Past exam of the mathematics course of the University of Cambridge / 2002 / iii / Paper 24 (Elliptic Curves)

Let $O=(0:1:0)$ be the point at infinity of the Weierstrass equation of an elliptic curve. It is the identity element for the elliptic curve group law. For an affine rational point $P=(x,y)$, the inverse isIndeed, the two affine intersections with the vertical line have these ordinates, since their sum as roots of the quadratic in $y$ is $-a_{1}x-a_3$. This reflection is valid for a generalized Weierstrass equation of an elliptic curve in every characteristic of a field.

For distinct $P,Q$, draw their line; for $P=Q$, draw the tangent line. Let $R$ be its third intersection with the elliptic curve, counted with intersection multiplicity. Then the sum is the reflection of the third intersection:A vertical line has third intersection $O$, so $P+(-P)=O$. If a tangent has third intersection $O$, then $2P=O$. Define addition with $O$ by $P+O=P$; these conventions include all exceptional cases of the affine construction.

The construction is defined over the coefficient field: after two known intersections, the remaining root is rational over that field. It gives a commutative group operation. To see why it is associative, use the elliptic curve group law from Riemann-Roch: the map $P\mapsto [P-O]$ identifies the elliptic curve with its degree-zero divisor class group. A line has intersection divisor $P+Q+R$ linearly equivalent to $3O$, the divisor of the line at infinity. Thus $[P-O]+[Q-O]+[R-O]=0$. The geometric sum agrees with addition of divisor classes, which is associative.

Here the inverse in the elliptic curve group law is $(x,y)\mapsto (x,-y-1)$. For $P_0+P_1$, the line is $y=2-2x$. Substitution in the Weierstrass equation of an elliptic curve givesThe third intersection is $(3,-4)$, so reflection givesFor the difference, first take $-P_1=(1,-1)$. The line through $P_0$ and $-P_1$ is $y=2-3x$, and now the intersection polynomial is $x(x-1)(x-8)$. Its third point is $(8,-22)$, givingFinally, implicit differentiation gives $(2y+1)y^{\prime }=3x^2-7$. The tangent line at $P_1$ therefore has slope $-4$ and equation $y=4-4x$. Its intersection polynomial factors as $(x-1{)}^2(x-14)$. The double root records the intersection multiplicity of the tangent, and the remaining intersection is $(14,-52)$. Hence

Move the nonidentity rational 2-torsion point to $T=(0,0)$ and complete the square. After a rational change of coordinates, the elliptic curve has an integral modelThe two-isogeny formula gives a partnerand the isogeny of elliptic curves and its dual isogeny areBoth extend at the exceptional points; their kernels are the identities and the distinguished 2-torsion points, and $\hat{\varphi }\varphi =[2]$.

The two-torsion square-class homomorphism is $\alpha (O)=1$, $\alpha (T)=[b]$, and $\alpha (x,y)=[x]$ otherwise, with values in ${\mathbb{Q}}^{\ast }/{\mathbb{Q}}^{\ast 2}$. Its kernel is $\hat{\varphi }{E}^{\prime }(\mathbb{Q})$. Define ${\alpha }^{\prime }$ on the partner in the same way. By the prime-support bound in two-isogeny descent, representatives are signed squarefree divisors $d$ of $b$, or of $b^{\prime }$ for the partner. A class is realized precisely when its quartic covering in a two-isogeny descent has a rational solution:For $UV\ne 0$, this comes from $x=d(U/V{)}^2$ and $y=dUN/V^3$; the cases $U=0$ or $V=0$ account for the distinguished point and the identity. Test this finite list using signs and local congruences, and exhibit rational solutions for the surviving classes. The local-to-global gap in isogeny descent matters: local solubility gives an upper bound from the isogeny Selmer group, so a rank determination requires matching actual classes or further descent, not merely declaring every locally soluble cover to have a rational point.

Once the two actual images are determined, the two-isogeny rank formula isFor completeness, put $A=E(\mathbb{Q})$ and $B=E^{\prime }(\mathbb{Q})$. The Mordell-Weil theorem gives $[A:2A]=2^r|A[2]|$. The index of a subgroup formula through $\hat{\varphi }B$ givesHere $\ker \hat{\varphi }\cap \varphi A=\varphi (A[2])$, since $\hat{\varphi }\varphi =[2]$, and this image has size $|A[2]|/2$. The denominator is therefore $4/|A[2]|$, proving the displayed rank of an elliptic curve formula.

Use two-isogeny descent with $a=-7$, $b=12$, so the partner elliptic curve is $E^{\prime }:Y^2=X^3+14X^2+X$. On $E$, a negative $x$ would make $x(x-3)(x-4)$ negative. Hence the prime-support bound in two-isogeny descent restricts the square class image to $\{1,2,3,6\}$. All four occur: the identity gives $1$, and the rational points $(2,2)$, $(0,0)$, $(6,6)$ give respectively $2$, $12\equiv 3$, and $6$ in ${\mathbb{Q}}^{\ast }/{\mathbb{Q}}^{\ast 2}$. Thus $|\alpha E(\mathbb{Q})|=4$.

For the partner, $b^{\prime }=1$, so its square class image is contained in $\{1,-1\}$. A realization of $-1$ would yield coprime integers $U,V$, not both zero, satisfyingIf exactly one of $U,V$ is odd, the right side is $3$ modulo four, which is not a square. If both are odd, $U^4\equiv V^4\equiv 1(\mathrm{mod}16)$ and $14U^2{V}^2\equiv 14(\mathrm{mod}16)$, so the right side is $12$ modulo sixteen, again impossible. Both even is excluded by coprimality. This proves the negative unit obstruction for the fourteen-coefficient isogeny cover; the identity realizes $1$, so $|{\alpha }^{\prime }{E}^{\prime }(\mathbb{Q})|=1$.

The two-isogeny rank formula now gives $2^r=4\cdot 1/4=1$. Consequently this is the rank-zero elliptic curve with roots zero three and four:The displayed nonzero-ordinate points are therefore torsion points of an elliptic curve, rather than evidence of positive rank. In fact doubling either $(2,2)$ or $(6,6)$ gives $(4,0)$, so both have order four.

For the affine polynomial $f(x,y)=y^2+y-x^3+x$, a singular point of an algebraic variety must satisfy $f=f_x=f_y=0$. Modulo $37$, the derivative equations are $2y+1=0$ and $3x^2=1$. Thus $y=18$ and $x^2=25$, giving candidates $x=5$ and $x=32$. At $(5,18)$, the two sides of the curve equation are both $9$ modulo $37$. At $(32,18)$, the right side is $28$, so that candidate is not on the curve. The point at infinity is nonsingular: for the homogeneous equation $Y^{2}Z+Y{Z}^2-X^3+X{Z}^2=0$, the derivative with respect to $Z$ is one at $(0:1:0)$. Therefore the unique singular point of an algebraic variety is

Count affine solutions and then add the point at infinity. Over the finite field ${\mathbb{F}}_2$, both values of $x$ give $x^3-x=0$, and both values of $y$ solve $y^2+y=0$. Hence there are four affine points. Over ${\mathbb{F}}_3$, all three values of $x$ give zero, and each has the two ordinates $0,2$, giving six affine points.

Over the finite field ${\mathbb{F}}_{11}$, completing the square gives $(2y+1{)}^2=1+4(x^3-x)$. The square residues are $0,1,3,4,5,9$. For $x=0,1,\dots ,10$, the right sides and the corresponding numbers of ordinates areTheir sum is sixteen. The resulting elliptic-curve point counts over a finite field are

The elliptic-curve discriminant is $37$, so the elliptic curve has good reduction at both $2$ and $3$. At a prime $\ell$ of good reduction, the reduction of torsion points on an elliptic curve is injective on torsion of order prime to $\ell$. Here is the formal reason: the kernel of reduction of an elliptic curve is described by an integral formal group law on $\ell {\mathbb{Z}}_{\ell }$, and its multiplication series is $[n](t)=nt+O(t^2)$. If $\ell \nmid n$, the first term has strictly smaller valuation than every higher term for $t\ne 0$. Thus this kernel has no nonidentity point killed by $n$.

Apply this to each prime-primary component of the rational torsion subgroup. A component at $2$ injects into ${\tilde{E}}_3({\mathbb{F}}_3)$, of order $7$, and is therefore trivial. A component at $3$ injects into ${\tilde{E}}_2({\mathbb{F}}_2)$, of order $5$, and is trivial. Every other prime-primary component injects into both groups, so its order divides $\gcd (5,7)=1$. This proves the two-prime bound on rational elliptic torsion in the present case:

At $2$ there is good reduction, and the surjectivity of good reduction over a local field gives an exact sequenceThe quotient has order $5$ and is consequently a cyclic group. For every odd integer $n$, multiplication by $n$ is an automorphism of $E_1({\mathbb{Q}}_2)$: its formal group law has multiplication series $nt+O(t^2)$ with unit linear coefficient, whose inverse formal power series has integral coefficients and converges on $2{\mathbb{Z}}_2$. This is the prime-to-residue-characteristic multiplication on a formal group.

Thus the odd-primary torsion subgroup injects into the order-five quotient. It also realizes that quotient: choose a lift $P$ of any reduced point, so $[5]P\in E_1$. There is a unique $Q\in E_1$ with $[5]Q=[5]P$. Then $P-Q$ is killed by five and has the prescribed reduction. This proves the prime-to-p torsion lifts uniquely at good reduction directly here. Therefore, for an odd prime $p$,The five-primary subgroup consists of the unique five-torsion lifts of the five reduced points. These lifts need not be rational over $\mathbb{Q}$; the preceding answer about rational torsion points of an elliptic curve does not contradict their existence over the p-adic field.

For every prime $p\ne 37$, the elliptic-curve discriminant is a unit modulo $p$, giving good reduction. Hasse's theorem on elliptic curves givesEquivalently, the elliptic-curve point count over a finite field lies between $p+1-2\sqrt{p}$ and $p+1+2\sqrt{p}$, including for $p=2$.

Work near the identity $O$ of a generalized Weierstrass equation of an elliptic curve. On the projective chart where $Y\ne 0$, use the local parameter $t=-x/y$ and the auxiliary coordinate $w=-1/y$. Substitution givesThe coefficient of $w$ in the linearized equation at $(0,0)$ is one. Consequently, successive coefficient comparison determines a unique formal power series $w(t)$, without dividing by any coefficient of the equation. Its initial terms areRecover the affine coordinates as Laurent series $x=t/w(t)$ and $y=-1/w(t)$; in particular $x=t^{-2}+O(t^{-1})$ and $y=-t^{-3}+O(t^{-2})$.

The elliptic curve group law is a regular morphism near $(O,O)$. Applying the local parameter to the sum and passing to completed local rings producesOne can construct the series without any nonunit division. PutThe divided difference is an integral formal power series, including its tangent line specialization at $T_1=T_2$. The line $w=\lambda t+\nu$ meets the cubic in the two chosen points and a third point $R$. Substitution in the equation shows that its cubic and quadratic coefficients in $t$ are $-A,-B$, whereSince $\lambda$ has total degree at least two and $\nu$ at least three, $A$ is a unit. The sum of the roots therefore givesThe last expression reflects the third intersection according to the chord-and-tangent group law. Both denominators have constant term one. This proves integrality of the universal construction and also provides an explicit coefficient algorithm. Expanding it, the resulting formal group of an elliptic curve beginsThe integral coefficient recursion and the unit-denominator addition calculation work universally over $\mathbb{Z}[a_1,a_2,a_3,a_4,a_6]$; thus these coefficients specialize in every characteristic of a field. This is the initial coefficients of the elliptic formal group at infinity construction, rather than a definition requiring division by the elliptic-curve discriminant.

The identity, commutativity and associativity of the elliptic curve group law give the defining identities of a one-dimensional commutative formal group law:Reflection in the generalized Weierstrass equation of an elliptic curve gives its formal inverse explicitly:Successive addition gives the multiplication series $[n{]}_F(T)=nT+O(T^2)$.

In characteristic zero, an especially useful description comes from the invariant differential on an elliptic curve:Integrating with zero constant term constructs the formal logarithmTranslation invariance of the invariant differential on an elliptic curve implies $L(F(X,Y))=L(X)+L(Y)$. Thus the formal logarithm converts the formal group law into the formal additive group in characteristic zero. Expanding this identity to degree three also recovers the displayed coefficients of $F$; in positive characteristic the integral addition construction remains valid although the logarithmic denominators may not exist.

Choose an integral Minimal Weierstrass equation over ${\mathbb{Z}}_p$. Let $E_0({\mathbb{Q}}_p)$ be the points with nonsingular reduction, and let $E_1({\mathbb{Q}}_p)$ be those reducing to $O$. This distinction matters at bad reduction of an elliptic curve: the whole singular reduced cubic is not a group. The smooth locus is a group under the induced elliptic curve group law, and Hensel's lemma lifts each of its rational points, givingThe formal kernel of a minimal Weierstrass equation identifies $E_1({\mathbb{Q}}_p)$ with $p{\mathbb{Z}}_p$ equipped with $F$. Indeed, the integral series $w(t)$ converges there, and $x=t/w(t)$, $y=-1/w(t)$ give the unique point for each nonzero parameter. If $v_p(t)=r>0$, then $v_p(x)=-2r$ and $v_p(y)=-3r$; the parameter zero gives $O$. Conversely a point reducing to $O$ has these local coordinates of positive valuation, so is recovered by the series.

Define $E_m$ for $m\ge 1$ by $t\in p^m{\mathbb{Z}}_p$. The linear part of the formal group law is addition, and the higher terms have degree at least two. Hence the filtration of elliptic-curve points over a local field hasAt good reduction, $E_0=E$ and $E/E_1\cong \tilde{E}({\mathbb{F}}_p)$. At bad reduction, there is also the finite quotient $E/E_0$: $E({\mathbb{Q}}_p)$ is a compact group because the curve is projective, and $E_0$ is an open subgroup, so its index of a subgroup is finite. Together these quotients and the formal filtration describe the group, including the extra components at bad primes.

The formal logarithm makes the deepest part explicit. Write $L(T)=T+{\sum }_{n\ge 2}{c}_n{T}^n$. Since its derivative is the integral invariant differential of a formal group law, $n{c}_n\in {\mathbb{Z}}_p$. ConsequentlyThe inequality $v_p(n)\le (n-1)/(p-1)$ shows that for an integer $m>1/(p-1)$ every nonlinear term on $p^m{\mathbb{Z}}_p$ has strictly higher valuation than the linear term. After scaling, $L$ is the identity plus a strictly contracting series; solving $L(t)=u$ by successive correction gives its inverse formal group exponential. Thus the deep logarithm subgroup of a formal group givesOne may take $m=1$ for odd $p$ and $m=2$ for $p=2$. In particular, $E({\mathbb{Q}}_p)$ contains an open subgroup isomorphic to the additive p-adic integers, and the remaining information is in finite quotients and their group extensions.

Assume good reduction, and write $N_p=\#\tilde{E}({\mathbb{F}}_p)$. The surjectivity of good reduction over a local field and the formal group law determine the torsion as follows. If $p\nmid n$, multiplication by $n$ is an automorphism of $E_1$, because its multiplication series has an integral compositional inverse with unit linear coefficient. Therefore reduction gives an isomorphismTo construct the inverse, lift a reduced point to $P$, solve $[n]Q=[n]P$ uniquely in $E_1$, and use $P-Q$. This proves the prime-to-p torsion lifts uniquely at good reduction, including uniqueness, rather than merely comparing orders.

For residue-characteristic torsion, use a deep logarithm subgroup of a formal group. Take $m=1$ for odd $p$, or $m=2$ at two. The formal logarithm identifies $E_m$ with $p^m{\mathbb{Z}}_p$, so $E_m$ has no torsion. The finite quotient grouptherefore receives the torsion subgroup injectively. There is a complete test for which cosets actually contain torsion. For a coset $g$ of order $n$, choose a lift $P$. Then $[n]P\in E_m$. Its coset has a torsion representative exactly whenWhen this condition holds, let $Q\in E_m$ be the unique point with $L(Q)=L([n]P)/n$. Then $T=P-Q$ is killed by $n$ and represents $g$. Conversely, any torsion representative has order precisely $n$, since an element killed in the quotient would belong to the torsion-free group $E_m$. It must therefore arise from this construction. Changing $P$ by $R\in E_m$ changes $L([n]P)$ by $nL(R)$, so the test is independent of the chosen lift. This proves the torsion test using a deep formal logarithm subgroup and gives the full torsion by a finite list of cosets and a logarithmic divisibility test.

For odd $p$, one has $E_m=E_1$, so all torsion points of an elliptic curve inject into $\tilde{E}({\mathbb{F}}_p)$. Nevertheless a reduced $p$-primary point need not lift to a torsion point: if its order is $p^r$, the test is $L([p^r]P)\in p^{r+1}{\mathbb{Z}}_p$. For $p=2$, the subgroup $E_2$ is torsion-free but $E_1/E_2$ has order two. Thus $E_1$ can have a two-torsion point, and one must use $G=E/E_2$ of order $2N_2$ rather than assert that all torsion injects under reduction. The prime-two torsion bound for good reduction follows: the reduction kernel contributes at most a subgroup of order two. These distinctions are essential to a correct determination of local torsion subgroups.