Past exam of the analytic number theory and elliptic curves course of the University of Oxford / 2008 / B (Elliptic Curves)

For $p=3$, a root would have valuation zero because five is a unit. It would therefore reduce to a unit cube modulo nine. The only cube residue classes modulo nine are $0,1,-1$, none equal to five. Thus no root exists in ${\mathbb{Q}}_3$.

For $p=5$, the valuation equation would be $3v_5(x)=1$, impossible because the valuation of a nonzero element of ${\mathbb{Q}}_5$ is an integer. Thus no root exists in ${\mathbb{Q}}_5$.

For $p=13$, $7^3\equiv 5(\mathrm{mod}13)$ and the derivative $3\cdot 7^2\equiv 4\not\equiv 0(\mathrm{mod}13)$. Hensel's lemma lifts this simple root to a root in ${\mathbb{Z}}_{13}\subseteq {\mathbb{Q}}_{13}$. Thus a root exists in ${\mathbb{Q}}_{13}$.

The expansion isThe notation has the units digit before the comma and successive positive powers afterwards, as defined in the source. To check it, the geometric series converges in the 3-adic norm and its sum is $1+(3+2\cdot 3^2)/(1-3^2)=1-21/8=-13/8$.

For the general repeating block, $|p^2{|}_p<1$ givesBoth numerator and denominator are integers, and the denominator is a $p$-adic unit.

The reduction has equation $F=x^3+y^3=0$. At the origin both first partial derivatives vanish, so the point is singular, also when $p=3$. A lift reducing to the origin would require $x,y\in p{\mathbb{Z}}_p$. Its two cubes would then lie in $p^3{\mathbb{Z}}_p$, whereas the right side of the original equation has valuation one. This is impossible.

For an example which does lift, chooseIt has the same reduction and the rational point $(p,0)$ reduces to the origin. Over ${\mathbb{Q}}_p$, which has characteristic zero, a singular affine point would require $x=y=0$, which does not lie on this curve. Its projective closure is also smooth: the simultaneous partial derivatives of $X^3+Y^3-p^3{Z}^3$ cannot vanish at a projective point. Thus this is a nonsingular curve for every prime $p$, including three. A singular point in the reduction can therefore fail to lift or can lift, depending on the original equation.

Let $\alpha ,\beta ,\gamma$ be the nonzero reductions of $a,b,c$. The square set in ${\mathbb{F}}_p$ has $(p+1)/2$ members, including zero. Multiplication by $\alpha$, and separately the transformation $z\mapsto \gamma -\beta z$, preserve this cardinality. Hence the two sets in the hint have total cardinality $p+1>p$ and must intersect. This gives a solution $(x_0,y_0)$ modulo $p$.

The solution cannot have both coordinates zero since $\gamma \ne 0$. If $x_0\ne 0$, choose any integral lift of $y_0$ and apply Hensel's lemma to the polynomial $a{X}^2+b{y}_0^2-c$ in $X$: its derivative at the reduced root is $2\alpha x_0\ne 0$. If $y_0\ne 0$, use the other variable instead. The nonzero derivative uses $p\ne 2$. Thus a solution lifts to $\boxed{x,y\in {\mathbb{Z}}_p}$ as required.

For a nonsingular curve $y^2=x^3+Ax+B$ with integers $A,B$, the Nagell–Lutz theorem states that a finite rational torsion point has integer coordinates and satisfies either $y=0$ orThe point at infinity is the identity and is treated separately. Integrality is the result allowed in the source. To prove the remaining divisibility, suppose $y\ne 0$. Then the doubled point is finite and also torsion, so its coordinates are integral. Its tangent slope is $m=(3x^2+A)/(2y)$ and its abscissa is $m^2-2x$. Thus $m^2$ is an integer. A rational number whose square is an integer is itself an integer, so $2y$ divides $3x^2+A$. In particular $y^2$ divides ${\psi }_1(x)=(3x^2+A{)}^2$. It also divides ${\psi }_2(x)=x^3+Ax+B=y^2$. Evaluating the permitted polynomial identity at the integer $x$ therefore proves the divisibility of $4A^3+27B^2$ by $y^2$.

For $y=0$, the point equals its negative and has order two. The theorem gives a finite set of torsion candidates, but the divisibility condition by itself does not assert that every candidate is torsion.

Here $4A^3+27B^2=31$. A nonzero ordinate of a torsion point must have its square dividing 31, so $y=\pm 1$. The curve equation then becomes $x(x^2+1)=0$, whose only integer solution is $x=0$. No point with $y=0$ exists over the rationals: the monic cubic $x^3+x+1$ has no integer root, since its only possible integer roots are $\pm 1$ and neither works.

It remains to test $(0,\pm 1)$. Doubling either gives abscissa $(1/(\pm 2){)}^2=1/4$, which is not an integer. If the original point were torsion its double would satisfy the integrality part of the Nagell–Lutz theorem, a contradiction. ThereforeThe rational point $(0,1)$ consequently has infinite order, so its multiples give infinitely many distinct rational points.

The curve has good reduction at five and seven: its discriminant is $-432D^2$, and the hypotheses make $D$ a unit at those primes. Over ${\mathbb{F}}_5$ the cubing map is a bijection, soThe character sum vanishes after replacing $x^3+D$ by a variable ranging over the whole field. Over ${\mathbb{F}}_7$, where $D=2$, the possible cubes are zero once, one three times, and minus one three times. The corresponding right sides are two, three and one. Two and one are nonzero squares while three is not, so the count is $1+2+0+6=9$.

Rational torsion injects into the reduction group at a good odd prime, a standard reduction theorem. Thus its order divides $\gcd (6,9)=3$. If a point of order three existed, its coordinates would be integral by the Nagell–Lutz theorem. Since $2P=-P$, the duplication formula givesThus either $x=0$ and $y^2=D$, or $x^3=-4D$ and $y^2=-3D$.

At the prime in the hypothesis, $D$ is a nonsquare unit. Since $p\equiv 1(\mathrm{mod}3)$, there is a nontrivial cube root of unity $\zeta \in {\mathbb{F}}_p$, and $(2\zeta +1{)}^2=-3$. Hence $-3$ is a nonzero square, so both $D$ and $-3D$ are nonsquares. Neither ordinate equation is possible even modulo $p$. There is no rational point of order three, proving

Write the equation as $y^2=x^3-5x^2+4x$. Its duplication formula uses slope $m=(3x^2-10x+4)/(2y)$ and $x(2P)=m^2+5-2x$. At the three listed points the slopes are respectively $i$, $-1+i\sqrt{3}$, and $2+\sqrt{3}$. Substitution givesThese are nonidentity points of order two, so each listed point has exactly order four.

For $p\ne 2,3$ the three distinct roots zero, one and four give the full two-torsion subgroup of order four over ${\mathbb{F}}_p$. At least one of $-1,3,-3$ is a square: if neither of the first two is, their product is. If $-1$ is a square, the first listed point exists over the field. If three is a square, the third exists. If $-3$ is a square, the second can be written $(1-\sqrt{-3},3+\sqrt{-3})$ and exists without requiring the two separate square roots. The duplication computations remain valid after reduction; their ordinates do not vanish unless $p=2$ or three. Thus a rational two-torsion point has a half over the field. Together with a different two-torsion point this generates a subgroup of order eight. Consequently $\boxed{8\mid \#E({\mathbb{F}}_p)}$ for every stated prime.

Over the rationals there are already four two-torsion points, including the identity. Counting at five gives eight points: the abscissas zero, one and four give one ordinate each, two and three give two each, and there is the identity. Thus rational torsion has order dividing eight.

There are no rational points of order four. For a curve $y^2={\prod }_j(x-e_j)$, translating $e_i$ to zero and using the duplication formula shows that a half of $(e_i,0)$ must satisfy $(x-e_i{)}^2=(e_i-e_j)(e_i-e_k)$. For the three roots here, the candidate abscissas are $\pm 2$, $1\pm \sqrt{-3}$, and $4\pm 2\sqrt{3}$. The last two pairs are nonrational; at $x=2,-2$ the ordinate squares are $-4,-36$, also impossible over $\mathbb{Q}$. A group of order eight containing this two-torsion subgroup would contain an element of order four, because an elliptic curve has only four points killed by two. Hence

For a point with $u\ne 0$, consider the valuation $v_{\ell }$ at any rational prime. If $v_{\ell }(u)<0$, the term $u^3$ has strictly lower valuation than $a_1{u}^2$ and $b_{1}u$, since the coefficients are integral. Thus $2v_{\ell }(v)=3v_{\ell }(u)$, forcing $v_{\ell }(u)$ even. If $v_{\ell }(u)>0$ and $\ell \nmid b_1$, the factor $u^2+a_{1}u+b_1$ is a unit, so $2v_{\ell }(v)=v_{\ell }(u)$, again even. At valuation zero there is no odd exponent to remove.

Therefore every odd valuation in the square class of $u$ lies at a prime dividing $b_1$, and all negative valuations are even. Removing rational squares gives a signed squarefree integer $r$ with $r\mid b_1$. For $(0,0)$ the assigned class is that of $b_1$, whose squarefree representative also divides $b_1$; the identity has representative one. HenceThe brackets stress that these integers represent square classes, which is the target of $q$.

For rank-one two-isogeny descent with parameters three and minus three, use the standard two-isogeny rank formula. For $C:y^2=x(x^2+ax+b)$ and its dual curve $D:y^2=x(x^2-2ax+a^2-4b)$, let ${\alpha }_C,{\alpha }_D$ be the abscissa square-class maps, with their usual values at $(0,0)$ and the identity. If $r_C$ is the Mordell–Weil rank, thenFor the present curve $a=3,b=-3$, its possible classes are $1,-1,3,-3$, and the identity and $(0,0)$ supply $1,-3$. Exclude the class three as follows. A point in that class has $x=3(U/V{)}^2$, with coprime integers $U,V$, and substitution in the curve gives the necessary quartic equationwith integer $N$. Modulo three this forces $3\mid V,N$. Coprimality then makes $U$ a unit modulo three, and modulo nine the right side is $3U^4\equiv 3$, while $N^2\equiv 0$, a contradiction. The class minus one is excluded as well, since multiplying it by the known class minus three would give three. Therefore the first image has size two.

The dual curve is $D:y^2=x(x^2-6x+21)$. Its quadratic factor is $(x-3{)}^2+12>0$ on the real line, so every nonzero rational abscissa is positive. By (i) its image is contained in $\{1,3,7,21\}$. The point $(0,0)$ supplies 21 and the point $(3,6)$ supplies three. As the square-class map is a homomorphism, their product supplies seven. All four occur. Hence the descent formula gives $2^{r_C+2}=2\cdot 4=8$, so

Fix $P$ and put $e_m=h_x(mP)-m^2{h}_x(P)$ for $m\ge 0$. Then $e_0=e_1=0$. Apply the given approximate parallelogram identity with its two arguments $mP$ and $P$. The quadratic terms cancel exactly, leavingSet $d_m=e_m-e_{m-1}$. Starting from $d_1=0$, the inequality gives $|d_m|\le (m-1)C$. Summing from one to $m$ therefore yieldsThus $C_m=m(m-1)C/2$ works independently of $P$, including $m=1$.

The preceding bound at $m=2$ gives $|h_x(2Q)-4h_x(Q)|\le C$ for every point $Q$. For $a_n=4^{-n}{h}_x(2^{n}P)$, take $Q=2^{n}P$ to obtainFor $m>n$, summing the geometric tail givesThus the sequence is Cauchy and converges by completeness of the real numbers. The estimate also gives a quantitative bound on its distance from the limit.

For prime-power contraction in a formal group, a one-dimensional formal group over $R$ has $F(X,Y)=X+Y+$ terms of total degree at least two with coefficients in $R$. Induction under composition therefore givesFor $|x|<1$ this converges and the non-Archimedean inequality gives $|[p](x)|\le \max (|p||x|,|x{|}^2)$. The residue characteristic implies $|p|<1$; in equal characteristic $p$ the linear coefficient is zero, which only improves the bound.

Let $x_n=[p^n](x)$, so $x_{n+1}=[p](x_n)$. If $x=0$ there is nothing to prove. Otherwise put $\rho =\max (|p|,|x|)<1$. Inductively $|x_n|\le |x|$, and then $|x_{n+1}|\le \rho |x_n|$. ThusCompleteness ensures convergence of the formal-series evaluations. The contraction argument in fact does not need the extra discreteness assumption.

For prescribing a factor by elliptic-curve tripling, quadratic reciprocity gives $(3/p)=1$ when $p\equiv 1(\mathrm{mod}12)$. Choose $r\in {\mathbb{F}}_p$ with $r^2=3$ and choose an integer $a$ by the Chinese remainder theorem so thatThen $a^2+6a-3\equiv 0(\mathrm{mod}p)$ and it is four modulo $q$.

The curve $E:y^2=x^3+ax-a$ has discriminant $-16a^2(4a+27)$. At $p$, $a\ne 0$, since otherwise $r=3/2$ would force $p=3$. Also $4a+27=15+8r$ cannot vanish: squaring $8r=-15$ would give $192=225(\mathrm{mod}p)$, forcing $p=3$ or 11, neither in the required class. At $q$, $a=1$ makes $a(4a+27)=31$, and $q\equiv 5(\mathrm{mod}12)$ excludes $q=31$. Thus both reductions are nonsingular.

The point $P=(1,1)$ is on every curve in this family. Doubling it uses the invertible denominator two and givesModulo $p$ this difference vanishes, and the doubling ordinate is $-1$, so $2P=-P$ and $3P$ is the identity. Modulo $q$, taking $a=1$ gives $x(2P)=2$, so $2P$ and $P$ have distinct abscissas and their sum is a finite point.

Consequently the attempted addition computing $3P$ modulo $N$ asks to invert a denominator divisible by $p$ and not by $q$. Its numerator is nonzero modulo $p$, since the two ordinates there are minus one and one, so this is not a removable coincidence. The Euclidean gcd used for inversion returnsa proper factor. Thus the specified elliptic-curve computation successfully factors $N$.