Past exam of the mathematics course of the University of Cambridge / 2017 / iii / Paper 125 (Elliptic Curves)

For a nonzero isogeny of elliptic curves $\varphi :E_1\to E_2$, its degree of an isogeny is the degree of the induced extension of function fields. Since $\varphi$ commutes with negation, its first coordinate is a rational function of $x_1$ alone. Write it in lowest terms asThe coordinate maps $x_i:E_i\to {\mathbb{P}}^1$ are finite morphisms of degree two. Multiplying function field degrees in the commutative diagram $x_2\circ \varphi =R\circ x_1$ gives the degree of an isogeny from its x-coordinate map:This is the total degree, so the argument also covers an inseparable isogeny of elliptic curves. Counting distinct points in the kernel of an isogeny would give only its separable degree. The zero group homomorphism is assigned degree zero separately.

On a Short Weierstrass form $y^2=x^3+ax+b$ in characteristic of a field other than two, the elliptic-curve addition formula givesThere is no cancellation: at a root $r$ of $f(x)=x^3+ax+b$, the numerator equals $f^{\prime }(r{)}^2$, which is nonzero because the elliptic-curve discriminant is nonzero. The numerator has degree four and the denominator degree three. HenceFor completeness, the same answer holds in characteristic two, where the displayed short equation is not a nonsingular model. On a general Weierstrass equation of an elliptic curve usewhere $b_2=a_1^2+4a_2$, $b_4=a_1{a}_3+2a_4$, $b_6=a_3^2+4a_6$, and $b_8=a_1^2{a}_6+4a_2{a}_6-a_1{a}_3{a}_4+a_2{a}_3^2-a_4^2$. The resultant of this numerator and denominator is ${\Delta }^2$. Their resultant is therefore nonzero in every nonsingular case; even when the denominator drops degree, the numerator retains degree four.

Work first where all three coordinates are finite and the joining line is not vertical. By the chord-and-tangent group law, the third intersection of $y=\lambda x+\mu$ with the elliptic curve is $-(P_1+P_2)$, whose first coordinate is also $x_3$. Substitution gives the monic polynomialIts roots are $x_1,x_2,x_3$, counted with intersection multiplicity. Comparing its coefficients with the elementary symmetric polynomials provesThis symmetric-coordinate identity for elliptic-curve addition is an identity of rational functions. It includes tangent cases by specialization. Literally assigning finite $s_i$ when a point is $O$ would be meaningless; such cases must be interpreted on the projective curve. A nonsingular equation in the printed short form has characteristic different from two.

Here is how the identity yields the quadratic form for the degree of an isogeny. With $u=x(P)$, $v=x(Q)$, write $s=u+v$ and $q=uv$. As an equation for $t=x(P+Q)$, it becomesBoth $x(P+Q)$ and $x(P-Q)$ satisfy it, because replacing $Q$ by $-Q$ does not change $v$. Thus its two branches are the sum and difference maps. Their common denominator is the square of $u-v$. The following divisor on an algebraic curve calculation keeps track of cancellations and exceptional points rigorously, instead of assuming degrees of displayed numerators always add.

On $E_2\times E_2$, equality of the two first coordinates means $Q=P$ or $Q=-P$. Each coordinate has a double pole at $O$. Consequently the principal divisor identity iswhere $D_{+}$ is the diagonal and $D_{-}$ is the graph of negation. Equivalently, the two zero divisors are the inverse images of $O$ under difference and sum, exactly the two branches identified above. Their generic multiplicities are one; the divisor identity also accounts for their intersections at 2-torsion points.

For nonzero isogenies of elliptic curves $\varphi ,\psi :E_1\to E_2$ with $\varphi \ne \pm \psi$, pull this identity back by $(\varphi ,\psi )$. Taking degrees of the resulting principal divisor on $E_1$ gives the divisor proof of the degree parallelogram law:If one map is zero, this is immediate. If $\varphi =\pm \psi$, it follows from $\mathrm{deg}([2]\circ \varphi )=4\mathrm{deg}\varphi$. This also proves the parallelogram law for a general Weierstrass equation of an elliptic curve in characteristic two: the same divisor identity uses the quotient by negation, even though the particular symmetric-coordinate formula above is unavailable.

Put $q(\varphi )=\mathrm{deg}\varphi$ and $q(0)=0$. Applying the parallelogram law to $n\varphi ,\varphi$ gives the recurrence $q((n+1)\varphi )+q((n-1)\varphi )=2q(n\varphi )+2q(\varphi )$, and hence $q(n\varphi )=n^{2}q(\varphi )$ for every integer $n$. Its polarization $B(\varphi ,\psi )=q(\varphi +\psi )-q(\varphi )-q(\psi )$ is symmetric and integer-valued. For fixed $\psi$, the parallelogram law makes $B(\cdot ,\psi )$ odd and gives $B(x+y,\psi )+B(x-y,\psi )=2B(x,\psi )$. Interchanging $x,y$ and adding proves additivity, since integers have no two-torsion. Thus $B$ has bilinearity, and $q$ is a positive quadratic form on $\mathrm{Hom}(E_1,E_2)$, with $q(\varphi )>0$ whenever $\varphi \ne 0$.

Let $\pi$ be the Frobenius isogeny and let $a=p+1-N$ be its Trace of Frobenius. Its characteristic equation is ${\pi }^2-[a]\pi +[p]=0$, so the trace of the square of an elliptic-curve endomorphism is $a^2-2p$. The elliptic-curve point count over a finite field therefore givesThe prime-square point-count formula is consequentlyOne can also obtain it directly from the degree of an isogeny: the maps $1-\pi$ and $1+\pi$ are separable isogenies, with degrees $p+1-a$ and $p+1+a$. Their composition is $1-{\pi }^2$, whose kernel of an isogeny is exactly $E({\mathbb{F}}_{p^2})$. Multiplicativity of degree gives the same product.

An elliptic curve has good reduction over $K$ if it admits an integral Weierstrass equation of an elliptic curve with unit elliptic-curve discriminant. Equivalently, the reduction of its Minimal Weierstrass equation is a nonsingular cubic over the residue field $k$. Its smooth integral projective model is a group scheme with the point $O$ as identity.

Choose homogeneous coordinates in the valuation ring ${\mathcal{O}}_K$ with at least one coordinate a unit, and reduce them modulo its maximal ideal ${\mathfrak{m}}_K$. This defines $\mathrm{red}:E(K)\to \tilde{E}(k)$. The chord-and-tangent group law extends over the smooth integral model, so reduction is a group homomorphism. For any point of $\tilde{E}(k)$, choose an affine projective chart containing it. Smoothness means some partial derivative of its equation is nonzero in $k$. Lift the other coordinate arbitrarily and apply the Hensel lemma to the coordinate with unit derivative. This constructs a point of $E(K)$ above the prescribed point, proving the surjectivity of good reduction over a local field.

The kernel of reduction of an elliptic curve consists precisely of points reducing to $O$. The parameter $t=-x/y$ at $O$ gives a bijection between this kernel and ${\mathfrak{m}}_K$: the integral formal-coordinate series solve the equation uniquely near $O$. Addition in these coordinates is the formal group of an elliptic curve, not ordinary addition in ${\mathfrak{m}}_K$. ThusHere the group operation on the last expression is its formal group law.

In this setting a formal group law means a one-dimensional commutative series $F(X,Y)\in {\mathcal{O}}_K[[X,Y]]$ withThese identities force $F(X,Y)=X+Y+$ terms of total degree at least two. There is a unique formal inverse $i_F(T)=-T+O(T^2)$ with $F(T,i_F(T))=0$.

A morphism to another formal group law $G$ is a series $h(T)=cT+O(T^2)$ satisfying $h(F(X,Y))=G(h(X),h(Y))$. The invertible morphism criterion for formal group laws isNecessity follows by comparing linear coefficients in $h^{-1}\circ h=T$. For sufficiency, solve recursively for a compositional inverse $j(T)=c^{-1}T+\cdots$: at every stage the new coefficient is obtained by dividing by the unit $c$, so all coefficients stay in ${\mathcal{O}}_K$. Applying $j$ to the morphism identity shows that $j$ is itself a group homomorphism of formal group laws.

In particular, the multiplication series satisfies $[n{]}_F(T)=nT+O(T^2)$. Since $p\nmid n$, the multiplication isomorphism of a formal group law makes $[n{]}_F$ invertible over ${\mathcal{O}}_K$. Its series and inverse converge on ${\mathfrak{m}}_K$, so multiplication by $n$ is bijective on $E_1(K)$, and on $E_1(L)$ for every finite extension $L/K$.

Let $K^{\mathrm{ur}}$ be the maximal unramified extension of $K$, with residue field $\overline{k}$. First show that every geometric solution of $nQ=P$ lies in $E(K^{\mathrm{ur}})$.

The multiplication-by-n morphism on the reduced elliptic curve is surjective over $\overline{k}$. Choose $\overline{Q}$ with $n\overline{Q}=\overline{P}$, defined over some finite finite field extension $k^{\prime }/k$. Let $L/K$ be the corresponding finite unramified extension. By the surjectivity of good reduction over a local field, lift $\overline{Q}$ to $Q_0\in E(L)$. Then $P-n{Q}_0\in E_1(L)$. The multiplication isomorphism of a formal group law gives a unique $R\in E_1(L)$ with $nR=P-n{Q}_0$, so $Q_0+R$ is an $n$-division point of $P$ defined over $L$.

Taking $P=O$ gives every element of $E[n]$ over $K^{\mathrm{ur}}$: reduction is injective on this torsion point of an elliptic curve group because $[n]$ is injective on the formal kernel, and each reduced $n$-torsion point has the unique corrected lift just constructed. Every other division point differs from one lift by an element of $E[n]$. Hence the entire field $K([n{]}^{-1}P)$ is unramified, not merely a field containing one choice of $Q$.

To bound the composite uniformly in $P$, put $f=[K(E[n]):K]$. This division field of an elliptic curve is unramified. The Galois group of $K^{\mathrm{ur}}/K$ is procyclic, generated topologically by its Frobenius element $\sigma$, and ${\sigma }^f$ fixes every element of $E[n]$. If $nQ=P\in E(K)$, thenIteration gives ${\sigma }^{jf}Q=Q+jT$. In particular ${\sigma }^{nf}Q=Q$. Thus every such $Q$, for every $P$ together, lies in the unique unramified extension of degree $nf$. If $M$ is the composite of all these fields, the uniform unramified division field over a local field givesThe prime-to-$p$ hypothesis is essential to the inverse-series argument; no assertion about arbitrary $p$-division is being made.

For $p\nmid 2k$, the displayed integral equation has nonzero elliptic-curve discriminant modulo $p$, so it has good reduction. Let $\chi$ be the Legendre symbol, with $\chi (0)=0$. Counting the two, one, or zero possible ordinates over each $x$ givesIf $p\equiv 3(\mathrm{mod}4)$, then $\chi (-1)=-1$ and the terms for $x$ and $-x$ cancel. The term at zero vanishes. Thus the count is $p+1$.

For the converse, suppose $p\equiv 1(\mathrm{mod}4)$, and put $h=(p-1)/2$. The Euler criterion and the sum of powers over a finite field show that the Trace of Frobenius satisfiesIndeed, among the positive exponents in this polynomial, of degree $3(p-1)/2<2(p-1)$, only $p-1$ has a nonzero sum over ${\mathbb{F}}_p$, and that sum is $-1$. Since $(x^3+kx{)}^h=x^h(x^2+k{)}^h$, the coefficient formula for trace of Frobenius modulo p yieldsNeither $k$ nor the binomial coefficient vanishes modulo $p$. Hence $a_p\ne 0$, proving the point-count criterion for y squared equals x cubed plus k x:

We use the following formal logarithm fact, also useful for the next part. For a formal group law over ${\mathbb{Z}}_p$, its logarithm has coefficients $c_j/j$ with $c_j\in {\mathbb{Z}}_p$, obtained by integrating its integral invariant differential. If $p$ is odd and $t\in p{\mathbb{Z}}_p\setminus \{0\}$, every term of degree $j\ge 2$ has valuation strictly greater than $v_p(t)$, since $j{v}_p(t)-v_p(j)>v_p(t)$. Thus the logarithm converges and is nonzero at $t$. Its homomorphism into the additive characteristic-zero group proves torsion-freeness of the formal group over Qp for odd p. Consequently reduction injects the entire rational torsion subgroup at any odd prime of good reduction, including its $p$-primary torsion. In particular the torsion subgroup is finite, and its order divides $p+1$ at every good $p\equiv 3(\mathrm{mod}4)$.

By the Dirichlet theorem on primes in arithmetic progressions, choose a good prime $p\equiv 3(\mathrm{mod}8)$. Then $v_2(p+1)=2$, bounding the two-primary part by four. For any odd prime $\ell$ dividing the torsion order, the Chinese remainder theorem and the Dirichlet theorem on primes in arithmetic progressions give a good prime $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$, avoiding the finitely many primes dividing $2k$. But then $\ell \nmid p+1$, a contradiction. Therefore

The order four does occur. For $k=4$, the elliptic-curve addition formula gives $2(2,4)=(0,0)$, so $(2,4)$ has order four. More precisely, the only nonzero rational 2-torsion point when $k>0$ is $(0,0)$, so order four means a cyclic group with a rational half of this point. The duplication formula isSuch a half must have $x(P{)}^2=k$. Writing $k=s^2$, positivity of $y(P{)}^2=2kx(P)$ forces $x(P)=s>0$. Then $y(P{)}^2=2s^3$, so $2s$ is a rational square, equivalently $s=2t^2$ for an integer $t\ge 1$. Conversely $(2t^2,4t^3)$ is a half of $(0,0)$ when $k=4t^4$. The rational torsion on y squared equals x cubed plus positive k x is therefore cyclic of order four exactly for these $k$, and otherwise cyclic of order two.

For this integral Weierstrass equation of an elliptic curve, computeIf an odd prime divides $m$ or $m^2-1$, then $c_4$ is a unit there and $\Delta$ is not. The j-invariant of an elliptic curve consequently has negative valuation. Since good reduction implies an integral j-invariant, such a prime cannot be a prime of good reduction, regardless of whether the displayed equation is minimal. Conversely, if it divides neither factor, this equation already has unit discriminant.

At five the good possibilities have $m\equiv \pm 2$, so $m^2\equiv 4$. At seven they have $m^2\equiv 2$ or $4$. Direct elliptic-curve point count over a finite field gives the following nonzero ordinates, together with the three zero-ordinate points and $O$:At either prime, torsion-freeness of the formal group over Qp for odd p makes reduction injective on all of $E(\mathbb{Q}{)}_{\mathrm{tors}}$, so its order is at most eight. Using only prime-to-$p$ injectivity here would leave an unjustified possible $p$-primary component.

All three nonzero 2-torsion points $(0,0),(-1,0),(-m^2,0)$ are rational. The rational point $P=(m,m(m+1))$ lies on the curve, since $m(m+1)(m+m^2)=m^2(m+1{)}^2$. For an equation $y^2=x(x^2+ax+b)$ the elliptic-curve addition formula givesHere $a=1+m^2$, $b=m^2$, so $2P=(0,0)$ and $P$ has order four. The point $(-1,0)$ is not in $⟨P⟩$, whose only nonzero point of order two is $(0,0)$. Therefore $P$ and $(-1,0)$ generate a subgroup of order eight isomorphic to $\mathbb{Z}/4\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$. The upper bound proves the rational torsion in the family x times x plus one times x plus m squared:

Galois cohomology and the finite division quotient. Let $K$ be a number field, $G_K=\mathrm{Gal}(\overline{K}/K)$ with its profinite topology, and $M$ a discrete continuous $G_K$-module. Its Galois cohomology is continuous group cohomology. In degrees zero and one,Thus a crossed homomorphism measures the failure of a choice to be Galois-invariant, and changing the choice changes the cocycle by a coboundary. A short exact sequence of such modules gives a long exact sequence in group cohomology. The connecting map sends an invariant element to the cocycle obtained by lifting it and comparing its Galois translates.

For an elliptic curve $E/K$ and $n\ge 2$, multiplication by $n$ is surjective on $E(\overline{K})$ and has kernel $E[n]$. The Kummer exact sequence of an elliptic curve therefore givesExplicitly, choose $nQ=P$ and set $\kappa (P)(\sigma )=\sigma Q-Q$. Replacing $Q$ changes this by a coboundary; replacing $P$ by $P+nR$, $R\in E(K)$, does not change it. If its class is zero, some torsion translate of $Q$ is Galois-invariant, so $P\in nE(K)$. This proves injectivity of the Kummer map of an elliptic curve.

The whole group $H^1(K,E[n])$ need not be finite. The crucial restriction is ramification. Let $S$ contain the finite primes of bad reduction of an elliptic curve and those dividing $n$. At $v\notin S$, good reduction and prime-to-residue-characteristic multiplication imply that every division point of a local point is in an unramified extension, by the formal-group lifting argument. Thus every global Kummer class restricts trivially to inertia there.

Choose a finite Galois extension $L/K$ containing $E[n]$ and the $n$th roots of unity, and enlarge $S$ to include its ramified primes. Over $L$, the torsion module is constant and can be identified with ${\mu }_n^2$. By Kummer theory,For classes unramified outside the primes $S_L$ above $S$, valuations outside $S_L$ must be divisible by $n$. Their restriction images therefore lie in $L(S_L,n{)}^2$, the square of an S-unramified power class group. Its finiteness can be seen without assuming the Mordell-Weil theorem: the finiteness of S-unramified Kummer classes follows fromThe S-unit group is finitely generated by the Dirichlet unit theorem and its valuations at $S_L$. The localized ideal class group is a quotient of the ordinary ideal class group of $L$, which is finite by the finiteness of the ideal class group. The Minkowski bound for ideal classes supplies an integral ideal of bounded norm in each class, and only finitely many integral ideals have bounded norm.

The kernel of restriction from $H^1(K,E[n])$ to $H^1(L,E[n])$ is also finite: a cocycle trivial after restriction can, after subtracting a coboundary, be made to factor through the finite group $\mathrm{Gal}(L/K)$. There are only finitely many maps from that group to the finite module $E[n]$. This is the finite-extension kernel of a Kummer map mechanism. Consequently the possible Kummer classes form a finite set, provingThis is the Weak Mordell-Weil theorem. Imposing membership in the local Kummer image at every place refines the finite unramified collection to the n-Selmer group. Its relation with the obstruction to a globally rational point iswhere the last group is the $n$-torsion of the Tate–Shafarevich group. Thus local solubility gives a finite computable upper bound but can leave a genuine global obstruction.

Heights and finite generation. For the other essay, normalize the absolute values on a field $K$ so that the product formula holds. The Absolute logarithmic Weil height of $[x_0:x_1]\in {\mathbb{P}}^1(K)$ isAt the infinite places the local degrees are one or two and the usual real or complex modulus is used. The product formula makes this independent of scaling; it is also unchanged by extending $K$. Over $\mathbb{Q}$, using coprime integral coordinates gives $h([u:v])=\log \max (|u|,|v|)$, the naive height on the projective line. The Northcott theorem says that points of bounded height and bounded field degree form a finite set; in particular this holds over the fixed field $K$. One way to see the finiteness is the height-Mahler measure formula: for an algebraic number of degree $d$, the coefficients of its primitive minimal integer polynomial are bounded by binomial factors times $\exp (dh)$. Bounds on $d$ and $h$ therefore leave only finitely many integer polynomials and hence only finitely many algebraic numbers.

Set $h_E(P)=h(x(P))$ for $P\ne O$, and $h_E(O)=0$. Since $x:E\to {\mathbb{P}}^1$ has degree two, bounded $h_E$ gives only finitely many points of $E(K)$. The height growth under a morphism of the projective line states that a degree-$d$ morphism gives $h(f(t))=dh(t)+O(1)$. The upper bound follows from its homogeneous coordinate polynomials; the lower bound follows from their having no common zero, using a resultant identity at each place. Applied to the degree-four duplication map, it gives a uniform constant $C$ withConsequently $4^{-j}{h}_E(2^{j}P)$ is Cauchy: the absolute difference of consecutive terms is at most $C{4}^{-(j+1)}$. Define the canonical height of an elliptic curve byIt is nonnegative and satisfies $\hat{h}(2P)=4\hat{h}(P)$. The factor one-half is the conventional normalization for the divisor $(O)$, since the first-coordinate height belongs to $2(O)$.

The addition-divisor identity also gives the bounded-error height identityuniformly in $P,Q$. This is the height form of the identity for the sum and difference pullbacks of the line bundle associated to $2(O)$; it includes points where the affine addition formulas have a zero denominator. Apply it to $2^{j}P,2^{j}Q$, divide by $2\cdot 4^j$, and take the limit. Thus $\hat{h}$ satisfies the parallelogram law, and its polarization is a bilinear form, the height pairing. Nonnegativity implies the Cauchy-Schwarz inequality for that pairing, by evaluating its nonnegative quadratic polynomial on $mP+nQ$ for all integers $m,n$ and approximating real ratios by rational numbers. In particularThese properties do not presuppose finite generation. Bounded canonical height gives a finite set by the bounded difference and the Northcott theorem. Torsion points have canonical height zero. Conversely, if $\hat{h}(P)=0$, all $2^{j}P$ have bounded naive height, so two coincide; their difference makes $P$ torsion. Thus the height detects precisely the free part, once finite generation is proved.

Use the Weak Mordell-Weil theorem with $n=2$ and choose finitely many coset representatives $R_i$. Write $P=2Q+R_i$, and put $H={\max }_i\hat{h}(R_i)$. The height inequality yieldsIteration enters the finite set $\{P:\hat{h}(P)\le H+1\}$, since after $j$ steps the height is at most $H+2^{-j}\max (\hat{h}(P)-H,0)$. Unwinding $P=2Q+R_i$ expresses every point using that finite set and the $R_i$. This proves the canonical-height proof of Mordell-Weil finite generation and henceThe Fundamental theorem of finitely generated abelian groups supplies this decomposition. The Mordell-Weil theorem combines a finite quotient from arithmetic Galois cohomology with a contracting height descent; either ingredient alone would not establish finite generation.

Translate the rational 2-torsion point to $(0,0)$ and clear denominators to obtain the integral Weierstrass equation of an elliptic curve. Nonsingularity requires $b\ne 0$ and $b^{\prime }=a^2-4b\ne 0$. The two-isogeny descent usesand its dual isogenyThese formulas extend across their missing affine points as degree-two isogenies of elliptic curves, with kernels $\{O,(0,0)\}$ on their respective curves; substitution gives $\psi \varphi =[2]$ and $\varphi \psi =[2]$.

Define homomorphisms to the square-class group of a field ${\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^2$ byFor ordinary intersections with a line, the product of the three first coordinates is the square of its intercept, proving the homomorphism identity; tangent cases use the same product with multiplicities. For $T=(0,0)$, direct addition gives $x(P+T)=b/x(P)$, so $\alpha (P+T)=[b]\alpha (P)$. Also $\alpha (P)\alpha (-P)=1$ and $\alpha (T{)}^2=1$, which handle inverse points and $T+T=O$. These verify the exceptional values as well. Their kernels are $\psi E^{\prime }(\mathbb{Q})$ and $\varphi E(\mathbb{Q})$. One can check the first assertion directly: if $x=s^2\ne 0$, solving for the first coordinate of a preimage under $\psi$ giveswith rational corresponding ordinate. Conversely, on $E^{\prime }$ one has ${\psi }_x=Y^2/(4X^2)$, a square. The exceptional point $(0,0)$ has a rational preimage exactly when $b$ is a square. The other kernel assertion follows identically, since the double companion curve is isomorphic to $E$ by scaling its coordinates by four and eight.

We now justify the rank factor in the square-class index formula for two-isogeny descent, rather than forgetting a torsion correction. Put $A=E(\mathbb{Q})$, $B=E^{\prime }(\mathbb{Q})$, andThe preimage of $\psi \varphi A$ under $\psi$ is $\varphi A+\ker \psi$, soThe Mordell-Weil theorem gives $[A:2A]=2^r\#A[2]$, where $r$ is the rank of an abelian group of $A$. If $b^{\prime }$ is a square, $\#A[2]=4$ and $(0,0)\in \varphi A$, so $\delta =1$. If it is not a square, $\#A[2]=2$ and $\delta =2$. Hence $\delta \#A[2]=4$ in both cases, and

To bound these two images, let $\ell \nmid b$ and take a point with $x\ne 0$. If $v_{\ell }(x)>0$, then $x^2+ax+b$ is a unit, so $2v_{\ell }(y)=v_{\ell }(x)$ is even. If $v_{\ell }(x)<0$, the leading term $x^3$ uniquely has least valuation in the equation, so $2v_{\ell }(y)=3v_{\ell }(x)$ and again $v_{\ell }(x)$ is even. Thus every image class has a signed square-free integer representative supported on the prime divisors of $b$. The exceptional class $[b]$ also has that property. There are at most $2^{\nu (b)+1}$ such classes. Applying the same reasoning to $E^{\prime }$ gives $\#{\alpha }^{\prime }(B)\le 2^{\nu (b^{\prime })+1}$. The prime-support bound in two-isogeny descent is thereforeHere $\nu$ counts the distinct prime divisors of the absolute value of a nonzero integer; $\nu (1)=\nu (-1)=0$. The nonsingularity hypotheses exclude the otherwise undefined case $\nu (0)$.

For the unheaded practical procedure, enumerate signed square-free divisors $d$ of $b$, and of $b^{\prime }$ on the companion curve. A class $d$ is represented by a point of $E$ exactly when its quartic covering in a two-isogeny descenthas a rational solution with $(U,V)\ne (0,0)$. For $UV\ne 0$, reconstruct $x=d{U}^2/V^2$, $y=dUW/V^3$; substitution verifies the equivalence. Solutions with $V=0$ or $U=0$ account for the identity class or the class of $(0,0)$ respectively. Clearing denominators allows integral $U,V,W$ with $\gcd (U,V)=1$.

Test these finitely many coverings over the real numbers and local fields, especially at two and the primes dividing $b{b}^{\prime }$, to exclude impossible classes. Search the survivors for rational points, close the witnessed classes under multiplication, and use the index formula once both images are determined. Equivalently, local solubility gives a descent upper bound and independent rational points, certified for example by their canonical height of an elliptic curve pairing, give a lower bound. When the bounds coincide the rank is determined. This procedure often succeeds, but local solubility alone does not prove global solubility: a nonzero Tate–Shafarevich group can leave surviving coverings without rational points. In that case the computation gives a rigorous bound rather than a falsely certified exact rank.

Take the odd congruence class $p\equiv 3(\mathrm{mod}8)$. The congruent number elliptic curve in the standard scaled coordinates isThese are the two curves in two-isogeny descent. On $E_p$, the prime-support bound in two-isogeny descent restricts the first image to $\{1,-1,p,-p\}$. All four classes occur: the 2-torsion points give $\alpha ((0,0))=[-p^2]=[-1]$, $\alpha ((p,0))=[p]$, and $\alpha ((-p,0))=[-p]$. Thus $\#\alpha (E_p)=4$.

On $E_p^{\prime }$, the equation forces $x>0$ whenever $x\ne 0$. Its exceptional value is $[4p^2]=1$. The second image is therefore contained in $\{1,2,p,2p\}$. Use the quartic covering in a two-isogeny descent to exclude its three nontrivial candidates.

For $d=p$, a rational solution can be written with coprime integral $U,V$, and must satisfyThen $p\mid W$, so $U^4+(2V^2{)}^2\equiv 0(\mathrm{mod}p)$. Since $p\equiv 3(\mathrm{mod}4)$, $-1$ is not a quadratic residue; a sum of two squares is zero only if both are zero. This forces $p\mid U,V$, contradicting coprimality. For $d=2p$, the same reasoning applies to $W^2=2p(U^4+V^4)$ and again forces $p\mid U,V$.

For $d=2$, the equation isIt implies $W=2Z$, whence $2Z^2=U^4+p^2{V}^4$. Exactly one of $U,V$ odd is impossible by parity, while both even contradict coprimality. Thus both are odd. Since $p\equiv 3(\mathrm{mod}8)$ implies $p^2\equiv 9(\mathrm{mod}16)$, reduction modulo sixteen gives $2Z^2\equiv 1+9=10$. But the possible residues of $2Z^2$ modulo sixteen are $0,2,8$. This contradiction eliminates $d=2$. Consequently ${\alpha }^{\prime }(E_p^{\prime })=\{1\}$ and the square-class index formula for two-isogeny descent givesThe reduction argument for $y^2=x^3+kx$ used earlier bounds rational torsion by four for every nonzero integer $k$: its point-count cancellation at $q\equiv 3(\mathrm{mod}4)$ does not depend on the sign of $k$, and the same prime choices apply. Here $k=-p^2$ and all four 2-torsion points are rational. Hence $E_p(\mathbb{Q})$ consists exactly of $O,(0,0),(p,0),(-p,0)$.

To relate this calculation to congruent numbers, a rational point $(x,y)$ with $y\ne 0$ produces the right triangle with side lengthsThe identities $A^2+B^2=C^2$ and $AB/2=p$ follow from $y^2=x(x^2-p^2)$. Conversely, a positive rational right triangle of area $p$ with legs $A,B$ and hypotenuse $C$ givesDirect substitution uses $AB=2p$ and $C^2=A^2+B^2$. No such point exists here. This proves the noncongruent primes congruent to three modulo eight: