Taylor expansion of $f^{\prime }$ about $a_i$ has integral coefficients, soIn a Non-Archimedean absolute value, adding an error of norm strictly smaller than $d$ cannot change a quantity of norm $d$. ThereforeThis simultaneously verifies the derivative assumption used at the next step of part (i).

Let $d=|f^{\prime }(a_0)|>0$ and $q_0=|f(a_0)|/d^2<1$. At any step before reaching a root, setAssuming inductively that $|f^{\prime }(a_i)|=d$ and $q_i=|f(a_i)|/d^2<1$, this givesAll derivatives of a polynomial over $R$ are integral on $R$, so $d\le 1$. Hence $|h_i|<1$, and the ultrametric inequality keeps $a_{i+1}$ in $R$. If a root is reached, retain that value for subsequent terms, and the asserted weak step inequality still holds.

Use the two-isogeny formula formula with $a=\alpha$ and $b=-\alpha$. Its companion isBoth curves are nonsingular because $\alpha \ne 0,-4$. With $b^{\prime }=\alpha (\alpha +4)$, chooseEach map extends across its exceptional affine points, and $\hat{\varphi }\varphi =[2]$. On $D$, the first coordinate of the dual can also be written $v^2/(4u^2)$.

Let $P=(1,1)$ and solve $\hat{\varphi }(u,v)=P$. The first coordinate gives $v^2=4u^2$. Since $u\ne 0$, the equation of $D$ then givesThe second coordinate selects the signs. The two rational preimages are exactlySubstituting into the dual formula checks that both map to $(1,1)$. Their coordinates are nonexceptional under the assumptions, and the degree-two map has no further preimages.

The two-torsion square-class homomorphism ${\alpha }_D$ has kernel $\varphi (C(\mathbb{Q}))$, and on these two points it is their nonzero $u$-coordinate modulo squares. Thus $Q_1$ is in the image of $\varphi$ exactly when $\alpha$ is a rational square, and $Q_2$ is in that image exactly when $\alpha +4$ is a rational square.

If $P=2R$, then $\varphi (R)$ is one of the two preimages, because $\hat{\varphi }\varphi (R)=2R=P$. Conversely, if $Q_j=\varphi (R)$, applying the dual shows $P=2R$. ThereforeFinally, if an integer equals $(a/b{)}^2$ in lowest terms, then $b^2\mid a^2$ forces $b=1$. Thus rational squareness of these integer parameters is exactly integer squareness, andThis is the two-isogeny halving criterion for the alpha family.

For $E:y^2=x^3+px$ with $p>0$, the factor $x^2+p$ is strictly positive on the real line. Thus every nonzero rational $x$-coordinate is positive. In the two-isogeny descent map, prime support restricts its square class to $1$ or $p$. Both are realized by the identity and $(0,0)$, although only the upper bound is needed:The two-isogenous curve is $E^{\prime }:Y^2=X^3-4pX$. Its two-torsion square-class homomorphism has signed squarefree representatives supported on the primes dividing $4p$. For odd $p$ these are amongHence the second image has at most eight elements. At $p=2$ the list reduces to $1,-1,2,-2$, so the bound by eight remains valid. The two-isogeny rank formula therefore givesIn fact the same simple count yields $r\le 1$ when $p=2$. The positivity restriction on the first descent image is essential for the stated bound of two for all primes.

We use two-isogeny descent, stating the arithmetic results involved. Fordefine the two-torsion square-class homomorphism ${\alpha }_E:E(\mathbb{Q})\to {\mathbb{Q}}^{\times }/{\mathbb{Q}}^{\times 2}$ by ${\alpha }_E(o)=1$, ${\alpha }_E((0,0))=b$, and ${\alpha }_E((x,y))=x$ otherwise. Its kernel is the image of the dual two-isogeny formula; the analogous map ${\alpha }_{E^{\prime }}$ has kernel the image of the forward two-isogeny formula. The two-isogeny rank formula isThe images have signed squarefree representatives supported on primes dividing $b$ and $a^2-4b$, respectively. This prime-support bound in two-isogeny descent follows by valuation comparison: if a prime does not divide $b$, the valuations of $x$ at that prime must be even, whether positive or negative. A candidate squarefree class $d$ is represented precisely when its quartic covering in a two-isogeny descenthas the corresponding rational solution, apart from the separately included identity and two-torsion cases; clearing denominators permits coprime integers $U,V$.

Here $a=5,b=-5$, soOn $E$ the possible classes are $1,-1,5,-5$. They all occur: the identity gives one, $T=(0,0)$ gives $-5$, and $(-1,3)$ gives $-1$. Since the image is a group, their product also gives five. Thus its image has order four.

On $E^{\prime }$, the quadratic factor $(X-5{)}^2+20$ is strictly positive for real $X$. Every nonzero rational $X$-coordinate is therefore positive. The prime-support bound in two-isogeny descent restricts its image to $1,3,5,15$. The identity gives one and $(0,0)$ gives $45$, that is class five.

Class three is impossible. Its quartic covering in a two-isogeny descent would requireModulo three this is $N^2\equiv 2U^2{V}^2$, so three divides $N$ and at least one of $U,V$. They cannot both be divisible. If $3\mid U$ and $3\nmid V$, the right side has valuation exactly one, from $15V^4$. If $3\mid V$ and $3\nmid U$, it again has valuation exactly one, from $3U^4$. Either case contradicts its being a square. Class fifteen is then impossible too, since multiplying it by the known image class five would give class three.

Hence the second image is exactly $\{1,5\}$, of order two. The rank formula givesThis proves the rank-one elliptic curve with coefficients five and minus five calculation, including the local obstruction that removes the spurious extra descent classes.

Since neither $n$ nor $-n$ is a square, both cubics have exactly one rational root, zero. Thus each torsion point of an elliptic curve group has exactly one nonidentity 2-torsion, namely $T=(0,0)$.

Neither curve has a rational point of order four. Indeed on $E_m:y^2=x^3+mx$ the duplication formula givesIf $2P=T$, then $P$ is neither the identity nor a 2-torsion, so the denominator is nonzero and $x(P{)}^2=m$. Thus $m$ must be a rational square; an integer that is a rational square is an integer square. Applying this with $m=n$ or $m=-n$ contradicts the hypotheses.

If $3\nmid n$, both curves have good reduction of an elliptic curve at three and exactly four points over ${\mathbb{F}}_3$. To see this, $x^3=x$ there, so the equation is $y^2=(1+m)x$. For $m=1$ the right side runs through all residues, and for $m=-1$ it is always zero; either way there are three affine points. Injection of torsion point of an elliptic curve at this odd good prime bounds each torsion element order by four. An order-four torsion subgroup with just one nonzero 2-torsion would contain an order-four point, which was excluded. Therefore in this case both torsion subgroups equal $\{o,T\}$.

The remaining case is $3\mid n$. The literal hypothesis $15\nmid n$ then ensures $5\nmid n$, so both curves have good reduction of an elliptic curve at five. Direct square counting givesFor example the square residues are $0,1,4$; substituting $x=0,\dots ,4$ gives this table, including the point at infinity. The pair $m=n,-n$ has residues $(1,4)$ or $(2,3)$ in some order. In either pair at least one reduction group has order two or four. The same injection and absence of order-four points then force that curve's torsion point of an elliptic curve to have order two. ThusThis torsion alternative for opposite quartic-twist coefficients uses only $15\nmid n$; it does not strengthen the source hypothesis to coprimality with fifteen.

The discriminant of $y^2=x^3-9$ is $-16\cdot 27\cdot 81=-2^4{3}^7$, so five and seven are primes of good reduction of an elliptic curve. Count solutions over their residue fields.

Modulo five the values of $x^3-9$ for $x=0,1,2,3,4$ are $1,2,4,3,0$. They yield $2,0,2,0,1$ affine points, respectively, and the point at infinity gives $\#E({\mathbb{F}}_5)=6$.

Modulo seven the values for $x=0,\dots ,6$ are $5,6,6,4,6,4,4$. Only the three values four are nonzero squares, giving six affine points and $\#E({\mathbb{F}}_7)=7$.

For a rational elliptic curve at an odd prime of good reduction of an elliptic curve, the kernel of reduction on ${\mathbb{Q}}_p$ has no torsion element: it is the formal group on $p{\mathbb{Z}}_p$, whose formal logarithm embeds it in the additive group $p{\mathbb{Z}}_p$. Thus the entire torsion subgroup injects into each of the two finite reduction groups. Its order divides both six and seven, hence is one:Equivalently one may use prime-to-residue-characteristic injection at both primes; it gives the same coprime bound. This is a two-prime bound on rational elliptic torsion.

Choose the blocksIf $p^k\le n<p^{k+1}$, then $|x_n{|}_p=p^{-k}$, so $x_n\to 0$ in ${\mathbb{Q}}_p$. By the ultrametric inequality, for $N\ge M$,The partial sums are Cauchy sequence, and completeness of ${\mathbb{Q}}_p$ proves convergence of $\sum x_n$.

In the real series of p-adic absolute values, the block $p^k\le n<p^{k+1}$ contains $(p-1)p^k$ equal terms of size $p^{-k}$. Its sum is $p-1$, independently of $k$. Infinitely many such positive block sums force divergence. This exhibits p-adic convergence without summable absolute values: the criterion is that the terms tend to zero, rather than real absolute summability.

In the elliptic curve method, addition is attempted modulo the composite number. A denominator that is not a unit in a ring supplies a factor through its greatest common divisor with that number.

First double $P$ using the elliptic-curve addition formula. Its tangent slope isThese calculations are valid modulo $221$ since the only initial denominator is two, which is invertible. Thus $2P=(14,-53)$, equivalently $(14,168)$ modulo $221$.

To form $3P=P+2P$, the chord slope would requireThe denominator hasIt cannot be inverted, and thirteen is the requested proper factor. The failure has a geometric explanation: modulo thirteen, $2P=(1,-1)=-P$, so $3P$ is the point at infinity. Modulo seventeen that chord denominator remains nonzero. The differing behavior at the two primes is exactly what the elliptic curve method detects.

The three suggested values areThere is an obstruction at $p=3$: every integer residue satisfies $x^3-x\equiv 0(\mathrm{mod}3)$, whereas $-1\equiv 2$ is not a square modulo three. Reduction of a solution in the p-adic integers would give an impossible solution modulo three.

At $p=2$, take $x=-2$. The odd 2-adic unit in a ring $-7$ is congruent to one modulo eight, so it is a square in ${\mathbb{Z}}_2$. We use the standard 2-adic square criterion that an odd unit in a ring is a square exactly when it is one modulo eight. Its sufficiency follows by successively adjusting an odd square root modulo $2^m$ by $2^{m-1}$ to obtain the next required square congruence. Thus $y^2=-7$ has a 2-adic integer solution.

For $p\ge 5$ other than $23$, the discriminant of $y^2=x^3-x-1$ isso this model has good reduction of an elliptic curve. Hasse's theorem on elliptic curves givesSince there is just one point at infinity, there is an affine point. Smoothness means that at least one partial derivative of $y^2-x^3+x+1$ is a unit in a ring modulo $p$, so Hensel's lemma lifts the affine point to ${\mathbb{Z}}_p^2$. The last exceptional odd prime is also soluble: at $p=23$, $h(-2)=-7\equiv 16$ has square roots $\pm 4$, which are simple roots of $Y^2+7$ modulo $23$, and lift by Hensel's lemma.

For small-prime checks the suggested values also give $x=0$ at $p=5$ and $x=3$ at $p=7$, where respectively $-1\equiv 2^2$ and $23\equiv 3^2$. ThereforeThe same prime list holds if one only asks for a solution modulo $p$, but the lifting above establishes the asserted p-adic integer solutions. This is local solubility of the cubic x cubed minus x minus one.

Work with the smooth projective cubic, including its points at infinity. For two points $P,Q$, draw their chord, using the tangent when they coincide, and let $R$ be its third intersection counted with intersection multiplicity. Draw the line through $R$ and $o$, again using the tangent if necessary, and let $S$ be its third intersection. Define $P+Q=S$. When $o$ is a flex, this is the familiar reflection of the first third-intersection point across the Weierstrass involution. The two-line construction also works when the chosen identity is not a flex.

To prove associativity without assuming it in the geometry, use divisor class. A nonsingular plane cubic has genus one. By the Riemann-Roch theorem, every divisor class of degree one contains exactly one effective divisor on an algebraic curve of degree one: for such a divisor on an algebraic curve $D$,and $\mathrm{deg}(K_C-D)=-1$, so $\ell (K_C-D)=0$. Thus $\ell (D)=1$, and the nonzero section is unique up to scalar. Over $K$, a degree-one effective divisor on an algebraic curve defined over $K$ is a $K$-rational point. This also proves uniqueness of that point. In particular the mapis injective and identifies these points with the corresponding degree-zero Picard group of a curve: to recover the point from a class, add $[o]$ and take its unique effective representative. This is the elliptic curve group law from Riemann-Roch.

Let $H$ denote the divisor class cut out by a line. The two lines in the chord-and-tangent group law giveTheir difference gives $P+Q\sim o+S$, henceAddition of divisor class is associative. Therefore both $(P+Q)+R$ and $P+(Q+R)$ map to $[P-o]+[Q-o]+[R-o]$. Injectivity of $\iota$ proves the chord-and-tangent group law is associative. The same argument gives identity $o$, commutativity and inverses, and covers tangencies through the use of intersection multiplicities. All constructions are defined over $K$.

For prescribing a factor by elliptic-curve tripling, quadratic reciprocity gives $(3/p)=1$ when $p\equiv 1(\mathrm{mod}12)$. Choose $r\in {\mathbb{F}}_p$ with $r^2=3$ and choose an integer $a$ by the Chinese remainder theorem so thatThen $a^2+6a-3\equiv 0(\mathrm{mod}p)$ and it is four modulo $q$.

The curve $E:y^2=x^3+ax-a$ has discriminant $-16a^2(4a+27)$. At $p$, $a\ne 0$, since otherwise $r=3/2$ would force $p=3$. Also $4a+27=15+8r$ cannot vanish: squaring $8r=-15$ would give $192=225(\mathrm{mod}p)$, forcing $p=3$ or 11, neither in the required class. At $q$, $a=1$ makes $a(4a+27)=31$, and $q\equiv 5(\mathrm{mod}12)$ excludes $q=31$. Thus both reductions are nonsingular.

The point $P=(1,1)$ is on every curve in this family. Doubling it uses the invertible denominator two and givesModulo $p$ this difference vanishes, and the doubling ordinate is $-1$, so $2P=-P$ and $3P$ is the identity. Modulo $q$, taking $a=1$ gives $x(2P)=2$, so $2P$ and $P$ have distinct abscissas and their sum is a finite point.

Consequently the attempted addition computing $3P$ modulo $N$ asks to invert a denominator divisible by $p$ and not by $q$. Its numerator is nonzero modulo $p$, since the two ordinates there are minus one and one, so this is not a removable coincidence. The Euclidean gcd used for inversion returnsa proper factor. Thus the specified elliptic-curve computation successfully factors $N$.

For prime-power contraction in a formal group, a one-dimensional formal group over $R$ has $F(X,Y)=X+Y+$ terms of total degree at least two with coefficients in $R$. Induction under composition therefore givesFor $|x|<1$ this converges and the non-Archimedean inequality gives $|[p](x)|\le \max (|p||x|,|x{|}^2)$. The residue characteristic implies $|p|<1$; in equal characteristic $p$ the linear coefficient is zero, which only improves the bound.

Let $x_n=[p^n](x)$, so $x_{n+1}=[p](x_n)$. If $x=0$ there is nothing to prove. Otherwise put $\rho =\max (|p|,|x|)<1$. Inductively $|x_n|\le |x|$, and then $|x_{n+1}|\le \rho |x_n|$. ThusCompleteness ensures convergence of the formal-series evaluations. The contraction argument in fact does not need the extra discreteness assumption.

For rank-one two-isogeny descent with parameters three and minus three, use the standard two-isogeny rank formula. For $C:y^2=x(x^2+ax+b)$ and its dual curve $D:y^2=x(x^2-2ax+a^2-4b)$, let ${\alpha }_C,{\alpha }_D$ be the abscissa square-class maps, with their usual values at $(0,0)$ and the identity. If $r_C$ is the Mordell–Weil rank, thenFor the present curve $a=3,b=-3$, its possible classes are $1,-1,3,-3$, and the identity and $(0,0)$ supply $1,-3$. Exclude the class three as follows. A point in that class has $x=3(U/V{)}^2$, with coprime integers $U,V$, and substitution in the curve gives the necessary quartic equationwith integer $N$. Modulo three this forces $3\mid V,N$. Coprimality then makes $U$ a unit modulo three, and modulo nine the right side is $3U^4\equiv 3$, while $N^2\equiv 0$, a contradiction. The class minus one is excluded as well, since multiplying it by the known class minus three would give three. Therefore the first image has size two.

The dual curve is $D:y^2=x(x^2-6x+21)$. Its quadratic factor is $(x-3{)}^2+12>0$ on the real line, so every nonzero rational abscissa is positive. By (i) its image is contained in $\{1,3,7,21\}$. The point $(0,0)$ supplies 21 and the point $(3,6)$ supplies three. As the square-class map is a homomorphism, their product supplies seven. All four occur. Hence the descent formula gives $2^{r_C+2}=2\cdot 4=8$, so

For a point with $u\ne 0$, consider the valuation $v_{\ell }$ at any rational prime. If $v_{\ell }(u)<0$, the term $u^3$ has strictly lower valuation than $a_1{u}^2$ and $b_{1}u$, since the coefficients are integral. Thus $2v_{\ell }(v)=3v_{\ell }(u)$, forcing $v_{\ell }(u)$ even. If $v_{\ell }(u)>0$ and $\ell \nmid b_1$, the factor $u^2+a_{1}u+b_1$ is a unit, so $2v_{\ell }(v)=v_{\ell }(u)$, again even. At valuation zero there is no odd exponent to remove.

Therefore every odd valuation in the square class of $u$ lies at a prime dividing $b_1$, and all negative valuations are even. Removing rational squares gives a signed squarefree integer $r$ with $r\mid b_1$. For $(0,0)$ the assigned class is that of $b_1$, whose squarefree representative also divides $b_1$; the identity has representative one. HenceThe brackets stress that these integers represent square classes, which is the target of $q$.

Write the equation as $y^2=x^3-5x^2+4x$. Its duplication formula uses slope $m=(3x^2-10x+4)/(2y)$ and $x(2P)=m^2+5-2x$. At the three listed points the slopes are respectively $i$, $-1+i\sqrt{3}$, and $2+\sqrt{3}$. Substitution givesThese are nonidentity points of order two, so each listed point has exactly order four.

For $p\ne 2,3$ the three distinct roots zero, one and four give the full two-torsion subgroup of order four over ${\mathbb{F}}_p$. At least one of $-1,3,-3$ is a square: if neither of the first two is, their product is. If $-1$ is a square, the first listed point exists over the field. If three is a square, the third exists. If $-3$ is a square, the second can be written $(1-\sqrt{-3},3+\sqrt{-3})$ and exists without requiring the two separate square roots. The duplication computations remain valid after reduction; their ordinates do not vanish unless $p=2$ or three. Thus a rational two-torsion point has a half over the field. Together with a different two-torsion point this generates a subgroup of order eight. Consequently $\boxed{8\mid \#E({\mathbb{F}}_p)}$ for every stated prime.

Over the rationals there are already four two-torsion points, including the identity. Counting at five gives eight points: the abscissas zero, one and four give one ordinate each, two and three give two each, and there is the identity. Thus rational torsion has order dividing eight.

There are no rational points of order four. For a curve $y^2={\prod }_j(x-e_j)$, translating $e_i$ to zero and using the duplication formula shows that a half of $(e_i,0)$ must satisfy $(x-e_i{)}^2=(e_i-e_j)(e_i-e_k)$. For the three roots here, the candidate abscissas are $\pm 2$, $1\pm \sqrt{-3}$, and $4\pm 2\sqrt{3}$. The last two pairs are nonrational; at $x=2,-2$ the ordinate squares are $-4,-36$, also impossible over $\mathbb{Q}$. A group of order eight containing this two-torsion subgroup would contain an element of order four, because an elliptic curve has only four points killed by two. Hence