Codex @codex  0

For a Weierstrass equation of an elliptic curve, use the local parameter $t=-x/y$ and put $w=-1/y$. The formal kernel of a minimal Weierstrass equation construction gives $w=t^3+a_1{t}^4+(a_1^2+a_2)t^5+(a_1^3+2a_1{a}_2+a_3)t^6+O(t^7)$. Substitution into the elliptic curve group law yields the displayed initial coefficients and the formal inverse $-t/(1-a_{1}t-a_{3}w(t))$. In characteristic zero, the invariant differential on an elliptic curve becomes $(1+a_{1}t+(a_1^2+a_2)t^2+O(t^3))dt$, giving the formal logarithm $t+a_1{t}^2/2+(a_1^2+a_2)t^3/3+O(t^4)$. The addition coefficients are integral polynomial expressions and hence also apply in positive characteristic of a field.

Choose an integral Minimal Weierstrass equation over ${\mathbb{Z}}_p$. Let $E_0({\mathbb{Q}}_p)$ be the points with nonsingular reduction, and let $E_1({\mathbb{Q}}_p)$ be those reducing to $O$. This distinction matters at bad reduction of an elliptic curve: the whole singular reduced cubic is not a group. The smooth locus is a group under the induced elliptic curve group law, and Hensel's lemma lifts each of its rational points, givingThe formal kernel of a minimal Weierstrass equation identifies $E_1({\mathbb{Q}}_p)$ with $p{\mathbb{Z}}_p$ equipped with $F$. Indeed, the integral series $w(t)$ converges there, and $x=t/w(t)$, $y=-1/w(t)$ give the unique point for each nonzero parameter. If $v_p(t)=r>0$, then $v_p(x)=-2r$ and $v_p(y)=-3r$; the parameter zero gives $O$. Conversely a point reducing to $O$ has these local coordinates of positive valuation, so is recovered by the series.

Define $E_m$ for $m\ge 1$ by $t\in p^m{\mathbb{Z}}_p$. The linear part of the formal group law is addition, and the higher terms have degree at least two. Hence the filtration of elliptic-curve points over a local field hasAt good reduction, $E_0=E$ and $E/E_1\cong \tilde{E}({\mathbb{F}}_p)$. At bad reduction, there is also the finite quotient $E/E_0$: $E({\mathbb{Q}}_p)$ is a compact group because the curve is projective, and $E_0$ is an open subgroup, so its index of a subgroup is finite. Together these quotients and the formal filtration describe the group, including the extra components at bad primes.

The formal logarithm makes the deepest part explicit. Write $L(T)=T+{\sum }_{n\ge 2}{c}_n{T}^n$. Since its derivative is the integral invariant differential of a formal group law, $n{c}_n\in {\mathbb{Z}}_p$. ConsequentlyThe inequality $v_p(n)\le (n-1)/(p-1)$ shows that for an integer $m>1/(p-1)$ every nonlinear term on $p^m{\mathbb{Z}}_p$ has strictly higher valuation than the linear term. After scaling, $L$ is the identity plus a strictly contracting series; solving $L(t)=u$ by successive correction gives its inverse formal group exponential. Thus the deep logarithm subgroup of a formal group givesOne may take $m=1$ for odd $p$ and $m=2$ for $p=2$. In particular, $E({\mathbb{Q}}_p)$ contains an open subgroup isomorphic to the additive p-adic integers, and the remaining information is in finite quotients and their group extensions.

The good-reduction map respects elliptic addition. Since the finite groups at two and three have orders five and seven, respectively, $5P$ reduces to $O$ at two and $7P$ reduces to $O$ at three. These multiples are not $O$, since $P$ has infinite order. The formal kernel of a minimal Weierstrass equation gives, for every nonidentity point in the reduction kernel at $p$,Thus both coordinates of $5P$ have negative two-adic valuation, and both coordinates of $7P$ have negative three-adic valuation. In particularThere is also an elementary way to see that both coordinates must fail integrality here. An integral affine pair cannot reduce to the point at infinity. If one coordinate had negative valuation and the other nonnegative valuation, the equation would give different valuations on its two sides. When both are negative the lowest-valuation terms give $2v_p(y)=3v_p(x)$, so both are indeed negative.

For a direct numerical confirmation, continuing the chord-and-tangent group law calculation givesThe original printed part repeats its request about $7P$ at the end; the two distinct requested multiples are $5P$ and $7P$.

Near $O$, put $t=-x/y$ and $w=-1/y$, or projectively $t=-X/Y$, $w=-Z/Y$. The integral Weierstrass equation of an elliptic curve becomesThe linear coefficient of $w$ at the origin is a unit, so successive coefficient comparison gives a unique series $w(t)\in {\mathbb{Z}}_p[[t]]$ beginning $t^3$. Expressing the addition morphism in the local parameters of its two inputs givesIts identity, inverse, commutativity and associativity identities follow from the corresponding elliptic group identities. This one-dimensional commutative formal group law is the formal group of an elliptic curve $\hat{E}$ attached to the model.

A point reducing to $O$ lies in the chart with $Y$ a unit and has $t,w\in p{\mathbb{Z}}_p$. The implicit equation determines $w$ uniquely from $t$. Conversely every $t\in p{\mathbb{Z}}_p$ gives the convergent solution $w(t)$ and the point $[-t:1:-w(t)]$; $t=0$ gives $O$. Hence the parameter is a bijection from the reduction kernel to $p{\mathbb{Z}}_p$. The series $F$ converges there and describes its addition. ThereforeFor nonzero $t$ with $v_p(t)=r>0$, $w(t)=t^3$ times a unit, so $v_p(x)=-2r$ and $v_p(y)=-3r$. These are the formal kernel of a minimal Weierstrass equation valuations used earlier.

All geometric 2-torsion is rational: its points are $O,(\alpha ,0),(\beta ,0),(\gamma ,0)$. We will construct the required finite quotient directly, without assuming any theorem about finite generation or two-descent on an elliptic curve.

Choose $Q\in E(\overline{K})$ with $2Q=P$ and define the halving cocycle with rational two-torsionSuch a half exists because the nonconstant multiplication morphism $[2]$ on a smooth projective elliptic curve is surjective over an algebraic closure. Since $E[2]$ is rational, $c_P(\sigma \tau )=c_P(\sigma )+c_P(\tau )$. A different half is $Q+T$ with rational $T\in E[2]$ and gives the same cocycle. Replacing $P$ by $P+2R$, with $R\in E(K)$, allows the half $Q+R$ and again changes nothing. Adding chosen halves shows additivity in $P$. If the cocycle is zero, the half is fixed by the absolute Galois group and lies in $E(K)$, so $P\in 2E(K)$. This proves, rather than assumes, an injectionThe fixed field of $\ker c_P$ is exactly $K(Q)$. Its Galois group is the image of $c_P$, so its degree is at most four. This also follows from the permitted biquadratic description.

Let $S$ be the finite set of primes dividing $2(\alpha -\beta )(\alpha -\gamma )(\beta -\gamma )$. At a place $v\notin S$ the displayed integral cubic has unit elliptic-curve discriminant, hence good reduction of an elliptic curve, and the residue characteristic is odd. Choose a half $\overline{Q}$ of the reduction of $P$ over the algebraic closure of the residue field. Its coordinates belong to a finite residue extension; let $L_v/K_v$ be the corresponding finite unramified extension. Smoothness and the Hensel lemma lift $\overline{Q}$ to some $Q_0\in E(L_v)$. The difference $P-2Q_0$ reduces to zero and belongs to the formal kernel of a minimal Weierstrass equation. In its integral formal group law the doubling series is $2t+O(t^2)$, with unit linear coefficient. The prime-to-residue-characteristic multiplication on a formal group gives a unique $R$ in this kernel such that $2R=P-2Q_0$. Thus $Q_0+R$ is a half of $P$ defined over an unramified local extension. Every other half differs by rational 2-torsion, so it too is unramified. We have proved the unramified halving fields for a split cubic assertion at every $v\notin S$.

There are only finitely many bounded-degree extensions with restricted ramification of $K$ of degree at most four. This is the permitted number-field finiteness consequence of the Hermite–Minkowski theorem: bounded local degrees bound the discriminant exponents at the finitely many allowed ramified primes, so absolute discriminants are bounded. Each possible halving field $L$ is Galois, and there are only finitely many homomorphisms $\mathrm{Gal}(L/K)\to E[2]$. The injection constructed above therefore has finite image. Consequently $E(K)/2E(K)$ is finite. No elliptic-curve finiteness or descent theorem was used in this argument.

For $K=\mathbb{Q}$, write $s=\#S$. Each coordinate of $c_P$ in a basis of $E[2]\cong (\mathbb{Z}/2\mathbb{Z}{)}^2$ is a quadratic Galois character unramified outside $S$. Its quadratic extension has a signed square-free integer representative $d=\pm {\prod }_{p\in S}{p}^{e_p}$, $e_p\in \{0,1\}$: an odd valuation outside $S$ would ramify there. There are at most $2^{s+1}$ choices, including the trivial character. Hence the pair of characters gives at most $2^{2s+2}$ cocycles. Each prime in $S$ is at most $2m$, because the three root differences have absolute values at most $2m$ and $2\le 2m$. Among the integers up to $2m$ there are at most $m$ primes: two, together with at most $m-1$ odd candidates. The rational halving quotient bound from root size is therefore

Direct substitution gives $y^2+y=x^3-x+6$ for both points. The displayed Weierstrass equation of an elliptic curve is minimal at every prime by the permitted assumption.

For $P$, neither $364$ nor $11737$ is divisible by three or five. ThereforeThe formal kernel of a minimal Weierstrass equation description gives $P\in E_1({\mathbb{Q}}_3)\cap E_1({\mathbb{Q}}_5)$. Similarly, neither $2059$ nor $98783$ is divisible by three or seven, so $Q\in E_1({\mathbb{Q}}_3)\cap E_1({\mathbb{Q}}_7)$, with the same respective coordinate valuations $-2,-3$.

If a point $T\in E_1({\mathbb{Q}}_p)$ had finite order of a group element $N=p^{a}n$ with $p\nmid n$, the point $p^{a}T$ would be killed by $n$. By prime-to-residue-characteristic multiplication on a formal group, multiplication by $n$ is injective on this kernel, so $p^{a}T=O$. Its order is therefore a power of $p$. Applying this at two distinct primes is the two-prime formal-kernel test for nontorsion: the order of $P$ would be both a power of three and of five, and the order of $Q$ both a power of three and of seven. Each would have to be the identity, although both are affine points. Both $P$ and $Q$ have infinite order.

For an integral Minimal Weierstrass equation, let $E_0({\mathbb{Q}}_p)$ be the subgroup of points whose reduction is a smooth point of the reduced cubic. Its reduction is a homomorphism to the smooth-locus group of a singular Weierstrass cubic, or to the whole reduced elliptic curve in the good-reduction case. Define the formal kernel of a minimal Weierstrass equation byIt consists of the identity and the points reducing to the identity at infinity. For a nonidentity affine point this is equivalent to $v_p(x)=-2r$ and $v_p(y)=-3r$ for some positive integer $r$.

The local parameter $t=-x/y$, with $t(O)=0$, gives the group isomorphismwhere $\hat{E}$ is the formal group of an elliptic curve. To see the local coordinates, put $w=-1/y$ in the Weierstrass equation of an elliptic curve. The resulting relation is $w=t^3+a_{1}tw+a_2{t}^{2}w+a_3{w}^2+a_{4}t{w}^2+a_6{w}^3$, and its unit linear coefficient gives a unique integral series $w(t)=t^3+O(t^4)$. Thus $x=t/w$ and $y=-1/w$ have valuations $-2v_p(t)$ and $-3v_p(t)$. The chord-and-tangent group law expressed in this parameter is precisely the integral formal group law $\hat{E}$. This description includes bad reduction; only the smooth identity neighborhood is involved.

A nonidentity rational point in the formal kernel of a minimal Weierstrass equation at two distinct primes has infinite order of a group element. Indeed, the prime-to-residue-characteristic multiplication on a formal group implies that a finite order in the kernel at $p$ must be a power of $p$. Membership in the kernel at a different prime $q$ also forces a power of $q$. The only common possibility is order one, contradicting nonidentity. For an integral model, negative valuations of the affine coordinates provide a convenient kernel-membership test.

Let $E:y^2=(x-\alpha )(x-\beta )(x-\gamma )$ with distinct algebraic integers in a number field $K$. For a rational point $P$, its halving field is unramified outside the finite set $S$ of primes dividing $2(\alpha -\beta )(\alpha -\gamma )(\beta -\gamma )$. At $v\notin S$, the elliptic-curve discriminant is a unit, so there is good reduction. A half of the reduction of $P$ is defined over a finite extension of the residue field. Pass to the corresponding unramified extension of the completion and lift this half using the Hensel lemma. The doubling error lies in the formal kernel of a minimal Weierstrass equation. Since two is a unit, prime-to-residue-characteristic multiplication on a formal group corrects this error uniquely. Every half differs by rational 2-torsion, so all halves are unramified at $v$. The halving cocycle with rational two-torsion has image of order at most four, making the halving field a Galois extension of degree at most four. The bounded-degree extensions with restricted ramification are finite in number; there are only finitely many homomorphisms from their finite Galois groups to $E[2]$. Thus $E(K)/2E(K)$ is finite, without assuming any form of the Mordell-Weil theorem.