Course 428

Elliptic Curves

Dr Timothy Murphy

Maxwell Theatre Friday, 21 January 2004 12:00–15:00

Attempt 7 questions. (If you attempt more, only the best 7 will be counted.) All questions carry the same number of marks.

1. Explain how two points on an elliptic curve are added.

Outline the proof that this operation is associative. Answer:

2. Find the sum P + Q of the points P = (0, 0), Q = (1, 1) on the curve

E(ℚ) : y^{2} = x^{3} − x^{2} + x.

Determine the orders of P and Q. Answer:

(a) Let P Q be the line

y = mx + c.

Then

m = \frac{1 − 0}{1 − 0} = 1.

This meets the curve where

(mx + c)^{2} = x^{3} − x^{2} + x.

Thus if P ∗ Q = R = (x_{2}, y_{2}) then

0 + 1 + x_{2} = 1 + m^{2} = 2, ie

x_{2} = 1.

Thus R = Q. Hence

P + Q = −Q
= (1, −1).

(b) P is of order 2, since

−(x, y) = (x, −y)

and so

−(0, 0) = (0, 0).

From above,

P + Q = −Q ⟹ 2Q = −P = P.

Hence Q is of order 4.

3. What is meant by saying that p is a good prime for an elliptic curve? Show that 3, 5 and 7 are good primes for the elliptic curve

E : y^{2} = x^{3} − 2x,

and determine the corresponding groups over the finite fields 𝔽_{3}, 𝔽_{5} and 𝔽_{7}. What can you deduce about the group of points of finite order on E(ℚ)? Answer:

(a) Suppose

E(ℚ) : y^{2} + a_{1}xy + a_{3}y = x ∗ 3 + a_{2}x^{2} + a_{4}x + a_{6},

where a_{i} ∈ ℤ. Then p is a good prime if the curve

E(𝔽_{p}) : y^{2} + a_{1}xy + a_{3}y = x ∗ 3 + a_{2}x^{2} + a_{4}x + a_{6}

is elliptic, ie non-singular.

(b) If p is an odd prime then it is good if and only if

p ∤ D,

where D is the discriminant of the cubic. In this case

D = −(4b^{3} + 27c^{2})
= −4 · 2^{3}.

Hence all odd primes are good.

(c) Suppose p = 3. The quadratic residues mod3 are 0, 1. Thus we can draw up the table

x x^{3} − 2x points
0 0 (0, 0)
1  −1
−1  1  (−1, ±1)

Thus E(𝔽_{3}) contains 4 points (including O), one of which, (0, 0), of order 2. Hence

E(𝔽_{2}) = ℤ/(4).

(d) Suppose p = 5. The quadratic residues mod3 are 0, ±1. Thus we can draw up the table

\begin{matrix}x & x^{3} − 2x & points \\ 0 & 0 & (0, 0) \\ 1 & −1 & (1, ±2) \\ 2 & −1 & (2, ±2) \\ −2 & 1 & (−2, ±1) \\ −1 & 1 & (−1, ±1) \end{matrix}

Thus E(𝔽_{5}) contains 10 points (including O), one of which, (0, 0), of order 2. Hence

E(𝔽_{2}) = ℤ/(10) = ℤ/(2) ⊕ ℤ/(5).

(e) Suppose p = 7. The quadratic residues mod 3 are 0, 1, 2, −3. Thus we can draw up the table

x x^{3} − 2x points
0 0 (0, 0)
1  −1
2  −3 (2, ±2)
3  0  (3, 0)
−3  0  (3, 0)
−2  3
−1  1  (−1, ±1)

Thus E(𝔽_{7}) contains 8 points (including O), three of which, (0, 0), (3, 0), (−3, 0), are of order 2. Hence

E(𝔽_{2}) = ℤ/(4) ⊕ ℤ/(2).

(f) Since the torsion group

T ⊂ E(ℚ)

is isomorphic to a subgroup of E(𝔽_{p}) for p = 3, 5, 7 it follows that

T = {0} or ℤ/(2).

Since (0, 0) ∈ E(ℚ), it follows that

T = ℤ/(2).

4. Express the 2-adic integer 1/3 ∈ ℤ_{2} in standard form

1/3 = a_{0} + a_{1}2 + a_{2}2^{2} + ⋯,

where each a_{i} is 0 or 1. Does there exist a 2-adic integer x such that x^{2} = −3? Answer:

(a) We have

1/3 ≡ 1 mod 2

since 1 ≡ 3 mod 2. Thus

1/3 = 1 + O(2).

Now

1/3 − 1 = −2/3

Hence

2^{−1}(1/3 − 1) = −1/3
≡ 1 mod 3.

Thus

1/3 = 1 + 2 + O(2^{2}).

Now

−1/3 − 1 = −4/3

Hence

2^{−2}(−1/3 − 1) = −1/3
≡ 1 mod 3.

Thus

1/3 = 1 + 2 + 2^{3} + O(2^{4}).

But now we have the same remainder −1/3, so we have entered a cyle, and will get the series

1/3 = 1 + 2 + 2^{3} + 2^{5} + 2^{7} + · · · .

To check that this is correct, note that

1 + 2 + 2^{3} + 2^{5} + 2^{7} + ⋯ = 1 + 2(1 + 2^{2} + 2^{4} + ⋯)

= 1 + \frac{2}{1 − 2^{2}}

= 1 − \frac{2}{3}

= \frac{1}{3}.

(b) There does not exist a 2-adic integer

x = a_{0} + a_{1}2 + a_{2}2^{2} + ⋯ (a_{i} ∈ {0, 1}

such that

x^{2} = −3

since this would imply that

a = a_{0} + a_{1}2 + a_{2}2^{2}

would satisfy

a^{2} ≡ −3 ≡ 5 mod 8.

But the only quadratic residues mod8 are 0, 1, 4.

5. Prove that a point P = (x, y) of finite order on the elliptic curve

E(ℚ) : y^{2} = x^{3} + ax^{2} + bx + c (a, b, c ∈ ℤ)

necessarily has integral coordinates x, y ∈ ℤ.

Answer: It is sufficient to show that

x, y ∈ ℤ_{p}

for each prime p. Let us fix the prime p, and write ∥ · ∥ for ∥ · ∥_{p}. Note that

∥x∥ > 1 ⟺ ∥y∥ > 1,

since otherwise x^{3} or y^{2} would dominate; and it this is so then

∥y∥^{2} = ∥x∥^{3}.

Suppose this is so. Let us change coordinates to X, Z where

(x, y) = [x, y, 1] = [X, 1, Z],

ie

X = x/y, Z = 1/y

or conversely

x = X/Z, y = 1/Z.

Suppose ∥x∥, ∥y∥ > 1. Then

∥Z∥ = 1/∥y∥ < 1,

and

∥X∥ = ∥x∥/∥y∥ = ∥x∥^{−1/2} < 1.

The equation of the curve in X, Z coordinates is

Z = X^{3} + aX^{2}Z + bXZ^{2} + cZ^{3}.

Substituting for Z in the right-hand side we get an expansion for Z as a power-series in X,

Z = X^{3} + aX^{2}(X^{3} + ⋯) + bX(X^{3} + ⋯)^{2} + c(X^{3} + ⋯)^{3}
= X^{3} + aX^{5} + O(X^{7}).

In particular,

∥Z∥ = ∥X∥^{3}.

Let

E_{(p^{r})} = {[X, 1, Z] ∈ E : ∥X∥ ≤ p^{−r}, ∥Z∥ ≤ p^{−3r}}.

Lemma 1. E_{(p^{r})} is a subgroup for each r ≥ 1. Proof. Suppose

P_{1} = [X_{1}, 1, Z_{1}], P_{2} = [X_{2}, 1, Z_{2}] ∈ E_{(p^{r})}.

Let

P_{3} = [X_{3}, 1, Z_{3}] = P_{1} + P_{2}.

Suppose P_{1}P_{2} is the line

Z = mX + d.

Then

m = \frac{Z_{2} − Z_{1}}{X_{2} − X_{1}}

But

Z_{2} − Z_{1} = (X_{2}^{3} + aX_{2}^{5} + ⋯) − (X_{1}^{3} + aX_{1}^{5} + ⋯)
= (X_{2}^{3} − X_{1}^{3}) + a(X_{2}^{5} − X_{1}^{5}) + ⋯

Thus

m = X_{1}^{2} + X_{1}X_{2} + X_{2}^{2} + O((X_{1} + X_{2})^{4})

Hence

m ≡ 0 mod p^{2r},

ie

∥m∥ ≤ p^{−2r}.

Moreover, since d = Z_{1} − mX_{1},

∥d∥ ≤ p^{−3r}.

Since −(x, y) = (x, −y) it follows that

−[X, 1, Z] = −[X/Z, 1/Z, 1] = [X/Z, −1/Z, 1] = [−X, 1, −Z]. In particular,

−P_{3} = [−X_{3}, 1, −Z_{3}].

Thus X_{1}, X_{2}, −X_{3} are the roots of mX + d = X^{3} + aX^{2}(mX + d) + bX(mX + d)^{2} + c(mX + d)^{3}.

Hence

X_{1} + X_{2} − X_{3} = −\frac{ad + 2bmd + 3cm^{2}d}{1 + am + bm^{2} + cm^{3}} .

Hence

X_{3} ≡ X_{1} + X_{2} mod p^{3r}.

Lemma 2. There is no point P ≠ O of finite order in E_{(p)}.

Proof. It is sufficient to show there is no point of prime order q.

6. Find all points of finite order on the elliptic curve

E(ℚ) : y^{2} = x^{3} + 17.

Answer: According to the Nagell-Lütz theorem, a point P = (x, y) of finite order must have x, y ∈ ℤ with y = 0 or y^{2}|D, where D is the discriminant of the cubic. In this case

D = −(4b^{2} + 27c^{2})
= −27 · 17^{2}.

Thus y = 0 or

y = 3^{a}17^{b}

where a, b ∈ {0, 1}. In other words,

y ∈ {0, ±1, ±3, ±17, ±3 · 17}.

There is no integer solution with y = 0. If y = ±1 then

x^{3} = 1 − 17 = −16

which again has no integer solution. If y = ±3 then

x^{3} = 9 − 17 = −8 ⟹ x = −2.

If y = ±17 then

x^{3} = 17^{2} − 17 = 17 · 16,

with no integer solution.

Finally, if y = ±3 · 17 then

x^{3} = 17(3^{2}17 − 1)

with no integer solution. Hence the only possible points of finite order are (−2, ±3). [Recall that Nagell-Lütz gives a necessary but not sufficient condition for a point to be of finite order.] Let P = (−2, 3). The tangent at P has slope

m = \frac{3x^{2}}{2y}

= \frac{12}{6}

= 2.

If the tangent at P meets the curve again at −2P = (x_{2}, y_{2}) then

−2 − 2 + x_{2} = m^{2} = 4,

ie

x_{2} = −8.

Since we have seen that there is no point of finite order with x_{2} = −8 it follows that −2P is of infinite order, and so therefore is P. Hence the only point of finite order on E is O = [0, 1, 0].

7. Define the Weierstrass elliptic function φ(z) with respect to a lattice Λ ⊂ ℂ, and establish the functional equation linking φ′(z) and φ(z). Show that any even function which is elliptic (doubly-periodic) with respect to Λ is expressible as a rational function in φ(z). Express the Weierstrass elliptic function φ_{2L}(z) with respect to the lattice 2Λ = {2ω : ω ∈ Λ} in terms of φ_{Λ}(z). Answer:

(a) We define

φ(z) = \frac{1}{z^{2}} + ∑_{ω∈L, ω≠0} (\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} ) .

(b) We assume that i. φ(z) is L-periodic; ii. An L-periodic function without poles is constant (since it is

bounded in the whole of ℂ). iii. An L-periodic function has the same number of zeros and poles

in a fundamental parallelogram. In the neighbourhood of z = 0,

\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} = \frac{1}{ω^{2}(1 − z/ω)^{2}} − \frac{1}{ω^{2}}

= \frac{1}{ω^{2}} ((1 − z/ω)^{−2} − 1)

= \frac{2z}{ω^{3}} + \frac{3z^{2}}{ω^{4}} + · · · .

Thus

φ(z) = \frac{1}{z^{2}} + 2G_{3}z + 3G_{4}z^{2} + ⋯,

where

G_{r} = ∑_{ω∈L,ω≠0} \frac{1}{ω^{r}} .

If r is odd,

G_{r} = 0

since the terms arising from ±ω cancel. Hence

φ(z) = \frac{1}{z^{2}} + 3G_{4}z^{2} + 5G_{6}z^{4} + · · · .

Thus

φ′(z) = −\frac{2}{z^{3}} + 6G_{4}z + 20G_{6}z^{3} + ⋯;

and so

φ′(z)^{2} = \frac{4}{z^{6}} − \frac{24G_{4}}{z^{2}} − 80G_{6} + O(z^{2}).

But

φ(z)^{3} = \frac{1}{z^{6}} + \frac{9G_{4}}{z^{2}} + 15G_{6} + O(z^{2}).

Hence

φ′(z)^{2} − 4φ(z)^{3} = −\frac{60G_{4}}{z^{2}} − 140G_{6} + O(z^{2})
= −60G_{4}φ(z) − 140G_{6} + O(z^{2});

and so

F (z) = φ′(z)^{2} − 4φ(z)^{3} + 60G_{4}φ(z) + 140G_{6} = O(z^{2}).

Thus F (z) is an L-periodic function without poles, which is vanishingly small close to z = 0. Hence

F (z) = 0,

ie

φ′(z)^{2} = 4φ(z)^{3} − 60G_{4}φ(z) − 140G_{6}.

(c) Suppose f(z) is an even L-periodic function. If a is a zero of f(z) of multiplicity d then so is −a. Thus the zeros in a fundamental parallelogram can be paired off as

±a_{1}, ±a_{2}, …, ±a_{r} mod L.

(This is still true if −a ≡ a mod L. For f′(z) is odd, and therefore has a zero of odd order at a, so that f(z) has a zero of even order at a.) Similarly, the poles in a fundamental parallelogram can be paired off as

±b_{1}, ±b_{2}, …, ±b_{r} mod L.

(The number of poles and zeros must be equal.) Now

f_{i}(z) = φ(z) − φ(a_{i})

has a double pole at ω ∈ L, and so has just two zeros ±a_{i} mod L in each fundamental region. It follows that the function

F (z) = \frac{(φ(z) − φ(a_{1})) ⋯ (φ(z) − φ(a_{r})}{(φ(z) − φ(b_{1})) ⋯ (φ(z) − φ(b_{r})}

has the same zeros and poles as f(z). Hence

\frac{f(z)}{F (z)}

has no poles or zeros and so is constant. Thus

f(z) = CF (z) = R(φ(z)),

where R is the rational function

R(w) = \frac{(w − φ(a_{1}) ⋯ (w − φ(a_{r})}{(w − φ(b_{1}) ⋯ (w − φ(b_{r})}.

(d) Since

φ_{2L}(2z) = \frac{1}{4z^{2}} + ∑^{′} (\frac{1}{2z − 2ω)^{2}} − \frac{1}{(2ω)^{2}} )

= \frac{1}{4}φ(z).

Thus

φ_{2L}(z) = \frac{1}{4}φ(z/2).

8. Find the rank of the curve

E(ℚ) : y^{2} = x^{3} − x.

Answer: There are 3 points of order 2 on E:

(0, 0), (1, 0), (−1, 0).

The associated elliptic curve is

Ẽ(ℚ) : y^{2} = x^{3} − 2ax^{2} + (a^{2} − 4b)x,

ie

Ẽ: y^{2} = x^{3} + 4x.

Let the rank be r. Then

2^{r+2} = |im χ| · |im c̃hi| ,

where

χ : E → ℚ^{×2}/ℚ^{×}, χ̃ : Ẽ → ℚ^{×2}/ℚ^{×}

are the auxiliary homomorphisms. We have

im χ ⊂ {±1}.

Since −1 ∈ im χ [as χ(0, 0) = −1],

im χ = {±1}.

On the other hand,

im χ̃ ⊂ {±1, ±2}.

[Recall that e ∈ im χ where ef = b if and only if the auxiliary equation

u^{2} = es^{4} + as^{2}t^{2} + ft^{4}

has a solution with gcd(s, t) = gcd(u, t) = 1.] If e = −1 then f = −4, and −1 ∈ im χ̃ if and only if

s^{2} = −s^{4} − 4t^{4},

which is clearly impossible. It follows that

|im χ̃| ≤ 2,

and so

2^{r+2} ≤ 2 · 2.

Hence

r = 0.

[One might recall that the n is a congruent number — ie there exists a right-angle triangle with rational sides and area n — if and only if the elliptic curve

y^{2} = x^{3} − n^{2}x

has rank > 0. Thus our result is equivalent to the well-known result that 1 is not a congruent number.]

9. Find all rational points on the curve

E(ℚ) : y^{2} = x^{3} + 1.

Answer: Let us first determine the points of finite order. By Nagell-Lütz, if P = (x, y) is such a point then x, y ∈ ℤ and either y = 0 or

y^{2} | D,

where

D = −(4b^{3} + 27c^{2}) = −3^{3}.

Hence

y ∈ {0, ±1, ±3}.

If y = 0 then x = −1, giving just one point (−1, 0) of order 2. If y = ±1 then x^{3} = 0, giving the two points (0, ±1). If y = ±3 then x^{3} = −8, giving the two points (−2, ±3). It remains to determine if these points are of finite order.

The slope at (x, y) is

m = \frac{3x^{2}}{2y} ,

and the tangent

y = mx + c

meets the curve again at (x_{2}, y_{2}), where

2x + x_{2} = m^{2}.

Let

P = (0, 1).

The slope at P is m = 0, and the tangent

y = 1

meets the curve again where x_{2} = 0, ie P is a point of inflexion satisfying

3P = 0.

Since there are points of orders 2 and 3, and there are ≤ 6 points of finite order, the torsion group must be ℤ/(6), and the points (−2, ±3) must be of order 6.

Now we must determine the rank of the curve. First we bring the root x = −1 of the cubic to 0, by the transformation x′ = x + 1. Dropping the ′ss the curve is now

E = E(ℚ) : y^{2} = x^{3} − 3x^{2} + 3x.

The associated curve is

Ẽ: y^{2} = x^{3} + 6x^{2} − 3x.

The rank r is given by

2^{r+2} = |im χ| · |im χ̃| ,

where

χ : E → ℚ^{×2}/ℚ^{×}, χ̃ : Ẽ → ℚ^{×2}/ℚ^{×}

are the auxiliary homomorphisms.

We have

{1, 3} ⊂ im χ ⊂ {±1, ±3}

(working always modℚ^{×2}).

If e = −1 then ef = b = 3 ⟹ f = −3; and e ∈ im χ if and only if the auxiliary equation

u^{2} = es^{4} + ft^{4}

has a solution with gcd(s, t) = gcd(u, t) = 1. This is evidenly impossible with e, f < 0. Hence −1 ∉ im χ, and so

im χ = {1, 3}.

Turning to the χ̃,

{1, −3} ⊂ im χ̃ ⊂ {±1, ±3}.

If e = −1 then ef = b̃ = −3 ⟹ f = 3. Thus −1 ∈ im χ̃ if and only if the auxiliary equation

u^{2} = −s^{4} + 3t^{4}

has a solution with gcd(s, t) = gcd(u, t) = 1. If s, t are both odd then

u^{2} ≡ −1 + 3 = 2 mod 8,

which is impossible. If s is even and t is odd then

u^{2} ≡ 3 mod 8,

which is again impossible. Finally, if s is odd and t is even then

u^{2} ≡ −1 mod 8,

which is still impossible.

We conclude that

−1 ∉ im χ̃.

Hence

im χ̃ = {1, −3},

and so

r = 0.

Hence the only rational points on the curve are the points of finite order: (−1, 0), (0, ±1), (2, ±3).

10. Solve the equation

x^{4} + 4x + 1 = 0.

Answer: We can write the equation as

(x^{2} + λ)^{2} = 2λx^{2} − 4x + (λ^{2} − 1).

The right-hand side will be a perfect square if

2^{2} = 2λ(λ^{2} − 1),

ie

λ^{3} − λ − 2 = 0.

To solve this equation, let

λ = u + v.

Then

u^{3} + v^{3} + (u + v)(3uv − 1) − 2 = 0.

Let us choose u, v so that

3uv = 1.

Then

u^{3} + v^{3} = 2.

On the other hand,

u^{3}v^{3} = 1/27.

Thus u^{3}, v^{3} are the roots of

t^{2} − 2t + 1/27 = 0.

Hence

u^{3}, v^{3} = 1 ± \sqrt{1 − 1/27} = 1 ± \sqrt{26/27}.

Thus

u, v = \sqrt[3]{1 ± \sqrt{26/27}},

and so

λ = \sqrt[3]{1 + \sqrt{26/27}} + \sqrt[3]{1 − \sqrt{26/27}}.

With this value of λ the original equation reduces to

x^{2} + λ = ±\sqrt{2λ}(x − \sqrt{2}/λ),

ie

x^{2} ∓ \sqrt{2/λ}x + (λ ± 1/\sqrt{λ}).

The solutions of these 2 quadratics give the 4 roots of the original polynomial.