Past exam of the mathematics course of the University of Cambridge / 2008 / iii / Paper 28 (Elliptic Curves)

The Hasse theorem for elliptic curves statesWe prove it by the positive degree of an isogeny. Let $\pi$ be the $q$-power Frobenius isogeny, of degree $q$. Its fixed points are precisely $E({\mathbb{F}}_q)$, so they form the kernel of $1-\pi$. Since the differential of $\pi$ is zero, the differential of $1-\pi$ is the identity; thus $1-\pi$ is a separable isogeny. Its degree is the number of its geometric kernel points. ThereforeWe use the standard degree parallelogram law, together with $\mathrm{deg}[m]=m^2$: degree, extended by zero at the zero endomorphism, is a positive quadratic form on the endomorphism ring of an elliptic curve. Put $t=1+q-N$, the Trace of Frobenius. Polarizing the degree form gives, for every pair of integers $m,n$,Indeed, the values on $1$ and $\pi$ are $1$ and $q$, and the cross coefficient is fixed by $\mathrm{deg}(1-\pi )=1+q-t$. These are standard degree facts about isogenies of elliptic curves, which suffice without an assumption about characteristic or ordinariness.

For $n\ne 0$, division by $n^2$ shows $x^2-tx+q\ge 0$ at every rational $x=m/n$. Density of the rational numbers and continuity of this polynomial make it nonnegative on the real line. Evaluating at its minimum $x=t/2$ gives $q-t^2/4\ge 0$, whence $|t|\le 2\sqrt{q}$. Since $N=q+1-t$, this proves the estimate. This is the degree-form proof of the Hasse bound; it proves both sides simultaneously by positivity of one degree form.

Let $t=q+1-\#E({\mathbb{F}}_q)$. The stated characteristic equation for the Frobenius isogeny isTake $\alpha ,\beta$ to be the complex roots of $T^2-tT+q$. They satisfy $\alpha +\beta =t$ and $\alpha \beta =q$. By the Hasse bound, $t^2\le 4q$. If the inequality is strict, the roots are complex conjugates and have squared modulus $q$. In the equality case both roots are the same real number $\pm \sqrt{q}$. Thus in every caseTo obtain every extension-field count without assuming distinct roots, set $t_n=\mathrm{tr}({\pi }^n)$ and $t_0=2$. The dual isogeny satisfies $\hat{\pi }\pi =[q]$ and $\pi +\hat{\pi }=[t]$. Consequently the sums ${\pi }^n+{\hat{\pi }}^n=[t_n]$ satisfyAlternatively, apply additivity of the trace of an elliptic-curve endomorphism directly to the characteristic equation multiplied by ${\pi }^{n-2}$. The sequence ${\alpha }^n+{\beta }^n$ has the same recurrence and initial values, so $t_n={\alpha }^n+{\beta }^n$ by induction. This is the Frobenius trace recurrence, valid also at a repeated root.

The fixed points of ${\pi }^n$ are $E({\mathbb{F}}_{q^n})$, and $1-{\pi }^n$ is again separable. Since $\mathrm{deg}{\pi }^n=q^n$, the trace-degree identity givesFactoring and using $\beta =q/\alpha$ yieldsThis is the elliptic-curve point count over a finite field formula and the Riemann hypothesis for an elliptic curve over a finite field. In particular the powers on both factors are necessary; they are damaged in the converted TeX but present in the original PDF.

Put $F=x^3+y^3+13z^3-2xyz$. The Hessian criterion for flexes of a plane cubic applies because the projective cubic is smooth. To check smoothness, a singular point with all coordinates nonzero would satisfy $3x^2=2yz$, $3y^2=2xz$, $39z^2=2xy$. Multiplication would force $351=8$, a contradiction. If one coordinate is zero, the three equations force all coordinates to vanish, which is not a projective point.

For completeness, the Hessian criterion for flexes of a plane cubic follows locally by putting a smooth point at $(0:0:1)$ and its tangent at $y=0$. After normalization the homogeneous cubic has terms $y{z}^2+a{x}^{2}z+bxyz+c{y}^{2}z$ and terms cubic in $x,y$. Its tangent has contact order three precisely when $a=0$. Its Hessian matrix at the point has determinant $-8a$, giving exactly the same condition.

For the present cubic the Hessian determinant isOn $F=0$ this is $2744xyz=8\cdot 343xyz$. Thus the plane cubic flexes are exactly the points on the cubic with $xyz=0$. Let $c=\sqrt[3]{13}$ and let $\omega$ be a primitive cube root of unity. The complete list over the algebraic closure isThese nine points are distinct, and the Hessian calculation proves there are no others. They are the flexes of a Hesse cubic. The only rational one is $O^{\prime }=(1:-1:0)$: the other two points with $z=0$ require a nonrational cube root of unity, and a rational point in either remaining triple would give a rational cube root of $-13$. By prime valuations, $13$ is not a rational cube.

For this Weierstrass equation of an elliptic curve, the inverse is $(x,y)\mapsto (x,13-y)$. At a point with $2y-13\ne 0$, implicit differentiation gives the tangent slopeIf the tangent line is $y=mx+b$, substitution into the equation shows that the three intersection abscissae sum to $m^2-1$. Two of them equal the tangency abscissa $x$, so the third is $x_3=m^2-1-2x$. Reflecting the third intersection by the inverse formula gives the elliptic curve group law from Riemann-Roch doubling formulaFor $P$, the slope is $13/(-13)=-1$, giving $x(2P)=0$ and $y(2P)=13$. For $Q$, the slope is $(12-4+13)/(6-13)=-3$, giving $x(2Q)=9-1+4=12$ and $y(2Q)=13-3+(-3)(-2-12)=52$. HenceIn particular $P$ has order exactly three: it is nonidentity and $2P=-P$.

We bound the torsion subgroups by reduction of torsion points on an elliptic curve. At a prime $p$ of good reduction, reduction is injective on the prime-to-$p$ torsion. Indeed, a point in the kernel is represented by the formal group of an elliptic curve on the maximal ideal. Multiplication by an integer prime to $p$ has a unit linear coefficient and is invertible there, so the kernel has no nonzero torsion of such order.

Both curves have good reduction at $2$ and $5$. For $E$ this follows from $\Delta =-91^3$, which is a unit at both primes. For $E^{\prime }$ at $2$, its reduction is $x^3+y^3+z^3=0$ and its three partial derivatives cannot vanish at a projective point. At $5$, the singularity calculation in part (i) would require $351-8=343$ to vanish modulo $5$, which it does not; $3$ and $13$ are also units there.

Direct counting gives:

For $E$ over ${\mathbb{F}}_5$, the numbers of ordinate solutions at $x=0,1,2,3,4$ are $2,2,2,2,0$. For $E^{\prime }$ in the chart $z=1$, they are $1,2,0,3,2$, with the single infinity point $(1:-1:0)$. These give the displayed totals without identifying the finite-field groups through the given isogeny of elliptic curves.

For either rational torsion subgroup, every odd-primary part injects at $2$, so the whole odd torsion has order dividing three. The two-primary part injects at $5$ and must be trivial, since the reduced group has odd order nine. Thus either rational torsion subgroup has order at most three. For $E$, the point $P$ already has order three, soFor the plane cubic $E^{\prime }$, the chosen identity $O^{\prime }$ is a plane cubic flex. The fact that three-torsion points are flexes of a plane cubic therefore identifies $E^{\prime }[3]$ with its nine geometric flexes. Part (i) found only the identity among the rational flexes. No nonidentity rational three-torsion exists, and the preceding bound excludes every other order. HenceThis also illustrates that isogenous elliptic curves can have different rational point groups; the given degree-three isogeny does not imply equality of rational torsion.

Double $2Q=(12,52)$ using the tangent formula. The slope issoThis finite point is neither $P$ nor $-P$, since its abscissa is nonzero. Therefore $P\pm 4Q$ are both finite nonidentity points.

For a direct exact-coordinate proof, the line from $P$ to $4Q$ has slope $985/104$, while the line from $P$ to $-4Q=(264/169,-3944/2197)$ has slope $-493/429$. For a secant through $P=(0,0)$ and $R=(u,v)$, its slope is $m=v/u$, and the group law gives $x(P+R)=m^2-1-u$, $y(P+R)=13-mx(P+R)$. Simplification yieldsThe first abscissa has odd numerator and denominator $64$. The second has denominator $1089=3^2\cdot 11^2$ and numerator not divisible by either $3$ or $11$. Thus neither point has integral coordinates.

Reduction also explains the obstruction without requiring the full secant arithmetic. At the good prime $2$, $\overline{Q}=(0,1)=-\overline{P}$, and $\overline{P}$ has order three, so $\overline{P+4Q}=O$. At the good prime $11$, the displayed coordinates of $4Q$ reduce to $(0,0)=\overline{P}$, so $\overline{P-4Q}=O$. A finite point with integral affine coordinates reduces to an affine point, not to the identity at infinity. Membership in the kernel of reduction of an elliptic curve therefore certifies the same two nonintegrality conclusions, at primes $2$ and $11$ respectively.

A one-dimensional commutative formal group law over the p-adic integers is a power series $\mathcal{F}(X,Y)\in {\mathbb{Z}}_p[[X,Y]]$ withIts linear part is $X+Y$, and it has a unique formal inverse $i(T)=-T+O(T^2)$ satisfying $\mathcal{F}(T,i(T))=0$. A formal-group homomorphism is a series $h(T)\in T{\mathbb{Z}}_p[[T]]$ satisfying $h(\mathcal{F}(X,Y))=\mathcal{F}(h(X),h(Y))$.

Define $[n](T)$ by adding $T$ to itself $n$ times with the formal group law. Induction on the linear part givesAssociativity and commutativity make $[n]$ a formal-group homomorphism. Since $p\nmid n$, its linear coefficient is a unit in ${\mathbb{Z}}_p$. We now construct its compositional inverse of a formal power series, rather than merely assert that the nonzero coefficient is sufficient.

Write $[n](T)=nT+a_2{T}^2+\cdots$ and seek $g(T)=b_{1}T+b_2{T}^2+\cdots$ with $[n](g(T))=T$. The degree-one coefficient gives $b_1=n^{-1}$. At degree $k\ge 2$, the coefficient is $n{b}_k$ plus a polynomial in the already chosen $b_1,\dots ,b_{k-1}$ and $a_2,\dots ,a_k$. Division by the unit $n$ uniquely chooses $b_k\in {\mathbb{Z}}_p$. This recursively constructs $g$ over the same ring. A right inverse is constructed in the same way; associativity of composition identifies it with $g$, so $g\circ [n]=[n]\circ g=T$.

To prove that $g$ respects the group law, apply $[n]$ to the two candidate series:Cancel by composing with $g$. The result is $\mathcal{F}(g(X),g(Y))=g(\mathcal{F}(X,Y))$. ThusThis is the multiplication isomorphism of a formal group law, a special case of the invertible morphism criterion for formal group laws. If $p\mid n$, its linear coefficient is not a unit, so the same isomorphism assertion would fail.

Reduce $P$ to $\overline{P}\in \tilde{E}({\mathbb{F}}_p)$. Because $p\nmid n$, the multiplication-by-n morphism on the reduced elliptic curve is a separable, surjective morphism of degree $n^2$. Choose a point $\overline{Q}\in \tilde{E}({\overline{\mathbb{F}}}_p)$ with $n\overline{Q}=\overline{P}$. Its coordinates lie in some finite field ${\mathbb{F}}_{p^d}$.

Let $L/{\mathbb{Q}}_p$ be the finite unramified extension with residue field ${\mathbb{F}}_{p^d}$. The curve retains good reduction over $L$. Its smooth integral model and the Hensel lemma give surjectivity of good reduction over a local field, so lift $\overline{Q}$ to some $Q_0\in E(L)$. This lift need not satisfy $n{Q}_0=P$ exactly, but its errorhas zero reduction and belongs to $E_1(L)$, the kernel of reduction of an elliptic curve.

The parameter $t=-x/y$ at infinity identifies $E_1(L)$ with the maximal ideal ${\mathfrak{m}}_L$ equipped with the formal group of an elliptic curve. The integral power series for $[n]$ and its inverse from part (i) remain integral over ${\mathcal{O}}_L$. They converge on ${\mathfrak{m}}_L$: terms of degree $k$ tend to zero in valuation because their coefficients are integral and the argument has positive valuation. Hence multiplication by $n$ is bijective on $E_1(L)$. Choose its unique solution $T\in E_1(L)$ to $nT=R$, and put $Q=Q_0+T$. ThenThe residue-field extension supplies a division point modulo $p$, and the formal-group inverse corrects the error without introducing ramification. This is the local construction underlying the uniform unramified division field over a local field and unramified division torsors at good primes.

A congruent number is a positive integer which occurs as the area of a right triangle with positive rational side lengths. Scaling a triangle by a nonzero rational factor multiplies its area by a rational square, so the essential parameter is its positive square class; integer parameters can be reduced to square-free integers. For example $6$ is congruent by the triangle $(3,4,5)$, and $5$ is congruent by $(3/2,20/3,41/6)$.

The connection with elliptic curves comes from the congruent number elliptic curve in the modelFrom a rational point with $y\ne 0$, defineDirect squaring gives $a^2+b^2=c^2$, and its area isConversely, from a positive rational triangle $(a,b,c)$ of area $N$, putSubstitution using $c^2=a^2+b^2$ and $ab=2N$ gives $y^2=x^3-N^{2}x$ and $y\ne 0$. ThusThe standard rational torsion of a congruent number curve consists of $O,(0,0),(N,0),(-N,0)$. One way to see the torsion restriction is to use good primes $p\equiv 3(\mathrm{mod}4)$. The character sum cancels at $x$ and $-x$, giving $\#E_N({\mathbb{F}}_p)=p+1$. For any odd prime $\ell$, the Dirichlet theorem on primes in arithmetic progressions supplies good primes with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$, so the reduction of torsion points on an elliptic curve excludes $\ell$-torsion. Good primes $p\equiv 3(\mathrm{mod}8)$ similarly bound the two-primary torsion by four, and the four displayed points give equality. Consequently the Mordell-Weil theorem turns the criterion into positive rank of $E_N(\mathbb{Q})$. Arithmetic two-descent on an elliptic curve and local obstructions are therefore tools for the congruent number problem, and a nontorsion point gives infinitely many rational right triangles from a nontorsion point by taking multiples.

We now give elementary proofs for $1$ and $2$, including the descent steps. Recall the primitive Pythagorean parametrizationwhere $m>n>0$ are coprime and of opposite parity. To derive it, in a primitive Pythagorean triple put the even leg at $A$. The relatively prime integers $(C+B)/2,(C-B)/2$ have product $(A/2{)}^2$, so each is a square, say $m^2,n^2$. This gives the formulas and the parity condition. The area is $mn(m-n)(m+n)$, and its four factors are pairwise coprime: their common divisors reduce to divisors of $m,n$ or of two, while $m\pm n$ are odd.

Area one is impossible. Clearing denominators of a hypothetical rational triangle of area one gives an integer triangle with square area. Dividing out its common factor leaves a primitive integer triangle whose area is still a rational square; an integer which is a rational square is an integer square. Choose such a triangle with smallest hypotenuse. Pairwise coprimality in the area product forcesThe positive integers $u,v$ are odd and coprime. If $m$ were even, then $n$ would be odd and $u^2-v^2=2s^2$ would be $2$ modulo eight, whereas two odd squares have difference zero modulo eight. Hence $m$ is odd, $n$ is even and $s$ is even.

Now set $a=(u+v)/2$ and $b=(u-v)/2$. These are positive coprime integers andThus $(a,b,r)$ is another integer right triangle with square area and hypotenuse $r$, strictly smaller than $m^2+n^2$. This contradicts the minimal choice and proves the Fermat right triangle theorem. In particular $1$ is not a congruent number.

For area two we first establish the auxiliary descent fourth-power sum cannot be a square. Suppose $x^4+y^4=z^2$ with positive integers, and choose a primitive solution with smallest $z$. Two odd fourth powers sum to $2$ modulo sixteen, so after exchange $x$ is odd and $y$ is even. Parametrize the primitive triangle $(x^2,y^2,z)$:The case $m$ even, $n$ odd makes $x^2\equiv 3(\mathrm{mod}4)$, so $m$ is odd and $n$ even. Coprimality then gives $m=u^2$ and $n=2v^2$. ConsequentlyThis second triangle is primitive, since $x$ is odd and $\gcd (x,v)=1$. Parametrize it as $x=r^2-s^2$, $2v^2=2rs$, $u^2=r^2+s^2$, with $r,s$ coprime. The equality $v^2=rs$ makes $r=a^2$, $s=b^2$. Thusa new positive solution with smaller hypotenuse $u<z=u^4+4v^4$. This contradicts infinite descent, proving the auxiliary assertion.

Area two is also impossible. Clearing denominators and removing a common factor now gives a primitive integer triangle with area twice an integer square. Indeed, if an integer is $2(a/b{)}^2$ with $\gcd (a,b)=1$, then $b^2$ divides two, forcing $b=1$. Its area product would satisfyThe odd factors must be squares and the unique even factor twice a square. As in the preceding modulo-eight argument, $m$ even would force $m+n=c^2$, $m-n=d^2$ and $n=b^2$ odd, with $c^2-d^2=2b^2$, impossible modulo eight. ThusThe integers $u=(c+d)/2$ and $v=(c-d)/2$ are positive and coprime, and $uv=(c^2-d^2)/4=b^2$. Hence $u=r^2$, $v=s^2$. Butcontradicting the auxiliary descent. This proves two is not a congruent number, and concludesThe two obstructions are global arithmetic descents. The elliptic-curve correspondence organizes the wider problem, but by itself is not a substitute for proving these particular nonexistence assertions.

Let $K$ be a field, $K_s$ a separable closure and $G_K$ its absolute Galois group. A discrete Galois module $A$ is an abelian group with a continuous $G_K$-action, so each element has an open stabilizer. Galois cohomology uses continuous cochains. Its zeroth group is $H^0(K,A)=A^{G_K}$, and its first group iswhereThus cocycles measure a failure of descent, and coboundaries account for changing a chosen lift. A short exact sequence of Galois modules gives a long exact sequence in group cohomology. Its connecting map sends an invariant element of a quotient to the cocycle $\sigma b-b$ of a chosen lift $b$; changing the lift changes this by a coboundary. These constructions provide the bridge between arithmetic divisibility and cohomology.

For Kummer theory, assume the characteristic does not divide $n$. The multiplicative exact sequence isThe final arrow is surjective because a root of $T^n-a$ is separable for $a\ne 0$. Hilbert's theorem 90 says $H^1(K,K_s^{\times })=0$. Here is its usual finite-extension proof. For a multiplicative cocycle $c_{\sigma }$ on a finite Galois extension $L/K$, choose $a\in L$ so thatSuch an $a$ exists by the Artin independence theorem. The cocycle identity gives $\tau A=c_{\tau }^{-1}A$. With $b=A^{-1}$ this becomes $c_{\tau }=\tau b/b$, a coboundary. Every continuous cocycle with values in $K_s^{\times }$ is defined over a sufficiently large finite Galois extension, so the same result holds for the absolute group.

The long exact sequence in group cohomology now givesThe class of $a$ maps to $c_{\sigma }=\sigma (\alpha )/\alpha$, where ${\alpha }^n=a$. This cohomological statement does not require ${\mu }_n\subset K$; it retains the actual Galois action on ${\mu }_n$. If all $n$th roots of unity do lie in $K$, the action is trivial, and after choosing a primitive root of unity the cocycles are characters into $\mathbb{Z}/n\mathbb{Z}$. Thus adjoining an $n$th root of $a$ describes a cyclic extension of degree dividing $n$, and Kummer classes classify the corresponding characters. For $n=2$, this gives the familiar quadratic extensions and the square-class group of a field.

Now let $K$ be a number field and $E/K$ an elliptic curve. The multiplication-by-n morphism is a surjective isogeny on $E(\overline{K})$, with kernel $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$. The Kummer exact sequence of an elliptic curveyieldsExplicitly, choose $Q$ with $nQ=P$ and set $\delta (P{)}_{\sigma }=\sigma Q-Q$. This lies in $E[n]$, satisfies the cocycle identity and is unchanged as a class if $Q$ is replaced by another division point. If it is a coboundary $\sigma T-T$ for $T\in E[n]$, then $Q-T$ is rational over $K$ and $P=n(Q-T)$. Conversely such a rational division point makes the cocycle zero. This proves the injectivity of the Kummer map of an elliptic curve on $E(K)/nE(K)$.

To prove the Weak Mordell-Weil theorem, it remains to prove that this particular cohomological image is finite. The full group $H^1(K,E[n])$ need not be finite, so the injection alone is not enough. Choose a finite set $S$ of finite places containing the bad-reduction places and those dividing $n$. At any other place, the construction in Question 3 works over the local field: reduce $P$, find an $n$-division point over a finite residue extension, lift it by the Hensel lemma, and correct its error by the inverse formal multiplication. Thus $P$ has an $n$-division point over the maximal unramified extension. Choosing that lift locally makes the cocycle zero on inertia. For an arbitrary lift its restriction is a coboundary, so the cohomology class is unramified. Therefore the image lies in first Galois cohomology unramified outside a finite set:We prove the required finiteness of this group. Take a finite Galois extension $L/K$ containing all of $E[n]$ and ${\mu }_n$, and enlarge $S$ to include any remaining ramification of $L/K$. Let $S_L$ be the places above it. The inflation-restriction exact sequence bounds the kernel of restriction to $L$ bya finite group, since both its group of arguments and its group of values are finite. Over $L$ the torsion module is constant and can be identified with ${\mu }_n^2$, so Kummer theory givesRestrictions of our unramified classes remain unramified outside $S_L$. If a Kummer class $[a]$ is unramified at such a place $v$, its $n$th root can be taken in an unramified local extension. The extended valuation still has integer values, and $nv(\sqrt[n]{a})=v(a)$. Hence $v(a)$ is divisible by $n$. Each coordinate therefore lies in the S-unramified power class groupThis group is finite. Indeed, the ideal of $a$ away from $S_L$ is ${\mathfrak{a}}^n$. Sending $[a]$ to $[\mathfrak{a}]$ yields the exact sequenceFor its kernel, a principal $\mathfrak{a}$ lets us divide $a$ by an $n$th power to obtain an $S_L$-unit. For surjectivity, an ideal class killed by $n$ has an $n$th power which is principal away from $S_L$, giving such an $a$. The S-unit group is finitely generated and the ideal class group is finite; hence both end groups are finite, proving finiteness of S-unramified Kummer classes. Restriction has finite image in $L(S_L,n{)}^2$ and finite kernel, so $H_S^1(K,E[n])$ is finite. We concludewhich is the Weak Mordell-Weil theorem and its Kummer-theoretic proof of the weak Mordell-Weil theorem.

This framework also defines the Selmer group of an elliptic curve by imposing that a class in $H^1(K,E[n])$ lie in the local Kummer image at every completion. Its classes are unramified outside a fixed finite set, so the same finiteness proof applies. Its relation to rational points isThe Tate–Shafarevich group here measures the difference between locally soluble torsors and globally soluble ones. Finally, the weak theorem gives finite divisibility quotients; adding the height descent lemma and bounded-height finiteness proves the stronger Mordell-Weil theorem. Those height inputs are additional to the cohomological finiteness just established.