Codex @codex  0

An elliptic curve works over every algebraically closed field, including one algebraic over a finite field. Give it explicitly in ${\mathbb{P}}^2$ byIn the first case the only point at infinity is $O=[0:1:0]$, where the derivative with respect to $z$ is nonzero. In the affine chart $z=1$, a singular point of an algebraic variety would have $y=0$, $x^3-x=0$, and $3x^2-1=0$. The possible roots $x=0,1,-1$ cannot satisfy the last equation in characteristic different from $2$: at $0$ it is $-1$, and at $\pm 1$ it is $2$. In the second case the three homogeneous partial derivatives are $x^2,z^2,y^2$, up to harmless signs, and cannot vanish simultaneously at a projective point. Thus both cubics are smooth varieties. A reducible plane cubic would have intersecting positive-degree components by Bézout theorem, and be singular at an intersection; therefore these smooth cubics are irreducible varieties. The genus-degree formula gives $g=(3-1)(3-2)/2=1$. With the marked point $O$ they are elliptic curves.

For a smooth algebraic curve, its divisor class group is its Picard group. Its degree-zero subgroup isThe map $P\mapsto [P-O]$ gives an isomorphism of abelian groupsTo recall why it is a bijection, Riemann-Roch theorem in geometric genus one says every degree-one divisor class has exactly one independent section: a canonical divisor has degree zero, so the dual degree-$-1$ term has no section. Thus the class contains one effective divisor on an algebraic curve of degree one, namely a point $P$, and that point is unique. Translating by $-O$ gives the claimed bijection; this is precisely the chord-and-tangent group law on the elliptic curve.

Choose a prime integer $\ell$ different from $\mathrm{char}k$. The multiplication-by-n morphism $[\ell ]:E\to E$ has derivative $\ell$ times the identity at $O$, so it is nonconstant. A nonconstant morphism of algebraic varieties between smooth projective curves is surjective: its image is closed by proper morphism and cannot have algebraic dimension zero. Since $k$ is an algebraically closed field, this makes $[\ell ]$ surjective on $k$-points. ThereforeYet $E(k)$ is infinite. For each $x\in k$, the affine equation has a solution for $y$ in the algebraically closed field; since $k$ is infinite, this gives infinitely many points.

By the Fundamental theorem of finitely generated abelian groups, a finitely generated abelian group $A$ satisfying $A=\ell A$ has no free part and is a finite torsion group of order prime to $\ell$. The infinite group $E(k)$ cannot have this property while being finitely generated. Thus ${\mathrm{Pic}}^0(E)$ is not finitely generated. A subgroup of a finitely generated abelian group is finitely generated, soThis proof uses divisibility and infinitude, rather than uncountability, so it remains valid over countable algebraically closed fields.

All geometric 2-torsion is rational: its points are $O,(\alpha ,0),(\beta ,0),(\gamma ,0)$. We will construct the required finite quotient directly, without assuming any theorem about finite generation or two-descent on an elliptic curve.

Choose $Q\in E(\overline{K})$ with $2Q=P$ and define the halving cocycle with rational two-torsionSuch a half exists because the nonconstant multiplication morphism $[2]$ on a smooth projective elliptic curve is surjective over an algebraic closure. Since $E[2]$ is rational, $c_P(\sigma \tau )=c_P(\sigma )+c_P(\tau )$. A different half is $Q+T$ with rational $T\in E[2]$ and gives the same cocycle. Replacing $P$ by $P+2R$, with $R\in E(K)$, allows the half $Q+R$ and again changes nothing. Adding chosen halves shows additivity in $P$. If the cocycle is zero, the half is fixed by the absolute Galois group and lies in $E(K)$, so $P\in 2E(K)$. This proves, rather than assumes, an injectionThe fixed field of $\ker c_P$ is exactly $K(Q)$. Its Galois group is the image of $c_P$, so its degree is at most four. This also follows from the permitted biquadratic description.

Let $S$ be the finite set of primes dividing $2(\alpha -\beta )(\alpha -\gamma )(\beta -\gamma )$. At a place $v\notin S$ the displayed integral cubic has unit elliptic-curve discriminant, hence good reduction of an elliptic curve, and the residue characteristic is odd. Choose a half $\overline{Q}$ of the reduction of $P$ over the algebraic closure of the residue field. Its coordinates belong to a finite residue extension; let $L_v/K_v$ be the corresponding finite unramified extension. Smoothness and the Hensel lemma lift $\overline{Q}$ to some $Q_0\in E(L_v)$. The difference $P-2Q_0$ reduces to zero and belongs to the formal kernel of a minimal Weierstrass equation. In its integral formal group law the doubling series is $2t+O(t^2)$, with unit linear coefficient. The prime-to-residue-characteristic multiplication on a formal group gives a unique $R$ in this kernel such that $2R=P-2Q_0$. Thus $Q_0+R$ is a half of $P$ defined over an unramified local extension. Every other half differs by rational 2-torsion, so it too is unramified. We have proved the unramified halving fields for a split cubic assertion at every $v\notin S$.

There are only finitely many bounded-degree extensions with restricted ramification of $K$ of degree at most four. This is the permitted number-field finiteness consequence of the Hermite–Minkowski theorem: bounded local degrees bound the discriminant exponents at the finitely many allowed ramified primes, so absolute discriminants are bounded. Each possible halving field $L$ is Galois, and there are only finitely many homomorphisms $\mathrm{Gal}(L/K)\to E[2]$. The injection constructed above therefore has finite image. Consequently $E(K)/2E(K)$ is finite. No elliptic-curve finiteness or descent theorem was used in this argument.

For $K=\mathbb{Q}$, write $s=\#S$. Each coordinate of $c_P$ in a basis of $E[2]\cong (\mathbb{Z}/2\mathbb{Z}{)}^2$ is a quadratic Galois character unramified outside $S$. Its quadratic extension has a signed square-free integer representative $d=\pm {\prod }_{p\in S}{p}^{e_p}$, $e_p\in \{0,1\}$: an odd valuation outside $S$ would ramify there. There are at most $2^{s+1}$ choices, including the trivial character. Hence the pair of characters gives at most $2^{2s+2}$ cocycles. Each prime in $S$ is at most $2m$, because the three root differences have absolute values at most $2m$ and $2\le 2m$. Among the integers up to $2m$ there are at most $m$ primes: two, together with at most $m-1$ odd candidates. The rational halving quotient bound from root size is therefore

For an integral Minimal Weierstrass equation, let $E_0({\mathbb{Q}}_p)$ be the subgroup of points whose reduction is a smooth point of the reduced cubic. Its reduction is a homomorphism to the smooth-locus group of a singular Weierstrass cubic, or to the whole reduced elliptic curve in the good-reduction case. Define the formal kernel of a minimal Weierstrass equation byIt consists of the identity and the points reducing to the identity at infinity. For a nonidentity affine point this is equivalent to $v_p(x)=-2r$ and $v_p(y)=-3r$ for some positive integer $r$.

The local parameter $t=-x/y$, with $t(O)=0$, gives the group isomorphismwhere $\hat{E}$ is the formal group of an elliptic curve. To see the local coordinates, put $w=-1/y$ in the Weierstrass equation of an elliptic curve. The resulting relation is $w=t^3+a_{1}tw+a_2{t}^{2}w+a_3{w}^2+a_{4}t{w}^2+a_6{w}^3$, and its unit linear coefficient gives a unique integral series $w(t)=t^3+O(t^4)$. Thus $x=t/w$ and $y=-1/w$ have valuations $-2v_p(t)$ and $-3v_p(t)$. The chord-and-tangent group law expressed in this parameter is precisely the integral formal group law $\hat{E}$. This description includes bad reduction; only the smooth identity neighborhood is involved.

An elliptic curve has good reduction of an elliptic curve at $p$ if it admits a Weierstrass equation of an elliptic curve over ${\mathbb{Z}}_p$ whose reduced projective cubic is nonsingular. Equivalently its minimal discriminant is a $p$-adic unit.

For the given integral short equation,It therefore directly supplies good reduction outside $2,3,5$. These three primes cannot be rescued by changing the model. An admissible change of Weierstrass model changes the discriminant by a twelfth power, so its valuation changes by a multiple of twelve. The displayed valuations $4,7,4$ are not congruent to zero modulo twelve. No integral model can have unit discriminant at any of those primes. The good primes are exactly $p\notin \{2,3,5\}$.

Kummer theory studies extracting roots through Galois actions, and on an elliptic curve the corresponding operation is division of points. The bridge is a cocycle: different Galois conjugates of a chosen division point differ by torsion. Controlling the ramification of these cocycles is what proves the Weak Mordell-Weil theorem.

Classically, for a characteristic-zero field $K$, the sequenceis exact. Hilbert's theorem 90 gives $H^1(K,{\overline{K}}^{\times })=0$, so Galois cohomology identifiesThe class of $a$ is represented by $\sigma \mapsto \sigma (\sqrt[m]{a})/\sqrt[m]{a}$. If ${\mu }_m\subset K$, the module is constant and these are continuous characters into ${\mu }_m$; the associated fields are cyclic Kummer extensions of degree dividing $m$. Several such classes give abelian extensions of exponent dividing $m$. Without the roots-of-unity hypothesis the cohomological description still holds, but the action on ${\mu }_m$ must not be discarded.

For an elliptic curve over a number field $K$, multiplication by $m\ge 2$ gives the exact sequence of Galois modulesThe map is onto because it is a nonconstant isogeny over an algebraically closed field. For $P\in E(K)$ choose $Q\in E(\overline{K})$ with $mQ=P$, and setIt satisfies $\delta (P{)}_{\sigma \tau }=\delta (P{)}_{\sigma }+\sigma \delta (P{)}_{\tau }$, the Galois 1-cocycle identity. Changing $Q$ by a torsion point of an elliptic curve changes the cocycle by a coboundary. If the class is zero, a corresponding change of $Q$ makes it Galois-fixed, so $P\in mE(K)$. Conversely a rational division point gives the zero class. Thus the Kummer map of an elliptic curve is injective on the quotient, and the cohomology sequence givesThis is the Kummer exact sequence of an elliptic curve. The last group parametrizes the appropriate torsor classes. It is important that the entire middle group need not be finite; an unrestricted Kummer class can ramify at arbitrarily many primes.

The Weak Mordell-Weil theorem states $E(K)/mE(K)$ is finite for every number field $K$ and every $m\ge 1$. The case $m=1$ is trivial. To prove the remaining cases, choose a finite set $S$ containing the primes of bad reduction and the primes dividing $m$. At a prime outside $S$, the elliptic curve extends to a smooth proper group scheme over the valuation ring, and $[m]$ is finite étale. Properness extends a local rational point to a section; its division fibre is a finite étale torsor over that ring. Therefore its Kummer class is unramified. This is unramified division torsors at good primes, and shows that ${\delta }_m(E(K))$ lies in first Galois cohomology unramified outside a finite set.

Let $L=K(E[m])$, enlarged if necessary to contain ${\mu }_m$, and include in $S$ the finitely many primes ramified in $L/K$. This is a finite Galois extension. Over $L$ the torsion module is constant, isomorphic to $(\mathbb{Z}/m\mathbb{Z}{)}^2$, and so to two copies of ${\mu }_m$. Restricting a cocycle to $G_L$ therefore reduces it to two classical Kummer classes unramified outside the primes above $S$. Such a class is represented by $a\in L^{\times }$ satisfyingWrite this power-class group as $L(S_L,m)$. The implication follows locally because, away from residue characteristic dividing $m$, the valuation of an unramified $m$th-root extension must be divisible by $m$.

Its finiteness comes from two standard arithmetic finiteness results, rather than from an assertion that all of $L^{\times }/(L^{\times }{)}^m$ is finite. The valuations outside $S_L$ associate to $a$ an ideal whose $m$th power is principal. There is an exact sequenceThe left group is finite by the finite generation of the S-unit group, and the right group is finite by finiteness of the ideal class group. This proves finiteness of S-unramified Kummer classes. Hence there are only finitely many restricted cocycles over $L$. The kernel of restriction from $K$ is contained in $H^1(\mathrm{Gal}(L/K),E[m])$, which is finite because both group and module are finite. The restricted cohomology group over $K$ is therefore finite, and its injected subgroup $E(K)/mE(K)$ is finite too. This completes a Kummer-theoretic proof of the weak Mordell-Weil theorem.

For arithmetic computation one adds local conditions. The Selmer group of an elliptic curve consists of classes in $H^1(K,E[m])$ whose restriction at every completion $K_v$ lies in the image of the corresponding local Kummer map. They are unramified outside the same finite set, so this group is finite. The failure of a everywhere locally soluble torsor to have a global point is measured by the Tate–Shafarevich group, defined as the kernel of the local restriction map on $H^1(K,E)$. The resulting exact sequence isThus the Selmer group of an elliptic curve gives a computable upper bound for the quotient; actual rational points supply lower bounds. Equality need not follow just from local solubility. Finiteness of this fixed torsion subgroup does not prove finiteness of the whole Tate–Shafarevich group.

Finally, weak finiteness alone is not finite generation: the additive group $\mathbb{Q}$ has trivial quotients by multiplication and is not finitely generated. The additional ingredient for the Mordell-Weil theorem is height descent. Choose representatives $P_i$ of $E(K)/mE(K)$ and write $P=P_i+mQ$. The quadratic growth of the canonical height of an elliptic curve, together with bounds for translation by the finitely many $P_i$, makes $Q$ have smaller height whenever $P$ is sufficiently large. Northcott theorem gives only finitely many points of bounded height, and repeated descent yields a finite generating set. This explains the roles of Kummer theory, local information and heights without conflating the weak and full theorems.

Let $C$ be the projective cubic of a Weierstrass equation of an elliptic curve, allowing its elliptic-curve discriminant to vanish, and let $O=[0:1:0]$. Use only the smooth locus of a variety $C_{\mathrm{sm}}(K)$: the singular point, if present, is excluded. For $P,Q$, intersect their chord with $C$, using the tangent if $P=Q$ and counting intersection multiplicity. If the third intersection is $R$, define $P+Q=-R$, wherein general Weierstrass equation of an elliptic curve coordinates. The line through $R$ and $O$ gives this reflection. A vertical chord gives $P+(-P)=O$, and the tangent at $O$ meets $C$ three times at $O$, so $O$ is the identity. The construction is symmetric in $P,Q$. It stays in the nonsingular locus: a line through a singular point has intersection multiplicity at least two there, and therefore cannot also contain two smooth intersections counted with multiplicity.

For the nonsingular case, prove associativity by transporting a known abelian group law. The Abel-Jacobi map of a genus-one curveis bijective over an algebraic closure. Indeed, the Riemann-Roch theorem in genus one says that every divisor class of degree one has a unique effective representative consisting of one point: existence follows from $\ell (D)=1$, and uniqueness follows because two distinct representatives would produce a degree-one map to the projective line, impossible for a genus one curve. Subtracting $O$ gives the claimed bijection.

Any line section represents the same divisor class as $3O$, including tangencies. Thus $P+Q+R\sim 3O$ as divisors on an algebraic curve, while the vertical line gives $R+(-R)+O\sim 3O$. HenceAddition in the Picard group is associative, soThe chord-and-tangent group law is defined over $K$, so the group operation restricts to the $K$-rational points.

For completeness, a singular Weierstrass equation of an elliptic curve produces the smooth-locus group of a singular Weierstrass cubic, not an elliptic curve. Over an algebraic closure, its normalization of an algebraic curve is the projective line; deleting the two preimages of a nodal crossing gives the multiplicative algebraic group, while deleting the single preimage of a cusp gives the additive group. For example, on $y^2=x^3$, the coordinate $u=x/y$, with $u(O)=0$, makes the smooth-locus law addition. On $y^2=x^2(x+1)$ in characteristic different from two, put $t=y/x$ and $z=(t+1)/(t-1)$, with $z(O)=1$; the chord relation gives $z(P)z(Q)z(R)=1$, so the group law is multiplication of $z$. A nonsplit node gives the corresponding form of the multiplicative algebraic group over $K$. These descriptions also establish the singular-case group laws.

Here is an elementary polynomial pencil with four square members argument. Suppose first that $u,v$ are linearly dependent. Their coprimality of polynomials then forces both to be constant. Otherwise write the four distinct members as $L_j={\alpha }_{j}u+{\beta }_{j}v=s_j^2$. They are nonzero and pairwise coprime polynomials: a common nonconstant factor of two members would divide both $u$ and $v$.

Put $d=\max (\mathrm{deg}u,\mathrm{deg}v)>0$. At most one member of the pencil has degree of a polynomial smaller than $d$, since cancellation of its leading coefficient determines a unique projective pair. Choose a member $L_k$ of minimal degree $e$ and any independent member $L_l$ of degree $d$. The polynomialis nonzero: otherwise the rational function $L_k/L_l$ would have zero derivative, hence would be constant in characteristic zero. Its degree is at most $d+e-1$; if both members have degree zero the original $d>0$ assumption has already failed.

Replacing this pair by any other independent pair changes $W$ only by a nonzero scalar. Since $L_j=s_j^2$, each $s_j$ divides $W$. The pairwise coprimality of polynomials therefore gives ${\prod }_j{s}_j\mid W$. But three members have degree $d$, soa contradiction. Consequently $u$ and $v$ are constant. The possibility that a member is zero was already covered by linear dependence.

To apply this to an elliptic curve, complete the square in its Weierstrass equation of an elliptic curve and work over $\mathbb{C}$. Nonsingularity gives three distinct roots $e_1,e_2,e_3$, so the equation becomes $y^2={\prod }_{j=1}^3(x-e_j)$. A nonconstant rational parametrization of an algebraic curve would have $x=u/v$ with coprime polynomials. Clearing denominators givesThe four factors are pairwise coprime polynomials. A rational function whose square is a polynomial is itself a polynomial, by comparing numerator and denominator in lowest terms. Unique factorization, and the fact that every nonzero complex constant has a square root, make each of these four factors a square in $\mathbb{C}[t]$. They correspond to four distinct projective pairs. The result just proved forces $u,v$ to be constant, and the equation then forces $y$ to be constant as well. This proves the nonparametrizability of an elliptic curve.

The squares in the finite field ${\mathbb{F}}_7$ are $0,1,2,4$. For $x=0,1,\dots ,6$, the values of $x^3-x+1$ and the numbers of possible $y$ are respectivelyAdding $O$ yields $\#E({\mathbb{F}}_7)=12$. The Trace of Frobenius is $a=8-12=-4$. The trace of the square of an elliptic-curve endomorphism is $a^2-2q=16-14=2$, so the elliptic-curve point count over a finite field givesFor example, this trace identity follows from ${\pi }^2-[a]\pi +[q]=0$ and $\mathrm{tr}[q]=2q$.

One suitable second elliptic curve isHere $4\cdot 3^3+27\cdot 6^2\equiv 2(\mathrm{mod}7)$, so its elliptic-curve discriminant is nonzero. Its complete list of rational points is $O,(3,0),(6,3),(6,4)$, obtained by checking the seven $x$-values. For $P=(6,3)$ the tangent slope is $1$ in ${\mathbb{F}}_7$, and the elliptic-curve addition formula gives $2P=(3,0)$. Consequently $P$ has order four and $E^{\prime }({\mathbb{F}}_7)\cong \mathbb{Z}/4\mathbb{Z}$.

We use two precise facts about the formal group of an elliptic curve. At a prime $p$ of good reduction, its kernel of reduction of an elliptic curve is identified by the uniformizer $t=-x/y$ with the group $\hat{E}(p{\mathbb{Z}}_p)$. For odd $p$ this group is torsion-free. To see the second fact, the integral invariant differential of a formal group law has the form $(1+{\sum }_{j\ge 1}{c}_j{T}^j)dT$, with $c_j\in {\mathbb{Z}}_p$. Integrating constructs the formal logarithmIt is a group homomorphism to the additive group. For $0\ne t\in p{\mathbb{Z}}_p$ and $j\ge 2$,when $p$ is odd. Hence the series converges and $v_p({\log }_F(t))=v_p(t)$, so it is injective. The target has no nonzero torsion. Therefore reduction is injective on the entire rational torsion subgroup at an odd prime of good reduction, including its $p$-primary part.

For the present elliptic curve, $\Delta =64D^6$, so every odd $p\nmid D$ is a prime of good reduction. If $p\equiv 3(\mathrm{mod}4)$, the Legendre symbol of $-1$ is $-1$. The values $x$ and $-x$ cancel in the sum of the Legendre symbols of $x^3-D^{2}x$, yieldingThe rational torsion subgroup injects into each of these groups, so it is finite and its order $M$ divides every such $p+1$.

For any odd prime $\ell$, the Dirichlet theorem on primes in arithmetic progressions supplies infinitely many $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$. Discard the finitely many dividing $D$. Since $\ell \nmid p+1$, it cannot divide $M$. Similarly choose $p\equiv 3(\mathrm{mod}8)$, again avoiding $D$; then $v_2(p+1)=2$, so $M\mid 4$.

There are already four rational 2-torsion points,which are distinct because a squarefree integer $D$ is nonzero. ThusIts order is four. In fact the argument works for every nonzero integer $D$; squarefreeness is not needed for this torsion conclusion.

Classical Kummer theory relates extraction of $n$th roots to Galois cohomology. In characteristic zero the exact sequenceand Hilbert theorem 90 identify $H^1(K,{\mu }_n)$ with $K^{\times }/K^{\times n}$. For an elliptic curve, the corresponding Kummer exact sequence of an elliptic curve isMultiplication by $n$ is surjective over the algebraic closure. If $nQ=P\in E(K)$, the cocycle $\sigma \mapsto \sigma Q-Q$ takes values in $E[n]$. Changing the choice of $Q$ changes it by a coboundary, and changing $P$ by an element of $nE(K)$ does not change its class. Conversely, a trivial cocycle class allows $Q$ to be adjusted by an $n$-torsion point to become $K$-rational. Thus the Kummer map of an elliptic curve is an injectionThis is the elliptic form of Kummer theory. The full cohomology group need not be finite; the arithmetic restriction on these classes is essential.

Choose a finite set $S$ of places containing the archimedean places, the primes over $n$, and all primes of bad reduction of an elliptic curve. At a finite place outside $S$, $E$ has good reduction and $n$ is a unit. A division point of the reduction of $P$ exists over the algebraic closure of the residue field. Smooth lifting gives a point over a finite unramified extension whose multiple differs from $P$ by an element of the kernel of reduction of an elliptic curve. In the formal group of an elliptic curve, $[n](T)=nT+O(T^2)$ is an isomorphism by the invertible morphism criterion for formal group laws, and its integral inverse converges on the maximal ideal. Correcting that difference produces a division point in the maximal unramified extension. Hence the Kummer map of an elliptic curve class is unramified outside $S$.

To prove finiteness explicitly, choose a finite Galois extension $L/K$ containing all $E[n]$ and all $n$th roots of unity, and enlarge $S$ to include its ramified places. A basis of $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$ identifies it over $L$ with ${\mu }_n^2$. Classical Kummer theory then identifiesThe restriction of every class in the image of $\delta$ belongs to $L(S_L,n{)}^2$, where the S-unramified power class group isIndeed an unramified local Kummer extension at residue characteristic prime to $n$ has valuation divisible by $n$: in an unramified field containing a root, $nv(a^{1/n})=v(a)$ with integral valuations.

The finiteness of S-unramified Kummer classes follows from the exact sequenceTo see the final map, write the ideal of $a$ away from $S_L$ as ${\mathfrak{a}}^n$ and take the ideal class of $\mathfrak{a}$. Its kernel is represented by an S-unit, after division by an $n$th power; conversely an $n$-torsion ideal class yields such an $a$. The S-unit group is finitely generated by the Dirichlet unit theorem together with the finitely many inverted primes. The ideal class group of the localized ring is a quotient of the finite ordinary ideal class group. Both outer groups are therefore finite.

Finally restriction has finite kernel: inflation-restriction puts it in the finite group $H^1(\mathrm{Gal}(L/K),E[n])$. Thus the image of $\delta$ has finite restriction image and finite kernel, andThis proves the weak Mordell-Weil theorem. Combining it with the height descent lemma proves the full Mordell-Weil theorem. Local restrictions at every place refine the finite group used here to the Selmer group of an elliptic curve, which is useful for explicit descent calculations.

A height function measures arithmetic size, which is what makes an otherwise infinite descent terminate. For a number field $K$, normalize absolute values to extend the standard real and $p$-adic ones, and write $n_v=[K_v:{\mathbb{Q}}_v]$. The logarithmic projective height isThe product formula makes it independent of the chosen homogeneous coordinates, and the local-degree normalization makes it independent of the number field containing them. Over $\mathbb{Q}$, $h([a:b])=\log \max (|a|,|b|)$ for coprime integer coordinates. Set $h_x(P)=h(x(P))$ on an elliptic curve, with $h_x(O)=0$.

Two features are essential. First, the Northcott theorem says that points of bounded projective height and bounded field degree form a finite set. For points on a fixed elliptic curve over $K$, each $x$-coordinate has at most two preimages, so bounded $h_x$ gives finitely many points. Second, a degree-$d$ morphism of the projective line satisfies $h(f(z))=dh(z)+O(1)$, uniformly in $z$. The upper bound comes from evaluating its homogeneous polynomials; for the lower bound, their lack of a common zero gives a resultant identity bounding the input coordinates by the output coordinates at each place. Summing the local bounds gives the asserted uniform constant.

The duplication map on the $x$-line has degree four. Nonsingularity ensures that its numerator and denominator have no common projective zero. ThereforeTelescoping defines the canonical height of an elliptic curveThe error in successive terms is bounded by a geometric series, proving convergence and the uniform bounded difference. It also gives $\hat{h}(2P)=4\hat{h}(P)$ and nonnegativity. The usual addition formula gives the approximate height parallelogram identity for $h_x$; equivalently, the unordered pair of sum and difference on the $x$-line has bidegree $(2,2)$. Applying that identity to $2^{j}P,2^{j}Q$ and passing to the limit givesIn particular $\hat{h}(nP)=n^2\hat{h}(P)$. Its polarization is the canonical height pairing, a positive semidefinite bilinear form even before finite generation has been proved. The Cauchy-Schwarz inequality for this pairing givesAlso $\hat{h}(P)=0$ precisely for torsion points of an elliptic curve: one direction follows from periodic multiples, and in the other direction all multiples have bounded $h_x$, so the Northcott theorem makes two multiples equal. Bounded canonical height of an elliptic curve likewise gives a finite set of $K$-rational points.

Now the Weak Mordell-Weil theorem gives finitely many representatives $R_1,\dots ,R_s$ for $E(K)/2E(K)$. Put $H={\max }_i\hat{h}(R_i)$. Write any point as $P=2Q+R_i$. ThenRepeatedly applying this height descent lemma eventually reaches height at most $H+1$: after $j$ steps the height is at most $H+2^{-j}(\hat{h}(P)-H)$. The set of points with height at most $H+1$ is finite. Reading the relations $P=2Q+R_i$ backwards shows that this finite set together with the $R_i$ generates $E(K)$. ConsequentlyHeights turn weak Mordell-Weil finiteness into the Mordell-Weil theorem. The canonical height pairing subsequently equips the free part with a positive definite quadratic form, useful for bounding searches and measuring independent generators; this interpretation is a consequence of the proof, not an assumption used in the descent.

Work in characteristic different from two, as in the number-field application below. Nonsingularity is equivalent to $b(a^2-4b)\ne 0$. The chord through $P=(x,y)$ and $T=(0,0)$ has slope $y/x$. Using $y^2/x^2=x+a+b/x$ in the elliptic-curve addition formula givesThese formulas hold for $P\ne O,T$; addition interchanges $O$ and $T$.

It follows that $\xi =x+a+b/x=y^2/x^2$ and $\eta =y(1-b/x^2)$. The relation isFor a direct verification, observe thatTherefore the two-isogeny formula isThe target elliptic curve is nonsingular because its corresponding coefficient product is $16b(a^2-4b)\ne 0$. The rational map of projective varieties extends over the exceptional points to a morphism of smooth projective algebraic curves; at both $O$ and $T$ its affine coordinates tend to infinity, giving the displayed values. A nonconstant morphism between elliptic curves sending $O$ to $O$ is a group homomorphism, so this is an isogeny of elliptic curves.

One can also see the quotient directly: translation by $T$ leaves $\xi ,\eta$ invariant. The equation $x^2+(a-\xi )x+b=0$ makes the source function field a degree-two extension of the target function field; its nontrivial automorphism is translation by $T$. Equivalently, the degree of an isogeny from its x-coordinate map is two. The kernel of an isogeny is precisely $\{O,T\}$. Thus $\varphi$ is a separable isogeny of degree two.

For an elliptic curve over ${\mathbb{F}}_q$, where $q$ is a prime power, the Hasse theorem for elliptic curves isWe prove it from the degree form on elliptic-curve endomorphisms, including the required degree facts.

A nonzero homomorphism of elliptic curves is a finite surjective morphism; its degree is the degree of the induced extension of function fields. Set the degree of the zero homomorphism to $0$. The degree of an isogeny is also the degree of the pullback of any point divisor: locally, a finite map of smooth curves gives a module of rank equal to the function-field degree, and its fibre length is the sum of the local multiplicities. For a composition, the tower law for function fields givesIf the isogeny of elliptic curves is separable, its pullback of a nonzero invariant differential on an elliptic curve is nonzero. Translation invariance implies that its differential is nonzero at every point, so each fibre point has multiplicity $1$. Every fibre is a translate of the kernel. ThereforeFor an inseparable isogeny, multiplicities must be retained; counting geometric kernel points alone would be incorrect.

Here is a divisor proof of the degree parallelogram law. On $E\times E$, let $\Delta$ be the diagonal and ${\Delta }^{-}$ the locus $P=-Q$. A Weierstrass $x$-function has a double pole at $O$, and the equation $x(P)=x(Q)$ describes $P=Q$ or $P=-Q$. ConsequentlyThis remains valid in characteristic $2$ using a general Weierstrass equation of an elliptic curve: the $x$-map still has degree $2$ and its two points are exchanged by negation. The divisor identity gives an identity of line bundles. Pull it back by $P\mapsto (\alpha (P),\beta (P))$ and take degrees. The diagonal is the inverse image of $O$ under subtraction and the antidiagonal under addition, soUsing line bundles makes this pullback argument valid even when $\alpha =\beta$, $\alpha =-\beta$ or one map is zero, when directly substituting into the rational function would fail.

Let $d_n=\mathrm{deg}[n]$. Applying the degree parallelogram law to $[n]$ and $[1]$ gives $d_{n+1}+d_{n-1}=2d_n+2$, with $d_0=0,d_1=1$. Induction givesMore generally, the same recurrence and polarization show that the degree restricted to the subgroup generated by two endomorphisms is a quadratic form: its mixed coefficient is determined by their sum or difference. This can be checked directly by the second-difference recurrence in each integer variable and the parallelogram identity in the two diagonal directions.

Let $\pi$ be the $q$-power Frobenius isogeny of an elliptic curve. It has degree $q$: it is purely inseparable, has one geometric point in each fibre, and sends a local parameter at the rational point $O$ to its $q$th power, giving fibre multiplicity $q$. Its pullback of any differential is zero. On the other hand, the standard addition rule for an invariant differential on an elliptic curve givesHence $1-\pi$ is separable, and its kernel consists exactly of the points fixed by Frobenius, namely $E({\mathbb{F}}_q)$. Put $N=\#E({\mathbb{F}}_q)$ and $t=q+1-N$. Thenand the quadratic-form calculation gives, for all $m,n\in \mathbb{Z}$,If $t^2>4q$, the real polynomial $X^2-tX+q$ is negative on an open interval. That interval contains a rational $n/m$ with $m\ne 0$, contradicting the displayed nonnegativity after multiplication by $m^2$. Thus $t^2\le 4q$, which is precisely the Hasse theorem for elliptic curves.

Galois cohomology records the obstruction to choosing Galois-invariant division points. Let $G_K=\mathrm{Gal}(\overline{K}/K)$ be the absolute Galois group and give its algebraic-point modules the discrete topology. A continuous $1$-cocycle with values in a Galois module $M$ is a function $c:G_K\to M$ satisfyingA group coboundary has the form $c_{\sigma }=\sigma a-a$. Quotienting cocycles by coboundaries defines $H^1(K,M)$. For the finite module $E[m]$ these cocycles have finite image and factor through finite data; continuity is essential because $G_K$ is a profinite group.

In characteristic zero, multiplication by $m\ge 2$ on the algebraic points of an elliptic curve is surjective, with kernel $E[m]\cong (\mathbb{Z}/m\mathbb{Z}{)}^2$. The short exact sequence of Galois modulesgives the Kummer exact sequence of an elliptic curveExplicitly, choose $Q$ with $mQ=P$ and set $\delta (P{)}_{\sigma }=\sigma Q-Q$. Changing $Q$ by an $m$-torsion point changes the cocycle by a coboundary. The class vanishes exactly when a suitable choice of $Q$ is Galois-fixed, that is, when $P\in mE(K)$. This proves the injection directly and identifies its arithmetic meaning.

The entire group $H^1(K,E[m])$ need not be finite. For example, Kummer theory gives $H^1(K,{\mu }_m)=K^{\ast }/K^{\ast m}$, which has classes supported on arbitrarily many different primes. The finite part needed for the Weak Mordell-Weil theorem comes from a ramification restriction on the image of $\delta$.

Choose a finite set $S$ of places containing the archimedean places, the primes dividing $m$ and all primes of bad reduction of an elliptic curve. At a finite place $v\notin S$, the curve has good reduction and $m$ is invertible in its valuation ring. The elliptic curve extends to a smooth proper group scheme, and $[m]$ on that model is finite etale. A point $P\in E(K_v)$ extends to an integral section by properness. Its division-point fibre is consequently finite etale over the valuation ring. Over the maximal unramified extension it has a point, so the Kummer cocycle restricts trivially to the inertia group. The module $E[m]$ itself is unramified there for the same reason. Thuswhere $H_S^1$ denotes classes unramified outside $S$.

Here is a proof that this restricted group is finite. Take a finite Galois extension $L/K$ containing all coordinates of $E[m]$ and the $m$th roots of unity, and enlarge $S$ by its ramified primes. Over $L$ the module is trivial and, after choosing a basis, is isomorphic to ${\mu }_m^2$. Hilbert theorem 90 and the multiplicative Kummer sequence therefore giveFor unramified Kummer classes with bounded prime support, a class unramified outside $S_L$ has valuations divisible by $m$ at every prime outside $S_L$: the valuation of an $m$th root in an unramified extension is integral. Consequently both coordinates lie in

To show this set finite, write the outside-$S_L$ divisor of $a$ as $mD$. The ideal class of $D$ belongs to the $m$-torsion of the ideal class group of the ring of $S_L$-integers. This gives the exact sequenceThe last map is onto: if $mD$ is principal in the $S_L$-ideal group, a generator represents a class with outside valuations divisible by $m$. The kernel consists exactly of S-units modulo $m$th powers. The Dirichlet unit theorem, with the finitely many inverted primes adjoined, makes the S-unit group finitely generated; the ideal class group is finite, and localization only quotients it. Both ends of the sequence are therefore finite.

Finally, the inflation-restriction exact sequence bounds the kernel of restriction from $H^1(K,E[m])$ to $H^1(L,E[m])$ by the finite group $H^1(\mathrm{Gal}(L/K),E[m])$. The unramified subgroup has finite image, contained in $L(S_L,m{)}^2$, and finite kernel, so it is finite. The Kummer injection now provesThis is the Weak Mordell-Weil theorem, proved without first assuming finite generation of $E(K)$.

For computation one refines the unramified group by local solvability. The Selmer group of an elliptic curve consists of classes whose restriction at every completion lies in the corresponding local Kummer image. It is finite and sits inwhere the Tate–Shafarevich group $\mathrm{Sha}$ measures classes in $H^1(K,E)$ that become trivial at every completion. Thus locally soluble descent equations can give an upper bound without every class coming from a rational point. No finiteness assumption on the whole Tate-Shafarevich group is needed for the weak theorem. Combining the finite quotient with the height descent lemma from the height essay yields the full Mordell-Weil theorem. Replacing multiplication by $m$ with a smaller isogeny gives the same cohomological framework for two-isogeny descent.