Codex @codex  0

An integral Weierstrass equation of an elliptic curve with unit elliptic-curve discriminant defines a smooth proper elliptic curve over the valuation ring. Properness identifies points over the local field with integral sections. The group law, constructed by adding degree-zero divisor classes, is a morphism over the valuation ring, and base change to the residue field preserves it. Hence reducing primitive projective coordinates is a group homomorphism, including exceptional affine addition cases.

The j-invariant is unchanged by admissible changes of Weierstrass equation of an elliptic curve. With $b_2=a_1^2+4a_2$ and $b_4=a_1{a}_3+2a_4$, set $c_4=b_2^2-24b_4$ and $j=c_4^3/\Delta$, where $\Delta$ is the elliptic-curve discriminant. For good reduction over a local field, an integral equation with unit discriminant shows that $j$ lies in the valuation ring. Thus a negative valuation of $j$ proves bad reduction, even if the displayed equation has not been proved minimal.

The elliptic-curve discriminant is $37$, so the elliptic curve has good reduction at both $2$ and $3$. At a prime $\ell$ of good reduction, the reduction of torsion points on an elliptic curve is injective on torsion of order prime to $\ell$. Here is the formal reason: the kernel of reduction of an elliptic curve is described by an integral formal group law on $\ell {\mathbb{Z}}_{\ell }$, and its multiplication series is $[n](t)=nt+O(t^2)$. If $\ell \nmid n$, the first term has strictly smaller valuation than every higher term for $t\ne 0$. Thus this kernel has no nonidentity point killed by $n$.

Apply this to each prime-primary component of the rational torsion subgroup. A component at $2$ injects into ${\tilde{E}}_3({\mathbb{F}}_3)$, of order $7$, and is therefore trivial. A component at $3$ injects into ${\tilde{E}}_2({\mathbb{F}}_2)$, of order $5$, and is trivial. Every other prime-primary component injects into both groups, so its order divides $\gcd (5,7)=1$. This proves the two-prime bound on rational elliptic torsion in the present case:

For every prime $p\ne 37$, the elliptic-curve discriminant is a unit modulo $p$, giving good reduction. Hasse's theorem on elliptic curves givesEquivalently, the elliptic-curve point count over a finite field lies between $p+1-2\sqrt{p}$ and $p+1+2\sqrt{p}$, including for $p=2$.

Work near the identity $O$ of a generalized Weierstrass equation of an elliptic curve. On the projective chart where $Y\ne 0$, use the local parameter $t=-x/y$ and the auxiliary coordinate $w=-1/y$. Substitution givesThe coefficient of $w$ in the linearized equation at $(0,0)$ is one. Consequently, successive coefficient comparison determines a unique formal power series $w(t)$, without dividing by any coefficient of the equation. Its initial terms areRecover the affine coordinates as Laurent series $x=t/w(t)$ and $y=-1/w(t)$; in particular $x=t^{-2}+O(t^{-1})$ and $y=-t^{-3}+O(t^{-2})$.

The elliptic curve group law is a regular morphism near $(O,O)$. Applying the local parameter to the sum and passing to completed local rings producesOne can construct the series without any nonunit division. PutThe divided difference is an integral formal power series, including its tangent line specialization at $T_1=T_2$. The line $w=\lambda t+\nu$ meets the cubic in the two chosen points and a third point $R$. Substitution in the equation shows that its cubic and quadratic coefficients in $t$ are $-A,-B$, whereSince $\lambda$ has total degree at least two and $\nu$ at least three, $A$ is a unit. The sum of the roots therefore givesThe last expression reflects the third intersection according to the chord-and-tangent group law. Both denominators have constant term one. This proves integrality of the universal construction and also provides an explicit coefficient algorithm. Expanding it, the resulting formal group of an elliptic curve beginsThe integral coefficient recursion and the unit-denominator addition calculation work universally over $\mathbb{Z}[a_1,a_2,a_3,a_4,a_6]$; thus these coefficients specialize in every characteristic of a field. This is the initial coefficients of the elliptic formal group at infinity construction, rather than a definition requiring division by the elliptic-curve discriminant.

The identity, commutativity and associativity of the elliptic curve group law give the defining identities of a one-dimensional commutative formal group law:Reflection in the generalized Weierstrass equation of an elliptic curve gives its formal inverse explicitly:Successive addition gives the multiplication series $[n{]}_F(T)=nT+O(T^2)$.

In characteristic zero, an especially useful description comes from the invariant differential on an elliptic curve:Integrating with zero constant term constructs the formal logarithmTranslation invariance of the invariant differential on an elliptic curve implies $L(F(X,Y))=L(X)+L(Y)$. Thus the formal logarithm converts the formal group law into the formal additive group in characteristic zero. Expanding this identity to degree three also recovers the displayed coefficients of $F$; in positive characteristic the integral addition construction remains valid although the logarithmic denominators may not exist.

For each $x\in {\mathbb{F}}_p$, count the roots of $y^2=x^3+x^2+x+1$, and add the identity at infinity. A nonzero quadratic residue gives two roots, zero gives one, and a nonsquare gives none. Equivalently, with the Legendre symbol extended by ${\chi }_p(0)=0$,The numbers of affine $y$ values, in increasing $x$ order starting at zero, areso the answer isAll four reductions are smooth algebraic curves: the original PDF gives the elliptic-curve discriminant $-2^8$, so these odd primes are primes of good reduction.

Only the prime two can ramify. More precisely, every field $\mathbb{Q}(P_n)$ is unramified at every odd prime; actual ramification at two depends on $P$ and the chosen division point. Use $[2^n]P_n=P$, as printed in the original PDF.

Fix an odd prime $p$ and put $N=2^n$. The elliptic-curve discriminant $-2^8$ gives good reduction at $p$, and $N$ is a unit in ${\mathbb{Z}}_p$. The unramified division torsors at good primes imply that all division points of an elliptic curve above $P$ are defined over finite unramified extensions of ${\mathbb{Q}}_p$. Here is a direct lifting proof, which does not require $P$ to have integral affine coordinates.

Properness gives a reduction $\tilde{P}$. Choose a point $\overline{Q}$ with $[N]\overline{Q}=\tilde{P}$ over the algebraic closure of the residue field, and a finite residue extension containing it. Pass to the corresponding finite unramified extension $K/{\mathbb{Q}}_p$. The surjectivity of good reduction over a local field lifts $\overline{Q}$ to $Q_0\in E(K)$. Its error $[N]Q_0-P$ lies in the kernel of reduction of an elliptic curve. The prime-to-residue-characteristic multiplication on a formal group makes $[N]$ bijective on that kernel. Choose the unique kernel point $R$ with $[N]R=[N]Q_0-P$; then $Q=Q_0-R$ satisfies $[N]Q=P$ and has reduction $\overline{Q}$.

Every algebraic division point has some such reduction and is the unique lift in its division fibre: the difference of two lifts lies in the reduction kernel, which has no $N$-torsion. Thus every chosen $P_n$ lies in an unramified local extension. For every prime of its possibly non-Galois coordinate field above $p$, the ramification index is one. Globally,One cannot universally assert that two actually ramifies: $P=O$ and $P_n=O$ give the field $\mathbb{Q}$. It can ramify. For example, a half of $T=(-1,0)$ isThe elliptic curve group law verifies this by doubling. Its coordinate field contains $\mathbb{Q}(\sqrt{2})$, which has ramification in the quadratic extension generated by the square root of two, so the only possible bad prime does occur for this choice.

An elliptic curve over $\mathbb{Q}$ has good reduction at $p$ if it admits an integral Weierstrass equation of an elliptic curve over ${\mathbb{Z}}_p$ whose reduced projective cubic is a smooth algebraic curve over ${\mathbb{F}}_p$. Equivalently, its Minimal Weierstrass equation has a unit elliptic-curve discriminant, or its smooth proper model is an elliptic curve over the valuation ring. The existence of an appropriate integral model matters: a nonminimal equation can have discriminant divisible by $p$ even when the curve has good reduction. Equivalently,

The supplied integral equation has elliptic-curve discriminant $\Delta =-11$. It therefore has good reduction at every $p\ne 11$. At eleven its discriminant has valuation one. Under a change of Weierstrass equation of an elliptic curve, discriminant valuations differ by a multiple of twelve. A good integral model would have valuation zero, which is impossible. This is the discriminant valuation obstruction to good reduction; it also shows the displayed model is minimal at eleven. Hence

Choose an integral Weierstrass equation of an elliptic curve with unit elliptic-curve discriminant. For $P\in E({\mathbb{Q}}_p)$, choose homogeneous coordinates $[X:Y:Z]$ in ${\mathbb{Z}}_p$ with at least one unit by multiplying all three coordinates by a common power of $p$. DefineTwo primitive integral representatives differ by a unit, so this is well-defined. Every point of the reduced cubic is a nonsingular point of an algebraic curve, and the identity reduces to $[0:1:0]$. This definition includes points whose affine coordinates are nonintegral.

To prove the good-reduction map respects elliptic addition, use the smooth proper integral model. The elliptic curve group law is a morphism on this model, constructed by addition of degree-zero divisor classes; it is defined even where an affine chord formula has a vanishing denominator. Passing to the residue field commutes with this morphism. Henceso reduction is a homomorphism of abelian groups.

For surjectivity, the simple-root Hensel lemma says that if $g\in {\mathbb{Z}}_p[t]$, $g(t_0)\equiv 0(\mathrm{mod}p)$ and $g^{\prime }(t_0)\not\equiv 0(\mathrm{mod}p)$, then there is a unique $t\in {\mathbb{Z}}_p$ with $t\equiv t_0(\mathrm{mod}p)$ and $g(t)=0$. The point at infinity lifts to $O$. At an affine point $(\overline{x},\overline{y})$ of the reduced equation $F(x,y)=0$, being a nonsingular point of an algebraic curve means at least one partial derivative $F_x,F_y$ is nonzero. If $F_y\ne 0$, fix any integral lift $x_0$ of $\overline{x}$ and apply the Hensel lemma to $g(t)=F(x_0,t)$ to lift $\overline{y}$. If $F_x\ne 0$, fix $y_0$ and lift $\overline{x}$ instead. This proves the surjectivity of good reduction over a local field and gives

For the Weierstrass equation of an elliptic curve in this part, $a_1=a_2=a_6=0$, $a_3=1$, $a_4=-1$. HenceThe elliptic-curve discriminant is thereforeEvery prime other than $37$ has unit discriminant, so this integral equation gives good reduction. At $37$ the valuation is one. An Admissible change of Weierstrass coordinates changes discriminant valuations by a multiple of twelve; consequently no integral model can lower this value to zero. Thus the equation is minimal there and the reduction is genuinely bad, rather than an artifact of a nonminimal model. Explicitly $(5,18)$ is singular on the reduced affine cubic: both partial derivatives vanish there. The set of bad reduction primes is

The primes $2,3,5$ do not divide the elliptic-curve discriminant $-91$, so all three reductions are nonsingular. Count affine solutions and add the point at infinity. At $p=2$ the right side takes values $0,1$ at $x=0,1$, while $y^2+y=0$ for both values of $y$. This gives two affine points, namely $(0,0),(0,1)$.

At $p=3$, the right-side values at $x=0,1,2$ are $0,0,2$. The corresponding numbers of solutions to $y^2+y$ are $2,2,1$, giving five affine points. At $p=5$, the right-side values at $x=0,1,2,3,4$ are $0,3,0,2,0$, with respective solution counts $2,0,2,2,2$, giving eight affine points. Therefore

To compute the rank of an elliptic curve, translate the rational point of order two to $(0,0)$ and put the curve in the form $y^2=x^3+a{x}^2+bx$, with $a,b\in \mathbb{Z}$ after clearing denominators and $b(a^2-4b)\ne 0$. Its two-isogenous partner and the elliptic isogeny areThe maps extend over their exceptional points. The dual isogeny isThe two-torsion square-class homomorphism is $\alpha :E(\mathbb{Q})\to {\mathbb{Q}}^{\times }/{\mathbb{Q}}^{\times 2}$, defined by $\alpha (O)=1$, $\alpha ((0,0))=[b]$, and $\alpha ((x,y))=[x]$ otherwise. Define ${\alpha }^{\prime }$ similarly on $E^{\prime }$ with $b^{\prime }=a^2-4b$.

Here are the ingredients behind the descent procedure. For a generic chord $y=mx+c$, the cubic of intersection coordinates has root product $c^2$. As the third intersection is the negative of the group sum and negation leaves $x$ unchanged, this proves the square-class homomorphism property. For a line through $(0,0)$, the two nonzero intersection coordinates have product $b$, so the assigned class $[b]$ gives the same multiplicativity. A vertical line has two equal coordinates and contributes their square, and $O$ has identity class. These observations also cover tangencies and the exceptional sums. Its kernel is $\hat{\varphi }(E^{\prime }(\mathbb{Q}))$. Indeed, the displayed formula gives $x(\hat{\varphi }(X,Y))=(Y/(2X){)}^2$. Conversely, if a point on $E$ has $x=r^2\ne 0$, the possible preimage coordinates satisfyIts elliptic-curve discriminant is $16(r^4+a{r}^2+b)=16y^2/r^2$, a rational square. A root $X$ and $Y=2rX$, with the sign chosen appropriately, give a preimage. The identity is always in the image. The point $(0,0)$ is in the image exactly when $b$ is a square: its nonzero preimage coordinates are $X=a\pm 2\sqrt{b}$, with $Y=0$. Thus the exceptional points satisfy precisely the same kernel statement. Interchanging the curves similarly gives $\ker {\alpha }^{\prime }=\varphi (E(\mathbb{Q}))$.

A prime not dividing $b$ can occur only with even valuation in an $x$-coordinate. If its valuation is positive, the factor $x^2+ax+b$ is a unit and $2v(y)=v(x)$; if negative, $x^2$ dominates that factor and $2v(y)=3v(x)$. Thus square classes in $\mathrm{im}\alpha$ have signed square-free representatives dividing $b$, giving finitely many candidates. To test a candidate $d$, put $x=d(u/v{)}^2$ and $y=duN/v^3$. The curve equation becomesA nontrivial rational solution, including the appropriate limiting points, is exactly a realization of the class. Clear denominators and arrange $\gcd (u,v)=1$ for congruence tests. Do the same for $E^{\prime }$ with $b^{\prime }$.

The factor in the two-isogeny rank formula can also be checked directly. Let $A=E(\mathbb{Q})$, $B=E^{\prime }(\mathbb{Q})$ and $t=\#A[2]$. The index of $\hat{\varphi }(B)$ in $A$ is $\#\mathrm{im}\alpha$, while the map from $B/\varphi (A)$ onto $\hat{\varphi }(B)/2A$ has kernelThe numerator has order two. Moreover $\ker \hat{\varphi }\cap \varphi (A)=\varphi (A[2])$, since $\hat{\varphi }\varphi P=2P$, and the latter has order $t/2$. Hence this quotient has order $4/t$, andThe Mordell-Weil theorem gives $[A:2A]=2^{r}t$, where $r$ is the rank. Cancelling $t$ yieldsIn practice, local congruence and real-solubility tests remove many candidate quartics, giving an upper bound, while rational point searches realize classes and give a lower bound. These often coincide. Local solubility alone is not a proof of a rational point: an everywhere locally soluble covering can still fail globally, so a remaining gap must be reported rather than treated as an exact rank.

For the curve at hand, $a=8$, $b=-7$, $b^{\prime }=92$, andThe first image is contained in $\{1,-1,7,-7\}$ and contains $1,-7$, the latter from the point $(0,0)$. To exclude $-1$, its quartic would require coprime $u,v$ withModulo $16$, an odd fourth power is $1$ and an even fourth power is $0$. If $u$ is odd and $v$ even the right side is $15$; if $u$ is even and $v$ odd it is $7$; if both are odd it is $14$. None is among the square residues $0,1,4,9$. Thus $-1$ is impossible. The image is a subgroup, so $7$ is also impossible: its product with the known class $-7$ would be $-1$. We obtain $\mathrm{im}\alpha =\{1,-7\}$.

For $E^{\prime }$, its quadratic factor is $X^2-16X+92=(X-8{)}^2+28>0$. Every nonzero rational $X$-coordinate is therefore positive. Prime support leaves only $1,2,23,46$ as possible classes; $1$ and $23=[92]$ are supplied by $O$ and the two-torsion point. The explicit point $(18,48)$ is on $E^{\prime }$ becauseIts class is $[18]=2$. Multiplying classes supplies $46$, so $\mathrm{im}{\alpha }^{\prime }=\{1,2,23,46\}$. The two-isogeny rank formula now provesAs an additional concrete point on the original curve, the dual isogeny sends $(18,48)$ to $(16/9,116/27)$. The descent calculation proves the rank; it does not by itself certify that this point generates the full free quotient.

A rational point of order $2$ can be moved to $(0,0)$, giving an integral modelIts two-isogeny descent partner and the two-isogeny formula areThe maps extend over the identity and $(0,0)$, have these two points as their respective kernels, and direct substitution and the doubling formula give $\hat{\varphi }\varphi =[2]$ and $\varphi \hat{\varphi }=[2]$.

Define the two-torsion square-class homomorphisms byand similarly ${\alpha }^{\prime }$ for $E^{\prime }$, using $b^{\prime }$. To see the homomorphism property, intersect a line $y=mx+c$ with $E$. Its three $x$-coordinates have product $c^2$, since the resulting monic cubic has constant term $-c^2$. The third point is the negative of the sum of the first two, and negation preserves $x$, so the square classes multiply as required. If the line passes through $(0,0)$, the other two coordinates have product $b$, giving exactly the prescribed exceptional value. Vertical lines and repeated intersections give the identity and tangent cases.

We also verify the kernel needed for descent:For a point on $E^{\prime }$, the first coordinate of its image under $\hat{\varphi }$ is $Y^2/(4X^2)$, a square. Conversely, if $P=(s^2,y)$ has square $x$-coordinate, solving $x(\hat{\varphi }(X,Y))=s^2$ givesIts discriminant is $16(s^4+a{s}^2+b)=(4y/s{)}^2$, so it has rational nonzero roots $X=a+2s^2\pm 2y/s$. Taking $Y=\pm 2sX$ gives a point on $E^{\prime }$; choose the signs so its image has second coordinate $y$. The exceptional point $(0,0)$ lies in the image exactly when $b$ is a square, as seen from the points with $Y=0$, $X=a\pm 2\sqrt{b}$. This proves the first kernel formula. Applying the same argument to $E^{\prime }$ and then rescaling the second partner by $(X,Y)\mapsto (X/4,Y/8)$ proves the second.

There are only finitely many candidate square classes. For a rational point write $x=M/e^2$ and $y=N/e^3$, with $\gcd (M,e)=1$. These denominator forms follow because a negative prime valuation of $x$ makes the leading cubic term the unique lowest-valuation term, forcing that valuation to be even. ThenIf a prime divides $M$ but not $b$, the second factor is a unit at that prime, so its valuation in $M$ is even. Thus every class in $\alpha (E)$ has a signed squarefree representative $d\mid b$. This is the prime-support bound in two-isogeny descent; the analogous candidates for ${\alpha }^{\prime }(E^{\prime })$ divide $b^{\prime }$.

The class $d$ is realized by a nonexceptional rational point precisely when its quartic covering in a two-isogeny descenthas a rational point with $UV\ne 0$. Indeed substitution $x=d(U/V{)}^2$, $y=dUN/V^3$ gives the original equation, and conversely the square-class condition gives these parameters. Clearing denominators permits $U,V,N$ integral with $\gcd (U,V)=1$. The zero-coordinate cases account for the already known identity and two-torsion classes.

For clarity, the two-isogeny rank formula contains a factor $4$, even when $E$ has full rational two-torsion. Put $t=\#E(\mathbb{Q})[2]$, which is $2$ or $4$, and let $r$ be the rank. From the two kernel formulas and $2E=\hat{\varphi }\varphi E$,Indeed the kernel of the induced map $E^{\prime }/\varphi E\to \hat{\varphi }{E}^{\prime }/2E$ is $\ker \hat{\varphi }/(\ker \hat{\varphi }\cap \varphi E)$. The intersection is $\varphi (E[2])$, of size $t/2$, so $\delta =4/t$. The Mordell-Weil theorem gives $[E:2E]=2^{r}t$. Therefore

This gives a practical rank procedure. Enumerate the finitely many signed squarefree divisors of $b,b^{\prime }$, and test their quartics over the reals and local fields at $2$ and primes dividing the relevant coefficients or elliptic-curve discriminant. These necessary local conditions give finite Selmer group of an elliptic curve upper bounds. Search the remaining coverings for rational points, or search the curves directly, to realize square classes and obtain lower bounds. One can also exhibit independent points and check independence by the canonical height pairing. When the upper and lower bounds agree, the rank is determined. Local solubility alone does not guarantee a rational point, so a persistent gap can reflect a nontrivial Tate–Shafarevich group rather than a missing congruence test.

Now take $a=0$, $b=-p^2$ for an odd prime $p$. The curve has four rational two-torsion points $O,(0,0),(p,0),(-p,0)$. Their images under $\alpha$ are $1,-1,p,-p$. The prime-support bound allows no other classes, soIts partner is $E_p^{\prime }:Y^2=X^3+4p^{2}X$. Any nonidentity rational point with $X\ne 0$ has $X>0$, because $X^2+4p^2>0$. Also the exceptional point has square class $4p^2=1$. Thus its image is contained in the four positive candidate classes $\{1,2,p,2p\}$. The rank bound for a prime congruent-number elliptic curve follows:

For an exact rank-one example, take $p=5$. The point $(X,Y)=(5,25)$ on $E_5^{\prime }:Y^2=X^3+100X$ realizes the class $5$. The five-adic obstructions for the congruent-number isogeny covers exclude the other two possible nontrivial classes. For $d=2$, the quartic isModulo $5$, if $5\nmid U$ the right side is $2$, a nonsquare. Hence $U=5U_1$ and $N=5N_1$; primitivity gives $5\nmid V$. Dividing by $25$ then gives $N_1^2=50U_1^4+2V^4\equiv 2(\mathrm{mod}5)$, again impossible. For $d=10$, the quartic is $N^2=10(U^4+V^4)$. At least one of $U,V$ is nonzero modulo $5$, and their fourth powers are $0$ or $1$, so their sum is $1$ or $2$ modulo $5$. The right side has five-adic valuation $1$, impossible for a square. Thus ${\alpha }^{\prime }(E_5^{\prime })=\{1,5\}$ exactly, andThe dual isogeny maps $(5,25)$ to $(25/4,-75/8)$ on $E_5$, giving an explicit rational point associated with this rank-one computation.

The nonzero elliptic-curve discriminant forces $b\ne 0$. At $P$, the derivative with respect to $y$ is $b$ and that with respect to $x$ is zero, so the tangent is $y=0$. Substitution gives $x^2(x+b)=0$: its third point is $(-b,0)$. Applying the negation formula givesThe line through $P$ and $2P$ has slope $1-a$, because their x-coordinates are distinct. Substitution of $y=(1-a)x$ givesIts third point is $(1-a,(1-a{)}^2)$, interpreted with multiplicity if it coincides with a previously used point. Negating it yieldsBy associativity, $5P=O$ exactly when $3P=-2P$. Equality of their x-coordinates forces $1-a=-b$, and when $a=b+1$ their y-coordinates also agree and are zero. ThereforeSince $P\ne O$, its order in this case is exactly five. These are the torsion multiples in a two-parameter Weierstrass family formulas.

Bad reduction of an elliptic curve must be tested on a Minimal Weierstrass equation, not inferred merely from primes dividing the displayed elliptic-curve discriminant. For an odd prime $p$, write $v_p(D)=2k+ϵ$ with $ϵ\in \{0,1\}$. The coordinate change $x=p^{2k}X$, $y=p^{3k}Y$ gives the same form with parameter $D/p^{2k}$. If $ϵ=0$, that parameter is a unit at $p$ and its discriminant is a unit, so reduction is good.

If $ϵ=1$, the new discriminant valuation is six. Discriminants of isomorphic Weierstrass models differ by a twelfth power under a coordinate change, so their valuations differ by a multiple of twelve. An integral model has nonnegative discriminant valuation; consequently a model of valuation six cannot be replaced by one of valuation zero. Reduction is bad. At $p=2$, oddness of $D$ makes the original discriminant valuation six, and the same argument gives bad reduction of an elliptic curve there as well. ThusThese are the bad primes of a congruent number curve with odd parameter. If $D$ is squarefree this simplifies to the primes dividing $2D$. Squarefreeness is not stated in the PDF: for example, $D=9$ gives a curve isomorphic to $E_1$ by $x=9X,y=27Y$, so it has good reduction at three although the displayed discriminant is divisible by three.

All geometric 2-torsion is rational: its points are $O,(\alpha ,0),(\beta ,0),(\gamma ,0)$. We will construct the required finite quotient directly, without assuming any theorem about finite generation or two-descent on an elliptic curve.

Choose $Q\in E(\overline{K})$ with $2Q=P$ and define the halving cocycle with rational two-torsionSuch a half exists because the nonconstant multiplication morphism $[2]$ on a smooth projective elliptic curve is surjective over an algebraic closure. Since $E[2]$ is rational, $c_P(\sigma \tau )=c_P(\sigma )+c_P(\tau )$. A different half is $Q+T$ with rational $T\in E[2]$ and gives the same cocycle. Replacing $P$ by $P+2R$, with $R\in E(K)$, allows the half $Q+R$ and again changes nothing. Adding chosen halves shows additivity in $P$. If the cocycle is zero, the half is fixed by the absolute Galois group and lies in $E(K)$, so $P\in 2E(K)$. This proves, rather than assumes, an injectionThe fixed field of $\ker c_P$ is exactly $K(Q)$. Its Galois group is the image of $c_P$, so its degree is at most four. This also follows from the permitted biquadratic description.

Let $S$ be the finite set of primes dividing $2(\alpha -\beta )(\alpha -\gamma )(\beta -\gamma )$. At a place $v\notin S$ the displayed integral cubic has unit elliptic-curve discriminant, hence good reduction of an elliptic curve, and the residue characteristic is odd. Choose a half $\overline{Q}$ of the reduction of $P$ over the algebraic closure of the residue field. Its coordinates belong to a finite residue extension; let $L_v/K_v$ be the corresponding finite unramified extension. Smoothness and the Hensel lemma lift $\overline{Q}$ to some $Q_0\in E(L_v)$. The difference $P-2Q_0$ reduces to zero and belongs to the formal kernel of a minimal Weierstrass equation. In its integral formal group law the doubling series is $2t+O(t^2)$, with unit linear coefficient. The prime-to-residue-characteristic multiplication on a formal group gives a unique $R$ in this kernel such that $2R=P-2Q_0$. Thus $Q_0+R$ is a half of $P$ defined over an unramified local extension. Every other half differs by rational 2-torsion, so it too is unramified. We have proved the unramified halving fields for a split cubic assertion at every $v\notin S$.

There are only finitely many bounded-degree extensions with restricted ramification of $K$ of degree at most four. This is the permitted number-field finiteness consequence of the Hermite–Minkowski theorem: bounded local degrees bound the discriminant exponents at the finitely many allowed ramified primes, so absolute discriminants are bounded. Each possible halving field $L$ is Galois, and there are only finitely many homomorphisms $\mathrm{Gal}(L/K)\to E[2]$. The injection constructed above therefore has finite image. Consequently $E(K)/2E(K)$ is finite. No elliptic-curve finiteness or descent theorem was used in this argument.

For $K=\mathbb{Q}$, write $s=\#S$. Each coordinate of $c_P$ in a basis of $E[2]\cong (\mathbb{Z}/2\mathbb{Z}{)}^2$ is a quadratic Galois character unramified outside $S$. Its quadratic extension has a signed square-free integer representative $d=\pm {\prod }_{p\in S}{p}^{e_p}$, $e_p\in \{0,1\}$: an odd valuation outside $S$ would ramify there. There are at most $2^{s+1}$ choices, including the trivial character. Hence the pair of characters gives at most $2^{2s+2}$ cocycles. Each prime in $S$ is at most $2m$, because the three root differences have absolute values at most $2m$ and $2\le 2m$. Among the integers up to $2m$ there are at most $m$ primes: two, together with at most $m-1$ odd candidates. The rational halving quotient bound from root size is therefore

The elliptic-curve discriminant of $y^2=x^3-12x^2+20x$ is $16\cdot 20^2\cdot (144-80)=409600=2^{14}{5}^2$. Thus three and eleven are primes of good reduction. Counting the reduced points gives four points over ${\mathbb{F}}_3$ and sixteen over ${\mathbb{F}}_{11}$. For example, the numbers of affine points above successive $x=0,1,2$ modulo three are $1,1,1$. Modulo eleven, for $x=0,\dots ,10$, they are $1,2,1,2,0,0,2,2,2,2,1$; add the point at infinity in each case.

The reduction of torsion points on an elliptic curve is injective on torsion prime to the residue characteristic. The three-primary rational torsion injects into the group of order sixteen at eleven, so is trivial; likewise the eleven-primary torsion injects into the group of order four at three. Every other primary component injects at both primes. Therefore the rational torsion subgroup has order dividing four. All four rational 2-torsion points are visible, so

The rational point $P=(1,3)$ lies on the curve. The tangent slope in the elliptic-curve addition formula is $(3-24+20)/6=-1/6$, giving $2P=(361/36,-323/216)$. The integral substitution $X=x-4$ changes the equation to $y^2=X^3-28X-48$; the doubled point has $X=217/36$. The Nagell–Lutz theorem says that a rational torsion point on this integral short equation has integral coordinates, so $2P$, and hence $P$, is nontorsion. An infinite-order point is $(1,3)$.

We prove the rank bound by two-isogeny descent. For $a=-12,b=20$, the two-isogeny formula gives the partnerand maps $\varphi :E\to E^{\prime }$, $\psi :E^{\prime }\to E$ with $\psi \varphi =[2]$. The two-torsion square-class homomorphism $\alpha :E(\mathbb{Q})\to {\mathbb{Q}}^{\ast }/({\mathbb{Q}}^{\ast }{)}^2$ is $\alpha (x,y)=[x]$ away from $O,(0,0)$, with values $1$ and $[20]=[5]$ at those exceptional points. Its kernel is $\psi E^{\prime }(\mathbb{Q})$. The corresponding map ${\alpha }^{\prime }$ on $E^{\prime }$ has kernel $\varphi E(\mathbb{Q})$.

The prime-support bound in two-isogeny descent can be checked directly here. For a prime $\ell \nmid 20$, if $v_{\ell }(x)>0$ then $x^2-12x+20$ is a unit, so $2v_{\ell }(y)=v_{\ell }(x)$ is even; if $v_{\ell }(x)<0$, the $x^3$ term has strictly least valuation and $2v_{\ell }(y)=3v_{\ell }(x)$ is even. Thus the square class of $x$ is supported only on two and five. Also $x(x-2)(x-10)\ge 0$ forces $x\in [0,2]\cup [10,\infty )$, so nonzero $x$ is positive. The possible classes are $1,2,5,10$, and the four torsion points provide all of them:Consequently $\#\alpha (E(\mathbb{Q}))=4$.

The same valuation argument on $E^{\prime }$ gives possible signed classes $1,-1,2,-2$, since its coefficient $b^{\prime }=64$ has only the prime two. The identity gives class $1$, and $(-4,8)\in E^{\prime }(\mathbb{Q})$ gives class $-1$. For $d=\pm 2$, the two-isogeny descent quartic iswith integral coprime $U,V$ after scaling a rational solution. If $U$ is odd, its right side is $2$ or $10$ modulo sixteen for $d=2$, and $14$ or $6$ for $d=-2$, according to the parity of $V$. None is a square. If $U=2u$ is even, $V$ is odd and the right side is $32(\pm u^4+3u^2{V}^2\pm V^4)$. The bracket is odd for either parity of $u$, so its 2-adic valuation is five, again impossible for a square. The signed divisor-two obstruction for an isogeny covering excludes both classes. Hence ${\alpha }^{\prime }(E^{\prime }(\mathbb{Q}))=\{1,-1\}$.

For completeness, the index correction in the two-isogeny index formula over a number field is one: $\ker \psi =\{O,(0,0)\}$ and $\varphi ((2,0))=(0,0)$, so the whole kernel lies in $\varphi E(\mathbb{Q})$. ThusThe Mordell-Weil theorem and the four rational 2-torsion points identify this index as $2^{r+2}$. Therefore $2^{r+2}=8$ andThis is the rank-one elliptic curve with roots zero two and ten. We have exhibited a point of infinite order but have not needed to prove that it generates the free part.