose char(k) = 2. We shall establish a condition on the coefficients c_{i} for non-singularity.

We have seen that the point [0, 1, 0] on the line at infinity is non-singular. So any singular point is in the affine plane.

In characteristic 2, −1 = 1, 2 = 0, 3 = 1, etc; so we have

\frac{∂F}{∂X} = c_{1}Y Z + X^{2} + c_{4}Z^{2},
\frac{∂F}{∂Y} = c_{1}XZ + c_{3}Z^{2} = Z(c_{1}X + c_{3}Z),
\frac{∂F}{∂Z} = Y^{2} + c_{1}XY + c_{2}X^{2} + c_{6}Z^{2}.

Thus if the point (x, y) = [x, y, 1] is singular then

c_{1}y + x^{2} + c_{4} = 0,
c_{1}x + c_{3} = 0,
y^{2} + c_{1}xy + c_{2}x^{2} + c_{6} = 0.

From the second equation,

c_{1}x = c_{3}.

If c_{1} = 0 this implies that c_{3} = 0, so that ∂F/∂Y = 0 identically. In that case the point (x, y) = [x, y, 1] is singular if

x^{2} + c_{4} = 0,

y^{2} + c_{2}x^{2} + c_{6} = 0.

428–99 2–8 We may not be able to solve these equations in k, but we can always solve them in an extension of k, for example in its algebraic closure k̄. Thus we have established what we said earlier; the curve

y^{2} = x^{3} + ax^{2} + bx + c

is always singular in characteristic 2.

Now suppose c_{1} ≠ 0. In that case

x = c_{3}/c_{1}.

So from the first equation,

y = c_{3}^{2}/c_{1}^{3} + c_{4}/c_{1};

and then from the third equation,

c_{3}^{4}/c_{1}^{6} + c_{4}^{2}/c_{1}^{2} + c_{3}^{3}/c_{1}^{3} + c_{3}c_{4}/c_{1} + c_{2}c_{3}^{2}/c_{1}^{2} + c_{6} = 0.

(Note that (a + b)^{2} = a^{2} + b^{2} in characteristic 2.) Multiplying by c_{1}^{6} and re-ordering the terms,

c_{1}^{6}c_{6} + c_{1}^{4}c_{2}c_{3}^{2} + c_{1}^{4}c_{4}^{2} + c_{1}^{3}c_{3}^{3} + c_{1}^{5}c_{3}c_{4} + c_{3}^{4} = 0.

Conversely, if this is so then either c_{1} = c_{3} = 0, or else c_{1} ≠ 0, in which case on taking

x = c_{3}/c_{1}, y = c_{3}^{2}/c_{1}^{3} + c_{4}/c_{1}

we see that

\frac{∂F}{∂X} = \frac{∂F}{∂Y} = \frac{∂F}{∂Z} = 0

at the point (x, y) = [x, y, 1].

Finally we observe that this point is necessarily on the curve, since

F (X, Y, Z) = X \frac{∂F}{∂X} + Y \frac{∂F}{∂Y} + Z \frac{∂F}{∂Z} .

We have established

Proposition 2.2 The equation

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

defines an elliptic curve in characteristic 2 if and only if

c_{1}^{6}c_{6} + c_{1}^{5}c_{3}c_{4} + c_{1}^{4}c_{2}c_{3}^{2} + c_{1}^{4}c_{4}^{2} + c_{1}^{3}c_{3}^{3} + c_{3}^{4} ≠ 0.

428–99 2–9

2.7 The discriminant of an elliptic curve

We have established two conditions for non-singularity: the condition above when char(k) = 2, and the condition that if char(k) ≠ 2 then the curve

y^{2} = x^{3} + ax^{2} + bx + c

is non-singular if D(p) ≠ 0, where p(x) is the cubic polynomial on the right.

It is natural to ask if we can find a polynomial D(c_{1}, c_{2}, c_{3}, c_{4}, c_{6}) such that the general Weierstrass equation is non-singular — and so defines an elliptic curve — if and only if D ≠ 0, in all characteristics. We shall show that this is indeed the case, though the polynomial we get is so complicated that we shall never write it out explicitly.

Suppose for the moment that char(k) ≠ 2. Then we can bring the curve

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

to standard form by completing the square on the left, giving

y^{2} = x^{3} + ax^{2} + bx + c

with

a = c_{2} + c_{1}^{2}/4, b = c_{4} + c_{1}c_{3}/2, c = c_{6} + c_{3}^{2}/4.

We know that the curve is non-singular in this case if

D(p) = −4a^{3}c + a^{2}b^{2} + 18abc − 4b^{3} − 27c^{2} ≠ 0.

Substituting for a, b, c gives us a horrendous polynomial, say

Δ(c_{1}, c_{2}, c_{3}, c_{4}, c_{6}).

It is clear that the coefficients of this polynomial will have denominators of the form 1/2^{r}. We claim that the highest power of 2 appearing in these denominators is 2^{4} = 16. In other words, the polynomial 16Δ has integer

428–99 2–10 coefficients. To see that this is so, consider

2^{6}Δ = − 2^{8}(c_{2} + c_{1}^{2}/4)^{3}(c_{6} + c_{3}^{2}/4)
+ 2^{6}(c_{2} + c_{1}^{2}/4)^{2}(c_{4} + c_{1}c_{3}/2)^{2}
+ 2^{7}3^{2}(c_{2} + c_{1}^{2}/4)(c_{4} + c_{1}c_{3}/2)(c_{6} + c_{3}^{2}/4)
− 2^{8}(c_{4} + c_{1}c_{3}/2)^{3}
− 2^{6}3^{3}(c_{6} + c_{3}^{2}/4)^{2}
= − (4c_{2} + c_{1}^{2})^{3}(4c_{6} + c_{3}^{2})
+ (4c_{2} + c_{1}^{2})^{2}(2c_{4} + c_{1}c_{3})^{2}
+ 2^{2}3^{2}(4c_{2} + c_{1}^{2})(2c_{4} + c_{1}c_{3})(4c_{6} + c_{3}^{2})
− 2^{5}(2c_{4} + c_{1}c_{3})^{3}
− 2^{2}3^{3}(4c_{6} + c_{3}^{2})^{2}.

Working modulo 4,

2^{6}Δ ≡ −c_{1}^{6}c_{3}^{2} + c_{1}^{6}c_{3}^{2} mod 4.

Thus 2^{4}Δ is a polynomial with integral coefficients.

Definition 2.2 We define the discriminant of the curve

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

to be

D(E) = 2^{4}Δ.

Proposition 2.3 The equation

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

defines an elliptic curve if and only if

D(E) ≠ 0.

Proof ▶ There is nothing to prove if char(k) ≠ 2, since the factor 2^{4} then makes no difference; D(E) = 0 if and only if the discriminant of the cubic x^{3} + ax^{2} + bx + c is 0, which we know is the condition for the curve to be singular.

If char(k) = 2 it is sufficient to show that D(E) reduces to the polynomial in Proposition 2.2. In effect, we have to determine 2^{6}Δ mod 8. From the formulae in the calculation mod4 above,

2^{6}Δ ≡ −12c_{1}^{4}c_{2}c_{3}^{2} + 4c_{1}^{6}c_{6} + 4c_{1}^{4}c_{4}^{2} + 4c_{1}^{5}c_{3}c_{4} + 2^{2}3^{2}c_{1}^{3}c_{3}^{3} − 2^{3}3^{3}c_{3}^{4} mod 8
≡ 4 (c_{1}^{4}c_{2}c_{3}^{2} + c_{1}^{6}c_{6} + c_{1}^{4}c_{4}^{2} + c_{1}^{5}c_{3}c_{4} + c_{1}^{3}c_{3}^{3} + c_{3}^{4}) mod 8

428–99 2–11 Thus in characteristic 2

D(E) = 2^{4}Δ = c_{1}^{6}c_{6} + c_{1}^{5}c_{3}c_{4} + c_{1}^{4}c_{2}c_{3}^{2} + c_{1}^{4}c_{4}^{2} + c_{1}^{3}c_{3}^{3} + c_{3}^{4},

which is exactly the polynomial which we showed vanished if and only if the curve is singular. ◀

2.8 On the Intersection of Curves

Suppose Γ_{1}, Γ_{2} are 2 non-degenerate curves in ℙ^{2} defined by homogeneous equations

F_{1}(X, Y, Z) = 0, F_{2}(X, Y, Z) = 0,

of degrees n_{1}, n_{2}; and suppose

P ∈ Γ_{1} ∩ Γ_{2}.

Then one can define an integer I(P; Γ_{1}, Γ_{2}) ≥ 1, the intersection number of Γ_{1} and Γ_{2} at P.

In the ‘generic’ case, where Γ_{1} and Γ_{2} are non-singular at P, and the tangents to the 2 curves at P are distinct, the intersection number I(P; Γ_{1}, Γ_{2}) = 1.

We shall not define the intersection number in the general case — although the definition is not particularly complicated — but only in the special case which we need, where one (or both) of the curves is a line.

Let Λ then be the line

aX + bY + cZ = 0;

and let Γ be the curve

F (X, Y, Z) = 0,

where F (X, Y, Z) is homogeneous of degree d.

If

P_{1} = [X_{1}, Y_{1}, Z_{1}], P_{2} = [X_{2}, Y_{2}, Z_{2}]

are 2 points of Λ then the general point P ∈ Λ can be written

P = uP_{1} + vP_{2} = [uX_{1} + vX_{2}, uY_{1} + vY_{2}, uZ_{1} + vZ_{2}].

We may regard u, v as homogeneous coordinates for the line Λ.

This line meets the curve where

H(u, v) ≡ F (uP_{1} + vP_{2}) = 0,

428–99 2–12 which is a homogenous equation of degree d in u, v.

If now P = (u_{0}, v_{0}) ∈ Λ ∩ Γ then uv_{0} − vu_{0} is a factor of H(u, v). We define the intersection number I(P; Λ, Γ) to be the multiplicity of this factor in H(u, v).

It is readily verified that this number is independent of the choice of points P_{1}, P_{2} ∈ Λ.

If the ground field k is algebraically closed then H(u, v) factorises completely into linear factors; and it follows that the sum of the intersection numbers is equal to the degree:

∑_{P ∈Λ∩Γ} I(P; Λ, Γ) = deg Γ.

In the general case — where k is not algebraically closed — this reduces to an inequality:

∑_{P ∈Λ∩Γ} I(P; Λ, Γ) ≤ deg Γ.

These results break down if Λ is a factor of Γ, ie

F (X, Y, Z) = (aX + bY + cZ)G(X, Y, Z),

where G is of degree d−1. In this case the intersection numbers are undefined.

Proposition 2.4 Suppose P is a point on the non-singular curve Γ of degree ≥ 2. Let Λ denote the tangent to Γ at P. Then

I(P; Λ, Γ) ≥ 2.

Proof ▶ Let us take P = [X_{0}, Y_{0}, Z_{0}] and a second point Q = [X_{1}, Y_{1}, Z_{1}] on Λ to define the homogeneous coordinates (u, v) on Λ. By the 2-dimensional version of Taylor’s Theorem,

H(u, v) =F (uP + vQ)
=u^{d}F (P) +

u^{d−1}v [(\frac{∂F}{∂X} )_{P} (X_{1} − X_{0}) + (\frac{∂F}{∂Y} )_{P} (Y_{1} − Y_{0}) + (\frac{∂F}{∂Z} )_{P} (Z_{1} − Z_{0})] + · · · .

Since P and Q both satisfy

\frac{∂F}{∂X} X + \frac{∂F}{∂Y} Y + \frac{∂F}{∂Z} Z = 0,

428–99 2–13 the coefficient of u^{d−1}v is 0; while the coefficient of u^{d} is 0 since F (P) = 0. Thus H has a double zero at u = 0, ie

I(P; Λ, Γ) ≥ 2.

◀

Remarks:

1. The result still holds if Γ is singular, provided the tangent Λ is not a factor of Γ.

2. We can use the intersection number to define the ‘badness’ or multiplicity of a singularity. For suppose P is a singular point on the curve Γ. It follows from our equation for H(u, v) above that the coefficient of u^{d−1}v vanishes identically, for any line Λ through P. Thus

min_{Λ∋P} I(P; Λ, Γ) ≥ 2.

We define this minimum to be the multiplicity of the singularity at P.

2.8.1 Bezout’s Theorem

Proposition 2.5 Two curves Γ_{1}, Γ_{2} in ℙ^{2} of degrees n_{1}, n_{2} cannot meet in more than n_{1}n_{2} points, unless they have a factor in common.

Proof ▶ We may assume that the field k we are working over is infinite; for otherwise we can pass to an infinite extension of k (for example, the algebraic closure k̄ of k, or the field k(t) of rational functions over k).

Let the curves be given by the homogeneous equations

F_{1}(X, Y, Z) = 0, F_{2}(X, Y, Z) = 0,

of degrees n_{1}, n_{2}.

Suppose the curves have n_{1}n_{2} + 1 points in common, say

P_{0}, P_{1}, …, P_{n_{1}n_{2}}.

We can find a line ax + by + cz not passing through any of these points; and we can take this line as the line at infinity. Thus we may assume that the n_{1}n_{2} + 1 points are all in the affine plane k^{2}. In this way we can reduce the problem to the affine case, in which the curves are given by affine equations

f_{1}(x, y) = 0, f_{2}(x, y) = 0,

428–99 2–14 where f_{1}, f_{2} are non-homogeneous polynomials of degrees ≤ n_{1}, n_{2}.

By making a further change of coordinates, if necessary, we may assume that the n_{1}n_{2} + 1 points

P_{i} = (x_{i}, y_{i})

have distinct x-coordinates and distinct y-coordinates.

Now let us regard f_{1}, f_{2} as polynomials in y, and let us compute their resultant R(f_{1}, f_{2}). This is a polynomial of degree ≤ n_{1}n_{2} in x.

For each x_{i} the polynomials f_{1}(x_{i}, y), f_{2}(x_{i}, y) have a factor y − y_{i} in common. It follows that the resultant R(x) must vanish for these values of x. Thus R(x) has more roots than its degree, and so must vanish identically.

But that implies that the polynomials f_{1}(x, y), f_{2}(x, y) have a factor in common, say

f_{1}(x, y) = m(x, y)g_{1}(x, y), f_{2}(x, y) = m(x, y)g_{1}(x, y).

It follows that the original homogeneous polynomials have a factor in common:

F_{1}(X, Y, Z) = M(X, Y, Z)G_{1}(X, Y, Z), F_{2}(X, Y, Z) = M(X, Y, Z)G_{1}(X, Y, Z).

◀

Remarks:

1. If the curves have a factor in common, and if the field we are working over is infinite, then of course the curves have an infinity of points in common.

2. The Proposition above is a very feeble form of Bezout’s Theorem, which states in its fullness that if Γ_{1}, Γ_{2} are curves in ℙ^{2}(k), where k is an algebraically closed field, and Γ_{1}, Γ_{2} have no factor in common, then

∑_{P ∈Γ_{1}∩Γ_{2}} I(P; Γ_{1}, Γ_{2}) = deg Γ_{1} deg Γ_{2}.

In other words, the number of points of intersection, if each is counted with due multiplicity, is equal to the product of the degrees.

There is a small addendum to Bezout’s Theorem which we shall find very useful.

Proposition 2.6 Suppose the curves Γ_{1}, Γ_{2} of degrees n_{1}, n_{2} over k have (n_{1}n_{2} − 1) points over k in common, but have no factor in common. Then they have a further point over k in common.

428–99 2–15 Proof ▶ When we eliminate Z say as above (in the proof of Bezout’s Theorem) we are left with a homogeneous polynomial over k of degree n_{1}n_{2} in X, Y. We know that this polynomial has (n_{1}n_{2} − 1) roots in k. It follows that the last root is also in k, by the homogeneous analogue of the fact that the sum of the roots of the polynomial

t^{d} + a_{1}t^{d−1} + ⋯ + a_{d} = 0

is equal to −a_{1}. ◀

In effect we have used a particular case of this result (with n_{1} = 1, n_{2} = 3) in our assertion that if P, Q ∈ E then P ∗ Q ∈ E; the line P Q meets E in two points over k, so it meets E in a third point over k.

2.9 Points of Inflection

Consider the curve

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6},

or in homogeneous form,

F (X, Y, Z) = Y^{2}Z + c_{1}XY Z + c_{3}Y Z^{2} − X^{3} − c_{2}X^{2}Z − c_{4}XZ^{2} − c_{6}Z^{3} = 0.

This meets the line at infinity Z = 0 where

X^{3} = 0,

ie thrice at the point [0, 1, 0]. Thus the line at infinity is the tangent to the curve at [0, 1, 0] — but it is more than that, it is a point of inflection.

Definition 2.3 A non-singular point P on the curve

Γ : F (X, Y, Z) = 0

is said to be a point of inflection (or flex) if the tangent Λ at P intersects Γ with multiplicity at least 3:

I(P; Λ, Γ) ≥ 3.

Proposition 2.7 Suppose P is a non-singular point on

Γ : F (X, Y, Z) = 0,

428–99 2–16 where F (X, Y, Z) is a homogeneous polynomial of degree ≥ 2. Then P is a point of inflection on Γ if and only if it satisfies the hessian equation

H(X, Y, Z) ≡ det ( \begin{matrix}\frac{∂^{2}F}{∂X^{2}} & \frac{∂^{2}F}{∂X∂Y} & \frac{∂^{2}F}{∂X∂Z} \\ \frac{∂^{2}F}{∂X∂Y} & \frac{∂^{2}F}{∂Y^{2}} & \frac{∂^{2}F}{∂Y ∂Z} \\ \frac{∂^{2}F}{∂X∂Z} & \frac{∂^{2}F}{∂Y ∂Z} & \frac{∂^{2}F}{∂Z^{2}} \end{matrix} ) = 0.

Proof ▶ Let P = [X, Y, Z]; and suppose Q = [X′, Y′, Z′]. Each point of the line P Q can be written in the form

uP + vQ = [uX + vX′, uY + vY′, uZ + vZ′].

We can regard (u, v) as homogeneous coordinates on the line P Q. This line meets Γ where

F (uP + vQ) = 0.

If deg F = d, this expands to

u^{d}F (P) + u^{d−1}v [\frac{∂F}{∂X} X′ + \frac{∂F}{∂Y} Y′ + \frac{∂F}{∂Z} Z′] +

\frac{1}{2}u^{d−2}v^{2} [\frac{∂^{2}F}{∂X^{2}} X′^{2} + \frac{∂^{2}F}{∂Y^{2}} Y′^{2} + \frac{∂^{2}F}{∂Z^{2}} Z′^{2} + 2\frac{∂^{2}F}{∂X∂Y} X′Y′ + 2\frac{∂^{2}F}{∂X∂Z} X′Z′ + 2\frac{∂^{2}F}{∂X∂Z} Y′Z′]+⋯

Thus the line P Q will intersect Γ at P with multiplicity ≥ 3 if and only if

L(X′, Y′, Z′) ≡ \frac{∂F}{∂X} X′ + \frac{∂F}{∂Y} Y′ + \frac{∂F}{∂Z} Z′ = 0

and

M(X′, Y′, Z′) ≡ \frac{∂^{2}F}{∂X^{2}} X′^{2}+\frac{∂^{2}F}{∂Y^{2}} Y′^{2}+\frac{∂^{2}F}{∂Z^{2}} Z′^{2}+2\frac{∂^{2}F}{∂X∂Y} X′Y′+2\frac{∂^{2}F}{∂X∂Z} X′Z′+2\frac{∂^{2}F}{∂X∂Z} Y′Z′ = 0.

The first condition simply states that P Q is the tangent to Γ at P.

On setting Q = P,

F (uP + vP) ≡ 0.

Hence

M(P) = 0.

Thus the equation

Q(X, Y, Z) = 0

represents a conic through P.

Lemma 1 The tangent to the conic M(X, Y, Z) = 0 at P coincides with the tangent to Γ at P.

428–99 2–17 Remark: It would be surprising if this were not so; for in that case we would have defined in an intrinsic way a second line passing through any point P of a curve. One might think of the normal to the curve at P. But angle is not a projective invariant, so this would not make sense.

Proof of Lemma ▷ To avoid confusion, let us for a moment set P = [X_{0}, Y_{0}, Z_{0}].

Then the tangent to M(X, Y, Z) = 0 at P is

(\frac{∂^{2}F}{∂X^{2}} X_{0} + \frac{∂^{2}F}{∂X∂Y} Y_{0} + \frac{∂^{2}F}{∂X∂Z} Z_{0}) X+(\frac{∂^{2}F}{∂X∂Y} X_{0} + \frac{∂^{2}F}{∂Y^{2}} Y_{0} + \frac{∂^{2}F}{∂Y ∂Z} Z_{0}) Y

+ (\frac{∂^{2}F}{∂X∂Z} X_{0} + \frac{∂^{2}F}{∂Y ∂Z} Y_{0} + \frac{∂^{2}F}{∂Z^{2}} Z_{0}) Z = 0.

Now ∂F/∂X, ∂F/∂Y, ∂F/∂Z are all homogeneous polynomials of degree d − 1. But recall that if F (X, Y, Z) is a homogeneous polynomial of degree d then

\frac{∂F}{∂X} X + \frac{∂F}{∂Y} Y + \frac{∂F}{∂Z} Z = dF (X, Y, Z).

Applying this with ∂F/∂X in place of F,

\frac{∂^{2}F}{∂X^{2}} X + \frac{∂^{2}F}{∂X∂Y} Y + \frac{∂^{2}F}{∂X∂Z} Z = (d − 1)\frac{∂F}{∂X} .

Similarly

\frac{∂^{2}F}{∂X∂Y} X + \frac{∂^{2}F}{∂Y^{2}} Y + \frac{∂^{2}F}{∂Y ∂Z} Z = (d − 1)\frac{∂F}{∂Y}
\frac{∂^{2}F}{∂X∂Z} X + \frac{∂^{2}F}{∂Y ∂Z} Y + \frac{∂^{2}F}{∂Z^{2}} Z = (d − 1)\frac{∂F}{∂Z} .

Thus the tangent to the conic M(X, Y, Z) at P is just

\frac{∂F}{∂X} X + \frac{∂F}{∂Y} Y + \frac{∂F}{∂Z} Z = 0,

which is the tangent to Γ at P ◁ Now suppose P is a point of inflection. Then

L(X, Y, Z) = 0 ⟹ M(X, Y, Z) = 0.

It follows that L is a factor of M, say

M(X, Y, Z) = L(X, Y, Z)L′(X, Y, Z),

where L′ is a second line. In particular the conic M(X, Y, Z) is degenerate.

428–99 2–18 Lemma 2 The conic

C(X, Y, Z) ≡ aX^{2} + bY^{2} + cZ^{2} + 2fY Z + 2gXZ + 2hY Z = 0

degenerates into 2 lines if and only if

det A = 0,

where

A = ( \begin{matrix}a & h & g \\ h & b & f \\ g & f & c \end{matrix} ) = 0.

Proof of Lemma ▷ Suppose

C(X, Y, Z) ≡ L_{1}(X, Y, Z)L_{2}(X, Y, Z).

Let the lines L_{1} = 0, L_{2} = 0 meet in the point (X_{0}, Y_{0}, Z_{0}). Then the tangent at (X_{0}, Y_{0}, Z_{0}) is undefined. Thus

Av_{0} = 0,

where

v_{0} = ( \begin{matrix}X_{0} \\ Y_{0} \\ Z_{0} \end{matrix} ) .

Hence A is singular, ie det A = 0.

Conversely, suppose det A = 0. Then we can find X_{0}, Y_{0}, Z_{0} satisfying the equation Av_{0} = 0. It follows that the tangent to Γ at any point P passes through P_{0} = [X_{0}, Y_{0}, Z_{0}]. But now take any point P. The tangent at P cuts the conic C(X, Y, Z) = 0 twice at P and at P_{0}. But a line can only cut a conic twice. It follows that the line P_{0}P lies wholly in the conic, which must thus degenerate into 2 lines. ◁

Putting this together, if P is a flex, then the conic M(X, Y, Z) = 0 is degenerate and so H(X, Y, Z) = 0.

Conversely, if H(X, Y, Z) = 0 then M(X, Y, Z) = 0 is degenerate. Since the tangent to this conic at P is L(X, Y, Z) = 0, this line must be one of the lines making up the conic:

M(X, Y, Z) = L(X, Y, Z)L_{1}(X, Y, Z).

Thus L is a factor of M, and so P is a flex. ◀

428–99 2–19

As we saw, the point [0, 1, 0] is a flex on an elliptic curve given by Weierstrass’ equation. We shall always take this point as the zero element O of the group on the curve. The other flexes are just the points of order 3 in the group. Thus flexes play an important rôle in the theory.

The hessian curve of a cubic is itself a cubic. But 2 cubics meet in at most 9 points — as may be seen by considering the resultant of the 2 polynomials, which is a homogeneous polynomial of degree 9 in 2 variables. It follows that an elliptic curve has at most 9 flexes.

We shall see that an elliptic curve over the reals ℝ has at most 3 flexes; and the same is therefore true of an elliptic curve over the rationals ℚ (which is our main focus of interest).

2.10 Milestones on the Road to Modern Geometry

Euclid (c325BC–c265BC) Whether the work of one man or a school, the introduction of axiomatic methods in Euclid’s Elements surely marks the greatest leap in the history of mathematics.

René Descartes (1596–1650) By representing a point P in the plane by its coordinates (x, y), Descartes converted geometric into algebraic problems — the start of algebraic geometry.

Bernard Riemann (1826–1866) Although not explicitly geometrical, Riemann’s study of what are today known as Riemann surfaces had a profound influence on the theory of curves — in particular his definition of the genus, the most important characteristic of a curve.

Felix Klein (1849–1925) In his Erlangen program Klein distinguished between different geometries according to their transformation groups — as for example, Euclidean geometry, affine geometry and projective geometry.

David Hilbert (1862–1943) The polynomials satisfied by the points on a variety form an ideal in the ring k[x_{1}, …, x_{n}]. Hilbert showed in his Finite Basis Theorem that every such ideal is generated by a finite number of polynomials.

Severi (1879–1961) and the Italian School studied general algebraic varieties, that is, the points satisfying a set of polynomial equations.

428–99 2–20 André Weil (1906–1998) In his seminal work, The Foundations of Alge-

braic Geometry, Weil provided a secure foundation for the work of the Italian school, and extended it to varieties over finite and other fields, not just ℂ.

Alexandre Grothendieck (1928–) In what is perhaps the greatest mathematical work of the 20th century, Grothendieck merged algebraic geometry with commutative algebra, by extending the notion of variety to include the “scheme” of a commutative ring. For example, to the integers ℤ there corresponds a ‘scheme’ — a generalized variety — over the space

spec(ℤ) = {0, 2, 3, 5, … },

whose points correspond to primes p (more precisely, to prime ideals, hence the inclusion of 0).

428–99 2–21

The Group on an Elliptic Curve

Every elliptic curve E(k) has a natural structure as an abelian group. We will always represent this group additively, denoting the sum of two points P, Q ∈ E(k) by P + Q.

The basic idea is that

P + Q + R = 0 ⟺ P, Q, R are collinear.

But as we shall see, this is not quite sufficient to define the group structure. Also, since this is the basis for the entire theory of elliptic curves we need to ensure that we are on a firm foundation.

Proposition 3.1 Suppose P, Q are points on the elliptic curve E(k). Then the line P Q (or the tangent at P if P = Q) meets E(k) again at a unique point R.

Proof ▶ Let the line P Q (or the tangent at P) be

lX + mY + nZ = 0.

If n ≠ 0 then we can eliminate Z by substituting

Z = −\frac{lX + mY}{n}

in the original cubic equation, giving a homogeneous cubic in X, Y:

a_{0}X^{3} + a_{1}X^{2}Y + a_{2}XY^{2} + a_{3}Y^{3} = 0.

(If n = 0 then we eliminate X or Y in the same way instead.)

Two of the roots of this cubic are given by P, Q, leaving the third root (which must be in the field k) to determine the point R. ◀

428–99 3–1 Remark: When we speak of a root of a homogeneous polynomial in X, Y we mean of course the ratio X_{0} : Y_{0}; and when we say that the root is in k we mean that we can find X_{0}, Y_{0} ∈ k in this ratio.

The proposition that if n − 1 roots of a polynomial p(x) ∈ k[x] lie in k then so does the nth root carries over unchanged to the homogeneous case.

3.1 Choice of zero point

Recall that the elliptic curve

E(k) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

has just one point on the line at infinity, namely [0, 1, 0]. We will always choose this as the zero point of our abelian group:

O = [0, 1, 0].

Accordingly, the inverse −P of any point P is the point where OP meets E(k) again:

−P = O ∗ P.

This gives us the definition of P + Q.

Definition 3.1 Let E(k) be the elliptic curve

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}.

The sum of two points P, Q ∈ E(k) is defined to be

P + Q = O ∗ (P ∗ Q).

It is evident that this operation is commutative:

Q + P = P + Q.

It is clear too that the point O serves as neutral element:

O + P = O ∗ (O ∗ P) = P.

Also each point P has negation −P = O ∗ P, since

P + (O ∗ P) = O ∗ (P ∗ (O ∗ P))

= O ∗ (P ∗ (P ∗ O)) = O ∗ O = O,

428–99 3–2 since the tangent at O meets E again at O, as O is a point of inflection.

However, it is far from evident that the operation is associative:

(P + Q) + R = P + (Q + R)?

We shall prove this important result in the next Chapter. But for the moment we shall assume that it is true, and look at some concrete examples of the group on an elliptic curve.

First though, let us get an explicit expression for −P when

P = (x_{0}, y_{0}) = [x_{0}, y_{0}, 1].

The line OP is

X − x_{0}Z = 0,

since this certainly goes through P and O = [0, 1, 0].

In affine terms this is the line

x = x_{0},

ie the line through P parallel to the y-axis.

Suppose the elliptic curve is in standard form

y^{2} = x^{3} + ax^{2} + bx + c = 0.

In this case the line x = x_{0} meets the curve again at the point (x_{0}, −y_{0}). Thus if the elliptic curve is given in standard form then

−(x, y) = (x, −y).

In the more general case

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

the line x = x_{0} meets the curve where

y^{2} + (c_{1}x_{0} + c_{3})y − (x_{0}^{3} + c_{2}x_{0}^{2} + c_{4}x + c_{6}) = 0.

One root of this equation for y is y_{0}. If the other root is y_{1} then

y_{0} + y_{1} = −(c_{1}x_{0} + c_{3}),

ie

y_{1} = −y_{0} − c_{1}x_{0} − c_{3}.

Thus

−(x, y) = (x, −y − c_{1}x − c_{3}).

428–99 3–3

3.2 Examples

1. Consider the curve

E(ℚ) : y^{2} = x^{3} + 1

over the rationals ℚ. There are 5 obvious points on this curve:

P = (−1, 0), Q = (0, 1), −Q = (0, −1), R = (2, 3), −R = (2, −3). (These all have integer coordinates; but it is important to bear in mind that we are interested in any rational solutions.) Let us determine P + Q. Suppose the line P Q is

y = mx + c.

The slope m is

m = \frac{1 − 0}{0 − (−1)} = 1.

Thus P Q is the line

y = x + 1.

This meets the curve where

(x − 1)^{2} = x^{3} + 1.

We know two of the roots: −1, 0 from P, Q. It follows (by looking at the coefficient of x^{2} that if the third root is x_{2} then

−1 + 0 + x_{2} = 1,

ie

x_{2} = 2.

Thus y_{2} = x_{2} + 1 = 3, ie

P ∗ Q = (2, 3) = R.

It follows that

P + Q = −R = (2, −3).

Next let us determine 2R. To determine the slope at R note that

2y \frac{dy}{dx} = 3x^{2},

428–99 3–4 ie

\frac{dy}{dx} = \frac{3x^{2}}{2y} .

In particular the slope at R is

m = \frac{12}{6} = 2;

and so the tangent at R is

y = 2x − 1.

This line meets the curve again where

(2x + c)^{2} = x^{3} + 1.

Two of the roots of this are 2, 2 from R (twice). Thus if the other root is x_{2} then (from the coefficient of x^{2})

2 + 2 + x_{2} = 2^{2},

ie

x_{2} = 0.

Thus

R ∗ R = (0, −1) = −Q,

and so

2R = Q.

Note that

−P = (−1, 0) = P,

ie

2P = 0;

the point P is of order 2.

428–99 3–5 In fact it is clear that the point P = (x_{0}, y_{0}) on the curve

y^{2} = x^{3} + ax^{2} + bx + c

is of order 2 if and only if y_{0} = 0, ie if and only if P lies on the x-axis. More generally, suppose the curve is given by

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}.

If P = (x_{0}, y_{0}) then as we saw

−P = (x_{0}, −y_{0} − c_{1}x_{0} − c_{3}).

Thus P is of order 2 if and only if

2y_{0} + c_{1}x_{0} + c_{3} = 0,

ie if and only if P lies on the ‘line of symmetry’

2y + c_{1}x + c_{3} = 0.

In either case, the line meets the curve in 0, 1 or 3 points. Thus there are either 0, 1 or 3 points of order 2 on an elliptic curve. Finally, let us determine 2Q. The slope at Q is

m = \frac{0}{2} = 0.

Thus the tangent at Q is y = 1. If this meets the curve again at (x_{2}, y_{2}) then

0 + 0 + x_{2} = 0^{2},

ie

x_{2} = 0.

Hence

Q ∗ Q = Q,

ie

2Q = −Q,

428–99 3–6 ie

3Q = 0.

Thus Q is of order 3, ie Q is a point of inflection on the curve. Since P + Q = −R, while P is of order 2, it follows that ±R are of order 6; and the 6 elements

{0, P, ±Q, ±R}

form a cyclic group of order 6.

We shall see later that these are the only rational points on this elliptic curve:

E(ℚ) = C_{6}.

In particular there are no integers such that

y^{2} = x^{3} + 1

except (x, y) = (−1, 0), (0, ±1), (2, ±3). However, this will require considerable apparatus to establish.

The group on the elliptic curve in this case is finite. There is no known algorithm to determine whether the group on a general elliptic curve over ℚ is finite or infinite. There are techniques which are likely to work in any given case, but there is no guarantee that they will work.

One important property of the group is known: Mordell’s Theorem states that the group on an elliptic curve E over ℚ is finitely-generated. In other words, there are points P_{1}, …, P_{r} ∈ E such that every rational point P ∈ E is expressible in the form

P = n_{1}P_{1} + ⋯ + n_{r}P_{r}.

Our main aim in the first part of the course is to prove Mordell’s Theorem.

2. Let us look at the same equation

E(F_{5}) : y^{2} = x^{3} + 1

but now over the finite field F_{5}. The curve is still non-singular, since

D = −4 = 1

in F_{5}.

428–99 3–7 We can easily find all the points on the curve. We have to find all (x, y) with 0 ≤ x, y ≤ 4, or if we prefer x, y ∈ {0, ±1, ±2}, for which

y^{2} ≡ x^{3} + 1 mod 5.

In other words, we have to determine for each x whether or not x^{3} + 1 is a quadratic residue mod5.

The quadratic residues mod5 are 0, 1, 4. The results are given in the following table:

x x^{3} + 1 y
0  1 ±1
1  2
2  4 ±2
−2 3
−1 0 0

We see that there are 6 points in the group, including the zero point O = [0, 1, 0]:

O, (0, ±1), (2, ±2), (−1, 0).

There is only one abelian group of order 6, namely the cyclic group C_{6} = ℤ/(6). Thus

E(F_{5}) = C_{6}.

There is just one element of order 2, namely P = (−1, 0), since this is the only point of the curve on the x-axis y = 0.

Let us determine the order of Q = (0, 1). The method is exactly the same as in the rational case. As there, the slope of the curve is given by

\frac{dy}{dx} = \frac{3x^{2}}{2y} .

In particular, the slope at Q is m = 0, so that the tangent at Q is

y = 1.

Since this is the only point with y = 1 it follows that

Q ∗ Q = Q,

and so

Q + Q = −Q,

428–99 3–8 ie

3Q = 0.

Thus Q is of order 3, as also is −Q. The remaining 2 points must be of order 6, since C_{6} has 1 element each of orders 1 and 2, and 2 elements each of orders 3 and 6.

(You may feel a little queasy about using the differential calculus over a finite field, or even the rationals. But in fact we are only using the derivative in a formal or algebraic sense, as for example if f(x) is a polynomial over k then

f(x) − f(a) ≡ (x − a)f′(a) mod (x − a)^{2},

ie

f(x) − f(a) = (x − a)f′(a) + (x − a)^{2}g(x)

for some polynomial g(x).)

What is P + Q? We leave that to the reader.

Elliptic curves over finite fields are used in cryptography, both in creating codes and in trying to crack them.

More generally, such curves provide on of the most powerful tools for trying to factorise large numbers.

Determining the number of points on an elliptic curve over a finite field has been an important topic in the development of the theory of elliptic curves, and many questions in this area remain open. If we take an elliptic curve over the field F_{p} (where p ≠ 2) in the form

E(F_{p}) : y^{2} = x^{3} + ax^{2} + bx + c

then we may expect the cubic p(x) = x^{3} +ax^{2} +bx+c to be a quadratic residue for about half the values x ∈ {0, 1, …, p − 1}. Each of these will give two solutions ±y unless y = 0, in which case it gives one. To these we must add the point O = [0, 1, 0]. Thus the ‘expected’ number of solutions is about p+1. Hasse’s Theorem tells us that if the number of points is actually p + 1 + a_{p}, then the ‘discrepancy’ a_{p} is bounded by

|a_{p}| < 2\sqrt{p}.

428–99 3–9 The values of a_{p} for the same equation but different primes p have remarkable and mysterious properties, related to modular forms and Fermat’s Last Theorem, which have still not been elucidated.

That is well beyond the scope of this course (although we shall have something to say about modular forms), but there is one related topic that we shall deal with.

It turns out that any elliptic curve E(ℚ) over the rationals can be ‘reduced modp’ to give a curve E(F_{p}) over the finite field F_{p}. This curve may be singular for a finite set of so-called ‘bad’ primes (for that particular curve), but it will remain an elliptic curve for the remaining primes. Furthermore it will emerge that there is a natural homomorphism

E(ℚ) → E(F_{p})

for each of these ‘good’ primes p; and the study of these homomorphisms is one of the many tools we shall have to hand for studying the curve E(ℚ).

3. Let us look now at the elliptic curve

E(ℚ) : y^{2} = x^{3} − 2x.

We see that this contains the points

P = (0, 0), Q = (2, 2), −Q = (2, −2).

We know that P has order 2.

Let us determine 2Q. The slope is given by

2y \frac{dy}{dx} = 3x^{2} − 2,

ie

\frac{dy}{dx} = \frac{3x^{2} − 2}{2y}

At P,

m = \frac{10}{4} = \frac{5}{2}.

Thus the tangent at P is

(y − 2) = \frac{5}{2}(x − 2),

428–99 3–10 ie

5x − 2y − 6 = 0.

If this tangent meets the curve again at (x_{2}, y_{2}) then

2 + 2 + x_{2} = m^{2} = \frac{25}{4},

ie

x_{2} = \frac{9}{4}.

Thus

P ∗ P = (\frac{9}{4}, \frac{21}{8}) ,

and so

2P = (\frac{9}{4}, −\frac{21}{8}) .

We shall show later that a point (x, y) of finite order on the elliptic curve

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

necessarily has integer coordinates x, y ∈ ℤ. (This is quite difficult to prove — though not as difficult as Mordell’s Theorem! Essentially we have to show that as we successively double the point, 2Q, 4Q, 8Q, …, the denominator of the slope m gets larger and larger.)

It will follow from this that the point Q is of infinite order. In particular the group E(ℚ) in this case is infinite.

4. Next, let us look at a curve in general Weierstrass format:

E(ℚ) : y^{2} − y = x^{3} − x.

We could bring this to standard form, as follows. Completing the square on the left,

(y − 1/2)^{2} = x^{3} − x + 1/4,

428–99 3–11 ie

y_{1}^{2} = x^{3} − x + 1/4

after the change of coordinate y_{1} = y − 1/2.

Note that an equation in standard form remains in standard form under any change of coordinates of the form

x_{2} = a^{2}x, y_{2} = a^{3}y_{1},

since the coefficients of y^{2} and x^{3} will still be the same after such a change. In the present case, if we take a = 2 the equation becomes

y_{2}^{2} = x_{2}^{3} − 16x_{2} + 16,

under the change of coordinates

x_{2} = 4x, y_{2} = 8y − 4.

This device can be used to bring any equation

E(ℚ) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

with rational coefficients to an equation

y^{′2} = x^{′3} + ax′ + b

with integer coefficients a, b.

However, this is not necessarily the best policy, since the coefficients a, b one finishes up with will in general be much larger than the original coefficients.

In the present case, we shall stick with the original equation

E(ℚ) : y^{2} − y = x^{3} − x.

This curve contains a number of obvious points:

P = (0, 0), Q = (1, 0), R = (−1, 0), S = (0, 1), T = (1, 1), U = (−1, 1).

If P = (x, y) ∈ E then

−P = (x, 1 − y).

Thus

−P = S, −Q = T, −R = U.

428–99 3–12 Let us determine P + Q. The line P Q has slope

m = \frac{0}{1} = 0;

so P Q is the line

y = 0.

This meets the curve again at (−1, 0). Thus

P + Q = −(−1, 0) = (−1, 1),

ie

P + Q = U.

Now let us determine 2Q. The slope is given by

(2y − 1)\frac{dy}{dx} = 3x^{2} − 1,

ie

\frac{dy}{dx} = \frac{3x^{2} − 1}{2y − 1}.

In particular, the slope at Q is

m = \frac{2}{−1} = −2.

Thus the tangent at Q is

y = −2x + 2.

This meets the curve where

(−2x + 2)^{2} − (−2x + 2) = x^{3} − x.

Thus if the tangent meets E again at (x_{2}, y_{2}) then (looking as usual at the coefficient of x^{2})

1 + 1 + x_{2} = m^{2} = 4,

and so

Q ∗ Q = (2, −2).

Thus

2Q = −(2, −2) = (2, 3) = V.

We leave it to the reader to determine 2V. Is the order of Q finite or infinite?

428–99 3–13 5. Finally, let us look at the same equation over the field F_{2}:

E(F_{2}) : y^{2} − y = x^{3} − x.

First we must verify that this is an elliptic curve, ie that the curve remains non-singular under ‘reduction mod2’.

The curve takes the homogeneous form (remember that in characterstic 2, −x = x, so that we do not need to worry about sign):

F (X, Y, Z) ≡ Y^{2}Z + Y Z^{2} + X^{3} + XZ^{2} = 0.

Hence

\frac{∂F}{∂X} = X^{2} + Z^{2},
\frac{∂F}{∂Y} = Z^{2},
\frac{∂F}{∂Z} = Y^{2}.

Thus at a singular point, Y = Z = 0, ie the point would be [1, 0, 0], which is not on the curve.

The projective plane ℙ^{2}(F_{2}) contains just 7 points: 4 points in the affine plane F_{2}^{2}, and 3 points on the line at infinity. (In general, the projective plane ℙ^{2}(F_{q}), over a finite field with q elements, contains q^{2} + q + 1 points.

It is trivial to see that E(F_{2}) contains just 5 points: all 4 affine points (0, 0), (0, 1), (1, 0), (1, 1) together with the point O = [0, 1, 0] at infinity.

The only abelian (or non-abelian) group with 5 elements is the cyclic group of order 5. Thus

E(F_{2}) = C_{5}.

As an exercise, verify that if P = (0, 0) then 5P = 0.

3.3 Change of origin

It is perhaps worth noting that we can choose any element in an abelian group A as neutral or zero element. More precisely, if a ∈ A then we can define a new group operation on A by

x † y = x + y − a.

428–99 3–14 This operation is evidently commutative; and it is associative, since

(x † y) † z = x + y + z − 2a = x † (y † z).

The element a acts as new zero element, since

x † a = x + a − a = x;

while x has inverse 2a − x since

x † (2a − x) = a,

which is now the neutral element.

Thus we could have taken any point A ∈ E(k) on the elliptic curve as zero element. However, unless A is a point of inflection we must lose the geometric property that

P + Q + R = 0 ⟺ P, Q, R are collinear.

In fact, if P, Q, R are collinear then

P † Q † R = P + Q + R − 2A = −2A,

so

P † Q † R = A ⟺ 3A = 0 ⟺ A is a point of inflection.

As we shall see, an elliptic curve can have up to 9 points of inflection. But in general the curve

E(k) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

has just one point of inflection: O = [0, 1, 0].

428–99 3–15

The Associative Law

Theorem 4.1 The addition

P + Q = O ∗ (P ∗ Q)

on the elliptic curve

E(k) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

is associative:

P + (Q + R) = (P + Q) + R.

Proof ▶ We have

P + (Q + R) = O ∗ (P ∗ (Q + R)) , (P + Q) + R = O ∗ ((P + Q) ∗ R) . Since

O ∗ (O ∗ P) = P,

it follows that

O ∗ A = O ∗ B ⟺ A = B.

Thus it is sufficient to show that

P ∗ (Q + R) = (P + Q) ∗ R,

ie

P ∗ (O ∗ (Q ∗ R)) = (O ∗ (P ∗ Q) ∗ R.

Lemma 3 The associative law holds if and only if

(P ∗ Q) ∗ (R ∗ S) = (P ∗ R) ∗ (Q ∗ S)

for any four points P, Q, R, S ∈ E(k).

428–99 4–1 Proof of Lemma ▷ Suppose the associative law holds, so that E(k) is an

additive group. Recall that

P ∗ Q = −(P + Q).

Thus

(P ∗ Q) ∗ (R ∗ S) = − ((P ∗ Q) + (R ∗ S))
= − (−(P + Q) − (R + S))
= (P + Q) + (R + S).

Similarly,

(P ∗ R) ∗ (Q ∗ S) = (P + R) + (Q + S)
= (P + Q) + (R + S)
= (P ∗ Q) ∗ (R ∗ S).

Conversely, if this relation holds for all P, Q, R, S then in particular, on setting P = O,

which as we have seen is equivalent to the associative law. ◁

This reduces the theorem to a rather complicated geometric result, involving 10 points on the curve:

X_{1} = P, X_{2} = Q, X_{3} = R, X_{4} = S,
X_{5} = P ∗ Q, X_{6} = R ∗ S, X_{7} = P ∗ R, X_{8} = Q ∗ S,
X_{9} = X_{5} ∗ X_{6}, X_{10} = X_{7} ∗ X_{8}.

The following are collinear:

ℓ_{1} = X_{1}X_{2}X_{5}, ℓ_{2} = X_{3}X_{4}X_{6}, ℓ_{3} = X_{1}X_{3}X_{7}, ℓ_{4} = X_{2}X_{4}X_{8}, ℓ_{5} = X_{5}X_{6}X_{9}, ℓ_{6} = X_{7}X_{8}X_{10}.

We have to show that

X_{9} = X_{10}.

We shall establish this identity for any non-singular cubic curve.

The basic idea is to use pencils of cubics. Suppose

Γ_{1} : F_{1}(X, Y, Z) = 0, Γ_{2} : F_{2}(X, Y, Z) = 0,

are two cubic curves. By the pencil defined by Γ_{1}, Γ_{2} we mean the family of cubic curves

Γ_{r,s} : rF_{1}(X, Y, Z) + sF_{2}(X, Y, Z) = 0.

428–99 4–2 This is a one-dimensional pencil, since each cubic in the family is determined by the ratio [r, s]. More generally, we can consider two-dimensional pencils

Γ_{r,s,t} : rF_{1}(X, Y, Z) + sF_{2}(X, Y, Z) + tF_{3}(X, Y, Z) = 0,

etc.

Note that a general cubic Γ (we are not concerned with singularity or non-singularity for the moment) is defined by 10 coefficients:

Γ : a_{1}X^{3}+a_{2}X^{2}Y +a_{3}X^{2}Za_{4}XY^{2}+a_{5}XY Z+a_{6}XZ^{2}+a_{7}Y^{3}+a_{8}Y^{2}Z+a_{9}Y Z^{2}+a_{10}Z^{3} = 0.

The cubic is unchanged if we multiply all the cubics by the same scalar ρ ∈ k^{×}, so we may say that the cubics form a projective space of dimension 9.

We can always find a cubic passing through any 9 points, since m simultaneous homogeneous linear equations in n > m unknowns always have a non-zero solution.

In general there will be just one such cubic; but there may well be more than one for some sets of 9 points.

Note that three lines ℓ, m, n define a cubic

Γ = ℓmn.

So our pencil could perfectly well consist of cubics

Γ_{r,s} = rℓ_{1}m_{1}n_{1} + sℓ_{2}m_{2}n_{2},

where ℓ_{1}, m_{1}, n_{1}, ℓ_{2}, m_{2}, n_{2} are 6 lines.

◀

428–99 4–3

Chapter 5 The p-adic Case

5.1 The p-adic valuation on ℚ

The absolute value |x| on ℚ defines the metric, or distance function,

d(x, y) = |x − y|.

Surprisingly perhaps, there are other metrics on ℚ just as worthy of study. Definition 5.1 Let p be a prime. Suppose

x = \frac{m}{n} ∈ ℚ,

where m, n ∈ ℤ with gcd(m, n) = 1. Then we set

∥x∥_{p} = \begin{cases}0 & if x = 0, \\ p^{−e} & if p^{e} ∥ m, \\ p^{e} & if p^{e} ∥ n. \end{cases}

We call the function x ↦ ∥x∥_{p} the p-adic valuation on ℚ.

Another way of putting this is: If x ∈ ℚ, x ≠ 0, then we can write

x = \frac{m}{n}p^{e}

where p |̸ m, n. The p-adic value of x is given by

∥x∥_{p} = p^{−e}.

Note that all integers are quite small in the p-adic valuation:

x ∈ ℤ ⟹ ∥x∥_{p} ≤ 1. 428–99 5–1 High powers of p are very small:

p^{n} → 0 as n → ∞.

The following result is immediate. Proposition 5.1 1. ∥x∥_{p} ≥ 0; and ∥x∥_{p} = 0 ⟺ x = 0;

2. ∥xy∥_{p} = ∥x∥_{p}∥y∥_{p};

3. ∥x + y∥_{p} ≤ max(∥x∥_{p}, ∥y∥_{p}).

From (3) we at once deduce Corollary 1 The p-adic valuation satisfies the triangle inequality:

3’ ∥x + y∥_{p} ≤ ∥x∥_{p} + ∥y∥_{p}.

A valuation on a field k is a map

x ↦ ∥x∥ : k → ℝ

satisfying (1), (2) and (3’). A valuation defines a metric

d(x, y) = ∥x − y∥

on k; and this in turn defines a topology on k. Corollary 2 If ∥x∥_{p} ≠ ∥y∥_{p} then

∥x + y∥_{p} = max(∥x∥_{p}, ∥y∥_{p}).

Corollary 3 In a p-adic equation

x_{1} + ⋯ + x_{n} = 0 (x_{1}, …, x_{n} ∈ ℚ_{p})

no term can dominate, ie at least two of the x_{i} must attain max ∥x_{i}∥_{p}.

To emphasize the analogy between the p-adic valuation and the familiar valuation |x| we sometimes write

∥x∥_{∞} = |x|.

428–99 5–2

5.2 p-adic numbers

The reals ℝ can be constructed from the rationals ℚ by completing the latter with respect to the valuation |x|. In this construction each Cauchy sequence

{x_{i} ∈ ℚ : |x_{i} − x_{j}| → 0 as i, j → ∞}

defines a real number, with 2 sequences defining the same number if |x_{i}−y_{i}| → 0.

(There are 2 very different ways of constructing ℝ from ℚ: by completing ℚ, as above; or alternatively, by the use of Dedekind sections. In this each real number corresponds to a partition of ℚ into 2 subsets L, R where

l ∈ L, r ∈ R ⟹ l < r.

The construction by completion is much more general, since it applies to any metric space; while the alternative construction uses the fact that ℚ is an ordered field. John Conway, in On Numbers and Games, has generalized Dedekind sections to give an extraordinary construction of rationals, reals and infinite and infinitesimal numbers, starting ‘from nothing’. Knuth has given a popular account of Conway numbers in Surreal Numbers.)

We can complete ℚ with respect to the p-adic valuation in just the same way. The resulting field is called the field of p-adic numbers, and is denoted by ℚ_{p}. We can identify x ∈ ℚ with the Cauchy sequence (x, x, x, …). Thus

ℚ ⊂ ℚ_{p}.

To bring out the parallel with the reals, we sometimes write

ℝ = ℚ_{∞}.

The numbers x ∈ ℚ_{p} with ∥x∥_{p} ≤ 1 are called p-adic integers. The p-adic integers form a ring, denoted by ℤ_{p}. For if x, y ∈ ℤ_{p} then by property (3) above,

∥x + y∥_{p} ≤ max(∥x∥_{p}, ∥y∥_{p}) ≤ 1,

and so x + y ∈ ℤ_{p}. Similarly, by property (1),

∥xy∥_{p} = ∥x∥_{p}∥y∥_{p} ≤ 1,

and so xy ∈ ℤ_{p}.

Evidently ℤ ⊂ ℤ_{p}.

428–99 5–3 More generally,

x = \frac{m}{n} ∈ ℤ_{p}

if p |̸ n. (We sometimes say that a rational number x of this form is pintegral.) In other words,

ℚ ∩ ℤ_{p} = \{\frac{m}{n} : p |̸ n\}.

Evidently the p-integral numbers form a sub-ring of ℚ.

Concretely, each element x ∈ ℤ_{p} is uniquely expressible in the form

x = c_{0} + c_{1}p + c_{2}p^{2} + ⋯ (0 ≤ c_{i} < p).

More generally, each element x ∈ ℚ_{p} is uniquely expressible in the form

x = c_{−i}p^{−i} + c_{−i+1}p^{−i+1} + ⋯ + c_{0} + c_{1}p + ⋯ (0 ≤ c_{i} < p).

We can think of this as the p-adic analogue of the decimal expansion of a real number x ∈ ℝ.

Suppose for example p = 3. Let us express 1/2 ∈ ℚ_{3} in standard form. The first step is to determine if

\frac{1}{2} ≡ 0, 1 or 2 mod 3.

In fact 2^{2} ≡ 1 mod 3; and so

\frac{1}{2} ≡ 2 mod 3.

Next

\frac{1}{3} (\frac{1}{2} − 2) = −\frac{1}{2} ≡ 1 mod 3

ie

\frac{1}{2} − 2 ≡ 1 · 3 mod 3^{2}.

Thus

\frac{1}{2} ≡ 2 + 1 · 3 mod 3^{2}

428–99 5–4 For the next step,

\frac{1}{3} (−\frac{1}{2} − 1) = −\frac{1}{2} ≡ 1 mod 3

giving

\frac{1}{2} ≡ 2 + 1 · 3 + 1 · 3^{2} mod 3^{3}

It is clear that this pattern will be repeated indefinitely. Thus

\frac{1}{2} = 2 + 3 + 3^{2} + 3^{3} + · · · .

To check this,

2 + 3 + 3^{2} + ⋯ = 1 + (1 + 3 + 3^{2} + ⋯)

= 1 + \frac{1}{1 − 3}

= 1 − \frac{1}{2}

= \frac{1}{2}.

As another illustration, let us expand 3/5 ∈ ℚ_{7}. We have

\frac{3}{5} ≡ 2 mod 7

\frac{1}{7} (\frac{3}{5} − 2) = −\frac{1}{5} ≡ 4 mod 7

\frac{1}{7} (−\frac{1}{5} − 4) = −\frac{3}{5} ≡ 5 mod 7

\frac{1}{7} (−\frac{3}{5} − 5) = −\frac{4}{5} ≡ 2 mod 7

\frac{1}{7} (−\frac{4}{5} − 2) = −\frac{2}{5} ≡ 1 mod 7

\frac{1}{7} (−\frac{2}{5} − 1) = −\frac{1}{5} ≡ 4 mod 7

We have entered a loop; and so (in ℚ_{7})

\frac{3}{5} = 2 + 4 · 7 + 5 · 7^{2} + 2 · 7^{3} + 1 · 7^{4} + 4 · 7^{5} + 5 · 7^{6} + ⋯

428–99 5–5 Checking,

1 + (1 + 4 · 7 + 5 · 7^{2} + 2 · 7) \frac{1}{1 − 7^{4}} = 1 − \frac{960}{2400}

= 1 − \frac{2}{5}

= \frac{3}{5}.

It is not difficult to see that a number x ∈ ℚ_{p} has a recurring p-adic expansion if and only if it is rational (as is true of decimals).

Let x ∈ ℤ_{p}. Suppose ∥x∥_{p} = 1. Then

x = c + yp,

where 0 < c < p and y ∈ ℤ_{p}. Suppose first that c = 1, ie

x = 1 + yp.

Then x is invertible in ℤ_{p}, with

x^{−1} = 1 − yp + y^{2}p^{2} − y^{3}p^{3} + · · · .

Even if c ≠ 1 we can find d such that

dc ≡ 1 mod p.

Then

dx ≡ dc ≡ 1 mod p,

say

dx = 1 + py,

and so x is again invertible in ℤ_{p}, with

x^{−1} = d (1 − yp + y^{2}p^{2} − ⋯) .

Thus the elements x ∈ ℤ_{p} with ∥x∥_{p} = 1 are all units in ℤ_{p}, ie they have inverses in ℤ_{p}; and all such units are of this form. These units form the multiplicative group

ℤ_{p}^{×} = {x ∈ ℤ_{p} : ∥x∥_{p} = 1}.

428–99 5–6

5.3 In the p-adic neighbourhood of 0

Recall that an elliptic curve E(k) can be brought to Weierstrassian form

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

if and only if it has a flex defined over k. This is not in general true for elliptic curves over ℚ_{p}. For example, the curve

X^{3} + pY^{3} + p^{2}Z^{3} = 0

has no points at all (let alone flexes) defined over ℚ_{p}. For if [X, Y, Z] were a point on this curve then

∥X^{3}∥_{p} = p^{3e}, ∥pY^{3}∥_{p} = p^{3f−1}, ∥p^{2}Z^{3}∥_{p} = p^{3g−2}

for some integers e, f, g. But if a, b, c ∈ ℚ_{p} and

a + b + c = 0

then two (at least) of a, b, c must have the same p-adic value, by Corollary 3 to Proposition 5.1.

On the other hand, ℚ_{p} is of characteristic 0; so if E(ℚ_{p}) is Weierstrassian — as we shall always assume, for reasons given earlier — then it can be brought to standard form

y^{2} = x^{3} + bx + c.

In spite of this, there is some advantage in working with the general Weierstrassian equation, since — as we shall see in Chapter 6 — this allows us to apply the results of this Chapter to study the integer points (that is, points with integer coordinates) on elliptic curves over ℚ given in general Weierstrassian form. Such an equation over ℚ can of course be reduced to standard form; but the reduction may well transform integer to non-integer points.

As in the real case, we study the curve in the neighbourhood of 0 = [0, 1, 0] by taking coordinates X, Z, where

(X, Z) = [X, 1, Z].

In these coordinates the elliptic curve takes the form

E(ℚ_{p}) : Z + c_{1}XZ + c_{3}Z^{2} = X^{3} + c_{2}X^{2}Z + c_{4}XZ^{2} + c_{6}Z^{3}.

As in the real case, if Z(P) is small then so is X(P).

428–99 5–7 Proposition 5.2 If P ∈ E(ℚ_{p}) then

∥Z∥_{p} < 1 ⟹ ∥X∥_{p} < 1;

and if this is so then

∥Z∥_{p} = ∥X∥_{p}^{3}.

Proof ▶ Suppose ∥Z∥_{p} < 1. Let

∥X∥_{p} = p^{e}.

If e ≥ 0 then X^{3} will dominate; no other term can be as large, p-adically speaking.

Thus e < 0, ie ∥X∥_{p} < 1; and now each term

∥c_{1}XZ∥_{p}, ∥c_{3}Z^{2}∥_{p}, ∥c_{2}X^{2}Z∥_{p}, ∥c_{4}XZ^{2}∥_{p}, ∥c_{6}XZ∥_{p} < ∥Z∥_{p}.

Only X^{3} is left to balance Z. Hence

∥Z∥_{p} = ∥X^{3}∥_{p} = ∥X∥_{p}^{3}.

◀

Definition 5.2 For each e > 0 we set

E_{(p^{e})} = {(X, Z) ∈ E : ∥X∥_{p} ≤ p^{−e}, ∥Z∥_{p} ≤ p^{−3e}}.

Recall that in the real case, we showed that Z could be expressed as a power-series in X,

Z = X^{3} − c_{1}X^{4} + (c_{1}^{2} + c_{2})X^{5} + · · · .

valid in a neighbourhood of O = [0, 1, 0]. It follows that

F (X, Z(X)) = 0

identically, where

F (X, Z) = Z + c_{1}XZ + c_{3}Z^{2} − (X^{3} + c_{2}X^{2}Z + c_{4}XZ^{2} + c_{6}Z^{3}).

This identity must hold in any field, in particular in ℚ_{p}.

Note that in the p-adic case, convergence is much simpler than in the real case. A series in ℚ_{p} converges if and only if its terms tend to 0:

∑ a_{r} convergent ⟺ a_{r} → 0.

428–99 5–8 Remember too that in the p-adic valuation integers are small,

x ∈ ℤ ⟹ ∥x∥_{p} ≤ 1.

Thus a power-series

a_{0} + a_{1}x + a_{2}x^{2} + ⋯

where a_{i} ∈ ℤ—or more generally, a_{i} ∈ ℤ_{p}—will converge for all x with ∥x∥_{p} < 1.

Proposition 5.3 Suppose ∥Z∥_{p} < 1. Then we can express Z as a powerseries in X,

Z = X^{3} + a_{1}X^{4} + a_{2}X^{5} + ⋯

where

1. a_{1} = −c_{1}, a_{2} = c_{1}^{2} + c_{2}, c_{3} = −(c_{1}^{3} + 2c_{1}c_{3} + c_{3});

2. each coefficient a_{i} is a polynomial in c_{1}, c_{2}, c_{3}, c_{4}, c_{6} with integer coefficients;

3. the coefficient a_{i} has weight i, given that c_{i} is ascribed weight i for (i = 1 − 4, 6.

Proof ▶ By repeatedly substituting for Z on the right-hand side of the equation

Z = X^{3} + c_{2}X^{2}Z + c_{4}XZ^{2} + c_{6}Z^{3} − (c_{1}XZ + c_{3}Z^{2})

we can successively determine more and more terms in the power series. Thus suppose we have shown that

Z = X^{3} (1 + a_{1}X + ⋯ + a_{n−1}X^{n−1}) .

On substituting for Z on the right-hand side of the equation and comparing coefficients of X^{n+3},

a_{n} = c_{2}a_{n−2} + c_{4} ∑_{i+j=n−4} a_{i}a_{j} + c_{6} ∑_{i+j+k=n−6} a_{i}a_{j}a_{k} − c_{1}a_{n−1} − c_{3} ∑_{i+j=n−3} a_{i}a_{j},

from which the result follows. ◀

Corollary If the elliptic curve is given in standard form

y^{2} = x^{3} + ax^{2} + bx + c

then

Z = x^{3} + d_{2}X^{5} + d_{4}X^{7} + ⋯,

where

428–99 5–9 1. only odd powers of X appear, ie d_{i} = 0 for i odd;

2. d_{2} = a, d_{4} = a^{2} + b, d_{6} = a^{3} + 3ab + c;

3. each coefficient d_{2i} is a polynomial in a, b, c with integer coefficients;

4. the coefficient d_{2i} has weight i, given that a, b, c are ascribed weights

2,4,6 respectively; Proof ▶ We note that in the standard case the (X, Z)-equation

Z = X^{3} + aX^{2}Z + bXZ^{2} + cZ^{3}

is invariant under the reflection (X, Z) ↦ (−X, −Z) (corresponding to P ↦ −P). Thus

Z(−X) = −Z(X),

from which the absence of terms of even degree X^{2i} follows. ◀

As in the real case, the sum of 2 points near O is defined by a function S(X_{1}, X_{2}), where

X(P_{1} + P_{2}) = S(X(P_{1}), X(P_{2})).

Proposition 5.4 Suppose ∥X_{1}∥_{p}, ∥X_{2}∥_{p} < 1. Then we can express S(X_{1}, X_{2}) as a double power-series in X_{1}, X_{2},

S(X_{1}, X_{2}) = X_{1} + X_{2} + c_{1}X_{1}X_{2} + ⋯

= ∑_{i} S_{i}(X_{1}, X_{2})

= ∑_{i,j} s_{ij}X_{1}^{i}X_{2}^{j}

where 1. S_{i}(X_{1}, X_{2}) is a symmetric polynomial in X_{1}, X_{2} of degree i;

2. S_{1}(X_{1}, X_{2}) = X_{1} + X_{2}, S_{2}(X_{1}, X_{2}) = c_{1}X_{1}X_{2};

3. the coefficient s_{jk} of X^{j}X^{k} is a polynomial in c_{1}, c_{2}, c_{3}, c_{4}, c_{6} with integral coefficients.

4. all the coefficients in S_{i}(X_{1}, X_{2}) have weight i.

428–99 5–10 Proof ▶ As in the real case, let the line

P_{1}P_{2} : Z = MX + D

meet E again in P_{3} = (X_{3}, Z_{3}), ie

P_{3} = P_{1} ∗ P_{2}.

Then X_{1}, X_{2}, X_{3} are the roots of the equation

X^{3} + c_{2}X^{2}(MX + D) + c_{4}X(MX + D)^{2} + c_{6}(MX + D)^{3}

− (MX + D) − c_{1}X(MX + D) − c_{3}(MX + D)^{2} = 0.

Hence

X_{1} + X_{2} + X_{3} = −\frac{coeff of X^{2}}{coeff of X^{3}}

= \frac{c_{1}M + 2c_{3}M^{2} − (c_{2} + c_{4}M + c_{6}M^{2})D}{1 + c_{2}M + c_{4}M^{2} + c_{6}M^{3}}

Now

M = \frac{Z_{2} − Z_{1}}{X_{2} − X_{1}}

= \frac{X_{2}^{3} − X_{1}^{3}}{X_{2} − X_{1}} − c_{1} \frac{X_{2}^{4} − X_{1}^{4}}{X_{2} − X_{1}} + ⋯

= X_{1}^{2} + X_{1}X_{2} + X_{2}^{2} − c_{1}(X_{1}^{3} + X_{1}^{2}X_{2} + X_{1}X_{2}^{2} + X_{2}^{3}) + ⋯,

D = \frac{X_{2}Z_{1} − X_{1}Z_{2}}{X_{2} − X_{1}}

= X_{1}X_{2} (\frac{X_{2}^{2} − X_{1}^{2}}{X_{2} − X_{1}} − c_{1} \frac{X_{2}^{3} − X_{1}^{3}}{X_{2} − X_{1}} + ⋯)

= X_{1}X_{2} (X_{1} + X_{2} − c_{1}(X_{2}^{2} + X_{1}X_{2} + X_{2}^{2}) + ⋯) .

Thus M, D are both expressible as symmetric power-series in X_{1}, X_{2}; and

∥M∥_{p} ≤ p^{−2}, ∥D∥_{p} ≤ p^{−3},

or more precisely,

M ≡ X_{1}^{2} + X_{1}X_{2} + X_{2}^{2} mod p^{3}
D ≡ X_{1}X_{2}(X_{1} + X_{2}) mod p^{4}.

428–99 5–11 Hence

X_{1} + X_{2} + X_{3} ≡ 0 mod p^{2}.

More precisely,

X_{1} + X_{2} + X_{3} ≡ c_{1}(X_{1}^{2} + X_{1}X_{2} + X_{2}^{2}) mod p^{3},

ie

X_{3} ≡ −(X_{1} + X_{2}) + c_{1}(X_{1}^{2} + X_{1}X_{2} + X_{2}^{2}) mod p^{3}.

In particular,

∥X_{3}∥_{p} ≤ p^{−1},

and so

∥Z_{3}∥_{p} = ∥MX_{3} + D∥ ≤ p^{−3},

ie

P_{1}, P_{2} ∈ E_{(p)} ⟹ P_{3} ∈ E_{(p)}.

Recall that

P_{1} + P_{2} = O ∗ (P_{1} ∗ P_{2}) = O ∗ P_{3}.

By our formulae above, with O, X_{3} in place of X_{1}, X_{2},

X(O ∗ P_{3}) ≡= −X_{3} mod p^{2},

or more precisely

X(O ∗ P_{3}) ≡= −X_{3} + c_{1}X_{3}^{2} mod p^{3},

Hence

X(P_{1} + P_{2}) = X_{1} + X_{2} mod p^{2},

or more precisely

X(P_{1} + P_{2}) = X_{1} + X_{2} − c_{1}(X_{1}^{2} + X_{1}X_{2} + X_{2}^{2}) + c_{1}(X_{1} + X_{2})^{2} mod p^{3}
= X_{1} + X_{2} + c_{1}X_{1}X_{2} mod p^{3}

428–99 5–12

◀

Finally, we turn to the normal coordinate function θ(X), defined as in the real case by

\frac{dθ}{dX} = \frac{1}{∂F/∂Z}

= \frac{1}{1 + c_{1}X + 2c_{3}Z − c_{2}X^{2} − 2c_{4}XZ − 3c_{6}Z^{2}}

Proposition 5.5 Suppose ∥X∥_{p} < 1. Then we can express θ as a powerseries in X,

θ = X + \frac{c}{2}X^{2} + ⋯

= ∑ t_{n}X^{n+1}

where

1. t_{1} = 1, t_{2} = −c_{1}/2;

2. for each i, it_{i} is a polynomial in c_{1}, c_{2}, c_{3}, c_{4}, c_{6} with integral coefficients;

3. t_{i} is of weight i.

Proof ▶ Since

\frac{dθ}{dX} = \frac{1}{1 + c_{1}X + 2c_{3}Z − c_{2}X^{2} − 2c_{4}XZ − 3c_{6}Z^{2}}
= 1 − (c_{1}X + 2c_{3}Z − c_{2}X^{2} − 2c_{4}XZ − 3c_{6}Z^{2})
+ (c_{1}X + 2c_{3}Z − c_{2}X^{2} − 2c_{4}XZ − 3c_{6}Z^{2})^{2} + ⋯

the coefficients in the power-series for dθ/dX are integral polynomials in the c_{i}. It follows on integration that the coefficients t_{i} in the power-series for θ(X) have at worst denominator i.

It remains to show that this power series converges for ∥X∥_{p} < 1.

Lemma 4 For all i,

∥1/i∥_{p} ≤ i.

Proof of Lemma ▷ Suppose

∥i∥_{p} = p^{−e}.

428–99 5–13 Then

p^{e} | i ⟹ p^{e} ≤ i
⟹ ∥1/i∥ ≤ i.

◁

If now ∥X∥_{p} < 1 then

∥X∥_{p} ≤ \frac{1}{p};

and so

∥t_{i}X^{i}∥_{p} ≤ \frac{i}{p^{i}} ,

which tends to 0 as i → ∞. The power-series is therefore convergent. ◀

Note that

p^{i} ≥ 2^{i} = (1 + 1)^{i} > i^{2}/2

if i ≥ 2, while if p is odd, ∥1/2∥_{p} = 1. Thus

∥X∥_{p} ≤ p^{−1} ⟹ ∥X^{i}/i∥_{p} ≤ p^{−2} for i ≥ 2 (p odd)
∥X∥_{2} ≤ 2^{−2} ⟹ ∥X^{i}/i∥_{2} ≤ 2^{−3} for i ≥ 2 (p = 2).

So if p is odd,

θ(X) = X + O(p^{2}) if ∥X∥_{p} ≤ p^{−1};

while if p = 2,

θ(X) = X + O(2^{3}) if ∥X∥_{2} ≤ 2^{−2}.

That is why in our discussion below the argument often applies to P ∈ E_{(p)} if p is odd, while if p = 2 we have to restrict P to E_{2^{2}}.

Theorem 5.1 For each power p^{e}, where e ≥ 1,

E_{(p^{e})}(ℚ_{p})

is a subgroup of E(ℚ_{p}). Moreover the map

θ : E_{(p^{e})}(ℚ_{p}) → p^{e}ℤ_{p}

is an isomorphism (of topological abelian groups), provided e ≥ 2 if p = 2.

428–99 5–14 Proof ▶ The identity

θ(S(X_{1}, X_{2}) = θ(X_{1}) + θ(X_{2}),

which we established in the real case, must still hold; and we conclude from it, as before, that

θ(P_{1} + P_{2}) = θ(P_{1}) + θ(P_{2})

whenever

P_{1}, P_{2} ∈ E_{(p^{e})}(ℚ_{p}).

It follows from this that E_{(p^{e})} is a subgroup; and that

θ : E_{(p^{e})} → p^{e}ℤ_{p}

is a homomorphism, provided e ≥ 2 if p = 2.

Since

θ(X) = X − c_{1}X^{2}/2 + ⋯,

we have

∥θ(X)∥_{p} = ∥X∥_{p}

for all ∥X∥_{p} ≤ p^{−e}. In particular

θ(X) = 0 ⟺ X = 0.

Hence θ is injective.

It is also surjective, as the following Lemma will show.

Lemma 5 The only closed subgroups of ℤ_{p} are the subgroups

p^{n}ℤ_{p} (n = 0, 1, 2, …),

together with {0}. In particular, every closed subgroup of ℤ_{p}, apart from {0}, is in fact open.

Proof of Lemma ▷ ℤ is a dense subset of ℤ_{p}:

\overline{ℤ} = ℤ_{p}.

For the p-adic integer

x = c_{0} + c_{1}p + c_{2}p^{2} + ⋯ (c_{i} ∈ {0, 1, …, p − 1})

is approached arbitrarily closely by the (rational) integers

x_{r} = c_{0} + c_{1}p + ⋯ + c_{r}p^{r}.

428–99 5–15

Now suppose S is a closed subgroup of ℤ_{p}. Let s ∈ S be an element of maximal p-adic valuation, say

∥s∥ = p^{−e}.

Then

s = p^{e}u

where u is a unit in ℤ_{p}, with inverse v, say. Given any ϵ > 0, we can find n ∈ ℤ such that

∥v − n∥ < ϵ.

Then

ns − p^{e} = p^{e}(nu − 1)
= p^{e}u(n − v);

and so

∥ns − p^{e}∥ < ϵ.

Since ns ∈ S and S is closed, it follows that

p^{e} ∈ S.

Hence

p^{e}\overline{ℤ} = p^{e}ℤ_{p} ⊂ S.

Since s was a maximal element in S, it follows that

S = p^{e}ℤ_{p}.

◁

It follows from this Lemma that im θ is one of the subgroups p^{m}ℤ_{p}. But since

∥X∥ = p^{−e} ⟹ ∥θ(X)∥ = p^{−e},

im θ must in fact be p^{e}ℤ_{p}, ie θ is surjective.

A continuous bijective map from a compact space to a hausdorff space is necessarily a homeomorphism. (This follows from the fact that the image of every closed, and therefore compact, subset is compact, and therefore closed.) In particular, θ establishes an isomorphism

E_{(p^{e})} ≅ p^{e}ℤ_{p} ≅ ℤ_{p}.

◀

It follows from this Theorem that E_{(p^{e})} is torsion-free, since ℤ_{p} is torsionfree. Thus there are no points of finite order on E close to O, a result which we shall exploit in the next Chapter.

428–99 5–16

5.4 The Structure of E(ℚ_{p})

We shall not use the following result, but include it for the sake of completeness.

Theorem 5.2 Let F ⊂ E(ℚ_{p}) be the torsion subgroup of the elliptic curve E(ℚ_{p}). Then

E(ℚ_{p}) ≅ F ⊕ ℤ_{p}.

Proof ▶ The torsion subgroup F splits (uniquely) into its p-component F_{p} and the sum F_{p′} of all components F_{q} with q ≠ p:

F = F_{p} ⊕ F_{p′}.

(See Appendix A for details.) Explicitly,

F_{p} = {P ∈ E : p^{n}P = 0 for some n},
F_{p′} = {P ∈ E : mP = 0 for some d with gcd(m, p) = 1}.

(We write E for E(ℚ_{p})).

We also set

E_{p} = {P ∈ E : p^{n}P → O as n → ∞}.

Evidently

E_{p} ⊃ E_{(p)}.

Since E_{(p)} is an open (and therefore closed) subgroup of E, it follows that the same is true of E_{p}.

Lemma 6 p^{n}E_{p} = E_{(p^{e})} for some n, e > 0.

Proof of Lemma ▷ For each P ∈ E_{p},

p^{n}P ∈ E_{(p)}

for some n > 0 since p^{n}P → O and E_{(p)} is an open neighbourhood of O. Hence the open subgroups p^{−n}E_{(p)} cover E_{p}. Since E_{p} is compact, it follows that p^{−n}E_{(p)} ⊃ E_{p} for some n, ie

p^{n}E_{p} ⊂ E_{(p)} ≅ ℤ_{p}.

But by Lemma 5 to Theorem 5.1, the only closed subgroups of ℤ_{p} are the p^{e}Z_{p}, which correspond under this isomorphism to the subgroups E_{(p^{e})} of E_{(p)}.

We conclude that

p^{n}E_{p} = E_{(p^{e})}

for some e. ◁

428–99 5–17 Lemma 7 Suppose A is a finite p-group; and suppose gcd(m, p) = 1. Then the map ψ : A → A under which

a ↦ ma

is an isomorphism.

Proof of Lemma ▷ Suppose a ∈ ker A, ie

ma = 0.

Then order(a) | m. But by Lagrange’s Theorem, order(a) = p^{e} for some e. Hence order(a) = 1, ie a = 0.

Thus ψ is injective; and it is therefore surjective, by the Pigeon-Hole Principle. Hence ψ is an isomorphism. ◁

It is not difficult to extend this result to E_{p}, which is in effect a kind of topological p-group.

Lemma 8 Suppose gcd(m, p) = 1. Then the map ψ : E_{p} → E_{p} under which

a ↦ ma

is an isomorphism.

Proof of Lemma ▷ Suppose P ∈ ker ψ, ie

mP = 0.

By Lemma 1,

p^{n}E_{p} ⊂ E_{(p^{2})} ≅ ℤ_{p}

for some n.

But ℤ_{p} is torsion-free. Thus

mP = 0 ⟹ m(p^{n}P = 0) ⟹ p^{n}P = 0.

Hence

m, p^{n} | order(P) ⟹ order(P) = 1 ⟹ P = 0

since gcd(m, p^{n}) = 1. Thus

ker ψ = 0,

ie ψ is injective.

Now suppose P ∈ E_{p}. We have to show that P = mQ for some Q ∈ E_{p}.

428–99 5–18 Since E_{p}/p^{n}E_{p} is a finite p-group we can find Q ∈ E_{p} such that

mQ ≡ P mod p^{n}E_{p}

ie

mQ = P + R,

where

R ∈ p^{n}E_{p} ≅ ℤ_{p}.

Now the map

P ↦ mP : ℤ_{p} → ℤ_{p}

is certainly an isomorphism, since m is a unit in ℤ_{p} with inverse m^{−1} ∈ ℤ_{p}. In particular we can find S ∈ p^{n}E_{p} with

mS = R.

Putting all this together,

P = mQ + R = mQ + mS = m(Q + S).

Thus the map ψ is surjective, and so an isomorphism. ◁

Lemma 9 E(ℚ_{p}) = F_{p′} ⊕ E_{p}.

Proof of Lemma ▷ Suppose

P ∈ F_{p′} ∩ E_{p},

say

mP = O,

where gcd(m, p) = 1.

On considering p mod m as an element of the finite group

(ℤ/m)^{×} = {r mod m : gcd(r, m) = 1},

it follows by Lagrange’s Theorem that

p^{r} ≡ 1 mod m

for some n > 0. But then p^{r}P = P;

428–99 5–19 and so

p^{n}P → O ⟹ P = O.

Now suppose P ∈ E. Since E is compact, and E_{p} is open, E/E_{p} is finite (eg since E must be covered by a finite number of E_{p}-cosets). Let the order of this finite group be mp^{e}, where gcd(m, p) = 1.

We can find u, v ∈ ℤ such that

um + vp^{e} = 1;

and then

P = Q + R,

where

Q = u(mP), R = v(p^{e}P).

Now

p^{e}Q = u(mp^{e}P) ∈ E_{p}.

Hence

p^{n}Q → 0 as n → ∞

ie

Q ∈ E_{p}.

On the other hand,

mR = v(mp^{e}P) ∈ E_{p}.

Hence by Lemma 8, there is a point S ∈ E_{p} such that

mR = mS,

and so

T = R − S ∈ F_{p′}.

Putting these results together,

P = T + (Q + S),

with T ∈ F_{p′} and Q + S ∈ E_{p}. ◁

Lemma 10 F_{p} ⊂ E_{p}.

428–99 5–20 Proof of Lemma ▷ Suppose

P = Q + R ∈ F_{p},

where Q ∈ F_{p′}, R ∈ E_{p}. Then

p^{n}P = 0 ⟹ p^{n}Q = 0, p^{n}R = 0,

since the sum is direct. But

p^{n}Q = 0 ⟹ order(Q) | p^{n} ⟹ order(Q) = 1 ⟹ Q = 0,

since the order of Q is coprime to p by the definition of F_{p′}. Thus

P = R ∈ E_{p}.

◁

It remains to split E_{p} into F_{p} and a subgroup isomorphic to ℤ_{p}.

Consider the surjection

ψ : E_{p} → E_{(p^{e})} ≅ ℤ_{p}.

Let us choose a point

P_{0} ∈ E_{p^{e}} \ E_{(p^{e+1})},

eg if we identify E_{(p^{e})} with ℤ_{p} we might take the point corresponding to 1 ∈ ℤ_{p}. Now choose a point P_{1} such that

ψ(P_{1}) = P_{0};

and let

E_{1} = \overline{⟨P_{1}⟩}

be the closure in E_{p} of the subgroup generated by P_{1}. We shall show that the restriction

ψ_{1} = ψ | E_{1} : E_{1} → E_{(p^{e})}

is an isomorphism, so that

E_{1} ≅ E_{(p^{e})} ≅ ℤ_{p}.

Certainly ψ_{1} is surjective. For E_{1} is compact, and so its image is closed; while ⟨P_{0}⟩ > is dense in E_{(p^{e})} ≅ ℤ_{p}.

Suppose

Q ∈ ker ψ_{1} = ker ψ ∩ E_{1}.

428–99 5–21 By definition, Q is the limit of points in ⟨P_{1}⟩, say

n_{i}P_{1} → Q,

where n_{i} ∈ ℤ. But then, since ψ is continuous,

n_{i}P_{0} → ψ(Q) = 0.

Hence

n_{i} → 0

in ℤ_{p}. But then it follows that

n_{i}P_{1} → 0

in E_{p}, since

⋂ p^{n}E_{p} = 0.

Hence Q = 0, ie ker ψ_{1} = 0.

It remains to show that

E_{p} = F_{p} ⊕ E_{1}.

Suppose P ∈ E_{p}. Then

ψ(P) = ψ(Q),

for some Q ∈ E_{1}. In other words,

p^{n}(P − Q) = 0.

Thus

R = P − Q ∈ F_{p}

On the other hand, if

F_{p} ∩ E_{1} = 0,

since as we have seen,

E_{1} ≅ E_{(p^{e})} ≅ ℤ_{p},

and Z_{p} is torsion-free.

We have shown therefore that

E = F_{p′} ⊕ E_{p}

= F_{p′} ⊕ (F_{p} ⊕ E_{1}) = (F_{p′} ⊕ F_{p}) ⊕ E_{1} = F ⊕ E_{1} ≅ F ⊕ ℤ_{p}.

428–99 5–22

◀

Remark: We can regard E_{p} as a ℤ_{p}-module; for since p^{n}P → O we can define xP unambiguously for x ∈ ℤ_{p}:

n_{i} → x ⟹ n_{i}P → xP.

Moreover, E_{p} is a finitely-generated ℤ_{p}-module; that follows readily from the fact that E_{(p)} ≅ ℤ_{p} is of finite index in E_{p}.

The Structure Theorem for finitely-generated abelian groups, ie Z-modules, extends easily to ℤ_{p}-modules; such a module is the direct sum of copies of ℤ_{p} and cyclic groups ℤ/(p^{e}). (This can be proved in much the same way as the corresponding result for abelian groups.)

Effectively, therefore, all we proved above was that the factor ℤ_{p} occurred just once, which simply reflects the fact that we are dealing with a 1-dimensional curve.

428–99 5–23

Points of Finite Order

6.1 The Torsion Subgroup

The elements of finite order in an abelian group A form a subgroup F ⊂ A, since

a, b ∈ F ⟹ ma = 0, nb = 0 ⟹ mn(a + b) = 0 ⟹ a + b ∈ F.

This subgroup F is commonly called the torsion subgroup of A. (See Appendix A for further details.)

It turns out to be much easier to determine the torsion subgroup F ⊂ E(ℚ) of an elliptic curve than it is to determine the rank of the curve — that is, the number of copies of ℤ in

E(ℚ) = F ⊕ ℤ ⊕ ⋯ ⊕ ℤ.

In effect the discussion below provides a simple algorithm for determining F, while there is no known algorithm for determining the rank.

Proposition 6.1 The torsion subgroup of an elliptic curve E(ℚ) is finite, ie E has only a finite number of points of finite order.

Proof ▶ Suppose E has equation

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6},

where c_{i} ∈ ℚ. Choose an odd prime p not appearing in the denominators of the c_{i}, and consider the p-adic curve E(ℚ_{p}). Any point P ∈ E(ℚ) of finite order will still have finite order in E(ℚ_{p}).

We know that E(ℚ_{p}) has an open subgroup

E_{(p)}(ℚ_{p}) ≅ ℤ_{p}.

428–99 6–1 The only point of finite order in this subgroup is 0 (since ℤ_{p} has no other elements of finite order).

It follows that any coset

P + E_{(p)}(ℚ_{p})

contains at most one element of finite order. For if there were two, say P, Q, then P − Q would be a point of finite order in the subgroup.

But E(ℚ_{p}) is compact, since it is a closed subspace of the compact space ℙ^{2}(ℚ_{p}). Hence it can be covered by a finite number of cosets

P_{1} + E_{(p)}(ℚ_{p}), …, P_{r} + E_{(p)}(ℚ_{p}).

Since each coset contains at most 1 point of finite order, the number of such points is finite. ◀

Remark: We shall prove in Chapter 8 the much deeper result that the group E(ℚ) of an elliptic curve over ℚ is finitely-generated (Mordell’s Theorem), from which the finiteness of F follows, as shown in Appendix A.

6.2 Lessons from the Real Case

Proposition 6.2 Suppose F is the torsion subgroup of the elliptic curve E(ℚ). Then

F ≅ ℤ/(n) or F ≅ ℤ(2n) ⊕ ℤ/(2).

Proof ▶ We know that

E(ℝ) ≅ 𝕋 or 𝕋 ⊕ ℤ/(2).

Since

E(ℚ) ⊂ E(ℝ),

it follows that

F ⊂ 𝕋 or 𝕋 ⊕ ℤ/(2).

Lemma Every finite subgroup of 𝕋 is cyclic; and there is just one such subgroup of each order n.

Proof of Lemma ▷ The torsion subgroup of

𝕋 = ℝ/ℤ

428–99 6–2 is

F = ℚ/ℤ.

For if t̄ ∈ 𝕋 is of order n then nt ∈ ℤ, say nt = m, ie t = m/n ∈ ℚ. Conversely, if t ∈ ℚ, say t = m/n, then nt̄= 0, and so t̄∈ F.

Suppose

A ⊂ ℚ/ℤ

is a finite subgroup ≠ 0. Since each t̄ ∈ 𝕋 has a unique representative t ∈ [−1/2, 1/2), A has a smallest representative t = m/n > 0, where we may assume that m, n > 0, gcd(m, n) = 1.

In fact n = 1; for we can find u, v, ∈ ℤ such that

um + vn = 1,

and then

\frac{1}{n} = u\frac{m}{n} + v,

ie

\frac{1}{n} ≡ u\frac{m}{n} mod ℤ

Thus

\frac{1}{n} ∈ A.

Since 1/n ≤ m/n, this must be our minimal representative: n = 1.

Now every element t̄ ∈ A must be of the form m/n; for otherwise we could find a representative

t − m/n ∈ (0, 1/n),

contradicting our choice of 1/n as minimal representative of A.

We conclude that

A = \{0, \frac{1}{n}, \frac{2}{n}, …, \frac{n − 1}{n}\} ≅ ℤ/(n).

Moreover, our argument shows that this is the only subgroup of A of order n. ◁

Since this is the only subgroup of 𝕋 of order n we can write

ℤ/(n) ⊂ 𝕋

428–99 6–3 without ambiguity, identifying

r mod n ⟷ r/n mod ℤ

This establishes the result if F ⊂ 𝕋. It remains to consider the case

A ⊂ 𝕋 ⊕ ℤ/(2).

By the Lemma, A ∩ 𝕋 is cyclic, say

A ∩ 𝕋 = ℤ/(n).

Thus

ℤ/(n) ⊂ A ⊂ ℤ/(n) ⊕ ℤ/(2).

Since ℤ/(n) is of index 2 in ℤ/(n) ⊕ ℤ/(n) it follows that

A = ℤ/(n) or A = ℤ/(n) ⊕ ℤ/(2).

If n is odd then

ℤ/(n) ⊕ ℤ/(2) ≅ ℤ/(2n)

by the Chinese Remainder Theorem. Thus either A is cyclic or else

A ≅ ℤ/(n) ⊕ ℤ/(2)

with n even. ◀

Mazur has shown that in fact the torsion group of an elliptic curve can only be one of a small number of groups, namely

ℤ/(n) (n = 1 − 10, 12) and ℤ/(2n) ⊕ ℤ/(2) (n = 1 − 5).

6.2.1 Elements of order 2

We can distinguish between the two cases in Proposition 6.2 by considering the number of points of order 2. For Z/(n) has no points of order 2 if n is odd, and just one point if n is even, say n = 2m, namely m mod n; while ℤ/(2n) ⊕ ℤ/(2) has three points of order 2, namely (n mod 2n, 0 mod 2), (n mod 2n, 1 mod 2), (0 mod 2n, 1 mod 2).

Proposition 6.3 The point P = (x, y) on the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx + c (a, b, c ∈ ℚ)

has order 2 if and only if y = 0. There are either 0, 1 or 3 points of order 2.

428–99 6–4 Proof ▶ If P = (x, y) then −P = (x, −y). Thus 2P = 0, ie −P = P, if and only if y = 0.

Thus there are as many elements of order 2 as there are roots of f(x) = x^{3} + ax^{2} + bx + c in ℚ. But if 2 roots α, β ∈ ℚ then the third root γ ∈ ℚ, since

α + β + γ = −a.

◀

In determining whether

p(x) = x^{3} + ax^{2} + bx + c

has 0, 1 or 3 rational roots, one idea is very important: if a, b, c ∈ ℤ then every rational root r of p(x) is in fact integral, and r | n. (For on substituting r = m/n and multiplying by n^{3}, each term is divisible by n except the first.) This usually reduces the search for rational roots to a number of simple cases.

We may also note that if a, b, c ∈ ℤ then a necessary — but not sufficient — condition for p(x) to have 3 rational roots is that the discriminant D should be a perfect square: D = d^{2}. For

D = [(α − β)(β − γ)(γ − α)]^{2} .

6.2.2 Elements of order 3

In any abelian group, the elements of order p (where p is a prime), together with 0, form a subgroup; for

pa = 0, pb = 0 ⟹ p(a + b) = 0.

We can consider this subgroup as a vector space over the finite field GF(p).

Proposition 6.4 If p is an odd prime then there are either no points of order p on the elliptic curve E(ℚ), or else there are exactly p − 1 such elements, forming with 0 the group ℤ/(p).

Proof ▶ An element of 𝕋 ⊕ ℤ/(2) of odd order p is necessarily in 𝕋. Thus the result follows from Proposition 6.2 and the Lemma in the proof of that Proposition. ◀

The elements of order 3 have a particularly simple geometric description.

Proposition 6.5 A point P ≠ 0 on the elliptic curve E(ℚ) has order 3 if and only if it is a point of inflexion. There are either 0 or 2 such points.

428–99 6–5 Proof ▶ Suppose P has order 3, ie

P + P + P = 0.

From the definition of addition, this means that the tangent at P meets E in 3 coincident points P, P, P. In other words, P is a point of inflexion.

It follows from the previous Proposition that there are either 0 or 2 such flexes. ◀

Remark: The point 0 is of course a flex (by choice); so there are either 1 or 3 flexes on the elliptic curve E(ℚ) given by a general Weierstrass equation.

6.3 Points of Finite Order are Integral

Theorem 6.1 Suppose P = (x, y) is a point of finite order on the elliptic curve

E(ℚ) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6},

where c_{1}, c_{2}, c_{3}, c_{4}, c_{6} ∈ ℤ. Then either 2P = 0 or x, y ∈ ℤ.

Proof ▶

Lemma 1 For each prime p, if (x, y) ∈ E(ℚ_{p}) then

∥x∥_{p} ≤ 1 ⟺ ∥y∥_{p} ≤ 1.

Proof of Lemma ▷ If ∥x∥_{p} ≤ 1 but ∥y∥_{p} > 1 then y^{2} will dominate the

equation. On the other hand, if ∥x∥_{p} > 1 but ∥y∥_{p} ≤ 1 then x^{3} will dominate the equation. ◁

On combining these results for all primes,

x ∈ ℤ ⟺ y ∈ ℤ.

(This last result is easily proved directly; for if x ∈ Z then the equation for E can be regarded as a monic quadratic equation for y with integral coefficients; and any rational solution for y is therefore integral; and similarly if y ∈ Z then the equation for E can be regarded as a monic cubic equation for x with integral coefficients; and any rational solution for x is therefore integral.)

Lemma 2 If P = (x, y) ∈ E(ℚ_{p}) then either x, y ∈ ℤ_{p} or else P ∈ E_{(p)}.

428–99 6–6 Proof of Lemma ▷ The equation of the curve in (X, Z)-coordinates is

Z + c_{1}XZ + c_{3}Z^{2} = X^{3} + c_{2}X^{2}Z + c_{4}XZ^{2} + c_{6}Z^{3}.

Suppose P ∉ E_{(p)}, ie

∥X∥_{p} ≥ 1 or ∥Z∥_{p} ≥ 1.

In fact

∥X∥_{p} ≥ 1 ⟹ ∥Z∥_{p} ≥ 1;

for if ∥X∥_{p} ≥ 1 but ∥Z∥_{p} < 1 then X^{3} would dominate the equation. Thus

∥Z∥_{p} ≥ 1

in either case.

Since y = 1/Z

∥Z∥_{p} ≥ 1 ⟹ ∥y∥_{p} ≤ 1.

Hence

x, y ∈ ℤ_{p}

by Lemma 1. ◁

Lemma 3 1. If p is odd then E_{(p)} is torsion-free (ie has no elements of finite order except 0).

2. E_{(2^{2})} is torsion-free.

Proof of Lemma ▷ This follows at once from the fact that

E_{(p)} ≅ ℤ_{p} (p odd), E_{(2^{2})} ≅ ℤ_{2},

as we saw in Chapter 5. ◁

Lemma 4 If P ∈ E_{(2)} then 2P ∈ E_{(2^{2})}.

Proof of Lemma ▷ Suppose P = (X, Z). Recall that although E_{(2)} was

defined as

E_{(2)} = {(X, Z) ∈ E : ∥X∥_{2}, ∥Z∥_{2} < 2^{−1}} ,

in fact it follows from the equation

Z(1 + c_{1}X + c_{2}Z) = X^{3} + c_{2}X^{2}Z + c_{4}XZ^{2} + C_{6}Z^{3}

428–99 6–7 that

(X, Z) ∈ E_{(2)} ⟹ ∥Z∥_{2} ≤ 2^{−3}.

(More generally, although E_{(p^{e})} is defined as

E_{(p^{e})} = {(X, Z) ∈ E : ∥X∥_{p} < p^{−e}, ∥Z∥ < 1} ,

in fact

(X, Z) ∈ E_{(p^{e})} ⟹ ∥Z∥_{p} ≤ p^{−3e}

by induction on e.)

The tangent at P is

Z = MX + D

where

M = \frac{∂F/∂X}{∂F/∂Z}

= \frac{c_{1}Z − (3X^{2} + 2c_{2}XZ + 3c_{4}Z^{2})}{1 + c_{1}X + 2c_{3}Z − (c_{2}X^{2} + 2c_{4}XZ + 3c_{6}Z^{2})}.

The term 3X^{2} dominates the numerator, while the term 1 dominates the numerator. It follows that

∥M∥_{2} ≤ 2^{−2}.

Hence

∥D∥_{2} = ∥Z − MX∥_{2} ≤ 2^{−3}.

The tangent meets E where

(MX + D)(1 + c_{1}X + c_{3}(MX + D)) = X^{3} + c_{2}X^{2}(MX + D) + c_{4}X(MX + D)^{2} + c_{6}(MX + D)^{3}.

Thus if the tangent meets E again at (X_{1}, Z_{1}) then

2X + X_{1} = −\frac{coeff of X^{2}}{coeff of X^{3}}

= \frac{c_{1}M + c_{3}M^{2} − (c_{2} + 2c_{4}M + 3c_{6}M^{2})D}{1 + c_{2}M + c_{4}M^{2} + c_{6}M^{3}}.

Hence

∥X_{1}∥_{2} ≤ 2^{−2}.

Since

∥Z_{1}∥ = ∥MX_{1} + D∥ ≤ 2^{−4},

428–99 6–8 it follows that

(X_{1}, Z_{1}) ∈ E_{(2^{2})}.

We conclude that

2P = −(X_{1}, Z_{1}) ∈ E_{(2^{2})},

since E_{(2^{2}(} is a subgroup of E. ◁ Now suppose P = (x, y) ∈ E(ℚ) is of finite order. For each odd prime p,

P ∉ E_{(p)}

by Lemma 3. Thus

x, y ∈ ℤ_{p}

by Lemma 2.

Since 2P is of finite order,

P ∈ E_{(2)} ⟹ 2P ∈ E_{(2^{2})} ⟹ 2P = 0,

by Lemmas 4 and 3. Thus if 2P ≠ 0 then

x, y ∈ ℤ_{2},

by Lemma refIntegrality.

Putting these results together, we conclude that either 2P = 0 or else

x, y ∈ ℤ_{p} for all p ⟹ x, y ∈ ℤ.

◀

Corollary If P = (x, y) is a point of finite order on the elliptic curve

y^{2} = x^{3} + ax^{2} + bx + c

then x, y ∈ ℤ.

Proof ▶ After the Proposition we need only consider the case

2P = 0 ⟹ y = 0 ⟹ x^{3} + ax^{2} + bx + c = 0.

Since a rational root of a monic polynomial with integral coefficients is necessarily integral, it follows that x ∈ ℤ. ◀

Recall that if P = (x, y) is a point of

E(ℚ) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

428–99 6–9 then

−P = (x, −y − c_{1}x − c_{3}).

For by definition, −P is the point where the line OP meets the curve again. But the lines through O are just the lines

x = c

parallel to the y-axis (together with the line Z = 0 at infinity). This is clear if we take the line in homogeneous form

lX + mY + nZ = 0.

This passes through O = [0, 1, 0] if m = 0, giving

x = X/Z = −n/l.

Thus −P is the point with the same x-coordinate as P, say

−P = (x, y_{1}).

But y, y_{1} are the roots of the quadratic

y^{2} + y(c_{1}x + c_{3}) − (x^{3} + c_{2}x^{2} + c_{4}x + c_{6}).

Hence

y + y_{1} = −(c_{1}x + c_{3}),

ie

y_{1} = −y − c_{1}x − c_{3}.

It follows that

2P = 0 ⟺ −P = P
⟺ y = −y − c_{1}x − c_{3}
⟺ 2y + c_{1}x + c_{3} = 0.

Example: Consider the curve

E(ℚ) : y^{2} + xy = x^{3} + 4x^{2} + x.

If P = (x, y) is of order 2 then

2y + x = 0.

428–99 6–10 This meets the curve where

x^{2}/4 − x^{2}/2 = x^{3} + 4x^{2} + x,

ie

4x^{3} + 17x^{2} + 4x = 0.

This has roots 0, −1/4, −4. Thus the curve has three points of order 2, namely (0, 0), (−1/4, 1/8), (4, 2).

6.4 Points of Finite Order are Small

Theorem 6.2 (Nagell-Lutz) Suppose the elliptic curve E(ℚ) has equation

y^{2} = f(x),

where

f(x) ≡ x^{3} + ax^{2} + bx + c (a, b, c ∈ ℤ);

and suppose P = [x, y, 1] ∈ E is a point of finite order. Then either y = 0, or

y^{2} | Δ(f),

where

Δ = 8a^{3}c − a^{2}b^{2} − 18abc + 4b^{3} + 27c^{2}

is the discriminant of f(x).

Proof ▶ We start by proving the weaker result

y | Δ(f),

since this brings out the basic idea in a more direct way.

Suppose P = (x, y) is a point of finite order. Then so is 2P = (x_{1}, y_{1}). Thus by Proposition ,

x, y, x_{1}, y_{1} ∈ ℤ.

Recall that

2x + x_{1} = −a + m^{2},

where

m = \frac{f′(y)}{2y}.

428–99 6–11 Since a ∈ ℤ, it follows that

m^{2} ∈ ℤ ⟹ m ∈ Z ⟹ 2y | f′(x).

On the other hand

y | f(x)

since y^{2} = f(x). Thus

y | f(x), f′(x).

Recall that the resultant R(f, g) of two polynomials

f(x) = a_{0}x^{m} + a_{1}x^{m−1} + ⋯ + a_{m}, g(x) = b_{0}x^{n} + b_{1}x^{n−1} + ⋯ + b_{n} is the determinant of the (m + n) × (m + n) matrix

R(f, g) = (\begin{matrix}a_{0} & a_{1} & a_{2} & … & a_{m} & 0 & … & 0 \\ 0 & a_{0} & a_{1} & … & a_{m−1} & a_{m} & … & 0 \\ & & & … \\ 0 & 0 & 0 & … & & … & a_{m−1} & a_{m} \\ b_{0} & b_{1} & b_{2} & … & b_{n} & 0 & … & 0 \\ 0 & b_{0} & b_{1} & … & b_{n−1} & b_{n} & … & 0 \\ & & & … \\ 0 & 0 & 0 & … & & … & b_{n−1} & b_{n} \end{matrix})

We saw earlier that R(f, g) = 0 is a necessary and sufficient condition for f(x), g(x) to have a root in common. Our present use of the resultant, though related, is more subtle. Lemma 1 Suppose f(x), g(x) ∈ ℤ[x]. Then there exist polynomials u(x), v(x) ∈ ℤ[x] such that

u(x)f(x) + v(x)g(x) = R(f, g).

Proof of Lemma ▷ Let us associate to the polynomials u(x) = c_{0}x^{n−1} + c_{1}x^{n−2} + ⋯ + c_{n−1}, v(x) = d_{0}x^{m−1} + d_{1}x^{m−2} + ⋯ + d_{m−1} (of degrees < n and < m) the (m + n)-vector

( c_{0} ; c_{1} ; ⋮ ; c_{n−1} ; d_{0} ; d_{1} ; ⋮ ; d_{m−1}) .

428–99 6–12 It is readily verified that if

u(x)f(x) + v(x)g(x) = e_{0}x^{m_{n}−1} + ⋯ + e_{m+n−1},

then the e_{k} are given by the vector equation

R(f, g) ( c_{0} ; c_{1} ; ⋮ ; c_{n−1} ; d_{0} ; d_{1} ; ⋮ ; d_{m−1}) = ( e_{0} ; e_{1} ; ⋮ ; e_{m+n−1}) .

We are looking for integers c_{i}, d_{j} such that

( e_{0} ; e_{1} ; ⋮ ; e_{m+n−1}) = ( 0 ; ⋮ ; 0 ; R(f, g))

The existence of such integers follows at once from the following Sublemma. (For simplicity we prove the result with det A as first coordinate rather than last; but it is easy to see that this does not matter.)

Sublemma Suppose A is an n × n-matrix with integer entries. Then we can find a vector v with integer entries such that

A (v_{1} ; ⋮ ; v_{n}) = (det A ; 0 ; ⋮ ; 0) .

Proof of Lemma ▷ On expanding det A by its first column,

det A = a_{11}A_{11} + a_{21}A_{21} + ⋯ + a_{n1}A_{n1},

where the A_{i1}’s are the corresponding co-factors. On the other hand, if i ≠ n then

a_{1i}A_{11} + a_{2i}A_{21} + ⋯ + a_{ni}A_{n1} = 0,

428–99 6–13 since this is the determinant of a matrix with two identical columns.

Thus the vector

v = (A_{11} ; A_{21} ; ⋮ ; A_{n1})

has the required property. ◁

◁

We apply this Lemma to the polynomials f(x), f′(x), recalling that

R(f, f′) = −D(f).

Thus we can find polynomials u(x), v(x) ∈ ℤ[x] such that

u(x)f(x) + v(x)f′(x) = D.

Hence

y | f(x), f′(x) ⟹ y | D.

Turning now to the full result, suppose again the P = (x, y) is of finite order, and that 2P = (x_{1}, y_{1}). We know that x, y, x_{1}, y_{1} ∈ ℤ.

Lemma 2 The x-coordinate of 2P is

−\frac{g(x)}{4y^{2}},

where

g(x) = x^{4} − 2bx^{2} − 8cx − 4ac + b^{2}.

Proof of Lemma ▷ Recall that

x(2P) = 2x + a − m^{2},

where

x = \frac{f′(x)}{2y}.

Thus

x(2P) = \frac{4y^{2}(2x + a) − f′(x)^{2}}{4y^{2}}

= \frac{4(x^{3} + ax^{2} + bx + c)(2x + a) − (3x^{2} + 2ax + b)^{2}}{4y^{2}} ,

428–99 6–14 which yields the given result on simplification. ◁

It follows from the lemma that

y^{2} | g(x);

Thus

y^{2} | f(x), g(x)

since y^{2} = f(x).

Lemma 3 There exist polynomials u(x), v(x) ∈ ℤ[x] of degrees 3, 2 such that

u(x)f(x) + v(x)g(x) = D.

Proof of Lemma ▷ For simplicity we are going to prove the result in the case

a = 0. We leave it to the reader to establish the general result.

Let us see if we can find u(x), v(x) ∈ ℚ[x] of the form

u(x) = x^{3} + Bx + C, v(x) = x^{2} + D

such that

u(x)f(x) − v(x)g(x) = const.

The coefficients of x^{6} and x^{5} on the left both vanish. Equating the coefficients of x^{4}, x^{3}, x^{2}, x yield

\begin{aligned}x^{4} : & b + B = −2b + D & ⟹ D = B + 3b \\ x^{3} : & c + C = −8c & ⟹ C = −9c \\ x^{2} : & Bb = b^{2} − 2Db & => 2D + B = b \\ x : & Bc + Cb = −8Dc & ⟹ B − 9b = −8D. \end{aligned}

Substituting for D in the third equation gives

B = −5b/3, D = 4b/3.

The final equation then reduces to

−5b/3 − 9b = −32b/3,

which is an identity.

Accordingly, we take

u(x) = 3x^{3} − 5bx − 27c, v(x) = 3x^{2} + 4b,

428–99 6–15 and then

u(x)f(x) − v(x)g(x) = −27c^{2} − 4b^{2} = D,

as required ◁ The result now follows as before; since x, y ∈ ℤ,

y^{2} | f(x), g(x) ⟹ y^{2} | D.

◀

Remark: The resultant of f(x), g(x) turns out to be

R(f, g) = −D^{2},

so our earlier Lemma would be insufficient. It is not entirely clear (to me at least) why we can find u(x), v(x) — of lower degrees than expected — such that

u(x)f(x) + v(x)g(x) = D.

6.5 Examples

In these examples we compute the torsion group F of various elliptic curves E(ℚ).

1. We look first at the curve

E(ℚ) : y^{2} = x^{3} + 1.

Recall that the discriminant of the polynomial

p(x) = x^{3} + bx + c

is

D = − (4b^{3} + 27c^{2}) .

Thus in the present case

D = −27.

It follows from Nagell-Lutz (Theorem 6.2) that

y = 0, ±1, ±3.

There is just one point of order 2, ie with y = 0, namely (−1, 0).

428–99 6–16 If y = ±1 then x = 0, giving the two points (0, ±1). If y = ±3 then x^{3} = 8, giving the two points (2, ±3). It remains to determine which of these points (0, ±1), (2, ±3) is of finite order – remembering that the Nagell-Lutz condition y^{2} | D is necessary (if y ≠ 0) but by no means sufficient. The tangent at P = (0, 1) has slope

m = \frac{p′(x)}{2y} = \frac{3x^{2}}{2y} = 0.

Thus the tangent at P is

y = 1.

This meets E where

x^{3} = 0,

ie thrice at P. In other words P is a flex, and so of order 3. Turning to the point (2, 3) we have

m = \frac{3x^{2}}{2y} = 2.

and so the tangent at this point is

y = 2x − 1,

which meets E again at (0, −1). Thus

2(2, 3) = −(0, −1) = (0, 1).

We conclude that (2, 3) (and (2, −3) = −(2, 3)) are of order 6, and F = ℤ/(6).

2. Consider the curve

E(ℚ) : y^{2} = x^{3} − 1.

Again, D = −27, and there is one point (1, 0) of order 2. But now

y = ±1 ⟹ x^{3} = 2,
y = ±3 ⟹ x^{3} = 10,

neither of which has solutions in ℤ. We conclude that F = ℤ/(2).

428–99 6–17 3. Suppose F is the torsion subgroup of

E(ℚ) : y^{2} = x^{3} + x

We have

D = −4,

and so

y = 0, ±1, ±2.

There is just one point of order 2, ie with y = 0, namely (0, 0).

If y = ±1 then

x^{3} + x − 1 = 0.

Note that a rational root α ∈ ℚ of a monic polynomial

x^{n} + a_{1}x^{n−1} + ⋯ + a_{n}

with integral coefficients a_{i} ∈ ℤ is necessarily integral: α ∈ ℤ. And evidently α | a_{n}. Thus in the present case the only possible rational roots of the equation are x = ±1; and neither of these is in fact a root.

If y = ±2 then

x^{3} + x − 4 = 0.

The only possible solutions to this are x = ±1, ±2, ±4; and it is readily verified that none of these is in fact a solution.

We conclude that

F = ℤ/(2).

4. Consider the curve

y^{2} = x^{3} − x^{2}.

This curve is singular, since p(x) = x^{3} − x^{2} has a double root, (and so D = 0). Thus it is not an elliptic curve, and so is outside our present study, although we shall say a little about singular cubic curves in the next Chapter.

5. Consider the curve

E(ℚ) : y^{2} − y = x^{3} − x.

This has 6 obvious integral points, namely (0, 0), (0, 1), (1, 0), (1, 1), (−1, 0), (−1, 1).

We can bring the curve to standard form by setting y_{1} = y − 1/2, ie y = y_{1} +1/2, to complete the square on the left. The equation becomes

y_{1}^{2} = x^{3} − x + 1/4.

428–99 6–18 Now we can make the coefficients integral by the transformation

y_{2} = 2^{3}y_{1}, x_{2} = 2^{2}x,

giving

y_{2}^{2} = x_{2}^{3} − 2^{4}x_{2} + 2^{6}/4,

since the coefficient of x has weight 4, while the constant coefficient has weight 6. (In practice it is probably easier to apply this transformation first, and then complete the square; that way our coefficients always remain integral.) Our new equation is

y_{2}^{2} = x_{2}^{3} − 16x_{2} + 16,

with discriminant

D = −(4 · 2^{12} + 27 · 2^{8})
= −2^{8}(64 + 27)
= −2^{8}91.

By Nagell-Lutz, if (x_{2}, y_{2}) ∈ F then x_{2}, y_{2} ∈ ℤ and

y_{2} = 0, ±1, ±2, ±4, ±8, ±16.

Note however that if P is not of order 2, ie y_{2} ≠ 0, then

y = \frac{y_{2} − 4}{8} ∈ ℤ

by Theorem 6.2. Only the cases y_{2} = ±4 satisfy this condition. Thus we only have to consider

y_{2} = 0, ±4.

If y_{2} = 0 then

x_{2}^{3} − 16x_{2} + 16 = 0.

But

16 | x_{2}^{3} ⟹ 4 | x_{2}
⟹ 32 | x_{2}^{3}, 16x_{2}
⟹ 32 | 16,

which is absurd. Thus there are no points of order 2 on E.

428–99 6–19 Finally, if y_{2} = ±4 then

16 = x_{2}^{3} − 16x_{2} + 16 ⟹ x_{2}^{3} − 16x_{2} = 0 ⟹ x_{2} = 0, ±4.

This gives the 6 ‘obvious’ points we mentioned at the beginning. It remains to determine which of these points are of finite order. Reverting to the original equation, suppose P = (0, 0). We have

(2y − 1)\frac{dy}{dx} = 3x^{2} − 1,

ie

\frac{dy}{dx} = \frac{3x^{2} − 1}{2y − 1}.

Thus the tangent at P has slope m = 1, and so is

y = x.

This meets the curve again at (1, 1). Hence

2(0, 0) = −(1, 1) = (1, 0).

The tangent at (1, 0) has slope m = −2, and so is

y = −2x + 2,

which meets E where

(−2x + 2)^{2} − x(−2x + 2) = x^{3} − x,

ie

x^{3} − 6x^{2} + 9x − 4 = 0.

We know this has two roots equal to 1. The third root must satisfy

2 + x = 6,

ie

x = 4.

428–99 6–20 At this point

y = −2x + 2 = −6.

We know that this point (4, −6) is not of finite order, by Nagell-Lutz. It follows that (1, 0) is of infinite order. Hence so is (0, 0) since 2(0, 0) = (1, 0); and so too are (1, 1) = −(1, 0) and (0, 1) = −(0, 0)

It remains to consider the points (−1, 0 and (−1, 1) = −(−1, 0). Note that if these are of finite order then they must be of order 3 (since there would be just 3 points in F), ie they would be flexes.

The tangent at P = (−1, 0) has slope m = −2, and so is

y = −2x − 2.

This meets E where

(−2x − 1)^{2} − x(−2x − 1) = x^{3} − x.

We know that this has two roots -1. Hence the third root is given by

−2 + x = 6,

ie

x = 8,

as before. At this point

y = −2x + 2 = −14.

So

2(−1, 0) = −(8, −14).

Again, we know by Nagell-Lutz that this point is of infinite order, and so therefore is (−1, 0) and (−1, 1) = −(−1, 0).

To verify that P = (4, −6), for example, is not of finite order, we may note that the tangent at this point has slope

m = −\frac{47}{11}.

But the tangent

y = mx + d

428–99 6–21 at P meets the curve again where

(mx + d)^{2} − x(mx + d) = x^{3} − x,

ie at a point (x_{1}, y_{1}) with

2 · 4 + x_{1} = m^{2} − m.

By Nagell-Lutz, x_{1} ∈ ℤ (since we have seen that there are no points of order 2), and so m^{2} − m ∈ ℤ, which is manifestly not the case.

We conclude that the torsion-group of this curve is trivial:

F = {0}.

428–99 6–22

Reduction modulo p

7.1 The reduction map

One serendipitous consequence of our adoption of projective (rather than affine) geometry is that this allows us to ‘reduce’ rational points modulo a prime p.

Proposition 7.1 Suppose p is a prime. For each dimension n we can define a map

Π_{p} : ℙ^{n}(ℚ) → ℙ^{n}(GFp)

as follows: Any point P ∈ ℙ^{n}(ℚ) can be expressed in the form

P = [X_{0}, X_{1}, …, X_{n}]

where X_{0}, X_{1}, …, X_{n} ∈ ℤ and not all X_{i} are divisible by p. We set

Π_{p}(P) = P̄ = [X_{0} mod p, X_{1} mod p, …, X_{n} mod p].

Proof ▶ We can ensure that the coordinates X_{i} are all integral, by multiplying by the lcm of the denominators; and then we can ensure that not all the X_{i} are divisible by p by dividing by the highest power of p dividing all the X_{i}.

It remains to show that the resulting point P̄ ∈ ℙ^{n}(GFp) is uniquely determined by the point P. Suppose we have two such expressions for P:

P = [X_{0}, X_{1}, …, X_{n}] = [X′_{0}, X′_{1}, …, X′_{n}].

Then

[X′_{0}, X′_{1}, …, X′_{n}] = ρ[X_{0}, X_{1}, …, X_{n}]

for some ρ ∈ ℚ^{×}. Let

ρ = \frac{r}{s},

428–99 7–1 where gcd(r, s) = 1. Then

rX′_{i} = sX_{i}

for all i. Clearly p |̸ r; for otherwise p | X_{i} for all i. Similarly p |̸ s. But then

r̄\overline{X′_{i}} = s̄\overline{X_{i}}

ie

[\overline{X′_{0}}, \overline{X′_{1}}, …, \overline{X′_{n}}] = ρ̄[\overline{X_{0}}, \overline{X_{1}}, …, \overline{X_{n}}],

where ρ̄ = r̄/s̄.

Thus the two representations of P give the same point P̄. ◀

Definition 7.1 We call the map

ℙ^{n}(ℚ) → ℙ^{n}(GFp) : P ↦ P̃

reduction modulo p.

It is not necessary to choose integral coordinates for reduction; it is sufficient that they be p-integral, that is, of the form c = a/b, where a, b are integers with p |̸ b. Note that if b is p-integral then the ‘remainder’ c̃ = ã/b̃ modulo p is well-defined. The following result is readily verified.

Proposition 7.2 Suppose

P = [X_{0}, …, X_{n}],

where X_{0}, …, X_{n} are p-integral but X̄_{0}, …, X̄_{n} do not all vanish. Then

P̄ = [X̄_{0}, …, X̄_{n}].

Proposition 7.3 Each line ℓ in ℙ^{2}(k) defines a line ℓ̄ in ℙ^{2}(GFp); and

P ∈ ℓ ⟹ P̄ ∈ ℓ̄.

More generally, each curve Γ in ℙ^{2}(k) defines a line Γ̄ in ℙ^{2}(GFp); and

P ∈ Γ ⟹ P̄ ∈ Γ̄.

Proof ▶ Suppose ℓ is the line

aX + bY + cZ = 0.

428–99 7–2 We can ensure that a, b, c are integral, by multiplying by the lcm of their denominators, and we can ensure that a, b, c are not all divisible by p, by dividing a, b, c by a suitable power of p; and then we set

ℓ̄: āX + b̄Y + c̄Z = 0.

If now P = [X, Y, Z] where X, Y, Z are all integers, but not all are divisible by p, then

aX + bY + cZ = 0 ⟹ āX̄ + b̄Ȳ + c̄Z̄ = 0.

Thus P lies on the line

ℓ̄: āX + b̄Y + c̄Z = 0.

Now suppose Γ is a curve in ℙ^{2}(ℚ), given by the homogeneous polynomial equation

F (X, Y, Z) = 0.

We can ensure that all the coefficients of F are integral, but not all divisible by p; and then we can define he polynomial

F̄[X, Y, Z] ∈ GFp[X, Y, Z],

by taking each coefficient of F mod p.

Suppose P = [X, Y, Z] where X, Y, Z ∈ ℤ but not all are divisible by p. Then

P ∈ Γ ⟺ F (X, Y, Z) = 0 ⟹ F̄(X̄, Ȳ , Z̄) = 0 ⟺ P̄ ∈ Γ̄.

◀

7.1.1 Reduction of Elliptic Curves

Definition 7.2 We say that the elliptic curve E(ℚ) has good reduction mod p if Ẽ is elliptic, ie non-singular.

We often say that E has good reduction at p.

Consider the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx + c,

where a, b, c ∈ ℤ (or, more generally, a, b, c are p-integral).

Reduction modulo p gives the curve

Ẽ: y^{2} = x^{3} + ãx^{2} + b̃x + c̃

over the finite field GFp.

428–99 7–3 Proposition 7.4 The reduction Ẽ of E modulo p is good if and only if p ≠ 2 and

p |̸ D,

where

D = −4a^{3}c + a^{2}b^{2} + 18abc − 4b^{3} − 27c^{2}

is the discriminant of the polynomial p(x) = x^{3} + ax^{2} + bx + c:

Proof ▶ If p = 2 then Ē is necessarily singular.

Suppose p ≠ 2. We know in this case that Ē is elliptic (non-singular) if and only if D(Ē) ≠ 0. The result follows since

D(Ē) = D(E) mod p.

◀

Theorem 7.1 Suppose the elliptic curve E(ℚ) has good reduction modulo p. Then the map

E(ℚ) → E(GFp) : P ↦ P̃

is a homomorphism.

Proof ▶ The zero point on E certainly maps into the zero point on Ẽ:

[0, 1, 0] ↦ [0, ˜1, 0].

Suppose the 3 points P, Q, R ∈ E(ℚ) satisfy

P + Q + R = 0.

In other words P, Q, R lie on a line

l : ax + by + cz = 0.

Let l̃be the reduction of l modulo p. Evidently l̃is a line in ℙ^{2}(GFp), which contains P̃, Q̃, R̃ by Proposition ??.

We need to be a little careful at this point. If P̃, Q̃, R̃ are distinct then it follows that

P̃ + Q̃ + R̃ = 0.

But can we be certain of this conclusion if 2 or all 3 of these points coincide? It’s not difficult to see that we can.

Lemma 4 Suppose the line l meets the curve Γ ⊂ ℙ^{2}(ℚ) of degree n in the n rational points P_{1}, …, P_{n} (each repeated according to multiplicity). Then l̃ meets Γ̃ in P̃_{1}, …, P̃_{n} (each repeated according to multiplicity).

428–99 7–4 Proof of Lemma ▷ Choose 2 points

Q = [x, y, z], R = [x′, y′, z′]

on l such that Q̃ ≠ R̃. We may suppose that x, y, z, x′, y′, z′ ∈ ℤ and that each triple x, y, z and x′, y′, z′ is coprime. the line l takes the parametric form

P (s, t) = sQ + tR = [sx + tx′, sy + ty′, sz + tz′].

This will meet the curve Γ where

f(s, t) = F (sQ + tR) = 0.

This is a homogeneous equation of degree n in s, t, which by hypothesis has roots (s_{1}, t_{1}), …, (s_{n}, t_{n}) corresponding to the points P_{1}, …, P_{n}. We may suppose that s_{1}, …, s_{n}, t_{1}, …, t_{n} ∈ ℤ, and that each pair (s_{1}, t_{1}), …, (s_{n}, t_{n}) is coprime. Now

f(s, t) = c(st_{1} − ts_{1}) ⋯ (st_{n} − ts_{n})

for some c ∈ ℚ.

◁

Thus

P + Q + R = 0 ⟹ P̄ + Q̄ + R̄ = 0.

Since it is readily verified that

\overline{−P} = −P̄,

it follows that the map is a homomorphism.

◀

Theorem 7.2 Suppose the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx + c

has good reduction at the prime p. Let T ⊂ E(ℚ) be the torsion subgroup (formed by the points of finite order). Then the reduction map

ρ : E(ℚ) → E(GFp),

sends T injectively onto a subgroup of E(GFp).

428–99 7–5 Proof ▶ We know by the Nagell-Lutz Theorem 6.1 that the non-zero points

P = (X, Y) ∈ T

all have integral coordinates: X, Y ∈ ℤ. It follows that

P̃ = [X̃, Ỹ , 1] = (X̃, Ỹ)

This can never be O. (It is always finite.) Thus

ker ρ = {0},

and so ρ is injective. ◀

7.2 An example

By Theorem 7.2, the torsion subgroup T of E(ℚ) has an isomorphic image in E(GFp) for every good prime p. We can often exploit this to determine T.

In general, the Nagell-Lutz Theorem provides a surer method of determining T. But there may be cases where the method below is quicker.

As an illustration, let us look at the curve

E(ℚ) : y^{2} = x^{3} + x + 1.

Since

D = −31.

E has good reduction at all odd primes p except 31.

Consider first reduction at p = 3 If (x, y) ∈ E(GF3) then x^{3} + x + 1 must be a quadratic residue modulo 3, ie

x^{3} + x + 1 = 0 or 1 mod 3.

This does not hold if x = 2 = −1; but it does hold in the other 2 cases

x = 0 and x = 1.

When x = 0 we have y = ±1. When x = 1 we have y = 1.

It follows that

E(GF3) = {(0, 1), (0, −1), (1, 0), [0, 1, 0]}.

428–99 7–6 We know that the point (X, Y) has order 2 if and only if Y = 0. In this case there is just 1 such point, namely (1, 0). Thus E(GF3) is of order 4, and has 1 element of order 2. Consequently,

E(GF3) ≅ ℤ/(4).

New consider the curve defined by the same equation over GF5. We have

x^{3} + x + 1 = 0, 1 or 4 mod 5.

This does not hold if x = 1 mod 5. The other cases yield the points:

(0, ±1), (2, ±1)m (3, ±1), (4 ± 2).

Thus

|E(GF5)| = 9,

and so

E(GF5) = ℤ/(3) ⊕ ℤ/(3) or ℤ/(9).

We leave it to the reader to determine which is the case.

This does not affect our present purpose, since in either case

T ⊂ E(GF3), T ⊂ E(GF5) ⟹ T = {O},

by Lagrange’s Theorem.

7.3 Singular cubic curves

Recall that a curve Γ in ℙ^{2}(k) is said to be degenerate if its equation factorizes:

Γ = ℓC,

where ℓ is a line and C a conic.

Proposition 7.5 A non-degenerate cubic curve has at most one singularity.

Proof ▶

Lemma 5 If P is a singular point on the non-degenerate curve Γ then every line through P meets Γ least twice at P.

428–99 7–7 Proof of Lemma ▷ We may assume (after a suitable projective transforma-

tion) that the equation has no terms of the first order:

Γ : ax^{2} + 2hxy + by^{2} + O(x^{3}, y^{3}).

But any line y = mx through P meets Γ where

(a + 2hm + bm^{2})y^{2} + O(x^{3}, y^{3}),

with a double root (at least) at y − 0, ie at (0, 0). ◁

Now suppose P, Q are singularities. Then the line P Q meets Γ tiwce at P and twice at Q, by the Lemma. Thus the line meets Γ four times, which is impossible. Hence there is at most one singularity. ◀

Singularities on cubic curves divide into two kinds: nodes and cusps. These are distinguished as follows: Let us move the singularity to (0, 0). Then

F (X, Y, Z) = aX^{2} + 2hXY + bY^{2} + O(X, Y)^{3}.

Definition 7.3 A singularity on a cubic curve is said to be a node if the second order terms split into distinct factors:

aX^{2} + 2hXY + bY^{2} = a(X + αY)(X + βY),

where α ≠ β; it is said to be a cusp if α = β, ie if the second order terms form a perfect square.

Definition 7.4 Suppose E(ℚ) is an elliptic curve. Then we say that E is stable at p if the reduction modp is good. We say that E is semi-stable at p if the reduction is bad but the singularity in Ē is a node. We say that E is unstable at p if the reduction is bad and the singularity in Ē is a cusp.

7.3.1 Nodes and cusps

Suppose we have a cubic curve

Γ(k) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6};

and suppose char(k) ≠ 2, 3. Then we can bring the curve to the form

y^{2} = x^{3} + ax^{2} + bx + c.

Now suppose Γ has a singularity. We know that there is just one singular point, and that it is a point (α, 0) on the line y = 0, where α is a double or triple root of

p(x) = x^{3} + ax^{2} + bx + c.

428–99 7–8

This root α ∈ k. For if α is a double root then gcd(p(x), p′(x)) = x − α, and we can compute this gcd by Euclid’s algorithm within the ring k[x]; while if α is a triple root then 3α = −b.

Thus we may assume that α = 0, after the transformation x ↦ x − α. Our equation now takes the form

y^{2} = x^{3} + ax^{2}.

Note that the second-order terms are y^{2} − ax^{2}. This has distinct factors unless a = 0. Thus by the definition above, the singularity is a cusp if a = 0, and a node if a ≠ 0. (This accords with the look of the curve if k = ℝ.)

Let us consider the case where the singularity is a cusp first. Our equation is

y^{2} = x^{3}.

We parametrize Γ \ {(0, 0)} by the map

k → Γ : t ↦ \begin{cases}(t^{−2}, t^{−3}) & if t ≠ 0, \\ [0, 1, 0] & if t = 0. \end{cases}

In other words,

P (t) = [t, 1, t^{3}]

for all t ∈ k.

Suppose the points P, Q, R with parameters p, q, r lie on the line

aX + bY + cZ = 0.

Then p, q, r are the roots of

at + b + ct^{3} = 0.

Since the coefficient of t^{2} is 0,

p + q + r = 0.

Thus from our definition of addition on Γ \ {(0, 0)},

P + Q + R = 0 ⟺ p + q + r = 0.

In addition, tt is readily verified that

−P (t) = P (−t).

428–99 7–9 It follows that the map

k → Γ \ {(0, 0)} : t ↦ P (t)

is an isomorphism. Thus the group on Γ\{(0, 0)} is isomorphic to the additive group of k.

Now let us consider the case where the singularity is a node. For simplicity let us take the curve

y^{2} = x^{3} + x^{2}.

This has a node at (0, 0) with ‘quasi-tangents’ y = ±x.

The line y = mx meets the curve in just one point apart from (0, 0), unless m = ±1. We parametrize the curve by setting

t = \frac{y + x}{y − x}.

This gives

y = \frac{t + 1}{t − 1}x;

and so

\frac{(t + 1)^{2}}{(t − 1)^{2}} x^{2} = x^{3} + x^{2},

ie

x = \frac{4t}{(t − 1)^{2}}

and

y = \frac{4t(t + 1)}{(t − 1)^{3}}.

In homogeneous terms

(x, y) = [4t(t − 1), 4t(t + 1), (t − 1)^{3}] = P (t).

It is readily verified that the map

k → Γ : t → P (t)

428–99 7–10 is bijective, with t = 0 corresponding to the singular point (0, 0). Thus we have a one-one correspondence between t ∈ k^{×} and P ∈ Γ \ {(0, 0}.

Suppose the points P, Q, R with parameters p, q, r lie on the line

aX + bY + cZ = 0.

Then p, q, r are the roots of

4at(t − 1) + 4bt(t + 1) + c(1 − t)^{3} = 0.

Since the coefficients of t^{3} and 1 are ±c,

pqr = 1.

Thus

P + Q + R = 0 ⟺ pqr = 0.

In addition, tt is readily verified that

−P (t) = P (1/t).

It follows that the map

k^{×} → Γ \ {(0, 0)} : t ↦ P (t)

is an isomorphism. Thus the group on Γ \ {(0, 0)} is isomorphic to the multiplicative group k^{×}.

Recall that the the elliptic curve E(ℚ) is said to be semi-stable at p if Ē has a node singularity, and unstable if Ē has a cusp singularity, Because of the analysis above, the terms ‘multiplicative’ and ‘additive’ are sometimes used in these two cases. (Note though that we have not proved that the group is always k^{×} or k in these two cases; the story is a little bit more complicated than that.)

7.4 Hasse’s Theorem

Consider the elliptic curve

E(GFp) : y^{2} = x^{3} + ax^{2} + bx + c.

If (x, y) ∈ E then

p(x) = x^{3} + ax^{2} + bx + c

428–99 7–11 must be a quadratic residue modp. Of the numbers {1, 2, …, p − 1} just (p − 1)/2 are quadratic residues, namely

(±1)^{2}, (±2)^{2}, …, (±(p − 1)/2)^{2}.

Thus if the values of p(x) mod p are randomly distributed, the expectation would be that p(x) = 0 for one x, and that p(x) would be a quadratic residue for (p−1)/2 values of x. The former would give one point (x, 0) on the curve; each of the latter would give two points (x, ±y). Thus the expected number of points is

1 + 2\frac{p − 1}{2} = p.

To this must be added the point O = [0, 1, 0], giving p + 1 points in all.

Definition 7.5 We set

a(p) = ∥E(GFp)∥ − (p + 1).

Thus a(p) measures the discrepancy from the expected value.

Hasse showed that

|a(p)| < 2\sqrt{p}

for all elliptic curves over GFp, ie

p + 1 − 2\sqrt{p} < a(p) < p + 1 + 2\sqrt{p}.

For example, if E is an elliptic curve over GF7 then

5 ≤ ∥E(GF7)∥ ≤ 11.

Although the proof of Hasse’s Theorem is not particularly difficult, it would take us too far afield to give it here.

Suppose E(ℚ) is an elliptic curve. Then a(p) is defined for each good prime p. Shimura conjectured that there was a modular form f(z) associated to E with the property that the a(p) were the coefficients of the corresponding Fourier series g(q). (See Chapter 8.)

Wiles proved Shimura’s Conjecture for semi-stable elliptic curves, that is, those for which the bad primes were at worst semi-stable (ie no cusps). This was the main step in his proof of Fermat’s Last Theorem.

Late last year, Shimura’s Conjecture was proved for all elliptic curves over ℚ.

428–99 7–12

The Complex Case

8.1 Periods and Lattices

We shall be concerned in this Chapter exclusively with meromorphic functions on ℂ, the space of complex numbers. Recall that a complex function f(z) is said to be meromorphic on ℂ if it is defined and regular at all points of ℂ except for a discrete set of points, at each of which it has a pole of finite order.

Every rational function P (z)/Q(z) (where P (z), Q(z) are polynomials) is meromorphic on ℂ, as are the trigonometric functions cos z, sin z, tan z, the exponential function e^{z}, etc.

Definition 8.1 The meromorphic function f(z) on ℂ is said to have period ω ∈ ℂ if

f(z + ω) = f(z)

whenever f(z) is defined.

Proposition 8.1 The periods of a non-constant meromorphic function f(z) form a discrete subgroup of the abelian group ℂ.

Proof ▶ If ω_{1}, ω_{2} are periods of f(z) then so are ω_{1} ± ω_{2}. Hence the periods form a subgroup of ℂ.

To prove that the subgroup is discrete, we have to show that there exists a constant C > 0 such that f(z) has no period |ω| < C except for ω = 0. To this end, consider the behaviour of f(z) in the neighbourhood of a regular point z_{0}. In some neighbourhood of this point, f(z) has an expansion

f(z) = c_{0} + c_{1}(z − z_{0}) + c_{2}(z − z_{0})^{2} + · · · .

428–99 8–1 This power-series will be dominated by its first non-zero term, and it is easy to deduce that

0 < |z − z_{0}| < C ⟹ f(z) ≠ c_{0}

for some constant C > 0. It follows that there is no non-zero period with |ω| < C. ◀

Note that as an abelian group, ℂ ≅ ℝ^{2}.

Proposition 8.2 A discrete subgroup of ℝ^{n} is isomorphic to ℤ^{m} for some m ≤ n.

Proof ▶ Suppose S is a discrete subgroup of ℝ^{n}. Let V = ⟨S⟩ be the vector subspace of ℝ^{n} spanned by the elements of S. We argue by induction on m = dim V, showing that S has a Z-basis with m elements.

Let s_{1}, …, s_{m} ∈ S be a basis for V; and let

U = ⟨s_{1}, …, s_{m−1}⟩.

By our inductive hypothesis,

S′ = S ∩ U

has a Z-basis with m − 1 elements, say t_{1}, …, t_{m−1}.

Suppose s ∈ S. Clearly t_{1}, …, t_{m−1}, s_{m} is a basis for V. Let

s = λ_{1}t_{1} + ⋯ + λ_{m−1}t_{m−1} + λ_{m}s_{m}.

We claim that there is an s ∈ S minimizing |λ_{m}|. For we can find n_{1}, …, n_{m−1} ∈ ℤ such that

|λ_{i} − n_{i}| ≤ \frac{1}{2} (1 ≤ i ≤ m − 1);

and then

s′ = s − (n_{1}t_{1} + ⋯ + n_{m−1}t_{m−1}
= (λ_{1} − n_{1})t_{1} + ⋯ + (λ_{m−1} − n_{m−1})t_{m−1} + λ_{m}s_{m}.

We may assume that λ_{m} ≤ 1, since s_{m} is a contender for minimal s. Thus s′ has the same λ_{m} as s and

|s′| ≤ |t_{1}| + ⋯ + |t_{m−1}| + |s_{m}| = R,

say.

428–99 8–2

But since S is a discrete subgroup, it has only a finite number of elements in the compact disk |v| ≤ R. Thus we need only consider a finite number of elements s ∈ S when minimizing |λ_{m}|; and so the minimum is certainly attained, at t_{m} say.

Now suppose s ∈ S. Evidently t_{1}, …, t_{m−1}, t_{m} is a basis for V. Hence

s = μ_{1}t_{1} + ⋯ + μ_{m−1}t_{m−1} + μ_{m}t_{m}.

But now we can find n_{m} ∈ ℤ such that

|μ_{m} − n_{m}| ≤ \frac{1}{2}.

and then

s′ = s − n_{m}t_{m}
= μ_{1}t_{1} + ⋯ + μ_{m−1}t_{m−1} + (μ_{m} − n_{m})t_{m}

has smaller s_{m} component than t_{m}, contradicting the minimality of t_{m} unless μ_{m} = n_{m}, ie μ_{m} ∈ ℤ.

But now s′ ∈ S′ = S∩U; and therefore μ_{1}, …, μ_{m−1} ∈ ℤ, by our inductive hypothesis.

We conclude that t_{1}, …, t_{m} is a Z-basis for S. ◀

Corollary 4 A non-trivial discrete subgroup of the additive group ℂ is isomorphic either to ℤ or to ℤ ⊕ ℤ.

Definition 8.2 A lattice in C is a discrete subgroup Λ ⊂ ℂ isomorphic to ℤ ⊕ ℤ.

Every lattice has a basis λ, μ. This basis is not unique. In fact it is easy to see that

λ′ = aλ + bμ, μ′ = cλ + dμ (a, b, c, d ∈ ℤ)

will form a basis if and only if ad − bc = ±1, ie

(\begin{matrix}λ′ \\ μ′ \end{matrix}) = (\begin{matrix}a & b \\ c & d \end{matrix}) (\begin{matrix}λ \\ μ \end{matrix})

where

det (\begin{matrix}a & b \\ c & d \end{matrix}) = ±1.

Proposition 8.3 If λ, μ is a basis for the lattice Λ then λ/μ ∉ ℝ.

428–99 8–3 Proof ▶ Suppose first that λ/μ ∈ ℚ, say

λ/μ = m/n.

Then

nλ = mμ,

ie λ, μ are not linearly independent.

(Alternatively, we may suppose that gcd(m, n) = 1. Then there exist a, b ∈ ℤ such that

am + bn = 1

Thus

aλ + bμ = μ/n ∈ Λ,

and

λ = m(μ/n), μ = n(μ/n),

ie λ and μ are both multiples of a smaller period.)

Now suppose that

λ/μ ∈ ℝ \ ℚ,

ie the ratio is real but irrational.

Lemma 6 If α is irrational then given any ϵ > 0 we can find m, n ∈ ℤ such that

|mα − n| < ϵ.

Proof of Lemma ▷ Choose N with 1/N < ϵ. For x ∈ ℝ, let {x} denote the

fractional part of x, ie

{x} = x − [x].

Consider the N + 1 fractional parts

0, {α}, {2α}, …, {Nα} ∈ [0, 1).

Divide the interval [0, 1) into N equal parts,

[0, 1/N), [1/N, 2/N), … [(N − 1)/N, 1).

By the Pigeon-Hole Principle, two of the fractional parts, say {rα}, {sα}, must lie in the same subinterval. But then

|{rα} − {sα}| < 1/N < ϵ,

428–99 8–4 ie

|rα − [rα] − (sα − [sα])|ϵ,

ie

|mα − n| < ϵ,

where m = r − s, n = [rα] − [sα]. ◁ By the Lemma, we can find m, n ∈ ℤ such that

|m(λ/μ) − n| < ϵ.

Hence

|mλ − nμ| < ϵμ.

Thus we can find lattice points mλ − nμ ∈ Λ arbitrarily close to 0, contradiction the condition that Λ be discrete. ◀

Definition 8.3 Suppose Λ ⊂ ℂ is a lattice. An elliptic function f(z) with respect to Λ is a meromorphic function whose periods include all elements of Λ, ie

ω ∈ Λ ⟹ f(z + ω) ≡ f(z).

Suppose λ, μ is a basis for the lattice Λ ⊂ ℂ. Then f(z) is elliptic with respect to Λ if and only if

f(z + λ) = f(z), f(z + μ) = f(z).

In other words an elliptic function is just a doubly-periodic function.

Definition 8.4 A fundamental parallelogram for the lattice Λ ⊂ ℂ is a set

Π(λ, μ, c) = {z ∈ ℂ : z = c + xλ + yμ : 0 ≤ x, y < 1},

where λ, μ is a basis for Λ, and c ∈ ℂ.

Suppose Π is a fundamental parallelogram for the lattice Λ. Then each z ∈ ℂ is congruent modulo Λ to a unique point z_{0} ∈ Π:

z ≡ z_{0} mod Λ,

by which we mean that

z − z_{0} ∈ Λ.

(Notice that we excluded 2 sides of the parallelogram, to ensure uniqueness.)

428–99 8–5

8.2 Applications of Cauchy’s Theorem

Let us recall some fundamental results from complex analysis:

1. Cauchy’s Theorem, the fundamental result of complex analysis, states that if the function f(z) is continuous on and holomorphic within the Jordan curve C then

∫_{C} f(z)dz = 0.

2. Suppose f(z) has a pole of order n at z = b, so that it has an expansion

f(z) = \frac{c_{−n}}{(z − b)^{n}} + ⋯ + \frac{c_{−1}}{z − b} + c_{0} + ⋯

in a neighbourhood of b. Then the residue of f(z) at b is defined to be c_{1}. Suppose f(z) is continuous on and meromorphic within C; and suppose f(z) has poles at b_{1}, b_{2}, …, b_{r} inside C, with residues c_{1}, c_{2}, …, c_{r}. Then

\frac{1}{2πi} ∫_{C} f(z)dz = c_{1} + c_{2} + ⋯ + c_{r}.

3. Suppose f(z) is continuous on and regular within C; and suppose a is

inside C. Then

f(a) = \frac{1}{2πi} ∫_{C} \frac{f(z)}{z − a}dz,

and

f′(a) = \frac{1}{2πi} ∫_{C} \frac{f(z)}{(z − a)^{2}} dz.

Informally, the second result is derived from the first by differentiating with respect to a under the integral sign.

4. Liouville’s Theorem: Suppose f(z) is regular and bounded on ℂ. Then f(z) is a constant. For let us take C to be a large circle centered on a with radius R; and let us suppose that |f(z)| ≤ c. Then

|f′(a)| ≤ \frac{1}{2π} \frac{2πR}{R^{2}} = \frac{c}{R}.

Since R is arbitrary it follows that f′(a) = 0 for all a, and so f(z) is constant.

428–99 8–6 5. Suppose the meromorphic function f(z) has zeros at a_{1}, a_{2}, …, a_{r} and

poles at b_{1}, b_{2}, …, b_{s} inside C; and suppose f(z) has no poles or zeros on C. Then

\frac{1}{2πi} ∫_{C} \frac{f′(z)}{f(z)}dz = r − s,

with the understanding that poles and zeros are counted with appropriate multiplicity, eg a double zero is counted twice. For the function f′(z)/f(z) has a simple pole with residue d at a zero of order d, and a simple pole with residue −d at a pole of order d.

6. With the same assumptions,

\frac{1}{2πi} ∫_{C} z \frac{f′(z)}{f(z)}dz = (a_{1} + ⋯ + a_{r}) − (b_{1} + ⋯ + b_{s}).

For if f(z) has a zero at a of order m then zf′(z)/f(z) has a simple pole at a with residue ma; while if f(z) has a pole at b of order n then zf′(z)/f(z) has a simple pole at b with residue −nb.

7. If each of the functions u_{n}(z) is holomorphic in the open set U ⊂ ℂ and ∑ u_{n}(z) is uniformly convergent in U then

f(z) = ∑ u_{n}(z)

is holomorphic in U, with

f′(z) = ∑ u′_{n}(z).

Notice that this is much simpler to prove than the corresponding result for real functions, using the fact that

f(a) = \frac{1}{2πi} ∫_{C} \frac{f(z)}{z − a}dz,

8. With the same assumptions, if C is a contour inside U then

∫_{C} f(z)dz = ∑ ∫_{C} u_{n}(z)dz.

In applying these results to elliptic functions, we usually take a fundamental parallelogram Π for C. Note that if f(z) is elliptic then

\frac{1}{2πi} ∫_{Π} f(z)dz = 0,

since the contributions of opposite sides will cancel out.

428–99 8–7 Proposition 8.4 An elliptic function f(z) with no poles is necessarily constant.

Proof ▶ Let Π be a fundamental parallelogram. Then f(z) is bounded on Π, say |f(z)| ≤ C, since a continuous function is always bounded on a compact set. But then f(z) is bounded on the whole of ℂ, since we can always find z_{0} ∈ Π with z ≡ z_{0} mod Λ and then |f(z)| = |f(z_{0})| ≤ C.

It follows by Liouville’s Theorem that f(z) is constant. ◀

Proposition 8.5 Suppose f(z) is an elliptic function; and suppose Π is a fundamental parallelogram, containing no poles or zeros of f(z) on its boundary. Then the number of poles of f(z) inside Π is equal to the number of zeros inside Π, each counted according to its multiplicity.

Proof ▶ This follows at once from the fact that

\frac{1}{2πi} ∫_{Π} \frac{f′(z)}{f(z)}dz = r − s.

For since f′(z)/f(z) is elliptic, the integral is 0, as explained above. ◀

Corollary 5 An elliptic function cannot have a singe simple pole inside Π.

Proof ▶ By the Proposition, the residue c at a single pole must vanish. But a simple pole cannot have zero residue. ◀

Thus an elliptic function has to have at least 2 poles (or a double pole) in each fundamental parallelogram.

Proposition 8.6 Suppose f(z) is an elliptic function; and suppose Π is a fundamental parallelogram, containing no poles of f(z) on its boundary. Let the residues of the poles inside Π be c_{1}, …, c_{r}. Then

c_{1} + ⋯ + c_{r} = 0.

Note that in this case the poles are not counted according to their multiplicity.

Proof ▶ This follows at once from the fact that

\frac{1}{2πi} ∫_{Π} f(z)dz = 0.

◀

428–99 8–8 Proposition 8.7 Suppose f(z) is an elliptic function; and suppose Π is a fundamental parallelogram, containing no poles or zeros of f(z) on its boundary. Let the zeros of f(z) inside Π be a_{1}, …, a_{r}, and let the poles inside Π be b_{1}, …, b_{r} (each repeated according to its multiplicity). Then

a_{1} + ⋯ + a_{r} ≡ b_{1} + ⋯ + c_{r} mod Λ.

Proof ▶ From above,

\frac{1}{2πi} ∫_{Π} z \frac{f′(z)}{f(z)}dz = (a_{1} + ⋯ + a_{r}) − (b_{1} + ⋯ + b_{s}).

Thus the result will be proved if we can show that

\frac{1}{2πi} ∫_{Π} z \frac{f′(z)}{f(z)}dz ∈ Λ

The function g(z) = zf′(z)/f(z) is not elliptic; but

g(z + λ) − g(z) = λ\frac{f′(z)}{f(z)}, g(z + μ) − g(z) = μ\frac{f′(z)}{f(z)}.

Thus the sides [c, c + μ] and [c + λ + μ, c + λ] together contribute

\frac{1}{2πi} ∫_{c}^{c+μ} λ\frac{f′(z)}{f(z)} = \frac{λ}{2πi} [log f(z)]_{c}^{c+μ} .

Since f(c + λ) = f(c), the function log f(z) differs at c and c + μ by 2mπi for some m ∈ ℤ. Thus these 2 sides together contribute ±mλ. Similarly the other 2 sides contribute ±nμ for some n ∈ ℤ. Hence

\frac{1}{2πi} ∫_{Π} z \frac{f′(z)}{f(z)}dz = ±mλ + ±nμ ∈ Λ.

◀

8.3 Weierstrass’ Elliptic Function

We have established several properties of elliptic functions. But we have yet to establish that any non-constant elliptic functions exist.

Proposition 8.8 Suppose Λ ⊂ ℂ is a lattice. The series

∑_{ω∈Λ,ω≠0} \frac{1}{|ω|^{e}}

converges if and only if e > 2

428–99 8–9 Proof ▶ Let λ, μ be a basis for the lattice Λ, so that

ω = mλ + nμ (m, n ∈ ℤ).

Lemma There are constants C_{1}, C_{2} such that

C_{1}(m^{2} + n^{2}) ≤ |mλ + nμ|^{2} ≤ C_{2}(m^{2} + n^{2}).

Proof of Lemma ▷ For x, y ∈ ℝ,

Q(x, y) = |xλ + yμ|^{2} = (xλ̄ + yμ̄)(xλ + yμ) = Ax^{2} + 2Bxy + cy^{2}

is a positive-definite quadratic form. Hence

Q(x, y) − C_{1}(x^{2} + y^{2})

is still positive-definite for sufficiently small C_{1}, and so

C_{1}(x^{2} + y^{2}) ≤ Q(x, y).

On the other hand, |2xy| ≤ x^{2} + y^{2}, and so

Q(x, y) ≤ (A + B + C)(x^{2} + y^{2}).

◁

Geometrically, this Lemma states that concentric circles can be drawn inside and outside an ellipse.

Lemma The series

∑_{(m,n)≠(0,0)} \frac{1}{(m^{2} + n^{2})^{e}}

is convergent if and only if e > 1.

Proof of Lemma ▷ We compare the sum S with the integral

I = ∫_{0}^{∞} ∫_{0}^{∞} \frac{dx dy}{(x^{2} + y^{2})^{e}} .

Changing to polar coordinates,

I = ∫_{0}^{∞} ∫_{0}^{2π} \frac{rdr dθ}{r^{2e}}
= 2π ∫_{0}^{2π} ∫_{0}^{∞} r^{1−2e}dr.

428–99 8–10 This converges if and only if 1 − 2e < −1, ie e > 1.

To see that S and I converge or diverge together, we note that if m ≥ 0, n ≥ 0 then

\frac{1}{((m + 1)^{2} + (n + 1)^{2})^{e}} ≤ \frac{1}{(x^{2} + y^{2})^{e}} ≤ \frac{1}{(m^{2} + y^{2})^{e}}

for m ≤ x ≤ m+1, n ≤ y ≤ n+1. We leave the completion of the argument, dealing with the terms along the axes, as an exercise. ◁ ◀

Definition 8.5 For n = 2, 3, 4, … we set

g_{n} = ∑_{ω∈Λ,ω≠0} \frac{1}{ω^{2n}} .

Note that the sums of odd powers all vanish,

∑_{ω∈Λ,ω≠0} \frac{1}{ω^{2n+1}} = 0

for n = 1, 2, 3, …, since the terms in ω and −ω cancel out.

Proposition 8.9 The series

∑_{ω∈Λ,ω≠0} (\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} )

is absolutely convergent for each z ∉ Λ, and defined a meromorphic function of ℂ with a double pole at each ω ∈ Λ.

Proof ▶ Suppose |ω| ≥ 2|z|, ie |z| ≤ \frac{1}{2}ω. Now

\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} = \frac{z(2ω − z)}{ω^{2}(ω − z)^{2}} .

But |ω − z| ≥ \frac{1}{2}|ω|, while |2ω − z| ≤ 3|ω|. Hence

|\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} | ≤ \frac{2|z|}{|ω|}^{3}.

Since ∑ 1/|ω|^{3} is convergent, it follows that the series

∑_{|ω|≥2C} \frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}}

is uniformly absolutely convergent — and so defines a holomorphic function — in |z| ≤ C; and the result follows. ◀

428–99 8–11 Definition 8.6 The Weierstrass elliptic function φ(z) with respect to the lattice Λ ⊂ ℂ is defined by

φ(z) = \frac{1}{z^{2}} + ∑_{ω∈Λ,ω≠0} (\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} ) .

Proposition 8.10 The function φ(z) is elliptic with respect to Λ.

Proof ▶ We have to show that if ω_{0} ∈ Λ then

f(z + ω_{0}) = f(z).

The result would be obvious if we could separate φ(z) into a variable part 1/z^{2} + ∑ 1/(z − ω)^{2} and a constant part ∑ 1/ω^{2}. Unfortunately these 2 parts do not converge separately, so a more careful approach—which we sketch below—is required.

Given ϵ > 0, choose R so large that

∑_{|ω|≥R} \frac{1}{|ω|^{3}} < ϵ and ∑_{|ω|≥R} \frac{1}{|z − ω|^{3}} < ϵ;

and let

φ(z) = F (z) + R(z),

where

F (z) = \frac{1}{z^{2}} + ∑_{|ω|≤R+|z|+|ω_{0}|} (\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} )

and

R(z) = ∑_{|ω|>R+|z|+|ω_{0}|} (\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} )

Then

φ(z + ω_{0}) − φ(z) = F (z + ω_{0}) − F (z) + R(z + ω_{0}) − R(z).

All the terms in F (z + ω_{0}) − F (z) cancel out, except some corresponding to ω satisfying |ω| > R. The contribution of these will be < ϵ, as will |R(z)| and R(z + ω_{0})|. Hence

|φ(z + ω_{0}) − φ(z)| < 3ϵ.

Since ϵ can be taken arbitrarily small, the result follows. ◀

428–99 8–12

8.4 The Field of Elliptic Functions

Proposition 8.11 φ(z) is even.

Proof ▶ This follows at once from the definition of φ(z) ◀

Corollary 6 φ′(z) is odd.

Proposition 8.12 The elliptic functions form with respect to Λ form a field over ℂ, of which the even functions form a sub-field.

Proof ▶ If f(z), g(z) are elliptic with respect to Λ, then so are f(z) ± g(z), f(z)g(z) and f(z)/g(z); and the same is true if f(z), g(z) are even. ◀

Definition 8.7 We say that σ ∈ ℂ is a semilattice point with respect to the lattice Λ if 2σ ∈ Λ but σ ∉ Λ.

There are evidently three classes of semilattice points mod Λ, represented by λ/2, μ/2 and (λ + μ)/2.

Proposition 8.13 An odd elliptic funtion f(z) has a pole or zero at every semilattice point σ.

Proof ▶ Suppose σ is not a pole of f(z). Since

2σ = ω ∈ Λ

ie

−σ = σ − ω,

it follows that

f(−σ) = f(σ − ω) = f(σ).

On the other hand, since f(z) is odd.

f(−σ) = −f(σ).

Hence

f(σ) = 0,

ie σ is a zero of f(z). ◀

Corollary 7 Suppose f(z) is an even elliptic funtion. If the semilattice point σ is a pole or zero of f(z) then it is a pole or zero of even order.

428–99 8–13 Proof ▶ Suppose σ is a zero of f(z). Since f^{1}(z) = f′(z) is odd, f^{2}(z) = f′′(z) is even, f^{3}(z) is odd, etc,

f^{(1)}(σ) = f^{(3)}(σ) = f^{(5)}(σ) = ⋯ = 0.

Thus the first n for which f^{(n)}(σ) ≠ 0 is even. Hence the ordero of the zero is even.

If f(z) has a pole at σ then the result follows on considering 1/f(z). ◀

Theorem 8.1 The field k of even elliptic functions with respect to Λ is generated over ℂ by the Weierstrass elliptic function: k = ℂ(φ(z)). In other words, every elliptic function f(z) is expressible as a rational function of φ(z):

f(z) = \frac{P (φ(z))}{Q(φ(z))},

where P, Q are polynomials.

Proof ▶ If f(z) has a pole or zero at 0, it must have even multiplicity since f(z) is even. Thus we can find e ∈ ℤ such that

g(z) = φ(z)^{e}f(z)

has no pole or zero at 0.

Suppose g(z) has zeros a_{1}, …, a_{r} and poles b_{1}, …, b_{r} in the fundamental parallelogram Π. If a is a zero of g(z) then so is −a mod Λ. Moreover if −a ≡ a mod Λ then the zero is of even order, by the Corollary to Proposition 8.13. Thus the zeros can be divided into pairs ±a_{1}, …, ±a_{t}, where 2t = r. Similarly the poles can be divided into pairs ±b_{1}, …, ±b_{t}.

The function φ(z) − φ(a) has just 2 zeros in Π, at ±a mod Λ. It follows that we can ‘eliminate’ poles or zeros at ±a by multiplying or dividing by φ(z) − φ(a). Thus

g(z)\begin{matrix}(φ(z) − φ(a_{1})) & … & (φ(z) − φ(a_{t})) \\ (φ(z) − φ(b_{1})) & … & (φ(z) − φ(b_{t})) \end{matrix}

has neither poles nor zeros, and so is constant. Hence

f(z) = cφ(z)^{−e} \begin{matrix}(φ(z) − φ(b_{1})) & … & (φ(z) − φ(b_{t})) \\ (φ(z) − φ(a_{1})) & … & (φ(z) − φ(a_{t})) \end{matrix}.

◀

428–99 8–14 Proposition 8.14 Every elliptic function f(z) is expressible in the form

f(z) = R(φ(z)) + ϕ′(z)S(φ(z)),

where R and S are rational functions.

Proof ▶ We can split f(z) into even and odd parts:

f(z) = \frac{f(z) + f(−z)}{2} + \frac{f(z) − f(−z)}{2}
= F (z) + G(z),

where F (z) is even and G(z) is odd. But then

H(z) = G(z)/φ′(z)

is even, and so

f(z) = F (z) + φ′(z)H(z),

where F (z) and H(z) are both even elliptic functions. The result now follows from the previous Proposition. ◀

Corollary 8 The field K of elliptic functions with respect to Λ is generated over ℂ by φ(z) and φ′(z):

K = ℂ (φ(z), φ′(z)) .

8.5 The Functional Equation

Since φ′(z) is odd, φ′(z)^{2} is even and so can be expressed as a rational function of φ(z):

φ′(z)^{2} = R(φ(z))

by our argument above. In fact we shall see that R is a cubic polynomial.

Proposition 8.15 The function φ(z) satisfies the functional equation

φ′(z)^{2} = 4 (φ(z) − φ(σ_{1})) (φ(z) − φ(σ_{2})) (φ(z) − φ(σ_{3})) ,

where σ_{1}, σ_{2}, σ_{3} are semilattice points in distinct classes modΛ (eg σ_{1} = λ/2, σ_{2} = μ/2, σ_{3} = (λ + μ)/2).

428–99 8–15 Proof ▶ The function on the left has a 6-fold pole at z = 0, and double zeros at each semilattice point. The function on the right also has a 6-fold pole at z = 0. Consider the function f(z) = φ(z) − φ(e_{i}). This has a zero at e_{i}; and it is a double zero since f′(e_{i}) = φ′(e_{i}) = 0.

Thus the function on the right has exactly the same poles and zeros as the function on the left. Hence they differ only by a multiplicative constant (since their ratio has no poles or zeros).

The value of this constant follows on considering the coefficients of 1/z^{6} on both sides:

φ(z) = \frac{1}{z^{2}} + h(z) ⟹ φ′(z) = −\frac{2}{z^{3}} + O(z)

⟹ φ′(z)^{2} = \frac{4}{z^{6}} + O(\frac{1}{z^{2}} .

◀

Theorem 8.2 The functional equation satisfied by φ(z) takes the form

φ′(z)^{2} = 4φ(z)^{3} − 60g_{2}φ(z) − 140g_{3},

where

g_{2} = ∑_{w∈Λ,w≠0} \frac{1}{w^{4}} , g_{3} = ∑_{w∈Λ,w≠0} \frac{1}{w^{6}} .

Proof ▶ We know that φ(z) satisfies a functional equation of the form

φ′(z)^{2} = 4φ(z)^{3} + aφ(z)^{2} + bφ(z) + c.

To determine the coefficients a, b, c we consider the leading terms in the expansions of φ(z) and φ′(z) about z = 0. We have

\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} = \frac{1}{ω^{2}(1 − z/ω)^{2}} − \frac{1}{ω^{2}}
= \frac{1}{ω^{2}} (1 + \frac{2z}{ω} + \frac{3z^{2}}{ω^{2}} + ⋯) − \frac{1}{ω^{2}}
= \frac{2z}{ω^{3}} + \frac{3z^{2}}{ω^{4}} + · · · .

Thus

φ(z) = \frac{1}{z^{2}} + 2z ∑_{ω≠0} \frac{1}{ω^{3}} + 3z^{2} ∑_{ω≠0} \frac{1}{ω^{4}} + ⋯

= \frac{1}{z^{2}} + 3g_{2}z^{2} + 5g_{3}z^{4} + O(z^{6}).

428–99 8–16 Differentiating,

φ′(z) = −\frac{2}{z^{3}} + 6g_{2}z + 20g_{3}z^{3} + O(z^{5}).

Thus

φ′(z)^{2} = \frac{4}{z^{6}} − \frac{24g_{2}}{z^{2}} − 80g_{3} + O(z^{2}),

while

φ(z)^{3} = \frac{1}{z^{6}} + \frac{9g_{2}}{z^{2}} + 15g_{3} + O(z^{2}),

and

φ(z)^{2} = \frac{1}{z^{4}} + 6g_{2} + O(z^{2}),

Substituting in the functional equation,

\frac{4}{z^{6}} + \frac{24g_{2}}{z^{2}} + 80g_{3} = \frac{4}{z^{6}} + \frac{36g_{2}}{z^{2}} + 60g_{3} + \frac{a}{z^{4}} + 6ag_{2} + \frac{b}{z^{2}} + c + O(z^{2}).

Comparing coefficients,

a = 0, b = −60g_{2}, c = −140g_{3},

as stated. ◀

8.6 Geometrical Interpretation

The functional equation can be interpreted as saying that the point (φ(z), φ′(z)) lies on the elliptic curve

y^{2} = 4x^{3} − 60g_{2}x − 140g_{3}

for all z ∈ ℂ \ Λ . If z ∈ Λ then φ(z) and φ′(z) are both undefined. We assign them to the infinite point [0, 1, 0] on E. Proposition 8.16 The map Φ : ℂ → E(ℂ) defined by

z ↦ \begin{cases}[φ(z), φ′(z), 1] & if z ∉ Λ, \\ [0, 1, 0] & if z ∈ Λ, \end{cases}

is surjective and continuous; and Φ(z_{1}) = Φ(z_{2}) ⟺ z_{1} ≡ z_{2} mod Λ.

428–99 8–17 Proof ▶ Suppose (x, y) = [x, y, 1] ∈ E. Consider the elliptic function

f(z) = φ(z) − x.

This has a double pole at the points of Λ, and so has two zeros in any fundamental parallelogram Π. Since f(z) is even, the two zeros are ±a mod Λ. But there are just two points (x, ±y) on E with a given x-coordinate. It follows that each point (x, y) ∈ E arises from some z ∈ ℂ, ie Φ is surjective.

Since φ(z) and φ′(z) are both doubly-periodic,

z_{1} ≡ z_{2} mod Λ ⟹ Φ(z_{1}) = Φ(z_{2}).

Conversely, if φ(z_{1}) = φ(z_{2}) then the argument above shows that z_{1} ≡ ±z_{2} mod Λ. Since φ′(−z) = −φ′(z), it follows that

Φ(z_{1}) = Φ(z_{2}) ⟹ z_{1} ≡ z_{2} mod Λ.

The map Φ is certainly continuous at all points z ∉ Λ, since φ(z) and φ′(z) are both differentiable, and so a fortiori continuous. It remains to show that Φ is continuous at 0. In the neighbourhood of 0 ∈ E,

(φ(z), φ′(z)) = (\frac{1}{z^{2}} + ⋯, \frac{−2}{z^{3}} + ⋯) .

Changing to X, Z coordinates, where [x, y, 1] = [X, 1, Z], ie

X = \frac{x}{z}, Z = \frac{1}{z},

we see that

X = z + O(z^{3}), Z = −\frac{1}{2}z^{3} + O(z^{5}).

It follows that Φ is continuous at 0, and so at the other points of Λ. ◀

Corollary 9 The map Φ induces a homeomorphism

E(ℂ) ≅ ℂ/Λ.

Let λ, μ be a basis for Λ. The quotient-group ℂ/Λ is homeomorphic to the torus 𝕋^{2}, under the map

(x mod 1, y mod 1) ↦ xλ + yμ mod Λ.

Since this map preserves addition, it is in fact an isomorphism of topological groups:

ℂ/Λ = 𝕋^{2}.

Thus we have a homeomorphism

𝕋^{2} → E(ℂ) : (x mod 1, y mod 1) ↦ (φ(xλ + yμ), φ′(xλ + yμ)) .

This leaves the question: is this map a group isomorphism? That is, does the addition on ℂ/Λ correspond to the addition defined geometrically on E?

428–99 8–18

8.7 The Addition Formula

Suppose u, v ∈ ℂ \ Λ, with u ≢ v mod Λ. Then we can find A, B, C ∈ ℂ such that

Aφ(u) + Bφ′(u) + C = 0
Aφ(v) + Bφ′(v) + C = 0.

Consider the elliptic function

f(z) = Aφ(z) + Bφ′(z) + C.

This has a triple pole (at most) at each lattice point z ∈ Λ. Hence it has 3 zeros a_{1}, a_{2}, a_{3} in any fundamental parallelogram Π, satisfying

a_{1} + a_{2} + a_{3} ≡ 0 mod Λ,

by Proposition /refZeroPoleSum Two of these are equivalent modulo Λ to u and v. It follows that the third is ≡ −(u + v) mod Λ:

Aφ(u + v) − Bφ′(u + v) + C = 0.

Thus, eliminating A, B, C,

det [ \begin{matrix}φ(u + v) & −φ′(u + v) & 1 \\ φ(u) & −φ′(u) & 1 \\ φ(v) & −φ′(v) & 1 \end{matrix} ] = 0.

This expresses Φ(u + v) = (φ(u + v), φ′(u + v)) in terms of Φ(u) and Φ(v).

Proposition 8.17 Suppose u, v, w ∈ ℂ/Λ; and suppose

u + v + w = 0.

Then the corresponding points Φ(u), Φ(v), Φ(w) ∈ E are collinear.

Proof ▶ Suppose u, v, w ≠ 0. We have seen that there exists (A, B, C) ≠ (0, 0, 0) such that

Aφ(u) + Bφ′(u) + C = 0
Aφ(v) + Bφ′(v) + C = 0
Aφ(w) + Bφ′(w) + C = 0.

428–99 8–19 In other words the 3 points Φ(u), Φ(v), Φ(w) lie on the line

Ax + By + C = 0.

If say u = 0 then v = −w, and

Φ(u) = [0, 1, 0], Φ(v) = [φ(v), φ′(v), 1], Φ(w) = [φ(v), −φ′(v), 1]

lie on the line x = φ(v)z. ◀

Corollary 10 The map

Φ : ℂ/Λ → E(ℂ)

is an isomorphism of topological abelian groups. In particular,

E(ℂ) ≅ 𝕋^{2}.

In one sense this result is of little practical value, since we already know that

E(ℝ) = 𝕋^{1} or 𝕋^{1} ⊕ ℤ/(2),

and this gives us more information about E(ℚ). For example, the result for E(ℝ) tells us that the torsion subgroup F, formed by the points of E(ℚ) of finite order, is either cyclic ℤ/(n), or else of the form ℤ/(2) ⊕ ℤ/(n). The result for E(ℂ) only tells us that F is either cyclic ℤ/(n), or else of the form ℤ/(m) ⊕ ℤ/(n).

Perhaps the main interest of the complex case is that it explains in a natural way why there is a group structure on E.

8.8 The modular group

As we have seen, each lattice Λ ⊂ ℂ gives rise to an elliptic curve

E(ℂ) : y^{2} = x^{3} − 15g_{2}x − 35g_{3}.

It is natural to ask: Does every elliptic curve over ℂ arises in this way from some lattice Λ?

Suppose s ∈ ℂ^{×}. Consider the lattice

sΛ = {sω : ω ∈ Λ}.

We say that Λ, sΛ are similar. Evidently

g_{k}(sΛ) = ∑′ \frac{1}{(sω)^{2k}} = s^{−2k}g_{k}(Λ).

428–99 8–20 In particular, sΛ gives rise to the elliptic curve

y^{2} = x^{3} − 15s^{−4}g_{2}(Λ)x − 35s^{−6}g_{3}(Λ).

But this is just the equation we get if we make the transformation

x ↦ s^{−2}x, y ↦ s^{−3}y,

since the coefficients of x and 1 in the Weierstrass equation have weights 4 and 6, respectively. Thus similar lattices give rise to projectively equivalent elliptic curves.

In effect, therefore, we are only concerned with lattices up to similarity. In other words, we are concerned with the ratio

τ = λ/μ

rather than with the basis elements λ, μ themselves. (For the lattice ⟨1, τ⟩ is similar to the lattice ⟨λ, μ⟩.)

Recall that τ ∉ ℝ. Thus τ either lies in the upper half-plane

H = {z ∈ ℂ : ℑ(z) > 0}

or else in the lower half-plane −H. It is convenient to restrict ourselves to bases λ, μ with λ/μ ∈ H. Let us say that the basis is positive in this case. (Note that just one of λ, μ and −λ, μ is positive; so we can always make a basis positive by replacing λ with −λ if necessary.)

Recall that if λ′, μ′ is another basis then

(\begin{matrix}λ′ \\ μ′ \end{matrix}) = (\begin{matrix}a & b \\ c & d \end{matrix}) (\begin{matrix}λ \\ μ \end{matrix}) ,

where a, b, c, d ∈ ℤ and ad − bc = ±1. On setting τ′ = λ′/μ′ this becomes

τ′ = \frac{aτ + b}{cτ + d}.

The following result, although apparently rather technical, will prove very useful.

Proposition 8.18 Suppose

τ′ = \frac{aτ + b}{cτ + d},

where

T = (\begin{matrix}a & b \\ c & d \end{matrix}) ∈ GL(2, ℝ).

Then

ℑ(τ′) = \frac{det T}{|cτ + d|^{2}} ℑ(τ).

428–99 8–21 Proof ▶ We have

ℑ(τ′) = \frac{1}{2i} (τ′ − \overline{τ′})

= \frac{1}{2i} (\frac{aτ + b}{cτ + d} − \frac{aτ̄ + b}{cτ̄ + d})

= \frac{1}{2i} \frac{(ad − bc)(τ − τ̄)}{(cτ + d)(cτ̄ + d)}

= \frac{det T}{|cτ + d|^{2}} ℑ(τ).

◀

Corollary 11 If τ, τ′ ∈ H then det T > 0.

Thus if we restrict ourselves to positive bases (those with ℑ(λ/μ) > 0) then we need only consider transformations

T ∈ SL(2, ℤ) = \{(\begin{matrix}a & b \\ c & d \end{matrix}) : a, b, c, d ∈ ℤ, ad − bc = 1\} .

The matrix T ∈ SL(2, ℤ) acts on H by

z ↦ T z = \frac{az + b}{cz + d}.

Notice that the matrices ±T define the same transformation. Definition 8.8 The modular group G is the quotient-group

G = SL(2, ℤ)/{±I}.

Thus the modular group G acts on the upper half-plane H, by

gz = \frac{az + b}{cz + d}.

Each g ∈ G arises from a pair of matrices ±T ∈ SL(2, ℤ). By ‘abuse of notation’ we use the matrix T to denote g. Definition 8.9 We define S, T ∈ G by

S = (\begin{matrix}0 & −1 \\ 1 & 0 \end{matrix}) , T = (\begin{matrix}1 & 1 \\ 0 & 1 \end{matrix}) ,

428–99 8–22 Thus T corresponds to the translation

z ↦ z + 1,

while S corresponds to the inversion

z ↦ −1/z.

We shall see shortly that S, T generate the modular group:

G = ⟨S, T ⟩.

Proposition 8.19 S^{2} = I, (ST)^{3} = I. Proof ▶ We have

S^{2} = −I
= I,

since we are working mod ± I. Also

ST = (\begin{matrix}0 & −1 \\ 1 & 1 \end{matrix})

satisfies its characteristic equation

t^{2} − t + 1 = 0.

Hence ST satisfies

(t + 1)(t^{2} − t + 1) = t^{3} + 1 = 0,

ie

(ST)^{3} = −I
= I,

since we are working mod ± I. ◀

8.9 The fundamental region

Definition 8.10 We define the fundamental region (for the modular group) F ⊂ H by

F = \{z ∈ H : −\frac{1}{2} < ℜ(z) ≤ \frac{1}{2}, |z| > 1 or |z| = 1 and ℜ(z) > 0\}.

428–99 8–23

Notice that we have included half the boundary of F, just as we did (and for much the same reason) with the fundamental parallelogram Π for a lattice Λ.

Notice too that F contains the points −ω^{2} and i; these will play a special rôle in what follows.

Theorem 8.3 Each point z ∈ H has a unique transform

z_{0} = gz ∈ F (g ∈ G).

Remark: Note that we are not saying g ∈ G is unique (we shall deal with that question shortly); only that z_{0} is unique.

Proof ▶ The idea is to find a transform gz maximimising ℑ(gz). By Proposition 8.18, if

gz = \frac{az + b}{cz + d}

then

ℑ(gz) = \frac{1}{|cz + d|^{2}} ℑ(z).

For a fixed z ∈ H, the points

{cz + d : c, d ∈ ℤ}

form a lattice (with basis 1,z). There are only a finite number of lattice points inside the disk |z| ≤ 1, ie there are only a finite number of c, d ∈ ℤ with

|cz + d| ≤ 1.

It follows that ℑ(gz) can only take a finite number of values ≥ ℑ(z). In particular there must be a maximum such value, attained say at g_{0}z.

Now translation z ↦ z + r does not affect ℑ(z), so the maximal value is also attained at each pount T^{r}g_{0}z.

But we can choose r so that z_{0} = T^{r}(g_{0}z) lies in the strip

S = \{z ∈ ℍ : −\frac{1}{2} < ℜ(z) ≤ \frac{1}{2}\}.

We claim that this transform z_{0} ∈ F, or else |z_{0}| = 1 and Sz_{0} ∈ F.

Lemma 7 If |z| < 1 then ℑ(Sz) > ℑ(z).

428–99 8–24 Proof of Lemma ▷ If z = re^{iθ} then Sz = −1/z and so

ℑ(Sz) = \frac{1}{r} sin θ > r sin θ = ℑ(z).

◁

In particular, |z_{0}| ≥ 1; for otherwise ℑ(Sz_{0}) > ℑ(z_{0}), contradicting the maximality of ℑ(z_{0}). If |z_{0}| > 1 then z_{0} ∈ F; while if |z_{0}| = 1 then either ℜ(z_{0}) ≥ 0, in which case z_{0} ∈ F, or else ℜ(z_{0}) < 0 in which case Sz_{0} ∈ F F.

Now suppose z, gz ∈ F. We may assume (swapping z,gz if necessary) that

ℑ(gz) ≥ ℑ(z).

By Proposition 8.18, this implies that

|cz + d| ≤ 1.

The lowest points of F is

−ω^{2} = \frac{1}{2} + \frac{\sqrt{3}}{2}i.

Hence

|ℑ(cz + d)| ≥ \frac{\sqrt{3}}{2}|c|;

and so

|c| ≤ 1.

But now cz lies in the strip S, and so

|ℜ(cz + d)| ≥ |d| − 1/2.

Hence

|d| ≤ 1.

The problem is reduced to just 4 cases: (c, d) = (1, 0), (0, 1), (1, 1), (1, −1). If c = 0 then g is a translation

gz = z + r;

and it is clear that z, gz cannot both lie in the strip S.

If d = 0 then we can take b = 1, c = −1, and so

gz = −\frac{az + 1}{z}

= Sz − a.

428–99 8–25 Now

z ∈ F ⟹ Sz ∈ S.

Hence a = 0, ie g = S. But it is clear that

z, Sz ∈ F ⟹ |z| = 1;

while if |z| = 1 then

ℜ(z) < 0 ⟺ ℜSz > 0.

So z, Sz cannot both be in F.

It remains to consider the cases (c, d) = (1, ±1). The function

|cz + d|

must attain its minimum on F at a boundary point. (It is a general principle that if the function f(z) is holomorphic on the open set U then |f(z)| can only attain its minimum at a point of U if this minimum is 0.) But on going round the boundary of F, it is clear that

|z ± 1| ≥ 1,

with equality only at the corner-points ω, −ω^{2}. It follows that if z, gz ∈ F then

z = gz = −ω^{2}.

◀

Remark: The Theorem shows that we can identify the quotient-space H/G with the fundamental region F.

Suppose the group G acts on the set X. Recall that the stabilizer S(x) of an element x ∈ X is the subgroup

S(x) = {g ∈ G : gx = x}.

During the proof of the Theorem we almost established the following result. We leave completion of the proof to the reader.

Proposition 8.20 1. S(−ω^{2}) = {I, T S, (T S)^{2}};

2. S(i) = {I, S};

3. If z ∈ F, z ≠ −ω^{2}, i then S(z) = {I}.

Theorem 8.4 The modular group G is generated by S and T:

G = ⟨S, T ⟩.

428–99 8–26 Proof ▶ Let

H = ⟨S, T ⟩

be the subgroup of G generated by S, T.

On examining the proof of Proposition 8.3 it is clear that the argument holds equally well with H replacing G. In particular, if z ∈ H then we can find a transform

hz ∈ F (h ∈ H).

Now suppose g ∈ G. Choose any z ∈ F except −ω^{2} or i, and consider the transform gz. By Theorem 8.3 we can find h ∈ H such that

h(gz) ∈ F.

But then, by the same Theorem,

hgz = z;

and therefore

hg ∈ S(z) = {I},

ie

hg = I ⟹ g = h^{−1} ∈ H.

Thus G = H, ie G is generated by S and T. ◀

8.10 Modular functions

Definition 8.11 The meromorphic function f(z) on H is said to be weakly modular of weight 2k (where k ∈ ℤ) if

f(gz) = (cz + d)^{−2k}f(z)

for each modular transformation

gz = \frac{az + b}{cz + d}.

Remark: Note that it would not make sense to speak of a function of odd weight, since cz + d is only determined up to ±1.

428–99 8–27 Proposition 8.21 The meromorphic function f(z) on H is weakly modular of weight 2k if and only if

f(T z) = f(z), f(Sz) = z^{−2k}f(z).

Proof ▶ If f(z) is weakly modular then the condition is certainly satisfied by S, T ∈ G.

Conversely, suppose the condition is satisfied S, T and g, where

gz = \frac{az + b}{cz + d}.

We shall show that it is satisfied by Sg and T g.

We have

S(gz) = −\frac{1}{gz} = −\frac{cz + d}{az + b};

while

f(Sgz) = (gz)^{−2k}f(gz)
= (az + b)^{−2k}(cz + d)^{2k}f(gz)
= (az + b)^{−2k}(cz + d)^{2k}(cz + d)^{−2k}f(z)
= (az + b)^{−2k}f(z),

so the result holds for Sg.

More simply,

T (gz) = gz + 1 = \frac{(a + c)z + (b + d)}{cz + d};

while

f(T gz) = f(gz)
= (cz + d)^{−2k}f(z),

so the result also holds for T g.

It follows that the result holds where g is any word in S, T, ie for any g ∈ ⟨S, T ⟩. Therefore, since S, T generate G, the result holds for all g ∈ G.

◀

Suppose f(z) is a weakly modular function. Then in particular f(z) is periodic with period 1:

f(z + 1) = f(z).

428–99 8–28 The map

Θ : z ↦ q = e^{2πiz}

maps H onto the interior of the disk

D = {z : |z| < 1}

with the point 0 removed. Moreover

Θ(z_{1}) = Θ(z_{2}) ⟺ z_{2} − z_{1} ∈ ℤ.

It follows that f(z) defines a meromorphic function g(q) on D \ {0}:

f(z) = g(e^{2πz}).

Definition 8.12 The weakly modular function f(z) is said to have a pole (or zero) of order m at ∞ if that is true of g(q) at q = 0. It is said to be regular at ∞ if it does not have a pole there; and in that case we set f(∞) = g(0).

Definition 8.13 The weakly modular function f(z) is said to be modular if it has at worst a pole of finite order at ∞.

It follows that a modular function has an ‘expansion at ∞’

g(q) = ∑_{n∈ℤ}a_{n}q^{n},

where only finite number of the coefficients a_{n} with n < 0 are ≠ 0.

Definition 8.14 A modular function is said to be a modular form if it has no poles in H, or at ∞.

To each modular function f(z) of weight 2k we can associate the lattice function F (Λ) of weight 2k given by

F (⟨λ, μ⟩) = μ^{−2k}f(λ/mu).

Conversely, we can recover the modular function from the lattice function by

f(z) = F (⟨1, z⟩).

Definition 8.15 We define the functions G_{k}(z) for k ≥ 2 by

G_{k}(z) = ∑_{(m,n)≠(0,0)} \frac{1}{(m + nz)^{2k}} .

428–99 8–29 Thus G_{k}(z) corresponds to the lattice function

g_{k}(Λ) = ∑_{ω∈Λ,ω≠0} \frac{1}{ω^{2k}} .

Recall that Riemann’s zeta function f(s) is defined by

ζ(s) = 1 + \frac{1}{2^{s}} + \frac{1}{3^{s}} + · · · .

In number theory (in particular in the proof of the Prime Number Theorem), ζ(s) is considered as a function of a complex variable. But our concern is only with ζ(n) for integers n ≥ 2.

Proposition 8.22 G_{k}(z) is a modular form of weight 2k, with

G_{k}(∞) = 2ζ(2k).

Proof ▶ The series for G_{k}(z) is uniformly absolutely convergent in ℑ(z) ≥ δ for any δ > 0, by comparison with the corresponding integral, as in the proof of Proposition 8.8. It follows that G_{k}(z) is holomorphic in H.

On the other hand, G_{k}(z) is weakly modular of weight 2k from the same property of the associated lattice function g_{2}(Λ).

It remains to see how G_{k}(z) behaves near ∞. As z → ∞,

\frac{1}{(m + nz)^{2k}} → \begin{cases}0 & if n ≠ 0 \\ m^{−2k} & if n = 0. \end{cases}

Since the series is uniformly convergent, it follows that

G_{k}(z) → 2ζ(2k) as z → ∞.

It follows from this that g(q) is regular at q = 0, with g(0) = 2ζ(2k). (For the coefficient a_{−n} in the Laurent series is given by

a_{−n} = \frac{1}{2πi} ∫_{C} q^{n−1}g(q)dq

round a small circle C with centre 0, and this vanishes as the radius of the circle tends to 0.) ◀

Proposition 8.23 A modular function has only a finite number of poles and zeros in F.

428–99 8–30 Proof ▶ The function g(q) has an expansion

g(q) = q^{n}(a_{n} + a_{n+1}z + ⋯) (a_{n} ≠ 0)

in some neighbourhood of 0. It follows that g(q) is regular and has no zeros in some disk

0 < |q| ≤ r ≤ 1.

Hence f(z) has no poles or zeros in the half-plane

{z ∈ H : ℑ(z) > e^{r}}.

On the other hand, f(z) has only a finite number of poles or zeros in the compact set

{z ∈ F̄ : ℑ(z) ≤ e^{r}}.

It follows that f(z) has only a finite number of poles or zeros in F. ◀

Definition 8.16 Suppose f(z) is a meromorphic function on U. For each u ∈ U we set

v_{u}(f) = \begin{cases}m & if f(z) has a zero of order m at u \\ −m & if f(z) has a pole of order m at u \\ 0 & otherwise \end{cases}

Remark: If f(z), g(z) are meromorphic functions on U then

1. v_{u}(f + g) ≤ max(v_{u}(f), v_{u}(g)),

2. v_{u}(fg) = v_{u}(f) + v_{u}(g).

Thus v_{u}(f) is a valuation on the field of meromorphic functions on U; in fact, it satisfies the same stronger conditions as the p-adic valuation we considered in Chapter 5.

8.11 The Modular Counting Theorem

Theorem 8.5 Suppose f(z) is a modular function of weight 2k. Then

\frac{1}{3}v_{ω}(f) + \frac{1}{2}v_{i}(f) + ∑_{z≠ω,−ω^{2},i} v_{z}(f) = \frac{k}{6}.

428–99 8–31 Proof ▶ Let

I = \frac{1}{2πi} ∫_{Γ} \frac{f′(z)}{f(z)}dz,

where Γ runs round the boundary of F, truncated at the top. More precisely,

Γ = A + B + C + D + E,

where A is the line joining −ω^{2} to 1/2 + Ri, B is the line joining 1/2 + Ri to −1/2 + Ri, C is the line joining −1/2 + Ri to ω, D is the circular arc joining ω to i, and E is the circular arc joining −ω^{2}.

Let us assume for the moment that f(z) has no poles or zeros on Γ, and also that R is so large that all the poles or zeros of f(z) inside F are inside Γ.

As we know, if f(z) has a pole or zero at u ∈ H then f′(z)/f(z) has a simple zero at u with residue v_{u}(f). It follows that

I = ∑_{u∈F} v_{u}(f).

We consider the contributions to I from the five parts of the contour.

1. Since f(z + 1) = f(z), while the integrals are in opposite directions,

∫_{A} + ∫_{C} = 0,

where for simplicity we write

∫_{X} for \frac{1}{2πi} ∫_{X} \frac{f′(z)}{f(z)}dz.

2. As z moves from ω to i on D, Sz moves from −ω^{2} to i on E. If f(z) were of weight 0, so that f(Sz) = f(z), then the contributions from D and E would cancel out in the same was as those from A and C. However, if f(z) is of weight 2k,

f(Sz) = \frac{1}{z^{2k}} f(z) ⟹ f′(Sz) = −\frac{2k}{z^{2k+1}} f(z) + \frac{1}{z^{2k}} f′(z)

⟹ \frac{f′(Sz)}{f(Sz)} = −\frac{2k}{z} + \frac{f′(z)}{f(z)}.

428–99 8–32 (In effect, f′(z)/f(z) = d/dz(log f(z)).) Thus the main parts of the integral cancel out, leaving

∫_{D} + ∫_{E} = \frac{1}{2πi} ∫_{D} \frac{2k}{z} dz

= \frac{2k}{2πi} ∫_{2π/3}^{π/2} iθdθ

= k (\frac{2}{3} − \frac{1}{2})

= \frac{k}{6}

3. Finally, on B we have

f(z) = g(e^{2πiz}).

Changing variable from z to q = e^{2πiz},

\frac{f′(z)}{f(z)} = 2πiq \frac{g′(q)}{g(q)}, dz = 2πiq dq,

and so

∫_{B} = \frac{1}{2πi} ∫_{γ} \frac{g′(q)}{g(q)}dq,

where q runs round the small circle

γ : q = e^{−2πR}e^{2πx}

from x = π to x = −π in a negative (clockwise) direction.

Now if g(q) has a pole or zero at q = 0 then g′(q)/g(q) has a simple pole there with residue

v_{0}(g) = v_{∞}(f);

while g′(q)/g(q) is regular at q = 0 if g(q) has neither pole nor zero there. It follows in all cases that

∫_{B} = −v_{∞}(f).

Putting the parts together,

I = \frac{k}{6} − v_{∞}(f).

428–99 8–33 But as we observed,

I = ∑_{u∈F} v_{u}(f).

Thus

∑_{u∈F} v_{u}(f) + v_{∞}(f) = \frac{k}{6},

as required.

It remains to deal with the case where f(z) has one or more poles or zeros on Γ.

1. Suppose f(z) has a pole or zero at z = z_{0} ∈ A, where z_{0} ≠ −ω^{2}. Then it will also have a pole or zero of the same order at the corresponding point on C, since f(z − 1) = f(z).

Let us make small semi-circular diversions to the west of the pole or zero on both A and C. Then

∫_{A′} + ∫_{C′} = 0,

as before; and the pole or zero is included once inside Γ′, as required.

2. Suppose f(z) has a pole or zero at z = z_{0} ∈ B, where z_{0} ≠ −ω^{2} or i. Then f(z) has a pole or zero of the same order at Sz_{0} ∈ C, since

f(Sz) = z^{2k}f(z).

Let us make a small (almost) semicircular diversion δ to the south of z_{0}. Then Sδ is a similar diversion to the north of Sz_{0}. It follows from our argument in the main case that

∫_{B′} + ∫_{C′} = \frac{1}{2πi} ∫ B′ \frac{2k}{z} dz

= \frac{1}{2πi} ∫ B \frac{2k}{z} dz

= \frac{k}{6},

since the function 1/z is regular at z_{0}.

3. Now suppose that f(z) has a pole or zero at −ω^{2}, and so also at ω = −ω^{2} − 1. We make a small diversion around both points, travelling inside F F along circular arcs δ, δ_{1} of radius ϵ, so that

B′ = B′′ + δ, C′ = C′′ + δ_{1},

428–99 8–34 where B′′, C′′ are slightly curtailed versions of B, C. By our argument in the main case,

∫_{B′′} + ∫_{C′′} = ∫_{B} + ∫_{C} +O(ϵ)  = \frac{k}{6} + O(ϵ).

In the neighbourhood of ω,

\frac{f′(z)}{f(z)} = \frac{v_{ω}(f)}{z − ω} + h(z),

where h(z) is holomorphic. The angle between C and D is π/3, so the arc δ has angle π/3 + O(ϵ), traversed in the negative direction. Hence

\frac{1}{2πi} ∫_{γ} \frac{f′(z)}{f(z)}dz = −\frac{v_{ω}(f)}{6}.

Similarly

\frac{1}{2πi} ∫_{γ_{1}} \frac{f′(z)}{f(z)}dz = −\frac{v_{ω}(f)}{6}.

Also

∫_{A′} + ∫_{C′} = 0,

as before. Putting the parts together,

I = \frac{k}{6} − v_{∞}(f) − \frac{1}{2}v_{ω}(f),

and so

\frac{1}{3}v_{ω}(f) + ∑_{u} v_{u}(f) = \frac{k}{6},

as required.

4. A pole or zero at i is dealt with similarly, by a small (nearly) semicircular diversion δ of radius ϵ to the north of i. Let D′′, E′′ denote the curtailed portions of D, E, so that

Γ′ = A + B + C + D′′ + δ + E′′.

Then

∫_{D′′} + ∫ E′′ = \frac{k}{6} + O(ϵ),

428–99 8–35 as in the previous case; while

\frac{f′(z)}{f(z)} = \frac{v_{i}(f)}{z − i} + h(z)

in the neighbourhood of i, where h(z) is regular at i, and so

∫_{γ} = −\frac{v_{i}(f)}{2},

again as in the previous case. Putting the parts together,

\frac{1}{2}v_{i}(f) + ∑_{u} v_{u}(f) = \frac{k}{6},

as required.

5. Finally, if f(z) has more than one pole or zero on Γ, eg a pole at −ω^{2} (and so also at ω) and a zero at i. Then we make a diversion around each pole or zero, according to the prescription above; and the parts will combine to give the result:

\frac{1}{3}v_{ω}(f) + \frac{1}{2}v_{i}(f) + ∑_{u} v_{u}(f) = \frac{k}{6}.

◀

Proposition 8.24 There are no modular forms of weight < 0; and the only modular forms of weigth 0 are the constants.

Proof ▶ For a modular form f(z), v_{u}(f) ≥ 0 for all u. Thus if f(z) were of weight < 0, then the left-hand side of the identity in the Theorem would be ≥ 0, while the right-hand side would be < 0.

Similarly, if k = 0 then the only way the identity could be satisfied is if v_{u}(f) = 0 for all u (including ∞). But then f(z) − f(∞) is a modular form of weight 0 with v_{∞}(f) > 0, which is a contradiction unless the function is identically zero, ie f(z) = f(∞) is constant. ◀

Proposition 8.25 There are no modular forms of weight 2.

Proof ▶ Suppose f(z) is such a form. Writing

a = v_{ω}(f), b = v_{i}(f), c = ∑_{u≠ω,i} v_{u}(f),

428–99 8–36 we have

\frac{a}{3} + \frac{b}{2} + c = \frac{1}{6},

with a, b ∈ ℕ, which is manifestly impossible. ◀

Proposition 8.26 The only modular form of weight 4 is G_{2}(z), up to a scalar multiple.

Proof ▶ The only solution of

\frac{a}{3} + \frac{b}{2} + c = \frac{1}{3}

with a, b, c ∈ ℕ, is a = 1, b = c = 0. Thus every modular form f(z) of weight 4 must have a simple zero at ω.

But then

f(z) − \frac{f(∞)}{G_{2}(∞)}G_{2}(z),

if non-zero, is a modular form of weight 4 with v_{∞}(f) ≥ 1, which conflicts with our formula. Hence this form vanishes identically, ie

f(z) = ρG_{2}(z),

where ρ = f(∞)/G_{2}(∞). (Recall that G_{2}(infty) = ζ(4) ≠ 0.) ◀

Proposition 8.27 The only modular form of weight 6 is G_{3}(z), up to a scalar multiple.

Proof ▶ The only solution of

\frac{a}{3} + \frac{b}{2} + c = \frac{1}{2}

with a, b, c ∈ ℕ, is evidently a = 0, b = 1, c = 0. Thus every modular form f(z) of weight 6 must have a simple zero at i.

It follows as in the proof of the last Proposition that

f(z) = ρG_{3}(z),

where ρ = f(∞)/G_{3}(∞). ◀ We have proved incidentally the following result.

Proposition 8.28 G_{2}(ω) = 0, G_{3}(i) = 0.

428–99 8–37 It is easy enough to prove this directly; since Sω = −ω^{2},

G(−ω^{2}) = \frac{1}{ω^{4}} G(ω) = ω^{2}G(ω),

while since −ω^{2} = ω + 1,

G(−ω^{2}) = G(ω),

Similarly, since Si = i,

G_{3}(i) = \frac{1}{i^{6}} G_{3}(i) = −G_{3}(i).

Recall that the discriminant Δ(E) of the elliptic curve

y^{2} = x^{3} + bx + c

was defined to be

Δ = 2^{4}D,

where

D = −(4b^{3} + 27c^{2})

is the discriminant of the polynomial on the right. (The factor 2^{4} was introduced to allow the discriminant of the general Weierstrassian elliptic curve

y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

to be defined as a polynomial in c_{1}, c_{2}, c_{3}, c_{4}, c_{6} with integral coefficients.) It follows that the discriminant of the elliptic curve

E(ℂ) : y^{2} = x^{3} − 15g_{2}x − 35g_{3}

is

Δ(E) = 2^{4}3^{3}5^{2}(20g_{2}^{3} − 49g_{3}^{2}).

(The scalar factor is irrelevant for our present purposes, and is only retained for consistency.)

Definition 8.17 The modular invariant Δ(z) is defined by

Δ(z) = 2^{4}3^{3}5^{2}(20G_{2}^{3} − 49G_{3}^{2}).

Proposition 8.29 Δ(z) is a modular form of weight 12. It has a simple zero at ∞, and no other poles or zeros.

428–99 8–38 Proof ▶ It is clear that Δ(z) is a modular form of weight 12. We know that the elliptic curve

E : y^{2} = x^{3} − 15g_{2}x − 35g_{3}

is non-singular. (Recall the argument: If the curve had a singularity, it would be a point (α, 0) on the line of symmetry y = 0, where α is a double root of the polynomial on the right. But we have seen that this polynomial has three distinct roots corresponding to the semilattice points of the lattice Λ in question.)

But now our formula gives

v_{∞}(Δ) = 1,

ie Δ(z) has a simple zero at ∞. ◀

Remark: A modular form f(z) with f(∞) = 0 is called a cusp form.

Proposition 8.30 The modular forms are generated by G_{2}(z) and G_{3}(z). More precisely, a modular form of weight 2k is a linear combination of the modular forms

G_{2}(z)^{a}G_{3}(z)^{b},

where

2a + 3b = k.

Proof ▶ We argue by induction on k. We have seen that the result is true for k = 0, 2, 4, 6.

Lemma The only modular form of weight 8 is G_{2}(z)^{2}, up to a scalar multiple. The only modular form of weight 10 is G_{2}(z)G_{3}(z), up to a scalar multiple.

Proof of Lemma ▷ The only solution of

2a + 3b = 4

is a = 2, b = 0, while the only solution of

2a + 3b = 5

is a = 1, b = 1. The result follows as in Propositions 8.26 and 8.27. ◁

Lemma The equation

2a + 3b = k (a, b ∈ ℕ)

has a solution for all k ≥ 2.

428–99 8–39 Proof of Lemma ▷ If k is even, a = k/2, b = 0 is a solution; while if k is

odd, a = (k − 3)/2, b = 1 is a solution. ◁

Now suppose f(z) is a modular form of weight 2k, where k ≥ 6. By the last Lemma, we can find a, b such that 2a + 3b = k. Let

g(z) = G_{2}(z)^{a}G_{3}(z)^{b}.

Then g(z) is also of weight 2k; and so is

h(z) = f(z) − ρg(z),

where we choose

ρ = \frac{f(∞)}{G_{2}(∞)^{a}G_{3}(∞)^{b}} = \frac{f(∞)}{ζ(4)^{a}ζ(6)^{b}}

so that

h(∞) = 0.

Then h(z) is a modular form of weight 2k with h(∞) = 0.

But now

k(z) = \frac{h(z)}{Δ(z)}

is a modular form of weight 2k − 12; for the zero of h(z) at ∞ cancels out the zero of Δ(z) at ∞, and Δ(z) has no other zeros.

It follows by our inductive hypothesis that k(z) is a linear combination of the monomial functions

G_{2}(z)^{a′}G_{3}(z)^{b′} (2a′ + 3b′ = k − 6).

Hence

g(z) = Δ(z)k(z)

is a linear combination of the functions

G_{2}(z)^{a′′}G_{3}(z)^{b′′} (2a′′ + 3b′′ = k);

and so therefore is

f(z) = g(z) + G_{2}(z)^{a}G_{3}(z)^{b}.

◀

Proposition 8.31 The functions G_{2}(z)^{a}G_{3}(z)^{b} with 2a+3b = k form a basis for the modular forms of weight 2k.

428–99 8–40 Proof ▶ Suppose there were a linear relation between these monomial functions. The relation of lowest weight must be of the form

λG_{2}(z)^{3c} + ⋯ + μG_{3}(z)^{2c} = 0.

(For otherwise we could divide the relation by G_{2}(z) or G_{3}(z).)

But now taking z = i, −ω^{2},

μG_{3}(ω)^{2c} = 0 ⟹ μ = 0, λG_{2}(ω)^{3c} = 0 ⟹ λ = 0.

◀

The modular forms constitute a graded algebra

M = (M_{k})_{k∈ℕ},

where M_{k} is the space of modular forms of weight 2k. It follows from the Proposition above that this algebra is the polynomial algebra generated by G_{2} and G_{3}:

M = ℂ[G_{2}, G_{3}].

8.12 The j-invariant

Definition 8.18 We set

j(z) = 2^{6}3^{3} \frac{G_{2}(z)^{3}}{Δ(z)} .

Remark: The scalar factor is of no significance for our present purpose. (It is chosen so that j(z) has residue 1 at ∞.)

Proposition 8.32 j(z) is a modular function of weight 0. It has a simple pole at ∞ and a triple zero at ω mod G, and no other poles or zeros.

Proof ▶ This follows at once from the properties of G_{2}(z) and Δ(z) (Propositions 8.26 and 8.29). ◀

Corollary 12 For each c ∈ ℂ there is just one z ∈ F such that

j(z) = c.

Proof ▶ The modular function j(z) − c is of weight 0, and has a simple pole at ∞. It follows from the Modular Counting Theorem that f(z) either has a triple zero at −ω^{2}, or else a simple zero at some other point.

In any case, there is just one zero in F. ◀

Recall that each modular function has an associated lattice function.

428–99 8–41 Definition 8.19 For each lattice Λ = ⟨λ, μ⟩ we set

J(Λ) = j(λ/μ).

Thus

J(Λ) = 2^{6}3^{3} \frac{g_{2}^{3}}{Δ}

= \frac{2^{2}}{5^{2}} \frac{g_{2}^{3}}{20g_{2}^{3} − 49g_{3}^{2}} .

Theorem 8.6 Each elliptic curve

E(ℂ) : y^{2} = x^{3} + bx + c

arises from a unique lattice Λ.

Proof ▶ We are looking for a lattice Λ with

−15g_{2}(Λ) = b, −35g_{3}(Λ) = c.

For such a lattice

j(Λ) = 2^{2}3^{3}5^{3} \frac{b^{3}}{2^{2}b^{3} − 3^{3}c^{2}} = C,

say.

By the Corollary to Proposition 8.32 there is a unique z_{0} ∈ F such that

j(z_{0}) = C.

Let

Λ_{0} = ⟨1, z_{0}⟩;

and let

E(ℂ) : y^{2} = x^{3} + b_{0}x + c_{0}

be the elliptic curve associated to Λ_{0}. Then

\frac{b_{0}^{3}}{4b_{0}^{3} − 27c_{0}^{2}} = j(z_{0}) = C = \frac{b^{3}}{4b^{3} − 27c^{2}} .

We know that the denominators do not vanish, since the curves are nonsingular. Hence

b_{0} = 0 ⟺ b = 0.

Suppose for the moment this is not so. Then

\frac{4b_{0}^{3} − 27c_{0}^{2}}{b_{0}^{3}} = \frac{4b^{3} − 27c^{2}}{b^{3}} ⟹ \frac{c_{0}^{2}}{b_{0}^{3}} = \frac{c^{2}}{b^{3}} .

428–99 8–42 Evidently

c_{0} = 0 ⟺ c = 0.

Suppose this too is not so. Then

(\frac{b}{b_{0}} )^{3} = (\frac{c}{c_{0}} )^{2} .

Let

\frac{b}{b_{0}} = β, \frac{c}{c_{0}} = γ, ρ = \frac{γ}{β} .

Then γ^{2} = β^{3}, and so

ρ^{2} = \frac{γ^{2}}{β^{2}} = \frac{β^{3}}{β^{2}} = β,

ρ^{3} = \frac{γ^{3}}{β^{3}} = \frac{γ^{3}}{γ^{2}} = γ.

Thus

b = ρ^{2}b_{0}, c = ρ^{3}c_{0}.

Let s^{2} = ρ. Then

b = s^{4}b_{0}, c = s^{6}c_{0}.

It follows that the given curve is defined by the lattice

Λ = sΛ_{0} = ⟨s, sz_{0}⟩.

If b_{0} = b = 0 then the two curves are

y^{2} = x^{3} + c_{0}, y^{2} = x^{3} + c.

The transformation

x → s^{2}x, y → s^{3}y

will take the first curve into the second provided we choose s so that

c = s^{6}c_{0}.

Similarly, if c_{0} = c = 0 then the curves are

y^{2} = x^{3} + b_{0}x, y^{2} = x^{3} + bx,

and the transformation will take the first curve into the second provided we choose s so that

b = s^{4}4_{0}.

428–99 8–43 Now suppose the given curve E is also defined by the lattice

Λ′ = ⟨λ′, μ′⟩ = μ′⟨1, λ′/μ′⟩ = μ⟨1, z′⟩,

where z′ = λ′/μ′. Then

j(z′) = J(Λ′) = 2^{2}3^{3}5^{3} \frac{b^{3}}{2^{2}b^{3} − 3^{3}c^{2}} = J(Λ) = j(z_{0}).

Hence, by Proposition 8.32,

z = gz

for some g ∈ G, say the transformation

gz = \frac{az + b}{cz + d}.

It follows that the lattices

⟨1, z⟩, ⟨1, z_{0}⟩

are the same, and so the lattices Λ′, Λ are similar, say

Λ′ = sΛ.

But then

s^{b}b = b, s^{6}c = c.

If b, c ≠ 0 this implies that s^{2} = 1, so that s = ±1 and the lattices are the same.

If b = 0 then

s = ±1, ±ω, ±ω^{2}.

But

j(z) = 0 ⟹ z = gω.

Thus the lattice is similar to

Λ_{0} = {m + nω : m, n ∈ ℤ},

and it is readily verified that

ωΛ_{0} = Λ_{0}, −ω^{2}Λ_{0} = Λ_{0},

so again the lattice is unique.

Similarly if c = 0 then

G_{3}(z_{0}) = 0 ⟹ z_{0} = i,

428–99 8–44 so that the lattice is similar to

Λ_{0} = {m + ni : m, n ∈ ℤ},

which again is invariant under the transformations given by s = ±i. ◀

Remark: We call j(z_{0}) = J(Λ) the j-invariant of the corresponding elliptic curve

y^{2} = x^{3} − 15g_{2}x − 35g_{x}.

We can extend the definition to all Weierstrassian curves

E(k) : y^{2} + c_{1}xy + c_{3}y = x^{3} + c_{2}x^{2} + c_{4}x + c_{6}

over all fields k, by exactly the same method by which we extended the definition of the discriminant Δ(E) to all such curves.

The j-invariant turns out to have an important rôle in the classification of elliptic curves over a general field k. But that is another story.

428–99 8–45

Mordell’s Theorem

9.1 The Theorem

Our aim in this Chapter is to prove Mordell’s Theorem, the central result on the arithmetic of elliptic curves.

Theorem 9.1 (Mordell) The abelian group on the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx + c.

is finitely-generated.

In fact we shall find that we have to consider the more general case of an elliptic curve over a number field K (rather than ℚ). This is because our proof requires that the polynomial

f(x) ≡ x^{3} + ax^{2} + bx + c ≡ (x − α)(x − β)(x − γ)

should factorise completely in K, ie that α, β, γ ∈ K.

If f(x) already factorises in ℚ then there is no need to introduce number fields. It is interesting to observe that this is the case with Wiles’ proof of Fermat’s Last Theorem, which (as we have noted) associates to the solution

A^{n} + B^{n} = C^{n}

of Fermat’s Last Theorem the elliptic curve

y^{2} = x(x − A^{n})(x + B^{n})

with discriminant

Δ = (ABC)^{2n} :

the point being that the discriminant has — in relation to its size — a large number of small factors, which (Wiles shows) leads to a contradiction.

428–99 9–1

9.2 The Idea of the Proof

Suppose E(ℚ) is finitely-generated. Then the group

\frac{E(ℚ)}{2E(ℚ)}

is finitely-generated, and so is finite. More precisely, we have the following result.

Proposition 9.1 Suppose A is a finitely-generated abelian group, say

A = F ⊕ rℤ = F ⊕ \underbrace{ℤ ⊕ ⋯ ⊕ ℤ}_{r summands}

where F is finite and r = rank(A). Suppose there are 2^{s} elements of order dividing 2 in A. Then

A/2A = (r + s)(ℤ/(2)) = \underbrace{ℤ/(2) ⊕ ⋯ ⊕ ℤ/(2)}_{r + s summands} .

Proof ▶ It is a readily verified that

B = C ⊕ D ⟹ B/2B = C/2C ⊕ D/2D.

It follows that

A/2A = F/2F ⊕ ℤ/(2) ⊕ ⋯ ⊕ ℤ/(2),

each direct summand ℤ in A contributing one copy of ℤ/(2). It remains to determine F/2F.

Consider the homomorphism

ϕ : F → F : x ↦ 2x.

By the First Isomorphism Theorem,

\frac{F}{2F} = \frac{F}{im ϕ} ≅ ker ϕ = \{x ∈ F : 2x = 0\}.

Thus 2^{s} is just the number of elements in F of order dividing 2. Since every element in A of finite order is in F, the result follows. ◀

It follows from this Proposition that

E(ℚ) finitely-generated ⟹ E(ℚ)/2E(ℚ) finite;

428–99 9–2 and moreover,

∥E(ℚ)/2E(ℚ)∥ = 2^{r+s}.

where r is the rank of E(ℚ) and s = 0, 1 or 2 according as the cubic f(x) has 0,1 or 3 roots in ℚ.

The converse, unfortunately, is not true: an abelian group A may have A/2A finite without A being finitely-generated. For example,

ℚ/2ℚ = 0,

since every rational is expressible as twice another rational; but ℚ is not finitely-generated as an abelian group.

So the condition (that E/2E be finite) is necessary but not sufficient. However, it allows us to start a process of “infinite descent”, as follows.

Let the points E_{1}, …, E_{m} be representatives of the cosets in E/2E; and suppose P ∈ E. Then

P − E_{i} ∈ 2E

for some i, say

P − E_{i_{0}} = 2P_{1}.

We can apply the same argument to P_{1}:

P_{1} − E_{i_{1}} = 2P_{2};

and we can continue in this way

P_{2} − E_{i_{2}} = 2P_{3},
P_{3} − E_{i_{3}} = 2P_{4}.
…

We expect the points P_{1}, P_{2}, … defined in this way by successive ‘halving’ to descend the curve in some sense. But what exactly do we mean by ‘descend’? When infinite descent is applied to integral solutions of an equation, the meaning is clear: the coordinates become smaller. But we are dealing with rational points. We need some notion of the simplicity of a rational number q = m/n. We therefore define the height of q ∈ ℚ to be

H(q) = max(|m|, |n|),

if q = m/n in its lowest terms. Now our task is clear; we have to show that the points P_{1}, P_{2}, … are descending in the sense that the heights of their coordinates are decreasing.

Actually, we shall find it sufficient, and much simpler, to consider the x-coordinate.

Thus the proof has 2 quite separate parts, which we might call the algebraic or group-theoretic part, and the topological or valuation-theoretic part.

428–99 9–3

9.3 When can a Point be ‘Halved’?

Recall our mammoth formula for the ‘double’ of a point X, Y) ∈ E:

2(X, Y) = (\frac{X^{4} − 2bX^{2} − 8cX + b^{2} − 4ac}{4Y^{2}},

\frac{X^{6} + 2aX^{5} + 5bX^{4} + 20cX^{3} + (8a^{2}c − 2ab^{2} − 4bc)X + b^{3} − 4abc + 8c^{2}}{8Y^{3}} ) .

If c = 0 we may observe that the x-coordinate is a perfect square

(\frac{X^{2} − b}{2Y})^{2} .

At first sight this seems a pure fluke. But it turns out to be the hinge of our argument.

Suppose the line

y = mx + d

meets E in the 3 points

P = (x_{1}, y_{1}), Q = (x_{2}, y_{2}), R = (x_{3}, y_{3}).

Then x_{1}, x_{2}, x_{3} are the roots of the cubic

(mx + d)^{2} = x^{3} + ax^{2} + bx + c.

It follows that

x_{1} + x_{2} + x_{3} = m^{2} − a,
x_{2}x_{3} + x_{3}x_{1} + x_{1}x_{2} = b − 2md,
x_{1}x_{2}x_{3} = d^{2} − c.

The last of these equations is the one that concerns us now. Suppose again that c = 0. Then the equation becomes

x_{1}x_{2}x_{3} = d^{2}.

This has a homomorphic air about it:

P + Q + R = 0 ⟹ x_{1}x_{2}x_{3} = d^{2}.

In particular we recover the ‘fluke’ above; if we take Q = R, so that P +2Q = 0, then we see that

x_{1}x_{2}^{2} = d^{2}.

428–99 9–4 Remembering that P and −P have the same x-coordinate, it follows that if P = 2Q then the x-coordinate of P is a square.

This was on the assumption that c = 0. Geometrically, this means that (0, 0) ∈ E. Now (0, 0) is a point of order 2. But any point (α, 0) ∈ E of order 2 can be brought to (0, 0) by the coordinate-change x ↦ x − α.

Thus the only assumption we are making is that E(K) possesses a point of order 2. In fact, returning to the original coordinates, we can express the result as follows: Suppose (α, 0) ∈ E, where α is a root of

f(x) = x^{3} + ax^{2} + bx + c.

Then

P = (X, Y) ∈ 2E(K) ⟹ X − α = θ^{2}

in K.

But there is nothing special about the root α. Suppose now that all 3 roots α, β, γ ∈ K. Then our argument shows that

P = (X, Y) ∈ 2E(K) ⟹ X − α, X − β, X − γ ∈ K^{2},

that is,

X − α = α′^{2}, X − β = β′^{2}, X − γ = γ′^{2},

where α′, β′, γ′ ∈ K.

This brings us to the main result in the algebraic half of the proof of Mordell’s Theorem.

Proposition 9.2 Suppose

E(K) : y^{2} = x^{3} + ax^{2} + bx + c

is an elliptic curve over the number field K; and suppose

f(x) = x^{3} + ax^{2} + bx + c

has roots α, β, γ ∈ K. Then

P = (X, Y) ∈ 2E(K) ⟺ X − α, X − β, X − γ ∈ K^{2}.

Remark: Note that any 2 of these conditions implies the third, since

Y^{2} = (X − α)(X − β)(X − γ).

428–99 9–5 Proof ▶ To simplify the presentation, let us make the coordinate-change x ↦ x − X. (This is not the same as the earlier coordinate-change making c = 0.) The given point P is now (0, Y), and we have to show that

P = (0, Y) ∈ 2E(K) ⟺ −α, −β, −γ ∈ K^{2},

say

α = −α′^{2}, β = −β′^{2}, γ = −γ′^{2},

where α′, β′, γ′ ∈ K.

(We have already seen that this condition is necessary. Our argument will re-prove that, and show that the condition is also sufficient.)

By definition, P = 2Q if the tangent to E at −Q passes through P. Let us therefore determine all the tangents that can be drawn from P to E.

The general line through P = (0, Y) is

y = mx + Y.

This meets E where

(mx + Y)^{2} = x^{3} + ax^{2} + bx + c.

We know that one root of this is x = 0 since P = (0, Y) ∈ E. In other words,

Y^{2} = c.

The other 2 roots of the equation satisfy

x^{2} + (a − m^{2})x + (b − 2mY) = 0.

The line will be a tangent if this quadratic has coincident roots. The condition for this is that

(a − m^{2})^{2} = 4(b − 2mY).

This is a quartic for m; so in general 4 tangents can be drawn to E from any point P ∈ E.

It is easy to see why there are 4 tangents. Let

A = (α, 0), B = (β, 0), C = (γ, 0)

be the 3 points of order 2 on E. If P = 2Q is one ‘halving’ of P then there are 3 others:

P = 2(Q + A), P = 2(Q + B), P = 2(Q + C).

428–99 9–6 These give rise to the 4 tangents passing through P. In particular we see that if one tangent is defined over K then so are all 4. (Note that the tangents must be distinct, since A, B, C are distinct.) Thus if our quartic has one root in K then all its roots must lie in K.

We should say, that 4 tangents can be drawn over ℂ. For there is no reason to suppose that the roots of the quartic will lie in K. In fact, that is exactly what we have to determine.

For if Q ∈ E(K) then our line P Q is defined over K, and so m ∈ K. Conversely, if m ∈ K and the line is tangent to E then the point Q = (ξ, η)

at which it touches has coordinates in K. For the roots of our equation

(mx + Y)^{2} = x^{3} + ax^{2} + bx + c

are now 0, ξ, ξ, so that

2ξ = m^{2} − a ∈ K,

and then

η = mξ + Y ∈ K.

Thus P = 2Q if and only if there is a line through P touching E, and defined over K. In other words, P = 2Q if our quartic for m has a root in K.

Recall the classical technique for solving a quartic (or at least reducing it to a cubic): re-cast the quartic in the form

Q(x)^{2} = L(x)^{2},

where Q(x) is quadratic and L(x) is linear.

In our case this leads to the equation

(m^{2} − a + λ)^{2} = 2λm^{2} − 8mY + (λ^{2} − 2λa + 4b),

where we have to choose λ so that the quadratic form in m on the right is a perfect square.

The condition for this is that λ should satisfy the cubic

(4Y)^{2} = 2λ(λ^{2} − 2λa + 4b).

Recalling that Y^{2} = c, this simplifies to

λ^{3} − 2aλ^{2} + 4bλ − 8c = 0.

Miracle! This is almost our original cubic f(x) (in the equation y^{2} = f(x)). In fact the equation can be written

f(−λ/2) = 0.

428–99 9–7 It follows that its 3 solutions are

λ = −2α, −2β, −2γ.

We can take λ to have any of these values. Suppose we take

λ = −2α.

Then our quartic for m takes the form

(m^{2} − a + λ)^{2} = (2λ)(m − 2Y/λ)^{2}.

Thus if our quartic has a solution in K, which we know is the case if P = 2Q, then λ/2 = −α must be a square. Similarly, taking the other 2 values for λ, it follows that −β and −γ must also be squares:

−α = α′^{2}, −β = β′^{2}, −γ = γ′^{2}.

Conversely suppose that this is the case. Then we can take

λ = −2α = 4α′^{2},

and our quartic for m splits into 2 quadratics

m^{2} − a + λ = ±2α′(m − 4Y/λ).

Note that since α + β + γ = −a,

−a + λ = −α + β + γ
= α′^{2} − β′^{2} − γ′^{2}.

Furthermore

Y^{2} = c = −αβγ = α′^{2}β′^{2}γ′^{2},

so that

Y = ±α′β′γ′.

We can take the + sign without loss of generality, since the signs of α′, β′, γ′ were arbitrary anyway.

Thus our quadratics become

m^{2} + α′^{2} − β′^{2} − γ′^{2} = ±2(α′m − 2β′γ′).

In other words,

(m ± α′)^{2} = (β′ ± γ′)^{2}.

We conclude that the 4 tangents through P are y = mx + Y, where

m = α′ + β′ − γ′, α′ − β′ + γ′, −α′ + β′ − γ′, −α′ − β′ + γ′.

In particular, we see that if −α, −β, −γ are perfect squares in K then m ∈ K and P = 2Q. ◀

428–99 9–8

9.4 The 3 Homomorphisms

Recall that if

P = (x_{1}, y_{1}), Q = (x_{2}, y_{2}), R = (x_{3}, y_{3}) ∈ E(K)

are 3 points of

E(K) : y^{2} = x^{3} + ax^{2} + bx

then

P + Q + R = 0 ⟹ x_{1}x_{2}x_{3} ∈ K^{2}.

It would have been nicer if we could have said

P + Q + R = 0 ⟹ x_{1}x_{2}x_{3} ∈ (K^{×})^{2},

where K^{×} denotes the multiplicative group formed by the non-zero elements of K. For then we could say that

P + Q + R = 0 ⟹ x_{1}x_{2}x_{3} ≡ 1 mod (K^{×})^{2}.

which would suggest that we had a homomorphism

Θ : E(K) → K^{×}/(K^{×})^{2}.

Unfortunately, this breaks down if

x_{1}x_{2}x_{3} = 0,

ie one of x_{1}, x_{2}, x_{3} vanishes. This is the case if one or more of the points P, Q, R is equal to D = (0, 0).

Remarkably, the homomorphism can be rescued in this case. Recall that

x_{2}x_{3} + x_{3}x_{1} + x_{1}x_{2} = b − 2md.

In the case x_{1}x_{2}x_{3} = 0 we have m = 0. Let us suppose x_{1} = 0. Then

x_{2}x_{3} = b

Thus if we agree to map D onto b mod (K^{×})^{2} rather than 0 then we recover the homomorphic relation.

Proposition 9.3 Suppose E(K) is the elliptic curve

y^{2} = x^{3} + ax^{2} + bx + c.

428–99 9–9 Then the map

Θ : E(K) → K^{×}/(K^{×})^{2}

defined by

P ↦ \begin{cases}X & if P = (X, Y) ≠ (0, 0), \\ b & if P = (0, 0), \\ 1 & if P = 0 = [0, 1, 0] \end{cases}

is a homomorphism

Proof ▶ If P = (X, Y) then −P = (X, −Y). Thus

P + Q = 0 ⟹ Θ(P)Θ(Q) = 1

in all cases.

It is sufficient therefore to show that

P + Q + R = 0 ⟹ Θ(P)Θ(Q)Θ(R) = 1

in all cases. We know that this holds if none of P, Q, R is 0 or D. If one is 0 then the result reduces to the case P + Q = 0. It two of P, Q, R are D then the third is 0, so that case has been dealt with.

It only remains to consider the case where just one is D, say P = D, and Q, R ≠ 0. But we have seen that in this case

x_{2}x_{3} = b,

and so

Θ(Q)Θ(R) = b.

Thus, since Θ(D) = b,

Θ(P)Θ(Q)Θ(R) = b^{2} = 1

in K^{×}/(K^{×})^{2}. ◀

We were assuming in this Proposition that c = 0. To convert back to the general case, we note that if α is a root of f(x) then the coordinate-change x ↦ x − α takes f(x) into x^{3} + a′x^{2} + b′x, where

a′ = a + 3α, b′ = b + 3α^{2} + 2aα.

Corollary 13 Suppose E(K) is the elliptic curve

y^{2} = x^{3} + ax^{2} + bx + c;

428–99 9–10 and suppose

A = (α, 0)

is a point of order 2 on E(K). Then the map

Θ_{α} : E(K) → K^{×}/(K^{×})^{2}

defined by

P ↦ \begin{cases}X − α & if P = (X, Y) ≠ A, \\ 3α^{2} + 2aα + b & if P = A, \\ 1 & if P = 0 = [0, 1, 0], \end{cases}

is a homomorphism.

Note that we have 3 homomorphisms, corresponding to the 3 roots α, β, γ of f(x). We can re-state Proposition 9.2 as follows.

Proposition 9.4 Suppose

E(K) : y^{2} = x^{3} + ax^{2} + bx + c

is an elliptic curve over the number field K; and suppose

f(x) = x^{3} + ax^{2} + bx + c

has roots α, β, γ ∈ K. Then

2E(K) = ker Θ_{α} ∩ ker Θ_{β} ∩ ker Θ_{γ}.

Remark: As we noted earlier,

ker Θ_{α} ⊂ ker Θ_{β} ∩ ker Θ_{γ},

and similarly for the other 2 kernels — each is contained in the intersection of the other two. Thus

2E(K) = ker Θ_{α} ∩ ker Θ_{β} = ker Θ_{α} ∩ ker Θ_{γ} = ker Θ_{α} ∩ ker Θ_{β}.

Corollary 14 E/2E is finite if and only if im Θ_{α}, im Θ_{β}, im Θ_{γ} are all finite.

428–99 9–11 Proof ▶ By the Proposition (and the following Remark),

2E = ker Θ_{α} ∩ ker Θ_{β} ∩ ker Θ_{γ}
= ker Θ_{α} ∩ ker Θ_{β}
= ker Θ_{α} ∩ ker Θ_{γ}
= ker Θ_{β} ∩ ker Θ_{γ}

Lemma 8 Suppose B, C are subgroups of the group A. Then

\frac{A}{B ∩ C}

is finite if and only if

\frac{A}{B} , \frac{A}{C},

are finite; and then

∥\frac{A}{B ∩ C} ∥ ≤ ∥\frac{A}{B} ∥ \frac{A}{C}∥.

Proof of Lemma ▷ We have

∥A/B ∩ C∥ = ∥A/B∥ ∥B/B ∩ C∥.

Let Φ be the canonical surjective homomorphism

Φ : A → A/C.

If Φ_{B} is the restriction of Φ to B, then

ker Φ_{B} = B ∩ C.

It follows from the First Isomorphism Theorem that

B/B ∩ C ≅ im Φ_{B} ⊂ A/C.

Hence

∥B/B ∩ C∥ ≤ ∥A/C∥,

and the result follows. ◁

Applying the Lemma with B = ker Θ_{α}, C = ker Θ_{β} we deduce that E/2E is finite if and only if

E/ ker Θ_{α} ≅ im Θ_{α} and E/ ker Θ_{β} ≅ im Θ_{β}

are both finite; and the same is true if α, β are replaced by α, γ or β, γ. ◀

428–99 9–12

9.5 The Finiteness of the Images

We have to prove that im Θ_{α}, im Θ_{β}, im Θ_{γ} (or at least two of them) are finite. It is sufficient to prove the result for one of them; and we can again suppose for simplicity that c = 0.

Proposition 9.5 Let E be the curve

E(K) : y^{2} = x^{3} + ax^{2} + bx

where b, c are algebraic integers in K. Let Θ be the homomorphism

E → K^{×}/(K^{×})^{2} : P ↦ \begin{cases}X & if P = (X, Y) ≠ (0, 0), \\ b & if P = (0, 0), \\ 1 & if P = 0 = [0, 1, 0] \end{cases}

Then im Θ is finite.

Proof ▶ Suppose

P = (x, y) ∈ E,

where y ≠ 0.

Lemma 9 Suppose 𝔭 is a prime ideal in K such that

𝔭 |̸ b.

Then 𝔭 appears to an even power in x:

𝔭^{2e} || x.

Proof of Lemma ▷ Suppose

p^{e} || x, p^{f} || y.

If e < 0 then the right-hand side is dominated by x^{3}, and so f < 0 and

2f = 3e.

On the other hand, if e > 0 then

𝔭 |̸ x^{2} + ax + b

since we are supposing that 𝔭 |̸ b. Thus

2f = e.

In either case (or if e = 0) e is even. ◁

428–99 9–13 Lemma 10 We can find a finite number of elements x_{1}, …, x_{r} ∈ K such that x̄_{k} ∈ im Θ, and for each x with x̄ ∈ im Θ we have

⟨xx_{k}^{−1}⟩ = 𝔞^{2}

for some k ∈ {1, …, r}.

Proof of Lemma ▷ By the last Lemme, the only prime ideals 𝔭 appearing

to an odd power in x are the finite number dividing b. Suppose these prime ideals are 𝔭_{1}, …, 𝔭_{s}. Consider the 2^{s} ideals

𝔭_{1}^{e_{1}} ⋯ 𝔭_{r}^{e_{r}} (e_{1}, …, e_{r} ∈ {0, 1}),

say

𝔞_{1}, …, 𝔞_{2^{s}}.

According to the last Lemma, if x̄ ∈ im Θ then

⟨x⟩ = 𝔞_{k}𝔟^{2}

for some k ∈ {1, …, s}.

If such an x exists for the ideal 𝔞_{k} let us choose one, say x_{k}:

⟨x_{k}⟩ = 𝔞_{k}𝔟^{2}.

If no such element exists let x_{k} = 1.

Then we see that if

⟨x⟩ = 𝔞_{k}𝔟^{2}

then

⟨xx_{k}^{−1}⟩ = 𝔟^{2}.

◁

If we are working over ℚ it follows that

xx_{k}^{−1} = ±X^{2},

and so

x ≡ ±x_{k} mod (K^{×})^{2}

for some k. Hence

im Θ = {±x_{1}, …, ±x_{r}}.

Thus im Θ is finite, and so the result is established: E(ℚ)/2E(ℚ) is finite. For a general number field K we have a little more work to do.

428–99 9–14 Let

S = ⟨x̄_{1}, …, x̄_{r}⟩

be the subgroup of K^{×}/(K^{×})^{2} generated by x̄_{1}, …, x̄_{r}. This subgroup is finite, since each element of K^{×}/(K^{×})^{2} has order 2.

Let T be the subgroup of K^{×}/(K^{×})^{2}

T = {x̄ ∈ im Θ : ⟨x⟩ = 𝔞^{2}}.

Then the last Lemma can be re-stated in the form

im Θ ⊂ ST.

Lemma 11 Suppose S, T are 2 finite subgroups of the abelian group G. Then ST is finite; and in fact

∥ST ∥ divides ∥S∥ ∥T ∥.

Proof of Lemma ▷ We have

∥ST ∥ = ∥ST/T ∥ ∥T ∥.

Let Φ be the canonical surjective homomorphism

Φ : G → G/T.

If Φ_{S} is the restriction of Φ to S, then

ker Φ_{S} = S ∩ T, im Φ_{S} = ST/T.

It follows from the First Isomorphism Theorem that

ST/T ≅ S/S ∩ T,

and so

∥ST/T ∥ divides ∥S∥.

◁

Corollary 15 The group im Θ is finite if and only if T is finite.

Recall that T is the subgroup of im Θ formed by those x̄ with x expressible in the form x = 𝔞^{2}. Our next Lemma shows that the set of all such x̄ (not just those in im Θ is finite.

428–99 9–15 Lemma 12 Let

S = {x ∈ K^{×} : ⟨x⟩ = 𝔞^{2}}.

Then S ⊃ (K^{×})^{2}; and the quotient-group

S/(K^{×})^{2}

is finite.

Proof of Lemma ▷ It is evident that S ⊃ (K^{×})^{2}, since

⟨x^{2}⟩ = ⟨x⟩^{2}.

By the finiteness of the class number we can find a finite number of ideals 𝔞_{1}, …, 𝔞_{h} such that for any ideal 𝔞 one of the ideals 𝔞𝔞_{i} is principal, say

𝔞𝔞_{i} = ⟨a⟩.

Now suppose x ∈ S, say

⟨x⟩ = 𝔞^{2}.

Then

𝔞 = 𝔞_{i}⟨a⟩

for some i, and so

⟨x⟩ = 𝔞_{i}^{2}⟨a^{2}⟩.

It follows that

𝔞_{i}^{2} = ⟨xa^{−2}⟩ = ⟨a_{i}⟩,

say, for some a_{i} ∈ K^{×}. For each 𝔞_{i}(1 ≤ i ≤ h) let us choose such an a_{i} if 𝔞_{i}^{2} is principal; otherwise let us set a_{i} = 1.

Now

⟨x⟩ = ⟨a_{i}a^{2}⟩.

In other words

x = ϵa_{i}a^{2},

where ϵ ∈ U(K) is a unit in K.

By Dirichlet’s Units Theorem, the group U(K) of units in K is finitelygenerated, say

U(K) = ⟨ϵ_{1}, …, ϵ_{m}⟩.

Then

ϵ = ϵ_{1}^{e_{1}} ⋯ ϵ_{m}^{e_{m}} (e_{1}, …, e_{m} ∈ ℤ).

428–99 9–16 It follows that

ϵ = ϵ_{1}^{e_{1}} ⋯ ϵ_{m}^{e_{m}}η^{2} (e_{1}, …, e_{m} ∈ {0, 1}),

where η ∈ U(K).

Putting all this together, we have

x = ϵ_{1}^{e_{1}} ⋯ ϵ_{m}^{e_{m}}a_{i}(aη)^{2}

In other words,

x ≡ ϵ_{1}^{e_{1}} ⋯ ϵ_{m}^{e_{m}}a_{i} mod (K^{×})^{2}.

There are only a finite number of elements ϵ_{1}^{e_{1}} ⋯ ϵ_{m}^{e_{m}}a_{i}. We conclude that the quotient-group

S/(K^{×})^{2}

is finite. ◁

Since

T ⊂ S/(K^{×})^{2}

it follows that T is finite. Hence

im Θ = ST

is finite. ◀

Corollary 16 E(K)/2E(K) is finite.

Corollary 17 If E(ℚ) is the elliptic curve

y^{2} = x^{3} + ax^{2} + bx + c (a, b, c ∈ ℚ)

then

E(ℚ)/2E(ℚ)

is finite.

9.6 The Height of a Point

We have shown that E(ℚ)/2E(ℚ) is finite, say

E/2E = {Ē_{1}, …, Ē_{n}},

where E_{1}, …, E_{m} ∈ E.

Recall our “plan for infinite descent”. Suppose P ∈ E. Then

P − E ∈ 2E

428–99 9–17 for some E ∈ {E_{1}, …, E_{m}}, say

P − E_{i_{0}} = 2P_{1}.

Then similarly

P_{1} − E_{i_{1}} = 2P_{2}
P_{2} − E_{i_{2}} = 2P_{3}
…

The points P = P_{0}, P_{1}, P_{2}, ⋯ ∈ E(ℚ) — derived by repeated halving — represent our infinite descent. But in what sense are they descending? We need some notion of the ‘height’ of a point on E.

Definition 9.1 Suppose q ∈ ℚ. Let

q = \frac{m}{n}

in lowest terms. Then we set

H(q) = max(|m|, |n|), h(q) = log H(q).

Lemma 13 Suppose x_{1}, x_{2} ∈ ℚ. Then

h(x_{1}x_{2}) ≤ h(x_{1}) + h(x_{2}), h(x_{1}^{n}) = nh(x_{1}), h(x_{1} + x_{2}) ≤ h(x_{1}) + h(x_{2}) + log 2.

Also, if x_{1} ≠ 0,

h(x^{−1}) = h(x).

Proof of Lemma ▷ Suppose x_{1} = m_{1}/n_{1}, x_{2} = m_{2}/n_{2}. Then

x_{1}x_{2} = \frac{m_{1}m_{2}}{n_{1}n_{2}} , x_{1}^{n} = \frac{m_{1}^{n}}{n_{1}^{n}} , x_{1} + x_{2} = \frac{m_{1}n_{2} + m_{2}n_{1}}{n_{1}n_{2}} , x_{1}^{−1} = \frac{n_{1}}{m_{1}} .

The result follows at once. ◁

If n_{1} and n_{2} have a large common factor — which will usually be the case for us — the result for x_{1} + x_{2} can be greatly improved, as the following result illustrates.

Lemma 14 Suppose

X = \frac{f(x)}{g(x)},

where f(x) and g(x) are polynomials of degrees d and e. Then

h(X) ≤ max(d, e)h(x) + C,

for some constant C.

428–99 9–18 Proof of Lemma ▷ We can assume that d = e. For suppose d < e. Then we

can replace f(x) by f(x) + g(x). This replaces X by X + 1; but that does not affect the result, since

h(X) − C ≤ h(X) ≤ h(X) + C

from the estimate in the last Lemma for h(x_{1} + x_{2}). If e < d we can apply the same argument after replacing X by X^{−1}.

We may also assume that the coefficients of f(x), g(x) are integral, say

f(x) = a_{0}x^{d} + a_{1}x^{d−1} + ⋯ + a_{d}, g(x) = b_{0}x^{d} + b_{1}x^{d−1} + ⋯ + b_{d},

where a_{i}, b_{j} ∈ ℤ. Then

X = \frac{a_{0}m^{d} + a_{1}m^{d−1}n + ⋯ + a_{d}n^{d}}{b_{0}m^{d} + b_{1}m^{d−1}n + ⋯ + b_{d}n^{d}}
= \frac{M}{N} ,

say. Thus

|M| ≤ (|a_{0}| + ⋯ |a_{d}|)H(x)^{d}, |N| ≤ (|b_{0}| + ⋯ |b_{d}|)H(x)^{d},

and so

h(X) ≤ dh(x) + C.

◁

We define the height of a point P = (x, y) to be the height of its xcoordinate.

Definition 9.2 Suppose P = (x, y) ∈ E(ℚ). Then we set

H(P) = H(x), h(P) = h(x).

We want to show that our infinite descent is descending in the sense that

h(P) > h(P_{1}) > h(P_{2}) > ⋯,

at least until we drop below a specified height.

This will be the conclusion of the following 3 Lemmas, concerning a given elliptic curve E(Q).

Lemma 15 For any constant C > 0, there are only a finite number of points P ∈ E(ℚ) with

h(P) ≤ C.

428–99 9–19 Proof of Lemma ▷ There are at most 4e^{2C} + 1 rationals with e(x) ≤ C,

since both denominator and numerator must be chosen from {−N, −N + 1, …, N − 1, N} where N = [e^{C}].

For each such x there are at most 2 values of y such that (x, y) ∈ E. ◁

Lemma 16 For each point P_{0} ∈ E there is a constant C = C(P_{0}) such that

h(P + P_{0}) ≤ 2h(P) + C.

Proof of Lemma ▷ Suppose

P + P_{0} + Q = 0,

ie the line P, P_{0} meets E again at Q.

If P = (x, y) then −P = (x, −y). Hence

h(−P) = h(P).

Thus it is sufficient to prove the result with Q in place of P + P_{0}.

Let

P = (x, y), P_{0} = (x_{0}, y_{0}), Q = (X, Y).

Suppose the equation of the line P P_{0}

y = mx + d.

Then

m = \frac{y − y_{0}}{x − x_{0}} .

The line meets the curve where

(mx + d)^{2} = x^{3} + ax^{2} + bx + c.

Hence

x + x_{0} + X = m^{2} − a.

Thus

X = \frac{(y − y_{0})^{2} − (x + x_{0} + a)(x − x_{0})^{2}}{(x − x_{0})^{2}}
= \frac{y^{2} − 2y_{0}y + y_{0}^{2} − x^{3} − ax^{2} + 2x_{0}x^{2} − 2ax_{0}x − 3x_{0}^{2}x − ax_{0}^{2} − x_{0}^{3}}{(x − x_{0})^{2}}
= \frac{−2y_{0}y + 2x_{0}x^{2} + (b − 2ax_{0} − 3x_{0}^{2})x + (c + y_{0}^{2} − ax_{0}^{2} − x_{0}^{3}}{(x − x_{0})^{2}} ,

428–99 9–20 since y^{2} = x^{3} + ax^{2} + bx + c.

The point is that

X = \frac{Ay + Bx^{2} + Cx + D}{Ex^{2} + F x + G}

for some integers A, B, C, D, E, F depending only on P_{0}. If x = m/n then

y^{2} = \frac{m^{3} + am^{2}n + bmn^{2} + cn^{3}}{n^{3}} .

Thus

n^{4}y^{2} = m^{3}n + am^{2}n^{2} + bmn^{3} + cn^{4}.

It follows that n^{2}y ∈ ℤ and

|n^{2}y| ≤ (1 + |a| + |b| + |c|)^{1/2}H(x)^{2}.

This allows us to apply the argument in the proof of the last Lemma. We have

X = \frac{An^{2}y + Bm^{2} + Cmn + Dn^{2}}{Em^{2} + F mn + Gn^{2}}
= \frac{M}{N} ,

where

M ≤ (|A|(1 + |a| + |b| + |c|)^{1/2} + |B| + |C| + |D|) H(x)^{2}
B ≤ (|E| + |F | + |G|)H(x)^{2}.

It follows that

H(X) ≤ CH(x)^{2}.

from which the result follows. ◁

Lemma 17 There is a constant C such that

h(2P) ≥ 4h(P) − C

for all P ∈ E.

428–99 9–21 Proof of Lemma ▷ Suppose P = (x, y), 2P = (X, Y). Let the tangent at P

be

y = mx + d.

If the elliptic curve E(ℚ) has equation

y^{2} = x^{3} + ax^{2} + bx + c

then

2y \frac{dy}{dx} = 3x^{2} + 2ax + b = f′(x),

and so

m = \frac{f′(x)}{2y}.

The tangent meets E where

(mx + d)^{2} = x^{3} + ax^{2} + bx + c.

This has roots x, x, X. Hence

2x + X = m^{2} − x;

and so

X = m^{2} − a − 2x
= \frac{f′(x)^{2} − (a + 2x)4y^{2}}{4y^{2}}
= \frac{f′(x)^{2} − 4(a + 2x)f(x)^{2}}{4f(x)^{2}} .

It follows from Lemma 14 that

h(x) ≤ 4h(x) + C.

But we want a result in the opposite direction!

The essential point is that the numerator and denominator of X have no factor in common, as polynomials:

gcd(f′(x)^{2} − 4(a + 2x)f(x)^{2}, 4f(x)^{2}) = gcd(f′(x)^{2}, f(x)) = 1,

since gcd(f′(x), f(x)) = 1.

428–99 9–22 Sublemma Suppose

X = \frac{f(x)}{g(x)},

where f(x), g(x) are polynomials of degrees d, e, with gcd(f(x), g(x)) = 1. Then

h(X) ≥ max(d, e)h(x) − C

for some constant C.

Proof of Lemma ▷ We may suppose that d = e, on replacing f(x) or g(x) by

f(x) + g(x), if necessary.

We may also assume that the coefficients of f(x), g(x) are integral, say

f(x) = a_{0}x^{d} + a_{1}x^{d−1} + ⋯ + a_{d}, g(x) = b_{0}x^{d} + b_{1}x^{d−1} + ⋯ + b_{d},

where a_{i}, b_{j} ∈ ℤ.

Let F (x, z), G(x, z) be the corresponding homogeneous forms, ie

F (x, z) = a_{0}x^{d} + a_{1}x^{d−1}z + ⋯ + a_{d}z^{d}, G(x, z) = b_{0}x^{d} + b_{1}x^{d−1}z + ⋯ + b_{d}z^{d}.

If x = m/n then

X = \frac{F (m, n)}{G(m, n)}.

We have to show that this is almost in its lowest terms.

Since gcd(f(x), g(x)) = 1, we can find polynomials u(x), v(x) ∈ ℚ[x] such that

u(x)f(x) + v(x)g(x) = 1.

On ‘multiplying out’ the denominators of the coefficients, and passing to the homogeneous forms, we obtain polynomials U(x, z), V (x, z) ∈ ℤ[x, z] such that

U(x, z)F (x, z) + V (x, z)G(x, z) = Az^{N}

where A is a non-zero integer, and N ∈ ℕ.

In particular,

U(m, n)F (m, n) + V (m, n)G(m, n) = An^{N}

It follows that

gcd(F (m, n), G(m, n)) | An^{N}.

On the other hand

gcd(F (m, n), n) | a_{0}m^{d}.

428–99 9–23 Since gcd(m, n) = 1 this implies that

gcd(F (m, n), n) | a_{0}.

It follows that

gcd(F (m, n), n^{N}) | a_{0}^{N},

and so

gcd(F (m, n), An^{N}) | Aa_{0}^{N}.

Hence

gcd(F (m, n), G(m, n)) | Aa_{0}^{N}.

We are nearly there. We have shown that

X = \frac{F (m, n)}{G(m, n)} = \frac{M}{N} ,

say, is almost in its lowest terms. It only remains to show that the numerator or denominator is of the correct order of magnitude. This is ‘trivial but not obvious’.

Let

M(x) = max(|f(x)|, |g(x)|).

Since

\frac{f(x)}{x^{d}} → a_{0} as x → ∞

there exist constants C_{1} > 0, C_{2} > 0 such that

M(x) ≥ C_{1}|x|^{d}

for |x| ≥ C_{2}.

On the other hand, since f(x), g(x) have no root in common, there is a constant C_{3} > 0 such that

M(x) ≥ C_{3}

for |x| ≤ C_{2}. It follows that

M(x) ≥ (C_{3}C_{2}^{−d})|x|^{d}

for |x| ≤ C_{2}.

Putting these together,

M(x) ≥ C_{4}|x|^{d}

428–99 9–24 for all x, with C_{4} = min(C_{1}, C_{3}C_{2}^{−d}). On setting x = m/n, and multiplying out, this gives

max(M, N) = max(F (m, n), G(m, n)) ≥ C_{4}|m|^{d}.

By the same argument

M(x) ≥ C_{5}

for all x, where C_{5} = min(C_{1}C_{2}^{d}, C_{3}) > 0. This gives

max(M, N) ≥ C_{5}|n|^{d}.

We conclude that

max(M, N) ≥ C_{6}H(x)^{d},

with C_{6} = min(C_{4}, C_{5}). Since we know that

gcd(M, N) ≤ Aa_{0}^{N},

we conclude that if

X = \frac{M′}{N′}

in its lowest terms then

H(X) = min(|M′|, |N′|) ≥ C_{7}H(x)^{d},

with C_{7} = C_{6}/(Aa_{0}^{N}) > 0; and so finally,

h(X) ≥ dh(x) − C.

◁

In particular, applying this to our formula for 2P, we have shown that

h(2P) ≥ 4h(P) − C.

◁

9.7 Putting It All Together

Recall that each step of our infinite descent is of the form

P_{i} − E_{j} = 2P_{i+1},

where E_{j} is one of a fixed (and finite) set of points E_{1}, …, E_{m}. By Lemma 17,

h(P_{i} − E_{j}) ≥ 4h(P_{i+1}) − c_{1}.

428–99 9–25 But by Lemma 16 (and the fact that h(−P) = h(P)),

h(P_{i} − E_{j}) ≤ 2h(P) + c_{2}.

Combining these,

2h(P_{i}) + c_{2} ≥ 4h(P_{i+1}) − c_{1}.

Hence

h(P_{i+1}) ≤ \frac{1}{2}h(P_{i}) + c_{3}

with c_{3} = (c_{1} + c_{2})/4.

We have shown therefore that

h(P_{i}) > C ⟹ h(P_{i+1}) < h(P_{i}),

for some constant C > 0. Let the points of E with h(P) ≤ C be

P_{1}, …, P_{n}.

Our infinite descent must lead to one of these points. We see therefore that for any point P ∈ E is expressible in the form

P = u_{1}E_{1} + ⋯ + u_{m}E_{m} + P_{i},

where u_{1}, …, u_{r} ∈ ℕ.

We conclude that E(ℚ) is generated by the points E_{1}, …, E_{m}, P_{1}, …, P_{n}.

428–99 9–26

9.8 The formula for rank(E)

Since we now know that E is finitely-generated, it follows from the Structure Theorem for Finitely Generated Abelian Groups that

E = ℤ ⊕ ⋯ ⊕ ℤ ⊕ ℤ/(p_{1}^{e_{1}}) ⊕ ⋯ ℤ/(p_{s}^{e_{s}}),

where there are r = rank(E) copies of ℤ.

Proposition 9.6 Let

d = \begin{cases}0 if there are 0 points of order 2 on E, \\ 1 if there is 1 point of order 2 on E, \\ 2 if there are 3 points of order 2 on E. \end{cases}

Then

∥E/2E∥ = 2^{s},

where

s = r + d.

Proof ▶ If

A = A_{1} ⊕ ⋯ ⊕ A_{m}

then

2A = 2A_{1} ⊕ ⋯ ⊕ 2A_{m}

and so

A/2A = A_{1}/2A_{1} ⊕ ⋯ ⊕ A_{m}/2A_{m}.

Thus it is sufficient to consider the factors of E.

Evidently the r copies of ℤ will give rise to r copies of ℤ/(2).

Lemma 18 If A = ℤ/(2^{e}) then

A/2A = ℤ/(2).

Proof of Lemma ▷ Let g be a generator of A, so that

A = {0, g, 2g, …, (2^{e} − 1)g}

Then

2A = {0, 2g, 4g, …, (2^{e} − 2)g}.

Thus half the elements of A are in 2A, and so A/2A is of order 2, ie A/2A = ℤ/(2). ◁

428–99 9–27 Lemma 19 If A = ℤ/(p^{e}), where p is odd,then

A/2A = 0.

Proof of Lemma ▷ Consider the map

θ : A → A : a ↦ 2a.

Then

ker θ = {a ∈ A : 2a = 0} = 0,

since by Lagrange’s Theorem there are no elements of order 2 in A. Hence θ is injective, and so surjective, ie 2A = A, and A/2A = 0. ◁

From the two Lemmas it follows that the number of copies of ℤ/(2) in

E/2E = ℤ/(2) + ⋯ + ℤ/(2)

is equal to r + f, where f is the number of factors of the form ℤ/(2^{e}). It remains to show that f = d.

Lemma 20 The number of elements of order 2 in A is 2^{f} − 1, where f is the number of factors of the form ℤ/(2^{e}).

Proof of Lemma ▷ An element of a direct sum

A = A_{1} ⊕ A_{2} ⊕ ⋯ ⊕ A_{m}

is of order 1 or 2 if and only if that is true of each component:

2(a_{1}, a_{2}, …, a_{m}) = 0 ⟺ 2a_{1} = 0, 2a_{2} = 0, …, 2a_{m} = 0.

But there is no element of order 2 in ℤ/(p^{e}) if p is odd, by Lagrange’s Theorem; while there is just one element of order 2 in ℤ/(2^{e}), nameley 2^{e−1} mod 2^{e}.

Thus we have two choices in each factor ℤ/(2^{e}), and one choice in each factor ℤ/(p^{e}) (p odd).

It follows that the number of elements of order 1 or 2 is 2^{f} where f is the number of factors of the form ℤ/(2^{e}); and so the number of elements of order 2 is 2^{f} − 1. ◁

◀

428–99 9–28

9.9 The square-free part

Each rational x ∈ ℚ^{×} is uniquely expressible in the form

x = dy^{2},

where y ∈ ℚ^{×} and d is a square-free integer. Explicitly, if

x = ±2^{e_{2}}3^{e_{3}}5^{e_{5}} ⋯

then

x = ±2^{ϵ_{2}}3^{ϵ_{3}}5^{ϵ_{5}} ⋯

where each ϵ_{p} ∈ {0, 1} is given by

ϵ_{p} ≡ e_{p} mod 2.

For example,

x = 2/3 ↦ d = 6, x = −3/4 ↦ −3.

We may call d the square-free part of x.

Thus each x̄ ∈ ℚ^{×}/ℚ^{×2} is represented by a unique square-free integer d, establishing an isomorphism

ℚ^{×}/ℚ^{×2} ⟷ D,

where D is the group formed by the square-free integers under multiplication modulo squares, eg

2 · 6 = 3, −3 · 6 = −2.

Let us see how to use this to compute the rank. Recall that

E/E^{2} ≅ im Θ

where

Θ = θ_{α} × θ_{β} × θ_{γ},

with θ_{α}, for example, given by

P = (x, y) ↦ \begin{cases}\overline{x − α} & if x ≠ α \\ p′(α) if x = α \end{cases}

If P = (x, y) is on the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx + c (a, b, c ∈ ℤ)

then

x = \frac{m}{t^{2}}, y = \frac{M}{t^{3}}

where m, M, t ∈ ℤ with gcd(m, t) = 1 = gcd(M, t) and t > 0.

428–99 9–29

9.10 An example

Consider the elliptic curve

E(ℚ) : y^{2} = x^{3} − x = x(x − 1)(x + 1).

Here

α = 0, β = 1, γ = −1,

so that p′(0) = (0−1)(0+1) = −1, p′(1) = (1−0)(1+1) = 2, p′(−1) = (−1−0)(−1−1) = 2. Thus, from above,

im Θ ⊂ S = {(d, e, f) : d | 1, e | 2, f | 2}.

This gives 32 choices:

d = ±1, e = ±1, ±2, f = ±1, ±2.

It follows (since 32 = 2^{5}) that

∥E/2E∥ ≤ 5,

and so

rank E ≤ 3.

However, we can restrict the range of im Θ much more than this. In the first place, since

x(x − 1)(x + 1) = y^{2},

it follows that def is a perfect square, say

def = g^{2}.

This implies firstly that def > 0, and secondly that each prime p dividing any of d, e, f must in fact divide just two of them. This reduces the number of cases to 8: (d, e, f) = (1, 1, 1), (1, −1, −1), (−1, 1, −1), (−1, −1, 1), (1, 2, 2), (1, −2, −2), (−1, 2, −2), (−1, −2, 2).

We can reduce the number still further by observing that since m = du^{2}, m − t^{2} = ev^{2}, m + t^{2} = fw^{2},

428–99 9–30 it follows that

d < 0 ⟹ m < 0 ⟹ m − t^{2} < 0 ⟹ e < 0,

while

d > 0 ⟹ m > 0 ⟹ m + t^{2} > 0 ⟹ f > 0.

This leaves just 4 choices for d, e, f:

(d, e, f) = (1, 1, 1), (−1, −1, 1), (1, 2, 2), (−1, −2, 2).

Thus

∥E/2E∥ ≤ 4

Since d = 2 (as there are 3 points of order 2),

∥E/2E∥ = 2^{r+d} ≥ 4.

We conclude that

rank E = 0.

9.11 Another example

Now let us consider the elliptic curve

y^{2} = x^{3} − x = x(x − 2)(x + 2).

Here

p′(0) = −4, p′(2) = 8, p′(−2) = 8,

and so

E/2E = im Θ ⊂ {(d, e, f) : d, e, f | 2}

The group on the right contains 2^{6} elements, since each of d, e, f can take the values ±1, ±2.

But as before, the condition

def = g^{2}

restricts the choice considerably. Firstly,

d < 0 ⟹ e < 0. d > 0 ⟹ f > 0.

428–99 9–31 Secondly, the factor 2 occurs in none, or just two, of d, e, f. This reduces the choice to

(d, e, f) = (1, 1, 1), (−1, −1, 1), (1, 2, 2), (−1, −2, 2), (2, 1, 2), (−2, −1, 2), (2, 2, 1), (−2, −2, 1).

Thus the rank is either 0 or 1. Can we reduce the choice further, and reduce the rank to 0? or conversely, can we find a point of infinite order on the curve, and so show that the rank is 1?

Note that it only necessary to eliminate one case; for we know that ∥E/2E∥ = 2^{s} ≥ 4, since there are 3 points of order 2 (and so d = 2).

Suppose

(d, e, f) = (−1, −1, 1).

In this case,

m = −u^{2}, m − 2t^{2} = −v^{2}, m + 2t^{2} = w^{2}.

Thus

u^{2} − v^{2} = 2t^{2} = u^{2} + w^{2}.

Now a^{2} ≡ 0 or 1 mod 4 according as a is even or odd. Since u^{2} − v^{2} is even it followu, v are both even or both odd; and in either case u^{2} − v^{2} ≡ 0 mod 4. So t is even, and therefore u, v must both be odd, since gcd(m, t) = 1 = gcd(m − 2t^{2}, t).

9.12 Third example

Consider the elliptic curve

E(ℚ) : y^{2} = x(x − 2)(x + 4) = x^{3} + 2x^{2} − 8x.

The point

P = (−1, 3) ∈ E.

(We chose α, β, γ to give this result.)

The slope at P is

\frac{dx}{dy} = \frac{3x^{2} + 4x − 8}{2y}

= −\frac{3}{2}

at P. It follows that P is of infinite order (since 2P has non-integral coordinates). Thus

r = rank(E) ≥ 1.

428–99 9–32 We have

p′(0) = −8, p′(2) = 12, p′(−4) = 24.

Thus

im Θ ⊂ S{(d, e, f) : d | 2, e | 6, f | 6; def = g^{2}}.

Note that any two of d, e, f determine the third since eg f = de (modulo squares).

If

P = (m/t^{2}, M/t^{3}) ↦ (d, e, f)

then

m = du^{2}, m − 2t^{2} = ev^{2}, m + 4t^{2} = fw^{2}.

Thus

d > 0 ⟹ m > 0 ⟹ f > 0 ⟹ e > 0,

while

d < 0 ⟹ m < 0 ⟹ e < 0 ⟹ f > 0.

(So f > 0 in all cases.)

It follows that

∥S∥ = 16,

with

S = {d = ±1, ±2, f = 1, 2, 3, 6}.

It follows that s ≤ 4, and so

rank(E) = s − d = s − 2 ≤ 2.

Thus rank(E) = 1 or 2.

In order to prove that rank(E) = 1 it is sufficient to show that one of the 16 elements of S does not lie in im Θ. For ∥S∥ is a power of 2, so if it is < 16 it must be ≤ 8.

Let us take the element (−1, −1, 1). Suppose this arises from a point P = (m/t^{2}, M/t^{3}), where for the moment we assume that P is not of order 2. Then

m = −u^{2}, m − 2t^{2} = −v^{2}, m + 4t^{2} = w^{2}.

Thus

2t^{2} = v^{2} − u^{2}, 4t^{2} = u^{2} + w^{2}.

From the second equation,

u^{2} + w^{2} ≡ 0 mod 4 ⟹ u, w even,

428–99 9–33 since a^{2} ≡ 0 or 1 mod 4 according as a is even or odd. It follows that t is odd, since

gcd(m, t) = 1 ⟹ gcd(u, t) = 1.

But then t^{2} ≡ 1 mod 4, and so

v^{2} − u^{2} ≡ 2 mod 4,

which is impossible.

(Alternatively, adding the two equations,

6t^{2} = v^{2} + w^{2}.

Thus

v^{2} + w^{2} ≡ 0 mod 3 ⟹ v ≡ w ≡ 0 mod 3
⟹ t ≡ 0 mod 3
⟹ u ≡ 0 mod 3,

contradicting gcd(m, t) = 1.)

9.13 Final example

The elliptic curve

E(ℚ) : y^{2} = x(x + 1)(x − 14) = x^{3} − 13x^{2} − 14x

is more complicated, but the method is the same.

We have

p′(0) = −14, p′(−1) = 15, p′(14) = 14 · 15.

Thus

im Θ ⊂ S = {(d, e, f) : d | 14, e | 15, f | 14 · 15; def = g^{2}}.

if P = (m/t^{2}, M/t^{3}) ↦ (d, e, f) (M ≠ 0) then

m = du^{2}, m + t^{2} = ev^{2}, m − 14t^{2} = fw^{2}.

In particular,

d > 0 ⟹ e > 0 ⟹ f > 0

428–99 9–34 while

d < 0 ⟹ f < 0 ⟹ e > 0

(giving e > 0 in all cases).

We have

d = ±1, ±2, ±7, ±14, e = 1, 3, 5, 15.

Thus

∥S∥ = 2^{5} ⟹ s ≤ 5 ⟹ r ≤ 3.

The elements of order 2 give rise to the points

(0, 0) ↦ (p′(0), 1, −14) = (−14, 1, −14),
(−1, 0) ↦ (−1, p′(−1), −15) = (−1, 15, −15),
(14, 0) ↦ (14, 15, p′(14)) = (14, 15, 14 · 15),

while of course

0 = [0, 1, 0] ↦ (1, 1, 1).

Thus the torsion group gives rise the subgroup

D = {(1, 1, 1), (−14, 1, −14), (−1, 15, −15), (14, 15, 14 · 15).

We can regard S as a 5-dimensional vector space over F_{2}, with 5 coordinates defined by: the sign of d, the factor 2 in d, the factor 7 in d, the factor 3 in e, the factor 5 in e. Thus

(0, 0) ↦ (−14, 1, −14) ⟷ (1, 1, 1, 0, 0),
(−1, 0) ↦ (−1, 15, −15) ⟷ (1, 0, 0, 1, 1),
(14, 0) ↦ (14, 15, 14 · 15) ⟷ (0, 1, 1, 1, 1).

Our aim is to prove that rank(E) = 0 by showing that im Θ = D. At first sight one might think we would have to apply our congruence technique to 2^{5} − 2^{2} = 28 cases. However, we can simplify the task by choosing a complementary subspace to D – that is, a subspace of U ⊂ S of dimension 3 such that

U ∩ D = 0,

in which case

S = D ⊕ U.

If now we can show that no elements of U except for (1, 1, 1) are in im Θ then it will follow that

S = im Θ ⊕ U;

428–99 9–35 whence

dim im Θ = dim D ⟹ im Θ = D.

For our subspace U let us take those vectors with 3rd and 5th components 0, ie

U = {(d, e, f) ∈ S : d = ±1, ±2, e = 1, 3}.

We see at once that U ∩D = {(1, 1, 1)} (the zero element of our vector space), so U is — as required — complementary to D. It is sufficient therefore to show that no element of U apart from (1, 1, 1) can be in im Θ. (This reduces the number of cases to be considered from 28 to 7.)

1. (−1, 1, −1): in this case

m = −u^{2}, m + t^{2} = v^{2}, m − 14t^{2} = −w^{2},

ie

t^{2} = u^{2} + v^{2}, 14t^{2} = w^{2} − u^{2}.

From the second equation t must be even, since otherwise w^{2} − u^{2} ≡ 2 mod 4, which is impossible.

But then from the first equation, u^{2} +v^{2} ≡ 0 mod 4, which implies that u, v are both even, contradicting gcd(u, t) = 1.

2. (2, 1, 2): in this case

m = 2u^{2}, m + t^{2} = v^{2}, m − 14t^{2} = 2w^{2},

ie

t^{2} = v^{2} − 2u^{2}, 7t^{2} = u^{2} − w^{2}.

From the second equation t must be even, since otherwise 7t^{2} ≡ 3 mod 4, and u^{2} − w^{2} cannot be ≡ 3 mod 4.

But then from the first equation, v is even and so u is even, contradicting gcd(u, t) = 1.

3. (−2, 1, −2): in this case

m = −2u^{2}, m + t^{2} = v^{2}, m − 14t^{2} = −2w^{2},

428–99 9–36 ie

t^{2} = v^{2} + 2u^{2}, 7t^{2} = w^{2} − u^{2}.

As in the last case, from the second equation t must be even, and then from the first equation, so must v and u, contradicting gcd(u, t) = 1.

4. (1, 3, 3): in this case

m = u^{2}, m + t^{2} = 3v^{2}, m − 14t^{2} = 3w^{2},

ie

t^{2} = 3v^{2} − u^{2}, 14t^{2} = u^{2} − 3w^{2}.

From the second equation

u^{2} − 3w^{2} ≡ 0 mod 7.

Since 3 is a quadratic non-residue mod7, it follows that u ≡ w ≡ 0 mod 7, which implies (by the second equation) that 7 | t, so again gcd(t, u) > 1.

5. (−1, 3, −3): in this case

m = −u^{2}, m + t^{2} = 3v^{2}, m − 14t^{2} = −3w^{2},

ie

t^{2} = 3v^{2} + u^{2}, 14t^{2} = 3w^{2} − u^{2}.

As in the last case, since 3 is not a quadratic residue mod 7, the second equation implies that 7 | u, w, t, contradicting gcd(u, t) = 1.

6. (2, 3, 6): in this case

m = 2u^{2}, m + t^{2} = 3v^{2}, m − 14t^{2} = 6w^{2},

ie

t^{2} = 3v^{2} − 2u^{2}, 14t^{2} = u^{2} − 6w^{2}.

Again, since 6 is not a quadratic residue mod7, this leads to a contradiction.

428–99 9–37 7. (−2, 3, −6): in this case

m = −2u^{2}, m + t^{2} = 3v^{2}, m − 14t^{2} = −6w^{2},

ie

t^{2} = 3v^{2} + 2u^{2}, 7t^{2} = u^{2} − 3w^{2}.

Since 3 is not a quadratic residue mod7, this again leads to a contradiction.

We conclude that

im Θ = D,

ie

rank E = 0.

428–99 9–38

Mordell Revisited

10.1 Introduction

There is an alternative way of proving Mordell’s Theorem, by ‘factorising’ the doubling map

E → E : P ↦ 2P;

although the factors are not, admittedly, homomorphisms from E to itself, but involve a ‘twin’ elliptic curve Ē. The resulting computations are much simpler. Moreover, the use of algebraic numbers is avoided if f(x) has one rational root. (In the previous method, algebraic numbers were avoided if two — and therefore all three — of the roots of f(x) are rational.)

The only disadvantage of this alternative method is that it requires either an act of faith, in which ‘magic’ formulae are pulled out of a hat; or else a rather lengthy digression into elliptic curves over ℂ.

10.2 The factors of the doubling map

Suppose

E(ℂ) = ℂ/Λ

is the complex elliptic curve associated to a lattice Λ ⊂ ℂ. Let ω_{1}, ω_{2} be a basis for Λ. Recall that the map

z ↦ (φ(z), φ′(z)/2)

establishes a one-one correspondence

Φ : ℂ/Λ ↔ E(ℂ),

428–99 10–1 where E(ℂ) is the curve

y^{2} = x^{3} + bx + c,

with coefficients

b = −15g_{2}, c = −35g_{3},

where

g_{r} = ∑_{ω∈Λ,ω≠0} \frac{1}{ω^{2r}} .

Under this correspondence, the ‘doubling’ homomorphism

Φ : P ↦ 2P

corresponds to the map

ϕ : z mod Λ ↦ 2z mod Λ.

We can express this in the commutative diagram

E →^{Φ} E
↕  ↕
ℂ/Λ →^{ϕ} ℂ/Λ

Let Λ̄ be the lattice generated by \frac{1}{2}ω_{1}, ω_{2}. so that

\frac{1}{2}Λ ⊂ Λ̄ ⊂ Λ

(where \frac{1}{2}Λ is generated by \frac{1}{2}ω_{1}, \frac{1}{2}ω_{2}). The homomorphism Φ : P ↦ 2P can now be split into 2 operations, first doubling in the ω_{1}-direction, and then in the ω_{2}-direction. More precisely,

ϕ = θ_{3}θ_{2}θ_{1},

where

θ_{1} : ℂ/Λ → ℂ/Λ̄, θ_{2} : ℂ/Λ̄ → ℂ/\frac{1}{2}Λ, θ_{3} : ℂ/\frac{1}{2}Λ → ℂ/Λ

are the homomorphisms

θ_{1} : z mod Λ → z mod Λ̄,
θ_{2} : z mod Λ̄ → z mod \frac{1}{2}Λ,
θ_{3} : z mod \frac{1}{2}Λ → 2z mod Λ.

The map θ_{3} is just the isomorphism (x, y) ↦ (x/4, y/8) associated to the similarity \frac{1}{2}Λ → Λ; it is convenient to combine it with θ_{2}.

428–99 10–2 Let Ē(ℂ) be the elliptic curve associated to the lattice Λ̄:

Ē = ℂ/Λ̄.

Then θ_{1}, θ_{3}θ_{2} define homomorphisms

Θ : E → Ē, Θ̄ : Ē → E.

giving the factorisation Φ = Θ̄Θ

of Φ : P ↦ 2P. This can be expressed in the commutative diagram

E →^{Θ}  Ē →^{Θ̄} E
↕ ↕ ↕
ℂ/Λ →^{θ_{1}} ℂ/Λ̄ →^{θ_{3}θ_{2}} ℂ/Λ

Note that

Φ̄ = ΘΘ̄ : Ē → Ē

is also a doubling map, this time on Ē, being given by the composition

θ_{1}θ_{3}θ_{2} : z mod Λ̄ ↦ z mod \frac{1}{2}Λ ↦ 2z mod Λ ↦ 2z mod Λ̄.

All that is straightforward. But how does it translate into geometric terms? What is the elliptic curve Ē? And what are the algebraic formulae for the maps Θ, Θ̄?

As we just noted, E is parametrised by

(x, y) = (φ(z), φ′(z)/2).

Similary Ē is parametrised by

(x, y) = (φΛ̄(z), φ′ ; Λ̄(z)/2).

To determine Θ, we must express φΛ̄(z) in terms of φ(z).

Proposition 10.1 Let Λ = ⟨ω_{1}, ω_{2}⟩, and let Λ̄ = ⟨ω_{1}/2, ω_{2}⟩. Then, writing φ(z) for φ_{Λ}(z),

φΛ̄(z) = \frac{φ(z)^{2} − αφ(z) + 3α^{2} + b}{φ(z) − α},

where α = φ(ω_{1}/2), and b is the coefficient in the functional equation

(φ′(z)/2)^{2} = φ(z)^{3} + bφ(z) + c.

428–99 10–3 Proof ▶ Since Λ̄ ⊂ Λ, φΛ̄(z) is elliptic with respect to Λ. It is also even. Hence it is a rational function of φ(z),

φΛ̄(z) = R(φ(z)),

where R(w) = P (w)/Q(w) with polynomials P (w), Q(w).

It is easy to see that the function

f(z) = φ(z) + φ(z + ω_{1}/2)

has periods ω_{1}/2, ω_{2}, and so is elliptic with respect to Λ̄. Since it has a double pole at 0, and no other poles inside Π_{1},

f(z) = AφΛ̄(z) + B

for some constants A, B. In the neighbourhood of z = 0,

f(z) = \frac{1}{z} + φ(ω_{1}/2).

It follows that

f(z) = φΛ̄(z) + φ(ω_{1}/2).

Thus

φΛ̄(z) = φ(z) + φ(z + ω_{1}/2) − φ(ω_{1}/2).

Let

α = φ(ω_{1}/2), β = φ(ω_{2}/2), γ = φ(ω_{1}/2 + ω_{2}/2).

Recall that

φ′(ω_{1}/2) = 0, φ′(ω_{2}/2) = 0, φ′(ω_{1}/2 + ω_{2}/2) = 0,

since φ′(z) is an odd function. Thus

(α, 0), (β, 0), (γ, 0)

are just the 3 points of order 2 on E.

We have

φΛ̄(z) = φ(z) + φ(z + ω_{1}/2) − α;

we want to express φ(z + ω_{1}/2) in terms of φ(z). The function φ(z + ω_{1}/2) is elliptic with respect to Λ, and has a double pole at ω_{1}/2, and no other poles inside Π. The function φ(z) − φ(ω_{1}/2) = φ(z) − α has a double zero at ω_{1}/2, since φ′(ω_{1}/2) = 0. Thus

F (z) = φ(z + ω_{1}/2)(φ(z) − α)

428–99 10–4 has a double pole at the points of Λ, and no other poles. Since F (z) is even, it follows that

F (z) = Cφ(z) + D

for some constants C, D. To determine these constants we expand F (z) around z = 0.

By Taylor’s theorem,

φ(z + ω_{1}/2) = φ(ω_{1}/2) + \frac{1}{2}φ′′(ω_{1}/2)z^{2} + \frac{1}{24}φ′′′′(ω_{1}/2)z^{4} + O(z^{6}).

On differentiating the functional equation

φ′(z)^{2} = 4φ(z)^{3} + 4bφ(z) + 4c,

we deduce that

φ′′(z) = 2(3φ(z)^{2} + b).

Differentiating twice more,

φ′′′′(z) = 12 (φ(z)φ′′(z) + φ′(z)^{2}) .

In particular,

φ′′(ω_{1}/2) = 2(3α^{2} + b), φ′′′′(ω_{1}/2) = 24α(3α^{2} + b).

Thus

φ(z + ω_{1}/2) = α + (3α^{2} + b)z^{2} + α(3α^{2} + b)z^{4} + O(z^{6})

in the neighbourhood of z = 0. It follows that

F (z) = (α + (3α^{2} + b)z^{2}) (\frac{1}{z^{2}} − α) + O(z^{2})
= \frac{α}{z^{2}} + (2α^{2} + b).

Hence

F (z) = αφ(z) + 2α^{2} + b.

We conclude that

φΛ̄(z) = φ(z) − α + \frac{αφ(z) + 2α^{2} + b}{φ(z) − α}
= \frac{φ(z)^{2} − αφ(z) + 3α^{2} + b}{φ(z) − α}.

◀

428–99 10–5 Corollary 18 The derivative of φΛ̄(z) is given by:

φ′ ; Λ̄(z) = \frac{φ(z)^{2} − 2αφ(z) − 2α^{2} − b}{(φ(z) − α)^{2}}φ′(z).

We see from this that the homomorphism Θ : E → Ē is given by

Θ : (x, y) ↦ (\frac{x^{2} − αx + 3α^{2} + b}{x − α}, \frac{x^{2} − 2αx − 2α^{2} − b}{(x − α)^{2}}y)

if x ≠ α, while

Θ(α, 0) = O.

But what is the curve Ē? Recall that

φ(z) = \frac{1}{z^{2}} + 3g_{2}z^{2} + 5g_{3}z^{4} + O(z^{6})
= \frac{1}{z^{2}} − \frac{b}{5}z^{2} − \frac{c}{7}z^{4} + O(z^{6}).

Similarly

φΛ̄(z) = \frac{1}{z^{2}} − \frac{b_{1}}{5} z^{2} − \frac{c_{1}}{7} z^{4} + O(z^{6}).

Thus we can determine b_{1}, c_{1} by looking at the expansion of φΛ̄(z) around z = 0. From above,

φΛ̄(z) = φ(z) + φ(z + ω_{1}/2) − α
= \frac{1}{z^{2}} − \frac{b}{5}z^{2} − \frac{c}{7}z^{4} + (3α^{2} + b)z^{2} + α(3α^{2} + b)z^{4} + O(z^{6}).

We conclude that

b̄ = −15α^{2} − 4b,
c̄ = −21α^{3} − 7αb + c
= −28α^{3} + 8c,

since

α^{3} + bα + c = 0.

The relation between Λ̄ and \frac{1}{2}Λ is exactly the same as that between Λ and Λ̄, except that ω_{1}/2 is replaced by ω_{2}/2. More precisely,

α = φ(ω_{1}/2)

428–99 10–6 is replaced by

ᾱ = φΛ̄(ω_{2}/2)
= φ(ω_{2}/2) + φ(ω_{1}/2 + ω_{2}/2) − φ(ω_{1}/2)
= β + γ − α
= −2α;

for α + β + γ = 0, since α, β, γ are the roots of x^{3} + bx + c.

It follows that the formula for Θ̄, can be derived from that for Θ by substituting b̄, c̄, −2α for b, c, α, respectively (corresponding to the homomorphism θ_{2} : ℂ/Λ̄ → ℂ/\frac{1}{2}Λ) and then dividing the x and y-coordindates by 4 and 8, respectively (corresponding to the homomorphism θ_{3} : ℂ/\frac{1}{2}Λ → ℂ/Λ). Thus

Θ̄(x̄, ȳ) = (\frac{1}{4} · \frac{x̄^{2} − (−2α)x̄ + 3(−2α)^{2} + b̄}{x̄ − (−2α)}, \frac{1}{8} · \frac{x̄^{2} − 2(−2α)x̄ − 2(−2α)^{2} − b̄}{(x̄ − (−2α))^{2}}ȳ)

= (\frac{1}{4} · \frac{x̄^{2} + 2αx̄ − 3α^{2} − 4b}{x̄ + 2α}, \frac{1}{8} · \frac{x̄^{2} + 4αx̄ + 7α^{2} + 4b}{(x̄ + 2α)^{2}} ȳ) .

if x̄ ≠ −2α, while

Θ̄(−2α, 0) = O.

We summarise our results in the following Proposition.

Proposition 10.2 Suppose

E(ℂ) : y^{2} = x^{3} + bx + c

is the elliptic curve associated to a lattice Λ; and suppose α is a root of x^{3} + bx + c. Let Ẽ be the elliptic curve

Ẽ(ℂ) : y^{2} = x^{3} + (−15α^{2} − 4b)x + (−28α^{2} + 8c).

Then the homomorphism

Φ : E → E

under which

P ↦ 2P

can be expressed as the product of 2 homomorphisms

Φ = Θ̄Θ

where

Θ : E → Ẽ, Θ̄ : Ẽ → E

428–99 10–7 are the maps

Θ(x, y) = (\frac{x^{2} − αx + 3α^{2} + b}{x − α}, \frac{x^{2} − 2αx − 2α^{2} − b}{(x − α)^{2}}y)

if (x, y) ≠ (α, 0), while Θ(α, 0) = Θ(O) = O; and

Θ̄(x̄, ȳ) = (\frac{1}{4} · \frac{(x̄^{2} + 2αx̄ − 3α^{2} − 4b}{x̄ + 2α}, \frac{1}{8} · \frac{x̄^{2} + 4αx̄ + 7α^{2} + 4b}{(x̄ + 2α)^{2}} ȳ)

if (x̄, ȳ) ≠ (−2α, 0), while Θ̄(−2α, 0) = Θ̄(O) = O.

10.3 Tying a neater package

Our formulae become much simpler if we work with elliptic curves in ‘constantfree’ format

E : y^{2} = x^{3} + ax^{2} + bx.

It is not difficult to see why. Our construction starts with an elliptic curve E together with a point of order 2 on E. By taking E in constant-free form we have a ‘built-in’ point of order 2, namely (0, 0). Thus we have only 2 constants, a and b, to deal with rather than b, c and α.

To avoid confusion, let us — for the time being — ‘dot’ the coefficients and variables in the constant-free model:

Ė : ẏ^{2} = ẋ^{3} + ȧẋ^{2} + ḃẋ.

The coordinate-change x = ẋ + ȧ/3 brings this to our earlier ‘x^{2}-free’ format

y^{2} = (x − ȧ/3)^{3} + ȧ(x − ȧ/3)^{2} + ḃ(x − ȧ/3)
= x^{3} + (−ȧ^{2}/3 + ḃ)x + (2ȧ^{3}/27 − ȧḃ/3).

Thus

b = −ȧ^{2}/3 + ḃ, c = 2ȧ^{3}/27 − ȧḃ/3,

and

α = ȧ/3,

since (0, 0) ↦ (ȧ/3, 0).

Hence the associated curve Ē (in x^{2}-free format) has coefficients

b̄ = −15α^{2} − 4b

= −ȧ^{2}/3 − 4ḃ,

c̄ = −28α^{3} + 8c

= −4ȧ^{3}/9 − 8ȧḃ/3.

428–99 10–8

We want to transform Ē into constant-free format. At first sight there might seem some ambiguity in this, since it involves choosing a point of order 2 on Ē. However, we know the point we want: (α_{1}, 0) = (−2α, 0) = (−2ȧ/3, 0). Our transformation must bring this to (0, 0), and is therefore

ẋ = x + 2α = x + 2ȧ/3.

Thus our new curve ˙ Ē has equation

ẏ^{3} = (ẋ − 2ȧ/3)^{3} + b_{1}(ẋ − 2ȧ/3) + c_{1}
= ẋ^{3} + ȧ_{1}ẋ^{2} + ḃ_{1}ẋ,

where

ȧ_{1} = −2ȧ,
ḃ_{1} = 4ȧ^{2}/3 + ḃ_{1}
= ȧ^{2} − 4ḃ,

which is pleasingly simple!

It remains to express Θ and Θ̄ in the new system. We have

Θ̇(ẋ, ẏ) = (x̃, ỹ),

where

x̃ = \frac{(ẋ + ȧ/3)^{2} − ȧ(ẋ + ȧ/3)/3 + 3(ȧ/3)^{2} − ȧ^{2}/3 + ḃ}{(ẋ + ȧ/3 − ȧ/3)^{2}} + 2ȧ/3

= \frac{ẋ^{2} + ȧẋ + ḃ}{ẋ^{2}},

ỹ = \frac{(ẋ + ȧ/3)^{2} − 2ȧ/3(ẋ + ȧ/3) − 2(ȧ/3)^{2} + ȧ^{2}/3 − ḃ}{(ẋ + ȧ/3 − ȧ/3)^{2}} ẏ

= \frac{ẋ^{2} − ḃ}{ẋ^{2}} ẏ.

We derive ˙ Θ̄ from this by substituting ˙ b̄ = ȧ^{2} − 4ḃ for ḃ, and dividing the x- and y-coordinates by 4 and 8, respectively:

˙Θ̄(ẋ, ẏ) = (\frac{ẏ^{2}}{4ẋ^{2}} , \frac{ẋ^{2} − ȧ^{2} + 4ḃ}{8ẋ^{2}} ẏ) .

We summarise our conclusions in the following Definition and Proposition, where we now drop the dots.

428–99 10–9 Definition 10.1 To each elliptic curve

E : y^{2} = x^{3} + ax^{2} + bx.

we associated the elliptic curve

Ẽ: y^{2} = x^{3} + āx^{2} + +b̄x,

where

ā = −2a, b̄ = a^{2} − 4b.

Theorem 10.1 Suppose E(K) is the elliptic curve

E : y^{2} = x^{3} + ax^{2} + bx

over the field K. Let Ē(K) be the associated elliptic curve, and let the maps

Θ : E → Ē, Θ̄ : Ē → E

be defined by

Θ(x, y) = (\frac{y^{2}}{x^{2}} , \frac{x^{2} − b}{x^{2}}y)

if x ≠ 0, while Θ(O) = Θ(T) = 0 for T = (0, 0),

Θ̄)(x, y) = (\frac{ȳ^{2}}{4x̄^{2}} , \frac{x̄^{2} − b̄}{8x̄^{2}}ȳ)

if x̄ ≠ 0, while Θ̄(O) = Θ̄(T̄) = 0 for T̄ = (0, 0). Then Θ, Θ̄ are homomorphisms; and

Θ̄Θ : E → E, ΘΘ̄ : Ē → Ē

are the doubling maps P ↦ 2P on E and Ē.

Proof ▶ Although we established this result on the assumption that K = ℂ, it is readily verified that each part of the result (eg the statement that Θ(P + Q) = Θ(P) + Θ(Q)) can be expressed as a number of polynomial identities with integral coefficients, which must remain valid over any field.

◀

At this point we can forget how the associated elliptic curve Ē and the homomorphisms Θ, Θ̄ arose; all we need to know is that the maps given by the formulae above are indeed homomorphisms, and that the doubling map Φ on E factorises into Θ̄Θ.

428–99 10–10

10.4 Divide and rule

Recall that our main aim is to show that if K = ℚ then [E : 2E] is finite. The splitting of the doubling map allows us to divide this task. Proposition 10.3 Suppose ϕ : A → B is a homomorphism of abelian groups, and S ⊂ A is a subgroup of finite index. Then

[ϕA : ϕS] ≤ [A : S].

Proof ▶ Consider the composition

ϕ_{S} : A → B → B/ϕS.

Evidently

im ϕ_{S} = ϕA/ϕS,

while

ker ϕ_{S} ⊃ S.

By the first isomorphism theorem,

ϕA/ϕS ≅ A/ ker ϕ_{S}.

Hence

[ϕA : ϕS] = [A : ker ϕ_{S}] ≤ [A : S].

◀

Proposition 10.4 [E : 2E] and [Ē : 2Ē] are both finite if and only if [Ē : im Θ] and [E : im Θ̄] are both finite. Proof ▶ We have

[E : 2E] = [E : Θ̄ΘE]
= [E : Θ̄Ē][Θ̄Ē: Θ̄ΘE]
≤ [E : Θ̄Ē][Ē: ΘE],

by Proposition 10.3 ◀

428–99 10–11

10.5 Characterisation of the image

Proposition 10.5 If P̄ = (x̄, ȳ) ∈ Ē with x̄ ≠ 0 then

P̄ ∈ im Θ ⟺ x̄ ∈ K^{2}.

Similarly if P = (x, y) ∈ E with x ≠ 0 then

P ∈ im Θ̄ ⟺ x ∈ K^{2}.

Proof ▶ Suppose P̄ = Θ(P), where P = (x, y) Then

x̄ = \frac{y^{2}}{x^{2}} ∈ K^{2}.

Conversely, suppose (x̄, ȳ) ∈ Ē; and suppose

x̄ = w^{2},

where w ∈ K. We have to show that there is a point P = (x, y) ∈ E(K) with

\frac{y^{2}}{x^{2}} = w^{2}.

We may suppose that

y = wx,

on taking −P if y = −wx.

Substituting y = wx in the equation for E,

w^{2}x^{2} = x^{3} + ax^{2} + bx = 0.

One solution is x = 0; the other two are given by

x^{2} + (a − w^{2})x + b = 0.

This will have a solution in K if and only if

(a − w^{2})^{2} − 4b ∈ K^{2},

ie

w^{4} − 2aw^{2} + (a^{2} − 4b) ∈ K^{2},

428–99 10–12 ie

x̄^{2} + āx̄ + b̄ ∈ K^{2}.

But since (x̄, ȳ) ∈ Ē,

ȳ^{2} = x̄(x̄^{2} + āx̄ + b̄).

By hypothesis, x̄ ∈ K^{2}. Hence

x̄^{2} + āx̄ + b̄ ∈ K^{2},

which as we saw is the condition for (x̄, ȳ) ∈ im Θ.

The proof of the corresponding result for Θ̄ is identical, the factor 1/4 in the x-coordinate of Θ̄(x̄, ȳ) making no difference, since we are working modulo squares. ◀

10.6 The associated homomorphism

Proposition 10.6 The map

χ : E(K) → K^{×}/K^{×}^{2}

under which

P ↦ \begin{cases}x mod K^{×}^{2} & if P = (x, y) with x ≠ 0 \\ b mod K^{×}^{2} & if P = T = (0, 0) \\ 1 mod K^{×}^{2} & if P = O \end{cases}

is a homomorphism.

Proof ▶ Trivially,

χ(−P) = χ(P) = 1/χ(P),

since x = 1/x for all x ∈ K^{×}/K^{×}^{2} (ie all elements are of order 1 or 2).

Now suppose

P + Q + R = 0,

ie P, Q, R are collinear. We have to show that

χ(P)χ(Q)χ(R) = 1.

If one of P, Q, R is O, say P = O, this reduces to the result just proved:

Q + R = 0 ⟹ χ(Q)χ(R) = 1.

428–99 10–13

Suppose none of the points is O. Let the line P QR be y = mx + d. This line meets E where

(mx + d)^{2} = x^{3} + ax^{2} + bx.

The roots of this are the x-coordinates of P, Q, R, say x_{1}, x_{2}, x_{3}. Thus

x_{1}x_{2}x_{3} = d^{2}.

If none of x_{1}, x_{2}, x_{3} is zero, then

χ(P)χ(Q)χ(R) = x_{1}x_{2}x_{3} ≡ 1 mod K^{×}^{2},

as required.

Finally, suppose one of x_{1}, x_{2}, x_{3} is 0, say x_{1} = 0, ie P = T = (0, 0). Then d = 0, and the remaining two points satisfy the quadratic

m^{2}x = x^{2} + ad + b = 0.

Thus

x_{2}x_{3} = b.

Now χ(T) = b (by what may have seemed an arbitrary definition, but whose purpose is now apparent); so

χ(P)χ(Q)χ(R) = bx_{2}x_{3} = b^{2} ≡ 1 mod K^{×}^{2}.

Thus in all cases

P + Q + R = 0 ⟹ χ(P)χ(Q)χ(R) = 1.

Hence χ is a homomorphism. ◀ Now we can re-state Proposition 10.5 as

Proposition 10.7 We have

im Θ = ker χ̄, im Θ̄ = ker χ.

Equivalently, the two sequences

E →^{Θ} Ē →^{χ̄} K^{×}/K^{×}^{2}, Ē →^{Θ̄} E →^{χ} K^{×}/K^{×}^{2}

are exact.

Proposition 10.8 [E : 2E] and Ē: 2Ē] are both finite if and only if im χ and im χ̄ are both finite.

Proof ▶ This follows at once from Proposition 10.4, since

E/ im Θ̄ ≅ im χ, Ē/ im Θ ≅ im χ̄,

◀

428–99 10–14

10.7 The rational case

So far we have been working over a general field K. Now let us turn to the rational case K = ℚ. Note that since T = (0, 0) ∈ E, we are assuming that our elliptic curve contains a rational point of order 2.

Proposition 10.9 Let E be the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx (a, b ∈ ℤ);

and let

χ : E → ℚ^{×}/ℚ^{×}^{2}

be the associated homomorphism under which

P = (x, y) ↦ x mod ℚ^{×}^{2}.

Then each element of im χ is of the form

b_{1} mod ℚ^{×}^{2}

where b_{1} | b.

Proof ▶ Suppose P = (x, y) ∈ E. We know that x, y can be expressed in the form

x = \frac{m}{e^{2}}, y = \frac{n}{e^{3}} ,

where e, m, n ∈ ℤ and gcd(m, e) = gcd(n, e) = 1.

From the equation of the curve,

n^{2} = m(m^{2} + ae^{2}m + be^{4}).

Let

b_{1} = gcd(m, m^{2} + ae^{2}m + be^{4})

Then

b_{1} = gcd(m, be^{4})
= gcd(m, b),

since gcd(m, e) = 1. In particular, b_{1} | b. Let

b = b_{1}b_{2}, m = b_{1}m_{1},

where we choose the sign of b_{1} so that m_{1} ≥ 0. Then

n^{2} = b_{1}^{2}m_{1}(b_{1}m_{1}^{2} + ae^{2}m_{1} + b_{2}e^{4}).

428–99 10–15 Hence b_{1}^{2} | n^{2}, and so b_{1} | n, say

n = b_{1}n_{1}.

Thus

n_{1}^{2} = m_{1}(b_{1}m_{1}^{2} + ae^{2}m_{1} + b_{2}e^{4}).

The two factors on the right are co-prime, since we took out their common factor. Hence

m_{1} = U^{2}, b_{1}m_{1}^{2} + ae^{2}m_{1} + b_{2}e^{4} = V^{2}.

For future reference we note that this implies

b_{1}U^{4} + ae^{2}U^{2} + b_{2}e^{4} = V^{2},

with e > 0, gcd(U, V) = 1.

But for our present purpose we simply need the fact that

x = \frac{b_{1}m_{1}}{e^{2}}

= b_{1} \frac{U^{2}}{e^{2}}

≡ b_{1} mod ℚ^{×}^{2}.

◀

Corollary 19 Each element of im χ̄ is of the form

\overline{b_{1}} mod ℚ^{×}^{2}

where \overline{b_{1}} | b̄.

Theorem 10.2 The group E/2E is finite.

Proof ▶ By Proposition 10.4,

[E : 2E] ≤ [E : im Θ̄][Ē: im Θ]
= ∥ im χ∥ · ∥ im χ̄∥.

But these two images are finite, by Proposition 10.9 and its Corollary. ◀

428–99 10–16

10.8 Determining the rank of E

We know that

E = F ⊕ ℤ^{r},

where F is the torsion subgroup of E, and r is its rank. It follows that

E/2E = F/2F ⊕ (ℤ/(2))^{r} .

Note that if A is an abelian group then A/2A is of exponent 2, ie 2ā = 0 for all ā ∈ A/2A. Thus if A is finitely-generated, it follows from the Structure Theorem that

A/2A = (ℤ/(2))^{d}

for some d. (Alternatively, A/2A can be regarded as a vector space over the finite field F_{2} = {0, 1}; and d is the dimension of this vector space.)

In our case,

2^{r} = \frac{[E : 2E]}{[F : 2F]}.

It is easy to determine [F : 2F]; so computation of the rank r reduces to the determination of [E : 2E]. For this we need to sharpen a little our earlier proof that [E : 2E] is finite.

But first let us consider the torsion subgroup F. Suppose A is a finite abelian group. By the Structure Theorem,

A = ℤ/(p_{1}^{e_{1}} ⊕ ⋯ ⊕ ℤ/(p_{r}^{e_{r}})
= C_{1} ⊕ ⋯ ⊕ C_{r},

say, where C_{i} = ℤ/(p_{i}^{e_{i}}). Thus

A/2A = C_{1}/2C_{1} ⊕ ⋯ ⊕ C_{r}/2C_{r}.

Proposition 10.10 Suppose A = ℤ/(p^{e}). Then

[A : 2A] = \begin{cases}ℤ/(2) & if p = 2 \\ 0 & if p ≠ 2. \end{cases}

Proof ▶ Consider the map ϕ : A → A under which

a ↦ 2a.

Then

ker ϕ = {a ∈ A : 2a = 0}.

428–99 10–17

If p ≠ 2 then A has no elements of order 2, by Lagrange’s Theorem. Hence ker ϕ = 0, and so

2A = A,

ie every element a ∈ A is of the form a = 2b for some b ∈ A.

On the other hand, if p = 2 then ℤ/(2^{e}) has just one element of order 2, namely 2^{e−1} mod 2^{e}. Thus ∥ ker ϕ∥ = 2; and so

[A : 2A] = 2.

◀

Corollary If

A = ℤ/(p_{1}^{e_{1}}) ⊕ ⋯ ⊕ ℤ/(p_{r}^{e_{r}})

then

[A : 2A] = 2^{d},

where d is the number of factors with p_{i} = 2.

Corollary If A is a finite abelian group with

[A : 2A] = 2^{d},

then the number of elements of order 2 in A is 2^{e} − 1.

Proof ▶ As we saw above, the factor ℤ/(p^{e}) contains just one element of order 2 if p = 2 and none otherwise. But the element

a = a_{1} ⊕ ⋯ ⊕ a_{r}

is of order 1 or 2 if and only if that is true of each a_{i}. Thus the number of such elements is 2^{d} by Corollary 1; and the result follows on subtracting the one element of order 1. ◀

We apply this result to our elliptic curve E. We know that E has at least one point of order 2, namely T = (0, 0). We know too that if it has more than one point of order 2 then it must have just three.

Proposition 10.11 Suppose F is the torsion subgroup of

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx.

Then

[F : 2F] = \begin{cases}4 & if b̄ ∈ ℚ^{2} \\ 2 & if b̄ ∉ ℚ^{2} \end{cases}

428–99 10–18 Proof ▶ P ∈ E is of order 2 if P = (α, 0), where α is a root of

x^{3} + ax^{2} + bx = 0.

One root is α = 0; the other two are the roots of the quadratic

x^{2} + ax + b = 0.

This has rational roots if and only if

a^{2} − 4b = b̄ ∈ ℚ^{2}.

Thus E has 3 or 1 points of order 2, and so [F : 2F] = 4 or 2, according as b̄ is or is not a perfect square. ◀

We proved that [E : 2E] is finite by showing that

[E : 2E] = [E : Θ̄ΘE]
= [E : Θ̄Ē][Θ̄Ē: Θ̄(ΘE)]
≤ [E : Θ̄Ē][Ē: ΘE].

But now we need a slightly more precise result in place of Proposition 10.3.

Proposition 10.12 Suppose ϕ : A → B is a homomorphism of abelian groups, and S ⊂ A is a subgroup of finite index. Then

[A : S] = [ϕA : ϕS][ker ϕ : ker ϕ ∩ S].

Proof ▶ With the same notation as in the earlier proof,

ker ϕ_{S} = S + ker ϕ.

For

ϕ_{S}a = 0 ⟹ ϕa = ϕs
⟹ a = s + k,

where k ∈ ker ϕ; while conversely ϕ(s + k) = ϕs ∈ ϕS. Thus

[A : S] = [ϕA : ϕS][ker ϕ + S : S].

But by the Second Isomorphism Theorem, if S, T ⊂ A then

(S + T)/S ≅ T/(S ∩ T).

In particular,

[ker ϕ + S : S] = [ker ϕ : ker ϕ ∩ S].

◀

428–99 10–19 Corollary 20 We have

[E 2E] = \frac{[E : im Θ̄][Ē: im Θ]}{[ker Θ̄ ∩ im Θ]}

Proof ▶ This follows on applying the Proposition with A = Ē, B = E, ϕ = Θ̄, S = im Θ. ◀

The subgroups ker Θ and ker Θ̄ are (almost) trivial.

Proposition 10.13 We have

ker Θ = {O, T }, ker Θ̄ = {O, T̄},

where T = (0, 0) ∈ E, T̄ = (0, 0) ∈ Ē.

Proof ▶ This follows at once from the definitions of Θ, Θ̄, since Θ(x, y) is finite (ie Z ≠ 0) if x ≠ 0; and Θ̄(x̄, ȳ) is finite if x̄ ≠ 0. ◀

Proposition 10.14 We have

[E : 2E] = \frac{[E : im Θ̄][Ē: im Θ]}{d}

where

d = \begin{cases}2 & if b̄ ∈ ℚ^{2}, \\ 1 & if b̄ ∉ ℚ^{2} \end{cases}

Proof ▶ After Proposition 10.13 we simply have to determine whether or not

T̄ ∈ im Θ.

Suppose T = Θ(P), where P = (x, y). Then y = 0 from the definition of Θ. On the other hand P ≠ T, since Θ(T) = O, by definition.

In other words, Θ(P) = T if and only if P ∈ E is a point of order 2 other than T. But, as we saw in the proof of Proposition 10.11, there are two such points if b̄ ∈ ℚ^{2}, and no such points otherwise.

Thus

∥ ker Θ̄ ∩ im Θ∥ = \begin{cases}2 & if b̄ ∈ ℚ^{2}, \\ 1 & if b̄ ∉ ℚ^{2}; \end{cases}

and the result follows. ◀

428–99 10–20 Theorem 10.3 If the rank of the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx

is r then

2^{r} = \frac{∥ im χ∥ · ∥ im χ̄∥}{4}.

Proof ▶ If

E = F ⊕ ℤ^{r}

then as we saw

2^{r} = \frac{[E : 2E]}{[F : 2F]}

The result now follows at once from Propositions 10.14 and 10.11. ◀

10.9 An example

Consider the elliptic curve

E(ℚ) : y^{2} = x^{3} + x.

The associated curve is

Ē(ℚ) : y^{2} = x^{3} − 4x.

Thus

b = 1, b̄ = −4.

If the rank of E is r then

2^{r} = \frac{∥ im χ∥ · ∥ im χ̄∥}{4}

by Theorem 10.3. We have to determine ∥ im χ∥, ∥ im χ̄∥.

Let us consider

χ : E → ℚ^{×}/ℚ^{×}^{2}

first. We know that the elements of im χ are of the form

b_{1} mod ℚ^{×}^{2},

where b_{1} | b. In this case b = 1, and so

b_{1} = ±1. 428–99 10–21 Certainly 1 = χ(O) ∈ im χ. We have to determine if −1 ∈ im χ. We saw in the proof of Proposition 10.9 that if this is so then we can find

e, U, V with e ≥ 1, gcd(U, V) = 1 satisfying

b_{1}U^{4} + b_{2}e^{4} = V^{2},

ie

−U^{4} − e^{4} = V^{2},

which is clearly impossible. Hence −1 ∉ im χ, and so

im χ = {1}.

Turning to χ̄, we have b̄ = −4, and so b_{1} = ±1, ±2. (We can omit b_{1} = ±4, since we are working modulo squares.) We know that 1 ∈ im χ̄. Also

χ(T̄) = b̄ = −4 ≡ −1,

where T̄ = (0, 0). Thus −1 ∈ im χ̄.

It remains to determine if b_{1} = ±2 ∈ im χ̄. (Note that if one is in the image then so is the other, since im χ̄ is a subgroup containing −1.) For b_{1} = 2, b_{2} = −2, we have to solve the equation

2U^{4} − 2e^{4} = V^{2}.

This has the trivial solution (e, U, V) = (1, 1, 0) (corresponding to the point P = (2, 0) ∈ Ē).

We conclude that

im χ̄ = {±1, ±2}.

(Note that once we knew that im χ = {1}, it followed from Theorem 10.3 that ∥ im χ̄∥ ≥ 4; so in fact it was clear that im χ̄ = {±1, ±2}.)

Hence

2^{r} = \frac{1 · 4}{4} = 1,

ie E is of rank 0, that is, E(ℚ) is finite.

Now we can find E = F easily, by the Nagell-Lutz Theorem. We have

D = −4.

Hence y = 0, ±1, ±2. But the equations

x^{3} + x − 1 = 0, x^{3} + x − 4

have no solutions. Hence the only rational points on E are the 3 points of order 2,

E = {O, (0, 0), (2, 0), (−2, 0)}.

428–99 10–22

10.10 Another example

If b is not a perfect square, then 1 = Θ(O), b = Θ(T) are distinct elements of im χ. Similarly, if b̄ is not a perfect square, then 1, b̄ are distinct elements of im χ̄.

Thus if neither b nor b̄ is a perfect square then these elements alone contribute 4 to ∥ im χ∥ · ∥ im χ̄∥; so by Theorem 10.3 any further element in either of these images ensures that the rank is ≥ 1.

Consider the elliptic curve

E(ℚ) : y^{2} = x^{3} + 3x.

The associated curve is

Ē(ℚ) : ȳ^{2} = x̄^{3} − 12x̄.

Thus

b = 3, b̄ = −12.

We know that 3 = χ(T) ∈ im χ. On the other hand −1, −3 ∉ im χ, since

b_{1}U^{4} + b_{2}e^{4} < 0

in these cases. Thus

im χ = {1, 3}.

Similarly −3 ≡ −12 ∈ im χ̄. We have to determine which other factors b_{1} of 12 are in im χ̄ — remembering that since this is a 2-group it contains either 2, 4 or 8 elements. The candidates are: −1, ±2, 3, ±6.

If −1 ∈ im χ̄ then the equation

−U^{4} + 12e^{4} = V^{2}

has a solution with e ≥ 1, gcd(U, V) = 1. U must be odd, since otherwise U, V are both even. But then

−U^{4} ≡ 1 mod 4,

and so

−U^{4} + 12e^{4} ≡ −1 mod 4.

Since −1 is not a square mod 4, the equation has no solution, and −1 ∉ im χ̄. Thus ∥ im χ̄∥ = 2 or 4.

The equation for b_{1} = −2, b_{2} = 6 is

−2U^{4} + 6e^{4} = V^{2},

428–99 10–23 which has the obvious solution (e, U, V) = (1, 1, 2). Thus −2 ∈ im χ̄. It follows that

im χ̄ = {1, −2, −3, 6}.

In particular ∥ im χ̄∥ = 4, and so

rank(E) = 1.

We can determine the torsion subgroup F ⊂ E by the Nagell-Lutz theorem, in the usual way. The discriminant of x^{3} + 3x is −4 · 3^{2} = −36 Thus if P = (x, y) ∈ E is of finite order, then x, y ∈ ℤ and y = 0 or y^{2} | 36. Hence

y = 0, ±1, ±2, ±3, ±6.

Also

y^{2} = x^{3} + 3x = x(x^{2} + 3) ⟹ x ≥ 0.

It is readily verified that the only possible points of finite order are: O, (0, 0), (1, ±2), (3, ±6).

We can use the ‘factors of double’ to simplify computation of 2P. (Alternatively, we could find where the tangent at P meets the curve again, in the usual way.) Let S = (1, 2). Then

Θ(S) = (\frac{2^{2}}{1^{2}} , \frac{1^{2} − 3}{1^{2}} · 2) = (4, −4),

and so

2S = Θ̄Θ(S) = Θ̄(4, −4) = (\frac{1}{4} · \frac{16}{16}, −\frac{1}{8} · \frac{4^{2} + 12}{4^{2}} · 4) = (\frac{1}{4}, −\frac{7}{8}) .

Since 2S has non-integral coordinates, it is of infinite order; and so therefore is S.

Since

Θ(3, 6) = (4, 4) = −Θ(S) = Θ(−S)

it follows that

(3, 6) + S ∈ ker Θ = {O, T }

and so

(3, 6) = T − S.

428–99 10–24 Thus

F = {O, T }.

It is an interesting — if long-winded — exercise to show that T and S together generate E:

E(ℚ) = ⟨T ⟩ ⊕ ⟨S⟩ ≅ ℤ/(2) ⊕ ℤ.

In other words, each point P ∈ E is uniquely expressible in the form

P = nS or P = T + nS.

Note that the subgroup ℤ is not unique; if T, S generate E then so do T, T + S.

To show that E = ⟨T, S⟩ we would apply the Method of Infinite Descent; where now each step P ↦ 2P could be divided into two steps: P ↦ P̄ = ΘP ∈ Ē and P̄ ↦ Θ̄P̄ = 2P ∈ E.

We leave this as an exercise to the reader, merely observing that even when the rank is known it can be a difficult problem to find free generators, ie to find a ℤ-basis for E/F.

428–99 10–25

10.11 Computing the rank — II

Recall that we associate to the elliptic curve

E : y^{2} = x^{3} + ax^{2} + bx

a second elliptic curve

E_{1} : y^{2} = x^{3} + a_{1}x^{2} + b_{1}x,

where

a_{1} = −2a, b_{1} = a^{2} − 4b.

The map E → E : P ↦ 2P factorises into two homomorphisms

Θ : E → E_{1}, Φ : E_{1} → E,

defined by

Θ(x, y) = (\frac{x^{2} + ax + b}{x}, \frac{x^{2} − b}{x^{2}}y) , Φ(x_{1}, y_{1}) = (\frac{x_{1}^{2} + a_{1}x_{1} + b_{1}}{4x_{1}} , \frac{x_{1}^{2} − b_{1}}{8x_{1}^{2}} y_{1}) ,

except that in each case the point (0, 0) of order 2 maps to 0. (Thus each homomorphism has kernel {0, (0, 0)}, since every affine point apart from (0, 0) maps to an affine point.)

It follows (by a little elementary group theory) that

[E : 2E] = [E : im Φ] [im Φ : im ΦΘ]
= \frac{[E : im Φ] [E_{1} : im Θ]}{[ker Φ : ker Φ ∩ im Θ]}

Our basic Lemma (corresponding to Mordell’s Lemma in the earlier approach) states that P_{1} = (x_{1}, y_{1}) ∈ E_{1} lies in im Θ if and only if x_{1} is a perfect square; and similarly P = (x, y) ∈ E lies in im Φ if and only if x is a perfect square.

Thus if we introduce the auxiliary homomorphisms

χ : E → ℚ^{×}/ℚ^{×2}, χ_{1} : E_{1} → ℚ^{×}/ℚ^{×2}

defined by

χ(x, y) = x̄ (x ≠ 0), χ(0, 0) = b̄
χ_{1}(x_{1}, y_{1}) = \overline{x_{1}} (x_{1} ≠ 0), χ_{1}(0, 0) = b̄_{1}.

428–99 10–26 then

im Θ = ker χ_{1}, im Φ = ker χ.

It follows that

[E : 2E] = \frac{∥ im χ∥ ∥ im χ_{1}∥}{e},

where

e = \begin{cases}1 if b_{1} is a perfect square, \\ 2 otherwise. \end{cases}

Since r = rank E is given by

2^{r+d} = [E : 2E],

where d = 1 or 2 according as x^{3} +ax^{2} +bx has 1 rational root or 3, the rank is completely determined once we know ∥ im χ∥ and ∥ im χ_{1}∥.

Recall that if

P = (x, y) ∈ E : y^{2} = x^{3} + ax^{2} + bx + c,

where a, b, c ∈ ℤ then x, y take the forms

x = \frac{m}{t^{2}}, y = \frac{M}{t^{3}} ,

with gcd(m, t) = 1 = gcd(M, t).

As in the earlier method, we represent each rational x ∈ ℚ^{×}/ℚ^{×2} by its square-free part d. Thus if

m = du^{2}

where d is square-free then we may take d as the representative of x̄ ∈ ℚ^{×}/ℚ^{×2}.

Proposition 10.15 Suppose

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx

is an elliptic curve with a, b ∈ ℤ. If d ∈ im χ (where d is square-free) then d | b. Moreover, if b = dd′ then d ∈ im χ if and only if there exist u, v, t with gcd(u, t) = 1 = gcd(v, t) such that

du^{4} + au^{2}t^{2} + d′t^{4} = v^{2}.

Conversely, any solution u, v, t of this equation with gcd(u, t) = 1 arises in this way from a point on E.

428–99 10–27 Proof ▶ Suppose

P = (\frac{du^{2}}{t^{2}} , \frac{M}{t^{3}} ) ∈ E.

Then

\frac{M^{2}}{t^{6}} = \frac{du^{2}}{t^{2}} (\frac{d^{2}u^{4}}{t^{4}} + a\frac{du^{2}}{t^{2}} + b) .

Thus

M^{2} = du^{2}(d^{2}u^{4} + adu^{2}t^{2} + bt^{4})
= d^{2}u^{2}(du^{4} + au^{2}t^{2} + d′t^{4}).

. It follows that du^{4} + au^{2}t^{2} + d′t^{4} is a perfect square, say

du^{4} + au^{2}t^{2} + d′t^{4} = v^{2}.

Conversely, if u, v satisfy this equation then

P = (\frac{du^{2}}{t^{2}} , \frac{duv}{t^{3}} ) ∈ E.

Finally, gcd(v, t) = 1, since

p | v, t ⟹ p^{2} | du^{2} ⟹ p | u,

contradicting gcd(u, t) = 1. ◀

10.12 Example

Consider the elliptic curve

y^{2} = x^{3} + 1.

over the rationals. There is one point of order 2 on the curve, namely D = (−1, 0).

(The point P = (2, 3) is also on the curve. Since

\frac{dy}{dx} = \frac{3x^{2}}{2y}

= \frac{12}{6} = 2

at this point, the tangent at P cuts E again at (X, Y), where

2 + 2 + X = 2^{2},

428–99 10–28 ie

X = 0.

It follows that 2P = −D = D, so that P is of order 4.)

The transformation x′ = x + 1, ie x = x′ − 1 (taking the point of order 2 to (0, 0)) brings the curve to our preferred form

E : x^{3} − 3x^{2} + 3x

Thus

a = −3, b = 3,

and so

a_{1} = 6, b_{1} = −3,

ie the associated curve is

E_{1} : y^{2} = x^{3} + 6x^{2} − 3x.

Since there is just one point of order 2 on E, and b_{1} is not a perfect square,

2^{r+1} = \frac{∥ im χ∥ ∥ im χ_{1}∥}{2},

We start by computing ∥ im χ∥. Since d | 3,

im χ ⊂ {±1, ±3}.

Since (0, 0) ↦ 3,

im χ = {1, 3} or {±1, ±3}.

Suppose d = −1. Then d′ = −3, and we are looking for solutions of

−u^{4} − 3u^{2}t^{2} − 3t^{4} = v^{2}.

Since the left-hand side is negative while the right-hand side is positive, there is no such solution. Hence

im χ = {1, 3}.

Turning to im χ_{1}, we again have d | 3, and so

im χ_{1} ⊂ {±1, ±3}.

But now (0, 0) ↦ −3. Thus

im χ = {1, −3} or {±1, ±3}.

428–99 10–29 Again, consider d = −1. Now d′ = 3, and we are looking for solutions of

−u^{4} + 6u^{2}t^{2} + 3t^{4} = v^{2}.

This implies that

−u^{4} ≡ v^{2} mod 3.

and therefore

3 | u, v

since the quadratic residues mod3 are {0, 1}. But then

3^{2} | u^{4}, u^{2}t^{2}, v^{2} ⟹ 3^{2} | 3t^{4}
⟹ 3 | t,

contradicting the condition gcd(u, t) = 1.

We conclude that

im χ_{1} = {1, −3}.

Hence

2^{r+1} = \frac{2 · 2}{2},

ie

rank E = r = 0.

10.13 Another example

Let us re-visit the curve

E : y^{2} = x^{3} − x,

which we already saw has rank 0 (in the last chapter). The associated curve is

E_{1} : y^{2} = x^{3} + 4x,

Since b_{1} = 4 is a perfect square, while the original equation has three points of order 2,

2^{r+2} = ∥ im χ∥ ∥ im χ_{1}∥.

If d ∈ im χ then d | b = −1. Thus

im χ ⊂ {±1}.

428–99 10–30 In fact, since (0, 0) ↦ −1,

im χ = {±1}.

Turning to im χ_{1}, since d | 4 ⟹ d | 2 (as d is square-free),

im χ_{1} ⊂ {±1, ±2}.

We observe that (2, 4) ∈ E_{1}. Thus 2 ∈ im χ_{1}, and so

im χ_{1} = {1, 2} or {±1, ±2}.

Suppose d = −1. Then d′ = −4, and we are looking for solutions of

−u^{4} − 4t^{4} = v^{2},

which is impossible, since the left-hand side is negative, while the right-hand side positive. Thus

im χ_{1} = {1, 2}.

We conclude that

2^{r+2} = 2 · 2,

whence

rank E = r = 0.

10.14 A third example

Finally, let us look again at the curve

E(ℚ) : y^{2} = x(x − 2)(x + 4) = x^{3} + 2x^{2} − 8x,

which we already saw (in the last Chapter) has rank 1, with the point P = (−1, 3) having infinite order.

Since

a_{1} = −2a = −4, b_{1} = a^{2} − 4b = 36,

the associated curve is

E_{1} : y^{2} = x^{3} − 4x^{2} + 36x.

Since b_{1} = 36 is a perfect square,

2^{r+2} = ∥ im χ∥ ∥ im χ_{1}∥.

428–99 10–31 If d ∈ im χ then d | −8. Thus

im χ ⊂ {±1, ±2}.

Since (2, 0) ↦ 2, while (−4, 0) ↦ −1, we deduce that

im χ = {±1, ±2}.

Turning to im χ_{1}, we have d | 36. Thus

im χ_{1} ⊂ {±1, ±2, ±3, ±6}.

The point (0, 0) ↦ 1 (since 36 ≡ 1 modulo squares), which is not much help. Consider d = −1. In this case d′ = −36, and we have to solve the equation

−u^{4} − 4u^{2}t^{2} − 36t^{4} = v^{2}.

Since the left-hand side is < 0, we conclude that −1 ∉ im χ_{1}.

In fact, any d < 0 will lead to a contradiction in the same way. We conclude that

im χ_{1} ⊂ {1, 2, 3, 6}.

Suppose d = 3. Then d′ = 12, and the equation reads

3u^{4} − 4u^{2}t^{2} + 12t^{4} = v^{2}.

But this implies that

−u^{2}t^{2} ≡ v^{2} mod 3.

Thus 3 | v and 3 | u or t. But

3 | u, v ⟹ 3^{2} | 12t^{4} ⟹ 3 | t

while

3 | v, t ⟹ 3^{2} | 3u^{4} ⟹ 3 | u,

and in either case gcd(u, t) > 1, contrary to assumption.

We conclude that 3 ∉ im χ_{1}; and therefore

2^{r+2} ≤ \frac{4 · 2}{⟹}r ≤ 1.

However, we recall that the point (−1, 3) ∈ E is of infinite order, and so

rank E = 1.

428–99 10–32

Chapter 11 The modular group

Recall that

SL(2, ℝ) = \{(\begin{matrix}a & b \\ c & d \end{matrix}) : a, b, c, d ∈ ℝ, ad − bc = 1\}.

By analogy we set

SL(2, ℤ) = \{(\begin{matrix}a & b \\ c & d \end{matrix}) : a, b, c, d ∈ ℤ, ad − bc = 1\}.

Proposition 11.1 The centre of SL(2, R) is {±I}. Proof ▶ Suppose

X = (\begin{matrix}a & b \\ c & d \end{matrix}) ∈ Z (SL(2, ℤ)) .

Let

S = (\begin{matrix}0 & −1 \\ 1 & 0 \end{matrix}) , T = (\begin{matrix}1 & 1 \\ 0 & 1 \end{matrix})

Then

SX = XS ⟹ (\begin{matrix}−c & −d \\ a & b \end{matrix}) = (\begin{matrix}b & −a \\ d & −c \end{matrix}) ⟹ a = d, b = −c;

while

T X = XT ⟹ (\begin{matrix}a + c & b + d \\ c & d \end{matrix}) = (\begin{matrix}a & a + b \\ c & c + d \end{matrix}) ⟹ c = 0.

Thus

b = c = 0 ⟹ X = ±I.

◀

428–99 11–1 Definition 11.1 The modular group Γ is the quotient-group

Γ = SL(2, R)/{±I}.

Thus each element g ∈ Γ corresponds to two matrices ±X. We write g = X̄, or even g = X, if that causes no confusion.

The modular group Γ acts on the upper complex plane

H = {z ∈ ℂ : ℑ(z) > 0}

by

gz = \frac{az + b}{cz + d}

if g = X̄, where

X = (\begin{matrix}a & b \\ c & d \end{matrix}) .

This action is faithful, ie g ∈ Γ acts trivially only if g = e. This allows us to identify g ∈ Γ with the corresponding transformation of H.

Definition 11.2 We define s, t, u ∈ Γ as the elements corresponding to the matrices

S = (\begin{matrix}0 & −1 \\ 1 & 0 \end{matrix}) , T = (\begin{matrix}1 & 1 \\ 0 & 1 \end{matrix}) , U = ST = (\begin{matrix}1 & −1 \\ 0 & 1 \end{matrix}) .

Proposition 11.2 Γ is generated by s, t:

Γ = ⟨s, t⟩.

Proof ▶ It is sufficient to show that SL(2, ℤ) is generated by S, T. Suppose

X = (\begin{matrix}a & b \\ c & d \end{matrix}) .

Our strategy is to act on X with S and T on either side so as to minimize |b| + |c|. We implement this through the following steps.

Step A Observe that

SXS^{−1} = (\begin{matrix}d & −b \\ −c & a \end{matrix}) .

If at any stage |c| > |b| then we can replace X by SXS^{−1}; Thus we may assume that

|c| ≤ |b|.

428–99 11–2 Step B We have

XT^{r} = (\begin{matrix}a & b + ra \\ c & d + rc \end{matrix}) .

We can choose r so that

|b + ra| ≤ |a|/2.

Thus we may assume that

|b| ≤ |a|/2.

Step C We have

T^{r}X = (\begin{matrix}a + rc & b + rd \\ c & d \end{matrix}) .

We can choose r so that

|b + rd| ≤ |d|/2.

Thus we may assume that

|b| ≤ |d|/2.

Note that in each of these steps, |b| + |c| is either reduced or at worst left unchanged. We may suppose therefore that we reach a stage where none of the steps leads to any “improvement”, ie our matrix entries satisfy

|c| ≤ |b|, |b| ≤ |a|/2, |b| ≤ |d|/2.

Hence

|bc| ≤ |ad|/4.

But

ad − bc = 1 ⟹ |ad| − 1 ≤ |bc|
⟹ |ad| − 1 ≤ |ad|/4
⟹ |ad| ≤ 4/3
⟹ |ad| = 1
⟹ |bc| ≤ 1/4
⟹ |bc| = 0
⟹ b = c = 0.

Thus our final matrix is ±I.

428–99 11–3 Accordingly, we have found ‘wordw’ W_{1}, W_{2} in S, T, T^{−1} such that

W_{1}XW_{2} = ±I.

It follows that

X = ±W_{1}^{−1}W_{2}^{−1}.

Since −I = S^{2}, we have expressed X as a word in S, T, T^{−1}. Thus S, T generate SL(2, ℤ); and so s, t generate Γ. ◀

Corollary 21 Γ is generated by s, u:

Γ = ⟨s, t⟩.

Theorem 11.1 Γ is freely-generated by the subgroups C_{2} = ⟨s⟩, C_{3} = ⟨u⟩, ie each g ∈ Γ is uniquely expressible in the form

g = u^{i_{0}}su^{i_{1}} ⋯ u_{n−1}^{i_{n−1}}su_{n}^{i_{n}},

where

0 ≤ i_{0}, i_{n} ≤ 2, 1 ≤ i_{j}, i_{n} ≤ 2 (0 < j < n).

Proof ▶ After the last Corollary, it only remains to prove uniqueness. Let Γ^{+} ⊂ Γ correspond to the matrices with non-negative entries:

Γ^{+} = \{X̄ : X = (\begin{matrix}a & b \\ c & d \end{matrix}) : ad − bc = 1, a, b, c, d ≥ 0.\}

Evidently

g, h ∈ Γ^{+} ⟹ gh ∈ Γ^{+}.

Now

SU = (\begin{matrix}0 & −1 \\ 1 & 0 \end{matrix}) (\begin{matrix}0 & −1 \\ 1 & 1 \end{matrix}) = (\begin{matrix}0 & −1 \\ 1 & 1 \end{matrix})

◀

11.1 Congruence subgroups

If X, Y ∈ Mat(n, ℤ) we write

X ≡ Y (mod m)

as a shorthand for X_{ij} ≡ Y_{ij} (mod m)

428–99 11–4 for all i, j.

It is easy to see that X_{1} ≡ Y_{1} (mod m), X_{2} ≡ Y_{2} (mod m) ⟹ X_{1}+X_{2} ≡ Y_{1}+Y_{2} (mod m), X_{1}X_{2} ≡ Y_{1}Y_{2} (mod m). In other words, the map

Θ(n) : Mat(n, ℤ) → Mat(n, ℤ/(n))

under which

X ↦ X mod n

is a ring-homomorphism. Definition 11.3 For each n ∈ ℕ(n ≠ 0) we define the subgroup Γ(n) ⊂ Γ by

Γ(n) = {X̄ : X ≡ I mod n}.

In other words, Γ(n) consists of the transformations

z ↦ \frac{az + b}{cz + d}

with

a ≡ d ≡ 1 (mod n), b ≡ c ≡ 0 (mod n).

Proposition 11.3 Γ(n) = \overline{ker Θ_{n}}. Theorem 11.2 Γ(n) is a normal subgroup of Γ, of finite index

[Γ : Γ(n)] = ∏_{p|n}(p^{3} − p).

Proof ▶

◀

428–99 11–5

Appendix A

The Structure of Finitely-Generated Abelian Groups

A.1 Finitely-generated abelian groups

Definition A.1 The abelian group A is said to be generated by the subset S ⊂ A if each element a ∈ A is expressible in the form

a = n_{1}s_{1} + ⋯ + n_{r}s_{r} (n_{i} ∈ ℤ, s_{i} ∈ S).

A is said to be finitely-generated if it is generated by a finite set {a_{1}, …, a_{r}} ⊂ A. We write A = ⟨a_{1}, …, a_{r}⟩ in this case.

Proposition A.1 If

0 → A → B → C → 0

is an exact sequence of abelian groups then B is finitely-generated if and only if A and C are both finitely-generated.

Proof ▶ Suppose B is generated by {b_{1}, …, b_{r}}. Then the quotient-group C is generated by the images \{\overline{b_{1}}, …, \overline{b_{r}}\}.

To see that any subgroup A ⊂ B is also finitely-generated, we argue by induction on r, the number of generators. The quotient-group B/⟨b_{1}⟩ is generated by r − 1 elements. Hence by induction

A/A ∩ ⟨b_{1}⟩ ⊂ B/⟨b_{1}⟩

is finitely-generated, by {a_{1}, …, a_{s}} say. But a subgroup of a cyclic group is cyclic; and so

A ∩ ⟨b_{1}⟩ = ⟨a⟩, say. Thus

A = ⟨a, a_{1}, …, a_{s}⟩.

Conversely, suppose A is generated by {a_{1}, …, a_{r}}. and C is generated by \{\overline{b_{1}}, …, \overline{b_{s}}\}, where b_{1}, …, b_{s} ∈ B. Then it is readily verified that B is generated by {a_{1}, …, a_{r}, b_{1}, …, b_{s}}. ◀

A.2 Torsion groups

Recall that an abelian group is said to be a torsion group if every element is of finite order; conversely, it is said to be torsion-free if 0 is the only element of finite order. Evidently a finite abelian group is a torsion group; while a torsion-free group is necessarily infinite.

Proposition A.2 The elements of finite order in an abelian group A form a subgroup

F = {a ∈ A : na = 0 for some n ∈ ℕ, n ≠ 0}.

Proof ▶ To see that F is a subgroup, note that

a, b ∈ F ⟹ ma = 0, nb = 0 ⟹ mn(a + b) = 0 ⟹ a + b ∈ F.

◀

Definition A.2 We call F the torsion subgroup of A. The elements of F, ie the elements of finite order in A, are called torsion elements of A.

Proposition A.3 The torsion group F of a finitely-generated abelian group A is finite.

Proof ▶ This follows at once from Propositions A.1 and the following

Lemma 21 A finitely-generated torsion group is necessarily finite.

Proof of Lemma ▷ Suppose A is generated by {a_{1}, …, a_{r}}, and suppose a_{i} is

of order d_{i} for 1 ≤ i ≤ r. Then each element a ∈ A is expressible in the form

a = n_{1}a_{1} + ⋯ + n_{r}a_{r}

where

0 ≤ n_{i} < d_{i}.

Thus

∥A∥ ≤ d_{1} ⋯ d_{r}.

◁ ◀

Proposition A.4 The quotient-group A/F is torsion-free.

Proof ▶ Suppose nā = 0, where a ∈ A. Then na ∈ F. Hence mna = 0 for some m. Thus a is of finite order, ie a ∈ F. In other words, ā = 0. ◀

The last 2 Propositions allow us to divide our task — the study of finitelygenerated abelian groups — into 2 parts: finite abelian groups, and finitelygenerated torsion-free abelian groups. These are the subjects of the next 2 sections.

A.3 Finite Abelian Groups

Proposition A.5 Suppose A is an abelian group. For each prime p, the elements of order p^{n} in A for some n ∈ N form a subgroup

A_{p} = {a ∈ A : p^{n}a = 0 for some n ∈ ℕ}.

Proof ▶ Suppose a, b ∈ A_{p}. Then

p^{m}a = 0, p^{n}b = 0,

for some m, n. Hence

p^{m+n}(a + b) = 0,

and so a + b ∈ A_{p}. ◀

Definition A.3 We call A_{p} the p-component of A.

Proposition A.6 Suppose A is an abelian group. Then the torsion subgroup F is the direct sum of the A_{p}:

F = ⊕_{p}A_{p}.

Proof ▶ Suppose a ∈ F, say na = 0. Let

n = p_{1}^{e_{1}} ⋯ p_{r}^{e_{r}};

and set

m_{i} = n/e_{i}^{p_{i}}.

Then gcd(m_{1}, …, m_{r}) = 1, and so we can find n_{1}, …, n_{r} such that

m_{1}n_{1} + ⋯ + m_{r}n_{r} = 1.

Thus

a = a_{1} + ⋯ + a_{r},

where

a_{i} = m_{i}n_{i}a.

But

p_{i}^{e_{i}}a_{i} = (p_{i}^{e_{i}}m_{i})n_{i}a = nn_{i}a = 0

(since na = 0). Hence

a_{i} ∈ A_{p_{i}}.

Thus A is the sum of the subgroups A_{p}.

To see that this sum is direct, suppose

a_{1} + ⋯ + a_{r} = 0,

where a_{i} ∈ A_{p_{i}}, with distinct primes p_{1}, …, p_{r}. Suppose

p_{i}^{e_{i}}a_{i} = 0.

Let

m_{i} = p_{1}^{e_{1}} ⋯ p_{i−1}^{e_{i−1}}p_{i+1}^{e_{i+1}} ⋯ p_{r}^{e_{r}}.

Then

m_{i}a_{j} = 0 if i ≠ j.

Thus (multiplying the given relation by m_{i}),

m_{i}a_{i} = 0.

But gcd(m_{i}, p_{i}^{e_{i}}) = 1. Hence we can find m, n such that

mm_{i} + np_{i}^{e_{i}} = 1.

But then

a_{i} = m(m_{i}a_{i}) + n(p_{i}^{e_{i}}a_{i}) = 0.

We conclude that A is the direct sum of its p-components A_{p}. ◀

Proposition A.7 If A is a finitely-generated abelian group then A_{p} = 0 for almost all p, ie for all but a finite number of p.

Proof ▶ The torsion subgroup F ⊂ A is finite, by Proposition reffinite. Thus the orders of all the elements of F have only a finite number of prime factors. If p is not among these primes then evidently A_{p} = 0. ◀ Theorem A.1 Suppose A is a finite abelian p-group (ie each element is of order p^{e} for some e). Then A can be expressed as a direct sum of cyclic p-groups:

A = ℤ/(p^{e_{1}}) ⊕ ⋯ ⊕ ℤ/(p^{e_{r}}).

Moreover the powers p^{e_{1}}, …, p^{e_{r}} are uniquely determined by A.

Proof ▶ We argue by induction on ∥A∥ = p^{n}. We may assume therefore that the result holds for the subgroup

pA = {pa : a ∈ A}.

For pA is stricty smaller than A, since

pA = A ⟹ p^{n}A = A,

while we know from Lagrange’s Theorem that p^{n}A = 0.

Suppose

pA = ⟨pa_{1}⟩ ⊕ ⋯ ⊕ ⟨pa_{r}⟩.

Then the sum

⟨a_{1}⟩ + ⋯ + ⟨a_{r}⟩ = B,

say, is direct. For suppose

n_{1}a_{1} + ⋯ + n_{r}a_{r} = 0.

If p | n_{1}, …, n_{r}, say n_{i} = pm_{i}, then we can write the relation in the form

m_{1}(pa_{1}) + ⋯ + m_{r}(pa_{r}) = 0,

whence m_{i}pa_{i} = n_{i}a_{i} = 0 for all i.

On the other hand, if p does not divide all the n_{i} then

n_{1}(pa_{1}) + ⋯ + n_{r}(pa_{r}) = 0,

and so pn_{i}a_{i} = 0 for all i. But if p |̸ n_{i} this implies that pa_{i} = 0. (For the order of a_{i} is a power of p, say p^{e}; while p^{e} | n_{i}p implies that e ≤ 1.) But this contradicts our choice of pa_{i} as a generator of a direct summand of pA. Thus the subgroup B ⊂ A is expressed as a direct sum

B = ⟨a_{1}⟩ ⊕ ⋯ ⊕ ⟨a_{r}⟩.

Let

K = {a ∈ A : pa = 0}.

Then

A = B + K.

For suppose a ∈ A. Then pa ∈ pA, and so

pa = n_{1}(pa_{1}) + ⋯ + n_{r}(pa_{r})

for some n_{1}, …, n_{r} ∈ ℤ. Thus

p(a − n_{1}a_{1} − ⋯ − n_{r}a_{r}) = 0,

and so

a − n_{1}a_{1} − ⋯ − n_{r}a_{r} = k ∈ K.

Hence

a = (n_{1}a_{1} + ⋯ + n_{r}a_{r}) + k ∈ B + K.

If B = A then all is done. If not, then K ⊄ B, and so we can find k_{1} ∈ K, k_{1} ∉ B. Now the sum

B_{1} = B + ⟨k_{1}⟩

is direct. For ⟨k_{1}⟩ is a cyclic group of order p, and so has no proper subgroups. Thus

B ∩ ⟨k_{1}⟩ = {0},

and so

B_{1} = B ⊕ ⟨k_{1}⟩

If now B_{1} = A we are done. If not we can repeat the construction, by choosing k_{2} ∈ K, k_{2} ∉ B_{1}. As before, this gives us a direct sum

B_{2} = B_{1} ⊕ ⟨k_{2}⟩ = B ⊕ ⟨k_{1}⟩ ⊕ ⟨k_{2}⟩.

Continuing in this way, the construction must end after a finite number of steps (since A is finite):

A = B_{s} = B ⊕ ⟨k_{1}⟩ ⊕ ⋯ ⊕ ⟨k_{s}⟩
= ⟨a_{1}⟩ ⊕ ⋯ ⊕ ⟨a_{r}⟩ ⊕ ⟨k_{1}⟩ ⊕ ⋯ ⊕ ⟨k_{s}⟩.

It remains to show that the powers p^{e_{1}}, …, p^{e_{r}} are uniquely determined by A. This follows easily by induction. For if A has the form given in the theorem then

pA = ℤ/(p^{e_{1}−1}) ⊕ ⋯ ⊕ ℤ/(p^{e_{r}−1}).

Thus if e > 1 then ℤ/(p^{e}) occurs as often in A as ℤ/(p^{e−1}) does in pA. It only remains to deal with the factors ℤ/(p). But the number of these is now determined by the order ∥A∥ of the group. ◀

Remark: It is important to note that if we think of A as a direct sum of cyclic subgroups, then the orders of these subgroups are uniquely determined, by the theorem; but the actual subgroups themselves are not in general uniquely determined. In fact the only case in which they are uniquely determined (for a finite p-group A) is if A is itself cyclic,

A = ℤ/(p^{e}),

in which case of course there is just one summand.

To see this, it is sufficient to consider the case of 2 summands:

A = ℤ/(p^{e}) ⊕ ℤ/(p^{f}).

We may suppose that e ≥ f. Let a_{1}, a_{2} be the generators of the 2 summands. Then it is easy to see that we could equally well take a′_{1} = a_{1} + a_{2} in place of a_{1}:

A = ⟨a_{1} + a_{2}⟩ ⊕ ⟨a_{2}⟩.

For certainly these elements a_{1} +a_{2}, a_{2} generate the group; and the sum must be direct, since otherwise there would not be enough terms m_{1}a′_{1} + m_{2}a_{2} to give all the p^{e+f} elements in A.

A.4 Torsion-free Abelian Groups

Definition A.4 To each abelian group A we associate the vector space V = V (A) over ℚ given by

V = A ⊗_{ℤ} ℚ.

Remarks:

1. Concretely, we construct V from A as follows. Each element v ∈ V is

of the form

v = λa (λ ∈ ℚ, a ∈ A).

Two elements

v = λa, w = μb.

are equal if we can find m, n, N such that

λ = \frac{m}{N}, μ = \frac{n}{N} , ma = nb.

In other words, a linear relation

λ_{1}v_{1} + ⋯ + λ_{r}v_{r} = 0

holds in V if when multiplied by some integer N with Nλ_{1}, …, Nλ_{r} ∈ ℤ it yields a relation that holds in A.

2. We can put this in a more general setting. Recall that a module M over a ring R (not necessarily commutative, but with identity element 1) is defined by giving an abelian group A on which R acts so that

(a) λ(μm) = (λμ)m;

(b) (λ + μ)m = λm + μm;

(c) λ(m + n) = λm + λn;

(d) 1m = m.

There are 2 special cases of importance. Firstly, a module over a field k is just a vector space over k. Thus the concept of a module may be seen as a natural generalisation of that of a vector space, in which the scalars are allowed to form a ring.

Secondly, a module over the integers ℤ is just an abelian group.

Suppose

ϕ : R → S

is a ring-homomorphism. Then each R-module M gives rise to an Smodule N, where

N = S ⊗_{R} M.

Concretely, each element n ∈ N is expressible as a sum

n = s_{1}m_{1} + ⋯ + s_{r}m_{r},

with addition and scalar multiplication being defined in the natural way. We have a natural map

M → N : m ↦ 1 · m.

Our case arises in this way from the natural injection

i : ℤ → ℚ.

It is a special case in so far as each element of V is expressible as a single element λa rather than a sum of such elements. As we just observed, we have a natural group homomorphism

A → V : a ↦ 1 · a.

3. In the language of categories and functors, we have a covariant functor

F : A → V

from the category A of abelian groups to the category V of vector spaces over ℚ.

Definition A.5 The rank r(A) of the abelian group A is defined to be the dimension of V:

r(A) = dim_{ℚ} V.

Proposition A.8 A finitely-generated abelian group has finite rank.

Proof ▶ If A = ⟨a_{1}, …, a_{n}⟩ then 1 · a_{1}, …, 1 · a_{n} span V, and so

r(A) ≤ n.

◀

Proposition A.9 Suppose A is an abelian group. Then the map

A → V : a ↦ 1 · a

is a homomorphism of abelian groups, with kernel F.

Proof ▶ Suppose a ↦ 0, ie 1 · a = 0 in V. By definition this means that Na = 0 for some N ∈ ℕ (N ≠ 0). In other words, a ∈ F. ◀

Corollary 1 An abelian group A is of rank 0 if and only if it is a torsion group.

Corollary 2 A torsion-free abelian group A can be embedded in a vector space V over ℚ:

A ⊂ V.

Theorem A.2 A finitely-generated torsion-free abelian group A is necessarily free, ie A is expressible as a direct sum of copies of the integers ℤ:

A = rℤ = ℤ ⊕ ⋯ ⊕ ℤ.

Proof ▶ We have seen that A ⊂ V, where V is a finite-dimensional vector space over ℚ. Suppose a_{1}, …, a_{n} generate A. Then these elements span V. Hence we can choose a basis for V from among them. After re-ordering we may suppose the a_{1}, …, a_{r} form a basis for V.

We derive a ℤ-basis b_{1}, …, b_{r} for A as follows. Choose b_{1} to be the smallest positive multiple of a_{1} in A:

b_{1} = λ_{1}a_{1} ∈ A.

(It is easy to see that λ_{1} = 1/m_{1} for some m ∈ ℕ.)

Now choose b_{2} to be an element of A in the vector subspace ⟨a_{1}, a_{2}⟩ with smallest positive second coefficient

b_{2} = μ_{1}a_{1} + λ_{2}a_{2} ∈ A.

(Again, it is easy to see that λ_{2} = 1/m_{2} for some m ∈ ℕ.)

Continuing in this way, choose b_{i} to be an element of A in the vector subspace ⟨a_{1}, …, a_{i}⟩ with smallest positive ith coefficient

b_{i} = μ_{1}a_{1} + ⋯ + μ_{i−1}a_{i−1} + λ_{i}a_{i} ∈ A.

(Once again, it is easy to see that λ_{i} = 1/m_{i} for some m ∈ ℕ.)

Finally, we choose b_{r} to be an element of A with smallest positive last coefficient

b_{r} = μ_{1}a_{1} + ⋯ + μ_{r−1}a_{i−1} + λ_{r}a_{i} ∈ A.

We assert that b_{1}, …, b_{r} forms a ℤ-basis for A. For suppose a ∈ A. Let

a = ρ_{r,1}a_{1} + ⋯ + ρ_{r,r}a_{r},

where ρ_{1}, …, ρ_{r} ∈ ℚ. The last coefficient ρ_{r,r} must be an integral multiple of λ_{r},

ρ_{r,r} = n_{r}λ_{r}.

For otherwise we could find a combination ma + nb_{r} with last coefficient positive but smaller than λ_{r}.

But now

a − n_{r}b_{r} ∈ ⟨a_{1}, …, a_{r−1}⟩,

say

a − n_{r}b_{r} = ρ_{r−1,1}a_{1} + ⋯ + ρ_{r−1,r−1}a_{r−1}.

By the same argument, the last coefficient ρ_{r−1,r−1} is an integral multiple of λ_{r−1}.

ρ_{r−1,r−1} = n_{r−1}λ_{r−1},

and so

a − n_{r}b_{r} − n_{r−1}b_{r−1} ∈ ⟨a_{1}, …, a_{r−2}⟩.

Continuing in this fashion, we find finally that

a = n_{r}b_{r} + n_{r−1}b_{r−1} + n_{1}b_{1},

with n_{r}, …, n_{1} ∈ ℤ. Thus b_{1}, …, b_{r} forms a ℤ-basis for A, and

A = ℤb_{1} ⊕ ⋯ ⊕ ℤb_{r} ≡ rℤ.

◀

Remark: We can think of the summands ℤ as subgroups of A. But it should be noted that these subgroups are not unique, unless A = ℤ. For there are many ways of splitting ℤ ⊕ ℤ into 2 direct summands. In fact, if the generators of these summands are e, f,

A = ℤe ⊕ ℤf,

then we can take as generators any pair

n_{11}e + n_{12}f, n_{21}e + n_{22}f,

(where n_{11}, n_{12}, n_{21}, n_{22} ∈ ℤ) provided

det ( \begin{matrix}n_{11} & n_{12} \\ n_{21} & n_{22} \end{matrix} ) = ±1,

that is, the matrix must be unimodular.

The corresponding result holds for rℤ: any unimodular transformation will give us a new expression for the group as a direct sum of subgroups isomorphic to ℤ.

Theorem A.3 Every finitely-generated abelian group A is the direct sum of its torsion group F and a torsion-free group P:

A = F ⊕ P.

Proof ▶ Let F be the torsion subgroup of A.

Lemma 22 The quotient-group

Q = A/F

is torsion-free.

Proof of Lemma ▷ For suppose ā ∈ Q (where a ∈ A) has finite order, say

nā = 0, for some n > 0. In other words, na ∈ F. But then m(na) = 0 for some m > 0. Thus a is of finite order, ie a ∈ F, and so ā = 0. ◁

It follows from Proposition A.2 that Q is a direct sum of copies of ℤ:

Q = ℤ ⊕ ⋯ ⊕ ℤ.

Choose elements a_{1}, …, a_{r} in A mapping onto the elements (1, 0, …, 0), …, (0, 0, …, 1) in Q; and let

P = ⟨a_{1}, …, a_{r}⟩.

We shall show that A = F ⊕ P.

Recall that the abelian group A is the direct sum of the subgroups B and C,

A = B ⊕ C,

if and only if

1. B ∩ C = {0};

2. A = B + C, ie each element a ∈ A is expressible in the form a = b + c, with b ∈ B, c ∈ C.

We apply this with B = F, C = P. Firstly, F ∩ P = {0}. For suppose a ∈ F ∩ P. Since a ∈ P,

a = n_{1}a_{1} + ⋯ + n_{r}a_{r}

for some n_{1}, …, n_{r} ∈ ℤ. Since a ∈ F, we have na = 0 for some n > 0. Thus

nn_{1}a_{1} + ⋯ + nn_{r}a_{r} = 0.

It follows — going over to the quotient group Q — that

nn_{1}e_{1} + ⋯ + nn_{r}e_{r} = 0.

But that implies that nn_{1} = ⋯ = nn_{r} = 0, since e_{1}, …, e_{r} form a ℤ-basis for Q. Thus n_{1} = ⋯ = n_{r} = 0, and so a = 0, ie F ∩ P = {0}.

Secondly, suppose a ∈ A. Then ā ∈ Q can be expressed in the form

ā = m_{1}e_{1} + ⋯ + m_{r}e_{r},

for some m_{1}, …, m_{r} ∈ ℤ. But then

a − m_{1}a_{1} − ⋯ − m_{r}a_{r} = f ∈ F.

Thus

a = f + m_{1}a_{1} + ⋯ + m_{r}a_{r} ∈ F + P.

It follows that

A = F ⊕ P.

◀

Corollary Every finitely-generated abelian group A is the direct sum of a finite group F and a number of copies of ℤ:

A = F ⊕ ℤ ⊕ ⋯ ⊕ ℤ.

Remark: While F is unique — it is the torsion subgroup of A — the subgroups corresponding to the copies of ℤ not in general unique.

In fact the only cases in which the subgroups are unique is if either the group is finite (so that A = F) or else A = ℤ (so that F = 0 and there is just one copy of Z). For we can split

A = F ⊕ ℤ

in many ways if F ≠ {0}. In fact if e is a generator of ℤ,

A = F ⊕ ⟨e⟩,

then we can replace e by e + f, where f is any element of F:

A = F ⊕ ⟨e + f⟩,

For e + f has infinite order, and so every non-zero element of ⟨e + f⟩ also has infinite order. Hence

F ∩ ⟨e + f⟩ = {0},

and so the sum is direct.

A.5 The Structure Theorem

Putting together the results of the last 3 sections, we derive the Structure Theorem for Finitely-Generated Abelian Groups.

Theorem A.4 Every finitely-generated abelian group A is expressible as a direct sum of cyclic groups (including ℤ):

A = ℤ/(p^{e_{1}}) ⊕ ⋯ ⊕ ℤ/(p^{e_{s}}) ⊕ ℤ ⊕ ⋯ ⊕ ℤ.

Moreover the prime-powers p_{1}^{e_{1}}, …, p_{s}^{e_{s}} and the number of copies of ℤ are uniquely determined by A.

Remark: If we think of the Theorem as expressing A as a direct sum of cyclic subgroups, then in general these subgroups will not be unique, although their orders (p^{e} or ∞) will be.

The only case in which the expression will be unique is if A is cyclic. For if that is so then either A = ℤ or else A is a finite cyclic group ℤ/(n). In this last case each p-component A_{p} is also cyclic, since every subgroup of a cyclic abelian group is cyclic. Thus the expression for A as a direct sum in the Theorem is just the splitting of A into its p-components A_{p}; and we know that this is unique.

Conversely, if A is not cyclic, then either

1. A has at least 2 ℤ summands; or

2. A has a component ℤ and F ≠ {0}; or

3. some component A_{p} is not cyclic.

In each of these cases we have seen above that the splitting is not unique.

Appendix B

Fermat’s Last Theorem when n = 4

B.1 The Case n = 2

The equation

x^{2} + y^{2} = z^{2}

certainly has solutions, eg (3, 4, 5) and (5, 12, 13). This does not contradict Fermat’s Last Theorem, of course, since that only asserts there is no solution if n > 2.

Pythagoras already knew that this equation (with n = 2) had an infinity of solutions; and Diophantus later found all the solutions, following the technique below.

In the first place, we may assume that

gcd(x, y, z) = 1.

We may also assume that x, y, z > 0. We shall use the term Pythagorean triple for a solution with these properties.

Note that modulo 4

x^{2} = \begin{cases}0 mod 4 & if x is even, \\ 1 mod 4 & if x is odd. \end{cases}

It follows that x and y cannot both be odd; for then we would have z^{2} = 2 mod 4, which is impossible. Thus just one of x and y is even; and so z must be odd. We can assume without loss of generality that x is even, say x = 2X. Our equation can then be written

4X^{2} = z^{2} − y^{2} = (z + y)(z − y).

We know that 2 | z + y, 2 | z − y, since y, z are both odd. On the other hand no other factor can divide z + y and z − y:

gcd(z + y, z − y) = 2.

For

d | z + y, z − y ⟹ d | 2y, 2z.

It follows that

z + y = 2u^{2}, z − y = 2v^{2}, x = 2uv.

Thus

(x, y, z) = (2uv, u^{2} − v^{2}, u^{2} + v^{2}).

where gcd(u, v) = 1. Note that just one of u, v must be odd; for if both were odd, x, y, z would all be even.

Every Pythagorean triple arises in this way from a unique pair (u, v) with gcd(u, v) = 1, u > v > 0, and just one of u, v odd. The uniqueness follows from the fact that

(u + v)^{2} = z + x, (u − v)^{2} = z − x.

For this shows that x, y, z determine u + v and u − v, and therefore u and v.

B.2 The Case n = 4

The only case of his “Theorem” that Fermat actually proved, as far as we know, was the case n = 4:

x^{4} + y^{4} = z^{4}.

His proof was based on a technique which he invented: the Method of Infinite Descent. Basically, this consists in showing that from any solution of the equation in question one can construct a second, smaller, solution.

Actually, we are going to apply this to the Diophantine equation

x^{4} + y^{4} = z^{2}.

If we can show that this has no solution in non-zero integers, then the same will be true a fortiori of Fermat’s equation with n = 4.

Suppose (x, y, z) is a solution of this equation. As before we may and shall suppose that x, y, z > 0 and gcd(x, y.z) = 1. Evidently (x^{2}, y^{2}, z) is then a Pythagorean triple, and so can be expressed in the form (swapping x, y if necessary)

x^{2} = 2ab, y^{2} = a^{2} − b^{2}, z = a^{2} + b^{2},

where a, b are positive integers with gcd(a, b) = 1. Since x is even, 4 | x^{2}, and therefore just one of a and b must be even.

If a were even and b were odd, then a^{2} − b^{2} = 3 mod 4, so the second equation y^{2} = a^{2} − b^{2} would be untenable. Thus b is even, and so from the first equation x^{2} = 2ab we can write

a = u^{2}, b = 2v^{2}, x = 2uv,

where gcd(u, v) = 1, and u, v > 0.

The second equation now reads

y^{2} = u^{4} − 4v^{4}.

Thus

4v^{4} + y^{2} = u^{4},

and so (2v^{2}, y, u^{2}) is a Pythagorean triple. It follows that we can write

2v^{2} = 2st, y = s^{2} − t^{2}, u^{2} = s^{2} + t^{2},

where gcd(s, t) = 1. From the first equation we can write

s = X^{2}, t = Y^{2}, v = XY,

where gcd(X, Y) = 1, and X, Y > 0; and so on writing Z for u the third equation reads

X^{4} + Y^{4} = Z^{2},

which is just the equation we started from. So from any solution (x, y, z) of the equation

x^{4} + y^{4} = z^{2}

with gcd(x, y, z) = 1, x, y > 0 and x even, we obtain a second solution (X, Y, Z) with gcd(X, Y, Z) = 1, X, Y > 0 and X even, where

x = 2uv = 2XY Z,
y = s^{2} − t^{2} = X^{4} − Y^{4},
z = a^{2} + b^{2} = u^{4} + v^{4} = Z^{4} + X^{4}Y^{4}.

The new solution is evidently smaller than the first in every sense. In particular,

Z < z^{1/4};

so our infinite chain must (rapidly) lead to a contradiction, and Fermat’s Last Theorem is proved for n = 4.

Appendix C

Fermat’s Last Theorem when n = 3

Having proved Fermat’s Last Theorem for n = 4, it only (?) remains to prove it for odd primes 3, 5, 7, 11, . . .. It is convenient in this case to take the equation in symmetric form

x^{p} + y^{p} + z^{p} = 0

(on replacing z by −z).

Our proof for p = 3 is based, like that for n = 4, on Fermat’s Method of Infinite Descent. But now we have to mix in a little algebraic number theory.

C.1 Algebraic numbers

Definition C.1 A number α ∈ ℂ is said to be algebraic if it satisfies a polynomial equation

f(x) = x^{n} + a_{1}x^{n−1} + ⋯ + a_{n} = 0

with rational coefficients a_{i} ∈ ℚ.

For example, \sqrt{2} and i are algebraic.

A number is said to be transcendental if it is not algebraic. Both e and π are transcendental. It is in general extremely difficult to prove a number transcendental, and there are many open problems in this area, eg it is not known if π^{e} is transcendental.

Proposition C.1 The algebraic numbers form a field ℚ̄ ⊂ ℂ.

Proof ▶ If α satisfies the equation f(x) = 0 then −α satisfies f(−x) = 0, while 1/α satisfies x^{n}f(1/x) = 0 (where n is the degree of f(x)). It follows that −α and 1/α are both algebraic. Thus it is sufficient to show that if α, β are algebraic then so are α + β, αβ.

Suppose α satisfies the equation

f(x) ≡ x^{m} + a_{1}x^{m−1} + ⋯ + a_{m} = 0,

and β the equation

g(x) ≡ x^{n} + b_{1}x^{n−1} + ⋯ + b_{n} = 0.

Consider the vector space

V = ⟨α^{i}β^{j} : 0 ≤ i < m, 0 ≤ j < n⟩

over ℚ spanned by the mn elements α^{i}β^{j}. Evidently

α + β, αβ ∈ V.

But if θ ∈ V then the mn + 1 elements

1, θ, θ^{2}, …, θ^{mn}

are necessarily linearly dependent (over ℚ), since dim V ≤ mn. In other words θ satisfies a polynomial equation of degree ≤ mn. Thus each element θ ∈ V is algebraic. In particular α + β and αβ are algebraic. ◀

C.2 Algebraic integers

Definition C.2 A number α ∈ ℂ is said to be an algebraic integer if it satisfies a polynomial equation

f(x) = x^{n} + a_{1}x^{n−1} + ⋯ + a_{n} = 0

with integral coefficients a_{i} ∈ ℤ.

Proposition C.2 The algebraic integers form a ring ℤ̄ ⊂ ℚ̄. That is, if α, β are algebraic integers, then so are α + β, α − β and αβ.

Proof ▶ If α is a root of the monic polynomial f(x) then −α is a root of the monic polynomial f(−x). It follows that if α is an algebraic integer then so is −α. Thus it is sufficient to show that if α, β are algebraic integers then so are α + β, αβ.

Suppose α satisfies the equation

f(x) ≡ x^{m} + a_{1}x^{m−1} + ⋯ + a_{m} = 0 (a_{1}, …, a_{m} ∈ ℤ),

and β the equation

g(x) ≡ x^{n} + b_{1}x^{n−1} + ⋯ + b_{n} = 0 (b_{1}, …, b_{n} ∈ ℤ).

Consider the abelian group (or ℤ-module)

M = ⟨α^{i}β^{j} : 0 ≤ i < m, 0 ≤ j < n⟩

generated by the mn elements α^{i}β^{j}. Evidently

α + β, αβ ∈ V.

As a finitely-generated torsion-free abelian group, M is isomorphic to ℤ^{d} for some d. Moreover M is noetherian, ie every increasing sequence of subgroups of M is stationary: if

S_{1} ⊂ S_{2} ⊂ S_{3} ⋯ ⊂ M

then for some N,

S_{N} = S_{N+1} = S_{N+2} = · · · .

Suppose θ ∈ M. Consider the increasing sequence of subgroups

⟨1⟩ ⊂ ⟨1, θ⟩ ⊂ ⟨1, θ, θ^{2}⟩ ⊂ · · · .

This sequence must become stationary; that is to say, for some N

θ^{N} ∈ ⟨1, θ, …, θ^{N−1}⟩.

In other words, θ satisfies an equation of the form

θ^{N} = a_{1}θ^{N−1} + a_{2}θ^{N−2} + · · · .

Thus every θ ∈ M is an algebraic integer. In particular α + β and αβ are algebraic integers. ◀

Proposition C.3 A rational number c ∈ ℚ is an algebraic integer if and only if it is a rational integer:

ℤ̄ ∩ ℚ = ℤ.

Proof ▶ Suppose c = m/n, where gcd(m, n) = 1; and suppose c satisfies the equation

x^{d} + a_{1}x^{d−1} + ⋯ + a_{d} = 0 (a_{i} ∈ ℤ).

Then

m^{d} + a_{1}m^{d−1}n + ⋯ + a_{d}n^{d} = 0.

Since n divides every term after the first, it follows that n | m^{d}. But that is incompatible with gcd(m, n) = 1, unless n = 1, ie c ∈ ℤ. ◀

Definition C.3 A number α ∈ ℂ is said to be a unit if both α and 1/α are algebraic integers.

Any root of unity, ie any number satisfying x^{n} = 1 for some n, is a unit. But these are not the only units; for example, \sqrt{2} − 1 is a unit. The units form a multiplicative subgroup of ℚ̄^{×}.

C.3 The field ℚ(ω)

Let

ω = e^{2πi/3}.

Then ω^{3} = 1; more precisely,

ω^{2} + ω + 1 = 0.

Proposition C.4 The numbers of the form

a + ωb (a, b ∈ ℚ)

form a field.

Proof ▶ ℚ(ω) is closed under addition, subtraction and multiplication. It only remains to show that it is closed under division. Suppose θ ∈ ℚ(ω), θ ≠ 0. Since ℚ(ω) is a vector space of dimension 2 over ℚ, the elements 1, θ, θ^{2} are linearly dependent over ℚ, ie θ satisfies an equation of degree 1 or 2 over ℚ.

If θ satisfies an equation of degree 1 over ℚ then θ ∈ ℚ, and so 1/θ ∈ ℚ ⊂ ℚ(ω).

Suppose θ satisfies the equation

θ^{2} + bθ + c = 0.

We may suppose c ≠ 0 (or else divide the equation by θ). Then

θ^{−1} = −c^{−1}θ − c^{−1}b ∈ ℚ(ω).

◀

C.3.1 Automorphisms and norms

The conjugacy automorphism

z ↦ z̄: ℂ → ℂ

of the complex numbers induces an automorphism of ℚ(ω), under which

ω ↦ ω̄ = ω^{2},

and more generally

a + ωb ↦ a + ω^{2}b = (a − b) − bω.

If ξ = a+ωb, we call ξ̄ = a+ω^{2}b the conjugate of ξ in ℚ(ω). If ξ satisfies a polynomial equation f(x) = with coefficients in ℚ, then so does its conjugate ξ̄. (This follows on applying the automorphism to the equation f(ξ) = 0. The coefficients of f will be left untouched, since they lie in ℚ, while each power ξ^{n} will be replaced by ξ̄^{n}.) In particular, if ξ is an algebraic integer, then so is ξ̄

The product

N(ξ) = ξξ̄ = |ξ|^{2}

is called the norm of ξ. Clearly the norm is multiplicative:

N(αβ) = N(α)N(β).

C.4 The ring ℤ[ω]

Which numbers in ℚ(ω) are algebraic integers? The answer is not obvious.

Certainly ω is an algebraic integer, since it satisfies x^{3} − 1 = 0; and so are all the numbers in the set ℤ[ω] consisting of numbers of the form

a + ωb (a, b ∈ ℤ)

since the algebraic integers are closed under addition and multiplication.

Proposition C.5 The algebraic integers in ℚ(ω) are just the elements of ℤ[ω].

Proof ▶ Suppose

ξ = a + ωb (a, b ∈ ℚ)

is an algebraic integer. Then so is its conjugate

ξ̄ = a + ω^{2}b = (a − b) − ωb.

Hence

ξ + ξ̄ = 2a − b

is an algebraic integer. Since this number is rational, it follows that

2a − b ∈ ℤ.

Similarly

ωξ = −b + ω(a − b)

is an algebraic integer, and so by the previous argument

−2b − (a − b) = −a − b ∈ Z.

We deduce that

3a, 3b ∈ ℤ;

say

a = \frac{r}{3}, b = \frac{s}{3},

where r, s ∈ ℤ.

But we also know that

N(ξ) = ξξ̄ = a^{2} − ab + b^{2}

is an algebraic integer, and therefore a rational integer. This means that

r^{2} − rs + s^{2} = 0 mod 9.

It is readily verified that this is only soluble if r, s = 0 mod 3, ie if a, b ∈ ℤ.

◀

C.5 Units in ℤ[ω]

Proposition C.6 There are just 6 units in ℤ[ω]:

±1, ±ω, ±ω^{2}.

Proof ▶ Suppose ϵ is a unit. Then

N(ϵ)N(ϵ^{−1}) = 1.

It follows that

N(ϵ) = 1.

Conversely, if N(ϵ) = 1 then ϵ is a unit, since

N(ϵ) = ϵϵ̄ = 1 ⟹ ϵ^{−1} = ϵ̄ ∈ ℤ[ω].

Thus we have to find all ϵ = a + ωb with a, b ∈ ℤ satisfying

N(ϵ) = a^{2} − ab + b^{2} = 1.

This equation can be re-written:

(2a − b)^{2} + 3b^{2} = 4.

Evidently b = 0, ±1. It is a trivial matter to consider these cases separately, and deduce that the only solutions are the 6 listed above. ◀

We say that π ∈ ℤ[ω] is a prime if for every factorisation

π = αβ (α, β ∈ ℤ[ω])

either α or β is a unit.

If π is a prime then so is ϵπ for any unit ϵ. Two primes that differ only by a unit factor are said to be equivalent, and we write

π ≡ π′ = ϵπ.

In general, we do not distinguish between equivalent primes.

C.6 Unique Factorisation in ℤ[ω]

Let us recall the main steps in the proof of unique factorisation in ℤ (or ℕ):

Division with Remainder Suppose a, b ∈ Z, with b ≠ 0. Then we can

find q ∈ Z such that

a = bq + r,

where

|r| < |b|.

The Euclidean Algorithm This is a procedure for determining the greatest common divisor gcd(a, b) = d of a, b ∈ ℤ. We start by dividing a by b:

a = q_{1}b + r_{1},

where |r_{1}| < |b|. Now we divide b by the remainder r_{1}:

b = q_{2}r_{1} + r_{2},

where |r_{2}| < |r_{1}|. We continue in this way, successively dividing remainders:

r_{1} = q_{3}r_{2} + r_{3},
r_{2} = q_{4}r_{3} + r_{4},
…

At some point, the process must terminate when an exact division occurs (with zero remainder):

r_{n−1} = q_{n+1}r_{n}.

For the remainders have been getting steadily smaller:

|b| > |r_{1}| > |r_{2}| > …

and so must ultimately vanish.

The last non-zero remainder is the sought-for gcd:

d = gcd(a, b) = r_{n}.

For d | r_{n−1}, from the last line of the algorithm. Hence d | r_{n−2} from the previous line; and so, working up the algorithm,

d | r_{n−3}, r_{n−4}, …, r_{1}, b, a.

On the other hand, if e | a, b then working down the algorithm,

e | a, b, r_{1}, r_{2}, …, r_{n}.

Thus e | a, b ⟹ e | d. au + bv = d The Euclidean Algorithm has one important consequence that

is not immediately obvious. Let us say that e is expressed linearly in terms of c, d if we have an expression

e = cx + dy

with x, y ∈ Z.

The last line but one of the algorithm expresses d = r_{n} linearly in terms of r_{n−1} and r_{n−2}, say

d = r_{n−1}x_{1} + r_{n−2}y_{1}.

The previous line expresses r_{n−1} in terms of r_{n−2} and r_{n−3}, allowing us to express d linearly in terms of r_{n−2} and r_{n−3}, say

d = r_{n−2}x_{2} + r_{n−3}y_{2}.

Continuing in this way, we obtain expressions

d = r_{n−3}x_{3} + r_{n−4}y_{3}
…
d = r_{2}x_{n−2} + r_{1}y_{n−2}
d = r_{1}x_{n−1} + byn − 1

and finally

d = bx_{n} + ay_{n}.

Thus d is expressed linearly in terms of a, b:

d = au + bv

for some u, v ∈ Z.

The Lemma Suppose p is a prime number. Then

p | ab ⟹ p | a or p | b.

We take the classic definition of a prime number: a number that has no factors other than 1 and itself. If p |̸ a then gcd(p, a) = 1, and so by the Euclidean Algorithm we can find u, v ∈ ℤ such that

pu + av = 1.

Similarly if p |̸ b then we can find x, y ∈ Z such that

px + by = 1.

Multiplying these relations together

1 = (pu + av)(px + by)
= p(puv + uby + avx) + abvy

Now if p | ab then p divides all the terms on the right, and we deduce that p | 1, which is absurd.

Unique Factorisation Firstly, we can prove by induction that any n ∈ ℕ is expressible as a product of primes. For if n is not prime then we can write n = ab, where |a|, |b| < |n|. By our inductive hypothesis we can express a, b as products of primes; and these combine to give such an expression for n.

We can prove by induction on n that this expression is unique up to order. For suppose

n = p_{1}^{e_{1}} … p_{r}^{e_{r}} = q_{1}^{f_{1}} … q_{s}^{f_{s}}.

By repeated use of the lemma above, the first factor p_{1} on the left must occur on the right. Dividing both sides by p_{1}, we can apply the inductive hypothesis to show that the the factors, with one p_{1} removed, are the same up to order. Hence they are the same with the p_{1} restored to both sides.

Now we see that the entire argument rests upon Division with Remainder. Wherever this exists we will have unique factorisation.

One place where this holds is the ring k[x] of polynomials over a field k, since we can divide one polynomial by another,

f(x) = g(x)q(x) + r(x),

leaving a remainder r(x) of lower degree than g(x). It follows by our argument that there is unique factorisation into prime (or irreducible) polynomials in k[x]. Note that the degree in this case plays the rôle of the absolute value |n| in the case of ℤ above. The essential point is that it must be a positive integer, to ensure that our reduction process ends.

Proposition C.7 Given α, β ∈ ℤ[ω] (with β ≠ 0), we can find γ, δ ∈ ℤ[ω] such that

α = βγ + δ,

where N(δ) < N(β).

Proof ▶ We can certainly divide α by β in ℚ(ω), say

\frac{α}{β} = r + ωs (r, s ∈ ℤ).

Now let us choose m, n to be the nearest integers to r, s, so that

|r − m| ≤ \frac{1}{2}, |s − n| ≤ \frac{1}{2}.

Set

γ = m + ωn ∈ ℤ[ω];

and let

θ = (r − m) + ω(s − n) ∈ ℚ(ω).

Then

N(θ) = (r − m)^{2} − (r − m)(s − n) + (s − n)^{2}
≤ \frac{1}{4} + \frac{1}{4} + \frac{1}{4} < 1,

and so

α = βγ + δ,

where

δ = γθ,

and

N(δ) = ℕ(γ)N(θ) < N(γ).

◀

Corollary There is unique factorisation into primes (up to equivalence and order) in ℤ[ω].

C.7 Fermat’s Last Theorem in ℤ[ω]

It is convenient to take Fermat’s equation (for n = 3) in the symmetric form

x^{3} + y^{3} + z^{3} = 0.

Suppose first (x, y, z) is a solution in ℤ. As usual we assume that gcd(x, y, z) = 1.

Suppose that x = 1 mod 3, say x = 1 + 3a. Then

x^{3} = (1 + 3a)^{3}
= 1 + 3^{2}a + 3^{3}a^{2} + 3^{3}a^{3}
= 1 mod 3^{2}.

Similarly

x = −1 mod 3 ⟹ x^{3} = −1 mod 3^{2}.

It follows that one (and just one) of x, y, z must be divisible by 3, since otherwise we would have an impossible congruence

±1 ± 1 ± 1 = 0 mod 3^{2}.

Our aim is to extend this idea to solutions in ℤ[ω], with the prime Π playing the rôle of 3 (recalling that Π^{2} ≡ 3).

We note in the first place that there are just 3 residue classes in ℤ[ω] modulo Π, representated by 0, 1, and − 1. (For the number of residues modulo α is N(α), and N(Π) = 3.)

Lemma If x = 1 mod Π then

x^{3} = 1 mod Π^{4}.

Proof ▶ Suppose

x = 1 + Πα.

Then

x^{3} = (1 + Πα)^{3}
= 1 + 3Πα + 3Π^{2}α^{2} + Π^{3}α^{3}
= 1 − ω^{2}Π^{3}α + Π^{3}α^{3} mod Π^{4},

since 3 = −ω^{2}Π^{2}, while Π^{4} | 3Π^{2}. Thus

x^{3} − 1 = α(−ω^{2} + α^{2})Π^{3} mod Π^{4}
= α(α + ω)(α − ω)Π^{3} mod Π^{4}.

Now 0, ω, −ω are in the 3 different residue classes modulo Π; and so therefore are α, α + ω, α − ω. It follows that just one of these must be divisible by Π; and so

x^{3} = 1 mod Π^{4}.

◀

Corollary If x = −1 mod Π then

x^{3} = −1 mod Π^{4}.

This follows at once from the lemma on replacing x by −x.

Let us turn to Fermat’s equation

x^{3} + y^{3} + z^{3} = 0,

where we are now looking for solutions in ℤ[ω] (although this will, of course, include solutions in ℤ). We assume as usual that gcd(x, y, z) = 1.

One of x, y, z must be divisible by Π. For otherwise, by the Lemma and Corollary above, we will have an impossible congruence

±1 ± 1 ± 1 = 0 mod Π^{4}.

In fact we can go further; one of x, y, z must be divisible by Π^{2}. For otherwise we would have

Π^{3}α^{3} ± 1 ± 1 = 0 mod Π^{4},

where Π |̸ α.

We may thus suppose that x = Π^{2}x′, so that

Π^{6}x′^{3} = −(y^{3} + z^{3})
= −(y + z)(y + ωz)(y + ω^{2}z).

How can the prime-power Π^{6} be distributed among the 3 factors on the right? Evidently one factor must be divisible by Π^{2} at least. On replacing z by ωz or ω^{2}z, if necessary, we may assume that Π^{2} | (y + z). But

(y + ωz) − (y + z) = (ω − 1)z ≡ Πz.

Thus

Π^{2} | y + z ⟹ Π ∥ y + ωz,

where π^{e} ∥ α means that π^{e} | α but π^{e+1} |̸ α. Similarly

Π^{2} | y + z ⟹ Π ∥ y + ω^{2}z.

It follows that

Π^{4} | y + z, Π ∥ y + ωz, Π ∥ y + ω^{2}z.

Thus it follows from unique factorisation that

y + z ≡ Π^{4}X^{3}, y + ωz ≡ ΠY^{3}, y + ω^{2}z ≡ ΠZ^{3},

where gcd(ΠX, Y, Z) = 1. But

(y + z) + ω(y + ωz) + ω^{2}(y + ω^{2}z) = 0.

This yields a relation of the form

ϵ_{1}Π^{3}X^{3} + ϵ_{2}Y^{3} + ϵ_{3}Z^{3} = 0,

where ϵ_{1}, ϵ_{2}, ϵ_{3} are units, and gcd(ΠX, Y, Z) = 1. We can assume that ϵ_{2} = 1. Since Π |̸ Y, Z, we have Y^{3}, Z^{3} = ±1 mod Π^{3}. Thus

±1 ± ϵ_{3} = 0 mod Π^{3}.

This congruence can only be satisfied if ϵ_{3} = ±1. After replacing Z by −Z if required, we may therefore assume that ϵ_{3} = 1. Thus the equation reads

ϵΠ^{3}X^{3} + Y^{3} + Z^{3} = 0.

Proposition C.8 The equation

ϵΠ^{3}x^{3} + y^{3} + z^{3} = 0

has no solution (x, y, z) in ℤ[ω] with gcd(Πx, y, z) = 1 for any unit ϵ.

Proof ▶ Since Π |̸ y, z,

y^{3}, z^{3} = ±1 mod Π^{4}.

Thus

ϵΠ^{3}x^{3} ± 1 ± 1 = 0 mod Π^{4}.

The only way this congruence can be satisfied is if Π | x, say x = Πx′. Then

ϵΠ^{6}x′^{3} = −(y^{3} + z^{3})
= −(y + z)(y + ωz)(y + ω^{2}z).

Our earlier argument still holds — the introduction of the unit ϵ makes no difference. After replacing z by ωz or ω^{2}z, if necessary, we have

y + z ≡ Π^{4}X^{3}, y + ωz ≡ ΠY^{3}, y + ω^{2}z ≡ ΠZ^{3},

where gcd(ΠX, Y, Z) = 1. As before, we deduce that

ϵ_{1}Π^{3}X^{3} + ϵ_{2}Y^{3} + ϵ_{3}Z^{3} = 0,

where ϵ_{1}, ϵ_{2}, ϵ_{3} are units. Dividing by ϵ_{2} we have

ϵΠ^{3}X^{3} + Y^{3} + ϵ′Z^{3} = 0.

This is only soluble modulo Π^{3} if ϵ′ = ±1; and we may assume that ϵ′ = 1, on replacing Z by −Z if necessary. Thus we are led to a new solution of our equation

ϵΠ^{3}X^{3} + Y^{3} + Z^{3} = 0,

with gcd(ΠX, Y, Z) = 1.

It remains to show that this solution is ‘smaller’, in some sense, than the first. To this end, note that

x = ΠXY Z.

Thus

N(x) = 3ℕ(X)N(Y)N(Z),

and so

max(N(x), N(y), N(z)) > max(N(X), N(Y), N(Z)).

◀

Corollary Fermat’s Last Theorem holds for n = 3.

Appendix H

Elliptic Curve Factorisation

Lenstra’s Elliptic Curve Factorisation (ECF) technique is an analogue of Pollard’s so-called ‘p − 1 method’, in which the group ℤ/p)^{×} is replaced by the group on an elliptic curve E(F_{p}) over a finite field. So we start by describing Pollard’s method.

H.1 The Pollard “p − 1 method”

We want to factorise a large number n.

It is a straightforward matter to determine whether n is prime, using the Miller-Rabin algorithm. We may therefore suppose that n is composite.

Suppose p is a prime factor of n. By Fermat’s Little Theorem, if p ∤ a then

a^{p−1} ≡ 1 mod p.

Hence

a^{k} ≡ 1 mod p

if p − 1 | k.

It follows that

d = gcd(a^{k} − 1, n) > 1

since p is a factor of both numbers.

It would be very bad luck if we found a factor d of n in this way, and then discovered that d = n. We may therefore suppose in this case that we have a proper factor of n.

But how do we choose k? We make the assumption at this point that the prime-factors of p − 1 are all (relatively) small.

H.2 Elliptic curve factorisation

Let n, as before, be a large composite integer that we wish to factorise. Suppose p is a prime factor of n. Let

E(ℚ) : y^{2} = x^{3} + bx + c (b, c ∈ ℤ)

be an elliptic curve over ℚ. Unless we are very unlucky (or very lucky) p will be a good prime for E, ie the curve

E(F_{p}) : y^{2} = x^{3} + bx + c

over the finite field F_{p} is still elliptic. (We say lucky because p is a bad prime if and only if

p | Δ = −(4b^{3} + 27c^{2}).

Thus if p is a bad prime,

d = gcd(Δ, n) > 1;

so if we wished we could compute this gcd at the outset. However, the probability of p being bad is so small that this is probably not worth considering.)

Suppose the curve E(F_{p}) contains N points. By Hasse’s Theorem,

p + 1 − 2\sqrt{p} < N < p + 1 + 2\sqrt{p}.

Suppose N is b-smooth. As before, let

k = ∏_{q≤b} q^{e(q)}.

Then

N | k.

Suppose P ∈ E(ℚ). We express P in homogeneous coordinates:

P = [X, Y, Z],

where X, Y, Z ∈ ℤ.

It is a straightforward matter to find a formula for the sum of two points:

[X_{1}, Y_{1}, Z_{1}] + [X_{2}, Y_{2}, Z_{2}] = [X_{3}, Y_{3}, Z_{3}],

where X_{3}, Y_{3}, Z_{3} are polynomials in X_{1}, Y_{1}, Z_{1}, X_{2}, Y_{2}, Z_{2} with integer coefficients:

X_{3}, Y_{3}, Z_{3} ∈ ℤ[X_{1}, Y_{1}, Z_{1}, X_{2}, Y_{2}, Z_{2}].

In effect, we simply have to dress up our usual computation

x_{1} + x_{2} + x_{3} = m^{2}, y_{3} = mx_{3} + c

in homogeneous form.

As a special case, this gives a formula for the double of a point:

2[X, Y, Z] = [X_{1}, Y_{1}, Z_{1}],

where X_{1}, Y_{1}, Z_{1} are polynomials over ℤ in X, Y, Z.

Using these formulae we can compute

rP = [X_{r}, Y_{r}, Z_{r}]

for any r ∈ ℕ.

Now let

P_{p} = [X mod p, Y mod p, Z mod p]

be the point of E(F_{p}) corresponding to P ∈ E(ℚ). By Lagrange’s Theorem,

NP_{p} = 0,

and therefore

kP_{p} = 0.

But kP_{p} is just the point we get from

kP = [X_{k}, Y_{k}, Z_{k}]

by reduction modp. It follows that

Z_{k} ≡ 0 mod p.

(We also have X_{k} ≡ 0 mod p. However, this follows from the result for Z_{k} since the only point of E(F_{p}) on the line at infinity Z = 0 is O = [0, 1, 0].)

It follows that

d = gcd(Z_{k}, n) > 1;

and unless we are very unlucky this will give us a proper factor of n.

Note that in constructing Z_{k} for this purpose we can work throughout modn.

This method has one very large advantage over Pollard’s p − 1 method; by changing the coefficients b, c in the elliptic curve we change N, which probably ranges at random over the interval (p + 1 − 2\sqrt{p}, p + 1 + 2\sqrt{p}). This allows us many chances of finding a ‘smooth’ N, while Pollard’s method only gives us the one chance p − 1.

Analysis shows that if we have some idea of the size of p then it pays to choose b of order \sqrt{p}, and move on to another elliptic curve if this fails.

Incidentally, it is easier to choose the point P = [X, Y, Z] first, and then find b, c so that the elliptic curve contains this point, rather than choosing the curve and then looking for a rational point on it.