Past exam of the mathematics course of the University of Cambridge / 2009 / iii / Paper 26 (Elliptic Curves)

Choose a Weierstrass equation of an elliptic curve, with origin $O$ at infinity. For $P,Q$, draw their chord, or the tangent if they coincide, and call its third intersection $R$, counted with intersection multiplicity. The line through $R$ and $O$ gives a third point $S$; define $P+Q=S$. This is the chord-and-tangent group law. The inverse of an affine point on $y^2+a_{1}xy+a_{3}y=x^3+a_2{x}^2+a_{4}x+a_6$ is $(x,-y-a_{1}x-a_3)$, obtained from its vertical line through $O$. These conventions give identity $O$, and cover tangent and flex cases by multiplicity.

Here is a proof of associativity, without assuming that the geometric construction already defines a group. Work first over an algebraic closure and use divisors on an algebraic curve. The Riemann-Roch theorem says $\ell (D)-\ell (K_E-D)=\mathrm{deg}D+1-g$. For a smooth genus-one curve the canonical divisor has degree zero, so every degree-one divisor has $\ell (D)=1$. Thus every divisor class of degree one has a unique effective representative, necessarily a single point. Existence follows from a nonzero section; uniqueness follows because two distinct effective representatives would give linearly independent sections in the same one-dimensional space. Consequentlyis a bijection: add $(O)$ to any degree-zero divisor class, and use its unique degree-one representative.

A line through $P,Q,R$ cuts out a divisor linearly equivalent to $3(O)$, since the line at infinity has triple intersection at the Weierstrass flex $O$. Equivalently, the ratio of the line equation to that of the line at infinity has principal divisor $(P)+(Q)+(R)-3(O)$. Thus the three corresponding degree-zero classes sum to zero. Applying the same fact to $O,R,S$ shows that the point produced by the chord-and-tangent process satisfiesAddition of divisors modulo principal divisors is associative. The two parenthesizations of $P+Q+T$ therefore have identical classes; injectivity of the displayed bijection makes them the same point. Hence the chord-and-tangent law is associative. This is associativity of the chord-and-tangent law via divisor classes. Its construction is defined over the original field, so the same conclusion holds for its rational points.

The nonzero elliptic-curve discriminant forces $b\ne 0$. At $P$, the derivative with respect to $y$ is $b$ and that with respect to $x$ is zero, so the tangent is $y=0$. Substitution gives $x^2(x+b)=0$: its third point is $(-b,0)$. Applying the negation formula givesThe line through $P$ and $2P$ has slope $1-a$, because their x-coordinates are distinct. Substitution of $y=(1-a)x$ givesIts third point is $(1-a,(1-a{)}^2)$, interpreted with multiplicity if it coincides with a previously used point. Negating it yieldsBy associativity, $5P=O$ exactly when $3P=-2P$. Equality of their x-coordinates forces $1-a=-b$, and when $a=b+1$ their y-coordinates also agree and are zero. ThereforeSince $P\ne O$, its order in this case is exactly five. These are the torsion multiples in a two-parameter Weierstrass family formulas.

Use $P=(0,0)$ in the family from part (b). For order four, take $a=b=1$, givingIts discriminant is $-15$, and $2P=(-1,0)$ is a nonzero point equal to its own inverse. Thus $4P=O$ and $2P\ne O$.

For order five, take $a=2,b=1$:The discriminant is $-11$, and $a=b+1$ gives exact order five by part (b).

For order six, take $a=0,b=-2$:Its discriminant is $80$. Here $2P=(2,2)$ and $3P=(1,1)$; negation is $(x,y)\mapsto (x,2-y)$, so $3P$ is nonzero 2-torsion. Neither $2P$ nor $3P$ is $O$, excluding orders two and three, while $6P=O$. All coefficients and points are rational, and the nonzero discriminants certify genuine elliptic curves.

Bad reduction of an elliptic curve must be tested on a Minimal Weierstrass equation, not inferred merely from primes dividing the displayed elliptic-curve discriminant. For an odd prime $p$, write $v_p(D)=2k+ϵ$ with $ϵ\in \{0,1\}$. The coordinate change $x=p^{2k}X$, $y=p^{3k}Y$ gives the same form with parameter $D/p^{2k}$. If $ϵ=0$, that parameter is a unit at $p$ and its discriminant is a unit, so reduction is good.

If $ϵ=1$, the new discriminant valuation is six. Discriminants of isomorphic Weierstrass models differ by a twelfth power under a coordinate change, so their valuations differ by a multiple of twelve. An integral model has nonnegative discriminant valuation; consequently a model of valuation six cannot be replaced by one of valuation zero. Reduction is bad. At $p=2$, oddness of $D$ makes the original discriminant valuation six, and the same argument gives bad reduction of an elliptic curve there as well. ThusThese are the bad primes of a congruent number curve with odd parameter. If $D$ is squarefree this simplifies to the primes dividing $2D$. Squarefreeness is not stated in the PDF: for example, $D=9$ gives a curve isomorphic to $E_1$ by $x=9X,y=27Y$, so it has good reduction at three although the displayed discriminant is divisible by three.

At every good prime we have $p\ne 2$. After removing any even p-adic valuation in the parameter as in part (a), use a smooth reduction $y^2=x^3-d^{2}x$ with $d\in {\mathbb{F}}_p^{\times }$. Let $\chi$ be the Legendre symbol, extended by $\chi (0)=0$. Counting the two, one or zero y-values above each x givesIf $p\equiv 3(\mathrm{mod}4)$, then $\chi (-1)=-1$. The terms for $x$ and $-x$ cancel, including zeros, because the cubic is odd. Hence $a_p=0$.

For the converse, the four distinct points $O,(0,0),(d,0),(-d,0)$ form the full rational 2-torsion subgroup of the reduced curve. Its group order is therefore divisible by four. If $p\equiv 1(\mathrm{mod}4)$, zero trace would give group order $p+1\equiv 2(\mathrm{mod}4)$, a contradiction. ConsequentlyThis is the vanishing trace criterion for a congruent number curve. The Hasse theorem for elliptic curves statesFor good primes that divide a nonsquarefree displayed parameter, the tilde denotes the smooth reduction of a minimal model, not the singular special fibre of that nonminimal equation.

We first determine the torsion. The rational 2-torsion points are $O,(0,0),(5,0),(-5,0)$. At the good primes three and seven, part (b) gives group orders four and eight. Prime-to-residue-characteristic torsion injects under reduction: an element in the kernel has a formal parameter $t$ of positive valuation, and multiplication by an integer prime to the residue characteristic has series $mt+O(t^2)$ with unit leading coefficient, so cannot kill a nonzero such parameter. At seven this excludes rational 3-primary torsion; at three it excludes 7-primary torsion and every odd-primary component other than the already excluded 3-primary component. Thus all torsion is 2-primary and injects at three, bounding its order by four. Consequently

For the rank, use two-isogeny descent withThe two-isogeny formula givesThey extend at the exceptional points, have kernels $\{O,(0,0)\}$ on their respective curves, and satisfy $\psi \varphi =[2]$. These assertions can be checked by substitution; for example the composed x-coordinate is $(x^2+25{)}^2/[4x(x^2-25)]$, the duplication x-coordinate. The maps respect addition because they are morphisms fixing $O$: pushforward of divisor classes is additive, takes principal divisors to principal divisors by the norm of a rational function, and under the identification in part 1(a) sends $[(P)-(O)]$ to $[(\varphi P)-(O)]$, and likewise for $\psi$.

Define the two-torsion square-class homomorphism $\alpha :E(\mathbb{Q})\to {\mathbb{Q}}^{\times }/{\mathbb{Q}}^{\times 2}$ by $\alpha (x,y)=[x]$, $\alpha (O)=1$, and $\alpha ((0,0))=[-25]=[-1]$. Define ${\alpha }^{\prime }$ on $E^{\prime }$ similarly, with ${\alpha }^{\prime }((0,0))=[100]=1$. To see the homomorphism property, a nonvertical line $y=mx+c$ cuts either curve in three points whose x-coordinates have product $c^2$. The chord-and-tangent law therefore makes their square classes multiply to one. When the line passes through $(0,0)$, the two remaining x-coordinates have product equal to the coefficient of $x$, exactly explaining the assigned value there. Vertical lines give the inverse-point relation. The same argument includes repeated tangent intersections.

The kernels are $\ker \alpha =\psi E^{\prime }(\mathbb{Q})$ and $\ker {\alpha }^{\prime }=\varphi E(\mathbb{Q})$. Here is an explicit check, not just an invocation of the descent correspondence. The x-coordinate of every nonexceptional $\psi$-image is a square. Conversely, if $(x,y)\in E$ has $x=s^2\ne 0$, put $X=2x+2y/s$ and $Y=2sX$. Then $X^2-4xX+100=0$, so $(X,Y)\in E^{\prime }$ and the displayed $\psi$ maps it to $(x,y)$. For $E^{\prime }$, every nonexceptional $\varphi$-image has $X=(y/x{)}^2$; if $X=s^2\ne 0$, put $x=(X+Y/s)/2$, $y=sx$. Substitution gives a point of $E$ mapping to $(X,Y)$. The point $(0,0)\in E^{\prime }$ has square class one and equals $\varphi (5,0)$; the point $(0,0)\in E$ has nonsquare class $-1$. Together with the origins these checks handle every exception.

The prime-support bound in two-isogeny descent can be read directly from $y^2=x(x^2+B)$. At a prime not dividing the integral coefficient $B$, positive valuation of $x$ gives $2v(y)=v(x)$, while negative valuation gives $2v(y)=3v(x)$; either way the valuation of $x$ is even. Thus the first image has only the candidate classes $1,-1,5,-5$. All four occur, already at the four torsion points. Hence $\#\alpha (E)=4$.

On $E^{\prime }$, nonzero real x-coordinates are positive since $X(X^2+100)$ has the sign of $X$. Prime support leaves only $1,2,5,10$. The point $(5,25)$ supplies class five. Class two would give the quartic covering in a two-isogeny descentIndeed write $X=2(U/V{)}^2$ and clear the square factor in the curve equation. If $5\nmid U$, the right side is two modulo five, impossible for a square. If $5\mid U$, then $5\nmid V$ and $5\mid W$; division by twenty-five gives $(W/5{)}^2\equiv 2V^4\equiv 2(\mathrm{mod}5)$, again impossible. This is the five-adic obstruction to square class two on the curve with coefficient one hundred. Because the image is a subgroup and contains five, class ten is excluded as well. Therefore ${\alpha }^{\prime }(E^{\prime })=\{1,5\}$ has size two.

Now $[E:\psi E^{\prime }]=4$. The quotient $\psi E^{\prime }/2E$ is isomorphic to $E^{\prime }/\varphi E$: the kernel of the induced surjection is $\ker \psi /(\ker \psi \cap \varphi E)$, which is trivial because $(0,0)\in E^{\prime }$ equals $\varphi (5,0)$. Thus $[E:2E]=4\cdot 2=8$. Finite generation follows from the Mordell-Weil theorem, whose height-descent proof is supplied in the essay below. A finitely generated group with the torsion already found has $[E:2E]=2^{r+2}$, so $r=1$. HenceThe point $(-4,6)$ has infinite order, since it is not one of the torsion points. No assertion that this particular point generates the free factor is needed.

Let $P_0=(-4,6)$, the infinite-order point established in part (c). Every positive multiple $n{P}_0$ is rational and is neither $O$ nor 2-torsion: either possibility would force some nonzero multiple of $P_0$ to vanish. Write its coordinates as $(x,y)$, so $y\ne 0$ and $x\notin \{0,5,-5\}$.

The stated algebraic identity gives positive rational sidesThey satisfy $a^2+b^2=c^2$, and their area isby the curve equation. This is the infinitely many rational right triangles from a nontorsion point construction for the congruent number elliptic curve.

The infinitely many points cannot produce only finitely many triangles. For a fixed ratio $r=c/b$, the positive number $X=|x|$ satisfies $X^2-10rX+25=0$, so there are at most two choices for $|x|$, then at most two signs of $x$ and two signs of $y$. Thus the map to ordered triangles is finite-to-one. Permuting the two legs introduces only another finite ambiguity. Consequently there are infinitely many distinct rational right triangles of area five. For $P_0$ itself the sides are $(3/2,20/3,41/6)$.

Here a formal group law means a one-dimensional commutative law $F(X,Y)\in R[[X,Y]]$ with $F(X,0)=X$, $F(0,Y)=Y$, $F(X,Y)=F(Y,X)$ and $F(F(X,Y),Z)=F(X,F(Y,Z))$. It has leading part $X+Y$ and a recursively determined formal inverse $i_F(T)=-T+O(T^2)$. A homomorphism $h(T)\in TR[[T]]$ satisfies $h(F(X,Y))=G(h(X),h(Y))$. It is an isomorphism precisely when its linear coefficient is a unit of $R$: necessity follows by composing with an inverse, while sufficiency follows by recursive inversion of the series and then the homomorphism identity. Over a field the condition is $\boxed{h^{\prime }(0)\ne 0}$.

The characteristic-zero classification is that every such law over $K$ has a unique isomorphism to the formal additive group with linear coefficient one. This is its formal logarithm. To prove it, put $f(T)={\partial }_{Y}F(T,0)$, whose constant term is one, and defineIntegration is coefficientwise, which is possible over the characteristic-zero field. Differentiate associativity with respect to $Z$ at zero to obtainIt follows that ${\partial }_Y{\ell }_F(F(X,Y))=1/f(Y)={\ell }_F^{\prime }(Y)$. The difference ${\ell }_F(F(X,Y))-{\ell }_F(Y)$ is therefore independent of $Y$; evaluating at $Y=0$ givesIts linear coefficient one makes it invertible as a formal series. Conversely, a homomorphism from $F$ to the additive law with derivative $c$ satisfies $h^{\prime }(T)f(T)=c$, by differentiating its defining identity at the second variable zero. Thus $h=c{\ell }_F$. In particular the normalized logarithm is unique, and every homomorphism between two laws over $K$ is ${\ell }_G^{-1}(c{\ell }_F(T))$, with an isomorphism exactly when $c\ne 0$. This is a formal classification; analytic convergence is a separate issue.

Now suppose $F$ is defined over ${\mathcal{O}}_K$. Write $v_K(\pi )=1$, $e=v_K(p)$ and let the residue field have size $q$. Since $f(T)$ and its reciprocal have integral coefficients, writing ${\ell }_F(T)=T+{\sum }_{n\ge 2}{c}_n{T}^n$ gives the valuation bound for coefficients of an integral formal logarithmTherefore the logarithm converges on $\pi {\mathcal{O}}_K$, as $n{v}_K(t)-e{v}_p(n)$ tends to infinity. Choose an integer $s>e/(p-1)$ and put $g(t)={\ell }_F(t)-t$. For $t,u\in {\pi }^s{\mathcal{O}}_K$, factoring $t^n-u^n$ givesThe last inequality uses $v_p(n)\le (n-1)/(p-1)$, since $n\ge p^{v_p(n)}\ge 1+(p-1)v_p(n)$. It follows that $g$ maps this ball into ${\pi }^{s+1}{\mathcal{O}}_K$ and is strictly contracting, gaining at least one unit of valuation in differences.

For any $z\in {\pi }^s{\mathcal{O}}_K$, iterate $t_{j+1}=z-g(t_j)$ from $t_0=z$. The iterates remain in the ball, their differences gain valuation at each step, and completeness gives a limit solving ${\ell }_F(t)=z$. The same difference estimate makes this solution unique. Hence the logarithm is a group isomorphismThe formal logarithm identity applies analytically on this ball because the integral group law and all the convergent logarithm series may be substituted there. Finally reduction of the formal parameter modulo ${\pi }^s$ is a group homomorphism from $F(\pi {\mathcal{O}}_K)$ onto the finite group on $\pi {\mathcal{O}}_K/{\pi }^s{\mathcal{O}}_K$, with kernel $F({\pi }^s{\mathcal{O}}_K)$. Its index is $q^{s-1}$. Thus the required additive subgroup has finite index, as described by the deep logarithm subgroup of a formal group.

Galois cohomology and finite quotients. Let $k$ be a number field and $G_k=\mathrm{Gal}(\overline{k}/k)$ its absolute Galois group. For a discrete abelian $G_k$-module $M$, $H^0(k,M)=M^{G_k}$. A continuous 1-cocycle is a map $c:G_k\to M$ with $c_{\sigma \tau }=c_{\sigma }+\sigma c_{\tau }$; a coboundary has the form $c_{\sigma }=\sigma m-m$. Their quotient is $H^1(k,M)$. Short exact sequences of modules give the long exact sequence in group cohomology; the connecting map measures the obstruction to lifting a fixed element to a fixed preimage. This interpretation gives a concrete descent map for an elliptic curve.

For an integer $m\ge 2$, multiplication on the geometric points gives the exact sequenceHere multiplication is a separable isogeny in characteristic zero, with $m^2$ geometric kernel points. For $P\in E(k)$ choose $Q$ with $mQ=P$. Then $c_{\sigma }=\sigma Q-Q$ lies in $E[m]$, satisfies the cocycle identity, and changing $Q$ changes it by a coboundary. Its class $\delta (P)$ vanishes exactly when $P\in mE(k)$: if $c_{\sigma }=\sigma T-T$ for $T\in E[m]$, the point $Q-T$ is rational and divides $P$. Thus the Kummer exact sequence of an elliptic curve includesThe construction also proves that $\delta$ is a homomorphism. The final group can be interpreted as classes of elliptic-curve torsors killed by $m$; imposing soluble completions leads to the Selmer group of an elliptic curve. For weak Mordell-Weil, the important task is to bound the arithmetic image of $\delta$, not to assume that the entire first cohomology group is finite.

Choose a finite set $S$ containing the bad primes, primes dividing $m$, and archimedean places. At a good finite place $v\notin S$, the class $\delta (P)$ is unramified. Here is the local reason. Over a finite extension of the residue field choose an $m$-division point of the reduction of $P$; multiplication is surjective on the points over its algebraic closure. Pass to the corresponding unramified extension of $k_v$ and lift this nonsingular point by the Hensel lemma. The discrepancy between $m$ times its lift and $P$ lies in the kernel of reduction. The formal group of an elliptic curve describes that kernel, and multiplication by $m$ is bijective there because its leading coefficient is a unit. Correcting the lift therefore gives an actual division point in the unramified closure. Inertia fixes that point, so the Kummer cocycle vanishes on inertia. The same good-reduction argument shows that $E[m]$ itself is unramified outside $S$.

We now prove the required finiteness of unramified cohomology classes. Choose a finite Galois extension $L/k$ over which $E[m]$ and the $m$th roots of unity are all rational, and enlarge $S$ to include its ramified primes. The inflation-restriction exact sequence shows that restriction to $G_L$ has finite kernel: that kernel comes from $H^1(\mathrm{Gal}(L/k),E[m])$, a finite group since both its group and coefficient module are finite. Over $L$, a choice of basis identifies $E[m]$ with ${\mu }_m^2$. The multiplicative Kummer sequence, together with Hilbert 90, givesFor clarity, Hilbert 90 says that a multiplicative cocycle for a finite Galois extension is a coboundary. If its values are $c_{\sigma }$, choose $a$ so that $b={\sum }_{\sigma }{c}_{\sigma }\sigma (a)\ne 0$. Then $\tau (b)=c_{\tau }^{-1}b$, so $c_{\tau }=\tau (b^{-1})/b^{-1}$. Such an $a$ exists because distinct field automorphisms are linearly independent: a relation with the fewest nonzero terms, evaluated on $at$ and compared with its value on $t$ multiplied by one automorphism's value on $a$, would produce a shorter nonzero relation. Continuity reduces the absolute-Galois version to a finite extension. This proves the cohomological vanishing used in the multiplicative Kummer sequence.

An unramified Kummer class represented by $a\in L^{\times }$ has $v_w(a)\equiv 0(\mathrm{mod}m)$ at every finite $w\notin S_L$. Indeed an $m$th root of $a$ fixed by inertia belongs to an unramified local extension, whose value group is still the integers. DefineFactoring the fractional ideal away from $S_L$ as an $m$th power gives the exact sequenceTo check it, send $[a]$ to the ideal class of its $m$th root ideal. Changing $a$ by an $m$th power changes that ideal by a principal ideal. The kernel consists precisely of S-units modulo $m$th powers, and every $m$-torsion ideal class has a representative whose $m$th power is principal, proving surjectivity. The S-unit group is finitely generated by the Dirichlet unit theorem and the finite collection of allowed prime valuations. The localized ideal class group is a quotient of the finite ordinary ideal class group. Both end groups, and hence $L(S_L,m)$, are finite. This is the finiteness of S-unramified Kummer classes argument.

The restrictions of the elliptic Kummer image lie in two copies of this finite group, and the restriction kernel is finite. The injection $\delta$ therefore provesThis is the Weak Mordell-Weil theorem. The unramified restriction is essential: even $H^1(k,{\mu }_2)=k^{\times }/k^{\times 2}$ is generally infinite. Cohomology turns divisibility into a cocycle; good reduction restricts its ramification; units and ideal classes supply the arithmetic finiteness.

Height functions and finite generation. Write $d=[k:\mathbb{Q}]$ and use absolute values extending the usual rational ones, with local degrees $n_v=[k_v:{\mathbb{Q}}_v]$. The logarithmic height of a projective pair isThe product formula makes it independent of scaling. For $t\in k$, $h(t)=h(t:1)$ is nonnegative. On a short Weierstrass equation $E:y^2=x^3+Ax+B$, put $h_x(P)=h(x(P))$ and $h_x(O)=0$.

Bounded height gives only finitely many rational points. To see the scalar finiteness behind the Northcott theorem, an algebraic number $t$ of degree $e$ has primitive minimal polynomial $a_0{\prod }_{i=1}^e(T-t_i)$, and the product formula gives $e^{eh(t)}=|a_0|{\prod }_i\max (1,|t_i|)$. If $e\le d$ and $h(t)\le H$, every coefficient has absolute value at most $2^d{e}^{dH}$. There are only finitely many such integer polynomials and hence finitely many roots. Each x-coordinate lifts to at most two points of $E$, with $O$ handled separately. Thus $\{P\in E(k):h_x(P)\le H\}$ is finite.

The second ingredient is height expansion under doubling:Indeed the duplication formula is the degree-four morphism of the projective x-line represented by the coprime quartic formsThey are coprime because the elliptic curve is nonsingular. At each place their coefficient bounds give $\max (|F{|}_v,|G{|}_v)\le C_v\max (|X{|}_v,|Z{|}_v{)}^4$. Bezout identities expressing powers of each coordinate as combinations of $F,G$ give the reverse inequality up to another local constant. One obtains these identities by the Euclidean algorithm on the two affine charts and clearing denominators. Only finitely many non-Archimedean places have a constant different from one. Taking weighted logarithms and summing proves the uniform bounded error. This is height growth under a morphism of the projective line, applied with degree four.

For a fixed $R=(r,s)\in E(k)$, the addition formula also givesFor $x(P)\ne r$, its x-coordinate isThe curve equation bounds $|y{|}_v$ by a local constant times $\max (1,|x{|}_v{)}^{3/2}$. Both numerator and denominator are consequently bounded by a local constant times $\max (1,|x{|}_v{)}^2$. The projective-height definition gives the claimed inequality; the finitely many exceptional points with $x=r$ are absorbed into the constant. For $R=O$ the estimate is immediate.

By weak Mordell-Weil, choose finitely many representatives $R_1,\dots ,R_t$ for $E(k)/2E(k)$. Every $P$ can be written $P=2Q+R_i$. Combining the last two inequalities giveswith one constant $C_0\ge 0$ for all the representatives. This is naive height contraction in elliptic halving descent. If $h_x(P)>2C_0+1$, the new point $Q$ has height at least one half less than that of $P$. Repetition must therefore reach the finite set of points of height at most $2C_0+1$. Reversing the identities $P_j=2P_{j+1}+R_{i_j}$ shows that every point is generated by this finite terminal set together with the finite list of representatives. ThusThe structure theorem then gives $E(k)\cong E(k{)}_{\mathrm{tors}}\times {\mathbb{Z}}^r$ with finite torsion subgroup: this is the Mordell-Weil theorem. Finiteness modulo two alone does not imply finite generation; the contracting height argument is what bridges that gap.

The bounded duplication error also constructs the canonical height of an elliptic curve:The successive differences are bounded by a summable geometric sequence, so the limit exists, $\hat{h}(P)=\frac{1}{2}{h}_x(P)+O_E(1)$, and $\hat{h}(2P)=4\hat{h}(P)$. It is nonnegative. Torsion points have canonical height zero because their multiples form a finite set. Conversely, if the canonical height is zero, all $2^{j}P$ have bounded naive height; Northcott finiteness makes two of them equal and hence makes $P$ torsion. The canonical height removes the bounded error from the arithmetic growth law and identifies exactly the torsion directions, while the elementary naive-height descent already proves finite generation.