Past exam of the mathematics course of the University of Cambridge / 2021 / iii / Paper 125 (Elliptic Curves)

The Weierstrass equation of an elliptic curve over a field $K$ has the general formwith nonzero elliptic-curve discriminant. Admissible change of Weierstrass coordinates relates two such equations defining isomorphic pointed curves over $K$:where $u\in K^{\times }$ and $r,s,t\in K$.

If $\mathrm{char}K\ne 2,3$, completing the square and translating $x$ simplify every equation. Short Weierstrass form isTwo short equations are $K$-isomorphic precisely when, for some $u\in K^{\times }$,the isomorphism from the first curve to the second is $(x,y)\mapsto (u^{2}x,u^{3}y)$.

A twist of an elliptic curve $E/\mathbb{Q}$ is an elliptic curve that becomes isomorphic to $E$ over $\overline{\mathbb{Q}}$. WriteFor $d\in {\mathbb{Q}}^{\times }$, its quadratic twist may be writtenOver $\mathbb{Q}(\sqrt{d})$, the map $(x,y)\mapsto (d^{-1}x,d^{-3/2}y)$ identifies $E^d$ with $E$.

The hypothesis $j(E)\ne 0,1728$ impliesConsequently twists are classified bywhere the last identification is Kummer theory. In the explicit equations, $E^d{\simeq }_{\mathbb{Q}}{E}^e$ exactly when $d/e$ is a rational square. Every nonzero rational square class has a unique square-free integer representative, including its sign, so the twists are parametrized by the nonzero square-free integers.

If every point of $E[n]$ is rational, the Weil pairingand its nondegeneracy imply that every $n$th root of unity belongs to $\mathbb{Q}$. The only roots of unity in $\mathbb{Q}$ are $\pm 1$, so $n\le 2$. Since the question assumes $n\ge 2$, only $n=2$ is possible. It does occur: any nonsingular equationwith distinct $a,b,c\in \mathbb{Q}$ has all four points of $E[2]$ rational.

Mod-three Galois representation of an elliptic curve is the representationin this case. Twisting by the quadratic character ${\chi }_d$ replaces it by ${\chi }_d{\rho }_3$. Thus $E^d$ has a rational point of order three exactly when $E[3]$ contains a nonzero vector $v$ satisfyingfor every $\sigma \in G_{\mathbb{Q}}$: the line ${\mathbb{F}}_{3}v$ is a one-dimensional Galois subrepresentation with character ${\chi }_d$.

The two-dimensional representation $E[3]$ has at most two distinct one-dimensional characters among its Jordan–Hölder factors. Therefore at most two quadratic characters ${\chi }_d$, and hence at most two rational isomorphism classes of twists, can have a rational point of order three.

Write $K=\mathbb{Q}(\sqrt{d})$ and let $\sigma$ be its nontrivial automorphism. On the rational vector space $E(K)\otimes \mathbb{Q}$, the involution $\sigma$ gives the eigenspace decompositionThe positive eigenspace is $E(\mathbb{Q})\otimes \mathbb{Q}$. Choose the quadratic twist $E^{\prime }=E^d$ and an isomorphism $\iota :E^{\prime }\to E$ over $K$ for which ${\iota }^{\sigma }=-\iota$. It maps $E^{\prime }(\mathbb{Q})\otimes \mathbb{Q}$ isomorphically onto the negative eigenspace. Taking dimensions gives

A one-dimensional commutative formal group law over ${\mathcal{O}}_K$ is a power series $F(X,Y)\in {\mathcal{O}}_K[[X,Y]]$ satisfyingFor $r\ge 1$, the ideal ${\pi }^r{\mathcal{O}}_K$ becomes a group, denoted $F({\pi }^r{\mathcal{O}}_K)$, under $x{+}_{F}y=F(x,y)$; convergence follows because both inputs lie in the maximal ideal.

Over the characteristic-zero field $K$, there is a unique formal logarithmsatisfying ${\log }_F(F(X,Y))={\log }_F(X)+{\log }_F(Y)$. Its coefficients have bounded denominator growth, so for sufficiently large $r$ both ${\log }_F$ and its inverse formal group exponential converge on ${\pi }^r{\mathcal{O}}_K$ and preserve that ideal. They givewhere the final isomorphism is multiplication by ${\pi }^{-r}$.

The curve has good reduction at $2$ and $3$ because its discriminant $-53$ is a unit at both primes. Direct counting givesIndeed, at $p=2$ the affine solution counts for $x=0,1$ are $2,1$, and at $p=3$ the counts for $x=0,1,2$ are $2,2,2$; in each case one then adds the point at infinity.

For good reduction at $p$, the reduction of an elliptic curve gives a mapwhose kernel is its formal group of an elliptic curve, and the torsion in that kernel is $p$-primary. Hence the prime-to-$p$ part of any torsion subgroup injects into $\tilde{E}({\mathbb{F}}_p)$.

At $p=2$, the odd part of $E(\mathbb{Q}{)}_{\mathrm{tors}}$ must divide $4$, so it is trivial. The torsion group is therefore a $2$-group. At $p=3$, all of this group has order prime to $3$ and injects into a group of order $7$, so it too is trivial. Thus

Let $E_r({\mathbb{Q}}_2)$ be the $r$th term in the filtration of elliptic-curve points over a local field. Reduction givesof order four, whilehas order two. The formal logarithm is injective on $E_2({\mathbb{Q}}_2)$ and identifies it with an additive subgroup of ${\mathbb{Q}}_2$, so $E_2({\mathbb{Q}}_2)$ is torsion-free. A finite subgroup of $E({\mathbb{Q}}_2)$ therefore injects into $E({\mathbb{Q}}_2)/E_2({\mathbb{Q}}_2)$, whose order is $4\cdot 2=8$. Thus $|E({\mathbb{Q}}_2{)}_{\mathrm{tors}}|$ divides $8$.

The reduction of $P=(0,0)$ is a nonidentity point of the group $\tilde{E}({\mathbb{F}}_3)$ of prime order seven. Hence $7P$ reduces to the identity and lies in $E_1({\mathbb{Q}}_3)$. Part i shows that $P$ has infinite order, so $7P\ne O$. Every nonidentity point in $E_1({\mathbb{Q}}_3)$ has formal parameter $z=-x/y$ of positive valuation and thereforehas negative valuation. Thus $7P$ does not have integral coordinates.

Forthe chord-and-tangent group law gives, for distinct nonopposite points $P=(x_1,y_1)$ and $Q=(x_2,y_2)$,For doubling, replace the slope byThe point at infinity is the identity and $-(x,y)=(x,-y)$.

Let the $x$-coordinates of $P,Q,P+Q,P-Q$ be $x_1,x_2,x_3,x_4$. Applying the addition formula with $Q$ and $-Q$ givesSubstituting $y_i^2=x_i^3+a{x}_i+b$ and simplifying yieldsMultiplying the two addition formulas and eliminating $y_1{y}_2$ in the same way gives

These identities are the algebraic source of two parallelogram laws. Applied to pullbacks of the pole divisor of $x$, they implyfor isogenies of elliptic curves. Together with $\mathrm{deg}(n\phi )=n^2\mathrm{deg}\phi$, this makes the degree a quadratic form. Applied to the Absolute logarithmic Weil height of the four $x$-coordinates, with bounded terms removed by passage to the limit defining the canonical height of an elliptic curve, they similarly give

For $E:y^2=x^3+1$, let $\alpha (x,y)=(\zeta x,y)$. The three points $P,\alpha P,{\alpha }^{2}P$ lie on the horizontal line through $P$, so their sum is zero. Thusin the endomorphism ring of an elliptic curve. Since $\mathrm{deg}\alpha =1$ and complex conjugation sends $\alpha$ to ${\alpha }^2$, degree on $\mathbb{Z}[\alpha ]$ is the Eisenstein-integer norm:

A separable isogeny is determined by its kernel up to unique isomorphism of its target, and every finite Galois-stable subgroup of an elliptic curve is the kernel of the corresponding quotient isogeny. Put $T=(-1,0)$. The three nonzero points of $E[2]$ are $T,\alpha T,{\alpha }^{2}T$, andHence $\phi (\alpha -{\alpha }^2)$ kills $\ker \phi =\{O,T\}$ and factors uniquely through $\phi$:for an isogeny $\psi :E^{\prime }\to E^{\prime }$. Degrees giveMoreover,Composing the factorization twice and using the surjectivity of $\phi$ gives ${\psi }^2=[-3]$.

Both alternatives are given.

Let $E$ be an elliptic curve over ${\mathbb{F}}_q$ and let $\pi$ be its Frobenius isogeny. The fixed points of $\pi$ are exactly $E({\mathbb{F}}_q)$, and separability of $1-\pi$ givesHere Trace of Frobenius is the integer $a$. Since $\mathrm{deg}\pi =q$, the quadraticity of degree gives, for every pair of integers $m,n$,If the discriminant $a^2-4q$ were positive, this homogeneous quadratic would be negative for some real ratio $m/n$, hence for a nearby rational ratio and then for some pair of integers. ThereforeThis is the Hasse theorem for elliptic curves,

The Frobenius isogeny satisfiesIf $\alpha ,\beta$ are the roots of $X^2-aX+q$, then $|\alpha |=|\beta |=\sqrt{q}$ andThe zeta function of an elliptic curve over a finite field isSubstitution of the point-count formula and $-\log (1-z)={\sum }_{n\ge 1}{z}^n/n$ gives the rational functionThe bounds $|\alpha |=|\beta |=\sqrt{q}$ are the Riemann hypothesis for an elliptic curve over a finite field. The relations $\alpha \beta =q$ and the displayed formula also give the functional equation

For a discrete module $M$ over the absolute Galois group $G_K$, the first Galois cohomology group iswhere a one-cocycle satisfies $c(\sigma \tau )=c(\sigma )+\sigma c(\tau )$ and a coboundary has the form $c(\sigma )=\sigma m-m$.

For an integer $n\ge 2$, the Kummer exact sequence of an elliptic curveproduces the injective Kummer map of an elliptic curveExplicitly, if $nQ=P$, then $\delta (P)$ is represented by $\sigma \mapsto \sigma Q-Q$.

For every completion $K_v$ there is a local Kummer map. The n-Selmer group isIt fits intowhere $\mathrm{Sha}(E/K)$ is the Tate–Shafarevich group.

Only finitely many places divide $n$, are places of bad reduction, or are Archimedean. Outside this finite set $S$, every Selmer class is unramified. Since the finite Galois module $E[n]$ has finite order, there are only finitely many $E[n]$-valued cohomology classes unramified outside $S$; equivalently, the relevant finite extensions have bounded degree and ramification, and their number is finite by the Hermite–Minkowski theorem. Hence ${\mathrm{Sel}}^{(n)}(E/K)$ is finite, and its subgroup $E(K)/nE(K)$ is finite. This is the Weak Mordell-Weil theorem. Combined with height descent, which chooses representatives of bounded height in the finitely many cosets modulo $nE(K)$, it yields the finite generation asserted by the Mordell-Weil theorem.

Let $T=(0,0)$, the rational point of order two. Definebywhere the right sides denote square classes.

To prove multiplicativity, let a nonvertical line $y=mx+c$ meet $E$ in points with $x$-coordinates $x_1,x_2,x_3$. Substitution gives the monic cubicso Vieta formulas give $x_1{x}_2{x}_3=c^2$. If the first two intersection points are $P,Q$, the third is $-(P+Q)$ and has the same $x$-coordinate as $P+Q$. Thereforein the square-class group. Tangencies follow by taking a repeated root, and the vertical and exceptional cases give the stated values at $O$ and $T$. Thus $\alpha$ is a group homomorphism.

The curve has a two-isogeny descent. Its quotient by $⟨T⟩$ isand the dual two-isogeny gives a corresponding map ${\alpha }^{\prime }:E^{\prime }(\mathbb{Q})\to {\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^2$. The standard kernel calculation yields

If $d$ represents a class in $\mathrm{im}\alpha$, writewith coprime integers $u,v$. Substitution into the equation and clearing squares shows that the class occurs exactly when the quartic covering in a two-isogeny descenthas a nontrivial rational, equivalently primitive integral, solution. Valuation parity shows that only the finitely many square classes represented by square-free divisors $d$ of $b$ need be considered. Repeating the construction for $E^{\prime }$ reduces the rank calculation to finitely many explicit quartic solubility tests.

Here $a=p$ and $b=p^2$. For $E$, the four possible square classes arewith coveringsThe classes $-1$ and $-p$ have no real points, because their right sides are respectivelyfor every nonzero pair $(u,v)$. Hence

The two-isogenous curve isIts candidate classes and coverings areThe image of ${\alpha }^{\prime }$ is a subgroup and contains $-3$, the image of the rational two-torsion point $(0,0)$.

Suppose now that $p\equiv 7(\mathrm{mod}12)$. Then both $-1$ and $3$ are quadratic nonresidues modulo $p$. The covering $C_{-1}^{\prime }$ has no ${\mathbb{Q}}_p$-point. Indeed, after choosing primitive $p$-adic coordinates, if $p\nmid u$, reduction modulo $p$ would make $-1$ a square. If $p\mid u$, then $p\nmid v$; the right side has valuation two, and division by $p^2$ would make $3$ a square modulo $p$. Both alternatives are impossible.

Thus $-1\notin \mathrm{im}{\alpha }^{\prime }$. A subgroup of the three-dimensional square-class group generated by $-1,3,p$ that contains $-3$ but not $-1$ has order at most four. ThereforeThe rank is consequently $0$ or $1$.