The curve has good reduction at five and seven: its discriminant is $-432D^2$, and the hypotheses make $D$ a unit at those primes. Over ${\mathbb{F}}_5$ the cubing map is a bijection, soThe character sum vanishes after replacing $x^3+D$ by a variable ranging over the whole field. Over ${\mathbb{F}}_7$, where $D=2$, the possible cubes are zero once, one three times, and minus one three times. The corresponding right sides are two, three and one. Two and one are nonzero squares while three is not, so the count is $1+2+0+6=9$.

Rational torsion injects into the reduction group at a good odd prime, a standard reduction theorem. Thus its order divides $\gcd (6,9)=3$. If a point of order three existed, its coordinates would be integral by the Nagell–Lutz theorem. Since $2P=-P$, the duplication formula givesThus either $x=0$ and $y^2=D$, or $x^3=-4D$ and $y^2=-3D$.

At the prime in the hypothesis, $D$ is a nonsquare unit. Since $p\equiv 1(\mathrm{mod}3)$, there is a nontrivial cube root of unity $\zeta \in {\mathbb{F}}_p$, and $(2\zeta +1{)}^2=-3$. Hence $-3$ is a nonzero square, so both $D$ and $-3D$ are nonsquares. Neither ordinate equation is possible even modulo $p$. There is no rational point of order three, proving

Here $4A^3+27B^2=31$. A nonzero ordinate of a torsion point must have its square dividing 31, so $y=\pm 1$. The curve equation then becomes $x(x^2+1)=0$, whose only integer solution is $x=0$. No point with $y=0$ exists over the rationals: the monic cubic $x^3+x+1$ has no integer root, since its only possible integer roots are $\pm 1$ and neither works.

It remains to test $(0,\pm 1)$. Doubling either gives abscissa $(1/(\pm 2){)}^2=1/4$, which is not an integer. If the original point were torsion its double would satisfy the integrality part of the Nagell–Lutz theorem, a contradiction. ThereforeThe rational point $(0,1)$ consequently has infinite order, so its multiples give infinitely many distinct rational points.

For a nonsingular curve $y^2=x^3+Ax+B$ with integers $A,B$, the Nagell–Lutz theorem states that a finite rational torsion point has integer coordinates and satisfies either $y=0$ orThe point at infinity is the identity and is treated separately. Integrality is the result allowed in the source. To prove the remaining divisibility, suppose $y\ne 0$. Then the doubled point is finite and also torsion, so its coordinates are integral. Its tangent slope is $m=(3x^2+A)/(2y)$ and its abscissa is $m^2-2x$. Thus $m^2$ is an integer. A rational number whose square is an integer is itself an integer, so $2y$ divides $3x^2+A$. In particular $y^2$ divides ${\psi }_1(x)=(3x^2+A{)}^2$. It also divides ${\psi }_2(x)=x^3+Ax+B=y^2$. Evaluating the permitted polynomial identity at the integer $x$ therefore proves the divisibility of $4A^3+27B^2$ by $y^2$.

For $y=0$, the point equals its negative and has order two. The theorem gives a finite set of torsion candidates, but the divisibility condition by itself does not assert that every candidate is torsion.

Let $\alpha ,\beta ,\gamma$ be the nonzero reductions of $a,b,c$. The square set in ${\mathbb{F}}_p$ has $(p+1)/2$ members, including zero. Multiplication by $\alpha$, and separately the transformation $z\mapsto \gamma -\beta z$, preserve this cardinality. Hence the two sets in the hint have total cardinality $p+1>p$ and must intersect. This gives a solution $(x_0,y_0)$ modulo $p$.

The solution cannot have both coordinates zero since $\gamma \ne 0$. If $x_0\ne 0$, choose any integral lift of $y_0$ and apply Hensel's lemma to the polynomial $a{X}^2+b{y}_0^2-c$ in $X$: its derivative at the reduced root is $2\alpha x_0\ne 0$. If $y_0\ne 0$, use the other variable instead. The nonzero derivative uses $p\ne 2$. Thus a solution lifts to $\boxed{x,y\in {\mathbb{Z}}_p}$ as required.

The reduction has equation $F=x^3+y^3=0$. At the origin both first partial derivatives vanish, so the point is singular, also when $p=3$. A lift reducing to the origin would require $x,y\in p{\mathbb{Z}}_p$. Its two cubes would then lie in $p^3{\mathbb{Z}}_p$, whereas the right side of the original equation has valuation one. This is impossible.

For an example which does lift, chooseIt has the same reduction and the rational point $(p,0)$ reduces to the origin. Over ${\mathbb{Q}}_p$, which has characteristic zero, a singular affine point would require $x=y=0$, which does not lie on this curve. Its projective closure is also smooth: the simultaneous partial derivatives of $X^3+Y^3-p^3{Z}^3$ cannot vanish at a projective point. Thus this is a nonsingular curve for every prime $p$, including three. A singular point in the reduction can therefore fail to lift or can lift, depending on the original equation.

The expansion isThe notation has the units digit before the comma and successive positive powers afterwards, as defined in the source. To check it, the geometric series converges in the 3-adic norm and its sum is $1+(3+2\cdot 3^2)/(1-3^2)=1-21/8=-13/8$.

For the general repeating block, $|p^2{|}_p<1$ givesBoth numerator and denominator are integers, and the denominator is a $p$-adic unit.

For $p=3$, a root would have valuation zero because five is a unit. It would therefore reduce to a unit cube modulo nine. The only cube residue classes modulo nine are $0,1,-1$, none equal to five. Thus no root exists in ${\mathbb{Q}}_3$.

For $p=5$, the valuation equation would be $3v_5(x)=1$, impossible because the valuation of a nonzero element of ${\mathbb{Q}}_5$ is an integer. Thus no root exists in ${\mathbb{Q}}_5$.

For $p=13$, $7^3\equiv 5(\mathrm{mod}13)$ and the derivative $3\cdot 7^2\equiv 4\not\equiv 0(\mathrm{mod}13)$. Hensel's lemma lifts this simple root to a root in ${\mathbb{Z}}_{13}\subseteq {\mathbb{Q}}_{13}$. Thus a root exists in ${\mathbb{Q}}_{13}$.

If $p\equiv 1(\mathrm{mod}4)$, choose $i\in {\mathbb{F}}_p$ with $i^2=-1$. The cubic has the three distinct roots $0,im,-im$, so all four two-torsion points are rational over ${\mathbb{F}}_p$. They form a subgroup of order four, hence $4\mid \#E({\mathbb{F}}_p)$ by Lagrange's theorem.

If $p\equiv 3(\mathrm{mod}4)$, let $\chi$ be the Legendre symbol with $\chi (0)=0$. Since $f(x)=x(x^2+m^2)$ is odd and $\chi (-1)=-1$, the terms for $x$ and $-x$ cancel in ${\sum }_x\chi (f(x))$. Counting the possible second coordinates givesThus in both casesThe assumptions $p\ne 2$ and $m\ne 0$ ensure nonsingularity and keep the displayed two-torsion roots distinct when they exist.

Write $x=c/d$ in lowest terms and put $H=\max \{|c|,|d|\}\ge 1$. For $P\ne O,(0,0)$,Before reduction to lowest terms, both numerator and denominator are bounded in magnitude by $(1+|a|+|b|)H^2$. Cancellation can only decrease the height. Hence one may chooseThe duplication formula for $C$ isThe numerator has magnitude at most $(1+|b|{)}^2{H}^4$, and the denominator at most $4(1+|a|+|b|)H^4$. Thussatisfies the second bound. At the identity or any point whose relevant image is the identity, the image height is zero and the same nonnegative constants work directly. Thus the formulas cover every rational point, including the exceptional points of the displayed coordinate expressions.

The doubling slope at $P=(2,1)$ is $(3\cdot 2^2-1)/(2\cdot 1)=11/2$, givingThese denominators are invertible modulo $N$. To add $P$ again, the difference of first coordinates is $105/4-2=97/4$, so the new slope would be $-1083/194$. This requires inversion of a number divisible by 97. The elliptic curve method instead computesIt is a proper factor. The failure of the group-law division modulo the composite integer reveals different behavior modulo its prime factors.

Here $a=1$, $b=-2$ and the two-isogenous curve is $D:v^2=u(u^2-2u+9)$. Let ${\delta }_C$ and ${\delta }_D$ be the first-coordinate square-class maps, using the coefficient $b$ or $b_1$ at the point $(0,0)$. The same chord argument shows that both maps are homomorphisms.

For an equation $y^2=x(x^2+ax+b)$ with integer coefficients, its first-coordinate square class has a square-free representative dividing $b$, including a possible sign. Indeed, at a prime not dividing $b$, a negative valuation of $x$ must be even because $x^3$ dominates; a positive valuation must be even because $x^2+ax+b$ is a unit. Thus only primes dividing $b$ can occur to odd order. For $C$, the possibilities are $1,-1,2,-2$. The classes $1,-2$ occur at the identity and $(0,0)$. If class two occurred, write $x=2M^2/e^2$ with coprime integers $M,e$. Substituting in the equation would give a rational square, necessarily an integer square,Modulo three, the right side is two whenever $M,e$ are not both divisible by three: this holds whether just one or both are units. That is impossible. Since the image is a subgroup containing $-2$, exclusion of two also excludes minus one. Therefore $|{\delta }_C(C(\mathbb{Q}))|=2$.

For $D$, the quadratic $u^2-2u+9=(u-1{)}^2+8$ is positive, so every nonzero first coordinate is positive. Its square class can only be one or three. Both occur, with three supplied by $(3,6)$, so $|{\delta }_D(D(\mathbb{Q}))|=2$.

Let $\psi :D\to C$ be the dual two-isogeny, with $\psi \varphi =[2]$. The kernel identities of part (ii), applied to both curves and the usual coordinate scaling, give $[C:\psi D]=2$ and $[D:\varphi C]=2$. Moreover $\ker \psi =\{O,T_1\}$ lies in $\varphi C$, since $b_1=9$ is a square. Thus $[\psi D:2C]=[D:\varphi C]=2$, andThis is a rank-zero two-isogeny descent for roots zero one and minus two. The rational two-torsion has four points, since the cubic factors as $x(x-1)(x+2)$. By the Mordell-Weil theorem, the last index is $2^r|C(\mathbb{Q})[2]|=2^{r+2}$. Therefore

For an affine point of $C$ with $x\ne 0$, the first coordinate of its image is $(y/x{)}^2$. Thus its image has trivial square class whenever that coordinate is nonzero. The identity and $T=(0,0)$ map to the identity. If a point maps to $T_1=(0,0)$, it has $y=0$ and $x^2+ax+b=0$, forcing $b_1=a^2-4b$ to be a rational square; in that case $q(T_1)=1$ too. Hence $\varphi (C(\mathbb{Q}))\subseteq \ker q$.

Conversely, let $(u,v)\in D(\mathbb{Q})$ have $q(u,v)=1$ and $u\ne 0$. Write $u=t^2$ with $t\in {\mathbb{Q}}^{\ast }$. The equation of $D$ givesSet $x=(u-a+v/t)/2$ and $y=tx$. Then $x$ solves $x^2+(a-u)x+b=0$ and is nonzero because $b\ne 0$. Hence $y^2=u{x}^2=x(x^2+ax+b)$, so $(x,y)\in C(\mathbb{Q})$. Also $x-b/x=v/t$, giving $\varphi (x,y)=(u,v)$.

The identity is an image of the identity. Finally, $T_1\in \ker q$ exactly when $b_1$ is a rational square; then either nonzero root $x=(-a\pm \sqrt{b_1})/2$ gives $(x,0)\in C(\mathbb{Q})$ mapping to $T_1$. This covers all exceptional points and proves

In the typical case, the line through $P,Q$, or their tangent when they coincide, is $v=mu+c$. Its intersections with $D$ have first coordinates given byTheir product is $c^2$. The third intersection is $-(P+Q)$, which has the same first coordinate as $P+Q$. ConsequentlyPassing to the quotient by rational squares gives $q(P)q(Q)q(P+Q)=1$. Every square class is its own inverse, soThe excluded cases have their specified special values; the source asks only for this chord-and-tangent argument away from them.

The discriminant is $-64D^3$, which is nonzero modulo three because $D\equiv 2(\mathrm{mod}3)$. Thus there is good reduction at three. For every $x\in {\mathbb{F}}_3$, the reduced right side is $x^3-x=0$, so its only affine points are $(0,0),(1,0),(2,0)$. Together with the identity they form $C_2\times C_2$.

By part (ii), the rational torsion subgroup injects into this four-element group and hence has exponent two. Over $\mathbb{Q}$, the two-torsion points have $Y=0$, requiring $X(X^2+D)=0$. Since $D>0$, the only rational root is zero. Therefore

For a short Weierstrass equation of an elliptic curve with coefficients in the p-adic integers, a point with nonintegral $x$ has valuations $v_p(x)=-2m$ and $v_p(y)=-3m$ for some integer $m\ge 1$: the term $x^3$ strictly dominates $Ax+B$ in the equation, so $2v_p(y)=3v_p(x)$. Its formal parameter $T=-x/y$ therefore has valuation $m\ge 1$. These points, together with the identity, form the formal neighborhood $E_1({\mathbb{Q}}_p)$ of the identity, with parameter in $p{\mathbb{Z}}_p$ and the elliptic formal group law over the p-adic integers. For a point with $x\in {\mathbb{Z}}_p$, the equation gives $y\in {\mathbb{Z}}_p$ too.

The formal neighborhood has no nontrivial torsion. Multiplication by an integer coprime to $p$ has series $[m](T)=mT+O(T^2)$ and preserves $|T{|}_p$, so any torsion there must have $p$-power order. If $p\ge 3$, part (i) gives $|T{|}_p\ge p^{-1/(p-1)}>p^{-1}$, contradicting $T\in p{\mathbb{Z}}_p$.

The printed hypotheses also allow $p=2$. In that case, a nontrivial torsion point in the formal neighborhood would have order a power of two and hence yield a point of order two in that neighborhood. But every nonidentity point of order two on a short Weierstrass equation of an elliptic curve has $y=0$ and $x$ a root of the monic cubic over the p-adic integers $X^3+AX+B$. Such a root lies in the p-adic integers, so it cannot belong to the formal neighborhood, whose nonidentity points have nonintegral coordinates. This excludes the remaining case. This is the torsion-free formal subgroup for a short Weierstrass equation. Thus every affine torsion point satisfiesWith good reduction, the reduction homomorphism $E({\mathbb{Q}}_p)\to \tilde{E}({\mathbb{F}}_p)$ has kernel exactly this torsion-free formal neighborhood. Its restriction to the torsion subgroup is therefore injective, proving the required subgroup isomorphism. The short model over the p-adic integers is essential to the prime-two argument; no blanket torsion-injectivity assertion for arbitrary models is needed.

If $p=0$ as an element of $K$, the stated lower bound is zero and is immediate. Otherwise set ${\rho }_1=|p{|}^{1/(p-1)}$. The supplied formal group expansion has $g(0)=0$, because $[p](0)=0$. For $z\in \mathcal{M}$, the non-Archimedean estimates giveIf $0<|z|<{\rho }_1$, then $|z{|}^p<|p||z|$, so the two terms cannot cancel and $|[p](z)|=|p||z|>0$. The same strict inequality persists under iteration, so no such $z$ can have finite $p$-power order. Every nonzero $p$-power torsion point therefore satisfies $|z|\ge {\rho }_1$.

For a point of order $p$, $[p](z)=0$ itself forces $|p||z|\le |z{|}^p$, proving the bound for $n=1$. For $n\ge 2$, put $w=[p](z)$, of order $p^{n-1}$. Since $|z|\ge {\rho }_1$, the preceding maximum is $|z{|}^p$. By induction,This proves the formal torsion radius for prime power order. Taking the positive $p$th root gives

Choose a nonzero integer $D$ with $D\alpha ,D\beta \in \mathbb{Z}$. By the Chinese remainder theorem, choose $z_n\in \mathbb{Z}$ satisfying $z_n\equiv D\alpha (\mathrm{mod}{q}^n)$ and $z_n\equiv D\beta (\mathrm{mod}{r}^n)$. Put $x_n=z_n/D$. ThenThis proves the requested simultaneous approximation, even when the rational targets have denominators divisible by either prime.

A rational sequence converging to zero at every standard absolute value is:Its ordinary absolute value is at most $1/n!$, hence tends to zero. For a fixed prime $p$ and all sufficiently large $n$, the denominator is congruent to one modulo $p$, so $v_p(y_n)=v_p(n!)\to \infty$. Therefore $|y_n{|}_p\to 0$ for each prime as well. The assertion concerns each fixed prime separately, rather than uniform convergence over all primes.

No prime works. The p-adic valuation induces a well-defined homomorphismThe class of $p$ maps to one, whereas the class of $p^p$ maps to zero. They therefore cannot be equal. Equivalently, $p$ cannot be a $p$th power because its valuation is not divisible by $p$.

In the P-adic numbers, ${\sum }_{j\ge 0}{p}^{2j}$ converges to $1/(1-p^2)$. ConsequentlySince $p\ne 2$, the digits one and two are both between zero and $p-1$, so no carrying is required. These are its p-adic digits, with the unique negative-power digit at exponent minus one.

The strict inequality means $v_3(x^2+2)>2$. Taking $x=5$ gives $x^2+2=27$, soFor the other expression, if $3\nmid x$ then $x^2+3\not\equiv 0(\mathrm{mod}3)$ and its p-adic valuation is zero. If $3\mid x$, then $x^2+3=3(3(x/3{)}^2+1)$ has p-adic valuation exactly one. It can never have valuation greater than two. Thus no such integer exists for the second strict inequality.