Past exam of the mathematics course of the University of Cambridge / 2023 / iii / Paper 125 (Elliptic Curves)

For a smooth projective curve $C$ of geometric genus one, the Riemann-Roch theorem saysThe canonical divisor has degree zero and is principal because a nonzero regular differential has no zeros. Hence $K_C\sim 0$, so equivalentlyIn particular, $\ell (D)=\mathrm{deg}D$ when $\mathrm{deg}D>0$.

The group ${\mathrm{Pic}}^0(E)$ is the group of degree-zero divisor classes on $E$, with addition induced by addition of divisors. ConsiderFor surjectivity, let $D$ have degree zero. Since $\mathrm{deg}(D+(O_E))=1$, Riemann--Roch gives $\ell (D+(O_E))=1$. A nonzero element of this space makes $D+(O_E)$ linearly equivalent to an effective divisor of degree one, necessarily $(P)$ for some point $P$. Thus $[D]=[(P)-(O_E)]$.

For injectivity, suppose $(P)-(O_E)$ is a principal divisor. If $P\ne O_E$, its defining function would be nonconstant and would have at most one simple pole, whereas Riemann--Roch gives $\ell ((O_E))=1$, so every such function is constant. Therefore $P=O_E$, and $\iota$ is a bijection.

Embed $E$ as a smooth plane cubic with $O_E$ an inflection point. A line through $P,Q$, using the tangent when $P=Q$, has a third intersection $S$ counted with multiplicity. The chord-and-tangent group law defines $P+Q=-S$, where $-S$ is the third point on the line through $S$ and $O_E$.

The divisor cut out by the first line isand the line through $S$ and $O_E$ gives $(S)+(-S)-2(O_E)$. Their quotient therefore showsUnder the bijection from part (a), the chord-and-tangent operation is exactly addition in the abelian group ${\mathrm{Pic}}^0(E)$. It is consequently associative and commutative, has identity $O_E$, and has the geometrically defined point $-P$ as inverse. Thus it makes $E$ an abelian group.

Because $\varphi$ is a separable isogeny,The degree-zero divisorcorresponds under $E_1\simeq {\mathrm{Pic}}^0(E_1)$ to the sum of all elements of the finite abelian group $E_1[\varphi ]$. Pairing every $T$ with $-T$ shows that this sum is the sum of the elements in $E_1[\varphi ]\cap E_1[2]$. It vanishes when that intersection has one element and also when it has four elements, since the sum of the four elements of $(\mathbb{Z}/2\mathbb{Z}{)}^2$ is zero. The principal divisor criterion on an elliptic curve therefore gives a rational function $g$ with $\mathrm{div}(g)=D$.

The divisor $D$ is invariant under $[-1]$, so $[-1{]}^{\ast }g/g$ has zero divisor and is constant. Applying $[-1]$ twice shows that this constant has square one; hence $[-1{]}^{\ast }g=\pm g$.

For a short Weierstrass equation of an elliptic curvethe multiplication-by-two isogeny hasThus one may take $g=y$, and $[-1{]}^{\ast }y=-y$. For multiplication by three, the third division polynomial of an elliptic curvevanishes simply at the eight nonzero points of $E[3]$ and has a pole of order eight at $O_E$. Hence $g={\psi }_3(x)$ has divisor $[3{]}^{\ast }(O_E)-9(O_E)$ and satisfies $[-1{]}^{\ast }g=g$. Both signs occur.

The Hasse theorem for elliptic curves states that for $E/{\mathbb{F}}_q$,Let $\pi$ be the Frobenius isogeny of an elliptic curve. Its fixed points are exactly $E({\mathbb{F}}_q)$, and $1-\pi$ is separable because its differential is the identity. ThereforeFor every endomorphism $\alpha$, the dual isogeny gives $\alpha \hat{\alpha }=[\mathrm{deg}\alpha ]$, and the degree satisfies the parallelogram lawConsequently, if $a=1+q-\mathrm{deg}(1-\pi )$ is the trace of $\pi$, thenThis is nonnegative for every pair of integers $m,n$. By approximating the minimizing real ratio $m/n=a/2$, the quadratic polynomial can be nonnegative for all rational ratios only if its discriminant is nonpositive. Thus $a^2\le 4q$, and the displayed point-count identity proves Hasse's theorem.

An explicit example with nonisomorphic groups occurs over ${\mathbb{F}}_{43}$. PutOn $E_1$, the point $(30,19)$ has order seven and its nonzero cyclic subgroup has $x$-coordinates $30,31,40$. Vélu formulas give the quotient coefficientsso the degree-seven quotient iswhich is $E_2$. Direct quadratic-residue counts give $\#E_1({\mathbb{F}}_{43})=\#E_2({\mathbb{F}}_{43})=49$. The points killed by seven on $E_1$ are only the displayed kernel and $O$, while $(1,8)$ and $(3,2)$ are independent seven-torsion points on $E_2$. Hence

Finally, let $p<43$ and suppose two curves are linked by an isogeny of degree seven. The isogeny and its dual induce inverse isomorphisms on every prime-to-seven primary subgroup, so nonisomorphic rational point groups would require $49$ to divide their common order. Since this order is less than $57$ by Hasse, one group would then be cyclic of order $49$ and the other would contain all of $E[7]$. The Weil pairing on rational seven-torsion forces ${\mu }_7\subset {\mathbb{F}}_p$, hence $p\equiv 1(\mathrm{mod}7)$ unless $p=7$. The only prime below $43$ congruent to one modulo seven is $29$, but Hasse gives $\#E({\mathbb{F}}_{29})<49$; for $p=7$ the same inequality is immediate. No such pair exists below $43$.

The curve has good reduction when it admits a Minimal Weierstrass equation over ${\mathcal{O}}_K$ whose discriminant is a unit, so reduction modulo $\pi$ is a nonsingular elliptic curve $\tilde{E}/k$. Write a point of $E(K)$ in primitive projective coordinates $(X:Y:Z)$ over ${\mathcal{O}}_K$. Reducing all three coordinates definesPrimitivity ensures that the reduced triple is not zero. The addition morphism on the smooth Weierstrass model reduces to the addition morphism on $\tilde{E}$; equivalently, this follows from the valuative criterion for properness for the smooth proper group scheme. Therefore $\mathrm{red}(P+Q)=\mathrm{red}(P)+\mathrm{red}(Q)$.

The needed Hensel lemma says that if $f\in {\mathcal{O}}_K[X]$ and $a\in {\mathcal{O}}_K$ satisfy $f(a)\equiv 0(\mathrm{mod}\pi )$ and $f^{\prime }(a)\not\equiv 0(\mathrm{mod}\pi )$, then $a$ lifts uniquely to a root of $f$ in ${\mathcal{O}}_K$ with the prescribed residue. At every affine point of the smooth curve $\tilde{E}$, one partial derivative of its Weierstrass equation is nonzero. Fixing the other coordinate and applying Hensel's lemma lifts that point to $E(K)$; $O_E$ lifts itself. Thus reduction is surjective.

Use the local parametersso $x=t/z$ and $y=-1/z$. Substitution in a general integral Weierstrass equation givesFor fixed $0\ne t\in \pi {\mathcal{O}}_K$, the difference between the two sides, viewed as a polynomial in $z$, is congruent to $z$ modulo $\pi$ and has derivative congruent to one. Hensel's lemma gives a unique $z\in \pi {\mathcal{O}}_K$, and therefore a unique point $\theta (t)=(t/z,-1/z)$ in the kernel of reduction of an elliptic curve. Together with $\theta (0)=O_E$, this identifies that kernel with the parameters $t\in \pi {\mathcal{O}}_K$.

Let $K^{\mathrm{nr}}$ be the maximal unramified extension of $K$. Because $p\nmid n$, multiplication by $n$ on the special fibre is a separable isogeny and is surjective on $\tilde{E}(\overline{k})$. Choose a point $\tilde{Q}$ with $[n]\tilde{Q}=\tilde{P}$ and lift it, after a finite unramified extension, to $Q_0$. Then $R=P-[n]Q_0$ lies in the kernel of reduction.

On the formal group of an elliptic curve, multiplication by $n$ has the formSince $n$ is a unit in ${\mathcal{O}}_K$, the invertible morphism criterion for formal group laws makes $[n{]}_F$ an automorphism of $\pi {\mathcal{O}}_{K^{\mathrm{nr}}}$. Hence $R=[n]S$ for a unique point $S$ in the kernel of reduction, and $Q=Q_0+S$ satisfies $[n]Q=P$. Moreover, good reduction makes the finite group scheme $E[n]$ étale over ${\mathcal{O}}_K$, so all its points are defined over an unramified extension. Every point of $[n{]}^{-1}P=Q+E[n]$ is therefore unramified, proving that $K([n{]}^{-1}P)/K$ is unramified.

Multiplication by $n$ is already an automorphism of the formal kernel, so the exact reduction sequence shows that $E(K)/nE(K)$ is finite. Choose representatives $P_1,\dots ,P_s$. Each becomes $n$-divisible over a finite unramified extension; their compositum $L/K$ is still finite and unramified. Every class from $E(K)/nE(K)$ then maps to zero in $E(L)/nE(L)$.

For $x=u/v\in \mathbb{Q}$ in lowest terms, the naive height on the projective line isHomogenize the coprime numerator and denominator of $\xi$ to degree $d$. The triangle inequality gives the upper estimate $H(\xi (x))\le c_{2}H(x{)}^d$. Since the two homogenized forms have no common projective zero, their resultant is nonzero, and the Bézout identities for the resultant express fixed multiples of $u^{2d-1}$ and $v^{2d-1}$ as combinations of their values with coefficients of degree $d-1$. After cancellation this gives $H(x{)}^d\le CH(\xi (x))$, which is the lower estimate with $c_1=C^{-1}$.

Now write $x=u/v$ in lowest terms and putSince $\gcd (N,v)=1$, the equation $y^2=N/v^3$ givesClearly $M\le \gamma H(x{)}^3$ for $\gamma =1+|a|+|b|$. Homogenizing the supplied polynomial identity givesIts coefficient sum is at most ${\gamma }^2$, so $|u{|}^5\le {\gamma }^{2}H(x{)}^{2}M$. The same lower bound is immediate from $|v{|}^3\le M$ when $|v|=H(x)$. Thus

Set $h(O_E)=0$ andfor $P\ne O_E$. The canonical height of an elliptic curve isThe duplication formula is a rational function of degree four in $x$, so the rational-map height estimate in part (a) givesTherefore successive terms of $4^{-r}h([2^r]P)$ differ by at most $C_E{4}^{-r-1}$, and the limit is well defined.

Shifting the limit immediately gives $\hat{h}([2]P)=4\hat{h}(P)$. The addition formula likewise givesApply this to $[2^r]P,[2^r]Q$, divide by $2\cdot 4^r$, and pass to the limit to obtain the exact parallelogram lawTaking $Q=P$ starts an induction on $|n|$ that yieldsfor every integer $n$.

An admissible change of Weierstrass equation of an elliptic curve replaces the $x$-coordinate by a degree-one rational function, so the two logarithmic heights differ by $O(1)$. Dividing this bounded difference by $4^r$ in the defining limit shows that the canonical height is unchanged. It is intrinsic to the elliptic curve and the chosen point.

Replacing $[2^r]$ and $4^r$ by $[3^r]$ and $9^r$ gives the same canonical height. Indeed $h([3]P)=9h(P)+O_E(1)$, and the same telescoping argument constructs a quadratic height differing from the original by a bounded function. A bounded quadratic function is zero, so the two limits agree.

Part (a) givesThus replacing the $x$-coordinate height literally by the $y$-coordinate height multiplies the resulting canonical height by $3/2$. Multiplying the new naive height by $2/3$ restores the original normalization.

Fix a prime $p$. If a rational point $T=(x,y)$ has $v_p(x)<0$, the integral projective Weierstrass equation forcesfor some $m>0$. Hence its formal parameter $t=-x/y$ lies in $p{\mathbb{Z}}_p$, so $T$ belongs to the formal group of an elliptic curve at the identity. This formal kernel has no nonzero torsion for the present equation. Multiplication by an integer prime to $p$ is a formal-group automorphism, while the formal logarithm rules out $p$-power torsion for odd $p$. For $p=2$, inversion sends $t$ to $-t$ because the equation has no $xy$ or $y$ term, and thereforeFor $v_2(t)\ge 1$, its leading term has strictly smaller valuation than every higher term, so $[2{]}_F(t)$ cannot vanish; iterating excludes all two-power torsion as well.

Thus a nonzero torsion point cannot have $v_p(x)<0$. Since this holds for every prime, $x\in \mathbb{Z}$. The integral equation then makes $y^2$ an integer; a rational number whose square is integral is itself integral, so $y\in \mathbb{Z}$. This is the integrality assertion in the Lutz–Nagell theorem.

For $E:y^2=x^3-x^2+25x$, the addition formulas giveIn particular, $[2]Q=T$ and $Q$ has order four, while the nonintegral coordinate of $[2]P=(144/25,-2172/125)$ and part (a) show that $P$ has infinite order.

For two-isogeny descent, writeThe rational point $(0,0)$ is the kernel of a degree-two isogeny $E\to E^{\prime }$. The square-class maps send an affine point with $x\ne 0$ to $[x]\in {\mathbb{Q}}^{\ast }/{\mathbb{Q}}^{\ast 2}$, send $O$ to $1$, and send $(0,0)$ to $[b]$ or $[a^2-4b]$ on the two curves. Their images determine the rank through

HereOn $E$, the possible square classes divide $25$; real solubility excludes the negative classes, while $P$ and $Q$ exhibit $1$ and $5$. Thus $\alpha (E(\mathbb{Q}))=\{1,5\}$. On $E^{\prime }$, the pointsexhibit the classes $-11,-1,11$, along with $1$. The remaining candidate classes are divisible by $3$. Their homogeneous spaceshave no primitive solution modulo $9$: reduction modulo $3$ first forces $3\mid UV$, and then the equation is congruent to $3$ or $6$ modulo $9$. HenceThe rank formula gives $2^r=2\cdot 4/4=2$, so $r=1$.

At the good primes $7$ and $19$, direct counts giveThe reduction of torsion points on an elliptic curve injects rational torsion into both groups, so its order divides $\gcd (12,16)=4$. Since $Q$ has order four, the torsion subgroup is $\mathbb{Z}/4\mathbb{Z}$. Thereforeso $t=1$, $d_1=4$, and $r=1$.