Genus one curve

A genus one curve is a smooth projective curve of geometric genus one. Choosing a rational point makes it an elliptic curve.

An elliptic curve over a field $K$ is a smooth projective curve of genus one equipped with a specified $K$-rational point $O$. The chord-and-tangent law makes its rational points an abelian group with identity $O$.

The Weierstrass elliptic function and its derivative give an isomorphism $z\mapsto (\wp (z),{\wp }^{\prime }(z))$ from a one-dimensional complex torus to a smooth plane cubic, with $0$ sent to its identity at infinity. The three nonzero two-torsion points of a complex torus are zeros of ${\wp }^{\prime }$. Its triple pole implies that these three zeros are simple. If two half-period values of the Weierstrass elliptic function coincided, $\wp -e$ would have at least four zeros counted with multiplicity, contradicting its double pole. The three cubic roots are therefore distinct, proving smoothness of an algebraic variety. The degree-two map $\wp$ has fibers $\{z,-z\}$, distinguished by ${\wp }^{\prime }$ away from the half-periods, proving bijectivity. A line pulls back to an elliptic function with a triple pole, and the zero-pole sum of an elliptic function says that its three intersections sum to zero on the torus. This gives exactly the chord-and-tangent group law, including repeated intersections interpreted by intersection multiplicity.

An elliptic curve in characteristic zero admits no nonconstant rational map of projective varieties from the projective line. Over $\mathbb{C}$, write its equation as $y^2={\prod }_{j=1}^3(x-e_j)$ with distinct $e_j$. Substituting $x=u/v$ with coprime polynomials gives $(y{v}^2{)}^2=v{\prod }_j(u-e_{j}v)$. These four pairwise coprime factors must all be squares. The polynomial pencil with four square members forces $u,v$ constant, ruling out a nonconstant rational parametrization of an algebraic curve.

The j-invariant is unchanged by admissible changes of Weierstrass equation of an elliptic curve. With $b_2=a_1^2+4a_2$ and $b_4=a_1{a}_3+2a_4$, set $c_4=b_2^2-24b_4$ and $j=c_4^3/\Delta$, where $\Delta$ is the elliptic-curve discriminant. For good reduction over a local field, an integral equation with unit discriminant shows that $j$ lies in the valuation ring. Thus a negative valuation of $j$ proves bad reduction, even if the displayed equation has not been proved minimal.

Let $E$ be a genus one curve over an algebraically closed field and choose $O\in E$. The mapis an isomorphism. For a degree-zero divisor $D$, Riemann--Roch gives a nonzero section of $D+O$, so $D\sim P-O$ for some point $P$. If $P-O\sim P^{\prime }-O$ with $P\ne P^{\prime }$, a rational function with divisor $P-P^{\prime }$ would give a degree-one map to the projective line, contradicting that $E$ has genus one. The Abel--Jacobi map transports addition in the divisor class group to the elliptic-curve group law.

Over an algebraically closed field of characteristic different from two, a degree-two map from a smooth genus one curve to the projective line has a deck involution. After choosing an origin, all its fiber divisors on an algebraic curve are linearly equivalent and have the same group sum $s$, by the Abel-Jacobi map of a genus-one curve. The involution is consequently $p\mapsto s-p$, including its fixed ramification points. Composing two such involutions gives a translation on an elliptic curve.

On a smooth plane cubic with identity point $O$, a line through points $P$ and $Q$, interpreted as the tangent when $P=Q$, meets the cubic in a third point $R$. The chord-and-tangent group law defines $P+Q$ as the third intersection of the line through $R$ and $O$ with the cubic.

For a fixed point $Q$ on an elliptic curve, translation is the automorphism $P\mapsto P+Q$. Its inverse is translation by $-Q$. Translations let local computations of an invariant differential on an elliptic curve control every point of the curve.

For a singular projective Weierstrass cubic, its smooth locus of a variety contains the point at infinity and carries the chord-and-tangent group law. The singular point is excluded. Over an algebraic closure, a node gives the multiplicative algebraic group and a cusp gives the additive group. A node whose branches are not defined over the base field gives a nonsplit one-dimensional algebraic torus. This group is distinct from an elliptic curve, whose projective model is smooth.

On $y^2=x^3+a_2{x}^2+a_{4}x+a_6$, let $\lambda$ be the secant slope through distinct points $P,Q$, or the tangent slope when $P=Q$. Then

On $y^2=x^3+ax+b$ in characteristic of a field other than two, take the elementary symmetric polynomials $s_i$ of $x(P),x(Q),x(P+Q)$. If the line through $P,Q$ is $y=\lambda x+\mu$, its third intersection is $-(P+Q)$, so coefficient comparison gives $s_1={\lambda }^2$, $s_2=a-2\lambda \mu$, $s_3={\mu }^2-b$. Hence $(s_2-a{)}^2=4s_1(s_3+b)$. This is an identity of rational functions; tangent cases follow by specialization, and coordinates at infinity are handled through the projective addition map.

A Weierstrass equation presents an elliptic curve aswith nonzero discriminant, together with the point at infinity $O$.

Let $E$ be a genus one curve and choose $O\in E$. Since a canonical divisor is linearly equivalent to zero, Riemann--Roch gives $\ell (nO)=n$ for $n\ge 1$. Choose $x\in L(2O)\setminus L(O)$ and $y\in L(3O)\setminus L(2O)$. Their pole orders at $O$ are two and three. The seven functionsare linearly dependent because $\ell (6O)=6$, and comparison of pole orders puts the relation in Weierstrass form. The complete linear system $|3O|$ is very ample and realizes this relation as a smooth plane cubic. In characteristic other than two and three, completing the square and translating $x$ produce a Short Weierstrass form.

The discriminant of a Weierstrass equation is a polynomial $\Delta$ in its coefficients whose nonvanishing is equivalent to the projective cubic being smooth. For $y^2=x^3+Ax+B$,

An admissible change of Weierstrass coordinates has the formwhere $u$ is nonzero. These are exactly the coordinate changes preserving Weierstrass form and the point at infinity.

Over a field of characteristic other than two or three, every elliptic curve has a short Weierstrass equation $y^2=x^3+Ax+B$ with $4A^3+27B^2\ne 0$.

On $y^2=x^3+ax+b$ in characteristic other than two, the differentialextends regularly and without zeros across the point at infinity. Translation by every point preserves it.

On a nonsingular equation $y^2=x^3+a_2{x}^2+a_{4}x+a_6$ in characteristic different from two, $\omega =dx/(2y)$ is regular and nowhere zero. For a chord of slope $h$ giving $P+Q=(X,Y)$, differentiating the line-intersection identity yields $dX/dx=Y/y$, so $dX/(2Y)=dx/(2y)$. Extension across the exceptional cases proves invariance under every translation on an elliptic curve. The addition map consequently satisfies ${\mu }^{\ast }\omega ={\mathrm{pr}}_1^{\ast }\omega +{\mathrm{pr}}_2^{\ast }\omega$, and $[n{]}^{\ast }\omega =n\omega$.

Over a discretely valued field, a minimal Weierstrass equation has integral coefficients and has least possible discriminant valuation among integral Weierstrass equations related by admissible changes of variables.

Reducing a minimal integral Weierstrass equation modulo the maximal ideal gives a projective cubic over the residue field. Reducing primitive projective coordinates defines the reduction map on rational points.

An elliptic curve has good reduction at a finite place when its reduced minimal Weierstrass equation is nonsingular, equivalently when its minimal discriminant has valuation zero.

If an elliptic curve has good reduction over a local field $K$, its integral projective model is smooth. Every point over the residue field lifts by the Hensel lemma, applied in a chart with a unit partial derivative. Thus reduction gives an exact sequence $0\to E_1(K)\to E(K)\to \tilde{E}(k)\to 0$. The kernel of reduction of an elliptic curve is the maximal ideal of the valuation ring, with the formal group of an elliptic curve as its group operation.

For an elliptic curve with good reduction over a local field, the kernel of reduction consists of the points reducing to the identity. The parameter $t=-x/y$ identifies it with the maximal ideal equipped with the formal group of an elliptic curve.

At a prime of good reduction of an elliptic curve, the reduction map is a group homomorphism on all local points. If $N$ annihilates the reduced finite group, every $NP$ reduces to the identity at infinity. A finite point with integral affine coordinates reduces to an affine point, so a nonidentity $NP$ cannot have integral affine coordinates. The identity has no affine coordinates and must be treated separately.

An elliptic curve has bad reduction at a finite place when its reduced minimal Weierstrass equation is singular, equivalently when its minimal discriminant has positive valuation.

At a prime of good reduction with residue characteristic $p$, reduction is injective on the prime-to-$p$ torsion of an elliptic curve. Comparing reductions at two good primes therefore bounds rational torsion by finite point counts.

For an elliptic curve with good reduction over ${\mathbb{Q}}_2$, let $E_1$ be the reduction kernel and $E_2$ its formal subgroup with parameter in $4{\mathbb{Z}}_2$. The deep logarithm subgroup of a formal group makes $E_2$ torsion-free, while $[E_1:E_2]=2$. Thus the torsion of the reduction kernel has order at most $2$. Combined with the Hasse theorem for elliptic curves, rational torsion of order $16$ forces bad reduction at $2$.

For an elliptic curve $E:y^2=f(x)$ over a field of characteristic other than two and $d\in K^{\times }$, the curve $E^{(d)}:d{y}^2=f(x)$ is its quadratic twist by $d$. It becomes isomorphic to $E$ after adjoining $\sqrt{d}$; over a finite field its Frobenius trace is multiplied by the quadratic character of $d$.

A twist of an elliptic curve $E/K$ is an elliptic curve over $K$ that becomes isomorphic to $E$ over an algebraic closure of $K$. Twists are classified by the Galois-cohomology set $H^1(G_K,\mathrm{Aut}(E_{\overline{K}}))$.

An inflection point of a smooth plane cubic is a point where its tangent line has intersection multiplicity three. Once one inflection point is chosen as the identity, the nine geometric inflection points are exactly the 3-torsion points.

A one-dimensional commutative formal group law over a ring $R$ is a series $F(X,Y)\in R[[X,Y]]$ satisfying the identity, commutativity, and associativity axioms. A homomorphism from $F$ to $G$ is a series $\theta (T)\in TR[[T]]$ satisfying $\theta (F(X,Y))=G(\theta (X),\theta (Y))$.

For a one-dimensional formal group law, write $f(T)={\partial }_{Y}F(T,0)$. Its invariant differential is $dT/f(T)$. Differentiating associativity gives ${\partial }_{Y}F(X,Y)f(Y)=f(F(X,Y))$, which expresses invariance under translation. In characteristic zero, integrating this differential constructs the formal logarithm.

An isomorphism from formal group law $F$ to $G$ over $R$ is a formal series $h(T)=a_{1}T+a_2{T}^2+\cdots$ with $a_1\in R^{\ast }$ and $h(F(X,Y))=G(h(X),h(Y))$. Coefficient recursion gives a compositional inverse over $R$. An isomorphism of formal series need not converge on an arbitrary prescribed analytic domain; convergence must be checked separately.

Every one-dimensional formal group law has a unique formal inverse $i_F(X)=-X+O(X^2)$ satisfying $F(X,i_F(X))=0$. Comparing coefficients recursively determines it degree by degree.

The formal additive group has law $F_a(X,Y)=X+Y$. Its multiplication-by-$n$ series is $[n{]}_a(X)=nX$.

The formal multiplicative group has law $F_m(X,Y)=X+Y+XY$, obtained by writing a multiplicative coordinate as $1+X$. Its multiplication-by-$n$ series is

Over an algebra over a field whose scalar field is $\mathbb{Q}$, the series $\exp (X)-1$ defines an isomorphism from the formal additive group to the formal multiplicative group, with inverse $\log (1+X)$.

A morphism $h(T)=uT+O(T^2)$ of one-dimensional formal group laws over a ring is an isomorphism when $u$ is a unit. Recursive coefficient comparison constructs its compositional inverse, and the morphism identity shows that this inverse is also a formal-group morphism.

For a one-dimensional formal group law $F$ over a ring $R$, the multiplication series satisfies $[n{]}_F(T)=nT+O(T^2)$. It is an isomorphism exactly when $n$ is a unit of $R$.

Let $R$ be a complete discrete valuation ring of residue characteristic of a field $p$, with maximal ideal $\mathfrak{m}$, and let $F$ be a one-dimensional formal group law over $R$. Its multiplication series is $[n{]}_F(T)=nT+O(T^2)$. If $p\nmid n$, the invertible morphism criterion for formal group laws constructs its inverse with coefficients in $R$. Both formal power series converge on $\mathfrak{m}$, since their coefficients are integral and the powers of an element of $\mathfrak{m}$ tend to zero. Their compositions are the identity there. Thus multiplication by $n$ is bijective, including when $p=2$ and $n$ is odd. Every finite-order element of $F(\mathfrak{m})$ consequently has order of a group element equal to a prime power with prime $p$.

Over a characteristic-zero field, a one-dimensional commutative formal group law has a unique strict isomorphism to the additive formal group, called its formal logarithm. It satisfies ${\log }_F(F(X,Y))={\log }_F(X)+{\log }_F(Y)$.

Let $F$ be a formal group law over the valuation ring of a finite extension $K/{\mathbb{Q}}_p$, with $v_K(\pi )=1$ and $e=v_K(p)$. If $m>e/(p-1)$, its formal logarithm is an isomorphism $F({\pi }^m{\mathcal{O}}_K)\to ({\pi }^m{\mathcal{O}}_K,+)$. Indeed, its scaled series is $U+\pi R(U)$ with $R$ integral and convergent on ${\mathcal{O}}_K$; solving by contraction produces the formal group exponential. The subgroup has index $q^{m-1}$ in $F(\pi {\mathcal{O}}_K)$, where $q$ is the residue-field order.

For a one-dimensional commutative integral formal group law, the formal logarithm identifies $F(4{\mathbb{Z}}_2)$ with $4{\mathbb{Z}}_2$. This is an index-two subgroup of $F(2{\mathbb{Z}}_2)$. Choose a topological generator $h$ of the subgroup and an element $v$ outside it, and write $2v=ch$. If $c$ is odd, $v$ generates the whole group. If $c$ is even, $v-(c/2)h$ has order two and splits off a cyclic factor. The formal additive group and formal multiplicative group realize the two cases.

For odd $p$, a one-dimensional formal group law over ${\mathbb{Z}}_p$ has a formal logarithm ${\log }_F(T)=T+{\sum }_{j\ge 2}{c}_j{T}^j/j$ with $c_j\in {\mathbb{Z}}_p$. This follows by integrating its integral invariant differential. For $t\in p{\mathbb{Z}}_p\setminus \{0\}$, $v_p(c_j{t}^j/j)>v_p(t)$ for $j\ge 2$. Hence the series converges and $v_p({\log }_F(t))=v_p(t)$, so its kernel is zero. As it is a homomorphism into a characteristic-zero additive group, there is no nonzero torsion. In particular, at an odd prime of good reduction over $\mathbb{Q}$, reduction injects the whole rational torsion subgroup, including its $p$-primary part.

The formal group exponential is the compositional inverse of the formal logarithm. On a sufficiently small neighborhood over a characteristic-zero local field, both series converge and identify the formal group with the additive group.

The local parameter $z=-x/y$ at the identity of a Weierstrass curve expresses addition as a formal group law. Over a local field it describes points reducing to the identity.

For an elliptic curve over a local field with integral Minimal Weierstrass equation, let $E_0(K)$ consist of points with nonsingular reduction and let $E_1(K)$ be the kernel of $E_0(K)\to {\tilde{E}}_{\mathrm{ns}}(k)$. This definition also applies at a prime of bad reduction of an elliptic curve. The point at infinity is always smooth. With $t=-x/y$ and $w=-1/y$, the Weierstrass equation of an elliptic curve becomesThe unit linear coefficient in $w$ gives a unique integral formal power series $w(t)=t^3+O(t^4)$. Then $x=t/w$ and $y=-1/w$, so the nonidentity points of $E_1(K)$ have $v(x)=-2r$ and $v(y)=-3r$ for $r=v(t)>0$. The local parameter $t$ bijects $E_1(K)$ with ${\mathfrak{m}}_K$ and turns its addition into the formal group of an elliptic curve. At good reduction this agrees with the kernel of reduction of an elliptic curve.

A nonidentity rational point in the formal kernel of a minimal Weierstrass equation at two distinct primes has infinite order of a group element. Indeed, the prime-to-residue-characteristic multiplication on a formal group implies that a finite order in the kernel at $p$ must be a power of $p$. Membership in the kernel at a different prime $q$ also forces a power of $q$. The only common possibility is order one, contradicting nonidentity. For an integral model, negative valuations of the affine coordinates provide a convenient kernel-membership test.

For an integral short equation $y^2=x^3+ax+b$, negation acts on $t=-x/y$ by $t\mapsto -t$. Thus the integral formal multiplication series is odd: $[2](t)=2t+t^{3}g(t)$. If $v_2(t)=s\ge 1$, the leading term has valuation $s+1<3s$, so successive doubling never kills a nonzero point. Odd multiplication has unit linear coefficient. Combined with the formal logarithm at odd primes, this proves torsion-freeness of the formal identity neighbourhood at every prime for a short equation. The short-model hypothesis matters at two.

For $y^2=x^3+ax+b$, put $t=-x/y$ and $w=-1/y$. Then $x=t/w$, $y=-1/w$, and the curve equation becomesThere is a unique solution $w(t)\in t^{3}K[[t]]$, and points in the kernel of reduction correspond to parameters of positive valuation.

An isogeny $\varphi :E\to E^{\prime }$ sends the identity to the identity, so substituting the formal coordinates into $t^{\prime }=-x^{\prime }/y^{\prime }$ gives a series $f(t)\in tK[[t]]$. Compatibility with the elliptic-curve group laws givesmaking $f$ a morphism of formal group laws.

For an elliptic curve over a nonarchimedean local field, $E_0$ consists of points with nonsingular reduction, $E_1$ is the kernel of reduction, and $E_r$ for $r\ge 1$ consists of points whose formal parameter has valuation at least $r$. The successive quotients for $r\ge 1$ are copies of the additive residue-field group.

An isogeny is a nonconstant morphism of elliptic curves preserving their identity points. It is a finite surjective group homomorphism.

Elliptic curves isogenous over a finite field have the same number of rational points: the isogeny intertwines Frobenius, and multiplicativity of degree gives equal degrees for $1-\pi$. Their groups need not be isomorphic. Over ${\mathbb{F}}_7$, $y^2=x^3-x$ and $y^2=x^3+4x$ are two-isogenous and have groups $\mathbb{Z}/2\mathbb{Z}\times \mathbb{Z}/4\mathbb{Z}$ and $\mathbb{Z}/8\mathbb{Z}$, respectively.

The endomorphism ring of an elliptic curve consists of its self-isogenies together with the zero map, with pointwise addition and composition as multiplication.

The degree of an isogeny is the degree of its induced finite extension of function fields. On $\mathrm{End}(E)$ it is a quadratic form: $\mathrm{deg}(n\varphi )=n^2\mathrm{deg}\varphi$, and

The degree parallelogram identity for endomorphisms of an elliptic curve gives $d_{n+1}+d_{n-1}=2d_n+2$ for $d_n=\mathrm{deg}[n]$, with $d_0=0$ and $d_1=1$. Induction gives $d_n=n^2$ in every characteristic. A zero pullback on differentials therefore does not mean that multiplication is the zero morphism.

On the product of an elliptic curve with itself, let $D_{+}$ and $D_{-}$ be the diagonal and the graph of negation. The principal divisor of $x(P)-x(Q)$ is $D_{+}+D_{-}-2(\{O\}\times E)-2(E\times \{O\})$: equality of the coordinates means $Q=\pm P$, while $x$ has a double pole at $O$. Pulling back along $(\varphi ,\psi )$ and taking degrees proves the parallelogram law for the degree of an isogeny when $\varphi ,\psi$ are nonzero and $\varphi \ne \pm \psi$. The exceptional cases follow from $\mathrm{deg}[2]=4$. The same argument uses the quotient by negation in characteristic two. Thus degree, with degree zero assigned to the zero map, is a positive quadratic form on $\mathrm{Hom}(E_1,E_2)$.

For an isogeny of elliptic curves $\varphi :E_1\to E_2$, write $x_2\circ \varphi =A(x_1)/B(x_1)$ with coprime polynomials $A,B$. Each $x_i:E_i\to {\mathbb{P}}^1$ is a two-to-one finite morphism, and function field degrees multiply in a tower. Consequently $2\mathrm{deg}\varphi =2\max (\mathrm{deg}A,\mathrm{deg}B)$. This computes the total degree, including an inseparable factor. The zero homomorphism is assigned degree zero separately.

A separable isogeny is an isogeny whose induced extension of function fields is separable. Its degree equals the number of geometric points in its kernel.

A nonzero isogeny of elliptic curves is separable exactly when its pullback of an invariant differential on an elliptic curve is nonzero. For a map of smooth curves in characteristic $p$, a zero differential means the function-field extension has a nontrivial inseparable part. The criterion turns sums of elliptic endomorphisms into computations of their tangent scalars.

Vélu's formulas construct the quotient of a Weierstrass elliptic curve by a specified finite subgroup and give rational functions for the resulting separable isogeny.

For an isogeny $\varphi :E\to E^{\prime }$, its kernel is denoted $E[\varphi ]$. In characteristic zero its cardinality equals $\mathrm{deg}\varphi$.

The dual of an isogeny $\varphi :E\to E^{\prime }$ of degree $n$ is the unique isogeny $\hat{\varphi }:E^{\prime }\to E$ satisfying

For $\varphi \in \mathrm{End}(E)$, its trace is the integer characterized byEquivalently, $\mathrm{tr}(\varphi )=1+\mathrm{deg}\varphi -\mathrm{deg}(1-\varphi )$.

The characteristic equation ${\varphi }^2-[\mathrm{tr}\varphi ]\varphi +[\mathrm{deg}\varphi ]=0$ gives

For an elliptic curve over ${\mathbb{F}}_q$, the Frobenius isogeny sends $(x,y)$ to $(x^q,y^q)$. If $a=q+1-\#E({\mathbb{F}}_q)$, then

For an elliptic curve over ${\mathbb{F}}_q$, the trace of Frobenius isIt is the trace of the Frobenius isogeny of an elliptic curve on every prime-to-$q$ Tate module.

For odd $p$, let $y^2=f(x)$ be a nonsingular cubic Weierstrass equation of an elliptic curve over ${\mathbb{F}}_p$. Its Trace of Frobenius is $a_p=-{\sum }_x\chi (f(x))$, where $\chi$ is the Legendre symbol extended by $\chi (0)=0$. By the Euler criterion, reduce this sum to $f(x{)}^{(p-1)/2}$. The sum of a positive power $x^j$ over ${\mathbb{F}}_p$ is zero unless $p-1$ divides $j$, when it is $-1$. Since the polynomial has degree $3(p-1)/2<2(p-1)$, only its $x^{p-1}$ coefficient contributes.

If $\alpha ,\beta$ are the roots of $T^2-aT+q$, where $a=q+1-\#E({\mathbb{F}}_q)$, then

For an elliptic curve over a finite field of characteristic $p$, its rational-point group is finite and abelian. Prime-to-characteristic geometric torsion bounds every other prime-torsion dimension by two. Multiplication by $p$ has degree $p^2$ and inseparable degree at least $p$, so the $p$-torsion dimension is at most one. The structure theorem for finite abelian groups therefore gives two cyclic factors with $m\mid n$ and $p\nmid m$.

For odd $p$ and $k\not\equiv 0(\mathrm{mod}p)$, take $E:y^2=x^3+kx$. If $p\equiv 3(\mathrm{mod}4)$, pairing $x$ with $-x$ cancels the Legendre symbols. If $p\equiv 1(\mathrm{mod}4)$, the coefficient formula for trace of Frobenius modulo p givesThe binomial coefficient is nonzero because every factorial involved is shorter than $p$. Thus the Trace of Frobenius is not zero in the second case.

For an elliptic curve over ${\mathbb{F}}_p$, put $N=\#E({\mathbb{F}}_p)$ and $a=p+1-N$. The trace of the square of an elliptic-curve endomorphism gives $\mathrm{tr}({\pi }^2)=a^2-2p$ for the Frobenius isogeny. Therefore $\#E({\mathbb{F}}_{p^2})=p^2+1-a^2+2p=N(2p+2-N)$.

For $E:y^2=x^3-x-1$ over ${\mathbb{F}}_3$, the Trace of Frobenius is three andIn particular, $\#E({\mathbb{F}}_{3^r})=3^r+1$ exactly when $r\equiv 3(\mathrm{mod}6)$.

For an elliptic curve over ${\mathbb{F}}_q$,

For Frobenius $\pi$, put $a=\mathrm{tr}(\pi )$ and note that $\mathrm{deg}\pi =q$. Nonnegativity of the quadratic formfor all integers $m,n$ forces its discriminant to be nonpositive, so $a^2\le 4q$. Since $\#E({\mathbb{F}}_q)=\mathrm{deg}(1-\pi )=q+1-a$, this is the Hasse bound.

If $a=q+1-\#E({\mathbb{F}}_q)$, then

If $1-aT+q{T}^2=(1-\alpha T)(1-\beta T)$ is the numerator of the zeta function, the Riemann hypothesis in this case is $|\alpha |=|\beta |=\sqrt{q}$. It is equivalent to the Hasse theorem for elliptic curves.

The $n$-torsion subgroup $E[n]$ is the kernel of multiplication by $n$. When the characteristic does not divide $n$, it is isomorphic over an algebraic closure to $(\mathbb{Z}/n\mathbb{Z}{)}^2$.

If $\ell$ is a prime different from the characteristic, multiplication by $\ell$ on an elliptic curve has degree ${\ell }^2$ and nonzero differential. It is a separable isogeny, so its geometric kernel has ${\ell }^2$ points, all killed by $\ell$. This gives the displayed group over an algebraic closure; the rational subgroup over the base field may be smaller.

For integral $m\ge 2$, suppose $E:y^2=x(x+1)(x+m^2)$ has good reduction at five or seven. At five, $m^2\equiv 4$; at seven, $m^2\equiv 2$ or $4$. Each resulting reduced elliptic curve has eight points. These restrictions follow from $\Delta =16m^4(m^2-1{)}^2$ and $c_4=16(m^4-m^2+1)$: if an odd prime divides $m(m^2-1)$, the j-invariant of an elliptic curve has negative valuation. The torsion-freeness of the formal group over Qp for odd p bounds the whole rational torsion by eight. The point $(m,m(m+1))$ doubles to $(0,0)$, and $(-1,0)$ is an independent 2-torsion point. These generate the stated group of order eight.

For positive integral $k$, the rational torsion subgroup of $y^2=x^3+kx$ has order dividing four. Indeed, torsion-freeness of the formal group over Qp for odd p, reduction of torsion points on an elliptic curve, and the point-count criterion for y squared equals x cubed plus k x bound its order by $p+1$ at all good primes $p\equiv 3(\mathrm{mod}4)$. The Dirichlet theorem on primes in arithmetic progressions excludes every odd torsion prime and bounds the two-primary part by four, by choosing $p\equiv 3(\mathrm{mod}8)$. There is exactly one nonzero rational 2-torsion point, namely $(0,0)$. A rational half of it must have $x^2=k$ by the elliptic-curve addition formula. Writing $k=s^2$ with $s>0$, its equation is $y^2=2s^3$, so $s=2t^2$ and $k=4t^4$. Conversely $(2t^2,4t^3)$ has order four. Thus the cyclic group of order four occurs exactly for $k=4t^4$, $t\ge 1$. The order bound itself holds for every nonzero integral $k$ of either sign: positivity was used only to classify the rational points of orders two and four.

On a Weierstrass equation $y^2=f(x)$ in characteristic other than two, the nonidentity 2-torsion points are exactly $(r,0)$ for the roots $r$ of $f$.