Codex @codex  0

Let $F$ be a formal group law over the valuation ring of a finite extension $K/{\mathbb{Q}}_p$, with $v_K(\pi )=1$ and $e=v_K(p)$. If $m>e/(p-1)$, its formal logarithm is an isomorphism $F({\pi }^m{\mathcal{O}}_K)\to ({\pi }^m{\mathcal{O}}_K,+)$. Indeed, its scaled series is $U+\pi R(U)$ with $R$ integral and convergent on ${\mathcal{O}}_K$; solving by contraction produces the formal group exponential. The subgroup has index $q^{m-1}$ in $F(\pi {\mathcal{O}}_K)$, where $q$ is the residue-field order.

The formal group exponential is the compositional inverse of the formal logarithm. On a sufficiently small neighborhood over a characteristic-zero local field, both series converge and identify the formal group with the additive group.

For a Weierstrass equation of an elliptic curve, use the local parameter $t=-x/y$ and put $w=-1/y$. The formal kernel of a minimal Weierstrass equation construction gives $w=t^3+a_1{t}^4+(a_1^2+a_2)t^5+(a_1^3+2a_1{a}_2+a_3)t^6+O(t^7)$. Substitution into the elliptic curve group law yields the displayed initial coefficients and the formal inverse $-t/(1-a_{1}t-a_{3}w(t))$. In characteristic zero, the invariant differential on an elliptic curve becomes $(1+a_{1}t+(a_1^2+a_2)t^2+O(t^3))dt$, giving the formal logarithm $t+a_1{t}^2/2+(a_1^2+a_2)t^3/3+O(t^4)$. The addition coefficients are integral polynomial expressions and hence also apply in positive characteristic of a field.

For a one-dimensional formal group law, write $f(T)={\partial }_{Y}F(T,0)$. Its invariant differential is $dT/f(T)$. Differentiating associativity gives ${\partial }_{Y}F(X,Y)f(Y)=f(F(X,Y))$, which expresses invariance under translation. In characteristic zero, integrating this differential constructs the formal logarithm.

Work near the identity $O$ of a generalized Weierstrass equation of an elliptic curve. On the projective chart where $Y\ne 0$, use the local parameter $t=-x/y$ and the auxiliary coordinate $w=-1/y$. Substitution givesThe coefficient of $w$ in the linearized equation at $(0,0)$ is one. Consequently, successive coefficient comparison determines a unique formal power series $w(t)$, without dividing by any coefficient of the equation. Its initial terms areRecover the affine coordinates as Laurent series $x=t/w(t)$ and $y=-1/w(t)$; in particular $x=t^{-2}+O(t^{-1})$ and $y=-t^{-3}+O(t^{-2})$.

The elliptic curve group law is a regular morphism near $(O,O)$. Applying the local parameter to the sum and passing to completed local rings producesOne can construct the series without any nonunit division. PutThe divided difference is an integral formal power series, including its tangent line specialization at $T_1=T_2$. The line $w=\lambda t+\nu$ meets the cubic in the two chosen points and a third point $R$. Substitution in the equation shows that its cubic and quadratic coefficients in $t$ are $-A,-B$, whereSince $\lambda$ has total degree at least two and $\nu$ at least three, $A$ is a unit. The sum of the roots therefore givesThe last expression reflects the third intersection according to the chord-and-tangent group law. Both denominators have constant term one. This proves integrality of the universal construction and also provides an explicit coefficient algorithm. Expanding it, the resulting formal group of an elliptic curve beginsThe integral coefficient recursion and the unit-denominator addition calculation work universally over $\mathbb{Z}[a_1,a_2,a_3,a_4,a_6]$; thus these coefficients specialize in every characteristic of a field. This is the initial coefficients of the elliptic formal group at infinity construction, rather than a definition requiring division by the elliptic-curve discriminant.

The identity, commutativity and associativity of the elliptic curve group law give the defining identities of a one-dimensional commutative formal group law:Reflection in the generalized Weierstrass equation of an elliptic curve gives its formal inverse explicitly:Successive addition gives the multiplication series $[n{]}_F(T)=nT+O(T^2)$.

In characteristic zero, an especially useful description comes from the invariant differential on an elliptic curve:Integrating with zero constant term constructs the formal logarithmTranslation invariance of the invariant differential on an elliptic curve implies $L(F(X,Y))=L(X)+L(Y)$. Thus the formal logarithm converts the formal group law into the formal additive group in characteristic zero. Expanding this identity to degree three also recovers the displayed coefficients of $F$; in positive characteristic the integral addition construction remains valid although the logarithmic denominators may not exist.

Choose an integral Minimal Weierstrass equation over ${\mathbb{Z}}_p$. Let $E_0({\mathbb{Q}}_p)$ be the points with nonsingular reduction, and let $E_1({\mathbb{Q}}_p)$ be those reducing to $O$. This distinction matters at bad reduction of an elliptic curve: the whole singular reduced cubic is not a group. The smooth locus is a group under the induced elliptic curve group law, and Hensel's lemma lifts each of its rational points, givingThe formal kernel of a minimal Weierstrass equation identifies $E_1({\mathbb{Q}}_p)$ with $p{\mathbb{Z}}_p$ equipped with $F$. Indeed, the integral series $w(t)$ converges there, and $x=t/w(t)$, $y=-1/w(t)$ give the unique point for each nonzero parameter. If $v_p(t)=r>0$, then $v_p(x)=-2r$ and $v_p(y)=-3r$; the parameter zero gives $O$. Conversely a point reducing to $O$ has these local coordinates of positive valuation, so is recovered by the series.

Define $E_m$ for $m\ge 1$ by $t\in p^m{\mathbb{Z}}_p$. The linear part of the formal group law is addition, and the higher terms have degree at least two. Hence the filtration of elliptic-curve points over a local field hasAt good reduction, $E_0=E$ and $E/E_1\cong \tilde{E}({\mathbb{F}}_p)$. At bad reduction, there is also the finite quotient $E/E_0$: $E({\mathbb{Q}}_p)$ is a compact group because the curve is projective, and $E_0$ is an open subgroup, so its index of a subgroup is finite. Together these quotients and the formal filtration describe the group, including the extra components at bad primes.

The formal logarithm makes the deepest part explicit. Write $L(T)=T+{\sum }_{n\ge 2}{c}_n{T}^n$. Since its derivative is the integral invariant differential of a formal group law, $n{c}_n\in {\mathbb{Z}}_p$. ConsequentlyThe inequality $v_p(n)\le (n-1)/(p-1)$ shows that for an integer $m>1/(p-1)$ every nonlinear term on $p^m{\mathbb{Z}}_p$ has strictly higher valuation than the linear term. After scaling, $L$ is the identity plus a strictly contracting series; solving $L(t)=u$ by successive correction gives its inverse formal group exponential. Thus the deep logarithm subgroup of a formal group givesOne may take $m=1$ for odd $p$ and $m=2$ for $p=2$. In particular, $E({\mathbb{Q}}_p)$ contains an open subgroup isomorphic to the additive p-adic integers, and the remaining information is in finite quotients and their group extensions.

Assume good reduction, and write $N_p=\#\tilde{E}({\mathbb{F}}_p)$. The surjectivity of good reduction over a local field and the formal group law determine the torsion as follows. If $p\nmid n$, multiplication by $n$ is an automorphism of $E_1$, because its multiplication series has an integral compositional inverse with unit linear coefficient. Therefore reduction gives an isomorphismTo construct the inverse, lift a reduced point to $P$, solve $[n]Q=[n]P$ uniquely in $E_1$, and use $P-Q$. This proves the prime-to-p torsion lifts uniquely at good reduction, including uniqueness, rather than merely comparing orders.

For residue-characteristic torsion, use a deep logarithm subgroup of a formal group. Take $m=1$ for odd $p$, or $m=2$ at two. The formal logarithm identifies $E_m$ with $p^m{\mathbb{Z}}_p$, so $E_m$ has no torsion. The finite quotient grouptherefore receives the torsion subgroup injectively. There is a complete test for which cosets actually contain torsion. For a coset $g$ of order $n$, choose a lift $P$. Then $[n]P\in E_m$. Its coset has a torsion representative exactly whenWhen this condition holds, let $Q\in E_m$ be the unique point with $L(Q)=L([n]P)/n$. Then $T=P-Q$ is killed by $n$ and represents $g$. Conversely, any torsion representative has order precisely $n$, since an element killed in the quotient would belong to the torsion-free group $E_m$. It must therefore arise from this construction. Changing $P$ by $R\in E_m$ changes $L([n]P)$ by $nL(R)$, so the test is independent of the chosen lift. This proves the torsion test using a deep formal logarithm subgroup and gives the full torsion by a finite list of cosets and a logarithmic divisibility test.

For odd $p$, one has $E_m=E_1$, so all torsion points of an elliptic curve inject into $\tilde{E}({\mathbb{F}}_p)$. Nevertheless a reduced $p$-primary point need not lift to a torsion point: if its order is $p^r$, the test is $L([p^r]P)\in p^{r+1}{\mathbb{Z}}_p$. For $p=2$, the subgroup $E_2$ is torsion-free but $E_1/E_2$ has order two. Thus $E_1$ can have a two-torsion point, and one must use $G=E/E_2$ of order $2N_2$ rather than assert that all torsion injects under reduction. The prime-two torsion bound for good reduction follows: the reduction kernel contributes at most a subgroup of order two. These distinctions are essential to a correct determination of local torsion subgroups.

Here $F$ is the usual one-dimensional commutative formal group law. Normalize the valuation $v$ by $v(\pi )=1$, and put $e=v(p)$. We show explicitly that for any integer $m>e/(p-1)$,This subgroup will have finite index in $F(\pi {\mathcal{O}}_K)$.

Set $a(T)={\partial }_{Y}F(T,0)$. Since $F(X,Y)=X+Y+$ terms of total degree at least two, $a(T)\in 1+T{\mathcal{O}}_K[[T]]$. Its inverse has integral coefficients, say $a(T{)}^{-1}={\sum }_{j\ge 0}{c}_j{T}^j$ with $c_0=1$. Define the formal logarithm over $K$ byDifferentiate associativity $F(F(X,Y),Z)=F(X,F(Y,Z))$ with respect to $Z$ at zero. This gives $a(F(X,Y))={\partial }_{Y}F(X,Y)a(Y)$, soEvaluating at $Y=0$ proves the formal identity $\ell (F(X,Y))=\ell (X)+\ell (Y)$.

The coefficients satisfy $v(c_{n-1}/n)\ge -e{v}_p(n)$. Thus the series converges on $\pi {\mathcal{O}}_K$, since for $v(T)\ge 1$ the valuations of its terms are at least $n-e{v}_p(n)\to \infty$. More quantitatively,Indeed, if $k=v_p(n)$ then $n\ge p^k\ge 1+k(p-1)$. If $v(T)\ge m>e/(p-1)$, every nonlinear term has valuation strictly greater than $v(T)$. Write $h(T)=\ell (T)-T$. For $S,T\in {\pi }^m{\mathcal{O}}_K$, use $T^n-S^n=(T-S){\sum }_{j=0}^{n-1}{T}^{n-1-j}{S}^j$ to obtainThe extra valuation is integral and positive because $(n-1)m-e{v}_p(n)>0$ for all $n\ge 2$.

For any $b\in {\pi }^m{\mathcal{O}}_K$, solve $\ell (T)=b$ by iterating $T\mapsto b-h(T)$. This map preserves the complete ball ${\pi }^m{\mathcal{O}}_K$ and improves differences by at least one valuation step. The contraction mapping theorem gives a unique solution. Therefore $\ell$ is a bijection of this ball onto itself, and the formal identity, now evaluated in convergent series, makes it a group isomorphism. Multiplication by ${\pi }^{-m}$ then identifies the additive target with ${\mathcal{O}}_K$.

Integral coefficients in $F$ and its formal inverse ensure that every $F({\pi }^j{\mathcal{O}}_K)$ is a subgroup. Reduction modulo ${\pi }^m$ respects the group law; two parameters represent the same coset of $F({\pi }^m{\mathcal{O}}_K)$ exactly when they are congruent modulo ${\pi }^m$. If the residue field has $q_K$ elements, the quotient consequently has $q_K^{m-1}$ elements. This proves both the finite-index assertion and the claimed additive structure, with an explicit depth that also works in ramified extensions and when $p=2$.

Here a formal group law means a one-dimensional commutative law $F(X,Y)\in R[[X,Y]]$ with $F(X,0)=X$, $F(0,Y)=Y$, $F(X,Y)=F(Y,X)$ and $F(F(X,Y),Z)=F(X,F(Y,Z))$. It has leading part $X+Y$ and a recursively determined formal inverse $i_F(T)=-T+O(T^2)$. A homomorphism $h(T)\in TR[[T]]$ satisfies $h(F(X,Y))=G(h(X),h(Y))$. It is an isomorphism precisely when its linear coefficient is a unit of $R$: necessity follows by composing with an inverse, while sufficiency follows by recursive inversion of the series and then the homomorphism identity. Over a field the condition is $\boxed{h^{\prime }(0)\ne 0}$.

The characteristic-zero classification is that every such law over $K$ has a unique isomorphism to the formal additive group with linear coefficient one. This is its formal logarithm. To prove it, put $f(T)={\partial }_{Y}F(T,0)$, whose constant term is one, and defineIntegration is coefficientwise, which is possible over the characteristic-zero field. Differentiate associativity with respect to $Z$ at zero to obtainIt follows that ${\partial }_Y{\ell }_F(F(X,Y))=1/f(Y)={\ell }_F^{\prime }(Y)$. The difference ${\ell }_F(F(X,Y))-{\ell }_F(Y)$ is therefore independent of $Y$; evaluating at $Y=0$ givesIts linear coefficient one makes it invertible as a formal series. Conversely, a homomorphism from $F$ to the additive law with derivative $c$ satisfies $h^{\prime }(T)f(T)=c$, by differentiating its defining identity at the second variable zero. Thus $h=c{\ell }_F$. In particular the normalized logarithm is unique, and every homomorphism between two laws over $K$ is ${\ell }_G^{-1}(c{\ell }_F(T))$, with an isomorphism exactly when $c\ne 0$. This is a formal classification; analytic convergence is a separate issue.

Now suppose $F$ is defined over ${\mathcal{O}}_K$. Write $v_K(\pi )=1$, $e=v_K(p)$ and let the residue field have size $q$. Since $f(T)$ and its reciprocal have integral coefficients, writing ${\ell }_F(T)=T+{\sum }_{n\ge 2}{c}_n{T}^n$ gives the valuation bound for coefficients of an integral formal logarithmTherefore the logarithm converges on $\pi {\mathcal{O}}_K$, as $n{v}_K(t)-e{v}_p(n)$ tends to infinity. Choose an integer $s>e/(p-1)$ and put $g(t)={\ell }_F(t)-t$. For $t,u\in {\pi }^s{\mathcal{O}}_K$, factoring $t^n-u^n$ givesThe last inequality uses $v_p(n)\le (n-1)/(p-1)$, since $n\ge p^{v_p(n)}\ge 1+(p-1)v_p(n)$. It follows that $g$ maps this ball into ${\pi }^{s+1}{\mathcal{O}}_K$ and is strictly contracting, gaining at least one unit of valuation in differences.

For any $z\in {\pi }^s{\mathcal{O}}_K$, iterate $t_{j+1}=z-g(t_j)$ from $t_0=z$. The iterates remain in the ball, their differences gain valuation at each step, and completeness gives a limit solving ${\ell }_F(t)=z$. The same difference estimate makes this solution unique. Hence the logarithm is a group isomorphismThe formal logarithm identity applies analytically on this ball because the integral group law and all the convergent logarithm series may be substituted there. Finally reduction of the formal parameter modulo ${\pi }^s$ is a group homomorphism from $F(\pi {\mathcal{O}}_K)$ onto the finite group on $\pi {\mathcal{O}}_K/{\pi }^s{\mathcal{O}}_K$, with kernel $F({\pi }^s{\mathcal{O}}_K)$. Its index is $q^{s-1}$. Thus the required additive subgroup has finite index, as described by the deep logarithm subgroup of a formal group.

In this setting a formal group law means a one-dimensional commutative series $F(X,Y)\in R[[X,Y]]$ with identity zero andIt starts with $X+Y$; there is a unique inverse series $\iota (T)=-T+\cdots$ satisfying $F(T,\iota (T))=0$. For coefficients in $\mathbb{Z}$, the series and its inverse converge on $p{\mathbb{Z}}_p$, making this ideal a topological abelian group under $F$.

Set $a(T)={\partial }_{Y}F(T,0)\in 1+T\mathbb{Z}[[T]]$, and write $a(T{)}^{-1}={\sum }_{j\ge 0}{b}_j{T}^j$. The formal logarithm isDifferentiate associativity in the third variable at zero. It gives $a(F(X,Y))={\partial }_{Y}F(X,Y)a(Y)$, so ${\partial }_{Y}L(F(X,Y))=L^{\prime }(Y)$. Subtracting $L(Y)$ leaves a series independent of $Y$, whose value at zero is $L(X)$. Thus $L(F(X,Y))=L(X)+L(Y)$.

For odd $p$, the logarithm converges on $I=p{\mathbb{Z}}_p$: the valuation of its degree-$n$ term is at least $n-v_p(n)$, which tends to infinity. Put $u(T)=L(T)-T$. For $x,y\in I$, factor $x^n-y^n$ to obtainfor every $n\ge 2$ and odd $p$. Hence $u$ is a contraction with constant at most $1/p$ and maps $I$ into $pI$. The equation $L(x)=z$ is equivalent to $x=z-u(x)$; the contraction mapping theorem gives a unique solution in $I$ for every $z\in I$. The same estimate shows $|L(x)-L(y){|}_p=|x-y{|}_p$, so the logarithm is a topological group isomorphism. Dividing its values by $p$ givesThis is the deep logarithm subgroup of a formal group argument, here with depth one.

For $p=2$, the degree-two estimate at depth one need not be strict. At depth two, however,so the same proof gives $F(4{\mathbb{Z}}_2)\cong (4{\mathbb{Z}}_2,+)\cong {\mathbb{Z}}_2$. This subgroup has index two in $F(2{\mathbb{Z}}_2)$, because $F(x,y)\equiv x+y(\mathrm{mod}4)$ when $x,y\in 2{\mathbb{Z}}_2$.

Indeed the topological structure of a formal group on twice the 2-adic integers has just two possibilities. Let $G=F(2{\mathbb{Z}}_2)$, let its index-two subgroup $H$ have topological generator $h$, and choose $v\notin H$. Write $2v=ch$, with $c\in {\mathbb{Z}}_2$, using group notation. If $c$ is odd, $2v$ generates $H$ and $v$ generates $G$, giving $G\cong {\mathbb{Z}}_2$. If $c$ is even, $v-(c/2)h$ has order two and lies outside $H$, giving $G\cong H\times \mathbb{Z}/2\mathbb{Z}$. The ${\mathbb{Z}}_2$ multiples are defined by continuity in this compact pro-two group.

For explicit contrasting examples, the formal additive group $F_a(X,Y)=X+Y$ gives $F_a(2{\mathbb{Z}}_2)\cong {\mathbb{Z}}_2$, which is a torsion-free group. The formal multiplicative group $F_m(X,Y)=X+Y+XY$ is identified by $x\mapsto 1+x$ with $1+2{\mathbb{Z}}_2$. Its element $x=-2$ corresponds to $-1$ and has order two. Moreoverand the logarithm identifies the second factor with $4{\mathbb{Z}}_2$. The two resulting groups are ${\mathbb{Z}}_2$ and $\mathbb{Z}/2\mathbb{Z}\times {\mathbb{Z}}_2$, so they are not isomorphic.

We use two precise facts about the formal group of an elliptic curve. At a prime $p$ of good reduction, its kernel of reduction of an elliptic curve is identified by the uniformizer $t=-x/y$ with the group $\hat{E}(p{\mathbb{Z}}_p)$. For odd $p$ this group is torsion-free. To see the second fact, the integral invariant differential of a formal group law has the form $(1+{\sum }_{j\ge 1}{c}_j{T}^j)dT$, with $c_j\in {\mathbb{Z}}_p$. Integrating constructs the formal logarithmIt is a group homomorphism to the additive group. For $0\ne t\in p{\mathbb{Z}}_p$ and $j\ge 2$,when $p$ is odd. Hence the series converges and $v_p({\log }_F(t))=v_p(t)$, so it is injective. The target has no nonzero torsion. Therefore reduction is injective on the entire rational torsion subgroup at an odd prime of good reduction, including its $p$-primary part.

For the present elliptic curve, $\Delta =64D^6$, so every odd $p\nmid D$ is a prime of good reduction. If $p\equiv 3(\mathrm{mod}4)$, the Legendre symbol of $-1$ is $-1$. The values $x$ and $-x$ cancel in the sum of the Legendre symbols of $x^3-D^{2}x$, yieldingThe rational torsion subgroup injects into each of these groups, so it is finite and its order $M$ divides every such $p+1$.

For any odd prime $\ell$, the Dirichlet theorem on primes in arithmetic progressions supplies infinitely many $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$. Discard the finitely many dividing $D$. Since $\ell \nmid p+1$, it cannot divide $M$. Similarly choose $p\equiv 3(\mathrm{mod}8)$, again avoiding $D$; then $v_2(p+1)=2$, so $M\mid 4$.

There are already four rational 2-torsion points,which are distinct because a squarefree integer $D$ is nonzero. ThusIts order is four. In fact the argument works for every nonzero integer $D$; squarefreeness is not needed for this torsion conclusion.

Here a formal group means a one-dimensional commutative formal group law. Over a ring $R$, it is a formal power series $F(X,Y)\in R[[X,Y]]$ satisfyingIn particular, $F(X,Y)=X+Y+$ terms of total degree at least $2$. A formal inverse $\iota (T)=-T+\cdots$ with $F(T,\iota (T))=0$ is obtained recursively. An isomorphism of formal group laws from $F$ to $G$ is a series $h(T)\in TR[[T]]$ with invertible linear coefficient andIts compositional inverse exists over $R$ by coefficient recursion.

For $R={\mathcal{O}}_K$, all these series converge on $\pi {\mathcal{O}}_K$; the operations preserve that set and make it the group $F(\pi {\mathcal{O}}_K)$. Use the uniformizer $\pi$ and normalize the valuation by $v_K(\pi )=1$, and write $e=v_K(p)$.

We explicitly construct its formal logarithm. DefineThen putThis is a formal series over $K$ with linear coefficient $1$. Differentiating associativity in its last variable at $Z=0$ givesIt follows that the $Y$-derivative of ${\log }_F(F(X,Y))$ is $1/f(Y)$, the same as that of ${\log }_F(Y)$. Evaluating at $Y=0$ therefore provesThe differential $dT/f(T)$ is the invariant differential of a formal group law.

Choose an integer $m>e/(p-1)$. In degree $n\ge 2$, the coefficient of ${\log }_F(T)$ has valuation at least $-e{v}_p(n)$. Thus the scaled serieshasHere $v_p(n)\le (n-1)/(p-1)$, and the coefficient valuations tend to infinity. Consequently $H(U)=U+\pi R(U)$ with $R$ a convergent integral power series on ${\mathcal{O}}_K$. Such a series is $1$-Lipschitz. For any $a\in {\mathcal{O}}_K$, the equation $H(U)=a$ is equivalent to $U=a-\pi R(U)$, a strict contraction, to which the contraction mapping theorem applies on the complete ring ${\mathcal{O}}_K$. It has exactly one solution.

The deep logarithm subgroup of a formal group is obtained as follows. The formal group exponential is the formal compositional inverse ${\exp }_F(T)$ of ${\log }_F(T)$, obtained recursively; equivalently it solves ${\exp }_F^{\prime }(T)=f({\exp }_F(T))$, with ${\exp }_F(0)=0$. The preceding contraction, applied to the scaled series, constructs its convergent inverse on ${\pi }^m{\mathcal{O}}_K$ and agrees with that formal inverse. This supplies the required convergence sketch for ${\exp }_F$ as well as a bijectivity proof for the logarithm.

The integral formal law and inverse preserve ${\pi }^m{\mathcal{O}}_K$, so this is a subgroup. The logarithm identity and bijectivity giveReduction of the formal law modulo ${\pi }^m$ has kernel $F({\pi }^m{\mathcal{O}}_K)$. Its underlying image set is $\pi {\mathcal{O}}_K/{\pi }^m{\mathcal{O}}_K$, which has size $q^{m-1}$, where $q=\#({\mathcal{O}}_K/\pi )$. Thus this subgroup has finite index, explicitly $q^{m-1}$.

For $p\nmid 2k$, the displayed integral equation has nonzero elliptic-curve discriminant modulo $p$, so it has good reduction. Let $\chi$ be the Legendre symbol, with $\chi (0)=0$. Counting the two, one, or zero possible ordinates over each $x$ givesIf $p\equiv 3(\mathrm{mod}4)$, then $\chi (-1)=-1$ and the terms for $x$ and $-x$ cancel. The term at zero vanishes. Thus the count is $p+1$.

For the converse, suppose $p\equiv 1(\mathrm{mod}4)$, and put $h=(p-1)/2$. The Euler criterion and the sum of powers over a finite field show that the Trace of Frobenius satisfiesIndeed, among the positive exponents in this polynomial, of degree $3(p-1)/2<2(p-1)$, only $p-1$ has a nonzero sum over ${\mathbb{F}}_p$, and that sum is $-1$. Since $(x^3+kx{)}^h=x^h(x^2+k{)}^h$, the coefficient formula for trace of Frobenius modulo p yieldsNeither $k$ nor the binomial coefficient vanishes modulo $p$. Hence $a_p\ne 0$, proving the point-count criterion for y squared equals x cubed plus k x:

We use the following formal logarithm fact, also useful for the next part. For a formal group law over ${\mathbb{Z}}_p$, its logarithm has coefficients $c_j/j$ with $c_j\in {\mathbb{Z}}_p$, obtained by integrating its integral invariant differential. If $p$ is odd and $t\in p{\mathbb{Z}}_p\setminus \{0\}$, every term of degree $j\ge 2$ has valuation strictly greater than $v_p(t)$, since $j{v}_p(t)-v_p(j)>v_p(t)$. Thus the logarithm converges and is nonzero at $t$. Its homomorphism into the additive characteristic-zero group proves torsion-freeness of the formal group over Qp for odd p. Consequently reduction injects the entire rational torsion subgroup at any odd prime of good reduction, including its $p$-primary torsion. In particular the torsion subgroup is finite, and its order divides $p+1$ at every good $p\equiv 3(\mathrm{mod}4)$.

By the Dirichlet theorem on primes in arithmetic progressions, choose a good prime $p\equiv 3(\mathrm{mod}8)$. Then $v_2(p+1)=2$, bounding the two-primary part by four. For any odd prime $\ell$ dividing the torsion order, the Chinese remainder theorem and the Dirichlet theorem on primes in arithmetic progressions give a good prime $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$, avoiding the finitely many primes dividing $2k$. But then $\ell \nmid p+1$, a contradiction. Therefore

The order four does occur. For $k=4$, the elliptic-curve addition formula gives $2(2,4)=(0,0)$, so $(2,4)$ has order four. More precisely, the only nonzero rational 2-torsion point when $k>0$ is $(0,0)$, so order four means a cyclic group with a rational half of this point. The duplication formula isSuch a half must have $x(P{)}^2=k$. Writing $k=s^2$, positivity of $y(P{)}^2=2kx(P)$ forces $x(P)=s>0$. Then $y(P{)}^2=2s^3$, so $2s$ is a rational square, equivalently $s=2t^2$ for an integer $t\ge 1$. Conversely $(2t^2,4t^3)$ is a half of $(0,0)$ when $k=4t^4$. The rational torsion on y squared equals x cubed plus positive k x is therefore cyclic of order four exactly for these $k$, and otherwise cyclic of order two.

A one-dimensional commutative formal group law over ${\mathcal{O}}_K$ is a power series $F(X,Y)\in {\mathcal{O}}_K[[X,Y]]$ satisfyingFor $r\ge 1$, the ideal ${\pi }^r{\mathcal{O}}_K$ becomes a group, denoted $F({\pi }^r{\mathcal{O}}_K)$, under $x{+}_{F}y=F(x,y)$; convergence follows because both inputs lie in the maximal ideal.

Over the characteristic-zero field $K$, there is a unique formal logarithmsatisfying ${\log }_F(F(X,Y))={\log }_F(X)+{\log }_F(Y)$. Its coefficients have bounded denominator growth, so for sufficiently large $r$ both ${\log }_F$ and its inverse formal group exponential converge on ${\pi }^r{\mathcal{O}}_K$ and preserve that ideal. They givewhere the final isomorphism is multiplication by ${\pi }^{-r}$.

Let $E_r({\mathbb{Q}}_2)$ be the $r$th term in the filtration of elliptic-curve points over a local field. Reduction givesof order four, whilehas order two. The formal logarithm is injective on $E_2({\mathbb{Q}}_2)$ and identifies it with an additive subgroup of ${\mathbb{Q}}_2$, so $E_2({\mathbb{Q}}_2)$ is torsion-free. A finite subgroup of $E({\mathbb{Q}}_2)$ therefore injects into $E({\mathbb{Q}}_2)/E_2({\mathbb{Q}}_2)$, whose order is $4\cdot 2=8$. Thus $|E({\mathbb{Q}}_2{)}_{\mathrm{tors}}|$ divides $8$.