Past exam of the mathematics course of the University of Cambridge / 2013 / iii / Paper 22 (Elliptic Curves)

Write the cubic in the Weierstrass equation of an elliptic curve as $f(x)=x^3+a_2{x}^2+a_{4}x+a_6$. A suitable invariant differential on an elliptic curve isIt is regular and nonzero wherever $y\ne 0$. At a point with $y=0$, nonsingularity gives $f^{\prime }(x)\ne 0$, and differentiating the equation shows $\omega =dy/f^{\prime }(x)$, again regular and nonzero. At the identity $O$, use the parameter $t=-x/y$: the expansions start $x=t^{-2}+\cdots$, $y=-t^{-3}+\cdots$, so $\omega =(1+\cdots )dt$. Thus it is a nowhere-vanishing regular differential on the whole smooth projective curve.

Here is a direct proof of translation invariance of a Weierstrass differential. Fix $Q=(u,v)$, let $P=(x,y)$ vary, and write $P+Q=(X,Y)$. On the open set where the chord-and-tangent group law uses an ordinary chord, put $h=(y-v)/(x-u)$. The addition formulas are $X=h^2-a_2-x-u$ and $Y=h(x-X)-y$. The line-intersection identity isDifferentiate this polynomial in $T$ at $T=x$ to obtain $f^{\prime }(x)-2yh=(x-u)(x-X)$. Differentiating $h$ along the curve now gives $dh/dx=(x-X)/(2y)$, and henceThis proves translation invariance on a dense open set. Since the translation on an elliptic curve is an automorphism and both sides are regular differentials, it proves invariance everywhere, including the exceptional addition cases. Translation by $O$ is the identity.

Translation invariance also gives ${\mu }^{\ast }\omega ={\mathrm{pr}}_1^{\ast }\omega +{\mathrm{pr}}_2^{\ast }\omega$ for the addition map: its differential on a tangent pair is the sum of the two translated tangent vectors. Therefore $[j{]}^{\ast }\omega =j\omega$ for every integer $j$.

Let $d_j=\mathrm{deg}[j]$, with the zero endomorphism assigned degree zero. The assumed degree identity, applied to $[j]$ and $[1]$, givesInduction gives $\mathrm{deg}[j]=j^2$ for positive $j$; negation is an automorphism, so the result holds for negative $j$ as well. This is quadratic degree recursion for elliptic multiplication.

For a prime $\ell \ne p$, the invariant differential on an elliptic curve has nonzero pullback under $[\ell ]$, so that map is a separable isogeny. Translation identifies all its fibres and their local multiplicities, so its geometric kernel has exactly its degree ${\ell }^2$ distinct points. It is killed by $\ell$, and thereforeThe algebraic closure is essential here; the assertion is not generally true for the rational-point subgroup over ${\mathbb{F}}_p$ itself. This is prime-to-characteristic geometric torsion.

For $[p]$, the pullback differential vanishes. Its total degree is $p^2$, and its inseparable degree is at least $p$, so its kernel has at most $p$ geometric points. Thus $E({\mathbb{F}}_p)[p]$ has dimension at most one over ${\mathbb{F}}_p$, while every other prime-torsion subgroup has dimension at most two. The rational-point group is finite and abelian. The structure theorem for finite abelian groups says that the number of cyclic factors of an $\ell$-primary component equals the dimension of its subgroup killed by $\ell$. Each component therefore has at most two factors. Combining the smaller primary factors into one cyclic group and the larger ones into another yieldsOne may also choose $p\nmid m$, since the $p$-primary component is cyclic. This explains two generators for elliptic curves over finite fields.

Put $N(x)=x^3+x+2$, $H(x)=x^3+2x+1$ and $R(x)=N(x)/(x-1{)}^2$, all in characteristic three. Since $N(1)=1$, the numerator and denominator have no common factor, and $R$ has degree three. The map $x:E\to {\mathbb{P}}^1$ has degree two. Comparing the degrees in $x\circ \varphi =R\circ x$ gives $2\mathrm{deg}\varphi =3\cdot 2$, so $\mathrm{deg}\varphi =3$. This is the degree of an isogeny from its x-coordinate map.

In characteristic three, direct differentiation givesThe supplied $y$-coordinate is $H(x)y/(x-1{)}^3$, so the invariant differential on an elliptic curve satisfiesIn particular $\varphi$ is separable. Its dual isogeny satisfies $\hat{\varphi }\circ \varphi =[3]$. Since $[3{]}^{\ast }\omega =0$ and ${\varphi }^{\ast }\omega =\omega$, the scalar by which $\hat{\varphi }$ pulls back the differential is zero.

Pullback on the elliptic invariant differential is additive for sums of homomorphisms, by the addition identity proved in (a). ConsequentlyThe differential criterion for separability of an isogeny therefore gives separability exactly when $3\nmid m$, with $n$ arbitrary. Such a map is automatically nonzero. When $3\mid m$, every nonzero resulting map is inseparable; the zero map is not a separable isogeny. In fact the zero map occurs only at $(m,n)=(0,0)$: equality of the degrees of $[m]\varphi$ and $[n]\hat{\varphi }$ in a nontrivial vanishing relation would force $m=\pm n$, and then cancellation would force $\varphi =\pm \hat{\varphi }$, contradicting their different differential scalars.

In this setting a formal group law means a one-dimensional commutative series $F(X,Y)\in R[[X,Y]]$ with identity zero andIt starts with $X+Y$; there is a unique inverse series $\iota (T)=-T+\cdots$ satisfying $F(T,\iota (T))=0$. For coefficients in $\mathbb{Z}$, the series and its inverse converge on $p{\mathbb{Z}}_p$, making this ideal a topological abelian group under $F$.

Set $a(T)={\partial }_{Y}F(T,0)\in 1+T\mathbb{Z}[[T]]$, and write $a(T{)}^{-1}={\sum }_{j\ge 0}{b}_j{T}^j$. The formal logarithm isDifferentiate associativity in the third variable at zero. It gives $a(F(X,Y))={\partial }_{Y}F(X,Y)a(Y)$, so ${\partial }_{Y}L(F(X,Y))=L^{\prime }(Y)$. Subtracting $L(Y)$ leaves a series independent of $Y$, whose value at zero is $L(X)$. Thus $L(F(X,Y))=L(X)+L(Y)$.

For odd $p$, the logarithm converges on $I=p{\mathbb{Z}}_p$: the valuation of its degree-$n$ term is at least $n-v_p(n)$, which tends to infinity. Put $u(T)=L(T)-T$. For $x,y\in I$, factor $x^n-y^n$ to obtainfor every $n\ge 2$ and odd $p$. Hence $u$ is a contraction with constant at most $1/p$ and maps $I$ into $pI$. The equation $L(x)=z$ is equivalent to $x=z-u(x)$; the contraction mapping theorem gives a unique solution in $I$ for every $z\in I$. The same estimate shows $|L(x)-L(y){|}_p=|x-y{|}_p$, so the logarithm is a topological group isomorphism. Dividing its values by $p$ givesThis is the deep logarithm subgroup of a formal group argument, here with depth one.

For $p=2$, the degree-two estimate at depth one need not be strict. At depth two, however,so the same proof gives $F(4{\mathbb{Z}}_2)\cong (4{\mathbb{Z}}_2,+)\cong {\mathbb{Z}}_2$. This subgroup has index two in $F(2{\mathbb{Z}}_2)$, because $F(x,y)\equiv x+y(\mathrm{mod}4)$ when $x,y\in 2{\mathbb{Z}}_2$.

Indeed the topological structure of a formal group on twice the 2-adic integers has just two possibilities. Let $G=F(2{\mathbb{Z}}_2)$, let its index-two subgroup $H$ have topological generator $h$, and choose $v\notin H$. Write $2v=ch$, with $c\in {\mathbb{Z}}_2$, using group notation. If $c$ is odd, $2v$ generates $H$ and $v$ generates $G$, giving $G\cong {\mathbb{Z}}_2$. If $c$ is even, $v-(c/2)h$ has order two and lies outside $H$, giving $G\cong H\times \mathbb{Z}/2\mathbb{Z}$. The ${\mathbb{Z}}_2$ multiples are defined by continuity in this compact pro-two group.

For explicit contrasting examples, the formal additive group $F_a(X,Y)=X+Y$ gives $F_a(2{\mathbb{Z}}_2)\cong {\mathbb{Z}}_2$, which is a torsion-free group. The formal multiplicative group $F_m(X,Y)=X+Y+XY$ is identified by $x\mapsto 1+x$ with $1+2{\mathbb{Z}}_2$. Its element $x=-2$ corresponds to $-1$ and has order two. Moreoverand the logarithm identifies the second factor with $4{\mathbb{Z}}_2$. The two resulting groups are ${\mathbb{Z}}_2$ and $\mathbb{Z}/2\mathbb{Z}\times {\mathbb{Z}}_2$, so they are not isomorphic.

An elliptic curve has good reduction of an elliptic curve at $p$ if it admits a Weierstrass equation of an elliptic curve over ${\mathbb{Z}}_p$ whose reduced projective cubic is nonsingular. Equivalently its minimal discriminant is a $p$-adic unit.

For the given integral short equation,It therefore directly supplies good reduction outside $2,3,5$. These three primes cannot be rescued by changing the model. An admissible change of Weierstrass model changes the discriminant by a twelfth power, so its valuation changes by a multiple of twelve. The displayed valuations $4,7,4$ are not congruent to zero modulo twelve. No integral model can have unit discriminant at any of those primes. The good primes are exactly $p\notin \{2,3,5\}$.

At $P_1$ the tangent slope is zero. The elliptic-curve addition formula givesThe chord from $P_1$ to $P_2$ has slope $(-3-15)/(-6)=3$, so its sum has $x$-coordinate $3^2-0-(-6)=15$ and $y$-coordinate $3(0-15)-15=-60$. Thus $P_1+P_2=(15,-60)$.

Reduction at the good prime seven gives $\tilde{E}:y^2=x^3+1$. For $x=0,1,2,3,4,5,6$, the right sides are respectively $1,2,2,0,2,0,0$. There are respectively $2,2,2,1,2,1,1$ choices of $y$. Including the point at infinity gives $\#\tilde{E}({\mathbb{F}}_7)=12$. Its nonzero torsion points of an elliptic curve of order two are $(3,0),(5,0),(6,0)$, so it cannot be cyclic. Its two-primary component is $(\mathbb{Z}/2\mathbb{Z}{)}^2$ and its three-primary component is cyclic of order three; henceIn particular its exponent is six.

The reduction of an elliptic curve is a group homomorphism defined on every ${\mathbb{Q}}_7$-point by projectivity. Thus $6P$ reduces to the identity for every rational $P$. A finite point with integral coordinates reduces to an affine point, whose projective last coordinate is one, so it cannot reduce to the identity at infinity. Therefore every nonzero finite point $6P$ has nonintegral coordinates. If $6P=O$, it has no affine coordinates at all. This is the reduction exponent obstruction to integral multiples.

The Lutz–Nagell theorem says that for a nonsingular short equation $y^2=x^3+ax+b$ with $a,b\in \mathbb{Z}$, every nonidentity rational torsion point of an elliptic curve $(x,y)$ has $x,y\in \mathbb{Z}$, and either $y=0$ orThis is a necessary condition for torsion, not a converse.

To prove integrality, fix a prime $q$. If $v_q(x)<0$, the $x^3$ term dominates the right side of the equation. Hence $2v_q(y)=3v_q(x)$, so $v_q(x)=-2s$, $v_q(y)=-3s$ for some $s\ge 1$. The parameter $t=-x/y$ has valuation $s$ and identifies the point with the formal neighbourhood of the identity, namely the formal group of an elliptic curve evaluated on $q{\mathbb{Z}}_q$.

For odd $q$, this group is a torsion-free group by the logarithm argument of Question 2. For $q=2$, use the special short-model structure. Negation sends $t$ exactly to $-t$, so the formal multiplication series $[2](t)$ is odd and has integral coefficients:If $s=v_2(t)\ge 1$, the first term has valuation $s+1$ and all the others have valuation at least $3s>s+1$. Thus $v_2([2](t))=s+1$, and no iteration of doubling kills a nonzero point. Multiplication by an odd integer has unit linear coefficient and also cannot kill it. This proves the torsion-free formal subgroup for a short Weierstrass equation, including at two. Consequently a rational torsion point of an elliptic curve cannot have $v_q(x)<0$ at any prime. Its $x$ is integral, and the equation then makes its rational $y$ integral too.

For the divisibility conclusion suppose $y\ne 0$. Then $2P\ne O$ and is also a rational torsion point of an elliptic curve, so $x(2P)$ is integral. Its tangent slope $\lambda =f^{\prime }(x)/(2y)$ satisfies $x(2P)={\lambda }^2-2x$. Thus ${\lambda }^2\in \mathbb{Z}$; a rational number with integral square is itself integral. In particular $y^2\mid f^{\prime }(x{)}^2$. Reduce the supplied polynomial identity modulo $y^2=f(x)$: both terms on the left are divisible by $y^2$, so the right side $4a^3+27b^2$ is too. This is the divisibility proof in the Nagell–Lutz theorem.

For the specific curve, $4a^3+27b^2=3^7{5}^4$. The computed equality $2P_1=-P_1$ makes $P_1$ a point of exact order three. The coordinate $y(P_3)=17$ has square not dividing $3^7{5}^4$, so $P_3$ has infinite order. To decide $P_2$, use the already computed point $P_1+P_2=(15,-60)$. Its $y$-coordinate has even square, which cannot divide the odd number $3^7{5}^4$, so that sum has infinite order. Since $P_1$ is torsion, $P_2$ must have infinite order as well. $P_1$ has order three; $P_2$ and $P_3$ both have infinite order.

Kummer theory studies extracting roots through Galois actions, and on an elliptic curve the corresponding operation is division of points. The bridge is a cocycle: different Galois conjugates of a chosen division point differ by torsion. Controlling the ramification of these cocycles is what proves the Weak Mordell-Weil theorem.

Classically, for a characteristic-zero field $K$, the sequenceis exact. Hilbert's theorem 90 gives $H^1(K,{\overline{K}}^{\times })=0$, so Galois cohomology identifiesThe class of $a$ is represented by $\sigma \mapsto \sigma (\sqrt[m]{a})/\sqrt[m]{a}$. If ${\mu }_m\subset K$, the module is constant and these are continuous characters into ${\mu }_m$; the associated fields are cyclic Kummer extensions of degree dividing $m$. Several such classes give abelian extensions of exponent dividing $m$. Without the roots-of-unity hypothesis the cohomological description still holds, but the action on ${\mu }_m$ must not be discarded.

For an elliptic curve over a number field $K$, multiplication by $m\ge 2$ gives the exact sequence of Galois modulesThe map is onto because it is a nonconstant isogeny over an algebraically closed field. For $P\in E(K)$ choose $Q\in E(\overline{K})$ with $mQ=P$, and setIt satisfies $\delta (P{)}_{\sigma \tau }=\delta (P{)}_{\sigma }+\sigma \delta (P{)}_{\tau }$, the Galois 1-cocycle identity. Changing $Q$ by a torsion point of an elliptic curve changes the cocycle by a coboundary. If the class is zero, a corresponding change of $Q$ makes it Galois-fixed, so $P\in mE(K)$. Conversely a rational division point gives the zero class. Thus the Kummer map of an elliptic curve is injective on the quotient, and the cohomology sequence givesThis is the Kummer exact sequence of an elliptic curve. The last group parametrizes the appropriate torsor classes. It is important that the entire middle group need not be finite; an unrestricted Kummer class can ramify at arbitrarily many primes.

The Weak Mordell-Weil theorem states $E(K)/mE(K)$ is finite for every number field $K$ and every $m\ge 1$. The case $m=1$ is trivial. To prove the remaining cases, choose a finite set $S$ containing the primes of bad reduction and the primes dividing $m$. At a prime outside $S$, the elliptic curve extends to a smooth proper group scheme over the valuation ring, and $[m]$ is finite étale. Properness extends a local rational point to a section; its division fibre is a finite étale torsor over that ring. Therefore its Kummer class is unramified. This is unramified division torsors at good primes, and shows that ${\delta }_m(E(K))$ lies in first Galois cohomology unramified outside a finite set.

Let $L=K(E[m])$, enlarged if necessary to contain ${\mu }_m$, and include in $S$ the finitely many primes ramified in $L/K$. This is a finite Galois extension. Over $L$ the torsion module is constant, isomorphic to $(\mathbb{Z}/m\mathbb{Z}{)}^2$, and so to two copies of ${\mu }_m$. Restricting a cocycle to $G_L$ therefore reduces it to two classical Kummer classes unramified outside the primes above $S$. Such a class is represented by $a\in L^{\times }$ satisfyingWrite this power-class group as $L(S_L,m)$. The implication follows locally because, away from residue characteristic dividing $m$, the valuation of an unramified $m$th-root extension must be divisible by $m$.

Its finiteness comes from two standard arithmetic finiteness results, rather than from an assertion that all of $L^{\times }/(L^{\times }{)}^m$ is finite. The valuations outside $S_L$ associate to $a$ an ideal whose $m$th power is principal. There is an exact sequenceThe left group is finite by the finite generation of the S-unit group, and the right group is finite by finiteness of the ideal class group. This proves finiteness of S-unramified Kummer classes. Hence there are only finitely many restricted cocycles over $L$. The kernel of restriction from $K$ is contained in $H^1(\mathrm{Gal}(L/K),E[m])$, which is finite because both group and module are finite. The restricted cohomology group over $K$ is therefore finite, and its injected subgroup $E(K)/mE(K)$ is finite too. This completes a Kummer-theoretic proof of the weak Mordell-Weil theorem.

For arithmetic computation one adds local conditions. The Selmer group of an elliptic curve consists of classes in $H^1(K,E[m])$ whose restriction at every completion $K_v$ lies in the image of the corresponding local Kummer map. They are unramified outside the same finite set, so this group is finite. The failure of a everywhere locally soluble torsor to have a global point is measured by the Tate–Shafarevich group, defined as the kernel of the local restriction map on $H^1(K,E)$. The resulting exact sequence isThus the Selmer group of an elliptic curve gives a computable upper bound for the quotient; actual rational points supply lower bounds. Equality need not follow just from local solubility. Finiteness of this fixed torsion subgroup does not prove finiteness of the whole Tate–Shafarevich group.

Finally, weak finiteness alone is not finite generation: the additive group $\mathbb{Q}$ has trivial quotients by multiplication and is not finitely generated. The additional ingredient for the Mordell-Weil theorem is height descent. Choose representatives $P_i$ of $E(K)/mE(K)$ and write $P=P_i+mQ$. The quadratic growth of the canonical height of an elliptic curve, together with bounds for translation by the finitely many $P_i$, makes $Q$ have smaller height whenever $P$ is sufficiently large. Northcott theorem gives only finitely many points of bounded height, and repeated descent yields a finite generating set. This explains the roles of Kummer theory, local information and heights without conflating the weak and full theorems.

Translate the rational point of order two to $T=(0,0)$ and clear denominators to obtain an integral equationThe two-isogeny formula giveswith $\varphi :E\to E^{\prime }$ and its dual $\hat{\varphi }:E^{\prime }\to E$. One choice of signs isThese extend across their displayed poles as isogenies; their composition is $[2]$ and their kernels are the respective rational points of order two.

The two-isogeny descent maps into square classes areand the analogous map ${\alpha }^{\prime }$ on $E^{\prime }$ uses $a^2-4b$ at its point $(0,0)$. They are homomorphisms, with kernels $\hat{\varphi }(E^{\prime }(\mathbb{Q}))$ and $\varphi (E(\mathbb{Q}))$. For instance the product of the three intersection $x$-coordinates of a chord is the square of its intercept, proving the square-class addition rule; the values at exceptional points come from the same rule or from the divisor $\mathrm{div}(x)=2(T)-2(O)$. This also identifies the maps as the Kummer maps for the two isogenies.

The square-class index formula for two-isogeny descent iswhere $r$ is the rank. To see the torsion correction explicitly, put $T^{\prime }=(0,0)$ on $E^{\prime }$. Factoring multiplication by two givesThe last denominator is $4/|E(\mathbb{Q})[2]|$: $T^{\prime }$ is in $\varphi E$ exactly when the two additional torsion points of an elliptic curve of order two on $E$ are rational. Since $[E:2E]=2^r|E(\mathbb{Q})[2]|$, cancellation gives the formula in both the single and full rational two-torsion cases.

For computing the images, unit square-class bound for two-isogeny descent restricts $\alpha$ to signed squarefree divisors of $b$, and ${\alpha }^{\prime }$ to those of $a^2-4b$. To justify the prime support, negative valuations of a rational $x$-coordinate are even; at a prime not dividing $b$, a positive valuation of $x$ makes $x^2+ax+b$ a unit, so the equation again forces the valuation to be even. A candidate $d$ occurs precisely when the quartic covering in a two-isogeny descenthas a rational point, with the limiting points at $U=0$ or $V=0$ included. Clearing denominators gives integers with $\gcd (U,V)=1$. For $UV\ne 0$, the associated point is $x=d(U/V{)}^2$, $y=dUN/V^3$. Test these finitely many coverings over $\mathbb{R}$ and over relevant ${\mathbb{Q}}_q$ to eliminate impossible classes; surviving locally soluble classes give an upper bound. Finding rational points on them proves membership and often makes the bound exact. Local solubility alone need not prove global solubility, so one must retain the possible Selmer obstruction.

For the illustration takewith $p\equiv 3(\mathrm{mod}8)$. On $E_p$ all possible square classes are $1,-1,p,-p$. They all occur: $O$ supplies $1$ and the three points with $y=0$, at $x=0,p,-p$, supply $-1,p,-p$. Hence $|\alpha (E_p)|=4$.

On $E_p^{\prime }$, a nonzero real point has $X>0$, because $X(X^2+4p^2)=Y^2$. Thus only $d=1,2,p,2p$ need be considered, and $d=1$ occurs already at $O$. The other three classes are excluded as follows.

For $d=p$, the covering is $N^2=p(U^4+4V^4)$. Reducing modulo $p$ forces $p\mid N$ and $U^4+4V^4\equiv 0$. If $V$ were divisible by $p$, then $U$ would be too, contradicting primitivity. Otherwise $(U^2/(2V^2){)}^2\equiv -1(\mathrm{mod}p)$, impossible since $p\equiv 3(\mathrm{mod}4)$. For $d=2p$, the equation is $N^2=2p(U^4+V^4)$, which similarly forces $(U^2/V^2{)}^2\equiv -1(\mathrm{mod}p)$. Thus neither class occurs. These are odd-prime obstructions for the congruent-number isogeny coverings.

For $d=2$, the equation is $N^2=2(U^4+p^2{V}^4)$. If exactly one of $U,V$ is odd, its right side is $2(\mathrm{mod}8)$, not a square. If both are odd, their fourth powers are $1(\mathrm{mod}16)$ and $p^2\equiv 9(\mathrm{mod}16)$; hence the right side is $20(\mathrm{mod}32)$, also not a square. Both even is forbidden by primitivity. This is the modulo-thirty-two obstruction for a congruent-number descent class. Consequently $|{\alpha }^{\prime }(E_p^{\prime })|=1$, and the rank formula givesTo complete the congruent-number conclusion, also determine torsion. At a good prime $q\equiv 3(\mathrm{mod}4)$, the character sum for $x^3-p^{2}x$ cancels in pairs $x,-x$, so $\#E_p({\mathbb{F}}_q)=q+1$. Rational torsion injects into good reduction at every odd prime, by the formal kernel, which is a torsion-free group. If $p\ne 3$, use $q=3,7$ to bound its order by $\gcd (4,8)=4$. If $p=3$, use $q=7,11$, giving $\gcd (8,12)=4$. The three rational points of order two already give four points, so $E_p(\mathbb{Q})\cong (\mathbb{Z}/2\mathbb{Z}{)}^2$. This is rational torsion of a congruent number curve in the present cases.

A congruent number is the positive area of a right triangle with rational side lengths. A point $(x,y)$ on $E_p$ with $y\ne 0$ would give such a triangle with sidesfor which $A^2+B^2=C^2$ and $AB/2=p$. Conversely a rational right triangle of area $p$ gives a point with nonzero $y$, for example $x=p(C+A)/B$, $y=2p^2(C+A)/B^2$. But every rational point on the curve just determined is $O$ or has $y=0$. Every prime $p\equiv 3(\mathrm{mod}8)$ is therefore not a congruent number.