Past exam of the mathematics course of the University of Cambridge / 2014 / iii / Paper 22 (Elliptic Curves)

For the first algebraic curve, a hyperbola, use the line $y=1+tx$ through $(0,1)$. Substitution and cancellation of the known intersection give $x((1-t^2)x-2t)=0$. Thus a rational parametrization of an algebraic curve isThe identity $y^2-x^2=1$ follows immediately. Away from $(0,1)$ its inverse is $t=(y-1)/x$; the exceptional point is recovered at $t=0$. The other point with $x=0$, namely $(0,-1)$, corresponds to $t=\infty$, while $t=\pm 1$ gives the points at infinity on the projective closure. This explains the exceptional parameters rather than discarding them.

For the second algebraic curve, the rational parametrization of an algebraic curvehas inverse $t=y/x$ where $x\ne 0$, and $t=0$ gives the cusp. Indeed, if $x\ne 0$ and $y^2=x^3$, then $(y/x{)}^2=x$ and $(y/x{)}^3=y$. Both curves admit rational parametrizations, although the second has a singular point.

Here is an elementary polynomial pencil with four square members argument. Suppose first that $u,v$ are linearly dependent. Their coprimality of polynomials then forces both to be constant. Otherwise write the four distinct members as $L_j={\alpha }_{j}u+{\beta }_{j}v=s_j^2$. They are nonzero and pairwise coprime polynomials: a common nonconstant factor of two members would divide both $u$ and $v$.

Put $d=\max (\mathrm{deg}u,\mathrm{deg}v)>0$. At most one member of the pencil has degree of a polynomial smaller than $d$, since cancellation of its leading coefficient determines a unique projective pair. Choose a member $L_k$ of minimal degree $e$ and any independent member $L_l$ of degree $d$. The polynomialis nonzero: otherwise the rational function $L_k/L_l$ would have zero derivative, hence would be constant in characteristic zero. Its degree is at most $d+e-1$; if both members have degree zero the original $d>0$ assumption has already failed.

Replacing this pair by any other independent pair changes $W$ only by a nonzero scalar. Since $L_j=s_j^2$, each $s_j$ divides $W$. The pairwise coprimality of polynomials therefore gives ${\prod }_j{s}_j\mid W$. But three members have degree $d$, soa contradiction. Consequently $u$ and $v$ are constant. The possibility that a member is zero was already covered by linear dependence.

To apply this to an elliptic curve, complete the square in its Weierstrass equation of an elliptic curve and work over $\mathbb{C}$. Nonsingularity gives three distinct roots $e_1,e_2,e_3$, so the equation becomes $y^2={\prod }_{j=1}^3(x-e_j)$. A nonconstant rational parametrization of an algebraic curve would have $x=u/v$ with coprime polynomials. Clearing denominators givesThe four factors are pairwise coprime polynomials. A rational function whose square is a polynomial is itself a polynomial, by comparing numerator and denominator in lowest terms. Unique factorization, and the fact that every nonzero complex constant has a square root, make each of these four factors a square in $\mathbb{C}[t]$. They correspond to four distinct projective pairs. The result just proved forces $u,v$ to be constant, and the equation then forces $y$ to be constant as well. This proves the nonparametrizability of an elliptic curve.

Let $C$ be the projective cubic of a Weierstrass equation of an elliptic curve, allowing its elliptic-curve discriminant to vanish, and let $O=[0:1:0]$. Use only the smooth locus of a variety $C_{\mathrm{sm}}(K)$: the singular point, if present, is excluded. For $P,Q$, intersect their chord with $C$, using the tangent if $P=Q$ and counting intersection multiplicity. If the third intersection is $R$, define $P+Q=-R$, wherein general Weierstrass equation of an elliptic curve coordinates. The line through $R$ and $O$ gives this reflection. A vertical chord gives $P+(-P)=O$, and the tangent at $O$ meets $C$ three times at $O$, so $O$ is the identity. The construction is symmetric in $P,Q$. It stays in the nonsingular locus: a line through a singular point has intersection multiplicity at least two there, and therefore cannot also contain two smooth intersections counted with multiplicity.

For the nonsingular case, prove associativity by transporting a known abelian group law. The Abel-Jacobi map of a genus-one curveis bijective over an algebraic closure. Indeed, the Riemann-Roch theorem in genus one says that every divisor class of degree one has a unique effective representative consisting of one point: existence follows from $\ell (D)=1$, and uniqueness follows because two distinct representatives would produce a degree-one map to the projective line, impossible for a genus one curve. Subtracting $O$ gives the claimed bijection.

Any line section represents the same divisor class as $3O$, including tangencies. Thus $P+Q+R\sim 3O$ as divisors on an algebraic curve, while the vertical line gives $R+(-R)+O\sim 3O$. HenceAddition in the Picard group is associative, soThe chord-and-tangent group law is defined over $K$, so the group operation restricts to the $K$-rational points.

For completeness, a singular Weierstrass equation of an elliptic curve produces the smooth-locus group of a singular Weierstrass cubic, not an elliptic curve. Over an algebraic closure, its normalization of an algebraic curve is the projective line; deleting the two preimages of a nodal crossing gives the multiplicative algebraic group, while deleting the single preimage of a cusp gives the additive group. For example, on $y^2=x^3$, the coordinate $u=x/y$, with $u(O)=0$, makes the smooth-locus law addition. On $y^2=x^2(x+1)$ in characteristic different from two, put $t=y/x$ and $z=(t+1)/(t-1)$, with $z(O)=1$; the chord relation gives $z(P)z(Q)z(R)=1$, so the group law is multiplication of $z$. A nonsplit node gives the corresponding form of the multiplicative algebraic group over $K$. These descriptions also establish the singular-case group laws.

Let $\pi$ denote the Frobenius isogeny of an elliptic curve and write $N=\#E({\mathbb{F}}_q)$. Its degree of an isogeny is $q$. The isogeny of elliptic curves $1-\pi$ has differential equal to the identity because $d\pi =0$, so it is a separable isogeny. Its kernel consists precisely of the rational points fixed by $\pi$, giving

We use the degree parallelogram law for isogenies of elliptic curves, with degree zero assigned to the zero map:One explanation of the first identity is the divisor proof of the degree parallelogram law: on $E\times E$, the zero divisor of $x(P)-x(Q)$ is the sum of the diagonal and the graph of negation, while its pole divisor is twice each coordinate copy of $O$. Pulling the associated line bundle identity back by $(f,g)$ and taking degrees gives the identity, including exceptional cases by the line-bundle formulation. This works for a general Weierstrass equation of an elliptic curve, including characteristic two; $x$ is the quotient coordinate for negation. Polarization therefore makes degree a quadratic form on the endomorphism ring of an elliptic curve.

Set $a=q+1-N$, the Trace of Frobenius. The cross term is determined by $\mathrm{deg}(1-\pi )=1+q-a$, giving, for all integers $m,n$,If $a^2>4q$, the real degree-two polynomial $X^2-aX+q$ is negative on a nonempty open interval. That interval contains a rational $m/n$, contradicting the displayed nonnegativity after multiplication by $n^2$. Thus $a^2\le 4q$. Hasse's bounds areThe argument proves the Hasse theorem for elliptic curves without assuming its bound in advance.

The squares in the finite field ${\mathbb{F}}_7$ are $0,1,2,4$. For $x=0,1,\dots ,6$, the values of $x^3-x+1$ and the numbers of possible $y$ are respectivelyAdding $O$ yields $\#E({\mathbb{F}}_7)=12$. The Trace of Frobenius is $a=8-12=-4$. The trace of the square of an elliptic-curve endomorphism is $a^2-2q=16-14=2$, so the elliptic-curve point count over a finite field givesFor example, this trace identity follows from ${\pi }^2-[a]\pi +[q]=0$ and $\mathrm{tr}[q]=2q$.

One suitable second elliptic curve isHere $4\cdot 3^3+27\cdot 6^2\equiv 2(\mathrm{mod}7)$, so its elliptic-curve discriminant is nonzero. Its complete list of rational points is $O,(3,0),(6,3),(6,4)$, obtained by checking the seven $x$-values. For $P=(6,3)$ the tangent slope is $1$ in ${\mathbb{F}}_7$, and the elliptic-curve addition formula gives $2P=(3,0)$. Consequently $P$ has order four and $E^{\prime }({\mathbb{F}}_7)\cong \mathbb{Z}/4\mathbb{Z}$.

In this one-dimensional setting, a commutative formal group law over a commutative ring $R$ is a formal power series $F(X,Y)\in R[[X,Y]]$ withIn particular $F(X,Y)=X+Y+$ terms of total degree at least two. There is a unique formal inverse $i_F(T)=-T+O(T^2)$; coefficient recursion solves $F(T,i_F(T))=0$.

A morphism from formal group law $F$ to $G$ is $f(T)\in TR[[T]]$ satisfyingThe invertible morphism criterion for formal group laws isNecessity follows by differentiating $g\circ f=T$ at zero for an inverse $g$. Conversely, write $f(T)=a_{1}T+a_2{T}^2+\cdots$ with $a_1$ a unit. In constructing $g(T)=b_{1}T+b_2{T}^2+\cdots$, the coefficient of $T$ fixes $b_1=a_1^{-1}$; at degree $n$, the equation $f(g(T))=T$ has the form $a_1{b}_n+$ an already known expression $=0$. This determines every $b_n$ over $R$. The same construction gives an inverse on the other side, and uniqueness makes the two inverses agree. Finally apply $g$ to the morphism identity with $X=g(U),Y=g(V)$ to obtainThus the inverse is itself a morphism of formal group laws, not merely an inverse formal power series. Over a general ring, nonzero derivative is insufficient: it must be a unit.

We use two precise facts about the formal group of an elliptic curve. At a prime $p$ of good reduction, its kernel of reduction of an elliptic curve is identified by the uniformizer $t=-x/y$ with the group $\hat{E}(p{\mathbb{Z}}_p)$. For odd $p$ this group is torsion-free. To see the second fact, the integral invariant differential of a formal group law has the form $(1+{\sum }_{j\ge 1}{c}_j{T}^j)dT$, with $c_j\in {\mathbb{Z}}_p$. Integrating constructs the formal logarithmIt is a group homomorphism to the additive group. For $0\ne t\in p{\mathbb{Z}}_p$ and $j\ge 2$,when $p$ is odd. Hence the series converges and $v_p({\log }_F(t))=v_p(t)$, so it is injective. The target has no nonzero torsion. Therefore reduction is injective on the entire rational torsion subgroup at an odd prime of good reduction, including its $p$-primary part.

For the present elliptic curve, $\Delta =64D^6$, so every odd $p\nmid D$ is a prime of good reduction. If $p\equiv 3(\mathrm{mod}4)$, the Legendre symbol of $-1$ is $-1$. The values $x$ and $-x$ cancel in the sum of the Legendre symbols of $x^3-D^{2}x$, yieldingThe rational torsion subgroup injects into each of these groups, so it is finite and its order $M$ divides every such $p+1$.

For any odd prime $\ell$, the Dirichlet theorem on primes in arithmetic progressions supplies infinitely many $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$. Discard the finitely many dividing $D$. Since $\ell \nmid p+1$, it cannot divide $M$. Similarly choose $p\equiv 3(\mathrm{mod}8)$, again avoiding $D$; then $v_2(p+1)=2$, so $M\mid 4$.

There are already four rational 2-torsion points,which are distinct because a squarefree integer $D$ is nonzero. ThusIts order is four. In fact the argument works for every nonzero integer $D$; squarefreeness is not needed for this torsion conclusion.

Use the congruent number elliptic curve in the equivalent coordinatesThe rational point $P=(25,100)$ lies on it, since $25^3-225\cdot 25=10000$. By the preceding rational torsion of a congruent number curve result, every rational torsion point of an elliptic curve has $y=0$ or is $O$. Thus $P$ is not a torsion point of an elliptic curve, and its positive multiples give infinitely many distinct rational points with nonzero $y$.

For any such point $(x,y)$, putThe identity $(x^2-225{)}^2+(30x{)}^2=(x^2+225{)}^2$ proves that these positive rational numbers are the sides of a right triangle. Their area isAll three sides are nonzero because a point with $y\ne 0$ has $x\notin \{0,15,-15\}$. For $P$ the construction gives $(a,b,c)=(4,15/2,17/2)$.

It remains to ensure that infinitely many points do not describe only finitely many triangles. Given the ordered positive pair $b,c$, set $r=c/b$. Then $X=|x|$ satisfiesThere are at most two possible $X$, then at most two signs of $x$ and two signs of $y$. Thus each ordered triangle has at most eight preimages; allowing interchange of its legs still gives a finite number. There are infinitely many distinct rational right triangles of area $15$. This is the infinitely many rational right triangles from a nontorsion point principle.

A height function measures arithmetic size, which is what makes an otherwise infinite descent terminate. For a number field $K$, normalize absolute values to extend the standard real and $p$-adic ones, and write $n_v=[K_v:{\mathbb{Q}}_v]$. The logarithmic projective height isThe product formula makes it independent of the chosen homogeneous coordinates, and the local-degree normalization makes it independent of the number field containing them. Over $\mathbb{Q}$, $h([a:b])=\log \max (|a|,|b|)$ for coprime integer coordinates. Set $h_x(P)=h(x(P))$ on an elliptic curve, with $h_x(O)=0$.

Two features are essential. First, the Northcott theorem says that points of bounded projective height and bounded field degree form a finite set. For points on a fixed elliptic curve over $K$, each $x$-coordinate has at most two preimages, so bounded $h_x$ gives finitely many points. Second, a degree-$d$ morphism of the projective line satisfies $h(f(z))=dh(z)+O(1)$, uniformly in $z$. The upper bound comes from evaluating its homogeneous polynomials; for the lower bound, their lack of a common zero gives a resultant identity bounding the input coordinates by the output coordinates at each place. Summing the local bounds gives the asserted uniform constant.

The duplication map on the $x$-line has degree four. Nonsingularity ensures that its numerator and denominator have no common projective zero. ThereforeTelescoping defines the canonical height of an elliptic curveThe error in successive terms is bounded by a geometric series, proving convergence and the uniform bounded difference. It also gives $\hat{h}(2P)=4\hat{h}(P)$ and nonnegativity. The usual addition formula gives the approximate height parallelogram identity for $h_x$; equivalently, the unordered pair of sum and difference on the $x$-line has bidegree $(2,2)$. Applying that identity to $2^{j}P,2^{j}Q$ and passing to the limit givesIn particular $\hat{h}(nP)=n^2\hat{h}(P)$. Its polarization is the canonical height pairing, a positive semidefinite bilinear form even before finite generation has been proved. The Cauchy-Schwarz inequality for this pairing givesAlso $\hat{h}(P)=0$ precisely for torsion points of an elliptic curve: one direction follows from periodic multiples, and in the other direction all multiples have bounded $h_x$, so the Northcott theorem makes two multiples equal. Bounded canonical height of an elliptic curve likewise gives a finite set of $K$-rational points.

Now the Weak Mordell-Weil theorem gives finitely many representatives $R_1,\dots ,R_s$ for $E(K)/2E(K)$. Put $H={\max }_i\hat{h}(R_i)$. Write any point as $P=2Q+R_i$. ThenRepeatedly applying this height descent lemma eventually reaches height at most $H+1$: after $j$ steps the height is at most $H+2^{-j}(\hat{h}(P)-H)$. The set of points with height at most $H+1$ is finite. Reading the relations $P=2Q+R_i$ backwards shows that this finite set together with the $R_i$ generates $E(K)$. ConsequentlyHeights turn weak Mordell-Weil finiteness into the Mordell-Weil theorem. The canonical height pairing subsequently equips the free part with a positive definite quadratic form, useful for bounding searches and measuring independent generators; this interpretation is a consequence of the proof, not an assumption used in the descent.

Classical Kummer theory relates extraction of $n$th roots to Galois cohomology. In characteristic zero the exact sequenceand Hilbert theorem 90 identify $H^1(K,{\mu }_n)$ with $K^{\times }/K^{\times n}$. For an elliptic curve, the corresponding Kummer exact sequence of an elliptic curve isMultiplication by $n$ is surjective over the algebraic closure. If $nQ=P\in E(K)$, the cocycle $\sigma \mapsto \sigma Q-Q$ takes values in $E[n]$. Changing the choice of $Q$ changes it by a coboundary, and changing $P$ by an element of $nE(K)$ does not change its class. Conversely, a trivial cocycle class allows $Q$ to be adjusted by an $n$-torsion point to become $K$-rational. Thus the Kummer map of an elliptic curve is an injectionThis is the elliptic form of Kummer theory. The full cohomology group need not be finite; the arithmetic restriction on these classes is essential.

Choose a finite set $S$ of places containing the archimedean places, the primes over $n$, and all primes of bad reduction of an elliptic curve. At a finite place outside $S$, $E$ has good reduction and $n$ is a unit. A division point of the reduction of $P$ exists over the algebraic closure of the residue field. Smooth lifting gives a point over a finite unramified extension whose multiple differs from $P$ by an element of the kernel of reduction of an elliptic curve. In the formal group of an elliptic curve, $[n](T)=nT+O(T^2)$ is an isomorphism by the invertible morphism criterion for formal group laws, and its integral inverse converges on the maximal ideal. Correcting that difference produces a division point in the maximal unramified extension. Hence the Kummer map of an elliptic curve class is unramified outside $S$.

To prove finiteness explicitly, choose a finite Galois extension $L/K$ containing all $E[n]$ and all $n$th roots of unity, and enlarge $S$ to include its ramified places. A basis of $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$ identifies it over $L$ with ${\mu }_n^2$. Classical Kummer theory then identifiesThe restriction of every class in the image of $\delta$ belongs to $L(S_L,n{)}^2$, where the S-unramified power class group isIndeed an unramified local Kummer extension at residue characteristic prime to $n$ has valuation divisible by $n$: in an unramified field containing a root, $nv(a^{1/n})=v(a)$ with integral valuations.

The finiteness of S-unramified Kummer classes follows from the exact sequenceTo see the final map, write the ideal of $a$ away from $S_L$ as ${\mathfrak{a}}^n$ and take the ideal class of $\mathfrak{a}$. Its kernel is represented by an S-unit, after division by an $n$th power; conversely an $n$-torsion ideal class yields such an $a$. The S-unit group is finitely generated by the Dirichlet unit theorem together with the finitely many inverted primes. The ideal class group of the localized ring is a quotient of the finite ordinary ideal class group. Both outer groups are therefore finite.

Finally restriction has finite kernel: inflation-restriction puts it in the finite group $H^1(\mathrm{Gal}(L/K),E[n])$. Thus the image of $\delta$ has finite restriction image and finite kernel, andThis proves the weak Mordell-Weil theorem. Combining it with the height descent lemma proves the full Mordell-Weil theorem. Local restrictions at every place refine the finite group used here to the Selmer group of an elliptic curve, which is useful for explicit descent calculations.

Work in characteristic different from two, as in the number-field application below. Nonsingularity is equivalent to $b(a^2-4b)\ne 0$. The chord through $P=(x,y)$ and $T=(0,0)$ has slope $y/x$. Using $y^2/x^2=x+a+b/x$ in the elliptic-curve addition formula givesThese formulas hold for $P\ne O,T$; addition interchanges $O$ and $T$.

It follows that $\xi =x+a+b/x=y^2/x^2$ and $\eta =y(1-b/x^2)$. The relation isFor a direct verification, observe thatTherefore the two-isogeny formula isThe target elliptic curve is nonsingular because its corresponding coefficient product is $16b(a^2-4b)\ne 0$. The rational map of projective varieties extends over the exceptional points to a morphism of smooth projective algebraic curves; at both $O$ and $T$ its affine coordinates tend to infinity, giving the displayed values. A nonconstant morphism between elliptic curves sending $O$ to $O$ is a group homomorphism, so this is an isogeny of elliptic curves.

One can also see the quotient directly: translation by $T$ leaves $\xi ,\eta$ invariant. The equation $x^2+(a-\xi )x+b=0$ makes the source function field a degree-two extension of the target function field; its nontrivial automorphism is translation by $T$. Equivalently, the degree of an isogeny from its x-coordinate map is two. The kernel of an isogeny is precisely $\{O,T\}$. Thus $\varphi$ is a separable isogeny of degree two.

First compute the Mordell-Weil group rank by two-isogeny descent. HereThe two-isogeny formula gives $\varphi :E\to E^{\prime }$. If $u=1+i$, then $u^4=-4$, andis an isomorphism over $K$. Its $x$-coordinate multiplier $u^2$ is a square in $K$.

Use the two-torsion square-class homomorphismFor any prime ideal of the Gaussian integers, if $v(x)>0$, then $x^2+i$ is a unit and $2v(y)=v(x)$; if $v(x)<0$, the term $x^3$ has strictly smallest valuation and $2v(y)=3v(x)$. Hence every valuation of $x$ is even. Since the Gaussian integers form a principal ideal domain, dividing by a square leaves a unit. Their units are $\{1,-1,i,-i\}$, whose square classes are $\{1,i\}$ because $-1=i^2$ and $i$ is not a square in $K$. For the latter assertion, $(a+bi{)}^2=i$ with $a,b\in \mathbb{Q}$ would imply $a^2=b^2$ and $2ab=1$, hence $a^2=1/2$, impossible for rational $a$. ThusBoth classes occur, at $O$ and $T$. This is the unit square-class bound for two-isogeny descent.

Define ${\alpha }^{\prime }$ on $E^{\prime }$ similarly, with ${\alpha }^{\prime }((0,0))=[-4i]=[i]$. Since $\theta$ multiplies nonexceptional $x$-coordinates by a square, and preserves the exceptional classes as well, its image is also $\{1,[i]\}$. The standard kernel identities in two-isogeny descent areHere $\hat{\varphi }$ is the dual isogeny and $\hat{\varphi }\varphi =[2]$. These identities can be checked directly from the formulas: $x(\hat{\varphi }(X,Y))=(Y/(2X){)}^2$, and conversely a square $x$-coordinate lets the quadratic equation for a preimage be solved using the curve equation. For example, if $x=r^2\ne 0$, the equation for $X$ is $X^2-(4x+2a)X+(a^2-4b)=0$, whose discriminant is $16(x^2+ax+b)=16(y/r{)}^2$; the $Y$-coordinate then follows from the dual formula. The exceptional points satisfy the same completed square-class criterion.

The two-isogeny index formula over a number field keeps track of a small kernel factor:In this case $\ker \hat{\varphi }=\{O,T^{\prime }\}$, where $T^{\prime }=(0,0)$, and $T^{\prime }\notin \varphi E(K)$ because ${\alpha }^{\prime }(T^{\prime })=[i]\ne 1$. Thus $\delta =2$, and the index is $2\cdot 2/2=2$. There is only one nonzero rational 2-torsion point on $E$: the other two would require $x^2=-i$, and $-i$ has the same nonsquare class as $i$. The Mordell-Weil theorem now givesso $r=0$.

It remains to identify all torsion, rather than merely the rank. The elliptic-curve discriminant is $-64i^3$, so the primes $(3)$ and $(2-i)$ have good reduction, with residue characteristics three and five. By the supplied point-count information their reduction groups have orders that are powers of two. The reduction of torsion points on an elliptic curve is injective on prime-to-residue-characteristic torsion. Every odd-primary torsion subgroup therefore injects into a group of two-power order at at least one of these two primes, and must be zero. All torsion is two-primary.

Finally, if a point had order four, its double would be $T$. The elliptic-curve addition formula givesFor $2P=T$ the denominator is nonzero, so $x^2=i$, impossible in $K$. A point of higher two-power order would have a multiple of order four, so it too is excluded. Thus the only torsion points are $O,T$. Together with rank zero,