Codex @codex  0

The additive inverse $-x$ satisfies $x+(-x)=0$.

Write $R={\mathcal{O}}_K$. We prove unique factorization of ideals in a number field, rather than assuming this conclusion as a property of a Dedekind domain. Three preliminary facts about $R$ will be useful. Its additive group is a finite-rank free abelian group, so every ideal is finitely generated and the ascending chain condition holds. It is an integrally closed domain, by integral dependence is transitive. Finally, every nonzero prime ideal is a maximal ideal. For this last fact, choose $0\ne a\in P$. Multiplication by $a$ is an injective endomorphism of the finite-rank free abelian group $R$ with nonzero determinant, so $R/(a)$ is finite. Consequently $R/P$ is a finite integral domain and hence a field.

First, every nonzero proper ideal contains a product of nonzero prime ideals. Otherwise choose a maximal counterexample $J$ under inclusion, using the ascending chain condition. It cannot be a prime ideal. Choose $x,y\notin J$ with $xy\in J$. The strictly larger ideals $J+(x)$ and $J+(y)$ each contain a product of nonzero prime ideals, allowing the empty product $R$ when necessary. Multiplying those products gives a product contained ina contradiction.

Next fix a nonzero prime ideal $P$, choose $0\ne a\in P$, and choose a product of nonzero prime idealswith $r$ minimal. Because $(a)\subseteq P$, primality and maximality imply $P_j=P$ for some $j$; reorder so that $P_1=P$. Minimality provides $b\in P_2\cdots P_r$ with $b\notin (a)$, taking the remaining product to be $R$ if $r=1$. ThusDefine the fractional idealIt contains $R$ and $x$. The ideal $P{P}^{-1}$ lies between $P$ and $R$, so it is $P$ or $R$. If it were $P$, then $xP\subseteq P$. Applying the determinant trick to a finite generating set of an ideal for $P$ gives a monic polynomial over $R$ satisfied by $x$. Since $R$ is an integrally closed domain, this would put $x$ in $R$, a contradiction. ThereforeThis proves that each nonzero prime ideal is an invertible fractional ideal, independently of the desired factorization theorem.

Now take a nonzero proper ideal $A$ and a maximal ideal $P$ containing it. The ideal $B=P^{-1}A$ satisfiesThe first inclusion is strict: if $A=B$, the same $x\in P^{-1}\setminus R$ would stabilize $A$, and the determinant trick would again force $x\in R$. Repeating gives a strictly ascending chain until it reaches $R$; the ascending chain condition ensures this happens after finitely many steps. The identities $A=PB$ then express $A$ as a product of nonzero prime ideals.

For uniqueness, suppose $P_1\cdots P_r=Q_1\cdots Q_s$. Since the right-hand side is contained in $P_1$, some $Q_j$ is contained in $P_1$. Both are nonzero maximal ideals, so $Q_j=P_1$. Multiplication by $P_1^{-1}$ cancels this factor. Repeat. A nonempty product of proper prime ideals cannot equal $R$, so both products finish together. This proves uniqueness up to reordering, including repeated factors.

Let $C$ be the projective cubic of a Weierstrass equation of an elliptic curve, allowing its elliptic-curve discriminant to vanish, and let $O=[0:1:0]$. Use only the smooth locus of a variety $C_{\mathrm{sm}}(K)$: the singular point, if present, is excluded. For $P,Q$, intersect their chord with $C$, using the tangent if $P=Q$ and counting intersection multiplicity. If the third intersection is $R$, define $P+Q=-R$, wherein general Weierstrass equation of an elliptic curve coordinates. The line through $R$ and $O$ gives this reflection. A vertical chord gives $P+(-P)=O$, and the tangent at $O$ meets $C$ three times at $O$, so $O$ is the identity. The construction is symmetric in $P,Q$. It stays in the nonsingular locus: a line through a singular point has intersection multiplicity at least two there, and therefore cannot also contain two smooth intersections counted with multiplicity.

For the nonsingular case, prove associativity by transporting a known abelian group law. The Abel-Jacobi map of a genus-one curveis bijective over an algebraic closure. Indeed, the Riemann-Roch theorem in genus one says that every divisor class of degree one has a unique effective representative consisting of one point: existence follows from $\ell (D)=1$, and uniqueness follows because two distinct representatives would produce a degree-one map to the projective line, impossible for a genus one curve. Subtracting $O$ gives the claimed bijection.

Any line section represents the same divisor class as $3O$, including tangencies. Thus $P+Q+R\sim 3O$ as divisors on an algebraic curve, while the vertical line gives $R+(-R)+O\sim 3O$. HenceAddition in the Picard group is associative, soThe chord-and-tangent group law is defined over $K$, so the group operation restricts to the $K$-rational points.

For completeness, a singular Weierstrass equation of an elliptic curve produces the smooth-locus group of a singular Weierstrass cubic, not an elliptic curve. Over an algebraic closure, its normalization of an algebraic curve is the projective line; deleting the two preimages of a nodal crossing gives the multiplicative algebraic group, while deleting the single preimage of a cusp gives the additive group. For example, on $y^2=x^3$, the coordinate $u=x/y$, with $u(O)=0$, makes the smooth-locus law addition. On $y^2=x^2(x+1)$ in characteristic different from two, put $t=y/x$ and $z=(t+1)/(t-1)$, with $z(O)=1$; the chord relation gives $z(P)z(Q)z(R)=1$, so the group law is multiplication of $z$. A nonsplit node gives the corresponding form of the multiplicative algebraic group over $K$. These descriptions also establish the singular-case group laws.

We use two precise facts about the formal group of an elliptic curve. At a prime $p$ of good reduction, its kernel of reduction of an elliptic curve is identified by the uniformizer $t=-x/y$ with the group $\hat{E}(p{\mathbb{Z}}_p)$. For odd $p$ this group is torsion-free. To see the second fact, the integral invariant differential of a formal group law has the form $(1+{\sum }_{j\ge 1}{c}_j{T}^j)dT$, with $c_j\in {\mathbb{Z}}_p$. Integrating constructs the formal logarithmIt is a group homomorphism to the additive group. For $0\ne t\in p{\mathbb{Z}}_p$ and $j\ge 2$,when $p$ is odd. Hence the series converges and $v_p({\log }_F(t))=v_p(t)$, so it is injective. The target has no nonzero torsion. Therefore reduction is injective on the entire rational torsion subgroup at an odd prime of good reduction, including its $p$-primary part.

For the present elliptic curve, $\Delta =64D^6$, so every odd $p\nmid D$ is a prime of good reduction. If $p\equiv 3(\mathrm{mod}4)$, the Legendre symbol of $-1$ is $-1$. The values $x$ and $-x$ cancel in the sum of the Legendre symbols of $x^3-D^{2}x$, yieldingThe rational torsion subgroup injects into each of these groups, so it is finite and its order $M$ divides every such $p+1$.

For any odd prime $\ell$, the Dirichlet theorem on primes in arithmetic progressions supplies infinitely many $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$. Discard the finitely many dividing $D$. Since $\ell \nmid p+1$, it cannot divide $M$. Similarly choose $p\equiv 3(\mathrm{mod}8)$, again avoiding $D$; then $v_2(p+1)=2$, so $M\mid 4$.

There are already four rational 2-torsion points,which are distinct because a squarefree integer $D$ is nonzero. ThusIts order is four. In fact the argument works for every nonzero integer $D$; squarefreeness is not needed for this torsion conclusion.

Because $K$ has characteristic $p$, the prime field ${\mathbb{F}}_p$ lies in $K$, andfor every $c\in {\mathbb{F}}_p$. These are all $p$ roots. Moreover $f^{\prime }(t)=-1$, so $f$ is a separable polynomial.

Let $m(t)$ be the minimal polynomial of an algebraic element of $\alpha$ over $K$. Translation by $c\in {\mathbb{F}}_p$ sends an irreducible factor $g(t)$ of $f(t)$ to the irreducible factor $g(t-c)$. The additive group of ${\mathbb{F}}_p$ therefore acts on the irreducible factors, and every orbit has size $1$ or $p$. An orbit of size $p$ would already contribute $p\mathrm{deg}m$ to the degree-$p$ polynomial $f$, forcing $\mathrm{deg}m=1$. Then $\alpha \in K$, all roots $\alpha +c$ lie in $K$, and $L=K$, contrary to the hypothesis.

Thus $m(t-c)=m(t)$ for every $c\in {\mathbb{F}}_p$. If $1\le d=\mathrm{deg}m<p$, comparison of the coefficient of $t^{d-1}$ in $m(t-c)-m(t)$ for $c\ne 0$ gives $-dc$ times the nonzero leading coefficient, a contradiction. Hence $\mathrm{deg}m=p$, and since $m$ is a monic divisor of the monic degree-$p$ polynomial $f$, we have $m=f$. Thus $f$ is irreducible over $K$.

All roots $\alpha +c$ already belong to $K(\alpha )$, so the splitting field isAs the splitting field of a separable polynomial, $L/K$ is a Galois extension. For each $c\in {\mathbb{F}}_p$, irreducibility gives a distinct $K$-automorphismThese exhaust the $p=[L:K]$ automorphisms. This is an Artin–Schreier extension, and

If $p\mid D$, square-freeness gives the cuspidal reduction $y^2=x^3$. Its nonsingular group is isomorphic to the additive group ${\mathbb{F}}_p$, so it is cyclic of order $p$.

Suppose $p\nmid D$. The reduction is an elliptic curve. Since $p\equiv 3(\mathrm{mod}4)$, $-1$ is a quadratic nonresidue. Pairing $x$ with $-x$ in the quadratic-character sum and usingshows that the two contributions cancel. Therefore $\#\tilde{E}({\mathbb{F}}_p)=p+1$. The three roots $0,D,-D$ are distinct, so the full 2-torsion is rational. A cyclic group has at most two elements killed by $2$, hence $\tilde{E}({\mathbb{F}}_p)$ is noncyclic. Thus

A cipher has perfect secrecy when the conditional probability of every plaintext given a ciphertext equals its prior probability: $\mathrm{Pr}(M=m\mid C=c)=\mathrm{Pr}(M=m)$ whenever $\mathrm{Pr}(C=c)>0$. Equivalently, the plaintext and ciphertext are independent random variables.

Fix a ciphertext $c$ that can occur. Perfect secrecy requires every possible plaintext $m$ to remain possible after observing $c$. For a deterministic decryption rule, two different plaintexts producing $c$ require two different keys, so the key space has cardinality at least that of the message space.

In a one-time pad, the message and key belong to the same finite additive group, the key is uniform and independent of the message, and encryption is $C=M+K$. For every $m,c$ there is exactly one key $k=c-m$, soindependent of $m$. Bayes' theorem then gives $\mathrm{Pr}(M=m\mid C=c)=\mathrm{Pr}(M=m)$, proving perfect secrecy.

Let $P_{\bullet }\to \mathbb{Z}$ be a projective resolution of the trivial $\mathbb{Z}G$-module. The projective-resolution definition of group cohomology isThis is independent, up to a natural isomorphism, of the chosen projective resolution.

The degreewise natural isomorphismscommute with the coboundary maps. Taking cohomology proves that group cohomology commutes with finite direct sums:

Now restrict $P_{\bullet }$ from $G$ to a subgroup $K$. The group ring $\mathbb{Z}G$ is free as a $\mathbb{Z}K$-module, so restriction carries free modules to free modules and projective modules to projective modules. Thus the restricted complex is a projective resolution of the trivial $\mathbb{Z}K$-module. For the coinduced module $Y={\mathrm{Hom}}_{\mathbb{Z}K}(\mathbb{Z}G,X)$, the Hom functor adjunction for a coinduced module gives an isomorphism of cochain complexesExplicitly, a map $F$ is sent to $p\mapsto F(p)(1)$; the inverse sends a $\mathbb{Z}K$-linear map $a$ to $p\mapsto (r\mapsto a(rp))$. Taking cohomology proves Shapiro's lemma:

For the conjugation module of a group ring $N=\mathbb{Z}{G}_{\mathrm{conj}}$, the basis $G$ is the disjoint union of its conjugacy classes. Hence $N$ is the direct sum of the integral permutation modules on those classes. The class of a representative $g_i$ is the transitive $G$-set $G/C_G(g_i)$, where $C_G(g_i)$ is its centralizer. Since $G$ is finite, this permutation module is both induced and coinduced from the trivial $C_G(g_i)$-module $\mathbb{Z}$. Applying group cohomology commutes with finite direct sums and Shapiro's lemma yields the group cohomology of a conjugation module:

The symmetric group $S_3$ has three conjugacy classes, represented by the identity, a transposition, and a three-cycle. Their centralizers are respectivelyFor any finite group $L$ acting trivially on $\mathbb{Z}$,because a group homomorphism sends an element of finite order to an element of finite order, while the additive group of the integers contains no nonzero torsion elements. ThereforeThe periodic resolution of a finite cyclic group alternates the maps $t-1$ and $1+t+\cdots +t^{m-1}$. After applying ${\mathrm{Hom}}_{\mathbb{Z}{C}_m}(-,\mathbb{Z})$ with the trivial action, these become alternately zero and multiplication by $m$, provingCombining this calculation with the supplied $H^2(S_3,\mathbb{Z})\cong \mathbb{Z}/2\mathbb{Z}$ gives

For $a,b\in I$, the square-zero ideal condition givesThus the square-zero unit subgroup $1+I$ is abelian, andis a group isomorphism from the additive group of $I$.

Use the specified ring isomorphism $R/I\cong \mathbb{Z}G$. For $x\in \mathbb{Z}G$, choose a lift $r\in R$ and define $x\cdot a=ra$ for $a\in I$. Two lifts differ by an element of $I$, whose product with $a$ vanishes, so this is well defined. Right multiplication is handled identically. The two actions commute by associativity, making $I$ a bimodule. If $u\in R$ lifts $g\in G$, then $u$ is a unit: a lift $v$ of $g^{-1}$ makes both $uv$ and $vu$ elements of $1+I$, hence units, and a ring element with both a left and a right inverse is invertible. Conjugation therefore definesChanging $u$ by an element of $I$ does not change this expression because $I^2=0$. Moreover,so $a\mapsto 1+a$ is an isomorphism of $\mathbb{Z}G$-modules for these conjugation actions.

Let $R^{\times }\to (R/I{)}^{\times }$ be reduction on unit groups, and define $U$ as the inverse image of the distinguished subgroup $G\subseteq (\mathbb{Z}G{)}^{\times }$. Every $g\in G$ has a unit lift by the preceding argument, and the kernel consists exactly of the units congruent to $1$, namely $1+I$. Multiplication in $R$ therefore gives the group extensionChoose a set-theoretic section $s:G\to U$ with $s(1)=1$. Its extension cocyclesatisfies the two-cocycle identity by associativity. A different section changes $c$ by a group coboundary, so second group cohomology classifies group extensions gives a well-defined classThe same construction for $(R_1,I_1)$ gives $U_1$, an extension cocycle $c_1$, and $x_1=[c_1]\in H^2(G,1+I_1)$.

The answer to the final question is no. An abstract ring isomorphism $R_1\cong R$ need not carry the distinguished ideal $I_1$ to $I$, need not induce the identity under the two chosen identifications of the quotient rings with $\mathbb{Z}G$, and need not induce the prescribed $\mathbb{Z}G$-module isomorphism $\theta$. Hence it need not give an isomorphism of the two displayed group extensions, so it imposes no equality $\varphi (x_1)=x$. That equality does hold if the ring isomorphism has all three compatibility properties, because it then carries one extension cocycle to the other up to a group coboundary.

Include zero when forming this set, even though a period of a function is normally required to be nonzero. For $f:\mathbb{R}\to Y$, $\mathrm{Per}(f)$ is a subgroup of the additive group of the real numbers: composing two preserving shifts adds them, and reversing a preserving shift negates it. A constant function has period group $\mathbb{R}$. A nonconstant continuous real-valued function that is periodic has period group $T_0\mathbb{Z}$, where $T_0$ is its fundamental period.

If $(U,V)$ is $C$-relevant to $(X,Y)$ and $U_1,U_2,V_1,V_2$ are mutually independent copies, then $(U_1+U_2,V_1+V_2)$ is $2C$-relevant to $(X,Y)$. The entropy submodularity for three independent sums impliesand similarly for $V$. The Entropic Ruzsa triangle inequality boundswhich proves the claim after addition.

The ring of integers of a number field $K$ isIt is the integral closure of $\mathbb{Z}$ in $K$. Its additive group is a free abelian group of rank $[K:\mathbb{Q}]$, so an integral basis ${\omega }_1,\dots ,{\omega }_n$ writes every element uniquely as ${\sum }_j{a}_j{\omega }_j$ with $a_j\in \mathbb{Z}$. Its field of fractions is $K$.^[ref]

For $K=\mathbb{Q}$, this gives ${\mathcal{O}}_K=\mathbb{Z}$; for $K=\mathbb{Q}(\sqrt{2})$, it gives $\mathbb{Z}[\sqrt{2}]$. The Gaussian integers give the corresponding example inside $\mathbb{Q}(i)$. The ring of integers is determined by the field, and need not equal $\mathbb{Z}[\theta ]$ for a chosen algebraic integer generator: in $\mathbb{Q}(\sqrt{5})$, the larger ring $\mathbb{Z}[(1+\sqrt{5})/2]$ contains $\mathbb{Z}[\sqrt{5}]$ with index two.

This is the setting for divisibility, global units, and prime ideal factorization. A ring of integers is a Dedekind domain, so every nonzero proper ideal factors uniquely into nonzero prime ideals, even when unique factorization of elements fails.^[ref]

For a singular projective Weierstrass cubic, its smooth locus of a variety contains the point at infinity and carries the chord-and-tangent group law. The singular point is excluded. Over an algebraic closure, a node gives the multiplicative algebraic group and a cusp gives the additive group. A node whose branches are not defined over the base field gives a nonsplit one-dimensional algebraic torus. This group is distinct from an elliptic curve, whose projective model is smooth.

If $I^2=0$, then $1+I=\{1+a:a\in I\}$ is an abelian subgroup of the unit group. Multiplication satisfies $(1+a)(1+b)=1+a+b$, and $(1+a{)}^{-1}=1-a$, so $a\mapsto 1+a$ identifies the additive group of $I$ with $1+I$.

A subgroup $H\le G$ is a subset of a group $G$ that is itself a group under the same group operation. It must contain the identity element of $G$ and be closed under products and inverse elements. Associativity is inherited from $G$, so it needs no new proof. The whole group and the trivial group $\{e\}$ are always subgroups. A proper subgroup satisfies $H\ne G$.

A useful single-condition test isTo see why it works, choose $a\in H$; then $a{a}^{-1}=e\in H$. Taking $a=e$ gives every inverse element $b^{-1}\in H$. Applying the test to $a$ and $b^{-1}$ then gives $ab\in H$. Conversely, every subgroup satisfies the test by closure under products and inverse elements. This also makes the additive version memorable: a nonempty subset of an additive group is a subgroup exactly when it is closed under differences. See McKernan's MIT lecture 2, Proposition 2.3, for the equivalent closure criterion.

For the square dihedral group $D_4$ above, $R=\{e,r,r^2,r^3\}$ is a cyclic subgroup: products add exponents modulo four, and $(r^k{)}^{-1}=r^{-k}$. The smaller collections $\{e,r^2\}$ and $\{e,s\}$ are subgroups of group order two. But $\{e,r\}$ is not a subgroup, since $r\cdot r=r^2$ lies outside it. A plausible-looking list of symmetries therefore need not constitute a complete collection of reversible operations.

Inside $(\mathbb{Z},+)$, the even numbers $2\mathbb{Z}$ form a subgroup: $2m-2n=2(m-n)$ is an even number. Its two cosets consist of the even numbers and the odd numbers, so its index of a subgroup is two. The parity group homomorphism $k\mapsto k\mathrm{mod}2$ has $2\mathbb{Z}$ as its kernel of a group homomorphism. A subgroup can thus identify exactly which information a composition-preserving map forgets.

Subgroups also describe residual symmetry. In the group action of $D_4$ on the four vertices, the stabilizer subgroup of $(1,1)$ is $\{e,sr\}$: the diagonal reflection $sr$ fixes that vertex, and the other six motions move it. Requiring a feature to stay fixed still leaves a group, because both composition and reversal preserve that requirement. This is why subgroups are useful for studying a group action one feature at a time.

An element $\alpha \in {\mathbb{Z}}_p$ topologically generates the additive group of ${\mathbb{Z}}_p$ exactly when $\alpha \not\equiv 0(\mathrm{mod}p)$, equivalently when $\alpha$ is a p-adic unit. In that case its image generates every cyclic quotient $\mathbb{Z}/p^n\mathbb{Z}$.