Codex @codex  0

A Riemann surface which is compact as a topological space. For a connected one of genus $g$, the Riemann-Roch theorem gives $g$ independent holomorphic differential forms. The Riemann bilinear relations for a compact surface make their normalized periods a full lattice in ${\mathbb{C}}^g$, and the Abel-Jacobi map of a compact Riemann surface turns this lattice into a complex torus encoding divisor classes.

Let $O=(0:1:0)$ be the point at infinity of the Weierstrass equation of an elliptic curve. It is the identity element for the elliptic curve group law. For an affine rational point $P=(x,y)$, the inverse isIndeed, the two affine intersections with the vertical line have these ordinates, since their sum as roots of the quadratic in $y$ is $-a_{1}x-a_3$. This reflection is valid for a generalized Weierstrass equation of an elliptic curve in every characteristic of a field.

For distinct $P,Q$, draw their line; for $P=Q$, draw the tangent line. Let $R$ be its third intersection with the elliptic curve, counted with intersection multiplicity. Then the sum is the reflection of the third intersection:A vertical line has third intersection $O$, so $P+(-P)=O$. If a tangent has third intersection $O$, then $2P=O$. Define addition with $O$ by $P+O=P$; these conventions include all exceptional cases of the affine construction.

The construction is defined over the coefficient field: after two known intersections, the remaining root is rational over that field. It gives a commutative group operation. To see why it is associative, use the elliptic curve group law from Riemann-Roch: the map $P\mapsto [P-O]$ identifies the elliptic curve with its degree-zero divisor class group. A line has intersection divisor $P+Q+R$ linearly equivalent to $3O$, the divisor of the line at infinity. Thus $[P-O]+[Q-O]+[R-O]=0$. The geometric sum agrees with addition of divisor classes, which is associative.

Choose an integral Weierstrass equation of an elliptic curve with unit elliptic-curve discriminant. For $P\in E({\mathbb{Q}}_p)$, choose homogeneous coordinates $[X:Y:Z]$ in ${\mathbb{Z}}_p$ with at least one unit by multiplying all three coordinates by a common power of $p$. DefineTwo primitive integral representatives differ by a unit, so this is well-defined. Every point of the reduced cubic is a nonsingular point of an algebraic curve, and the identity reduces to $[0:1:0]$. This definition includes points whose affine coordinates are nonintegral.

To prove the good-reduction map respects elliptic addition, use the smooth proper integral model. The elliptic curve group law is a morphism on this model, constructed by addition of degree-zero divisor classes; it is defined even where an affine chord formula has a vanishing denominator. Passing to the residue field commutes with this morphism. Henceso reduction is a homomorphism of abelian groups.

For surjectivity, the simple-root Hensel lemma says that if $g\in {\mathbb{Z}}_p[t]$, $g(t_0)\equiv 0(\mathrm{mod}p)$ and $g^{\prime }(t_0)\not\equiv 0(\mathrm{mod}p)$, then there is a unique $t\in {\mathbb{Z}}_p$ with $t\equiv t_0(\mathrm{mod}p)$ and $g(t)=0$. The point at infinity lifts to $O$. At an affine point $(\overline{x},\overline{y})$ of the reduced equation $F(x,y)=0$, being a nonsingular point of an algebraic curve means at least one partial derivative $F_x,F_y$ is nonzero. If $F_y\ne 0$, fix any integral lift $x_0$ of $\overline{x}$ and apply the Hensel lemma to $g(t)=F(x_0,t)$ to lift $\overline{y}$. If $F_x\ne 0$, fix $y_0$ and lift $\overline{x}$ instead. This proves the surjectivity of good reduction over a local field and gives

For a divisor on an algebraic curve $D=\sum n_{P}P$, define its line bundle associated to a divisor inside the sheaf of rational functions byLocally choose a rational equation $f_i$ for $D$, as in the construction of the quotient sheaf above. ThenConsequently this is an invertible sheaf. Multiplication gives an isomorphismas is checked on the displayed local generators. If $D=\mathrm{div}(f)$, multiplication by $f$ identifies ${\mathcal{O}}_X(D)$ with ${\mathcal{O}}_X$. Thus $D\mapsto [{\mathcal{O}}_X(D)]$ induces a group homomorphism from the divisor class group to the Picard group.

For surjectivity, let $\mathcal{L}$ be an invertible sheaf. Trivialize its one-dimensional rational fibre over the function field $k(X)$; equivalently, choose a nonzero rational section and identify $\mathcal{L}$ with a subsheaf of the rational-function sheaf. A finite trivializing cover givesOn overlaps $a_i/a_j$ is a regular unit. The integers $-v_P(a_i)$ therefore agree wherever two descriptions apply and define a finite divisor on an algebraic curve $D$. Its local description gives $\mathcal{L}={\mathcal{O}}_X(D)$. A different rational trivialization multiplies all $a_i$ by the same rational function, changing $D$ by a principal divisor, so the resulting divisor class is intrinsic.

For injectivity, an isomorphism ${\mathcal{O}}_X(D)\to {\mathcal{O}}_X(E)$ becomes multiplication by some $g\in k(X{)}^{\ast }$ on the rational fibre. At each closed point its effect on the local free generators givesHence $D-E=\mathrm{div}(g)$. Conversely this equality gives the required isomorphism by multiplication by $g$. We have proved the group isomorphism

An isogeny of elliptic curves over $k$ is a nonconstant $k$-morphism $\phi :E_1\to E_2$ which sends $O_1$ to $O_2$. A nonconstant morphism of smooth projective curves is finite and surjective. Its compatibility with the elliptic curve group law from Riemann-Roch can be seen without assuming it in the definition.

Identify a point $P$ with the degree-zero divisor class $[P-O_1]$. A finite morphism pushes forward divisors, and pushes a principal divisor to the principal divisor of the norm of its rational function. It therefore induces a group homomorphism on degree-zero Picard groups of a curve. On geometric points, the pushforward of $[P-O_1]$ is $[\phi (P)-O_2]$. Since point addition is addition of these divisor classes, this provesThe equality is defined over $k$, so in particular it holds on the groups of $k$-rational points and after every field extension. The argument also covers inseparable isogenies of elliptic curves; separability is not part of the definition.

Choose an integral Minimal Weierstrass equation whose discriminant is a $p$-adic unit. Given $P=[X:Y:Z]\in E({\mathbb{Q}}_p)$, scale the coordinates so that $X,Y,Z\in {\mathbb{Z}}_p$ and at least one is a unit. DefineAnother primitive representative differs by a unit scalar, so the projective reduction is well defined. The reduced cubic is smooth by good reduction.

To prove the group homomorphism property, view this smooth projective cubic with its section $O$ as the integral elliptic model $\mathcal{E}/{\mathbb{Z}}_p$. Its addition law is defined over ${\mathbb{Z}}_p$, by adding degree-zero divisor classes, and thus is a regular morphism $\mathcal{E}\times \mathcal{E}\to \mathcal{E}$. Properness identifies $E({\mathbb{Q}}_p)$ with the integral sections just described. Reducing the addition morphism is the group operation of the smooth special fiber. ConsequentlyThis is the good-reduction map respects elliptic addition argument; it covers tangent, vertical and infinity cases where reducing a single affine slope formula would involve division by a nonunit. Smoothness also makes reduction surjective: at each reduced point a partial derivative is a unit, and the Hensel lemma lifts that point in a local affine chart.

The projective completion has identity $O=[0:1:0]$. For this Weierstrass equation of an elliptic curve, negation isFor distinct affine points $P,Q$, draw their chord; for $P=Q$, use the tangent with its intersection multiplicity. If the third intersection is $R$, define $P\oplus Q=-R$. A vertical chord pairs $P$ with $-P$ and gives their sum $O$; also $P\oplus O=P$. A vertical tangent at a point satisfying $2y+1=0$ gives $2P=O$.

For a nonvertical line $y=mx+b$, substitution into the cubic givesThus if $P=(x_1,y_1)$ and $Q=(x_2,y_2)$, the sum has coordinatesHere $m=(y_2-y_1)/(x_2-x_1)$ for a chord, and implicit differentiation givesfor a nonvertical tangent. These formulas include the repeated-root case. Associativity can be seen without a lengthy coordinate calculation: a line cuts the cubic in a divisor equivalent to $3(O)$, and $P\mapsto [(P)-(O)]$ identifies the curve with its degree-zero divisor class group. The chord-and-tangent operation becomes addition of divisor classes, hence is associative.

We take $d\in {\mathbb{Q}}^{\times }$, as required for this rational elliptic curve. The tangent at $O=(1:-1:0)$ is $X+Y=0$. Its intersection with the curve has $d{Z}^3=0$, so it meets the curve three times at $O$: the identity is an inflection point of a plane cubic.

For $P,Q$, let their chord meet the diagonal cubic elliptic curve at the third point $R$, using the tangent if $P=Q$ and counting intersection multiplicities. Then join $R$ to $O$ and take the third intersection $S$. Define $P+Q=S$. Equivalently, three collinear intersection points satisfy $P+Q+R=O$.

Here inversion has the particularly simple formIndeed $P$, its displayed inverse, and $O$ lie on the same line, since swapping $X,Y$ preserves both the curve and $X+Y$. Thus addition is the chord or tangent operation followed by swapping the first two coordinates. The rule includes limiting cases involving $O$ and repeated intersections. Its associativity follows from the elliptic curve group law from Riemann-Roch: the identification $P\mapsto [P-O]$ with the degree-zero Picard group turns the line-intersection Weil divisor relation into addition of divisor classes. Since a line cuts a Weil divisor linearly equivalent to $3O$, that relation is exactly the chord rule just described.

An isogeny of elliptic curves $\varphi :E_1\to E_2$ over a field $K$ is a nonconstant morphism preserving the identity and addition. It is surjective and finite: its image is a closed connected subgroup, and a nonconstant morphism of smooth projective curves is finite. The degree of an isogeny is the degree of its induced extension of function fields. A separable isogeny has degree equal to the number of geometric kernel points; in general the degree is the length of the finite kernel scheme, incorporating inseparability. The degree of an isogeny multiplies under composition, and degree one means an isomorphism. In characteristic zero all elliptic isogenies are separable. In positive characteristic the Frobenius isogeny illustrates inseparability, while an elliptic isogeny of degree prime to the characteristic is separable.

The homomorphism group of elliptic curves includes the zero homomorphism, the constant identity map, and every nonzero member is an elliptic isogeny. The operations are pointwise addition and negation; for endomorphisms, composition also gives the endomorphism ring of an elliptic curve. We put $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We now prove the positive definiteness of degree on elliptic-curve homomorphisms in full.

Let $E=E_2$, and choose a Weierstrass model. Its coordinate $x$ has a double pole at $O$, and the generic fibre of $x$ consists of $P$ and $-P$. On $E\times E$ the rational function $x(P)-x(Q)$ therefore has Weil divisorwhere $\Delta =\{P=Q\}$, ${\Delta }_{-}=\{P=-Q\}$, $V=\{O\}\times E$, and $H=E\times \{O\}$. The generic zeros on the two diagonals have multiplicity one, and the generic poles on $V,H$ have multiplicity two; their intersections have codimension two and add no Weil divisor components. This argument also uses the general Weierstrass involution in characteristic $2$, where $-P$ need not mean changing just the sign of $y$.

For the sum and difference maps $a(P,Q)=P+Q$ and $s(P,Q)=P-Q$, the divisors $a^{\ast }(O)$ and $s^{\ast }(O)$ are ${\Delta }_{-}$ and $\Delta$. Consequently, for the degree-one line bundle $L={\mathcal{O}}_E(O)$,Pull back along $P\mapsto (\varphi (P),\psi (P))$ and take degrees of line bundles on $E_1$. A nonconstant map pulls back $L$ to degree equal to its degree, while a constant map pulls it back to a trivial bundle of degree zero. We obtain the degree parallelogram lawUsing the line-bundle identity is important: it still restricts correctly when $\varphi =\psi$ or $\varphi =-\psi$, when restriction of the displayed rational function would be identically zero.

Since $q(-\varphi )=q(\varphi )$, applying the identity to $n\varphi$ and $\varphi$ gives the second-difference recursionStarting from $q(0)=0$ and $q(\varphi )$ yields $q(n\varphi )=n^{2}q(\varphi )$ for all integers $n$. DefineIt is symmetric and odd in each variable. Applying the parallelogram identity to the four terms in its first expression givesInterchanging $u,w$ and using oddness also gives $B(u+w,v)-B(u-w,v)=2B(w,v)$. Adding proves $B(u+w,v)=B(u,v)+B(w,v)$; symmetry proves additivity in the other variable. Thus $q$ is a quadratic form with associated rational bilinear form $B$.

Every nonzero homomorphism has positive degree, so $q(\varphi )>0$ for $\varphi \ne 0$. The scaling identity also shows that the homomorphism group is a torsion-free group. Hence $q$ extends to its rational vector space. On the span of any finitely many rationally independent homomorphisms, the matrix of $B$ is rational. Positivity on nonzero rational vectors implies nonnegativity on real vectors by density. If the real matrix had a nontrivial kernel, its rational linear equations would have a nonzero rational solution, contradicting positivity. Thus its real extension is a positive-definite quadratic form. This establishes the requested positivity as well as the quadratic identities.

An important companion to degree is the dual isogeny. Under $E\cong {\mathrm{Pic}}^0(E)$ via $P\mapsto [P-O]$, the pullback ${\varphi }^{\ast }:{\mathrm{Pic}}^0(E_2)\to {\mathrm{Pic}}^0(E_1)$ defines $\hat{\varphi }:E_2\to E_1$. Divisor pushforward corresponds to $\varphi$, and pushforward after pullback multiplies divisor classes by $n=\mathrm{deg}\varphi$. Therefore $\varphi \hat{\varphi }=[n]$. Composing shows that $\hat{\varphi }\varphi -[n]$ takes values in the finite kernel of $\varphi$; a morphism from a connected smooth curve into this finite scheme must be constant, and its identity value is zero. ThusThe last equality follows from $\mathrm{deg}[n]=n^2$, already proved by applying $q(m\varphi )=m^{2}q(\varphi )$ to the identity map. The dual isogeny is unique, since the difference of two choices composed with $\varphi$ would vanish and $\varphi$ is surjective. It follows that being isogenous is an equivalence relation: duality supplies symmetry, and composition supplies transitivity. For a finite subgroup of geometric points of order prime to the characteristic, the quotient curve and its quotient map give an elliptic isogeny with that kernel; in general one uses finite subgroup schemes. This is the geometric source of explicit descent maps, including the two-isogeny formula in Question 4.

Finally elliptic isogenies preserve the rational rank of an abelian group over a number field. Their dual compositions are multiplication by $n$, so after tensoring the rational point groups with $\mathbb{Q}$ the elliptic isogeny becomes invertible. For a single curve, its endomorphism algebra in characteristic zero is $\mathbb{Q}$ or an imaginary quadratic field, giving ordinary integer multiplication or complex multiplication. In positive characteristic a supersingular curve can instead have a quaternionic endomorphism algebra. The positive degree form controls the sizes of these homomorphisms, while duality makes their arithmetic and geometric properties accessible.

Let $E$ be the elliptic curve, and choose a point $O\in E(k)$ to serve as identity. Its geometric genus is one and its canonical divisor $K$ has degree zero. For any divisor $D$ of degree one, the Riemann-Roch theorem givesSince $K-D$ has degree $-1$, its Riemann-Roch space is zero: a nonzero section would produce an effective divisor of negative degree. Hence $\ell (D)=1$. Choose a nonzero $f\in L(D)$. The divisor $D+(f)$ is effective of degree one, so over the algebraically closed field it is a single point $P$. Thus every degree-one divisor class has a point representative.

This representative is unique. If $P$ and $Q$ are linearly equivalent, choose $h$ with $(h)=P-Q$. Then $h\in L(Q)$. That space has dimension one and already contains the constants, so $h$ is constant and $P=Q$. Consequentlyis injective. It is also surjective: if $D$ represents a degree-zero divisor class, apply the preceding result to $D+O$ to obtain its unique point representative $P$, giving $[D]=[P-O]$.

The degree-zero Picard group of a curve is a group because divisors add commutatively, principal divisors form a subgroup, and degree passes to the quotient. DefineEquivalently, $R=P\oplus Q$ is the unique point satisfying the linear equivalence of divisors $P+Q\sim R+O$, where the plus signs in this equivalence denote divisor addition. The zero class corresponds to $O$, so $O$ is the identity. The inverse of $P$ is the unique point $P^{\prime }$ with $P+P^{\prime }\sim 2O$. Associativity follows because both $(P\oplus Q)\oplus R$ and $P\oplus (Q\oplus R)$ map to $\iota (P)+\iota (Q)+\iota (R)$, and $\iota$ is injective; commutativity follows in the same way. Thus this is an abelian group structure on $E(k)$, obtained directly by the elliptic curve group law from Riemann-Roch. The identity choice is part of the construction.

Write $X={\mathrm{Pic}}^{g-1}(C)$. The theta divisor is the effective locusFor its scheme structure, take a fixed effective Cartier divisor $E$ of degree $e\ge g$ and a universal line bundle $M$ locally on $X$. Both ${\pi }_{\ast }M(E)$ and ${\pi }_{\ast }(M(E){|}_E)$ are rank-$e$ vector bundles; the first assertion follows from Serre duality and the Riemann-Roch theorem. Define $\Theta$ by the determinant of their evaluation map. Its kernel is $H^0(C,M)$, so this is precisely the required locus. Exact sequences for enlarging $E$ cancel an invertible determinant factor, making the determinant description of the theta divisor independent of $E$.

This is a genuine irreducible reduced Cartier divisor. Choose $g-1$ points imposing independent conditions on $H^0(C,K_C)$. For their effective Cartier divisor $D^{\prime }$, the Riemann-Roch theorem gives $h^0(\mathcal{O}(D^{\prime }))=h^1(\mathcal{O}(D^{\prime }))=1$. These points form a nonempty open set in the irreducible symmetric product of a curve $C^{(g-1)}$; the Abel map of an algebraic curve is generically one-to-one there, so its image has dimension $g-1$. At such a class $M$, the first-order change of the evaluation determinant is the cup-product functionalUnder Serre duality its dual is multiplication $H^0(M)\otimes H^0(K_C\otimes M^{-1})\to H^0(K_C)$. The product of two nonzero sections on an integral algebraic curve is nonzero. Thus the functional is nonzero and the determinant has multiplicity one generically. Its irreducible support is consequently the reduced theta divisor.

Now let $L={\mathcal{O}}_C(D)$ have degree $g$. The Riemann-Roch theorem gives $h^0(L)\ge 1$, while evaluation at $P$ givesIf $h^0(L)\ge 2$, this kernel is nonzero for every $P$, so the entire image of ${\varphi }_D$ lies in $\Theta$. If $h^0(L)=1$, write $s$ for a nonzero section. The kernel is nonzero exactly at the zeros of $s$, so the image is not contained in $\Theta$. Moreover $h^1(L)=0$, and the family $L(-P)$ is computed by the rank-one evaluation map $H^0(L)\otimes {\mathcal{O}}_C\to L$. Its determinant is $s$ itself. This proves the scheme-theoretic restriction of the theta divisor to an Abel curve:Here the intersection is regarded as a Cartier divisor on $C$. Since $D$ was specified as a divisor class, it means its unique effective representative, with all multiplicities. The map ${\varphi }_D$ is an embedding: distinct points with the same image would give a degree-one map $C\to {\mathbb{P}}^1$; its cotangent map is evaluation of canonical differentials, which is surjective because $K_C$ is base-point-free. To see the latter, $h^0({\mathcal{O}}_C(P))=1$ for genus at least one, and the Riemann-Roch theorem gives $h^0(K_C-P)=g-1$. Thus the pullback also describes the intersection on the embedded curve.

It remains to count sections on $X$. Let $s_{\Theta }$ be the section defining the theta divisor, and take any $s\in H^0(X,{\mathcal{O}}_X(\Theta ))$. The quotient $r=s/s_{\Theta }$ is a rational function. Choose a fixed degree-$2g-1$ line bundle $T$ and the morphismIt is surjective: for every $M\in X$, the degree-$g$ bundle $T\otimes M^{-1}$ has a nonzero section by the Riemann-Roch theorem. On a general coordinate curve, put $D=T-{\sum }_{j\ne i}{P}_j$. The $g-1$ general points impose independent conditions on the $g$-dimensional space $H^0(C,T)$, leaving $h^0(\mathcal{O}(D))=1$. This independence follows inductively by choosing each new point away from the common zero set of the remaining nonzero sections. The restriction already proved identifies ${\mathcal{O}}_X(\Theta )$ on that coordinate curve with ${\mathcal{O}}_C(D)$, whose section space is one-dimensional. Hence $r\circ \beta$ is constant along every general coordinate curve.

A rational function on a product of integral curves which is constant in each factor is constant: on a common dense open set, successively varying one coordinate identifies its value with the value at a fixed general tuple. Therefore $r\circ \beta \in k$, and surjectivity of $\beta$ gives $r\in k$. Every $s$ is a scalar multiple of $s_{\Theta }$, proving

Fix a point $[L]\in {\mathrm{Pic}}^d(C)$ and put $V=H^0(C,L)$. The set of effective Cartier divisors in its divisor class is the complete linear system of a divisor, but identifying points alone would not prove the requested scheme assertion. We identify its functor on arbitrary parameter schemes, including nonreduced ones.

Let $T$ be a $k$-scheme and let $\mathcal{D}\subset C\times T$ be a relative effective degree-$d$ Cartier divisor whose Abel map of an algebraic curve is the constant morphism $[L]$. The definition of the Picard functor of a curve saysfor a line bundle $M$ on $T$. Its canonical section is nonzero on every geometric fibre. Since the constant family has direct image $V{\otimes }_k{\mathcal{O}}_T$, this section determines a line subbundleIt is a subbundle, rather than merely an injective sheaf map: locally some coordinate is nonzero on each residue field, hence a unit on a neighbourhood, so the quotient is locally free. Such a subbundle is exactly a $T$-point of the projective space ${\mathbb{P}}_{\mathrm{lines}}(V)$.

Conversely, its tautological line subbundle evaluates to a section of ${\mathrm{pr}}_C^{\ast }L\otimes {\pi }^{\ast }M$, nonzero on every geometric fibre. On the smooth integral fibres its zero locus is an effective Cartier divisor. The fibrewise regularity criterion gives a relative Cartier divisor flat over $T$, of degree $d$, and its Picard class is constant $[L]$. These constructions are inverse and commute with arbitrary base change. Thus they identify functors, and therefore the scheme fibre itself:If $h^0(C,L)=0$, the fibre is empty, which is smooth as well. The argument remains valid over a point's residue field, so every scheme fibre, not just each closed geometric fibre, is smooth. Fibre dimensions can jump when $h^0(C,L)$ jumps; this does not assert that the entire Abel map of an algebraic curve is a smooth morphism.

Choose a Weierstrass equation of an elliptic curve, with origin $O$ at infinity. For $P,Q$, draw their chord, or the tangent if they coincide, and call its third intersection $R$, counted with intersection multiplicity. The line through $R$ and $O$ gives a third point $S$; define $P+Q=S$. This is the chord-and-tangent group law. The inverse of an affine point on $y^2+a_{1}xy+a_{3}y=x^3+a_2{x}^2+a_{4}x+a_6$ is $(x,-y-a_{1}x-a_3)$, obtained from its vertical line through $O$. These conventions give identity $O$, and cover tangent and flex cases by multiplicity.

Here is a proof of associativity, without assuming that the geometric construction already defines a group. Work first over an algebraic closure and use divisors on an algebraic curve. The Riemann-Roch theorem says $\ell (D)-\ell (K_E-D)=\mathrm{deg}D+1-g$. For a smooth genus-one curve the canonical divisor has degree zero, so every degree-one divisor has $\ell (D)=1$. Thus every divisor class of degree one has a unique effective representative, necessarily a single point. Existence follows from a nonzero section; uniqueness follows because two distinct effective representatives would give linearly independent sections in the same one-dimensional space. Consequentlyis a bijection: add $(O)$ to any degree-zero divisor class, and use its unique degree-one representative.

A line through $P,Q,R$ cuts out a divisor linearly equivalent to $3(O)$, since the line at infinity has triple intersection at the Weierstrass flex $O$. Equivalently, the ratio of the line equation to that of the line at infinity has principal divisor $(P)+(Q)+(R)-3(O)$. Thus the three corresponding degree-zero classes sum to zero. Applying the same fact to $O,R,S$ shows that the point produced by the chord-and-tangent process satisfiesAddition of divisors modulo principal divisors is associative. The two parenthesizations of $P+Q+T$ therefore have identical classes; injectivity of the displayed bijection makes them the same point. Hence the chord-and-tangent law is associative. This is associativity of the chord-and-tangent law via divisor classes. Its construction is defined over the original field, so the same conclusion holds for its rational points.

We first determine the torsion. The rational 2-torsion points are $O,(0,0),(5,0),(-5,0)$. At the good primes three and seven, part (b) gives group orders four and eight. Prime-to-residue-characteristic torsion injects under reduction: an element in the kernel has a formal parameter $t$ of positive valuation, and multiplication by an integer prime to the residue characteristic has series $mt+O(t^2)$ with unit leading coefficient, so cannot kill a nonzero such parameter. At seven this excludes rational 3-primary torsion; at three it excludes 7-primary torsion and every odd-primary component other than the already excluded 3-primary component. Thus all torsion is 2-primary and injects at three, bounding its order by four. Consequently

For the rank, use two-isogeny descent withThe two-isogeny formula givesThey extend at the exceptional points, have kernels $\{O,(0,0)\}$ on their respective curves, and satisfy $\psi \varphi =[2]$. These assertions can be checked by substitution; for example the composed x-coordinate is $(x^2+25{)}^2/[4x(x^2-25)]$, the duplication x-coordinate. The maps respect addition because they are morphisms fixing $O$: pushforward of divisor classes is additive, takes principal divisors to principal divisors by the norm of a rational function, and under the identification in part 1(a) sends $[(P)-(O)]$ to $[(\varphi P)-(O)]$, and likewise for $\psi$.

Define the two-torsion square-class homomorphism $\alpha :E(\mathbb{Q})\to {\mathbb{Q}}^{\times }/{\mathbb{Q}}^{\times 2}$ by $\alpha (x,y)=[x]$, $\alpha (O)=1$, and $\alpha ((0,0))=[-25]=[-1]$. Define ${\alpha }^{\prime }$ on $E^{\prime }$ similarly, with ${\alpha }^{\prime }((0,0))=[100]=1$. To see the homomorphism property, a nonvertical line $y=mx+c$ cuts either curve in three points whose x-coordinates have product $c^2$. The chord-and-tangent law therefore makes their square classes multiply to one. When the line passes through $(0,0)$, the two remaining x-coordinates have product equal to the coefficient of $x$, exactly explaining the assigned value there. Vertical lines give the inverse-point relation. The same argument includes repeated tangent intersections.

The kernels are $\ker \alpha =\psi E^{\prime }(\mathbb{Q})$ and $\ker {\alpha }^{\prime }=\varphi E(\mathbb{Q})$. Here is an explicit check, not just an invocation of the descent correspondence. The x-coordinate of every nonexceptional $\psi$-image is a square. Conversely, if $(x,y)\in E$ has $x=s^2\ne 0$, put $X=2x+2y/s$ and $Y=2sX$. Then $X^2-4xX+100=0$, so $(X,Y)\in E^{\prime }$ and the displayed $\psi$ maps it to $(x,y)$. For $E^{\prime }$, every nonexceptional $\varphi$-image has $X=(y/x{)}^2$; if $X=s^2\ne 0$, put $x=(X+Y/s)/2$, $y=sx$. Substitution gives a point of $E$ mapping to $(X,Y)$. The point $(0,0)\in E^{\prime }$ has square class one and equals $\varphi (5,0)$; the point $(0,0)\in E$ has nonsquare class $-1$. Together with the origins these checks handle every exception.

The prime-support bound in two-isogeny descent can be read directly from $y^2=x(x^2+B)$. At a prime not dividing the integral coefficient $B$, positive valuation of $x$ gives $2v(y)=v(x)$, while negative valuation gives $2v(y)=3v(x)$; either way the valuation of $x$ is even. Thus the first image has only the candidate classes $1,-1,5,-5$. All four occur, already at the four torsion points. Hence $\#\alpha (E)=4$.

On $E^{\prime }$, nonzero real x-coordinates are positive since $X(X^2+100)$ has the sign of $X$. Prime support leaves only $1,2,5,10$. The point $(5,25)$ supplies class five. Class two would give the quartic covering in a two-isogeny descentIndeed write $X=2(U/V{)}^2$ and clear the square factor in the curve equation. If $5\nmid U$, the right side is two modulo five, impossible for a square. If $5\mid U$, then $5\nmid V$ and $5\mid W$; division by twenty-five gives $(W/5{)}^2\equiv 2V^4\equiv 2(\mathrm{mod}5)$, again impossible. This is the five-adic obstruction to square class two on the curve with coefficient one hundred. Because the image is a subgroup and contains five, class ten is excluded as well. Therefore ${\alpha }^{\prime }(E^{\prime })=\{1,5\}$ has size two.

Now $[E:\psi E^{\prime }]=4$. The quotient $\psi E^{\prime }/2E$ is isomorphic to $E^{\prime }/\varphi E$: the kernel of the induced surjection is $\ker \psi /(\ker \psi \cap \varphi E)$, which is trivial because $(0,0)\in E^{\prime }$ equals $\varphi (5,0)$. Thus $[E:2E]=4\cdot 2=8$. Finite generation follows from the Mordell-Weil theorem, whose height-descent proof is supplied in the essay below. A finitely generated group with the torsion already found has $[E:2E]=2^{r+2}$, so $r=1$. HenceThe point $(-4,6)$ has infinite order, since it is not one of the torsion points. No assertion that this particular point generates the free factor is needed.

An elliptic curve works over every algebraically closed field, including one algebraic over a finite field. Give it explicitly in ${\mathbb{P}}^2$ byIn the first case the only point at infinity is $O=[0:1:0]$, where the derivative with respect to $z$ is nonzero. In the affine chart $z=1$, a singular point of an algebraic variety would have $y=0$, $x^3-x=0$, and $3x^2-1=0$. The possible roots $x=0,1,-1$ cannot satisfy the last equation in characteristic different from $2$: at $0$ it is $-1$, and at $\pm 1$ it is $2$. In the second case the three homogeneous partial derivatives are $x^2,z^2,y^2$, up to harmless signs, and cannot vanish simultaneously at a projective point. Thus both cubics are smooth varieties. A reducible plane cubic would have intersecting positive-degree components by Bézout theorem, and be singular at an intersection; therefore these smooth cubics are irreducible varieties. The genus-degree formula gives $g=(3-1)(3-2)/2=1$. With the marked point $O$ they are elliptic curves.

For a smooth algebraic curve, its divisor class group is its Picard group. Its degree-zero subgroup isThe map $P\mapsto [P-O]$ gives an isomorphism of abelian groupsTo recall why it is a bijection, Riemann-Roch theorem in geometric genus one says every degree-one divisor class has exactly one independent section: a canonical divisor has degree zero, so the dual degree-$-1$ term has no section. Thus the class contains one effective divisor on an algebraic curve of degree one, namely a point $P$, and that point is unique. Translating by $-O$ gives the claimed bijection; this is precisely the chord-and-tangent group law on the elliptic curve.

Choose a prime integer $\ell$ different from $\mathrm{char}k$. The multiplication-by-n morphism $[\ell ]:E\to E$ has derivative $\ell$ times the identity at $O$, so it is nonconstant. A nonconstant morphism of algebraic varieties between smooth projective curves is surjective: its image is closed by proper morphism and cannot have algebraic dimension zero. Since $k$ is an algebraically closed field, this makes $[\ell ]$ surjective on $k$-points. ThereforeYet $E(k)$ is infinite. For each $x\in k$, the affine equation has a solution for $y$ in the algebraically closed field; since $k$ is infinite, this gives infinitely many points.

By the Fundamental theorem of finitely generated abelian groups, a finitely generated abelian group $A$ satisfying $A=\ell A$ has no free part and is a finite torsion group of order prime to $\ell$. The infinite group $E(k)$ cannot have this property while being finitely generated. Thus ${\mathrm{Pic}}^0(E)$ is not finitely generated. A subgroup of a finitely generated abelian group is finitely generated, soThis proof uses divisibility and infinitude, rather than uncountability, so it remains valid over countable algebraically closed fields.

Let $C$ be the projective cubic of a Weierstrass equation of an elliptic curve, allowing its elliptic-curve discriminant to vanish, and let $O=[0:1:0]$. Use only the smooth locus of a variety $C_{\mathrm{sm}}(K)$: the singular point, if present, is excluded. For $P,Q$, intersect their chord with $C$, using the tangent if $P=Q$ and counting intersection multiplicity. If the third intersection is $R$, define $P+Q=-R$, wherein general Weierstrass equation of an elliptic curve coordinates. The line through $R$ and $O$ gives this reflection. A vertical chord gives $P+(-P)=O$, and the tangent at $O$ meets $C$ three times at $O$, so $O$ is the identity. The construction is symmetric in $P,Q$. It stays in the nonsingular locus: a line through a singular point has intersection multiplicity at least two there, and therefore cannot also contain two smooth intersections counted with multiplicity.

For the nonsingular case, prove associativity by transporting a known abelian group law. The Abel-Jacobi map of a genus-one curveis bijective over an algebraic closure. Indeed, the Riemann-Roch theorem in genus one says that every divisor class of degree one has a unique effective representative consisting of one point: existence follows from $\ell (D)=1$, and uniqueness follows because two distinct representatives would produce a degree-one map to the projective line, impossible for a genus one curve. Subtracting $O$ gives the claimed bijection.

Any line section represents the same divisor class as $3O$, including tangencies. Thus $P+Q+R\sim 3O$ as divisors on an algebraic curve, while the vertical line gives $R+(-R)+O\sim 3O$. HenceAddition in the Picard group is associative, soThe chord-and-tangent group law is defined over $K$, so the group operation restricts to the $K$-rational points.

For completeness, a singular Weierstrass equation of an elliptic curve produces the smooth-locus group of a singular Weierstrass cubic, not an elliptic curve. Over an algebraic closure, its normalization of an algebraic curve is the projective line; deleting the two preimages of a nodal crossing gives the multiplicative algebraic group, while deleting the single preimage of a cusp gives the additive group. For example, on $y^2=x^3$, the coordinate $u=x/y$, with $u(O)=0$, makes the smooth-locus law addition. On $y^2=x^2(x+1)$ in characteristic different from two, put $t=y/x$ and $z=(t+1)/(t-1)$, with $z(O)=1$; the chord relation gives $z(P)z(Q)z(R)=1$, so the group law is multiplication of $z$. A nonsplit node gives the corresponding form of the multiplicative algebraic group over $K$. These descriptions also establish the singular-case group laws.