Past exam of the mathematics course of the University of Cambridge / 2007 / iii / Paper 27 (Elliptic Curves)

We take $d\in {\mathbb{Q}}^{\times }$, as required for this rational elliptic curve. The tangent at $O=(1:-1:0)$ is $X+Y=0$. Its intersection with the curve has $d{Z}^3=0$, so it meets the curve three times at $O$: the identity is an inflection point of a plane cubic.

For $P,Q$, let their chord meet the diagonal cubic elliptic curve at the third point $R$, using the tangent if $P=Q$ and counting intersection multiplicities. Then join $R$ to $O$ and take the third intersection $S$. Define $P+Q=S$. Equivalently, three collinear intersection points satisfy $P+Q+R=O$.

Here inversion has the particularly simple formIndeed $P$, its displayed inverse, and $O$ lie on the same line, since swapping $X,Y$ preserves both the curve and $X+Y$. Thus addition is the chord or tangent operation followed by swapping the first two coordinates. The rule includes limiting cases involving $O$ and repeated intersections. Its associativity follows from the elliptic curve group law from Riemann-Roch: the identification $P\mapsto [P-O]$ with the degree-zero Picard group turns the line-intersection Weil divisor relation into addition of divisor classes. Since a line cuts a Weil divisor linearly equivalent to $3O$, that relation is exactly the chord rule just described.

The Hessian criterion for flexes of a plane cubic applied to the defining polynomial givesConsequently the inflection points of a plane cubic on this curve are exactly its intersections with the three coordinate lines. Choose $r\in \overline{\mathbb{Q}}$ with $r^3=d$, and a primitive cube root of unity $\zeta$. The nine distinct flexes of a diagonal cubic areWith the chosen flex as identity, these points are precisely $E_d[3]$. A tangent cutting the Weil divisor $3P$ gives $3(P-O)=0$; conversely $3(P-O)=0$ makes the hyperplane Weil divisor equivalent to $3P$, which supplies a tangent with triple contact. This is the three-torsion points are flexes of a plane cubic correspondence.

On $Z=0$ only $O$ is rational, since the other cube roots of unity are not rational. On each other coordinate line a rational point exists exactly when $d$ is a rational cube, and then exactly one does. ThereforeIn particular the rational torsion subgroup cannot contain two independent points of order $3$.

One can also determine the whole rational torsion of a diagonal cubic. First it is killed by $6$. To see this, use the Weierstrass equation of an elliptic curve from (iii). At primes $\ell \equiv 2(\mathrm{mod}3)$ outside the finite set containing $2,3$ and the prime divisors of the numerator and denominator of $d$, the cube map permutes ${\mathbb{F}}_{\ell }$, sowhere the quadratic character is extended by $\chi (0)=0$, and the character sum vanishes after substituting $t=x^3-432d^2$. Reduction of torsion points on an elliptic curve injects the prime-to-$\ell$ part of rational torsion into this finite group. This injection follows because multiplication by an integer prime to $\ell$ is invertible on the formal group of an elliptic curve, and hence its reduction kernel has no such torsion.

For any prime $q>3$, choose a good $\ell \equiv 2(\mathrm{mod}3)$ with $\ell \equiv 1(\mathrm{mod}q)$; the Dirichlet theorem on primes in arithmetic progressions and the Chinese remainder theorem supply such primes outside the finite bad set. Then $q\nmid \ell +1$, excluding $q$-torsion. Similarly good $\ell \equiv 5(\mathrm{mod}12)$ exclude order $4$, and good $\ell \equiv 11(\mathrm{mod}18)$ exclude order $9$. Thus every rational torsion point has order dividing $6$.

The inversion formula in (i) shows that the only possible nonidentity rational point of order $2$ has $X=Y$ and $Z\ne 0$. It exists precisely when $(X/Z{)}^3=-d/2$, that is, when $d/2$ is a rational cube. There is at most one such point. This condition and $d$ being a cube cannot hold together, since $2$ is not a rational cube. Combining it with the three-torsion calculation gives the full answer:

Use the invertible linear projective transformationThe identitygivesThe transformation is invertible because $d\ne 0$, and it sends $O$ to $(0:1:0)$. Hence it is an isomorphism of the pointed smooth projective curves, giving the required Weierstrass equation of an elliptic curve:For affine points $u=X/Z,v=Y/Z$, the transformation and its inverse areThese formulae are interpreted in their stated affine charts; the projective transformation handles the exceptional points without any ambiguity.

Set $d=-7$. The affine rational pair $(u,v)=(2,-1)$ gives $P=(84,756)$ on the elliptic curve $y^2=x^3-21168$. It is a point of infinite order: in the rational torsion of a diagonal cubic classification, neither $-7$ nor $-7/2$ is a rational cube, so this curve has trivial rational torsion subgroup.

There is also a short direct torsion check specific to this curve. The primes $5$ and $11$ are good and have point counts $6$ and $12$, respectively, because cubing is bijective in their finite fields. Reduction at these two primes bounds the entire rational torsion by order dividing $6$, including its possible $5$- and $11$-primary parts by reduction at the other prime. The flex calculation excludes order $3$, and the inversion calculation excludes order $2$. Hence $P$ is indeed nontorsion.

Every nonzero multiple $nP$ is distinct, and its inverse projective image has $Z\ne 0$: the only rational point at infinity on the diagonal cubic is its identity. Thus each yields a distinct rational pair. More explicitly, if $nP=(x_n,y_n)$ on the Weierstrass model, thenHere $x_n\ne 0$, since $x_n=0$ would require a rational square equal to $-21168$. For example the elliptic-curve addition formula gives $2P=(28,28)$, which produces $(u_2,v_2)=(5/3,4/3)$. This proves there are infinitely many rational pairs of cubes summing to seven.

Work with the usual commutative unital ring convention. Write $f(T)=a_{1}T+a_2{T}^2+\cdots$, where $a_1=f^{\prime }(0)$ is a unit, and seek $g(T)={\sum }_{n\ge 1}{b}_n{T}^n$. Since $g$ has zero constant term, every coefficient of the composition of these formal power series involves only finitely many terms.

The linear coefficient forces $b_1=a_1^{-1}$. Suppose $b_1,\dots ,b_{n-1}$ have been chosen. The coefficient of $T^n$ in $f(g(T))$ isIndeed the term involving $b_n$ can only come from $a_{1}g$: in $g^j$ with $j\ge 2$, using a degree-$n$ term forces total degree at least $n+j-1>n$. Choose $b_n=-a_1^{-1}{C}_n$. This recursive construction of a compositional inverse uniquely gives $f\circ g=T$.

To check the other composition rather than assume it, construct $h(T)={\sum }_{n\ge 1}{c}_n{T}^n$ satisfying $h\circ f=T$. At degree $n$, its new coefficient is $c_n{a}_1^n$ plus terms already determined; $a_1^n$ is a unit, so the same recursion works. Composition is associative, as can be checked coefficientwise, or after truncation modulo $T^{N+1}$ for every $N$. ThereforeConsequently the compositional inverse of a formal power series is unique and satisfies

The Weak Mordell-Weil theorem asserts that $E(K)/mE(K)$ is finite for an elliptic curve over a number field $K$ and an integer $m\ge 2$. The role of (i) is to make division by $m$ possible in the local formal group of an elliptic curve whenever the residue characteristic does not divide $m$.

Let $v$ be a finite place with good reduction of an elliptic curve and $v\nmid m$. The kernel of reduction of an elliptic curve is parametrized by $t=-x/y$ in the maximal ideal of the local valuation ring. Multiplication by $m$ is represented by an integral formal power seriesIts linear coefficient is a local unit. Part (i) supplies an integral compositional inverse. Both series converge on the maximal ideal, so multiplication by $m$ is a bijection on the reduction kernel, over the local field and over every finite unramified extension.

This implies unramified division torsors at good primes. For $P\in E(K)$, first divide its reduction by $m$ over the algebraic closure of the residue field. Multiplication by $m$ on the reduced curve is surjective and separable, so the chosen division point is defined over some finite residue extension. Smooth lifting gives a point $Q_0$ over the corresponding unramified local extension with the required reduction. The difference $P-m{Q}_0$ lies in the reduction kernel; the inverse series supplies $Q_1$ with $m{Q}_1=P-m{Q}_0$. Thus $Q=Q_0+Q_1$ divides $P$ over an unramified extension. Applying the same reasoning to all reduced $m$-torsion points lifts all of $E[m]$, so every point of $[m{]}^{-1}P$ lies in the maximal unramified extension. This excludes ramification outside a fixed finite set $S$ consisting of primes of bad reduction and primes over $m$.

For completeness, the remaining global finiteness step in the Kummer-theoretic proof of the weak Mordell-Weil theorem is as follows. Choose $Q\in E(\overline{K})$ with $mQ=P$. The cocycle $\sigma \mapsto \sigma Q-Q$ defines the Kummer map of an elliptic curveChanging $Q$ by an $m$-torsion point changes the cocycle by a coboundary. A zero class makes $Q$ rational after that change, so the map is injective.

Let $L=K(E[m])$, fixed independently of $P$. Since the torsion is rational over $L$, the cocycle restricted to its Galois group is a homomorphism into $E[m]$. Consequently $L(Q)/L$ is Galois of degree at most $m^2$, contains the entire division fibre, and is unramified outside $S$. Hence $[L(Q):K]\le m^2[L:K]$. There are only finitely many extensions of bounded degree unramified outside a fixed finite set: local extensions of bounded degree have bounded field discriminant exponents, and the Hermite–Minkowski theorem then applies to the bounded global field discriminants. Their finite Galois compositum $M$ contains every such division fibre; each $L(Q)$ is stable over $K$ because it contains $E[m]$ and the whole fibre above the rational point $P$. All the Kummer classes consequently factor through the fixed finite group $\mathrm{Gal}(M/K)$ with values in the fixed finite group $E[m]$. There are only finitely many such cocycles, provingThus (i) provides the local division step that bounds ramification; the global arithmetic finiteness completes the argument.

An isogeny of elliptic curves $\varphi :E_1\to E_2$ over a field $K$ is a nonconstant morphism preserving the identity and addition. It is surjective and finite: its image is a closed connected subgroup, and a nonconstant morphism of smooth projective curves is finite. The degree of an isogeny is the degree of its induced extension of function fields. A separable isogeny has degree equal to the number of geometric kernel points; in general the degree is the length of the finite kernel scheme, incorporating inseparability. The degree of an isogeny multiplies under composition, and degree one means an isomorphism. In characteristic zero all elliptic isogenies are separable. In positive characteristic the Frobenius isogeny illustrates inseparability, while an elliptic isogeny of degree prime to the characteristic is separable.

The homomorphism group of elliptic curves includes the zero homomorphism, the constant identity map, and every nonzero member is an elliptic isogeny. The operations are pointwise addition and negation; for endomorphisms, composition also gives the endomorphism ring of an elliptic curve. We put $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We now prove the positive definiteness of degree on elliptic-curve homomorphisms in full.

Let $E=E_2$, and choose a Weierstrass model. Its coordinate $x$ has a double pole at $O$, and the generic fibre of $x$ consists of $P$ and $-P$. On $E\times E$ the rational function $x(P)-x(Q)$ therefore has Weil divisorwhere $\Delta =\{P=Q\}$, ${\Delta }_{-}=\{P=-Q\}$, $V=\{O\}\times E$, and $H=E\times \{O\}$. The generic zeros on the two diagonals have multiplicity one, and the generic poles on $V,H$ have multiplicity two; their intersections have codimension two and add no Weil divisor components. This argument also uses the general Weierstrass involution in characteristic $2$, where $-P$ need not mean changing just the sign of $y$.

For the sum and difference maps $a(P,Q)=P+Q$ and $s(P,Q)=P-Q$, the divisors $a^{\ast }(O)$ and $s^{\ast }(O)$ are ${\Delta }_{-}$ and $\Delta$. Consequently, for the degree-one line bundle $L={\mathcal{O}}_E(O)$,Pull back along $P\mapsto (\varphi (P),\psi (P))$ and take degrees of line bundles on $E_1$. A nonconstant map pulls back $L$ to degree equal to its degree, while a constant map pulls it back to a trivial bundle of degree zero. We obtain the degree parallelogram lawUsing the line-bundle identity is important: it still restricts correctly when $\varphi =\psi$ or $\varphi =-\psi$, when restriction of the displayed rational function would be identically zero.

Since $q(-\varphi )=q(\varphi )$, applying the identity to $n\varphi$ and $\varphi$ gives the second-difference recursionStarting from $q(0)=0$ and $q(\varphi )$ yields $q(n\varphi )=n^{2}q(\varphi )$ for all integers $n$. DefineIt is symmetric and odd in each variable. Applying the parallelogram identity to the four terms in its first expression givesInterchanging $u,w$ and using oddness also gives $B(u+w,v)-B(u-w,v)=2B(w,v)$. Adding proves $B(u+w,v)=B(u,v)+B(w,v)$; symmetry proves additivity in the other variable. Thus $q$ is a quadratic form with associated rational bilinear form $B$.

Every nonzero homomorphism has positive degree, so $q(\varphi )>0$ for $\varphi \ne 0$. The scaling identity also shows that the homomorphism group is a torsion-free group. Hence $q$ extends to its rational vector space. On the span of any finitely many rationally independent homomorphisms, the matrix of $B$ is rational. Positivity on nonzero rational vectors implies nonnegativity on real vectors by density. If the real matrix had a nontrivial kernel, its rational linear equations would have a nonzero rational solution, contradicting positivity. Thus its real extension is a positive-definite quadratic form. This establishes the requested positivity as well as the quadratic identities.

An important companion to degree is the dual isogeny. Under $E\cong {\mathrm{Pic}}^0(E)$ via $P\mapsto [P-O]$, the pullback ${\varphi }^{\ast }:{\mathrm{Pic}}^0(E_2)\to {\mathrm{Pic}}^0(E_1)$ defines $\hat{\varphi }:E_2\to E_1$. Divisor pushforward corresponds to $\varphi$, and pushforward after pullback multiplies divisor classes by $n=\mathrm{deg}\varphi$. Therefore $\varphi \hat{\varphi }=[n]$. Composing shows that $\hat{\varphi }\varphi -[n]$ takes values in the finite kernel of $\varphi$; a morphism from a connected smooth curve into this finite scheme must be constant, and its identity value is zero. ThusThe last equality follows from $\mathrm{deg}[n]=n^2$, already proved by applying $q(m\varphi )=m^{2}q(\varphi )$ to the identity map. The dual isogeny is unique, since the difference of two choices composed with $\varphi$ would vanish and $\varphi$ is surjective. It follows that being isogenous is an equivalence relation: duality supplies symmetry, and composition supplies transitivity. For a finite subgroup of geometric points of order prime to the characteristic, the quotient curve and its quotient map give an elliptic isogeny with that kernel; in general one uses finite subgroup schemes. This is the geometric source of explicit descent maps, including the two-isogeny formula in Question 4.

Finally elliptic isogenies preserve the rational rank of an abelian group over a number field. Their dual compositions are multiplication by $n$, so after tensoring the rational point groups with $\mathbb{Q}$ the elliptic isogeny becomes invertible. For a single curve, its endomorphism algebra in characteristic zero is $\mathbb{Q}$ or an imaginary quadratic field, giving ordinary integer multiplication or complex multiplication. In positive characteristic a supersingular curve can instead have a quaternionic endomorphism algebra. The positive degree form controls the sizes of these homomorphisms, while duality makes their arithmetic and geometric properties accessible.

Let $K$ be a number field and $E/K$ an elliptic curve. Heights measure the arithmetic size of points, and turn the finite quotient supplied by the Weak Mordell-Weil theorem into finite generation. For a projective point $[X:Z]\in {\mathbb{P}}^1(K)$ define the Absolute logarithmic Weil heightusing the usual normalized absolute values and local degrees $n_v=[K_v:{\mathbb{Q}}_v]$. The product formula makes this independent of scaling and of enlarging $K$. For a Short Weierstrass form put $h_x(P)=h([x(P):1])$ and $h_x(O)=h([1:0])=0$. Over $\mathbb{Q}$, if $x=A/B$ in lowest terms, $h(x)=\log \max (|A|,|B|)$.

The finiteness property is Northcott theorem: for bounded height and bounded degree over $\mathbb{Q}$ there are only finitely many algebraic numbers. One sees the mechanism from the height-Mahler measure formula. If $\alpha$ has degree $d\le D$ and height at most $H$, its primitive integral minimal polynomial has Mahler measure $e^{dh(\alpha )}\le e^{DH}$. Expanding its product of linear factors bounds every coefficient by $2^D{e}^{DH}$. Only finitely many integral polynomials satisfy this bound, and each has finitely many roots. Thus a height bound gives only finitely many $x$-coordinates in the fixed number field $K$, and each gives at most two points of $E$, besides $O$.

To understand multiplication, the doubling formula givesIts homogeneous numerator and denominator have degree four. They have no common projective zero: at infinity the numerator is nonzero, and at a root of $f(t)=t^3+at+b$ the numerator equals $f^{\prime }(t{)}^2$, since it is $f^{\prime }(t{)}^2-8tf(t)$. Nonsingularity excludes a common root of $f,f^{\prime }$. The coordinate doubling map is therefore a degree-four morphism of the projective line.

The general height growth under a morphism of the projective line is $h(\Phi (t))=dh(t)+O(1)$ for a fixed degree-$d$ morphism. Here is why the error is bounded independently of $t$. At a place $v$, normalize its homogeneous coordinates to have maximum norm $1$. The fixed homogeneous forms have uniformly bounded norm. They also have a positive lower bound: the normalized coordinate space is compact over $K_v$, and their common zero set is empty. Outside finitely many places their coefficients are integral and their reduction has no common zero, making both bounds $1$. Homogeneity and summation over places then give the asserted height estimate. Consequently there is a fixed $C$ with

Define the canonical height of an elliptic curve by the conventional normalizationThe successive approximants differ by at most $C/(2\cdot 4^{n+1})$, so the limit exists andThus canonical height retains Northcott finiteness, while replacing the bounded-error doubling rule by an exact one.

We also need the height parallelogram identity. It follows from the symmetric-square proof of the naive height parallelogram estimate, which we give explicitly using the supplied addition formulae. For $x_i=X_i/Z_i$, the unordered pair $x(P+Q),x(P-Q)$ is represented by the binary quadratic $C{T}^2-BTS+A{S}^2$, whereThese forms define the biquadratic morphism for elliptic sums and differences. They have no common zero. If $C=0$, the two projective coordinates agree. On the finite diagonal $x_1=x_2=t$, $B=4f(t)$ and $A=f^{\prime }(t{)}^2-8tf(t)$, so simultaneous vanishing would violate nonsingularity. At $(\infty ,\infty )$ the homogeneous $A$ is nonzero. This also handles $P=\pm Q$ and sums or differences equal to $O$, for which the affine fractions alone would be inappropriate.

The same local norm argument as above, now using bidegree $(2,2)$, givesOn the other hand the binary quadratic is the product of two linear factors for $x(P+Q)$ and $x(P-Q)$. At nonarchimedean places coefficient maximum norms multiply exactly: scale each factor to norm $1$ and reduce; the product of the two nonzero residue polynomials remains nonzero. This is multiplicativity of the nonarchimedean polynomial norm. At archimedean places the norms are comparable up to fixed constants, by the coefficient triangle inequality and compactness of normalized linear factors. ThereforeCombining the estimates proves the naive-height parallelogram relation with a uniform error. Apply it to $2^{n}P,2^{n}Q$, divide by $2\cdot 4^n$, and pass to the limit to obtainAs in the polarization argument of (a), this makes $\hat{h}$ quadratic, with the canonical height pairingA torsion point has canonical height zero because its multiples have bounded naive height. Conversely, if $\hat{h}(P)=0$, then all $2^{n}P$ have bounded naive height. Northcott finiteness makes two equal, giving $(2^j-2^i)P=O$ for some $j>i$. Thus canonical height vanishes exactly on torsion. In particular the torsion subgroup is finite, since the comparison with naive height bounds the heights of all its points.

We can now prove the Mordell-Weil theorem. The Weak Mordell-Weil theorem, as explained in Question 2(ii), makes $E(K)/2E(K)$ finite. Choose representatives $R_1,\dots ,R_s$ and put $M={\max }_i\hat{h}(R_i)$. Every $P$ can be written $P=2Q+R_i$. The parallelogram identity and nonnegativity giveIterating this height descent makes the height at step $n$ at most $M+2^{-n}\max (\hat{h}(P)-M,0)$, so after finitely many steps it is at most $M+1$. There are only finitely many points of that height by Northcott and the naive-height comparison. Reversing $P=2Q+R_i$ shows that every point is an integer combination of the finitely many representatives and this finite bounded-height set. ThereforeOn the resulting free part the canonical height pairing is positive definite. Its nonnegativity extends from rational vectors to real vectors by density. If a nonzero real vector $v$ were in its kernel, in a basis of the free part round $nv$ to integer vectors $z_n$. Their rounding errors are uniformly bounded, and $\hat{h}(z_n)=\hat{h}(z_n-nv)$ would be uniformly bounded. The vectors $z_n$ are unbounded and therefore include infinitely many distinct vectors, contradicting Northcott finiteness. Thus there is no real null vector. Heights consequently support quantitative point searches, tests of independence, and the regulator of an elliptic curve, in addition to providing the descent that proves finite generation.

A rational point of order $2$ can be moved to $(0,0)$, giving an integral modelIts two-isogeny descent partner and the two-isogeny formula areThe maps extend over the identity and $(0,0)$, have these two points as their respective kernels, and direct substitution and the doubling formula give $\hat{\varphi }\varphi =[2]$ and $\varphi \hat{\varphi }=[2]$.

Define the two-torsion square-class homomorphisms byand similarly ${\alpha }^{\prime }$ for $E^{\prime }$, using $b^{\prime }$. To see the homomorphism property, intersect a line $y=mx+c$ with $E$. Its three $x$-coordinates have product $c^2$, since the resulting monic cubic has constant term $-c^2$. The third point is the negative of the sum of the first two, and negation preserves $x$, so the square classes multiply as required. If the line passes through $(0,0)$, the other two coordinates have product $b$, giving exactly the prescribed exceptional value. Vertical lines and repeated intersections give the identity and tangent cases.

We also verify the kernel needed for descent:For a point on $E^{\prime }$, the first coordinate of its image under $\hat{\varphi }$ is $Y^2/(4X^2)$, a square. Conversely, if $P=(s^2,y)$ has square $x$-coordinate, solving $x(\hat{\varphi }(X,Y))=s^2$ givesIts discriminant is $16(s^4+a{s}^2+b)=(4y/s{)}^2$, so it has rational nonzero roots $X=a+2s^2\pm 2y/s$. Taking $Y=\pm 2sX$ gives a point on $E^{\prime }$; choose the signs so its image has second coordinate $y$. The exceptional point $(0,0)$ lies in the image exactly when $b$ is a square, as seen from the points with $Y=0$, $X=a\pm 2\sqrt{b}$. This proves the first kernel formula. Applying the same argument to $E^{\prime }$ and then rescaling the second partner by $(X,Y)\mapsto (X/4,Y/8)$ proves the second.

There are only finitely many candidate square classes. For a rational point write $x=M/e^2$ and $y=N/e^3$, with $\gcd (M,e)=1$. These denominator forms follow because a negative prime valuation of $x$ makes the leading cubic term the unique lowest-valuation term, forcing that valuation to be even. ThenIf a prime divides $M$ but not $b$, the second factor is a unit at that prime, so its valuation in $M$ is even. Thus every class in $\alpha (E)$ has a signed squarefree representative $d\mid b$. This is the prime-support bound in two-isogeny descent; the analogous candidates for ${\alpha }^{\prime }(E^{\prime })$ divide $b^{\prime }$.

The class $d$ is realized by a nonexceptional rational point precisely when its quartic covering in a two-isogeny descenthas a rational point with $UV\ne 0$. Indeed substitution $x=d(U/V{)}^2$, $y=dUN/V^3$ gives the original equation, and conversely the square-class condition gives these parameters. Clearing denominators permits $U,V,N$ integral with $\gcd (U,V)=1$. The zero-coordinate cases account for the already known identity and two-torsion classes.

For clarity, the two-isogeny rank formula contains a factor $4$, even when $E$ has full rational two-torsion. Put $t=\#E(\mathbb{Q})[2]$, which is $2$ or $4$, and let $r$ be the rank. From the two kernel formulas and $2E=\hat{\varphi }\varphi E$,Indeed the kernel of the induced map $E^{\prime }/\varphi E\to \hat{\varphi }{E}^{\prime }/2E$ is $\ker \hat{\varphi }/(\ker \hat{\varphi }\cap \varphi E)$. The intersection is $\varphi (E[2])$, of size $t/2$, so $\delta =4/t$. The Mordell-Weil theorem gives $[E:2E]=2^{r}t$. Therefore

This gives a practical rank procedure. Enumerate the finitely many signed squarefree divisors of $b,b^{\prime }$, and test their quartics over the reals and local fields at $2$ and primes dividing the relevant coefficients or elliptic-curve discriminant. These necessary local conditions give finite Selmer group of an elliptic curve upper bounds. Search the remaining coverings for rational points, or search the curves directly, to realize square classes and obtain lower bounds. One can also exhibit independent points and check independence by the canonical height pairing. When the upper and lower bounds agree, the rank is determined. Local solubility alone does not guarantee a rational point, so a persistent gap can reflect a nontrivial Tate–Shafarevich group rather than a missing congruence test.

Now take $a=0$, $b=-p^2$ for an odd prime $p$. The curve has four rational two-torsion points $O,(0,0),(p,0),(-p,0)$. Their images under $\alpha$ are $1,-1,p,-p$. The prime-support bound allows no other classes, soIts partner is $E_p^{\prime }:Y^2=X^3+4p^{2}X$. Any nonidentity rational point with $X\ne 0$ has $X>0$, because $X^2+4p^2>0$. Also the exceptional point has square class $4p^2=1$. Thus its image is contained in the four positive candidate classes $\{1,2,p,2p\}$. The rank bound for a prime congruent-number elliptic curve follows:

For an exact rank-one example, take $p=5$. The point $(X,Y)=(5,25)$ on $E_5^{\prime }:Y^2=X^3+100X$ realizes the class $5$. The five-adic obstructions for the congruent-number isogeny covers exclude the other two possible nontrivial classes. For $d=2$, the quartic isModulo $5$, if $5\nmid U$ the right side is $2$, a nonsquare. Hence $U=5U_1$ and $N=5N_1$; primitivity gives $5\nmid V$. Dividing by $25$ then gives $N_1^2=50U_1^4+2V^4\equiv 2(\mathrm{mod}5)$, again impossible. For $d=10$, the quartic is $N^2=10(U^4+V^4)$. At least one of $U,V$ is nonzero modulo $5$, and their fourth powers are $0$ or $1$, so their sum is $1$ or $2$ modulo $5$. The right side has five-adic valuation $1$, impossible for a square. Thus ${\alpha }^{\prime }(E_5^{\prime })=\{1,5\}$ exactly, andThe dual isogeny maps $(5,25)$ to $(25/4,-75/8)$ on $E_5$, giving an explicit rational point associated with this rank-one computation.