Past exam of the mathematics course of the University of Cambridge / 2001 / iii / Paper 19 (Elliptic Curves)

There is a necessary ordering qualification: the printed formula requires the even leg to be called $b$. The primitive Pythagorean triple $(a,b,c)=(4,3,5)$ satisfies the printed hypotheses but cannot have $b=2nm$. Thus the intended assertion is true after interchanging the two legs if necessary. We prove that version, including the parity condition on the parameters.

A primitive Pythagorean triple has pairwise coprime sides: a prime dividing any two also divides the third. The two legs cannot both be odd, since their squares would sum to $2(\mathrm{mod}4)$, and cannot both be even. Call the odd leg $a$ and the even leg $b$; then $c$ is odd. The positive integerssatisfy $uv=(b/2{)}^2$ and are coprime, since a common divisor divides both $c$ and $a$. A product of coprime positive integers is a square only when both factors are squares, by their prime factorizations. Write $u=n^2$, $v=m^2$. Then $n>m>0$, $\gcd (n,m)=1$, andFurthermore $n,m$ have opposite parity, since $c$ is odd. Conversely these coprimality and parity conditions give a primitive triple: the square identity follows by expansion, and a common odd prime divisor of its legs would divide both $n,m$, while the odd leg excludes a common factor two. This is the primitive Pythagorean parametrization.

Suppose an integer right triangle with square area exists, and choose one with the least positive hypotenuse $c$. It is primitive. Indeed, dividing all sides by their common divisor $d$ gives an integer right triangle whose area is the square of the rational number $s/d$, where $s^2$ was the original area. Its area is an integer, since one of its legs is even. A rational number whose square is an integer is itself an integer, as follows by writing it in lowest terms. Thus division by $d>1$ would give another square-area triangle with smaller hypotenuse.

By the primitive Pythagorean parametrization, after ordering the legs the triangle has sides $n^2-m^2,2nm,n^2+m^2$, with coprime $n>m>0$ of opposite parity. Its area isThese four positive factors are pairwise coprime: the pair $n-m,n+m$ has gcd dividing $2m$ and is odd, and the other pairs have gcd one by $\gcd (n,m)=1$. Since the product is a square, each factor is a square. WriteBoth $w,z$ are odd. Odd squares are $1(\mathrm{mod}8)$, so $2m=w^2-z^2$ is divisible by eight; hence $m$ is divisible by four and $v$ is even. Define positive integersThey satisfyThus $(r,s,u)$ is another positive integer right triangle with square area, but its hypotenuse $u=\sqrt{n}$ is strictly smaller than $n^2+m^2=c$. This contradicts minimality. No integer right triangle has a nonzero square area. This is the Fermat right triangle theorem, with the actual infinite descent construction exhibited.

We use the basic dual isogeny identities in the endomorphism ring of an elliptic curve, extending the dual of the zero map to zero:Here $[n]$ denotes the multiplication-by-$n$ endomorphism, and the degree of the zero map is set to zero. To see the source of additivity, identify $E$ with its Picard group of degree-zero line bundles using the origin. Dualization is pullback on this group. Pullback of a degree-zero line bundle along the sum of two homomorphisms is the tensor product of its pullbacks along those homomorphisms, giving additivity; functoriality of pullback reverses composition. The last identity is the defining degree identity for a dual isogeny. Every nonzero elliptic-curve endomorphism is an isogeny.

The natural inclusion $\mathbb{Z}\hookrightarrow \mathrm{End}(E)$ remains injective even in positive characteristic: for nonzero $n$, the map $[n]$ has degree $n^2$ and is not zero. Therefore an equality of multiplication endomorphisms uniquely specifies its integer coefficient.

Apply the dual isogeny degree identity to $1-\varphi$. Its dual is $1-\hat{\varphi }$, soRearrangement givesThe right side is multiplication by an integer, proving the assertion. In particular the trace of an elliptic-curve endomorphism isThe argument includes $\varphi =0$ and $\varphi =1$ with the zero-map convention. Multiplying $\hat{\varphi }=[t]-\varphi$ by $\varphi$ also yields the useful characteristic relation

The $q$-power Frobenius isogeny sends affine coordinates to $(x^q,y^q)$, has degree $q$, and fixes exactly the points defined over ${\mathbb{F}}_q$, including the origin. ConsequentlyThe degree is $q$ because the $q$-power Frobenius on a smooth curve has function-field inseparable degree $q$. By the permitted separability of $1-\varphi$, this separable isogeny has exactly $\mathrm{deg}(1-\varphi )$ geometric kernel points; there is no inseparable multiplicity to remove. Part(i) therefore givesThis relates the elliptic-curve point count over a finite field to the integer trace, rather than treating the point count as an independently assumed definition of the trace.

The nonzero quadratic residues modulo five are $1,4$. The values of $x^3+x+1$ and the numbers of possible $y$ areThere are eight affine points and one point at infinity. Thus $\#E({\mathbb{F}}_5)=9$ and part(ii) gives $\boxed{\mathrm{tr}(\varphi )=5+1-9=-3}$. The curve is nonsingular, since its short-Weierstrass discriminant $-16(4+27)$ is nonzero modulo five.

The dual operation reverses products, so $\widehat{{\varphi }^2}=(\hat{\varphi }{)}^2$. Also $\varphi \hat{\varphi }=[5]$ and $\varphi +\hat{\varphi }=[-3]$. Squaring the latter identity givesTherefore $\boxed{\mathrm{tr}({\varphi }^2)=-1}$. Over ${\mathbb{F}}_{25}$ the Frobenius is ${\varphi }^2$, of degree $25$, soMore generally the Frobenius trace recurrence has $t_0=2$, $t_1=t$ and $t_j=t{t}_{j-1}-q{t}_{j-2}$; the square calculation is its first nontrivial case.

Let $L/{\mathbb{Q}}_p$ be finite, with ring of integers ${\mathcal{O}}_L$ and maximal ideal ${\mathfrak{m}}_L$. The formal group of an elliptic curve on an integral Weierstrass model is a formal group law $F(X,Y)\in {\mathcal{O}}_L[[X,Y]]$, and $\hat{E}(L)$ denotes its points with parameter in ${\mathfrak{m}}_L$. Its multiplication series isSince $p\nmid m$, the linear coefficient $m$ is a unit. Construct a compositional inverse $g(T)=m^{-1}T+{\sum }_{j\ge 2}{b}_j{T}^j$ recursively: at degree $j$, the coefficient of $b_j$ in $[m{]}_F(g(T))$ is $m$, so the equation making that degree vanish uniquely determines $b_j\in {\mathcal{O}}_L$. The inverse on the other side is the same series, by uniqueness of formal composition inverses.

Both series converge on ${\mathfrak{m}}_L$, since their coefficients are integral and powers of an element of ${\mathfrak{m}}_L$ tend to zero. Their formal identities therefore hold as identities of convergent values. Thus for every $P$ there is a unique $Q$ with $[m]Q=P$, andThis proves unique divisibility for every finite extension, including ramified extensions and negative $m$. It uses prime-to-residue-characteristic multiplication on a formal group, not an unjustified logarithm isomorphism on the entire maximal ideal.

Now assume good reduction of an elliptic curve. For a finite local extension $M$, the reduction sequence isProperness defines reduction for all points, smoothness and the Hensel lemma make it surjective, and its kernel is precisely the formal group. Let $K$ be the maximal unramified extension and take $P\in E(K)$. Its coordinates lie in a finite unramified extension $L/{\mathbb{Q}}_p$. Over the algebraic closure of the residue field, the isogeny $[m]$ is surjective, so choose $\overline{Q}$ with $[m]\overline{Q}=\tilde{P}$. This residue point is defined over a finite residue extension. Choose the corresponding finite unramified extension $M/L$ inside $K$, and lift it to $Q_0\in E(M)$ by smooth reduction.

Then $P-[m]Q_0$ lies in the reduction kernel. The first argument gives a unique kernel point $R$ with $[m]R=P-[m]Q_0$. Hence $Q=Q_0+R\in E(M)\subseteq E(K)$ satisfies $[m]Q=P$. ConsequentlyEvery lifting and convergence argument was made in a finite complete extension; $K$ itself need not be complete. Unique divisibility is asserted only for the formal group. For $|m|>1$, good reduction also lifts the prime-to-$p$ torsion, so $E(K)$ has nonzero $m$-torsion and division there is not unique. The construction is unramified division points at good reduction.

We prove that the only finite-order rational point is the origin: $\boxed{E(\mathbb{Q}{)}_{\mathrm{tors}}=\{O\}}$. The identity always has order one, so “no elements of finite order” must be understood as no nonidentity torsion points.

The given discriminant is a unit at $5$ and $7$, so the integral Weierstrass equation of an elliptic curve has good reduction at both primes. For an odd prime $p$, completing the square in $y^2+xy=f(x)$ shows that the number of $y$ above $x$ is determined byA nonzero quadratic residue gives two points, zero gives one, and a nonresidue gives none. Direct evaluation givesIncluding the origin gives $\#\tilde{E}({\mathbb{F}}_5)=10$ and $\#\tilde{E}({\mathbb{F}}_7)=13$.

At a good prime $p$, reduction is injective on torsion of order prime to $p$: a point in its kernel belongs to the formal group, where multiplication by that order is bijective by part(i), so a point killed by it must be zero. Suppose a nonidentity rational point has finite order. Taking a suitable multiple gives a point of prime order $\ell$. If $\ell \notin \{5,7\}$, reduction at both primes forces $\ell$ to divide both $10$ and $13$, impossible. If $\ell =5$, reduction at $7$ forces $5\mid 13$, impossible. If $\ell =7$, reduction at $5$ forces $7\mid 10$, also impossible. This exhausts all primes and proves the claim. The torsion exclusion from good reduction counts explicitly handles the two residual characteristics instead of incorrectly assuming prime-to-$p$ injectivity also controls $p$-torsion.

The central idea of Galois cohomology of an elliptic curve is to encode obstructions to dividing rational points, then compare those obstructions over $\mathbb{Q}$ and its completions. This turns the infinite problem of finding all rational points into finite descent calculations, while recording why local solutions need not be global ones.

Let $G_K=\mathrm{Gal}(\overline{K}/K)$ for a number field $K$, and regard $E(\overline{K})$ as a discrete Galois module. Then $H^0(K,E)=E(K)$. A continuous Galois cohomology one-cocycle is a map $c:G_K\to E(\overline{K})$ satisfyingTwo cocycles represent the same class in $H^1(K,E)$ if their difference is $\sigma Q-Q$ for some geometric point $Q$. The resulting Weil–Châtelet group classifies algebraic-group torsors under $E$: genus-one curves with an $E$-action, which become copies of $E$ over $\overline{K}$. Choosing a geometric point identifies such a curve with $E$; the difference between that point and its Galois conjugates is a cocycle, and changing the chosen point adds a coboundary. A torsor class is zero exactly when the curve has a $K$-point. Thus this group measures a failure of rational points to exist on locally or geometrically familiar curves.

For an integer $n\ge 2$, multiplication by $n$ is surjective on $E(\overline{K})$ and has kernel $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$. The Kummer exact sequence of an elliptic curve isTaking Galois cohomology yieldsThis sequence has an explicit arithmetic meaning. Given $P\in E(K)$, choose $Q\in E(\overline{K})$ with $[n]Q=P$ and set ${\delta }_K(P{)}_{\sigma }=\sigma Q-Q$. Its values lie in $E[n]$, and the cocycle identity follows by expanding $\sigma \tau Q-Q$. Choosing another $Q$ changes it by a coboundary in $E[n]$. Replacing $P$ by $P+[n]R$ with $R\in E(K)$ does not change the class. Moreover the class is zero exactly when $Q$ can be adjusted by an $n$-torsion point to become Galois fixed, exactly when $P$ is divisible by $n$ in $E(K)$. Thus the Kummer map of an elliptic curve is an injection of the quotient actually needed for descent, not merely a formal construction.

For each place $v$ of $K$, repeat this construction over the completion $K_v$. Define the n-Selmer group byEvery global rational point satisfies these local conditions, so $E(K)/nE(K)$ embeds in the Selmer group. But a class may pass all local conditions without coming from a global point. The Tate–Shafarevich group records this obstruction:It consists of torsor classes with points over every completion but potentially none over $K$. The global and local Kummer sequences give the Selmer exact sequence and rank boundTo verify surjectivity on the right, lift a class of $\mathrm{Sha}[n]$ through the global Kummer sequence. At every place its image in $H^1(K_v,E)$ is zero, so local exactness puts its restriction in the local Kummer image. The lift is therefore Selmer. The kernel on the left is the global Kummer image by global exactness. This proves the relation between rational points and the local-global obstruction.

Finiteness is what makes this framework useful. Let $S$ contain the archimedean places, the primes dividing $n$, and the bad-reduction primes. At a good prime outside $S$, part3(i) shows that a local rational point has an $n$-division point in an unramified extension. Its Kummer class is therefore unramified. Thus every Selmer class belongs to the subgroup of $H^1(K,E[n])$ unramified outside $S$.

Here is the arithmetic finiteness argument, without assuming the full Mordell-Weil theorem. Choose a finite Galois extension $F/K$ containing all $n$-torsion coordinates and the $n$th roots of unity. Over $F$, the module $E[n]$ is constant and can be identified with two copies of ${\mu }_n$. Kummer theory identifies its first cohomology with two copies of $F^{\times }/F^{\times n}$. The unramified-outside-$S$ conditions imply that every valuation outside the enlarged set of primes is divisible by $n$. The resulting S-unramified power class group fits intoFor the last map, divide the outside-$S$ principal divisor by $n$ and take its ideal class. Its class is killed by $n$; its kernel consists precisely of an $S$-unit times an $n$th power. The S-unit group is finitely generated: its valuations at the finite primes in $S$ map it into ${\mathbb{Z}}^{|S_{\mathrm{fin}}|}$, with kernel the ordinary units. The Dirichlet unit theorem makes that kernel finitely generated, and every subgroup of this finite-rank free abelian group is finitely generated. Thus the first term is finite. Finiteness of the ideal class group makes the last term finite. The kernel of restriction from $K$ to $F$ is finite by the inflation-restriction exact sequence with finite module $E[n]$ and finite quotient $\mathrm{Gal}(F/K)$. Hence the Selmer group is finite, as is $E(K)/nE(K)$. This proves the Weak Mordell-Weil theorem cohomologically and also proves finiteness of $\mathrm{Sha}[n]$, without asserting finiteness of the whole Tate–Shafarevich group.

For $K=\mathbb{Q}$, combine this finite quotient with a height descent. Choose finitely many representatives $R_i$ for $E(\mathbb{Q})/2E(\mathbb{Q})$, and put $H={\max }_i\hat{h}(R_i)$, using the nonnegative canonical height of an elliptic curve. Its height parallelogram identity gives $\hat{h}(P-R_i)\le 2\hat{h}(P)+2\hat{h}(R_i)$. Thus if $P=2Q+R_i$,Iteration eventually brings the height below $H+1$. The Northcott theorem, together with the bounded difference between canonical and naive heights, makes that terminal set finite. Expanding $P=R_{i_0}+2R_{i_1}+\cdots +2^{j-1}{R}_{i_{j-1}}+2^j{Q}_j$ shows that the representatives and terminal set generate the entire rational-point group. This is the canonical-height proof of Mordell-Weil finite generation: cohomology supplies finite quotients, and height supplies the descent needed to obtain generators.

In practical descent one computes a finite ambient cohomology group and imposes the local Kummer conditions. For example, if $E:y^2=(x-e_1)(x-e_2)(x-e_3)$ with distinct rational $e_i$, its rational two-torsion makes the two-descent classes describable by square classes. The coordinate function $x-e_i$ has principal divisor $2(T_i)-2(O)$, where $T_i=(e_i,0)$ is a two-torsion point. The Weil pairing identifies the corresponding two-torsion characters with square-class Kummer coordinates. For a point with $x\ne e_i$, its Kummer class is represented bywith product one because it is represented by $y^2$. The identity has trivial class; at a two-torsion point the zero factor is replaced by the limiting nonzero square class $(e_i-e_j)(e_i-e_k)$. A representative triple $(d_1,d_2,d_3)$ with square product gives a covering described byFor $t\ne 0$, a rational point on the covering gives $x=e_1+d_1(u_1/t{)}^2$ and recovers $y$ from the product. Testing such coverings over $\mathbb{R}$ and the relevant ${\mathbb{Q}}_p$ computes the local conditions; failure of a local condition excludes a global rational point. Passing the local tests places the class in Selmer but still leaves the possible Tate–Shafarevich obstruction. This distinction prevents local solubility from being mistaken for a proof of global solubility.

Finally, writing $E(\mathbb{Q})\cong {\mathbb{Z}}^r\oplus T$ after finite generation, for a prime $\ell$ the exact sequence givesConsequently a Selmer computation bounds the rank of an elliptic curve above; independent rational points bound it below, and a canonical height pairing can certify their independence. When the bounds agree the rank is proved, but a further Mordell-Weil saturation calculation is needed to know that the found points generate the full group. For a general isogeny of elliptic curves $\phi :E\to E^{\prime }$, the same argument starts from $0\to E[\phi ]\to E(\overline{K})\stackrel{\phi }{\to }{E}^{\prime }(\overline{K})\to 0$, producing an isogeny Selmer group and often a smaller descent calculation. Galois cohomology supplies division obstructions, finite Selmer bounds and the precise local-global gap; height descent converts the finite quotient information into finite generation.