Past exam of the mathematics course of the University of Cambridge / 2006 / iii / Paper 29 (Elliptic Curves)

Write $N=\#E({\mathbb{F}}_q)$. The Hasse bound isWe prove it using isogeny degrees of endomorphisms, with no assumption about a pre-existing Frobenius eigenvalue estimate. The standard elliptic isogeny facts we use are these: isogeny degree is multiplicative under composition; $\mathrm{deg}[m]=m^2$; assigning isogeny degree zero to the zero homomorphism makes isogeny degree a quadratic form, satisfying the degree parallelogram law; and the isogeny degree of a separable isogeny equals the number of its geometric kernel of an isogeny points.

Let $\varphi$ be the $q$-power Frobenius isogeny. It has isogeny degree $q$ and zero differential. Therefore $1-\varphi$ has differential the identity and is a separable isogeny. Its kernel of an isogeny consists exactly of the points fixed by Frobenius, including the identity, soPut $t=q+1-N$. Polarization of the isogeny degree quadratic form gives, for all integers $m,n$,The cross coefficient is fixed by the case $m=n=1$, where the isogeny degree is $N=1-t+q$; the coefficients of $m^2,n^2$ are $\mathrm{deg}1=1$ and $\mathrm{deg}\varphi =q$.

Every isogeny degree is nonnegative. For $n\ne 0$, divide by $n^2$ to obtain $u^2-tu+q\ge 0$ for every rational $u=m/n$. Continuity and density of the rationals imply the same inequality for real $u$. Its minimum, attained at $u=t/2$, is $q-t^2/4$, so $t^2\le 4q$. This is precisely the stated bound. Equality is allowed; a zero value of the quadratic form can occur when the two endomorphisms involved are rationally dependent.

The given relation impliesTake isogeny degrees and cancel the positive integer $\mathrm{deg}\pi$. Multiplicativity of isogeny degree givesAs above, $\mathrm{deg}(1-{\varphi }_i)=\#E_i({\mathbb{F}}_q)$ and $\mathrm{deg}{\varphi }_i=q$. The degree parallelogram law on $\mathrm{End}(E_2)$ now yieldsSubstitution provesEquivalently, their Frobenius traces are negatives of one another. The isogeny degree argument works over the algebraic closure, so it does not wrongly assume that $\pi$ is defined over ${\mathbb{F}}_q$; the stated quadratic-extension hypothesis is compatible with the anticommutation relation.

The projective completion has identity $O=[0:1:0]$. For this Weierstrass equation of an elliptic curve, negation isFor distinct affine points $P,Q$, draw their chord; for $P=Q$, use the tangent with its intersection multiplicity. If the third intersection is $R$, define $P\oplus Q=-R$. A vertical chord pairs $P$ with $-P$ and gives their sum $O$; also $P\oplus O=P$. A vertical tangent at a point satisfying $2y+1=0$ gives $2P=O$.

For a nonvertical line $y=mx+b$, substitution into the cubic givesThus if $P=(x_1,y_1)$ and $Q=(x_2,y_2)$, the sum has coordinatesHere $m=(y_2-y_1)/(x_2-x_1)$ for a chord, and implicit differentiation givesfor a nonvertical tangent. These formulas include the repeated-root case. Associativity can be seen without a lengthy coordinate calculation: a line cuts the cubic in a divisor equivalent to $3(O)$, and $P\mapsto [(P)-(O)]$ identifies the curve with its degree-zero divisor class group. The chord-and-tangent operation becomes addition of divisor classes, hence is associative.

At $P_1=(0,0)$ the tangent slope is $-2$, so its equation is $y=-2x$. Substitution leaves $x^3=0$; this tangent meets the curve three times at $P_1$. The chord-and-tangent group law therefore givesIn particular $P_1$ has exact order three. The chord through $P_1$ and $P_2=(-2,-4)$ is $y=2x$. Substitution gives $x(x+2)(x-2)=0$, so the third intersection is $(2,4)$. Negating it gives

The primes $2,3,5$ do not divide the elliptic-curve discriminant $-91$, so all three reductions are nonsingular. Count affine solutions and add the point at infinity. At $p=2$ the right side takes values $0,1$ at $x=0,1$, while $y^2+y=0$ for both values of $y$. This gives two affine points, namely $(0,0),(0,1)$.

At $p=3$, the right-side values at $x=0,1,2$ are $0,0,2$. The corresponding numbers of solutions to $y^2+y$ are $2,2,1$, giving five affine points. At $p=5$, the right-side values at $x=0,1,2,3,4$ are $0,3,0,2,0$, with respective solution counts $2,0,2,2,2$, giving eight affine points. Therefore

Use the standard theorem on reduction of torsion points on an elliptic curve: at a prime of good reduction, reduction is injective on torsion whose order is prime to that prime. Reduction at $2$ implies that every odd-primary part of the rational torsion subgroup has order dividing $3$. Thus its only possible odd prime is $3$, and its $3$-primary part has order at most $3$. Reduction at $5$ injects the $2$-primary part into a group of order $9$, so that part is trivial. No other primary part can occur.

Consequently the torsion subgroup has order at most three. Since $P_1$ has exact order three,This argument uses only prime-to-residue-characteristic injectivity, and therefore avoids an unjustified claim of full torsion injectivity at the prime $2$.

We can use reduction instead of expanding a very large rational addition formula. Modulo $2$, both $P_1$ and $P_2$ reduce to $(0,0)$, which generates the three-element reduced group. The reduction homomorphism therefore givesThe rational point $P_2$ is not any of the three torsion points just found, so it has infinite order. In particular $R=P_1+5P_2\ne O$: otherwise multiplication by three would give $15P_2=O$.

If $R$ had integral coordinates, its affine integral representative would reduce to an affine point modulo $2$, not to the point at infinity. This contradicts its reduction to $O$. ThusIndeed, it is not even integral at $2$. This is a reduction certificate for a nonintegral elliptic point, with the crucial nonidentity condition verified by the torsion calculation.

Here $F$ is the usual one-dimensional commutative formal group law. Normalize the valuation $v$ by $v(\pi )=1$, and put $e=v(p)$. We show explicitly that for any integer $m>e/(p-1)$,This subgroup will have finite index in $F(\pi {\mathcal{O}}_K)$.

Set $a(T)={\partial }_{Y}F(T,0)$. Since $F(X,Y)=X+Y+$ terms of total degree at least two, $a(T)\in 1+T{\mathcal{O}}_K[[T]]$. Its inverse has integral coefficients, say $a(T{)}^{-1}={\sum }_{j\ge 0}{c}_j{T}^j$ with $c_0=1$. Define the formal logarithm over $K$ byDifferentiate associativity $F(F(X,Y),Z)=F(X,F(Y,Z))$ with respect to $Z$ at zero. This gives $a(F(X,Y))={\partial }_{Y}F(X,Y)a(Y)$, soEvaluating at $Y=0$ proves the formal identity $\ell (F(X,Y))=\ell (X)+\ell (Y)$.

The coefficients satisfy $v(c_{n-1}/n)\ge -e{v}_p(n)$. Thus the series converges on $\pi {\mathcal{O}}_K$, since for $v(T)\ge 1$ the valuations of its terms are at least $n-e{v}_p(n)\to \infty$. More quantitatively,Indeed, if $k=v_p(n)$ then $n\ge p^k\ge 1+k(p-1)$. If $v(T)\ge m>e/(p-1)$, every nonlinear term has valuation strictly greater than $v(T)$. Write $h(T)=\ell (T)-T$. For $S,T\in {\pi }^m{\mathcal{O}}_K$, use $T^n-S^n=(T-S){\sum }_{j=0}^{n-1}{T}^{n-1-j}{S}^j$ to obtainThe extra valuation is integral and positive because $(n-1)m-e{v}_p(n)>0$ for all $n\ge 2$.

For any $b\in {\pi }^m{\mathcal{O}}_K$, solve $\ell (T)=b$ by iterating $T\mapsto b-h(T)$. This map preserves the complete ball ${\pi }^m{\mathcal{O}}_K$ and improves differences by at least one valuation step. The contraction mapping theorem gives a unique solution. Therefore $\ell$ is a bijection of this ball onto itself, and the formal identity, now evaluated in convergent series, makes it a group isomorphism. Multiplication by ${\pi }^{-m}$ then identifies the additive target with ${\mathcal{O}}_K$.

Integral coefficients in $F$ and its formal inverse ensure that every $F({\pi }^j{\mathcal{O}}_K)$ is a subgroup. Reduction modulo ${\pi }^m$ respects the group law; two parameters represent the same coset of $F({\pi }^m{\mathcal{O}}_K)$ exactly when they are congruent modulo ${\pi }^m$. If the residue field has $q_K$ elements, the quotient consequently has $q_K^{m-1}$ elements. This proves both the finite-index assertion and the claimed additive structure, with an explicit depth that also works in ramified extensions and when $p=2$.

Arithmetic heights measure arithmetic complexity. For a reduced rational number $x=a/b$, its multiplicative height is $H(x)=\max (|a|,|b|)$ and its logarithmic height is $h(x)=\log H(x)$. Over a number field $K$, use the absolute projective heightNormalize the absolute values on a field by the product formula. That formula makes arithmetic height independent of the chosen homogeneous representative, and the normalization makes it independent of enlarging $K$. The Northcott theorem says that algebraic points of bounded degree and bounded arithmetic height form a finite set. For rational numbers this follows immediately by bounding the numerator and denominator. In a fixed number field, the same finiteness follows by bounding the coefficients of the minimal polynomial using its conjugates and the arithmetic height.

For an elliptic curve put $h_x(P)=h([x(P):1])$ and $h_x(O)=0$. The two points above a given $x$ show that bounded $h_x$ gives finitely many $K$-rational points. More importantly, multiplication expands this arithmetic height. To see the mechanism, choose a short Weierstrass equation of an elliptic curve $y^2=x^3+Ax+B$ over $K$. Doubling givesAfter homogenization the numerator and denominator are quartics with no common zero. At infinity the numerator is nonzero; at a root $t$ of the cubic the numerator becomes $(3t^2+A{)}^2$, nonzero by nonsingularity. For a degree-$d$ morphism of the projective line, fixed homogeneous coefficients give the upper arithmetic height bound $h(f(x))\le dh(x)+C$. A nonzero resultant supplies the reverse bound: at each place it bounds the common cancellation of the two homogeneous values, with a nontrivial constant needed at only finitely many places. Applying these bounds to duplication gives a constant $C$ independent of $P$ withThis includes points mapping to $O$, by the projective formulation.

The canonical height removes the bounded errors. With the conventional factor one half, defineThe successive terms before multiplying by one half differ by at most $C{4}^{-n-1}$. The limit exists, and summing this geometric bound givesHence bounded canonical height still gives finitely many points over the fixed number field.

To obtain the pairing, the quadratic nature comes from a uniform arithmetic height parallelogram estimate, not just from doubling. If $x=x(P)$ and $z=x(Q)$, the unordered coordinates $x(P+Q),x(P-Q)$ are the roots of the binary quadratic with coefficientsThese formulas follow by adding and multiplying the two chord expressions with slopes $(y(P)-y(Q))/(x-z)$ and $(y(P)+y(Q))/(x-z)$. Their homogenizations have bidegree $(2,2)$ and no simultaneous zero. Off the diagonal $C_2\ne 0$; on the finite diagonal $x=z=t$, $C_1=4f(t)$ and $C_0=f^{\prime }(t{)}^2-8tf(t)$ for $f(t)=t^3+At+B$, so simultaneous vanishing would contradict nonsingularity. At the double point at infinity the homogeneous $C_0$ is nonzero. Local coefficient norms, or the corresponding resultant bounds, therefore giveThe arithmetic height of a binary quadratic's coefficient vector differs by $O(1)$ from the sum of the heights of its two roots. At finite places this follows from multiplicativity of the maximum coefficient norm of products; at infinite places the fixed-degree norms are comparable. ThusApply this to $2^{n}P,2^{n}Q$, divide by $2\cdot 4^n$ and take limits. The errors vanish and give the exact height parallelogram identity. Polarization consequently makesa symmetric bilinear pairing. Nonnegativity of $\hat{h}(aP+bQ)$ for integers $a,b$, and density of rational ratios, give the Cauchy-Schwarz inequality. In particular $\hat{h}(P-Q)\le 2\hat{h}(P)+2\hat{h}(Q)$. Also $\hat{h}(mP)=m^2\hat{h}(P)$ for integers $m$. Torsion points of an elliptic curve have canonical height zero because their doubling orbit is finite; conversely, if a point has canonical height zero, all its integer multiples have bounded naive height, and finiteness forces two multiples to coincide. Thus canonical height vanishes exactly on torsion.

There is an arithmetic finiteness input before height descent: $E(K)/2E(K)$ is finite, the Weak Mordell-Weil theorem. Here is its mechanism. The multiplication exact sequence gives an injective Kummer map $E(K)/2E(K)\to H^1(K,E[2])$: choose a half-point $Q$ and use the cocycle $\sigma \mapsto \sigma Q-Q$; changing $Q$ changes a coboundary, and a trivial class means a half-point can be chosen over $K$. Let $L=K(E[2])$, a Finite Galois extension. Over $L$ the torsion module is $(\mathbb{Z}/2\mathbb{Z}{)}^2$, so Kummer theory identifies its first Galois cohomology with two copies of $L^{\times }/L^{\times 2}$.

Only classes unramified outside a fixed finite set $S$ occur. Include the primes over $2$, bad-reduction primes and the ramified primes of $L/K$. At a good prime away from $2$, multiplication by two on the proper smooth elliptic model is finite étale morphism, so the torsor of halves of a point is unramified. In square-class language, valuations outside $S$ are even. Such classes form a finite group: write the principal ideal of a representative as a square times an ideal supported on $S$. The ideal class gives an element of the finite two-torsion of the localized ideal class group; after fixing that class, ambiguity is an $S$-unit modulo squares. The $S$-unit theorem makes the latter finite. The group kernel of restriction from $K$ to $L$ is contained in $H^1(\mathrm{Gal}(L/K),E[2])$, which is finite because both the group and module are finite. This proves the weak theorem, without assuming finite generation of $E(K)$.

Finally choose representatives $R_1,\dots ,R_s$ of $E(K)/2E(K)$ and put $M={\max }_i\hat{h}(R_i)$. Every $P$ has the form $2Q+R_i$, andIf $\hat{h}(P)>M+1$, this reduces canonical height by more than one half. Iterate until a point of canonical height at most $M+1$ is reached. There are only finitely many such points, by Northcott and the bounded difference of heights. Reconstructing $P=2Q+R_i$ at every stage proves that these finitely many small points and the finitely many representatives generate $E(K)$. ThereforeThe canonical pairing is positive definite on the free part. It turns rank computations into an arithmetic lattice problem, supplies independence tests for proposed generators, and bounds searches once a arithmetic height bound is available. Weak finite-quotient finiteness alone would not prove this result: the arithmetic height contraction is the step that converts it into finite generation.

To compute the rank of an elliptic curve, translate the rational point of order two to $(0,0)$ and put the curve in the form $y^2=x^3+a{x}^2+bx$, with $a,b\in \mathbb{Z}$ after clearing denominators and $b(a^2-4b)\ne 0$. Its two-isogenous partner and the elliptic isogeny areThe maps extend over their exceptional points. The dual isogeny isThe two-torsion square-class homomorphism is $\alpha :E(\mathbb{Q})\to {\mathbb{Q}}^{\times }/{\mathbb{Q}}^{\times 2}$, defined by $\alpha (O)=1$, $\alpha ((0,0))=[b]$, and $\alpha ((x,y))=[x]$ otherwise. Define ${\alpha }^{\prime }$ similarly on $E^{\prime }$ with $b^{\prime }=a^2-4b$.

Here are the ingredients behind the descent procedure. For a generic chord $y=mx+c$, the cubic of intersection coordinates has root product $c^2$. As the third intersection is the negative of the group sum and negation leaves $x$ unchanged, this proves the square-class homomorphism property. For a line through $(0,0)$, the two nonzero intersection coordinates have product $b$, so the assigned class $[b]$ gives the same multiplicativity. A vertical line has two equal coordinates and contributes their square, and $O$ has identity class. These observations also cover tangencies and the exceptional sums. Its kernel is $\hat{\varphi }(E^{\prime }(\mathbb{Q}))$. Indeed, the displayed formula gives $x(\hat{\varphi }(X,Y))=(Y/(2X){)}^2$. Conversely, if a point on $E$ has $x=r^2\ne 0$, the possible preimage coordinates satisfyIts elliptic-curve discriminant is $16(r^4+a{r}^2+b)=16y^2/r^2$, a rational square. A root $X$ and $Y=2rX$, with the sign chosen appropriately, give a preimage. The identity is always in the image. The point $(0,0)$ is in the image exactly when $b$ is a square: its nonzero preimage coordinates are $X=a\pm 2\sqrt{b}$, with $Y=0$. Thus the exceptional points satisfy precisely the same kernel statement. Interchanging the curves similarly gives $\ker {\alpha }^{\prime }=\varphi (E(\mathbb{Q}))$.

A prime not dividing $b$ can occur only with even valuation in an $x$-coordinate. If its valuation is positive, the factor $x^2+ax+b$ is a unit and $2v(y)=v(x)$; if negative, $x^2$ dominates that factor and $2v(y)=3v(x)$. Thus square classes in $\mathrm{im}\alpha$ have signed square-free representatives dividing $b$, giving finitely many candidates. To test a candidate $d$, put $x=d(u/v{)}^2$ and $y=duN/v^3$. The curve equation becomesA nontrivial rational solution, including the appropriate limiting points, is exactly a realization of the class. Clear denominators and arrange $\gcd (u,v)=1$ for congruence tests. Do the same for $E^{\prime }$ with $b^{\prime }$.

The factor in the two-isogeny rank formula can also be checked directly. Let $A=E(\mathbb{Q})$, $B=E^{\prime }(\mathbb{Q})$ and $t=\#A[2]$. The index of $\hat{\varphi }(B)$ in $A$ is $\#\mathrm{im}\alpha$, while the map from $B/\varphi (A)$ onto $\hat{\varphi }(B)/2A$ has kernelThe numerator has order two. Moreover $\ker \hat{\varphi }\cap \varphi (A)=\varphi (A[2])$, since $\hat{\varphi }\varphi P=2P$, and the latter has order $t/2$. Hence this quotient has order $4/t$, andThe Mordell-Weil theorem gives $[A:2A]=2^{r}t$, where $r$ is the rank. Cancelling $t$ yieldsIn practice, local congruence and real-solubility tests remove many candidate quartics, giving an upper bound, while rational point searches realize classes and give a lower bound. These often coincide. Local solubility alone is not a proof of a rational point: an everywhere locally soluble covering can still fail globally, so a remaining gap must be reported rather than treated as an exact rank.

For the curve at hand, $a=8$, $b=-7$, $b^{\prime }=92$, andThe first image is contained in $\{1,-1,7,-7\}$ and contains $1,-7$, the latter from the point $(0,0)$. To exclude $-1$, its quartic would require coprime $u,v$ withModulo $16$, an odd fourth power is $1$ and an even fourth power is $0$. If $u$ is odd and $v$ even the right side is $15$; if $u$ is even and $v$ odd it is $7$; if both are odd it is $14$. None is among the square residues $0,1,4,9$. Thus $-1$ is impossible. The image is a subgroup, so $7$ is also impossible: its product with the known class $-7$ would be $-1$. We obtain $\mathrm{im}\alpha =\{1,-7\}$.

For $E^{\prime }$, its quadratic factor is $X^2-16X+92=(X-8{)}^2+28>0$. Every nonzero rational $X$-coordinate is therefore positive. Prime support leaves only $1,2,23,46$ as possible classes; $1$ and $23=[92]$ are supplied by $O$ and the two-torsion point. The explicit point $(18,48)$ is on $E^{\prime }$ becauseIts class is $[18]=2$. Multiplying classes supplies $46$, so $\mathrm{im}{\alpha }^{\prime }=\{1,2,23,46\}$. The two-isogeny rank formula now provesAs an additional concrete point on the original curve, the dual isogeny sends $(18,48)$ to $(16/9,116/27)$. The descent calculation proves the rank; it does not by itself certify that this point generates the full free quotient.