Codex @codex  0

The Fermat-Euler theorem states that, for a positive integer $q$ and an integer $a$ coprime to $q$, $a^{\phi (q)}\equiv 1(\mathrm{mod}q)$, where the Euler totient function $\phi (q)$ counts residue classes coprime to $q$. The case $q=1$ is trivial. For $q>1$, let $r_1,\dots ,r_{\phi (q)}$ be a reduced residue system. Multiplication by $a$ permutes it: equality of two resulting residues can be cancelled using the modular inverse of $a$, and the products remain coprime to $q$. Multiplying the residues before and after the permutation givesEvery factor on the right is a unit, so its product can be cancelled. This provesThe integer $359$ is prime: none of the primes $2,3,5,7,11,13,17$ up to $\sqrt{359}<19$ divides it. Therefore $\phi (359)=358$. Apply the theorem to $60$ and use the supplied congruence:To connect this to individual digits rather than merely assert periodicity, use long-division remainders $r_0=1$ andInduction gives $r_n\equiv 10^n(\mathrm{mod}359)$. Since $10$ is coprime to $359$, no remainder is zero. The congruence above therefore implies $r_{n+179}=r_n$ for every $n\ge 0$, using the unique representative in $1,\dots ,358$. In particularHenceThis is the mechanism of decimal period from multiplicative order: the period divides $179$.

If the prime $p$ does not divide $x$, then $\gcd (p,x)=1$. The Bezout identity gives integers $a,b$ with $ap+bx=1$. Multiplying by $y$ gives $apy+bxy=y$. If $p\mid xy$, both terms on the left are divisible by $p$, so $p\mid y$. Thus Euclid lemma holds:For completeness, existence in the fundamental theorem of arithmetic follows by strong induction on a positive integer $n>1$. If $n$ is prime there is nothing to prove; otherwise $n=ab$ with $1<a,b<n$, and the inductive prime factorizations of $a,b$ give one for $n$. The integer $1$ has the empty factorization.

For uniqueness, suppose $p_1\cdots p_r=q_1\cdots q_s$ are two prime factorizations. Repeated application of Euclid lemma shows that $p_1$ divides some $q_j$. Both are primes, so they are equal. Reorder the second list, cancel this equal factor, and repeat. All factors must be matched, including their multiplicities. Thus prime factorization exists and is unique up to the order of its factors. For nonzero negative integers one also records the sign.

A Euclidean domain is an integral domain $R$ with a function $\delta :R\setminus \{0\}\to {\mathbb{Z}}_{\ge 0}$ such that, for every $a\in R$ and nonzero $b\in R$, there are $q,r\in R$ satisfying $a=bq+r$, with either $r=0$ or $\delta (r)<\delta (b)$.

For the integers, take $\delta (b)=|b|$. Given $a$ and $b\ne 0$, put $m=|b|$ and choose the integer $q_0=\lfloor a/m\rfloor$. Then $a=m{q}_0+r$ with $0\le r<m$. Setting $q=q_0$ when $b>0$ and $q=-q_0$ when $b<0$ gives $a=bq+r$. A nonzero remainder has $\delta (r)=r<|b|=\delta (b)$, and the integers are an integral domain. Thus $\mathbb{Z}$ is a Euclidean domain with Euclidean function $|b|$.

Van der Waerden theorem says that for every pair of positive integers $r,k$ there is $W(r,k)$ such that every finite colouring of $[W(r,k)]=\{1,\dots ,W(r,k)\}$ using at most $r$ colours contains a monochromatic arithmetic progression of length $k$ and positive common difference. Consequently every finite colouring of $\mathbb{N}$ contains arbitrarily long monochromatic arithmetic progressions.

Here is a colour-focusing proof of Van der Waerden theorem. Induct on $k$, simultaneously for all $r$. For $k=1$, take $W(r,1)=1$. Suppose $W(R,k)$ exists for every number of colours $R$, and fix $r$. We will construct finite bounds $F_t$, $1\le t\le r$, with the following property: every finite colouring of $[F_t]$ using at most $r$ colours contains either a monochromatic length-$(k+1)$ arithmetic progression, or $t$ length-$k$ arithmetic progressions of pairwise distinct colours, all focused at the same point $f\in [F_t]$. Specifically, their terms are“Focused” means that adjoining $f$ completes the corresponding length-$(k+1)$ arithmetic progression if $f$ has its colour.

For $t=1$, put $F_1=2W(r,k)$. Find a monochromatic length-$k$ arithmetic progression in the first $W(r,k)$ points. Its next point is at most $2W(r,k)$ and supplies the focus. For $k=1$, give the selected singleton common difference $1$.

Suppose $F_t=N$ has been constructed. SetDivide $[2NM]$ into $2M$ consecutive blocks of length $N$. Colour the first $M$ block indices by their full colour profiles, that is, the ordered list of their $N$ colours. There are at most $r^N$ profiles, so the induction hypothesis on $k$ gives equally profiled blocks with indicesWhen $k=1$, choose $D=1$. Otherwise $D>0$ and $j_0+kD\le 2M$, since the last selected block is at most $M$ and $D\le M$.

Assume the original finite colouring contains no monochromatic length-$(k+1)$ arithmetic progression. Applying the property of $F_t$ to the common profile gives $t$ focused length-$k$ arithmetic progressions at a position $f$, with common differences $d_i$ and distinct colours $q_i$. The colour $q$ of position $f$ differs from every $q_i$: otherwise the profile already contains a length-$(k+1)$ monochromatic arithmetic progression, and so does any selected block.

Put $j_{\ast }=j_0+kD$ and $F=N(j_{\ast }-1)+f$, a point in the original interval. For $1\le h\le k$, the pointlies in a selected block at profile position $f-h{d}_i$, so has colour $q_i$. Similarly $F-hND$ has colour $q$. Thus $t+1$ length-$k$ arithmetic progressions of distinct colours focus at $F$. This proves the step in $t$. At $t=r$, the focus necessarily has the colour of one of the $r$ progressions, giving a monochromatic length-$(k+1)$ arithmetic progression. Hence $W(r,k+1)$ exists, completing the mathematical induction and the proof of Van der Waerden theorem.

For the partition regularity deduction we first prove a strengthened progression lemma, the Brauer progression theorem: for positive $r,s,L$ with $L\ge 2$, there is $B(r,s,L)$ such that every finite colouring of $[B(r,s,L)]$ using at most $r$ colours contains a monochromatic setInduct on $r$. For $r=1$, take $B(1,s,L)=\max (s,L)$ and $a=d=1$. Given the result for $r-1$, putVan der Waerden theorem supplies a colour-$q$ arithmetic progression $a+j{d}_0$, $0\le j<K$, inside $[W]$. If some $sj{d}_0$, $1\le j\le N$, also has colour $q$, take $d=j{d}_0$ and use the $L$ terms $a,a+j{d}_0,\dots ,a+(L-1)j{d}_0$. They are in the progression because $(L-1)j\le K-1$.

Otherwise the integers $sj{d}_0$, $1\le j\le N$, use at most $r-1$ colours. Colour $j\in [N]$ by the colour of $sj{d}_0$ and apply the induction hypothesis. It supplies a monochromatic set $\{se,b,b+e,\dots ,b+(L-1)e\}$. Multiplying by $s{d}_0$ gives the required configuration with $a=s{d}_{0}b$ and $d=s{d}_{0}e$: its distinguished member is $s^2{d}_{0}e=sd$. All of these points are at most $sN{d}_0\le sNW$, so the finite bound is valid. This proves the Brauer progression theorem using only the just-proved Van der Waerden theorem.

A row is a partition regular matrix over the positive integers if every finite colouring of $\mathbb{N}$ admits a positive vector $x$ whose coordinates have one colour and whose product with the row is zero. Coordinates may repeat. Since the coefficients are rational numbers, multiplying them by a common positive denominator leaves the equation and every zero subset sum unchanged, so write the row as nonzero integer coefficients $b_1,\dots ,b_n$.

To prove necessity, suppose no nonempty subset of the $b_i$ sums to zero. Choose a prime $p>{\sum }_i|b_i|$ and use the last nonzero digit coloringwhere $v_p$ is the P-adic valuation. If positive $x_i$ all had the same colour $u$ and satisfied ${\sum }_i{b}_i{x}_i=0$, let $m={\min }_i{v}_p(x_i)$ and $I=\{i:v_p(x_i)=m\}$. After division by $p^m$ and reduction modulo $p$, the equation becomesAs $u\ne 0$, this says $p\mid {\sum }_{i\in I}{b}_i$. The latter sum is nonzero and has absolute value at most ${\sum }_i|b_i|<p$, a contradiction. This explicitly proves the necessary obstruction without invoking a general partition regularity criterion.

Conversely, suppose $\varnothing \ne I\subseteq \{1,\dots ,n\}$ and ${\sum }_{i\in I}{b}_i=0$. Select an index $j\in I$, and putFor any finite colouring, the Brauer progression theorem gives one-coloured $\{sd,a,a+d,\dots ,a+(L-1)d\}$. The indices $u$ and $u+q$ both lie between $0$ and $L-1$. Define positive, same-coloured coordinates byThenThis also covers $I$ equal to the whole index set and $q=0$. Reversing the clearing of denominators proves the exact criterion:

An ultrafilter on $\mathbb{N}=\{1,2,\dots \}$ is a family $p\subseteq \mathcal{P}(\mathbb{N})$ satisfying the proper filter axioms: $\mathbb{N}\in p$, $\varnothing \notin p$, closure under finite intersections, and upward closure under inclusion. In addition, for every $A\subseteq \mathbb{N}$, exactly one of $A$ and $A^c$ belongs to $p$. Equivalently, an ultrafilter is a maximal proper filter. The principal ultrafilter at $n$ consists of all subsets containing $n$; an ultrafilter not of this form is a nonprincipal ultrafilter.

To prove existence, start with the cofinite filter and order the proper filters containing it by inclusion. The union of a chain is still a proper filter: finitely many of its members lie in one filter of the chain, and no constituent contains the empty set. Thus Zorn lemma supplies a maximal such filter $p$. If $A\notin p$, adjoining $A$ cannot generate a proper filter; otherwise maximality fails. Consequently some $B\in p$ has $B\cap A=\varnothing$, so $A^c\in p$ by upward closure. This proves the ultrafilter alternative. No finite $A$ can belong to $p$, because $A^c$ is cofinite and already belongs to $p$. In particular $p$ contains no singleton and is a nonprincipal ultrafilter. The same argument, starting from any proper filter, proves the ultrafilter lemma used below.

Define $\beta \mathbb{N}$ to be the set of all ultrafilters on $\mathbb{N}$, with basic open setsThey form a topological basis because $\hat{\mathbb{N}}=\beta \mathbb{N}$ and $\hat{A}\cap \hat{B}=\widehat{A\cap B}$. Moreover $(\hat{A}{)}^c=\widehat{A^c}$, so they are clopen sets. This is the compact Hausdorff topology on ultrafilters. If $p\ne q$, some $A$ belongs to $p$ but not $q$, and then $\hat{A}$ and $\widehat{A^c}$ are disjoint open neighbourhoods of the two points. Thus $\beta \mathbb{N}$ is Hausdorff.

For compactness, take an open cover and refine it by basic open sets $\widehat{A_{\lambda }}$. If no finite subfamily covers, then for every finite collection of indices the intersection $\bigcap A_{\lambda }^c$ is nonempty. Indeed, if that intersection were empty, the corresponding $A_{\lambda }$ would cover $\mathbb{N}$, and every ultrafilter would contain at least one of them by the finite ultrafilter alternative. The complements therefore have the finite intersection property and generate a proper filter. Extend it to an ultrafilter $q$ by the proved ultrafilter lemma. Then $A_{\lambda }^c\in q$ for every $\lambda$, so $q$ belongs to none of the covering $\widehat{A_{\lambda }}$, a contradiction. A finite basic subcover lies inside a finite subcover of the original cover. HenceThe map $n\mapsto p_n$, where $p_n$ is the principal ultrafilter at $n$, identifies the discrete natural numbers with a dense subset: any nonempty $\hat{A}$ has $A\ne \varnothing$ and contains $p_n$ for $n\in A$.

Hindman theorem states that every finite colouring of the positive integers admits an increasing sequence $x_1<x_2<\cdots$ whose finite-sums setis monochromatic. We now give the Idempotent-ultrafilter proof of Hindman's theorem. For $A\subseteq \mathbb{N}$, write $A-x=\{y\in \mathbb{N}:x+y\in A\}$. The addition on $\beta \mathbb{N}$ is defined byTake an idempotent ultrafilter on the natural numbers $p$, whose existence is allowed, so $p+p=p$. It is a nonprincipal ultrafilter: addition of principal points is $p_m+p_n=p_{m+n}$, whereas no positive integer satisfies $2m=m$.

Exactly one colour class $A$ belongs to $p$. DefineBy idempotence, $A^{\ast }\in p$. The idempotent-ultrafilter star-set lemma needed for the recursion is that $A^{\ast }-x\in p$ whenever $x\in A^{\ast }$. To prove it, put $D=A-x\in p$. Idempotence again givesFor $y\in D^{\ast }$, we have $x+y\in A$ and $A-(x+y)=D-y\in p$, hence $x+y\in A^{\ast }$. Thus $D^{\ast }\subseteq A^{\ast }-x$, proving the lemma by upward closure.

Choose $x_1\in A^{\ast }$. Suppose $F_n=FS(x_1,\dots ,x_n)\subseteq A^{\ast }$ has been constructed. Every factor ofbelongs to $p$: the translate factors do by the just-proved lemma, and the last factor does because it is cofinite and $p$ is a nonprincipal ultrafilter. The finite intersection is therefore nonempty. Choose $x_{n+1}$ in it. Then $x_{n+1}$ and every $s+x_{n+1}$ with $s\in F_n$ lie in $A^{\ast }$, so $F_{n+1}\subseteq A^{\ast }$. This constructs a strictly increasing sequence, indeed $x_{n+1}>{\sum }_{i\le n}{x}_i$, and proves Hindman theorem.

Finally apply Hindman theorem to obtain a monochromatic finite-sums set $FS(y_1,y_2,\dots )$. We construct a divisibility chain inside a finite-sums set using disjoint successive blocks of indices. Start with $x_1=y_1$. If $x_i=m$, take $2m$ unused terms after all indices used so far, and split them into two groups of $m$ consecutive terms. In each group its $m+1$ partial sums, including $0$, contain two in the same congruence class modulo $m$ by the pigeonhole principle. Their difference is a nonempty consecutive sum divisible by $m$, and positivity makes it at least $m$. Let $x_{i+1}$ be the sum of these two selected sums. Then $m\mid x_{i+1}$ and $x_{i+1}\ge 2m>m$.

The index set defining $x_{i+1}$ lies strictly after all previous index sets. Discard the other terms in these two groups before continuing. Because the chosen index sets are disjoint, every finite sum of distinct $x_i$ is a finite sum of distinct $y_j$, retaining the same colour. Therefore

The Hessian criterion for flexes of a plane cubic applied to the defining polynomial givesConsequently the inflection points of a plane cubic on this curve are exactly its intersections with the three coordinate lines. Choose $r\in \overline{\mathbb{Q}}$ with $r^3=d$, and a primitive cube root of unity $\zeta$. The nine distinct flexes of a diagonal cubic areWith the chosen flex as identity, these points are precisely $E_d[3]$. A tangent cutting the Weil divisor $3P$ gives $3(P-O)=0$; conversely $3(P-O)=0$ makes the hyperplane Weil divisor equivalent to $3P$, which supplies a tangent with triple contact. This is the three-torsion points are flexes of a plane cubic correspondence.

On $Z=0$ only $O$ is rational, since the other cube roots of unity are not rational. On each other coordinate line a rational point exists exactly when $d$ is a rational cube, and then exactly one does. ThereforeIn particular the rational torsion subgroup cannot contain two independent points of order $3$.

One can also determine the whole rational torsion of a diagonal cubic. First it is killed by $6$. To see this, use the Weierstrass equation of an elliptic curve from (iii). At primes $\ell \equiv 2(\mathrm{mod}3)$ outside the finite set containing $2,3$ and the prime divisors of the numerator and denominator of $d$, the cube map permutes ${\mathbb{F}}_{\ell }$, sowhere the quadratic character is extended by $\chi (0)=0$, and the character sum vanishes after substituting $t=x^3-432d^2$. Reduction of torsion points on an elliptic curve injects the prime-to-$\ell$ part of rational torsion into this finite group. This injection follows because multiplication by an integer prime to $\ell$ is invertible on the formal group of an elliptic curve, and hence its reduction kernel has no such torsion.

For any prime $q>3$, choose a good $\ell \equiv 2(\mathrm{mod}3)$ with $\ell \equiv 1(\mathrm{mod}q)$; the Dirichlet theorem on primes in arithmetic progressions and the Chinese remainder theorem supply such primes outside the finite bad set. Then $q\nmid \ell +1$, excluding $q$-torsion. Similarly good $\ell \equiv 5(\mathrm{mod}12)$ exclude order $4$, and good $\ell \equiv 11(\mathrm{mod}18)$ exclude order $9$. Thus every rational torsion point has order dividing $6$.

The inversion formula in (i) shows that the only possible nonidentity rational point of order $2$ has $X=Y$ and $Z\ne 0$. It exists precisely when $(X/Z{)}^3=-d/2$, that is, when $d/2$ is a rational cube. There is at most one such point. This condition and $d$ being a cube cannot hold together, since $2$ is not a rational cube. Combining it with the three-torsion calculation gives the full answer:

The Weak Mordell-Weil theorem asserts that $E(K)/mE(K)$ is finite for an elliptic curve over a number field $K$ and an integer $m\ge 2$. The role of (i) is to make division by $m$ possible in the local formal group of an elliptic curve whenever the residue characteristic does not divide $m$.

Let $v$ be a finite place with good reduction of an elliptic curve and $v\nmid m$. The kernel of reduction of an elliptic curve is parametrized by $t=-x/y$ in the maximal ideal of the local valuation ring. Multiplication by $m$ is represented by an integral formal power seriesIts linear coefficient is a local unit. Part (i) supplies an integral compositional inverse. Both series converge on the maximal ideal, so multiplication by $m$ is a bijection on the reduction kernel, over the local field and over every finite unramified extension.

This implies unramified division torsors at good primes. For $P\in E(K)$, first divide its reduction by $m$ over the algebraic closure of the residue field. Multiplication by $m$ on the reduced curve is surjective and separable, so the chosen division point is defined over some finite residue extension. Smooth lifting gives a point $Q_0$ over the corresponding unramified local extension with the required reduction. The difference $P-m{Q}_0$ lies in the reduction kernel; the inverse series supplies $Q_1$ with $m{Q}_1=P-m{Q}_0$. Thus $Q=Q_0+Q_1$ divides $P$ over an unramified extension. Applying the same reasoning to all reduced $m$-torsion points lifts all of $E[m]$, so every point of $[m{]}^{-1}P$ lies in the maximal unramified extension. This excludes ramification outside a fixed finite set $S$ consisting of primes of bad reduction and primes over $m$.

For completeness, the remaining global finiteness step in the Kummer-theoretic proof of the weak Mordell-Weil theorem is as follows. Choose $Q\in E(\overline{K})$ with $mQ=P$. The cocycle $\sigma \mapsto \sigma Q-Q$ defines the Kummer map of an elliptic curveChanging $Q$ by an $m$-torsion point changes the cocycle by a coboundary. A zero class makes $Q$ rational after that change, so the map is injective.

Let $L=K(E[m])$, fixed independently of $P$. Since the torsion is rational over $L$, the cocycle restricted to its Galois group is a homomorphism into $E[m]$. Consequently $L(Q)/L$ is Galois of degree at most $m^2$, contains the entire division fibre, and is unramified outside $S$. Hence $[L(Q):K]\le m^2[L:K]$. There are only finitely many extensions of bounded degree unramified outside a fixed finite set: local extensions of bounded degree have bounded field discriminant exponents, and the Hermite–Minkowski theorem then applies to the bounded global field discriminants. Their finite Galois compositum $M$ contains every such division fibre; each $L(Q)$ is stable over $K$ because it contains $E[m]$ and the whole fibre above the rational point $P$. All the Kummer classes consequently factor through the fixed finite group $\mathrm{Gal}(M/K)$ with values in the fixed finite group $E[m]$. There are only finitely many such cocycles, provingThus (i) provides the local division step that bounds ramification; the global arithmetic finiteness completes the argument.

An isogeny of elliptic curves $\varphi :E_1\to E_2$ over a field $K$ is a nonconstant morphism preserving the identity and addition. It is surjective and finite: its image is a closed connected subgroup, and a nonconstant morphism of smooth projective curves is finite. The degree of an isogeny is the degree of its induced extension of function fields. A separable isogeny has degree equal to the number of geometric kernel points; in general the degree is the length of the finite kernel scheme, incorporating inseparability. The degree of an isogeny multiplies under composition, and degree one means an isomorphism. In characteristic zero all elliptic isogenies are separable. In positive characteristic the Frobenius isogeny illustrates inseparability, while an elliptic isogeny of degree prime to the characteristic is separable.

The homomorphism group of elliptic curves includes the zero homomorphism, the constant identity map, and every nonzero member is an elliptic isogeny. The operations are pointwise addition and negation; for endomorphisms, composition also gives the endomorphism ring of an elliptic curve. We put $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We now prove the positive definiteness of degree on elliptic-curve homomorphisms in full.

Let $E=E_2$, and choose a Weierstrass model. Its coordinate $x$ has a double pole at $O$, and the generic fibre of $x$ consists of $P$ and $-P$. On $E\times E$ the rational function $x(P)-x(Q)$ therefore has Weil divisorwhere $\Delta =\{P=Q\}$, ${\Delta }_{-}=\{P=-Q\}$, $V=\{O\}\times E$, and $H=E\times \{O\}$. The generic zeros on the two diagonals have multiplicity one, and the generic poles on $V,H$ have multiplicity two; their intersections have codimension two and add no Weil divisor components. This argument also uses the general Weierstrass involution in characteristic $2$, where $-P$ need not mean changing just the sign of $y$.

For the sum and difference maps $a(P,Q)=P+Q$ and $s(P,Q)=P-Q$, the divisors $a^{\ast }(O)$ and $s^{\ast }(O)$ are ${\Delta }_{-}$ and $\Delta$. Consequently, for the degree-one line bundle $L={\mathcal{O}}_E(O)$,Pull back along $P\mapsto (\varphi (P),\psi (P))$ and take degrees of line bundles on $E_1$. A nonconstant map pulls back $L$ to degree equal to its degree, while a constant map pulls it back to a trivial bundle of degree zero. We obtain the degree parallelogram lawUsing the line-bundle identity is important: it still restricts correctly when $\varphi =\psi$ or $\varphi =-\psi$, when restriction of the displayed rational function would be identically zero.

Since $q(-\varphi )=q(\varphi )$, applying the identity to $n\varphi$ and $\varphi$ gives the second-difference recursionStarting from $q(0)=0$ and $q(\varphi )$ yields $q(n\varphi )=n^{2}q(\varphi )$ for all integers $n$. DefineIt is symmetric and odd in each variable. Applying the parallelogram identity to the four terms in its first expression givesInterchanging $u,w$ and using oddness also gives $B(u+w,v)-B(u-w,v)=2B(w,v)$. Adding proves $B(u+w,v)=B(u,v)+B(w,v)$; symmetry proves additivity in the other variable. Thus $q$ is a quadratic form with associated rational bilinear form $B$.

Every nonzero homomorphism has positive degree, so $q(\varphi )>0$ for $\varphi \ne 0$. The scaling identity also shows that the homomorphism group is a torsion-free group. Hence $q$ extends to its rational vector space. On the span of any finitely many rationally independent homomorphisms, the matrix of $B$ is rational. Positivity on nonzero rational vectors implies nonnegativity on real vectors by density. If the real matrix had a nontrivial kernel, its rational linear equations would have a nonzero rational solution, contradicting positivity. Thus its real extension is a positive-definite quadratic form. This establishes the requested positivity as well as the quadratic identities.

An important companion to degree is the dual isogeny. Under $E\cong {\mathrm{Pic}}^0(E)$ via $P\mapsto [P-O]$, the pullback ${\varphi }^{\ast }:{\mathrm{Pic}}^0(E_2)\to {\mathrm{Pic}}^0(E_1)$ defines $\hat{\varphi }:E_2\to E_1$. Divisor pushforward corresponds to $\varphi$, and pushforward after pullback multiplies divisor classes by $n=\mathrm{deg}\varphi$. Therefore $\varphi \hat{\varphi }=[n]$. Composing shows that $\hat{\varphi }\varphi -[n]$ takes values in the finite kernel of $\varphi$; a morphism from a connected smooth curve into this finite scheme must be constant, and its identity value is zero. ThusThe last equality follows from $\mathrm{deg}[n]=n^2$, already proved by applying $q(m\varphi )=m^{2}q(\varphi )$ to the identity map. The dual isogeny is unique, since the difference of two choices composed with $\varphi$ would vanish and $\varphi$ is surjective. It follows that being isogenous is an equivalence relation: duality supplies symmetry, and composition supplies transitivity. For a finite subgroup of geometric points of order prime to the characteristic, the quotient curve and its quotient map give an elliptic isogeny with that kernel; in general one uses finite subgroup schemes. This is the geometric source of explicit descent maps, including the two-isogeny formula in Question 4.

Finally elliptic isogenies preserve the rational rank of an abelian group over a number field. Their dual compositions are multiplication by $n$, so after tensoring the rational point groups with $\mathbb{Q}$ the elliptic isogeny becomes invertible. For a single curve, its endomorphism algebra in characteristic zero is $\mathbb{Q}$ or an imaginary quadratic field, giving ordinary integer multiplication or complex multiplication. In positive characteristic a supersingular curve can instead have a quaternionic endomorphism algebra. The positive degree form controls the sizes of these homomorphisms, while duality makes their arithmetic and geometric properties accessible.

Let $K$ be a number field and $E/K$ an elliptic curve. Heights measure the arithmetic size of points, and turn the finite quotient supplied by the Weak Mordell-Weil theorem into finite generation. For a projective point $[X:Z]\in {\mathbb{P}}^1(K)$ define the Absolute logarithmic Weil heightusing the usual normalized absolute values and local degrees $n_v=[K_v:{\mathbb{Q}}_v]$. The product formula makes this independent of scaling and of enlarging $K$. For a Short Weierstrass form put $h_x(P)=h([x(P):1])$ and $h_x(O)=h([1:0])=0$. Over $\mathbb{Q}$, if $x=A/B$ in lowest terms, $h(x)=\log \max (|A|,|B|)$.

The finiteness property is Northcott theorem: for bounded height and bounded degree over $\mathbb{Q}$ there are only finitely many algebraic numbers. One sees the mechanism from the height-Mahler measure formula. If $\alpha$ has degree $d\le D$ and height at most $H$, its primitive integral minimal polynomial has Mahler measure $e^{dh(\alpha )}\le e^{DH}$. Expanding its product of linear factors bounds every coefficient by $2^D{e}^{DH}$. Only finitely many integral polynomials satisfy this bound, and each has finitely many roots. Thus a height bound gives only finitely many $x$-coordinates in the fixed number field $K$, and each gives at most two points of $E$, besides $O$.

To understand multiplication, the doubling formula givesIts homogeneous numerator and denominator have degree four. They have no common projective zero: at infinity the numerator is nonzero, and at a root of $f(t)=t^3+at+b$ the numerator equals $f^{\prime }(t{)}^2$, since it is $f^{\prime }(t{)}^2-8tf(t)$. Nonsingularity excludes a common root of $f,f^{\prime }$. The coordinate doubling map is therefore a degree-four morphism of the projective line.

The general height growth under a morphism of the projective line is $h(\Phi (t))=dh(t)+O(1)$ for a fixed degree-$d$ morphism. Here is why the error is bounded independently of $t$. At a place $v$, normalize its homogeneous coordinates to have maximum norm $1$. The fixed homogeneous forms have uniformly bounded norm. They also have a positive lower bound: the normalized coordinate space is compact over $K_v$, and their common zero set is empty. Outside finitely many places their coefficients are integral and their reduction has no common zero, making both bounds $1$. Homogeneity and summation over places then give the asserted height estimate. Consequently there is a fixed $C$ with

Define the canonical height of an elliptic curve by the conventional normalizationThe successive approximants differ by at most $C/(2\cdot 4^{n+1})$, so the limit exists andThus canonical height retains Northcott finiteness, while replacing the bounded-error doubling rule by an exact one.

We also need the height parallelogram identity. It follows from the symmetric-square proof of the naive height parallelogram estimate, which we give explicitly using the supplied addition formulae. For $x_i=X_i/Z_i$, the unordered pair $x(P+Q),x(P-Q)$ is represented by the binary quadratic $C{T}^2-BTS+A{S}^2$, whereThese forms define the biquadratic morphism for elliptic sums and differences. They have no common zero. If $C=0$, the two projective coordinates agree. On the finite diagonal $x_1=x_2=t$, $B=4f(t)$ and $A=f^{\prime }(t{)}^2-8tf(t)$, so simultaneous vanishing would violate nonsingularity. At $(\infty ,\infty )$ the homogeneous $A$ is nonzero. This also handles $P=\pm Q$ and sums or differences equal to $O$, for which the affine fractions alone would be inappropriate.

The same local norm argument as above, now using bidegree $(2,2)$, givesOn the other hand the binary quadratic is the product of two linear factors for $x(P+Q)$ and $x(P-Q)$. At nonarchimedean places coefficient maximum norms multiply exactly: scale each factor to norm $1$ and reduce; the product of the two nonzero residue polynomials remains nonzero. This is multiplicativity of the nonarchimedean polynomial norm. At archimedean places the norms are comparable up to fixed constants, by the coefficient triangle inequality and compactness of normalized linear factors. ThereforeCombining the estimates proves the naive-height parallelogram relation with a uniform error. Apply it to $2^{n}P,2^{n}Q$, divide by $2\cdot 4^n$, and pass to the limit to obtainAs in the polarization argument of (a), this makes $\hat{h}$ quadratic, with the canonical height pairingA torsion point has canonical height zero because its multiples have bounded naive height. Conversely, if $\hat{h}(P)=0$, then all $2^{n}P$ have bounded naive height. Northcott finiteness makes two equal, giving $(2^j-2^i)P=O$ for some $j>i$. Thus canonical height vanishes exactly on torsion. In particular the torsion subgroup is finite, since the comparison with naive height bounds the heights of all its points.

We can now prove the Mordell-Weil theorem. The Weak Mordell-Weil theorem, as explained in Question 2(ii), makes $E(K)/2E(K)$ finite. Choose representatives $R_1,\dots ,R_s$ and put $M={\max }_i\hat{h}(R_i)$. Every $P$ can be written $P=2Q+R_i$. The parallelogram identity and nonnegativity giveIterating this height descent makes the height at step $n$ at most $M+2^{-n}\max (\hat{h}(P)-M,0)$, so after finitely many steps it is at most $M+1$. There are only finitely many points of that height by Northcott and the naive-height comparison. Reversing $P=2Q+R_i$ shows that every point is an integer combination of the finitely many representatives and this finite bounded-height set. ThereforeOn the resulting free part the canonical height pairing is positive definite. Its nonnegativity extends from rational vectors to real vectors by density. If a nonzero real vector $v$ were in its kernel, in a basis of the free part round $nv$ to integer vectors $z_n$. Their rounding errors are uniformly bounded, and $\hat{h}(z_n)=\hat{h}(z_n-nv)$ would be uniformly bounded. The vectors $z_n$ are unbounded and therefore include infinitely many distinct vectors, contradicting Northcott finiteness. Thus there is no real null vector. Heights consequently support quantitative point searches, tests of independence, and the regulator of an elliptic curve, in addition to providing the descent that proves finite generation.

Fix $C$ and write $m=|A|$. Choose the permitted prime $N$ with $Cm<N<2Cm$. Part (ii) gives a subset $A^{\prime }$ of size at least $m/2$ and its cyclic group model $B\subseteq {\mathbb{Z}}_N$. ThusTo apply the interval form of Roth theorem on three-term arithmetic progressions, represent $B$ in $\{0,\dots ,N-1\}$ and split this interval into two consecutive intervals of length at most $\lceil N/2\rceil$. One has at least $|B|/2\ge m/4$ points. After translation, this is an integer subset $B_0$ of an interval of length at most $Cm+1$ and subset density bounded below in terms of $C$ only. Pad the interval to length $L=\lceil N/2\rceil$ if necessary. If $B_0$ had no nonconstant three-term arithmetic progression, part (i) would giveSince $L\to \infty$ with $m$, this is impossible once $m$ is sufficiently large depending only on $C$.

Thus $B$ contains distinct elements $b_1,b_2,b_3$ with $b_1+b_3=2b_2$ modulo $N$. Their distinct preimages $a_1,a_2,a_3\in A^{\prime }$ satisfy $a_1+a_3=2a_2$ in the integers by the Freiman 2-isomorphism. Reordering the endpoints if necessary givesThe required size threshold depends on the fixed constant $C$; it is not a claim uniform in an arbitrarily growing $C$.

A Freiman 2-isomorphism is an injective map onto its image preserving pair-sum equality in both directions, with repeated summands allowed. Put $D=2A-2A$, so $D=-D$, $0\in D$, and $|D|<N$. We prove the half-size cyclic Freiman model with a sharp difference-set bound. Assume $A\ne \varnothing$; for an empty set the conclusion is immediate.

Choose an odd auxiliary prime $P>N$ large enough that reduction modulo $P$ is injective on $A$ and no nonzero element of $D$ reduces to zero. Choose a multiplier $t$ uniformly in ${\mathbb{Z}}_P^{\times }$. The forbidden residues areThey form a symmetric set, exclude zero since $P>N$, and have cardinality at most $2\lfloor (P-1)/N\rfloor$. For each nonzero $d\in D$, the product $td$ is uniform on the $P-1$ nonzero residues. Moreover, $td\in \mathcal{F}$ is the same event as $t(-d)\in \mathcal{F}$, so one need only sum over the $(|D|-1)/2$ opposite pairs. The union bound givesFix a multiplier avoiding all forbidden events. The use of opposite pairs is what achieves the threshold $N>|D|$ without an extra factor of two.

Represent each $ta(\mathrm{mod}P)$ by an integer $r(a)\in \{0,\dots ,P-1\}$. Partition these residues into the two half-intervalsAt least half of $A$ has representatives in one of them; call this subset $A^{\prime }$. Both intervals have diameter less than $P/2$, so for $a_1,a_2,a_3,a_4\in A^{\prime }$ the integersatisfies $|R|<P$.

Define $\varphi (a)=r(a)(\mathrm{mod}N)$. If $a_1+a_2=a_3+a_4$, then $R\equiv 0(\mathrm{mod}P)$, hence $R=0$ and the image relation holds. Conversely, if the image relation holds, then $R=jN$. If the original difference $d=a_1+a_2-a_3-a_4$ were nonzero, $R\equiv td(\mathrm{mod}P)$ would be nonzero; since $|R|<P$, this would be a forbidden residue in $\mathcal{F}$. Thus $d=0$.

Finally $\varphi$ is injective. If $\varphi (a)=\varphi (b)$, choose any $c\in A^{\prime }$ and apply the converse to $\varphi (a)+\varphi (c)=\varphi (b)+\varphi (c)$, obtaining $a+c=b+c$. ThereforeThe construction actually works for any integer $N>|D|$; the prime hypothesis in the question is sufficient.

A quantitative form of Roth theorem on three-term arithmetic progressions is: there is an absolute constant $C_R$ such that, for $N\ge 3$, every $A\subseteq [N]$ with no nonconstant three-term arithmetic progression satisfiesAll logarithms below are natural. We prove the classical Roth bound for three-term progressions with an unoptimized $C_R=100$. The empty set is immediate; write $\delta =|A|/N>0$.