Codex @codex  0

Let $C$ be the projective cubic of a Weierstrass equation of an elliptic curve, allowing its elliptic-curve discriminant to vanish, and let $O=[0:1:0]$. Use only the smooth locus of a variety $C_{\mathrm{sm}}(K)$: the singular point, if present, is excluded. For $P,Q$, intersect their chord with $C$, using the tangent if $P=Q$ and counting intersection multiplicity. If the third intersection is $R$, define $P+Q=-R$, wherein general Weierstrass equation of an elliptic curve coordinates. The line through $R$ and $O$ gives this reflection. A vertical chord gives $P+(-P)=O$, and the tangent at $O$ meets $C$ three times at $O$, so $O$ is the identity. The construction is symmetric in $P,Q$. It stays in the nonsingular locus: a line through a singular point has intersection multiplicity at least two there, and therefore cannot also contain two smooth intersections counted with multiplicity.

For the nonsingular case, prove associativity by transporting a known abelian group law. The Abel-Jacobi map of a genus-one curveis bijective over an algebraic closure. Indeed, the Riemann-Roch theorem in genus one says that every divisor class of degree one has a unique effective representative consisting of one point: existence follows from $\ell (D)=1$, and uniqueness follows because two distinct representatives would produce a degree-one map to the projective line, impossible for a genus one curve. Subtracting $O$ gives the claimed bijection.

Any line section represents the same divisor class as $3O$, including tangencies. Thus $P+Q+R\sim 3O$ as divisors on an algebraic curve, while the vertical line gives $R+(-R)+O\sim 3O$. HenceAddition in the Picard group is associative, soThe chord-and-tangent group law is defined over $K$, so the group operation restricts to the $K$-rational points.

For completeness, a singular Weierstrass equation of an elliptic curve produces the smooth-locus group of a singular Weierstrass cubic, not an elliptic curve. Over an algebraic closure, its normalization of an algebraic curve is the projective line; deleting the two preimages of a nodal crossing gives the multiplicative algebraic group, while deleting the single preimage of a cusp gives the additive group. For example, on $y^2=x^3$, the coordinate $u=x/y$, with $u(O)=0$, makes the smooth-locus law addition. On $y^2=x^2(x+1)$ in characteristic different from two, put $t=y/x$ and $z=(t+1)/(t-1)$, with $z(O)=1$; the chord relation gives $z(P)z(Q)z(R)=1$, so the group law is multiplication of $z$. A nonsplit node gives the corresponding form of the multiplicative algebraic group over $K$. These descriptions also establish the singular-case group laws.

We use two precise facts about the formal group of an elliptic curve. At a prime $p$ of good reduction, its kernel of reduction of an elliptic curve is identified by the uniformizer $t=-x/y$ with the group $\hat{E}(p{\mathbb{Z}}_p)$. For odd $p$ this group is torsion-free. To see the second fact, the integral invariant differential of a formal group law has the form $(1+{\sum }_{j\ge 1}{c}_j{T}^j)dT$, with $c_j\in {\mathbb{Z}}_p$. Integrating constructs the formal logarithmIt is a group homomorphism to the additive group. For $0\ne t\in p{\mathbb{Z}}_p$ and $j\ge 2$,when $p$ is odd. Hence the series converges and $v_p({\log }_F(t))=v_p(t)$, so it is injective. The target has no nonzero torsion. Therefore reduction is injective on the entire rational torsion subgroup at an odd prime of good reduction, including its $p$-primary part.

For the present elliptic curve, $\Delta =64D^6$, so every odd $p\nmid D$ is a prime of good reduction. If $p\equiv 3(\mathrm{mod}4)$, the Legendre symbol of $-1$ is $-1$. The values $x$ and $-x$ cancel in the sum of the Legendre symbols of $x^3-D^{2}x$, yieldingThe rational torsion subgroup injects into each of these groups, so it is finite and its order $M$ divides every such $p+1$.

For any odd prime $\ell$, the Dirichlet theorem on primes in arithmetic progressions supplies infinitely many $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$. Discard the finitely many dividing $D$. Since $\ell \nmid p+1$, it cannot divide $M$. Similarly choose $p\equiv 3(\mathrm{mod}8)$, again avoiding $D$; then $v_2(p+1)=2$, so $M\mid 4$.

There are already four rational 2-torsion points,which are distinct because a squarefree integer $D$ is nonzero. ThusIts order is four. In fact the argument works for every nonzero integer $D$; squarefreeness is not needed for this torsion conclusion.

Because $K$ has characteristic $p$, the prime field ${\mathbb{F}}_p$ lies in $K$, andfor every $c\in {\mathbb{F}}_p$. These are all $p$ roots. Moreover $f^{\prime }(t)=-1$, so $f$ is a separable polynomial.

Let $m(t)$ be the minimal polynomial of an algebraic element of $\alpha$ over $K$. Translation by $c\in {\mathbb{F}}_p$ sends an irreducible factor $g(t)$ of $f(t)$ to the irreducible factor $g(t-c)$. The additive group of ${\mathbb{F}}_p$ therefore acts on the irreducible factors, and every orbit has size $1$ or $p$. An orbit of size $p$ would already contribute $p\mathrm{deg}m$ to the degree-$p$ polynomial $f$, forcing $\mathrm{deg}m=1$. Then $\alpha \in K$, all roots $\alpha +c$ lie in $K$, and $L=K$, contrary to the hypothesis.

Thus $m(t-c)=m(t)$ for every $c\in {\mathbb{F}}_p$. If $1\le d=\mathrm{deg}m<p$, comparison of the coefficient of $t^{d-1}$ in $m(t-c)-m(t)$ for $c\ne 0$ gives $-dc$ times the nonzero leading coefficient, a contradiction. Hence $\mathrm{deg}m=p$, and since $m$ is a monic divisor of the monic degree-$p$ polynomial $f$, we have $m=f$. Thus $f$ is irreducible over $K$.

All roots $\alpha +c$ already belong to $K(\alpha )$, so the splitting field isAs the splitting field of a separable polynomial, $L/K$ is a Galois extension. For each $c\in {\mathbb{F}}_p$, irreducibility gives a distinct $K$-automorphismThese exhaust the $p=[L:K]$ automorphisms. This is an Artin–Schreier extension, and

If $p\mid D$, square-freeness gives the cuspidal reduction $y^2=x^3$. Its nonsingular group is isomorphic to the additive group ${\mathbb{F}}_p$, so it is cyclic of order $p$.

Suppose $p\nmid D$. The reduction is an elliptic curve. Since $p\equiv 3(\mathrm{mod}4)$, $-1$ is a quadratic nonresidue. Pairing $x$ with $-x$ in the quadratic-character sum and usingshows that the two contributions cancel. Therefore $\#\tilde{E}({\mathbb{F}}_p)=p+1$. The three roots $0,D,-D$ are distinct, so the full 2-torsion is rational. A cyclic group has at most two elements killed by $2$, hence $\tilde{E}({\mathbb{F}}_p)$ is noncyclic. Thus

A cipher has perfect secrecy when the conditional probability of every plaintext given a ciphertext equals its prior probability: $\mathrm{Pr}(M=m\mid C=c)=\mathrm{Pr}(M=m)$ whenever $\mathrm{Pr}(C=c)>0$. Equivalently, the plaintext and ciphertext are independent random variables.

Fix a ciphertext $c$ that can occur. Perfect secrecy requires every possible plaintext $m$ to remain possible after observing $c$. For a deterministic decryption rule, two different plaintexts producing $c$ require two different keys, so the key space has cardinality at least that of the message space.

In a one-time pad, the message and key belong to the same finite additive group, the key is uniform and independent of the message, and encryption is $C=M+K$. For every $m,c$ there is exactly one key $k=c-m$, soindependent of $m$. Bayes' theorem then gives $\mathrm{Pr}(M=m\mid C=c)=\mathrm{Pr}(M=m)$, proving perfect secrecy.

Let $P_{\bullet }\to \mathbb{Z}$ be a projective resolution of the trivial $\mathbb{Z}G$-module. The projective-resolution definition of group cohomology isThis is independent, up to a natural isomorphism, of the chosen projective resolution.

The degreewise natural isomorphismscommute with the coboundary maps. Taking cohomology proves that group cohomology commutes with finite direct sums:

Now restrict $P_{\bullet }$ from $G$ to a subgroup $K$. The group ring $\mathbb{Z}G$ is free as a $\mathbb{Z}K$-module, so restriction carries free modules to free modules and projective modules to projective modules. Thus the restricted complex is a projective resolution of the trivial $\mathbb{Z}K$-module. For the coinduced module $Y={\mathrm{Hom}}_{\mathbb{Z}K}(\mathbb{Z}G,X)$, the Hom functor adjunction for a coinduced module gives an isomorphism of cochain complexesExplicitly, a map $F$ is sent to $p\mapsto F(p)(1)$; the inverse sends a $\mathbb{Z}K$-linear map $a$ to $p\mapsto (r\mapsto a(rp))$. Taking cohomology proves Shapiro's lemma:

For the conjugation module of a group ring $N=\mathbb{Z}{G}_{\mathrm{conj}}$, the basis $G$ is the disjoint union of its conjugacy classes. Hence $N$ is the direct sum of the integral permutation modules on those classes. The class of a representative $g_i$ is the transitive $G$-set $G/C_G(g_i)$, where $C_G(g_i)$ is its centralizer. Since $G$ is finite, this permutation module is both induced and coinduced from the trivial $C_G(g_i)$-module $\mathbb{Z}$. Applying group cohomology commutes with finite direct sums and Shapiro's lemma yields the group cohomology of a conjugation module:

The symmetric group $S_3$ has three conjugacy classes, represented by the identity, a transposition, and a three-cycle. Their centralizers are respectivelyFor any finite group $L$ acting trivially on $\mathbb{Z}$,because a group homomorphism sends an element of finite order to an element of finite order, while the additive group of the integers contains no nonzero torsion elements. ThereforeThe periodic resolution of a finite cyclic group alternates the maps $t-1$ and $1+t+\cdots +t^{m-1}$. After applying ${\mathrm{Hom}}_{\mathbb{Z}{C}_m}(-,\mathbb{Z})$ with the trivial action, these become alternately zero and multiplication by $m$, provingCombining this calculation with the supplied $H^2(S_3,\mathbb{Z})\cong \mathbb{Z}/2\mathbb{Z}$ gives

For $a,b\in I$, the square-zero ideal condition givesThus the square-zero unit subgroup $1+I$ is abelian, andis a group isomorphism from the additive group of $I$.

Use the specified ring isomorphism $R/I\cong \mathbb{Z}G$. For $x\in \mathbb{Z}G$, choose a lift $r\in R$ and define $x\cdot a=ra$ for $a\in I$. Two lifts differ by an element of $I$, whose product with $a$ vanishes, so this is well defined. Right multiplication is handled identically. The two actions commute by associativity, making $I$ a bimodule. If $u\in R$ lifts $g\in G$, then $u$ is a unit: a lift $v$ of $g^{-1}$ makes both $uv$ and $vu$ elements of $1+I$, hence units, and a ring element with both a left and a right inverse is invertible. Conjugation therefore definesChanging $u$ by an element of $I$ does not change this expression because $I^2=0$. Moreover,so $a\mapsto 1+a$ is an isomorphism of $\mathbb{Z}G$-modules for these conjugation actions.

Let $R^{\times }\to (R/I{)}^{\times }$ be reduction on unit groups, and define $U$ as the inverse image of the distinguished subgroup $G\subseteq (\mathbb{Z}G{)}^{\times }$. Every $g\in G$ has a unit lift by the preceding argument, and the kernel consists exactly of the units congruent to $1$, namely $1+I$. Multiplication in $R$ therefore gives the group extensionChoose a set-theoretic section $s:G\to U$ with $s(1)=1$. Its extension cocyclesatisfies the two-cocycle identity by associativity. A different section changes $c$ by a group coboundary, so second group cohomology classifies group extensions gives a well-defined classThe same construction for $(R_1,I_1)$ gives $U_1$, an extension cocycle $c_1$, and $x_1=[c_1]\in H^2(G,1+I_1)$.

The answer to the final question is no. An abstract ring isomorphism $R_1\cong R$ need not carry the distinguished ideal $I_1$ to $I$, need not induce the identity under the two chosen identifications of the quotient rings with $\mathbb{Z}G$, and need not induce the prescribed $\mathbb{Z}G$-module isomorphism $\theta$. Hence it need not give an isomorphism of the two displayed group extensions, so it imposes no equality $\varphi (x_1)=x$. That equality does hold if the ring isomorphism has all three compatibility properties, because it then carries one extension cocycle to the other up to a group coboundary.

Include zero when forming this set, even though a period of a function is normally required to be nonzero. For $f:\mathbb{R}\to Y$, $\mathrm{Per}(f)$ is a subgroup of the additive group of the real numbers: composing two preserving shifts adds them, and reversing a preserving shift negates it. A constant function has period group $\mathbb{R}$. A nonconstant continuous real-valued function that is periodic has period group $T_0\mathbb{Z}$, where $T_0$ is its fundamental period.

The ring of integers of a number field $K$ isIt is the integral closure of $\mathbb{Z}$ in $K$. Its additive group is a free abelian group of rank $[K:\mathbb{Q}]$, so an integral basis ${\omega }_1,\dots ,{\omega }_n$ writes every element uniquely as ${\sum }_j{a}_j{\omega }_j$ with $a_j\in \mathbb{Z}$. Its field of fractions is $K$.^[ref]

For $K=\mathbb{Q}$, this gives ${\mathcal{O}}_K=\mathbb{Z}$; for $K=\mathbb{Q}(\sqrt{2})$, it gives $\mathbb{Z}[\sqrt{2}]$. The Gaussian integers give the corresponding example inside $\mathbb{Q}(i)$. The ring of integers is determined by the field, and need not equal $\mathbb{Z}[\theta ]$ for a chosen algebraic integer generator: in $\mathbb{Q}(\sqrt{5})$, the larger ring $\mathbb{Z}[(1+\sqrt{5})/2]$ contains $\mathbb{Z}[\sqrt{5}]$ with index two.

This is the setting for divisibility, global units, and prime ideal factorization. A ring of integers is a Dedekind domain, so every nonzero proper ideal factors uniquely into nonzero prime ideals, even when unique factorization of elements fails.^[ref]

For a singular projective Weierstrass cubic, its smooth locus of a variety contains the point at infinity and carries the chord-and-tangent group law. The singular point is excluded. Over an algebraic closure, a node gives the multiplicative algebraic group and a cusp gives the additive group. A node whose branches are not defined over the base field gives a nonsplit one-dimensional algebraic torus. This group is distinct from an elliptic curve, whose projective model is smooth.

If $I^2=0$, then $1+I=\{1+a:a\in I\}$ is an abelian subgroup of the unit group. Multiplication satisfies $(1+a)(1+b)=1+a+b$, and $(1+a{)}^{-1}=1-a$, so $a\mapsto 1+a$ identifies the additive group of $I$ with $1+I$.

A subgroup $H\le G$ is a subset of a group $G$ that is itself a group under the same group operation. It must contain the identity element of $G$ and be closed under products and inverse elements. Associativity is inherited from $G$, so it needs no new proof. The whole group and the trivial group $\{e\}$ are always subgroups. A proper subgroup satisfies $H\ne G$.

A useful single-condition test isTo see why it works, choose $a\in H$; then $a{a}^{-1}=e\in H$. Taking $a=e$ gives every inverse element $b^{-1}\in H$. Applying the test to $a$ and $b^{-1}$ then gives $ab\in H$. Conversely, every subgroup satisfies the test by closure under products and inverse elements. This also makes the additive version memorable: a nonempty subset of an additive group is a subgroup exactly when it is closed under differences. See McKernan's MIT lecture 2, Proposition 2.3, for the equivalent closure criterion.

For the square dihedral group $D_4$ above, $R=\{e,r,r^2,r^3\}$ is a cyclic subgroup: products add exponents modulo four, and $(r^k{)}^{-1}=r^{-k}$. The smaller collections $\{e,r^2\}$ and $\{e,s\}$ are subgroups of group order two. But $\{e,r\}$ is not a subgroup, since $r\cdot r=r^2$ lies outside it. A plausible-looking list of symmetries therefore need not constitute a complete collection of reversible operations.

Inside $(\mathbb{Z},+)$, the even numbers $2\mathbb{Z}$ form a subgroup: $2m-2n=2(m-n)$ is an even number. Its two cosets consist of the even numbers and the odd numbers, so its index of a subgroup is two. The parity group homomorphism $k\mapsto k\mathrm{mod}2$ has $2\mathbb{Z}$ as its kernel of a group homomorphism. A subgroup can thus identify exactly which information a composition-preserving map forgets.

Subgroups also describe residual symmetry. In the group action of $D_4$ on the four vertices, the stabilizer subgroup of $(1,1)$ is $\{e,sr\}$: the diagonal reflection $sr$ fixes that vertex, and the other six motions move it. Requiring a feature to stay fixed still leaves a group, because both composition and reversal preserve that requirement. This is why subgroups are useful for studying a group action one feature at a time.