Past exam of the mathematics course of the University of Cambridge / 2003 / iii / Paper 21 (Elliptic Curves)

The Mordell-Weil theorem gives $E(\mathbb{Q})\cong E(\mathbb{Q}{)}_{\mathrm{tors}}\oplus {\mathbb{Z}}^r$. Move the rational point of order two to $(0,0)$ and clear denominators to obtain an integral Weierstrass equation of an elliptic curveThe two-isogeny formula gives $E^{\prime }:Y^2=X(X^2-2aX+a^2-4b)$ and dual isogenies $\varphi :E\to E^{\prime }$, $\hat{\varphi }:E^{\prime }\to E$ with $\hat{\varphi }\varphi =[2]$. Compute the torsion subgroup using reduction of torsion points on an elliptic curve at several good primes, followed by division polynomials of an elliptic curve to identify the possible points.

For the free part, use two-isogeny descent. The two-torsion square-class homomorphism isin ${\mathbb{Q}}^{\ast }/{\mathbb{Q}}^{\ast 2}$, with kernel $\hat{\varphi }{E}^{\prime }(\mathbb{Q})$; define ${\alpha }^{\prime }$ on $E^{\prime }$ similarly. The prime-support bound in two-isogeny descent restricts the first image to signed square-free divisors of $b$ and the second to those of $a^2-4b$. For each candidate $d$, solve its two-isogeny descent quarticTest local solubility at the real place and the relevant p-adic fields, discard impossible classes, and search the surviving coverings for rational points. A point with $UV\ne 0$ gives $x=d(U/V{)}^2$, $y=dUN/V^3$. Include the identity and rational 2-torsion cases separately. Once both rational images are determined, the two-isogeny rank formula givesThe point searches give explicit candidates for a basis. Their canonical height pairing can certify independence; Mordell-Weil saturation and effective height bounds then certify that they generate the full free part. Rank alone does not certify generators of the whole Mordell-Weil group. If the rational images are not fully determined, the procedure instead supplies lower and upper bounds on the rank of an elliptic curve.

The obstruction is the local-to-global gap in isogeny descent. A two-isogeny descent quartic can have points over $\mathbb{R}$ and every p-adic field without a rational point. Local tests compute an isogeny Selmer group, which can strictly contain the rational-point quotient. For an isogeny of elliptic curves $\varphi :E\to E^{\prime }$, the comparison isThe last group is the kernel of $\varphi :\mathrm{Sha}(E/\mathbb{Q})\to \mathrm{Sha}(E^{\prime }/\mathbb{Q})$, so it records elements of the Tate–Shafarevich group invisible to all local tests. Searching a locally soluble covering which has no rational points never succeeds. Thus a Selmer group of an elliptic curve gives an upper bound and found independent points give a lower bound, and these need not coincide. Higher descent can improve the bounds, but this particular procedure has no unconditional guarantee of closing every gap.

For $E:y^2=x^3-17x$, the two-isogeny formula gives $E^{\prime }:Y^2=X^3+68X$. By the prime-support bound in two-isogeny descent, the image of the two-torsion square-class homomorphism on $E$ lies in $\{1,-1,17,-17\}$. The identity gives $1$, $T=(0,0)$ gives $-17$, and $P=(-1,4)$ gives $-1$, since $(-1{)}^3-17(-1)=16$. The image is a subgroup of the square-class group, so their product $17$ occurs as well; explicitly $P+T=(17,68)$. HenceOn $E^{\prime }$, a nonzero affine point has $X>0$, because $Y^2=X(X^2+68)$. The only candidate square classes are therefore $1,2,17,34$. The identity gives $1$, $T^{\prime }=(0,0)$ gives $[68]=17$, and $(2,12)$ gives $2$, since $2^3+68\cdot 2=144$. Their product $34$ occurs; adding $T^{\prime }$ gives $(34,-204)$. ThusBoth images have order four. The two-isogeny rank formula provesThis is the rank-two elliptic curve with cubic x cubed minus seventeen x; all candidate classes are represented, so no unresolved local-to-global gap in isogeny descent remains in this computation.

For each $x\in {\mathbb{F}}_p$, count the roots of $y^2=x^3+x^2+x+1$, and add the identity at infinity. A nonzero quadratic residue gives two roots, zero gives one, and a nonsquare gives none. Equivalently, with the Legendre symbol extended by ${\chi }_p(0)=0$,The numbers of affine $y$ values, in increasing $x$ order starting at zero, areso the answer isAll four reductions are smooth algebraic curves: the original PDF gives the elliptic-curve discriminant $-2^8$, so these odd primes are primes of good reduction.

Use the two-prime bound on rational elliptic torsion with the counts six at three and eight at five from solution. For a prime $\ell \ne 3,5$, the $\ell$-primary torsion subgroup injects into both reduced groups by reduction of torsion points on an elliptic curve. Its order therefore divides the corresponding primary part of $\gcd (6,8)=2$. The three-primary subgroup injects into the group of order eight at five and is trivial; the five-primary subgroup injects into the group of order six at three and is trivial. Hence the entire rational torsion subgroup has order at most two.

The factorization $x^3+x^2+x+1=(x+1)(x^2+1)$ supplies $T=(-1,0)$, a nonidentity point of order two under the elliptic curve group law. ThereforeThe primary-component argument avoids assuming injectivity on residue-characteristic torsion.

The rational point $P=(0,1)$ lies on $E$ and is neither the identity nor $(-1,0)$. By solution these are all the rational torsion points of an elliptic curve. Hence $P$ has infinite order and $E(\mathbb{Q})$ is infinite: its multiples $nP$ are distinct. No assertion about its being a generator or about the exact rank of an elliptic curve is needed here.

Only the prime two can ramify. More precisely, every field $\mathbb{Q}(P_n)$ is unramified at every odd prime; actual ramification at two depends on $P$ and the chosen division point. Use $[2^n]P_n=P$, as printed in the original PDF.

Fix an odd prime $p$ and put $N=2^n$. The elliptic-curve discriminant $-2^8$ gives good reduction at $p$, and $N$ is a unit in ${\mathbb{Z}}_p$. The unramified division torsors at good primes imply that all division points of an elliptic curve above $P$ are defined over finite unramified extensions of ${\mathbb{Q}}_p$. Here is a direct lifting proof, which does not require $P$ to have integral affine coordinates.

Properness gives a reduction $\tilde{P}$. Choose a point $\overline{Q}$ with $[N]\overline{Q}=\tilde{P}$ over the algebraic closure of the residue field, and a finite residue extension containing it. Pass to the corresponding finite unramified extension $K/{\mathbb{Q}}_p$. The surjectivity of good reduction over a local field lifts $\overline{Q}$ to $Q_0\in E(K)$. Its error $[N]Q_0-P$ lies in the kernel of reduction of an elliptic curve. The prime-to-residue-characteristic multiplication on a formal group makes $[N]$ bijective on that kernel. Choose the unique kernel point $R$ with $[N]R=[N]Q_0-P$; then $Q=Q_0-R$ satisfies $[N]Q=P$ and has reduction $\overline{Q}$.

Every algebraic division point has some such reduction and is the unique lift in its division fibre: the difference of two lifts lies in the reduction kernel, which has no $N$-torsion. Thus every chosen $P_n$ lies in an unramified local extension. For every prime of its possibly non-Galois coordinate field above $p$, the ramification index is one. Globally,One cannot universally assert that two actually ramifies: $P=O$ and $P_n=O$ give the field $\mathbb{Q}$. It can ramify. For example, a half of $T=(-1,0)$ isThe elliptic curve group law verifies this by doubling. Its coordinate field contains $\mathbb{Q}(\sqrt{2})$, which has ramification in the quadratic extension generated by the square root of two, so the only possible bad prime does occur for this choice.

An elliptic curve over $\mathbb{Q}$ has good reduction at $p$ if it admits an integral Weierstrass equation of an elliptic curve over ${\mathbb{Z}}_p$ whose reduced projective cubic is a smooth algebraic curve over ${\mathbb{F}}_p$. Equivalently, its Minimal Weierstrass equation has a unit elliptic-curve discriminant, or its smooth proper model is an elliptic curve over the valuation ring. The existence of an appropriate integral model matters: a nonminimal equation can have discriminant divisible by $p$ even when the curve has good reduction. Equivalently,

The supplied integral equation has elliptic-curve discriminant $\Delta =-11$. It therefore has good reduction at every $p\ne 11$. At eleven its discriminant has valuation one. Under a change of Weierstrass equation of an elliptic curve, discriminant valuations differ by a multiple of twelve. A good integral model would have valuation zero, which is impossible. This is the discriminant valuation obstruction to good reduction; it also shows the displayed model is minimal at eleven. Hence

Choose an integral Weierstrass equation of an elliptic curve with unit elliptic-curve discriminant. For $P\in E({\mathbb{Q}}_p)$, choose homogeneous coordinates $[X:Y:Z]$ in ${\mathbb{Z}}_p$ with at least one unit by multiplying all three coordinates by a common power of $p$. DefineTwo primitive integral representatives differ by a unit, so this is well-defined. Every point of the reduced cubic is a nonsingular point of an algebraic curve, and the identity reduces to $[0:1:0]$. This definition includes points whose affine coordinates are nonintegral.

To prove the good-reduction map respects elliptic addition, use the smooth proper integral model. The elliptic curve group law is a morphism on this model, constructed by addition of degree-zero divisor classes; it is defined even where an affine chord formula has a vanishing denominator. Passing to the residue field commutes with this morphism. Henceso reduction is a homomorphism of abelian groups.

For surjectivity, the simple-root Hensel lemma says that if $g\in {\mathbb{Z}}_p[t]$, $g(t_0)\equiv 0(\mathrm{mod}p)$ and $g^{\prime }(t_0)\not\equiv 0(\mathrm{mod}p)$, then there is a unique $t\in {\mathbb{Z}}_p$ with $t\equiv t_0(\mathrm{mod}p)$ and $g(t)=0$. The point at infinity lifts to $O$. At an affine point $(\overline{x},\overline{y})$ of the reduced equation $F(x,y)=0$, being a nonsingular point of an algebraic curve means at least one partial derivative $F_x,F_y$ is nonzero. If $F_y\ne 0$, fix any integral lift $x_0$ of $\overline{x}$ and apply the Hensel lemma to $g(t)=F(x_0,t)$ to lift $\overline{y}$. If $F_x\ne 0$, fix $y_0$ and lift $\overline{x}$ instead. This proves the surjectivity of good reduction over a local field and gives

An isogeny of elliptic curves over $k$ is a nonconstant morphism $\varphi :E_1\to E_2$ defined over $k$ and preserving the identity. Such a morphism is a group homomorphism: apply the Mumford rigidity lemma to $\varphi (P+Q)-\varphi (P)-\varphi (Q)$, whose restriction to either coordinate axis is zero. A nonconstant morphism of smooth projective curves is finite and surjective, so its degree of an isogeny is the positive integerDegrees multiply under composition. A separable isogeny has degree equal to the number of geometric points in its kernel of an isogeny. In positive characteristic of a field, inseparable isogenies also occur, for example the Frobenius isogeny; their total degree includes inseparable multiplicity, so counting geometric kernel points alone is insufficient. Every isogeny of degree $d$ has a dual isogeny $\hat{\varphi }$ satisfying $\hat{\varphi }\varphi =[d]$ and $\varphi \hat{\varphi }=[d]$.

Pointwise addition and negation make the homomorphism group of elliptic curves $H={\mathrm{Hom}}_k(E_1,E_2)$ an abelian group. Its zero is the constant identity map; every other element is an isogeny, because its nonconstant image is the whole target curve. Define $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We prove the positive definiteness of degree on elliptic-curve homomorphisms, including arbitrary characteristic.

Let $L={\mathcal{O}}_{E_2}(O)$, a line bundle associated to a divisor of degree one. On $E_2\times E_2$ write $m(P,Q)=P+Q$, $d(P,Q)=P-Q$ and let ${\pi }_i$ be the projections. The divisor proof of the degree parallelogram law givesHere is a direct justification. The degree-two Weierstrass coordinate $x$ has a double pole at $O$, and $x(P)=x(Q)$ precisely when $Q=P$ or $Q=-P$. Consequentlywhere $D_{+}$ is the diagonal and $D_{-}$ the graph of negation. Since $D_{+}=d^{-1}(O)$ and $D_{-}=m^{-1}(O)$, this principal divisor gives the displayed line bundle identity. This remains valid in characteristic two: the general Weierstrass equation of an elliptic curve of a smooth algebraic curve has a nontrivial generic involution $(x,y)\mapsto (x,-y-a_{1}x-a_3)$, so the two graphs still occur. This identity is also the symmetric-line-bundle form of the Theorem of the square.

Pull back the bundle identity along $(\varphi ,\psi ):E_1\to E_2\times E_2$ and take degrees of line bundles. For a nonzero map, $\mathrm{deg}({\varphi }^{\ast }L)=q(\varphi )$; for a zero map its pullback is trivial and has degree zero. Thus the degree parallelogram law isUsing bundles rather than pulling back the rational function itself is essential when $\varphi =\pm \psi$, where that function can vanish identically. Negation preserves degree, so $q(-\varphi )=q(\varphi )$. Applying the parallelogram identity to $n\varphi$ and $\varphi$ gives the quadratic degree recursion for elliptic multiplication, and induction from $q(0)=0$ yields $q(n\varphi )=n^{2}q(\varphi )$ for every integer $n$.

Define the bilinear degree pairing for elliptic-curve homomorphisms byIt is symmetric and odd in each argument. Two applications of the parallelogram law giveAdding proves $B(x+z,y)=B(x,y)+B(z,y)$, and symmetry proves additivity in the other argument. Also $B(\varphi ,\varphi )=q(\varphi )$. Therefore $q$ is an integer-valued quadratic form. The integral polarization is $2B(\varphi ,\psi )=q(\varphi +\psi )-q(\varphi )-q(\psi )$; $B$ itself may be half-integral.

Finally $q(\varphi )>0$ for every nonzero $\varphi$, since an isogeny has positive finite degree. If $n\varphi =0$ with $n\ne 0$, the identity $q(n\varphi )=n^{2}q(\varphi )$ forces $\varphi =0$, so $H$ is a torsion-free abelian group. On any finite-dimensional rational span in $H\otimes \mathbb{Q}$, the pairing has a rational matrix and is positive on every nonzero rational vector. By density it is nonnegative on real vectors; if that rational matrix were singular, its kernel would contain a nonzero rational vector, contradicting strict positivity. Thus its real extension is a positive-definite quadratic form. This establishes the required positivity as well as the quadratic identity. For example, on the subgroup of multiplication maps $[n]$, $q([n])=n^2$; on the endomorphism ring of an elliptic curve with complex multiplication it is the imaginary-quadratic field norm, explaining the lattice geometry behind isogeny degrees.