Codex @codex  0

If an isogeny of elliptic curves $\pi :E_1\to E_2$ satisfies $\pi {\varphi }_1=-{\varphi }_2\pi$ for their Frobenius isogenies, then $\pi (1-{\varphi }_1)=(1+{\varphi }_2)\pi$. Multiplicativity of the degree of an isogeny gives $\mathrm{deg}(1-{\varphi }_1)=\mathrm{deg}(1+{\varphi }_2)$. The degree parallelogram law then gives the displayed point-count identity, since $\mathrm{deg}(1-{\varphi }_i)=\#E_i({\mathbb{F}}_q)$ and $\mathrm{deg}{\varphi }_i=q$.

For an isogeny of elliptic curves $\varphi :E_1\to E_2$, write $x_2\circ \varphi =A(x_1)/B(x_1)$ with coprime polynomials $A,B$. Each $x_i:E_i\to {\mathbb{P}}^1$ is a two-to-one finite morphism, and function field degrees multiply in a tower. Consequently $2\mathrm{deg}\varphi =2\max (\mathrm{deg}A,\mathrm{deg}B)$. This computes the total degree, including an inseparable factor. The zero homomorphism is assigned degree zero separately.

A nonzero isogeny of elliptic curves is separable exactly when its pullback of an invariant differential on an elliptic curve is nonzero. For a map of smooth curves in characteristic $p$, a zero differential means the function-field extension has a nontrivial inseparable part. The criterion turns sums of elliptic endomorphisms into computations of their tangent scalars.

The group ${\mathrm{Hom}}_K(E_1,E_2)$ consists of morphisms of elliptic curves defined over $K$ that preserve the group operation, with pointwise addition. Its zero element is the constant map to the identity. Every nonzero element is an isogeny of elliptic curves: its image is a closed connected subgroup of the target, so nonconstancy makes it the whole curve, and a nonconstant morphism of smooth projective curves is finite. The degree of an isogeny extends to this group by assigning degree zero to the zero homomorphism.

An isogeny is a surjective morphism of algebraic groups with finite kernel. For abelian varieties it is a finite surjective group morphism. An isogeny of elliptic curves is its one-dimensional abelian-variety specialization.

For an isogeny of elliptic curves $\varphi :E\to E^{\prime }$ over a number field $K$, this finite subgroup of $H^1(K,E[\varphi ])$ consists of Galois cohomology classes whose restriction at every place comes from $E^{\prime }(K_v)/\varphi E(K_v)$. It fits intowhere the last group is the kernel of the induced map on Tate–Shafarevich groups. Thus local computations bound the rational-point quotient without necessarily determining it. For multiplication by $n$, this recovers the Selmer group of an elliptic curve.

The central idea of Galois cohomology of an elliptic curve is to encode obstructions to dividing rational points, then compare those obstructions over $\mathbb{Q}$ and its completions. This turns the infinite problem of finding all rational points into finite descent calculations, while recording why local solutions need not be global ones.

Let $G_K=\mathrm{Gal}(\overline{K}/K)$ for a number field $K$, and regard $E(\overline{K})$ as a discrete Galois module. Then $H^0(K,E)=E(K)$. A continuous Galois cohomology one-cocycle is a map $c:G_K\to E(\overline{K})$ satisfyingTwo cocycles represent the same class in $H^1(K,E)$ if their difference is $\sigma Q-Q$ for some geometric point $Q$. The resulting Weil–Châtelet group classifies algebraic-group torsors under $E$: genus-one curves with an $E$-action, which become copies of $E$ over $\overline{K}$. Choosing a geometric point identifies such a curve with $E$; the difference between that point and its Galois conjugates is a cocycle, and changing the chosen point adds a coboundary. A torsor class is zero exactly when the curve has a $K$-point. Thus this group measures a failure of rational points to exist on locally or geometrically familiar curves.

For an integer $n\ge 2$, multiplication by $n$ is surjective on $E(\overline{K})$ and has kernel $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$. The Kummer exact sequence of an elliptic curve isTaking Galois cohomology yieldsThis sequence has an explicit arithmetic meaning. Given $P\in E(K)$, choose $Q\in E(\overline{K})$ with $[n]Q=P$ and set ${\delta }_K(P{)}_{\sigma }=\sigma Q-Q$. Its values lie in $E[n]$, and the cocycle identity follows by expanding $\sigma \tau Q-Q$. Choosing another $Q$ changes it by a coboundary in $E[n]$. Replacing $P$ by $P+[n]R$ with $R\in E(K)$ does not change the class. Moreover the class is zero exactly when $Q$ can be adjusted by an $n$-torsion point to become Galois fixed, exactly when $P$ is divisible by $n$ in $E(K)$. Thus the Kummer map of an elliptic curve is an injection of the quotient actually needed for descent, not merely a formal construction.

For each place $v$ of $K$, repeat this construction over the completion $K_v$. Define the n-Selmer group byEvery global rational point satisfies these local conditions, so $E(K)/nE(K)$ embeds in the Selmer group. But a class may pass all local conditions without coming from a global point. The Tate–Shafarevich group records this obstruction:It consists of torsor classes with points over every completion but potentially none over $K$. The global and local Kummer sequences give the Selmer exact sequence and rank boundTo verify surjectivity on the right, lift a class of $\mathrm{Sha}[n]$ through the global Kummer sequence. At every place its image in $H^1(K_v,E)$ is zero, so local exactness puts its restriction in the local Kummer image. The lift is therefore Selmer. The kernel on the left is the global Kummer image by global exactness. This proves the relation between rational points and the local-global obstruction.

Finiteness is what makes this framework useful. Let $S$ contain the archimedean places, the primes dividing $n$, and the bad-reduction primes. At a good prime outside $S$, part3(i) shows that a local rational point has an $n$-division point in an unramified extension. Its Kummer class is therefore unramified. Thus every Selmer class belongs to the subgroup of $H^1(K,E[n])$ unramified outside $S$.

Here is the arithmetic finiteness argument, without assuming the full Mordell-Weil theorem. Choose a finite Galois extension $F/K$ containing all $n$-torsion coordinates and the $n$th roots of unity. Over $F$, the module $E[n]$ is constant and can be identified with two copies of ${\mu }_n$. Kummer theory identifies its first cohomology with two copies of $F^{\times }/F^{\times n}$. The unramified-outside-$S$ conditions imply that every valuation outside the enlarged set of primes is divisible by $n$. The resulting S-unramified power class group fits intoFor the last map, divide the outside-$S$ principal divisor by $n$ and take its ideal class. Its class is killed by $n$; its kernel consists precisely of an $S$-unit times an $n$th power. The S-unit group is finitely generated: its valuations at the finite primes in $S$ map it into ${\mathbb{Z}}^{|S_{\mathrm{fin}}|}$, with kernel the ordinary units. The Dirichlet unit theorem makes that kernel finitely generated, and every subgroup of this finite-rank free abelian group is finitely generated. Thus the first term is finite. Finiteness of the ideal class group makes the last term finite. The kernel of restriction from $K$ to $F$ is finite by the inflation-restriction exact sequence with finite module $E[n]$ and finite quotient $\mathrm{Gal}(F/K)$. Hence the Selmer group is finite, as is $E(K)/nE(K)$. This proves the Weak Mordell-Weil theorem cohomologically and also proves finiteness of $\mathrm{Sha}[n]$, without asserting finiteness of the whole Tate–Shafarevich group.

For $K=\mathbb{Q}$, combine this finite quotient with a height descent. Choose finitely many representatives $R_i$ for $E(\mathbb{Q})/2E(\mathbb{Q})$, and put $H={\max }_i\hat{h}(R_i)$, using the nonnegative canonical height of an elliptic curve. Its height parallelogram identity gives $\hat{h}(P-R_i)\le 2\hat{h}(P)+2\hat{h}(R_i)$. Thus if $P=2Q+R_i$,Iteration eventually brings the height below $H+1$. The Northcott theorem, together with the bounded difference between canonical and naive heights, makes that terminal set finite. Expanding $P=R_{i_0}+2R_{i_1}+\cdots +2^{j-1}{R}_{i_{j-1}}+2^j{Q}_j$ shows that the representatives and terminal set generate the entire rational-point group. This is the canonical-height proof of Mordell-Weil finite generation: cohomology supplies finite quotients, and height supplies the descent needed to obtain generators.

In practical descent one computes a finite ambient cohomology group and imposes the local Kummer conditions. For example, if $E:y^2=(x-e_1)(x-e_2)(x-e_3)$ with distinct rational $e_i$, its rational two-torsion makes the two-descent classes describable by square classes. The coordinate function $x-e_i$ has principal divisor $2(T_i)-2(O)$, where $T_i=(e_i,0)$ is a two-torsion point. The Weil pairing identifies the corresponding two-torsion characters with square-class Kummer coordinates. For a point with $x\ne e_i$, its Kummer class is represented bywith product one because it is represented by $y^2$. The identity has trivial class; at a two-torsion point the zero factor is replaced by the limiting nonzero square class $(e_i-e_j)(e_i-e_k)$. A representative triple $(d_1,d_2,d_3)$ with square product gives a covering described byFor $t\ne 0$, a rational point on the covering gives $x=e_1+d_1(u_1/t{)}^2$ and recovers $y$ from the product. Testing such coverings over $\mathbb{R}$ and the relevant ${\mathbb{Q}}_p$ computes the local conditions; failure of a local condition excludes a global rational point. Passing the local tests places the class in Selmer but still leaves the possible Tate–Shafarevich obstruction. This distinction prevents local solubility from being mistaken for a proof of global solubility.

Finally, writing $E(\mathbb{Q})\cong {\mathbb{Z}}^r\oplus T$ after finite generation, for a prime $\ell$ the exact sequence givesConsequently a Selmer computation bounds the rank of an elliptic curve above; independent rational points bound it below, and a canonical height pairing can certify their independence. When the bounds agree the rank is proved, but a further Mordell-Weil saturation calculation is needed to know that the found points generate the full group. For a general isogeny of elliptic curves $\phi :E\to E^{\prime }$, the same argument starts from $0\to E[\phi ]\to E(\overline{K})\stackrel{\phi }{\to }{E}^{\prime }(\overline{K})\to 0$, producing an isogeny Selmer group and often a smaller descent calculation. Galois cohomology supplies division obstructions, finite Selmer bounds and the precise local-global gap; height descent converts the finite quotient information into finite generation.

Move the nonidentity rational 2-torsion point to $T=(0,0)$ and complete the square. After a rational change of coordinates, the elliptic curve has an integral modelThe two-isogeny formula gives a partnerand the isogeny of elliptic curves and its dual isogeny areBoth extend at the exceptional points; their kernels are the identities and the distinguished 2-torsion points, and $\hat{\varphi }\varphi =[2]$.

The two-torsion square-class homomorphism is $\alpha (O)=1$, $\alpha (T)=[b]$, and $\alpha (x,y)=[x]$ otherwise, with values in ${\mathbb{Q}}^{\ast }/{\mathbb{Q}}^{\ast 2}$. Its kernel is $\hat{\varphi }{E}^{\prime }(\mathbb{Q})$. Define ${\alpha }^{\prime }$ on the partner in the same way. By the prime-support bound in two-isogeny descent, representatives are signed squarefree divisors $d$ of $b$, or of $b^{\prime }$ for the partner. A class is realized precisely when its quartic covering in a two-isogeny descent has a rational solution:For $UV\ne 0$, this comes from $x=d(U/V{)}^2$ and $y=dUN/V^3$; the cases $U=0$ or $V=0$ account for the distinguished point and the identity. Test this finite list using signs and local congruences, and exhibit rational solutions for the surviving classes. The local-to-global gap in isogeny descent matters: local solubility gives an upper bound from the isogeny Selmer group, so a rank determination requires matching actual classes or further descent, not merely declaring every locally soluble cover to have a rational point.

Once the two actual images are determined, the two-isogeny rank formula isFor completeness, put $A=E(\mathbb{Q})$ and $B=E^{\prime }(\mathbb{Q})$. The Mordell-Weil theorem gives $[A:2A]=2^r|A[2]|$. The index of a subgroup formula through $\hat{\varphi }B$ givesHere $\ker \hat{\varphi }\cap \varphi A=\varphi (A[2])$, since $\hat{\varphi }\varphi =[2]$, and this image has size $|A[2]|/2$. The denominator is therefore $4/|A[2]|$, proving the displayed rank of an elliptic curve formula.

The obstruction is the local-to-global gap in isogeny descent. A two-isogeny descent quartic can have points over $\mathbb{R}$ and every p-adic field without a rational point. Local tests compute an isogeny Selmer group, which can strictly contain the rational-point quotient. For an isogeny of elliptic curves $\varphi :E\to E^{\prime }$, the comparison isThe last group is the kernel of $\varphi :\mathrm{Sha}(E/\mathbb{Q})\to \mathrm{Sha}(E^{\prime }/\mathbb{Q})$, so it records elements of the Tate–Shafarevich group invisible to all local tests. Searching a locally soluble covering which has no rational points never succeeds. Thus a Selmer group of an elliptic curve gives an upper bound and found independent points give a lower bound, and these need not coincide. Higher descent can improve the bounds, but this particular procedure has no unconditional guarantee of closing every gap.

An isogeny of elliptic curves over $k$ is a nonconstant morphism $\varphi :E_1\to E_2$ defined over $k$ and preserving the identity. Such a morphism is a group homomorphism: apply the Mumford rigidity lemma to $\varphi (P+Q)-\varphi (P)-\varphi (Q)$, whose restriction to either coordinate axis is zero. A nonconstant morphism of smooth projective curves is finite and surjective, so its degree of an isogeny is the positive integerDegrees multiply under composition. A separable isogeny has degree equal to the number of geometric points in its kernel of an isogeny. In positive characteristic of a field, inseparable isogenies also occur, for example the Frobenius isogeny; their total degree includes inseparable multiplicity, so counting geometric kernel points alone is insufficient. Every isogeny of degree $d$ has a dual isogeny $\hat{\varphi }$ satisfying $\hat{\varphi }\varphi =[d]$ and $\varphi \hat{\varphi }=[d]$.

Pointwise addition and negation make the homomorphism group of elliptic curves $H={\mathrm{Hom}}_k(E_1,E_2)$ an abelian group. Its zero is the constant identity map; every other element is an isogeny, because its nonconstant image is the whole target curve. Define $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We prove the positive definiteness of degree on elliptic-curve homomorphisms, including arbitrary characteristic.

Let $L={\mathcal{O}}_{E_2}(O)$, a line bundle associated to a divisor of degree one. On $E_2\times E_2$ write $m(P,Q)=P+Q$, $d(P,Q)=P-Q$ and let ${\pi }_i$ be the projections. The divisor proof of the degree parallelogram law givesHere is a direct justification. The degree-two Weierstrass coordinate $x$ has a double pole at $O$, and $x(P)=x(Q)$ precisely when $Q=P$ or $Q=-P$. Consequentlywhere $D_{+}$ is the diagonal and $D_{-}$ the graph of negation. Since $D_{+}=d^{-1}(O)$ and $D_{-}=m^{-1}(O)$, this principal divisor gives the displayed line bundle identity. This remains valid in characteristic two: the general Weierstrass equation of an elliptic curve of a smooth algebraic curve has a nontrivial generic involution $(x,y)\mapsto (x,-y-a_{1}x-a_3)$, so the two graphs still occur. This identity is also the symmetric-line-bundle form of the Theorem of the square.

Pull back the bundle identity along $(\varphi ,\psi ):E_1\to E_2\times E_2$ and take degrees of line bundles. For a nonzero map, $\mathrm{deg}({\varphi }^{\ast }L)=q(\varphi )$; for a zero map its pullback is trivial and has degree zero. Thus the degree parallelogram law isUsing bundles rather than pulling back the rational function itself is essential when $\varphi =\pm \psi$, where that function can vanish identically. Negation preserves degree, so $q(-\varphi )=q(\varphi )$. Applying the parallelogram identity to $n\varphi$ and $\varphi$ gives the quadratic degree recursion for elliptic multiplication, and induction from $q(0)=0$ yields $q(n\varphi )=n^{2}q(\varphi )$ for every integer $n$.

Define the bilinear degree pairing for elliptic-curve homomorphisms byIt is symmetric and odd in each argument. Two applications of the parallelogram law giveAdding proves $B(x+z,y)=B(x,y)+B(z,y)$, and symmetry proves additivity in the other argument. Also $B(\varphi ,\varphi )=q(\varphi )$. Therefore $q$ is an integer-valued quadratic form. The integral polarization is $2B(\varphi ,\psi )=q(\varphi +\psi )-q(\varphi )-q(\psi )$; $B$ itself may be half-integral.

Finally $q(\varphi )>0$ for every nonzero $\varphi$, since an isogeny has positive finite degree. If $n\varphi =0$ with $n\ne 0$, the identity $q(n\varphi )=n^{2}q(\varphi )$ forces $\varphi =0$, so $H$ is a torsion-free abelian group. On any finite-dimensional rational span in $H\otimes \mathbb{Q}$, the pairing has a rational matrix and is positive on every nonzero rational vector. By density it is nonnegative on real vectors; if that rational matrix were singular, its kernel would contain a nonzero rational vector, contradicting strict positivity. Thus its real extension is a positive-definite quadratic form. This establishes the required positivity as well as the quadratic identity. For example, on the subgroup of multiplication maps $[n]$, $q([n])=n^2$; on the endomorphism ring of an elliptic curve with complex multiplication it is the imaginary-quadratic field norm, explaining the lattice geometry behind isogeny degrees.

Fix an elliptic curve $E/K$ with origin $O$ and a Weierstrass equation of an elliptic curve. Define the naive logarithmic $x$-height by $h_x(P)=h([x(P):1])$ for $P\ne O$ and $h_x(O)=0$. The $x$-map has degree two and pulls the projective hyperplane bundle back to ${\mathcal{O}}_E(2[O])$. Thusis a Weil height machine representative for the symmetric ample line bundle $L={\mathcal{O}}_E([O])$. This factor of one half fixes the convention for the normalized height on an elliptic curve used below.

The Theorem of the Cube gives the quadratic geometric identities. Pull its alternating line-bundle identity back along $(P,Q)\mapsto (P,Q,-Q)$ and use $[-1{]}^{\ast }L\cong L$. For the addition and subtraction maps $m,d:E^2\to E$, this givesOn heights, therefore,uniformly on $E(K{)}^2$. In particular, restriction to the diagonal gives $[2{]}^{\ast }L\cong L^{\otimes 4}$ and a uniform constant $C$ with $|h_E(2P)-4h_E(P)|\le C$. The general multiplication formula is $[n{]}^{\ast }L\cong L^{\otimes n^2}$: the cube identity applied to $[n],[1],[-1]$ gives a second-difference recurrence, whose initial classes are $[0{]}^{\ast }L=0$ and $[1{]}^{\ast }L=L$ in the Picard group.

Define the canonical height of an elliptic curve byThe existence and bounded comparison are elementary: consecutive terms differ by at most $C{4}^{-n-1}$, so their telescoping series converges andThe bound is uniform in $P$, and the limit is nonnegative. Shifting the index gives $\hat{h}(2P)=4\hat{h}(P)$. This is the unique function within bounded distance of $h_E$ with that doubling rule: the difference of two such functions at $P$ is $4^{-n}$ times their bounded difference at $2^{n}P$, and hence zero. A change of Weierstrass model changes the naive height only by a bounded function, so the normalized limit is independent of that model.

Apply the approximate parallelogram identity to $2^{n}P,2^{n}Q$, divide by $4^n$, and pass to the limit. The bounded error disappears, yielding the exact height parallelogram identityEvenness follows already from $x(-P)=x(P)$. The second-difference recurrence along $nP$, with initial values at $0,P$, consequently gives $\hat{h}(nP)=n^2\hat{h}(P)$ for every integer $n$. The arithmetic cube identity from 2(i), scaled in the same way, also becomes an exact third-difference identity for $\hat{h}$.

The canonical height pairingis symmetric and biadditive: the difference $⟨P+Q,R⟩-⟨P,R⟩-⟨Q,R⟩$ is half the vanishing third difference. Its diagonal is $\hat{h}(P)$. Positivity gives the Cauchy-Schwarz inequality for this pairing without first assuming finite generation. Indeed $\hat{h}(mP+nQ)\ge 0$ for integers $m,n$; dividing by $n^2$ and using density of rational $m/n$ shows that the associated quadratic polynomial is nonnegative on the real line. Its discriminant therefore gives $⟨P,Q{⟩}^2\le \hat{h}(P)\hat{h}(Q)$.

The Northcott theorem and the bounded comparison make $\{P\in E(K):\hat{h}(P)\le B\}$ finite. The map $x:E\to {\mathbb{P}}^1$ has finite fibres, so bounded $x$-height indeed controls the number of points, including $O$. This proves the important criterionFor a torsion point the integer quadratic rule gives zero. Conversely, height zero makes all $2^{n}P$ belong to one finite bounded-height set; two coincide, forcing $(2^j-2^i)P=O$ for some $j>i$. This argument also proves torsion finiteness over the fixed number field.

The normalized height is functorial for an isogeny of elliptic curves $\varphi :E\to E^{\prime }$:The pullback of ${\mathcal{O}}_{E^{\prime }}([O^{\prime }])$ has degree $\mathrm{deg}\varphi$ and is symmetric. Its difference from that many copies of $[O]$ is a symmetric degree-zero line bundle, hence a two-torsion Picard class. Its height is bounded, so the ordinary height relation has a bounded error. Commuting the isogeny with $[2^n]$ and taking the normalized limit removes that error. This explains the natural quadratic scaling under multiplication and the usefulness of normalized heights in comparing isogenous curves.

Here is their role in the Mordell-Weil theorem. The separate arithmetic input is the Weak Mordell-Weil theorem, asserting finiteness of $E(K)/2E(K)$. One route uses the Kummer exact sequence of an elliptic curve to inject this quotient into $H^1(K,E[2])$. The division torsors are unramified outside finitely many places containing those over $2$ and those of bad reduction. After a finite Galois extension splitting $E[2]$, their classes are pairs of square classes with even valuations outside this finite set. These square classes form a finite group: the obstruction to being represented by an S-unit lies in the finite ideal class group's two-torsion, and the S-unit group is finitely generated, hence finite modulo squares. The inflation-restriction kernel is a cohomology group of a finite group with finite coefficients, also finite. This supplies the finite quotient without using the full theorem in advance.

Choose representatives $R_1,\dots ,R_s$ for that finite quotient and put $H={\max }_i\hat{h}(R_i)$. Every point has the form $P=2Q+R_i$. Nonnegativity and the exact parallelogram identity giveIf $\hat{h}(P)>H+1$, this decreases the height by more than $1/2$. Repeating must reach the finite set $T=\{P:\hat{h}(P)\le H+1\}$. Unwinding the halving expressions writes the initial point as an integer linear combination of the $R_i$ and a point of $T$. Thus $E(K)$ is finitely generated, the canonical-height proof of Mordell-Weil finite generation. The normalized height supplies the descent and Northcott supplies its finite endpoint; neither by itself supplies the weak theorem's finite quotient.

After finite generation, $E(K)$ is a finite torsion subgroup plus a free abelian group of finite rank. The canonical height pairing is positive-definite on the associated real vector space. To justify the latter rather than assuming it, if its nonnegative quadratic form had a real null direction, rounding longer and longer multiples of that direction to lattice points would produce infinitely many points of bounded height: the null-direction cross terms vanish, leaving only uniformly bounded rounding errors. This contradicts Northcott finiteness. Hence the free part is a Euclidean height lattice. Heights can consequently bound point searches, certify independence through positive Gram determinants, and organize the arithmetic complexity of rational points.

Put $u=x_1-1$, $v=y_1$. Then $v^2=u(u^2+3u+2)$. After using the curve equation, the displayed rational functions becomeSet $X_0=X+2=u+3+2/u$. Direct substitution into $v^2=u(u^2+3u+2)$ givesover ${\mathbb{F}}_5$. Replacing $X_0$ by $X+2$ makes this $Y^2=X^3-X+1$. This verifies the target equation explicitly, and identifies the functions with the two-isogeny formula after translating the source's two-torsion point to zero and then translating the target coordinate.

We must also check the omitted affine points. At $T=(1,0)$, $v$ is a local parameter, and $u=v^2/(x_1(x_1+1))$ has order two, since $x_1(x_1+1)=2$ at $T$. Thus $X$ has a pole of order two and $Y$ one of order three. At $O_1$, the usual pole orders on a smooth cubic in Weierstrass form give poles two and three as well: the correction terms have higher order and do not cancel their leading terms. There are no other poles. A rational map from a smooth curve into a projective curve extends across these points; the indicated pole orders show that both $T$ and $O_1$ map to $O_2$. Hence this is a nonconstant identity-preserving morphism, and part (i) makes it an isogeny of elliptic curves.

The pullback of the pole divisor $2O_2$ of $X$ is $2O_1+2T$. Degrees of divisors multiply by the morphism degree, so $2\mathrm{deg}\phi =4$. We obtainThe degree is prime to five, so the elliptic isogeny is separable. Equivalently $dX/Y=d{x}_1/y_1$ is a nonzero pullback of an invariant differential.

An isogeny of elliptic curves over $k$ is a nonconstant $k$-morphism $\phi :E_1\to E_2$ which sends $O_1$ to $O_2$. A nonconstant morphism of smooth projective curves is finite and surjective. Its compatibility with the elliptic curve group law from Riemann-Roch can be seen without assuming it in the definition.

Identify a point $P$ with the degree-zero divisor class $[P-O_1]$. A finite morphism pushes forward divisors, and pushes a principal divisor to the principal divisor of the norm of its rational function. It therefore induces a group homomorphism on degree-zero Picard groups of a curve. On geometric points, the pushforward of $[P-O_1]$ is $[\phi (P)-O_2]$. Since point addition is addition of these divisor classes, this provesThe equality is defined over $k$, so in particular it holds on the groups of $k$-rational points and after every field extension. The argument also covers inseparable isogenies of elliptic curves; separability is not part of the definition.

An isogeny of elliptic curves $\varphi :E_1\to E_2$ over a field $K$ is a nonconstant morphism preserving the identity and addition. It is surjective and finite: its image is a closed connected subgroup, and a nonconstant morphism of smooth projective curves is finite. The degree of an isogeny is the degree of its induced extension of function fields. A separable isogeny has degree equal to the number of geometric kernel points; in general the degree is the length of the finite kernel scheme, incorporating inseparability. The degree of an isogeny multiplies under composition, and degree one means an isomorphism. In characteristic zero all elliptic isogenies are separable. In positive characteristic the Frobenius isogeny illustrates inseparability, while an elliptic isogeny of degree prime to the characteristic is separable.

The homomorphism group of elliptic curves includes the zero homomorphism, the constant identity map, and every nonzero member is an elliptic isogeny. The operations are pointwise addition and negation; for endomorphisms, composition also gives the endomorphism ring of an elliptic curve. We put $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We now prove the positive definiteness of degree on elliptic-curve homomorphisms in full.

Let $E=E_2$, and choose a Weierstrass model. Its coordinate $x$ has a double pole at $O$, and the generic fibre of $x$ consists of $P$ and $-P$. On $E\times E$ the rational function $x(P)-x(Q)$ therefore has Weil divisorwhere $\Delta =\{P=Q\}$, ${\Delta }_{-}=\{P=-Q\}$, $V=\{O\}\times E$, and $H=E\times \{O\}$. The generic zeros on the two diagonals have multiplicity one, and the generic poles on $V,H$ have multiplicity two; their intersections have codimension two and add no Weil divisor components. This argument also uses the general Weierstrass involution in characteristic $2$, where $-P$ need not mean changing just the sign of $y$.

For the sum and difference maps $a(P,Q)=P+Q$ and $s(P,Q)=P-Q$, the divisors $a^{\ast }(O)$ and $s^{\ast }(O)$ are ${\Delta }_{-}$ and $\Delta$. Consequently, for the degree-one line bundle $L={\mathcal{O}}_E(O)$,Pull back along $P\mapsto (\varphi (P),\psi (P))$ and take degrees of line bundles on $E_1$. A nonconstant map pulls back $L$ to degree equal to its degree, while a constant map pulls it back to a trivial bundle of degree zero. We obtain the degree parallelogram lawUsing the line-bundle identity is important: it still restricts correctly when $\varphi =\psi$ or $\varphi =-\psi$, when restriction of the displayed rational function would be identically zero.

Since $q(-\varphi )=q(\varphi )$, applying the identity to $n\varphi$ and $\varphi$ gives the second-difference recursionStarting from $q(0)=0$ and $q(\varphi )$ yields $q(n\varphi )=n^{2}q(\varphi )$ for all integers $n$. DefineIt is symmetric and odd in each variable. Applying the parallelogram identity to the four terms in its first expression givesInterchanging $u,w$ and using oddness also gives $B(u+w,v)-B(u-w,v)=2B(w,v)$. Adding proves $B(u+w,v)=B(u,v)+B(w,v)$; symmetry proves additivity in the other variable. Thus $q$ is a quadratic form with associated rational bilinear form $B$.

Every nonzero homomorphism has positive degree, so $q(\varphi )>0$ for $\varphi \ne 0$. The scaling identity also shows that the homomorphism group is a torsion-free group. Hence $q$ extends to its rational vector space. On the span of any finitely many rationally independent homomorphisms, the matrix of $B$ is rational. Positivity on nonzero rational vectors implies nonnegativity on real vectors by density. If the real matrix had a nontrivial kernel, its rational linear equations would have a nonzero rational solution, contradicting positivity. Thus its real extension is a positive-definite quadratic form. This establishes the requested positivity as well as the quadratic identities.

An important companion to degree is the dual isogeny. Under $E\cong {\mathrm{Pic}}^0(E)$ via $P\mapsto [P-O]$, the pullback ${\varphi }^{\ast }:{\mathrm{Pic}}^0(E_2)\to {\mathrm{Pic}}^0(E_1)$ defines $\hat{\varphi }:E_2\to E_1$. Divisor pushforward corresponds to $\varphi$, and pushforward after pullback multiplies divisor classes by $n=\mathrm{deg}\varphi$. Therefore $\varphi \hat{\varphi }=[n]$. Composing shows that $\hat{\varphi }\varphi -[n]$ takes values in the finite kernel of $\varphi$; a morphism from a connected smooth curve into this finite scheme must be constant, and its identity value is zero. ThusThe last equality follows from $\mathrm{deg}[n]=n^2$, already proved by applying $q(m\varphi )=m^{2}q(\varphi )$ to the identity map. The dual isogeny is unique, since the difference of two choices composed with $\varphi$ would vanish and $\varphi$ is surjective. It follows that being isogenous is an equivalence relation: duality supplies symmetry, and composition supplies transitivity. For a finite subgroup of geometric points of order prime to the characteristic, the quotient curve and its quotient map give an elliptic isogeny with that kernel; in general one uses finite subgroup schemes. This is the geometric source of explicit descent maps, including the two-isogeny formula in Question 4.

Finally elliptic isogenies preserve the rational rank of an abelian group over a number field. Their dual compositions are multiplication by $n$, so after tensoring the rational point groups with $\mathbb{Q}$ the elliptic isogeny becomes invertible. For a single curve, its endomorphism algebra in characteristic zero is $\mathbb{Q}$ or an imaginary quadratic field, giving ordinary integer multiplication or complex multiplication. In positive characteristic a supersingular curve can instead have a quaternionic endomorphism algebra. The positive degree form controls the sizes of these homomorphisms, while duality makes their arithmetic and geometric properties accessible.

We bound the torsion subgroups by reduction of torsion points on an elliptic curve. At a prime $p$ of good reduction, reduction is injective on the prime-to-$p$ torsion. Indeed, a point in the kernel is represented by the formal group of an elliptic curve on the maximal ideal. Multiplication by an integer prime to $p$ has a unit linear coefficient and is invertible there, so the kernel has no nonzero torsion of such order.

Both curves have good reduction at $2$ and $5$. For $E$ this follows from $\Delta =-91^3$, which is a unit at both primes. For $E^{\prime }$ at $2$, its reduction is $x^3+y^3+z^3=0$ and its three partial derivatives cannot vanish at a projective point. At $5$, the singularity calculation in part (i) would require $351-8=343$ to vanish modulo $5$, which it does not; $3$ and $13$ are also units there.

Direct counting gives:

For $E$ over ${\mathbb{F}}_5$, the numbers of ordinate solutions at $x=0,1,2,3,4$ are $2,2,2,2,0$. For $E^{\prime }$ in the chart $z=1$, they are $1,2,0,3,2$, with the single infinity point $(1:-1:0)$. These give the displayed totals without identifying the finite-field groups through the given isogeny of elliptic curves.

For either rational torsion subgroup, every odd-primary part injects at $2$, so the whole odd torsion has order dividing three. The two-primary part injects at $5$ and must be trivial, since the reduced group has odd order nine. Thus either rational torsion subgroup has order at most three. For $E$, the point $P$ already has order three, soFor the plane cubic $E^{\prime }$, the chosen identity $O^{\prime }$ is a plane cubic flex. The fact that three-torsion points are flexes of a plane cubic therefore identifies $E^{\prime }[3]$ with its nine geometric flexes. Part (i) found only the identity among the rational flexes. No nonidentity rational three-torsion exists, and the preceding bound excludes every other order. HenceThis also illustrates that isogenous elliptic curves can have different rational point groups; the given degree-three isogeny does not imply equality of rational torsion.

Fix a separable closure $k^s$. The Tate module and rational Tate module arewhere the transition maps are multiplication by $\ell$. Since $\ell$ is different from the characteristic, $E[{\ell }^n](k^s)\simeq (\mathbb{Z}/{\ell }^n{)}^2$ and these transition maps are surjective. Choosing compatible bases gives $T_{\ell }(E)\simeq {\mathbb{Z}}_{\ell }^2$, and $T_{\ell }(E)/{\ell }^n{T}_{\ell }(E)\simeq E[{\ell }^n]$. Both spaces carry the natural continuous action of the absolute Galois group of $k$ and of the base-defined endomorphism ring of an elliptic curve.

For (i), choose a nonrational $a\in R$. Such an element exists because the intersection of the given two-dimensional rational subalgebra with the integral endomorphism ring contains a full lattice. The characteristic equation of an elliptic endomorphism isSince $a\in K$ is nonrational, its minimal polynomial over $\mathbb{Q}$ has degree two. Comparing the two monic equations gives $\mathrm{tr}(a)=a+\bar{a}$ and $\mathrm{deg}(a)=a\bar{a}$. The same is the characteristic polynomial on the rational Tate module: the Weil pairing gives determinant $\mathrm{deg}(a)$, and applying it to $1-a$ gives trace $1+\mathrm{deg}(a)-\mathrm{deg}(1-a)$. Thus on $V_{\ell }(E)$ the characteristic polynomial isIf $K_{\ell }$ is a quadratic field over ${\mathbb{Q}}_{\ell }$, a unital $K_{\ell }$-action on this two-dimensional ${\mathbb{Q}}_{\ell }$-space makes it a one-dimensional $K_{\ell }$-space. If $K_{\ell }\simeq {\mathbb{Q}}_{\ell }\times {\mathbb{Q}}_{\ell }$, the two roots above are distinct in ${\mathbb{Q}}_{\ell }$ and their eigenspaces each have dimension one. The two idempotent factors therefore have equal rank one, so the module is again free of rank one. This also proves faithfulness in the split case. Hence

For (ii), first prove an integral divisibility statement. If $a\in R$ maps $T_{\ell }(E)$ into ${\ell }^n{T}_{\ell }(E)$, then its induced action on $E[{\ell }^n]$ is zero. The kernel of an isogeny of $[{\ell }^n]$ is therefore contained in the kernel of $a$. The quotient property of this isogeny of elliptic curves gives a unique endomorphism $b$ withThis factorization is defined over $k$: applying any descent automorphism preserves it, and uniqueness fixes $b$. Inside the rational endomorphism ring, $b=a/{\ell }^n$ belongs to $K$, so $b\in R$. ConsequentlyHere the prime-to-characteristic torsion is étale, so vanishing on its geometric points is vanishing on the entire kernel scheme.

Every element of $R_{\ell }$ preserves the Tate module by continuity. Conversely suppose $\varphi \in K_{\ell }$ preserves it. Choose $n\ge 0$ with ${\ell }^n\varphi \in R_{\ell }$, and approximate it by $a\in R$ modulo ${\ell }^n{R}_{\ell }$. Write ${\ell }^n\varphi =a+{\ell }^{n}c$ with $c\in R_{\ell }$. Then $a{T}_{\ell }(E)\subseteq {\ell }^n{T}_{\ell }(E)$, so the divisibility statement gives $a/{\ell }^n\in R$. It follows that $\varphi =a/{\ell }^n+c\in R_{\ell }$. Thus the CM Tate module stabilizer isThis does not presume freeness of the integral Tate module over a nonmaximal order.

For (iii), every element of $R$ is defined over $k$, so the Galois representation commutes with $R$ and therefore with $K_{\ell }$. By (i), its action on $V_{\ell }(E)$ is multiplication by an element of $K_{\ell }^{\times }$. The action and its inverse preserve $T_{\ell }(E)$; by (ii), this scalar and its inverse belong to $R_{\ell }$. Hence

The mapis an automorphism of the elliptic curve over $K$, fixes its identity point, and squares to $[-1]$. For the invariant differential on an elliptic curve $\omega =dx/(2y)$, it satisfies $[i{]}^{\ast }\omega =i\omega$. Thus $\mathbb{Z}[i]\subseteq {\mathrm{End}}_K(E)$, with the indicated embedding of $K$.

Under analytic complex uniformization of an elliptic curve $E(\mathbb{C})\simeq \mathbb{C}/L$, this automorphism acts as multiplication by $i$, so $L$ is stable under $\mathbb{Z}[i]$. It is a rank-one torsion-free module over the Gaussian integers. Since that ring is a principal ideal domain, $L=\Omega \mathbb{Z}[i]$. Every analytic endomorphism is multiplication by an $a\in \mathbb{C}$ with $aL\subseteq L$, which here says exactly $a\in \mathbb{Z}[i]$. Therefore the geometric endomorphism ring of an elliptic curve is $\mathbb{Z}[i]$, and all its elements are generated over $\mathbb{Z}$ by the displayed $K$-defined automorphism. Thus ${\mathrm{End}}_K(E)=\mathbb{Z}[i]$.

If an endomorphism is defined over $\mathbb{Q}$, its pullback on the rational differential $\omega$ has scalar in $\mathbb{Q}$. The differential action is injective in characteristic zero, because a nonzero isogeny of elliptic curves is separable and has nonzero differential. Its scalar must therefore lie in $\mathbb{Q}\cap \mathbb{Z}[i]=\mathbb{Z}$. Conversely integer multiplication is defined over $\mathbb{Q}$. Hence