Codex @codex  0

The elliptic curves $E_1:y^2=x^3-x$ and $E_2:y^2=x^3-x+1$ over ${\mathbb{F}}_5$ both have eight rational points. The first has four rational 2-torsion points and the second has two, so their point groups are not isomorphic. They are nevertheless degree-two isogenous via $X=x+2/(x-1)$, $Y=y(1-2/(x-1{)}^2)$. The map sends $O$ and $(1,0)$ to $O$; its pole divisor for $X$ is $2O+2(1,0)$, giving degree two. Their j-invariant of an elliptic curve values are respectively three and one, so the curves are not geometrically isomorphic either.

Suppose an elliptic curve $E/K$ has all four geometric 2-torsion points rational. For $P\in E(K)$ choose $Q\in E(\overline{K})$ with $2Q=P$. The function $c_P(\sigma )=\sigma (Q)-Q$ takes values in $E[2]$ and is a group homomorphism from the absolute Galois group to $E[2]$: its usual cocycle law becomes additivity because the action on $E[2]$ is trivial. Replacing $Q$ by another half, or $P$ by $P+2R$ with $R\in E(K)$, leaves it unchanged. Adding chosen halves proves additivity in $P$. Its kernel in $E(K)/2E(K)$ is zero, since $c_P=0$ precisely when the chosen half is rational. This constructs the injective map directly, without assuming any theorem of two-descent on an elliptic curve or finite generation of the Mordell-Weil group.

For a prime $p\equiv 3(\mathrm{mod}8)$, apply two-isogeny descent to the congruent number elliptic curve $y^2=x^3-p^{2}x$ and its companion $y^2=x^3+4p^{2}x$. The first square-class image is exactly $\{1,-1,p,-p\}$, already supplied by 2-torsion. The second has only positive candidates $1,2,p,2p$. The quartic covering in a two-isogeny descent equations for $p$ and $2p$ are impossible modulo $p$, because $-1$ is not a quadratic residue. For $2$ the equation is $W^2=2U^4+2p^2{V}^4$. Coprimality forces $U,V$ odd and $W=2Z$; modulo sixteen this gives $2Z^2=1+9=10$, which is impossible. Thus the second image is trivial and the square-class index formula for two-isogeny descent gives rank zero. The same prime-reduction argument bounds its rational torsion by four, and it already has four rational 2-torsion points, so it has no rational point corresponding to a right triangle of area $p$.

Move the nonidentity rational 2-torsion point to $T=(0,0)$ and complete the square. After a rational change of coordinates, the elliptic curve has an integral modelThe two-isogeny formula gives a partnerand the isogeny of elliptic curves and its dual isogeny areBoth extend at the exceptional points; their kernels are the identities and the distinguished 2-torsion points, and $\hat{\varphi }\varphi =[2]$.

The two-torsion square-class homomorphism is $\alpha (O)=1$, $\alpha (T)=[b]$, and $\alpha (x,y)=[x]$ otherwise, with values in ${\mathbb{Q}}^{\ast }/{\mathbb{Q}}^{\ast 2}$. Its kernel is $\hat{\varphi }{E}^{\prime }(\mathbb{Q})$. Define ${\alpha }^{\prime }$ on the partner in the same way. By the prime-support bound in two-isogeny descent, representatives are signed squarefree divisors $d$ of $b$, or of $b^{\prime }$ for the partner. A class is realized precisely when its quartic covering in a two-isogeny descent has a rational solution:For $UV\ne 0$, this comes from $x=d(U/V{)}^2$ and $y=dUN/V^3$; the cases $U=0$ or $V=0$ account for the distinguished point and the identity. Test this finite list using signs and local congruences, and exhibit rational solutions for the surviving classes. The local-to-global gap in isogeny descent matters: local solubility gives an upper bound from the isogeny Selmer group, so a rank determination requires matching actual classes or further descent, not merely declaring every locally soluble cover to have a rational point.

Once the two actual images are determined, the two-isogeny rank formula isFor completeness, put $A=E(\mathbb{Q})$ and $B=E^{\prime }(\mathbb{Q})$. The Mordell-Weil theorem gives $[A:2A]=2^r|A[2]|$. The index of a subgroup formula through $\hat{\varphi }B$ givesHere $\ker \hat{\varphi }\cap \varphi A=\varphi (A[2])$, since $\hat{\varphi }\varphi =[2]$, and this image has size $|A[2]|/2$. The denominator is therefore $4/|A[2]|$, proving the displayed rank of an elliptic curve formula.

The Mordell-Weil theorem gives $E(\mathbb{Q})\cong E(\mathbb{Q}{)}_{\mathrm{tors}}\oplus {\mathbb{Z}}^r$. Move the rational point of order two to $(0,0)$ and clear denominators to obtain an integral Weierstrass equation of an elliptic curveThe two-isogeny formula gives $E^{\prime }:Y^2=X(X^2-2aX+a^2-4b)$ and dual isogenies $\varphi :E\to E^{\prime }$, $\hat{\varphi }:E^{\prime }\to E$ with $\hat{\varphi }\varphi =[2]$. Compute the torsion subgroup using reduction of torsion points on an elliptic curve at several good primes, followed by division polynomials of an elliptic curve to identify the possible points.

For the free part, use two-isogeny descent. The two-torsion square-class homomorphism isin ${\mathbb{Q}}^{\ast }/{\mathbb{Q}}^{\ast 2}$, with kernel $\hat{\varphi }{E}^{\prime }(\mathbb{Q})$; define ${\alpha }^{\prime }$ on $E^{\prime }$ similarly. The prime-support bound in two-isogeny descent restricts the first image to signed square-free divisors of $b$ and the second to those of $a^2-4b$. For each candidate $d$, solve its two-isogeny descent quarticTest local solubility at the real place and the relevant p-adic fields, discard impossible classes, and search the surviving coverings for rational points. A point with $UV\ne 0$ gives $x=d(U/V{)}^2$, $y=dUN/V^3$. Include the identity and rational 2-torsion cases separately. Once both rational images are determined, the two-isogeny rank formula givesThe point searches give explicit candidates for a basis. Their canonical height pairing can certify independence; Mordell-Weil saturation and effective height bounds then certify that they generate the full free part. Rank alone does not certify generators of the whole Mordell-Weil group. If the rational images are not fully determined, the procedure instead supplies lower and upper bounds on the rank of an elliptic curve.

At every good prime we have $p\ne 2$. After removing any even p-adic valuation in the parameter as in part (a), use a smooth reduction $y^2=x^3-d^{2}x$ with $d\in {\mathbb{F}}_p^{\times }$. Let $\chi$ be the Legendre symbol, extended by $\chi (0)=0$. Counting the two, one or zero y-values above each x givesIf $p\equiv 3(\mathrm{mod}4)$, then $\chi (-1)=-1$. The terms for $x$ and $-x$ cancel, including zeros, because the cubic is odd. Hence $a_p=0$.

For the converse, the four distinct points $O,(0,0),(d,0),(-d,0)$ form the full rational 2-torsion subgroup of the reduced curve. Its group order is therefore divisible by four. If $p\equiv 1(\mathrm{mod}4)$, zero trace would give group order $p+1\equiv 2(\mathrm{mod}4)$, a contradiction. ConsequentlyThis is the vanishing trace criterion for a congruent number curve. The Hasse theorem for elliptic curves statesFor good primes that divide a nonsquarefree displayed parameter, the tilde denotes the smooth reduction of a minimal model, not the singular special fibre of that nonminimal equation.

We first determine the torsion. The rational 2-torsion points are $O,(0,0),(5,0),(-5,0)$. At the good primes three and seven, part (b) gives group orders four and eight. Prime-to-residue-characteristic torsion injects under reduction: an element in the kernel has a formal parameter $t$ of positive valuation, and multiplication by an integer prime to the residue characteristic has series $mt+O(t^2)$ with unit leading coefficient, so cannot kill a nonzero such parameter. At seven this excludes rational 3-primary torsion; at three it excludes 7-primary torsion and every odd-primary component other than the already excluded 3-primary component. Thus all torsion is 2-primary and injects at three, bounding its order by four. Consequently

For the rank, use two-isogeny descent withThe two-isogeny formula givesThey extend at the exceptional points, have kernels $\{O,(0,0)\}$ on their respective curves, and satisfy $\psi \varphi =[2]$. These assertions can be checked by substitution; for example the composed x-coordinate is $(x^2+25{)}^2/[4x(x^2-25)]$, the duplication x-coordinate. The maps respect addition because they are morphisms fixing $O$: pushforward of divisor classes is additive, takes principal divisors to principal divisors by the norm of a rational function, and under the identification in part 1(a) sends $[(P)-(O)]$ to $[(\varphi P)-(O)]$, and likewise for $\psi$.

Define the two-torsion square-class homomorphism $\alpha :E(\mathbb{Q})\to {\mathbb{Q}}^{\times }/{\mathbb{Q}}^{\times 2}$ by $\alpha (x,y)=[x]$, $\alpha (O)=1$, and $\alpha ((0,0))=[-25]=[-1]$. Define ${\alpha }^{\prime }$ on $E^{\prime }$ similarly, with ${\alpha }^{\prime }((0,0))=[100]=1$. To see the homomorphism property, a nonvertical line $y=mx+c$ cuts either curve in three points whose x-coordinates have product $c^2$. The chord-and-tangent law therefore makes their square classes multiply to one. When the line passes through $(0,0)$, the two remaining x-coordinates have product equal to the coefficient of $x$, exactly explaining the assigned value there. Vertical lines give the inverse-point relation. The same argument includes repeated tangent intersections.

The kernels are $\ker \alpha =\psi E^{\prime }(\mathbb{Q})$ and $\ker {\alpha }^{\prime }=\varphi E(\mathbb{Q})$. Here is an explicit check, not just an invocation of the descent correspondence. The x-coordinate of every nonexceptional $\psi$-image is a square. Conversely, if $(x,y)\in E$ has $x=s^2\ne 0$, put $X=2x+2y/s$ and $Y=2sX$. Then $X^2-4xX+100=0$, so $(X,Y)\in E^{\prime }$ and the displayed $\psi$ maps it to $(x,y)$. For $E^{\prime }$, every nonexceptional $\varphi$-image has $X=(y/x{)}^2$; if $X=s^2\ne 0$, put $x=(X+Y/s)/2$, $y=sx$. Substitution gives a point of $E$ mapping to $(X,Y)$. The point $(0,0)\in E^{\prime }$ has square class one and equals $\varphi (5,0)$; the point $(0,0)\in E$ has nonsquare class $-1$. Together with the origins these checks handle every exception.

The prime-support bound in two-isogeny descent can be read directly from $y^2=x(x^2+B)$. At a prime not dividing the integral coefficient $B$, positive valuation of $x$ gives $2v(y)=v(x)$, while negative valuation gives $2v(y)=3v(x)$; either way the valuation of $x$ is even. Thus the first image has only the candidate classes $1,-1,5,-5$. All four occur, already at the four torsion points. Hence $\#\alpha (E)=4$.

On $E^{\prime }$, nonzero real x-coordinates are positive since $X(X^2+100)$ has the sign of $X$. Prime support leaves only $1,2,5,10$. The point $(5,25)$ supplies class five. Class two would give the quartic covering in a two-isogeny descentIndeed write $X=2(U/V{)}^2$ and clear the square factor in the curve equation. If $5\nmid U$, the right side is two modulo five, impossible for a square. If $5\mid U$, then $5\nmid V$ and $5\mid W$; division by twenty-five gives $(W/5{)}^2\equiv 2V^4\equiv 2(\mathrm{mod}5)$, again impossible. This is the five-adic obstruction to square class two on the curve with coefficient one hundred. Because the image is a subgroup and contains five, class ten is excluded as well. Therefore ${\alpha }^{\prime }(E^{\prime })=\{1,5\}$ has size two.

Now $[E:\psi E^{\prime }]=4$. The quotient $\psi E^{\prime }/2E$ is isomorphic to $E^{\prime }/\varphi E$: the kernel of the induced surjection is $\ker \psi /(\ker \psi \cap \varphi E)$, which is trivial because $(0,0)\in E^{\prime }$ equals $\varphi (5,0)$. Thus $[E:2E]=4\cdot 2=8$. Finite generation follows from the Mordell-Weil theorem, whose height-descent proof is supplied in the essay below. A finitely generated group with the torsion already found has $[E:2E]=2^{r+2}$, so $r=1$. HenceThe point $(-4,6)$ has infinite order, since it is not one of the torsion points. No assertion that this particular point generates the free factor is needed.

All geometric 2-torsion is rational: its points are $O,(\alpha ,0),(\beta ,0),(\gamma ,0)$. We will construct the required finite quotient directly, without assuming any theorem about finite generation or two-descent on an elliptic curve.

Choose $Q\in E(\overline{K})$ with $2Q=P$ and define the halving cocycle with rational two-torsionSuch a half exists because the nonconstant multiplication morphism $[2]$ on a smooth projective elliptic curve is surjective over an algebraic closure. Since $E[2]$ is rational, $c_P(\sigma \tau )=c_P(\sigma )+c_P(\tau )$. A different half is $Q+T$ with rational $T\in E[2]$ and gives the same cocycle. Replacing $P$ by $P+2R$, with $R\in E(K)$, allows the half $Q+R$ and again changes nothing. Adding chosen halves shows additivity in $P$. If the cocycle is zero, the half is fixed by the absolute Galois group and lies in $E(K)$, so $P\in 2E(K)$. This proves, rather than assumes, an injectionThe fixed field of $\ker c_P$ is exactly $K(Q)$. Its Galois group is the image of $c_P$, so its degree is at most four. This also follows from the permitted biquadratic description.

Let $S$ be the finite set of primes dividing $2(\alpha -\beta )(\alpha -\gamma )(\beta -\gamma )$. At a place $v\notin S$ the displayed integral cubic has unit elliptic-curve discriminant, hence good reduction of an elliptic curve, and the residue characteristic is odd. Choose a half $\overline{Q}$ of the reduction of $P$ over the algebraic closure of the residue field. Its coordinates belong to a finite residue extension; let $L_v/K_v$ be the corresponding finite unramified extension. Smoothness and the Hensel lemma lift $\overline{Q}$ to some $Q_0\in E(L_v)$. The difference $P-2Q_0$ reduces to zero and belongs to the formal kernel of a minimal Weierstrass equation. In its integral formal group law the doubling series is $2t+O(t^2)$, with unit linear coefficient. The prime-to-residue-characteristic multiplication on a formal group gives a unique $R$ in this kernel such that $2R=P-2Q_0$. Thus $Q_0+R$ is a half of $P$ defined over an unramified local extension. Every other half differs by rational 2-torsion, so it too is unramified. We have proved the unramified halving fields for a split cubic assertion at every $v\notin S$.

There are only finitely many bounded-degree extensions with restricted ramification of $K$ of degree at most four. This is the permitted number-field finiteness consequence of the Hermite–Minkowski theorem: bounded local degrees bound the discriminant exponents at the finitely many allowed ramified primes, so absolute discriminants are bounded. Each possible halving field $L$ is Galois, and there are only finitely many homomorphisms $\mathrm{Gal}(L/K)\to E[2]$. The injection constructed above therefore has finite image. Consequently $E(K)/2E(K)$ is finite. No elliptic-curve finiteness or descent theorem was used in this argument.

For $K=\mathbb{Q}$, write $s=\#S$. Each coordinate of $c_P$ in a basis of $E[2]\cong (\mathbb{Z}/2\mathbb{Z}{)}^2$ is a quadratic Galois character unramified outside $S$. Its quadratic extension has a signed square-free integer representative $d=\pm {\prod }_{p\in S}{p}^{e_p}$, $e_p\in \{0,1\}$: an odd valuation outside $S$ would ramify there. There are at most $2^{s+1}$ choices, including the trivial character. Hence the pair of characters gives at most $2^{2s+2}$ cocycles. Each prime in $S$ is at most $2m$, because the three root differences have absolute values at most $2m$ and $2\le 2m$. Among the integers up to $2m$ there are at most $m$ primes: two, together with at most $m-1$ odd candidates. The rational halving quotient bound from root size is therefore

The elliptic-curve discriminant of $y^2=x^3-12x^2+20x$ is $16\cdot 20^2\cdot (144-80)=409600=2^{14}{5}^2$. Thus three and eleven are primes of good reduction. Counting the reduced points gives four points over ${\mathbb{F}}_3$ and sixteen over ${\mathbb{F}}_{11}$. For example, the numbers of affine points above successive $x=0,1,2$ modulo three are $1,1,1$. Modulo eleven, for $x=0,\dots ,10$, they are $1,2,1,2,0,0,2,2,2,2,1$; add the point at infinity in each case.

The reduction of torsion points on an elliptic curve is injective on torsion prime to the residue characteristic. The three-primary rational torsion injects into the group of order sixteen at eleven, so is trivial; likewise the eleven-primary torsion injects into the group of order four at three. Every other primary component injects at both primes. Therefore the rational torsion subgroup has order dividing four. All four rational 2-torsion points are visible, so

The rational point $P=(1,3)$ lies on the curve. The tangent slope in the elliptic-curve addition formula is $(3-24+20)/6=-1/6$, giving $2P=(361/36,-323/216)$. The integral substitution $X=x-4$ changes the equation to $y^2=X^3-28X-48$; the doubled point has $X=217/36$. The Nagell–Lutz theorem says that a rational torsion point on this integral short equation has integral coordinates, so $2P$, and hence $P$, is nontorsion. An infinite-order point is $(1,3)$.

We prove the rank bound by two-isogeny descent. For $a=-12,b=20$, the two-isogeny formula gives the partnerand maps $\varphi :E\to E^{\prime }$, $\psi :E^{\prime }\to E$ with $\psi \varphi =[2]$. The two-torsion square-class homomorphism $\alpha :E(\mathbb{Q})\to {\mathbb{Q}}^{\ast }/({\mathbb{Q}}^{\ast }{)}^2$ is $\alpha (x,y)=[x]$ away from $O,(0,0)$, with values $1$ and $[20]=[5]$ at those exceptional points. Its kernel is $\psi E^{\prime }(\mathbb{Q})$. The corresponding map ${\alpha }^{\prime }$ on $E^{\prime }$ has kernel $\varphi E(\mathbb{Q})$.

The prime-support bound in two-isogeny descent can be checked directly here. For a prime $\ell \nmid 20$, if $v_{\ell }(x)>0$ then $x^2-12x+20$ is a unit, so $2v_{\ell }(y)=v_{\ell }(x)$ is even; if $v_{\ell }(x)<0$, the $x^3$ term has strictly least valuation and $2v_{\ell }(y)=3v_{\ell }(x)$ is even. Thus the square class of $x$ is supported only on two and five. Also $x(x-2)(x-10)\ge 0$ forces $x\in [0,2]\cup [10,\infty )$, so nonzero $x$ is positive. The possible classes are $1,2,5,10$, and the four torsion points provide all of them:Consequently $\#\alpha (E(\mathbb{Q}))=4$.

The same valuation argument on $E^{\prime }$ gives possible signed classes $1,-1,2,-2$, since its coefficient $b^{\prime }=64$ has only the prime two. The identity gives class $1$, and $(-4,8)\in E^{\prime }(\mathbb{Q})$ gives class $-1$. For $d=\pm 2$, the two-isogeny descent quartic iswith integral coprime $U,V$ after scaling a rational solution. If $U$ is odd, its right side is $2$ or $10$ modulo sixteen for $d=2$, and $14$ or $6$ for $d=-2$, according to the parity of $V$. None is a square. If $U=2u$ is even, $V$ is odd and the right side is $32(\pm u^4+3u^2{V}^2\pm V^4)$. The bracket is odd for either parity of $u$, so its 2-adic valuation is five, again impossible for a square. The signed divisor-two obstruction for an isogeny covering excludes both classes. Hence ${\alpha }^{\prime }(E^{\prime }(\mathbb{Q}))=\{1,-1\}$.

For completeness, the index correction in the two-isogeny index formula over a number field is one: $\ker \psi =\{O,(0,0)\}$ and $\varphi ((2,0))=(0,0)$, so the whole kernel lies in $\varphi E(\mathbb{Q})$. ThusThe Mordell-Weil theorem and the four rational 2-torsion points identify this index as $2^{r+2}$. Therefore $2^{r+2}=8$ andThis is the rank-one elliptic curve with roots zero two and ten. We have exhibited a point of infinite order but have not needed to prove that it generates the free part.

We use two precise facts about the formal group of an elliptic curve. At a prime $p$ of good reduction, its kernel of reduction of an elliptic curve is identified by the uniformizer $t=-x/y$ with the group $\hat{E}(p{\mathbb{Z}}_p)$. For odd $p$ this group is torsion-free. To see the second fact, the integral invariant differential of a formal group law has the form $(1+{\sum }_{j\ge 1}{c}_j{T}^j)dT$, with $c_j\in {\mathbb{Z}}_p$. Integrating constructs the formal logarithmIt is a group homomorphism to the additive group. For $0\ne t\in p{\mathbb{Z}}_p$ and $j\ge 2$,when $p$ is odd. Hence the series converges and $v_p({\log }_F(t))=v_p(t)$, so it is injective. The target has no nonzero torsion. Therefore reduction is injective on the entire rational torsion subgroup at an odd prime of good reduction, including its $p$-primary part.

For the present elliptic curve, $\Delta =64D^6$, so every odd $p\nmid D$ is a prime of good reduction. If $p\equiv 3(\mathrm{mod}4)$, the Legendre symbol of $-1$ is $-1$. The values $x$ and $-x$ cancel in the sum of the Legendre symbols of $x^3-D^{2}x$, yieldingThe rational torsion subgroup injects into each of these groups, so it is finite and its order $M$ divides every such $p+1$.

For any odd prime $\ell$, the Dirichlet theorem on primes in arithmetic progressions supplies infinitely many $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$. Discard the finitely many dividing $D$. Since $\ell \nmid p+1$, it cannot divide $M$. Similarly choose $p\equiv 3(\mathrm{mod}8)$, again avoiding $D$; then $v_2(p+1)=2$, so $M\mid 4$.

There are already four rational 2-torsion points,which are distinct because a squarefree integer $D$ is nonzero. ThusIts order is four. In fact the argument works for every nonzero integer $D$; squarefreeness is not needed for this torsion conclusion.

First compute the Mordell-Weil group rank by two-isogeny descent. HereThe two-isogeny formula gives $\varphi :E\to E^{\prime }$. If $u=1+i$, then $u^4=-4$, andis an isomorphism over $K$. Its $x$-coordinate multiplier $u^2$ is a square in $K$.

Use the two-torsion square-class homomorphismFor any prime ideal of the Gaussian integers, if $v(x)>0$, then $x^2+i$ is a unit and $2v(y)=v(x)$; if $v(x)<0$, the term $x^3$ has strictly smallest valuation and $2v(y)=3v(x)$. Hence every valuation of $x$ is even. Since the Gaussian integers form a principal ideal domain, dividing by a square leaves a unit. Their units are $\{1,-1,i,-i\}$, whose square classes are $\{1,i\}$ because $-1=i^2$ and $i$ is not a square in $K$. For the latter assertion, $(a+bi{)}^2=i$ with $a,b\in \mathbb{Q}$ would imply $a^2=b^2$ and $2ab=1$, hence $a^2=1/2$, impossible for rational $a$. ThusBoth classes occur, at $O$ and $T$. This is the unit square-class bound for two-isogeny descent.

Define ${\alpha }^{\prime }$ on $E^{\prime }$ similarly, with ${\alpha }^{\prime }((0,0))=[-4i]=[i]$. Since $\theta$ multiplies nonexceptional $x$-coordinates by a square, and preserves the exceptional classes as well, its image is also $\{1,[i]\}$. The standard kernel identities in two-isogeny descent areHere $\hat{\varphi }$ is the dual isogeny and $\hat{\varphi }\varphi =[2]$. These identities can be checked directly from the formulas: $x(\hat{\varphi }(X,Y))=(Y/(2X){)}^2$, and conversely a square $x$-coordinate lets the quadratic equation for a preimage be solved using the curve equation. For example, if $x=r^2\ne 0$, the equation for $X$ is $X^2-(4x+2a)X+(a^2-4b)=0$, whose discriminant is $16(x^2+ax+b)=16(y/r{)}^2$; the $Y$-coordinate then follows from the dual formula. The exceptional points satisfy the same completed square-class criterion.

The two-isogeny index formula over a number field keeps track of a small kernel factor:In this case $\ker \hat{\varphi }=\{O,T^{\prime }\}$, where $T^{\prime }=(0,0)$, and $T^{\prime }\notin \varphi E(K)$ because ${\alpha }^{\prime }(T^{\prime })=[i]\ne 1$. Thus $\delta =2$, and the index is $2\cdot 2/2=2$. There is only one nonzero rational 2-torsion point on $E$: the other two would require $x^2=-i$, and $-i$ has the same nonsquare class as $i$. The Mordell-Weil theorem now givesso $r=0$.

It remains to identify all torsion, rather than merely the rank. The elliptic-curve discriminant is $-64i^3$, so the primes $(3)$ and $(2-i)$ have good reduction, with residue characteristics three and five. By the supplied point-count information their reduction groups have orders that are powers of two. The reduction of torsion points on an elliptic curve is injective on prime-to-residue-characteristic torsion. Every odd-primary torsion subgroup therefore injects into a group of two-power order at at least one of these two primes, and must be zero. All torsion is two-primary.

Finally, if a point had order four, its double would be $T$. The elliptic-curve addition formula givesFor $2P=T$ the denominator is nonzero, so $x^2=i$, impossible in $K$. A point of higher two-power order would have a multiple of order four, so it too is excluded. Thus the only torsion points are $O,T$. Together with rank zero,

Work first where all three coordinates are finite and the joining line is not vertical. By the chord-and-tangent group law, the third intersection of $y=\lambda x+\mu$ with the elliptic curve is $-(P_1+P_2)$, whose first coordinate is also $x_3$. Substitution gives the monic polynomialIts roots are $x_1,x_2,x_3$, counted with intersection multiplicity. Comparing its coefficients with the elementary symmetric polynomials provesThis symmetric-coordinate identity for elliptic-curve addition is an identity of rational functions. It includes tangent cases by specialization. Literally assigning finite $s_i$ when a point is $O$ would be meaningless; such cases must be interpreted on the projective curve. A nonsingular equation in the printed short form has characteristic different from two.

Here is how the identity yields the quadratic form for the degree of an isogeny. With $u=x(P)$, $v=x(Q)$, write $s=u+v$ and $q=uv$. As an equation for $t=x(P+Q)$, it becomesBoth $x(P+Q)$ and $x(P-Q)$ satisfy it, because replacing $Q$ by $-Q$ does not change $v$. Thus its two branches are the sum and difference maps. Their common denominator is the square of $u-v$. The following divisor on an algebraic curve calculation keeps track of cancellations and exceptional points rigorously, instead of assuming degrees of displayed numerators always add.

On $E_2\times E_2$, equality of the two first coordinates means $Q=P$ or $Q=-P$. Each coordinate has a double pole at $O$. Consequently the principal divisor identity iswhere $D_{+}$ is the diagonal and $D_{-}$ is the graph of negation. Equivalently, the two zero divisors are the inverse images of $O$ under difference and sum, exactly the two branches identified above. Their generic multiplicities are one; the divisor identity also accounts for their intersections at 2-torsion points.

For nonzero isogenies of elliptic curves $\varphi ,\psi :E_1\to E_2$ with $\varphi \ne \pm \psi$, pull this identity back by $(\varphi ,\psi )$. Taking degrees of the resulting principal divisor on $E_1$ gives the divisor proof of the degree parallelogram law:If one map is zero, this is immediate. If $\varphi =\pm \psi$, it follows from $\mathrm{deg}([2]\circ \varphi )=4\mathrm{deg}\varphi$. This also proves the parallelogram law for a general Weierstrass equation of an elliptic curve in characteristic two: the same divisor identity uses the quotient by negation, even though the particular symmetric-coordinate formula above is unavailable.

Put $q(\varphi )=\mathrm{deg}\varphi$ and $q(0)=0$. Applying the parallelogram law to $n\varphi ,\varphi$ gives the recurrence $q((n+1)\varphi )+q((n-1)\varphi )=2q(n\varphi )+2q(\varphi )$, and hence $q(n\varphi )=n^{2}q(\varphi )$ for every integer $n$. Its polarization $B(\varphi ,\psi )=q(\varphi +\psi )-q(\varphi )-q(\psi )$ is symmetric and integer-valued. For fixed $\psi$, the parallelogram law makes $B(\cdot ,\psi )$ odd and gives $B(x+y,\psi )+B(x-y,\psi )=2B(x,\psi )$. Interchanging $x,y$ and adding proves additivity, since integers have no two-torsion. Thus $B$ has bilinearity, and $q$ is a positive quadratic form on $\mathrm{Hom}(E_1,E_2)$, with $q(\varphi )>0$ whenever $\varphi \ne 0$.

For $p\nmid 2k$, the displayed integral equation has nonzero elliptic-curve discriminant modulo $p$, so it has good reduction. Let $\chi$ be the Legendre symbol, with $\chi (0)=0$. Counting the two, one, or zero possible ordinates over each $x$ givesIf $p\equiv 3(\mathrm{mod}4)$, then $\chi (-1)=-1$ and the terms for $x$ and $-x$ cancel. The term at zero vanishes. Thus the count is $p+1$.

For the converse, suppose $p\equiv 1(\mathrm{mod}4)$, and put $h=(p-1)/2$. The Euler criterion and the sum of powers over a finite field show that the Trace of Frobenius satisfiesIndeed, among the positive exponents in this polynomial, of degree $3(p-1)/2<2(p-1)$, only $p-1$ has a nonzero sum over ${\mathbb{F}}_p$, and that sum is $-1$. Since $(x^3+kx{)}^h=x^h(x^2+k{)}^h$, the coefficient formula for trace of Frobenius modulo p yieldsNeither $k$ nor the binomial coefficient vanishes modulo $p$. Hence $a_p\ne 0$, proving the point-count criterion for y squared equals x cubed plus k x:

We use the following formal logarithm fact, also useful for the next part. For a formal group law over ${\mathbb{Z}}_p$, its logarithm has coefficients $c_j/j$ with $c_j\in {\mathbb{Z}}_p$, obtained by integrating its integral invariant differential. If $p$ is odd and $t\in p{\mathbb{Z}}_p\setminus \{0\}$, every term of degree $j\ge 2$ has valuation strictly greater than $v_p(t)$, since $j{v}_p(t)-v_p(j)>v_p(t)$. Thus the logarithm converges and is nonzero at $t$. Its homomorphism into the additive characteristic-zero group proves torsion-freeness of the formal group over Qp for odd p. Consequently reduction injects the entire rational torsion subgroup at any odd prime of good reduction, including its $p$-primary torsion. In particular the torsion subgroup is finite, and its order divides $p+1$ at every good $p\equiv 3(\mathrm{mod}4)$.

By the Dirichlet theorem on primes in arithmetic progressions, choose a good prime $p\equiv 3(\mathrm{mod}8)$. Then $v_2(p+1)=2$, bounding the two-primary part by four. For any odd prime $\ell$ dividing the torsion order, the Chinese remainder theorem and the Dirichlet theorem on primes in arithmetic progressions give a good prime $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$, avoiding the finitely many primes dividing $2k$. But then $\ell \nmid p+1$, a contradiction. Therefore

The order four does occur. For $k=4$, the elliptic-curve addition formula gives $2(2,4)=(0,0)$, so $(2,4)$ has order four. More precisely, the only nonzero rational 2-torsion point when $k>0$ is $(0,0)$, so order four means a cyclic group with a rational half of this point. The duplication formula isSuch a half must have $x(P{)}^2=k$. Writing $k=s^2$, positivity of $y(P{)}^2=2kx(P)$ forces $x(P)=s>0$. Then $y(P{)}^2=2s^3$, so $2s$ is a rational square, equivalently $s=2t^2$ for an integer $t\ge 1$. Conversely $(2t^2,4t^3)$ is a half of $(0,0)$ when $k=4t^4$. The rational torsion on y squared equals x cubed plus positive k x is therefore cyclic of order four exactly for these $k$, and otherwise cyclic of order two.

For this integral Weierstrass equation of an elliptic curve, computeIf an odd prime divides $m$ or $m^2-1$, then $c_4$ is a unit there and $\Delta$ is not. The j-invariant of an elliptic curve consequently has negative valuation. Since good reduction implies an integral j-invariant, such a prime cannot be a prime of good reduction, regardless of whether the displayed equation is minimal. Conversely, if it divides neither factor, this equation already has unit discriminant.

At five the good possibilities have $m\equiv \pm 2$, so $m^2\equiv 4$. At seven they have $m^2\equiv 2$ or $4$. Direct elliptic-curve point count over a finite field gives the following nonzero ordinates, together with the three zero-ordinate points and $O$:At either prime, torsion-freeness of the formal group over Qp for odd p makes reduction injective on all of $E(\mathbb{Q}{)}_{\mathrm{tors}}$, so its order is at most eight. Using only prime-to-$p$ injectivity here would leave an unjustified possible $p$-primary component.

All three nonzero 2-torsion points $(0,0),(-1,0),(-m^2,0)$ are rational. The rational point $P=(m,m(m+1))$ lies on the curve, since $m(m+1)(m+m^2)=m^2(m+1{)}^2$. For an equation $y^2=x(x^2+ax+b)$ the elliptic-curve addition formula givesHere $a=1+m^2$, $b=m^2$, so $2P=(0,0)$ and $P$ has order four. The point $(-1,0)$ is not in $⟨P⟩$, whose only nonzero point of order two is $(0,0)$. Therefore $P$ and $(-1,0)$ generate a subgroup of order eight isomorphic to $\mathbb{Z}/4\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$. The upper bound proves the rational torsion in the family x times x plus one times x plus m squared:

Translate the rational 2-torsion point to $(0,0)$ and clear denominators to obtain the integral Weierstrass equation of an elliptic curve. Nonsingularity requires $b\ne 0$ and $b^{\prime }=a^2-4b\ne 0$. The two-isogeny descent usesand its dual isogenyThese formulas extend across their missing affine points as degree-two isogenies of elliptic curves, with kernels $\{O,(0,0)\}$ on their respective curves; substitution gives $\psi \varphi =[2]$ and $\varphi \psi =[2]$.

Define homomorphisms to the square-class group of a field ${\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^2$ byFor ordinary intersections with a line, the product of the three first coordinates is the square of its intercept, proving the homomorphism identity; tangent cases use the same product with multiplicities. For $T=(0,0)$, direct addition gives $x(P+T)=b/x(P)$, so $\alpha (P+T)=[b]\alpha (P)$. Also $\alpha (P)\alpha (-P)=1$ and $\alpha (T{)}^2=1$, which handle inverse points and $T+T=O$. These verify the exceptional values as well. Their kernels are $\psi E^{\prime }(\mathbb{Q})$ and $\varphi E(\mathbb{Q})$. One can check the first assertion directly: if $x=s^2\ne 0$, solving for the first coordinate of a preimage under $\psi$ giveswith rational corresponding ordinate. Conversely, on $E^{\prime }$ one has ${\psi }_x=Y^2/(4X^2)$, a square. The exceptional point $(0,0)$ has a rational preimage exactly when $b$ is a square. The other kernel assertion follows identically, since the double companion curve is isomorphic to $E$ by scaling its coordinates by four and eight.