Past exam of the mathematics course of the University of Cambridge / 2024 / iii / Paper 125 (Elliptic Curves)

Let $E$ be a smooth plane cubic whose identity $O$ is an inflection point. A line through $P$ and $Q$, using the tangent when $P=Q$, has a third intersection $R$ counted with multiplicity. The chord-and-tangent group law defines $P+Q$ by drawing the line through $R$ and $O$ and taking its third intersection.

The clean verification of the group axioms uses divisors. The line at infinity meets a Weierstrass cubic in $3(O)$, so three collinear points $P,Q,R$ satisfyConsequently the mapsends the chord-and-tangent construction to addition of divisor classes. The principal divisor criterion on an elliptic curve shows that this map is bijective. Associativity and commutativity therefore follow from the abelian group law on ${\mathrm{Pic}}^0(E)$. The tangent convention handles repeated intersections, $O$ represents the zero class, and the third point on the line through $P$ and $O$ represents the inverse of $P$. Hence all group axioms hold.

Forthe negative of $(x,y)$ is $(x,-y-1)$. At $P=(0,1)$ the tangent slope isThe tangent is $y=1-4x/3$, so the addition formulas giveThusThe line through $P=(0,1)$ and $Q=(-2,1)$ is $y=1$. Its third intersection has $x=2$, and reflection under $y\mapsto -y-1$ gives

Direct enumeration of the solutions of $y^2+y=x^3-4x+2$ givesafter adjoining the point at infinity. Therefore

The discriminant is $1909=23\cdot 83$, so $3,5,7$ are primes of good reduction of an elliptic curve. The reduction of torsion points on an elliptic curve injects the prime-to-$p$ torsion into $\tilde{E}({\mathbb{F}}_p)$.

If a prime $\ell$ divided the order of $E(\mathbb{Q}{)}_{\mathrm{tors}}$, its primary subgroup would inject at every one of $3,5,7$ except possibly when $p=\ell$. For $\ell =3$, the counts at $5$ and $7$ have greatest common divisor one; for $\ell =5$ use the counts at $3$ and $7$; for $\ell =7$ use those at $3$ and $5$; every other $\ell$ would divide all three counts. Each possibility is excluded. Hence

Modulo $3$, the affine points areEach equals its own inverse because $-1-1=1$ in ${\mathbb{F}}_3$. Thuswhich is noncyclic. The reductions of $P$ and $Q$ are the distinct nonzero points $(0,1)$ and $(1,1)$, so they form a basis.

If $mP+nQ=O$, reduction modulo $3$ shows that $m$ and $n$ are even. Write $m=2m_1$ and $n=2n_1$. Then $m_{1}P+n_{1}Q$ is a rational point of order dividing two, and part (iii) makes it zero. Repeating the argument shows that $m$ and $n$ are divisible by every power of two, so $m=n=0$. Therefore

The Hasse theorem for elliptic curves states that, for an elliptic curve over ${\mathbb{F}}_q$,Let $\pi$ be the Frobenius isogeny of an elliptic curve and put $a=q+1-\#E({\mathbb{F}}_q)$. The fixed points of $\pi$ are $E({\mathbb{F}}_q)$, and $1-\pi$ is separable, soHence the trace of an elliptic-curve endomorphism iswhile $\mathrm{deg}\pi =q$.

The degree on $\mathrm{End}(E)$ is a nonnegative quadratic form. Polarization and the identities for the dual isogeny give, for integers $m,n$,If $a^2>4q$, this real binary quadratic form is indefinite. An open cone on which it is negative contains a nonzero rational point and therefore a nonzero integer point, contradicting nonnegativity of isogeny degree. Thus $a^2\le 4q$, which is exactly the claimed inequality.

For $E:y^2=x^3+3$, direct counting givesNeither group order is divisible by $17$, so neither group contains a point of order $17$.

At $p=17$ the Frobenius trace is zero. The elliptic-curve point count over a finite field has trace recurrenceFor every $n\ge 1$, this order is congruent to one modulo $17$. Consequently $E({\mathbb{F}}_{17^n})$ has no point of order $17$ for any $n$.

At $p=31$, the trace is $a=31+1-43=-11$. On $E[17]$, Frobenius has characteristic polynomialIts discriminant is $14$, a nonsquare in ${\mathbb{F}}_{17}$, so its two distinct eigenvalues lie in ${\mathbb{F}}_{17^2}^{\times }$. Their orders divide $17^2-1=288$, whence ${\pi }^{288}=1$ on $E[17]$. Thus all of $E[17]$ is rational over ${\mathbb{F}}_{31^{288}}$, and in particular a point of order $17$ exists over some extension with $n\ge 2$.

A one-dimensional commutative formal group law over ${\mathcal{O}}_K$ is a power series $F(X,Y)\in {\mathcal{O}}_K[[X,Y]]$ satisfyingA morphism $h:\mathcal{F}\to \mathcal{G}$ is a series $h(T)\in T{\mathcal{O}}_K[[T]]$ satisfyingIf $h(T)=uT+O(T^2)$, the invertible morphism criterion for formal group laws says that $h$ is an isomorphism whenever $u\in {\mathcal{O}}_K^{\times }$. Indeed, recursive coefficient comparison constructs a unique compositional inverse $j(T)$; applying $j$ to the morphism identity shows that $j$ is a morphism in the opposite direction.

The multiplication series hasSince $p\nmid n$, its linear coefficient is a unit, so $[n{]}_{\mathcal{F}}$ is an automorphism of the group $\mathcal{F}(\pi {\mathcal{O}}_K)$. Its kernel is therefore zero, and

For a minimal integral Weierstrass equation, let $\tilde{E}$ be the reduced cubic and ${\tilde{E}}_{\mathrm{ns}}(k)$ its nonsingular points, with their induced group law. Define the filtration of elliptic-curve points over a local field byandThe parameter $z=-x/y$ identifies $E_1(K)$ with the formal group of an elliptic curve on $\pi {\mathcal{O}}_K$. Part (a) therefore gives $E_1(K)[n]=0$. Reduction restricts to the exact sequenceIts restriction to $n$-torsion has trivial kernel, yielding the injection

An integral Weierstrass equation has good reduction outside the finitely many primes dividing its nonzero discriminant. This proves finiteness of the set of bad primes. To prove finiteness of rational torsion, choose two distinct good primes. The reduction of torsion points on an elliptic curve injects each primary component at a good prime of different residue characteristic, so the two finite reduced point groups bound every primary component of $E(\mathbb{Q}{)}_{\mathrm{tors}}$.

Forthe displayed equation is minimal andIts bad primes are therefore exactlyThe good reductions at $11$ and $13$ haveTheir coprime orders exclude every rational torsion primary component, including the residue-characteristic components by using the other prime. Hence

The natural maphas finite image by hypothesis. It remains to bound its kernel. If $P\in E(K)$ becomes $nQ$ for $Q\in E(L)$, thenis a one-cocycle for $G=\mathrm{Gal}(L/K)$. Changing $Q$ by an $n$-torsion point changes this cocycle by a coboundary, producing a well-defined map from the kernel toIf its cohomology class is zero, subtracting the corresponding torsion point from $Q$ makes $Q$ Galois fixed, so $P\in nE(K)$. The map is therefore injective. Both $G$ and $E(L)[n]$ are finite, so this group cohomology set is finite. A finite kernel and finite image give

If $A$ is finitely generated, the structure theorem for finitely generated modules over a principal ideal domain immediately makes $A/nA$ finite.

Conversely, first replace the given height by a quadratic one. SetCondition (ii) makes this limit converge and givesThus $\hat{h}$ still has finite bounded subsets. Condition (i) also gives a global lower bound for $h$, so $\hat{h}\ge 0$. Applying condition (iii) to $2^{r}P,2^{r}Q$, dividing by $4^r$ and passing to the limit gives one direction of the parallelogram identity. Applying the same inequality to $P+Q$ and $P-Q$, and using $\hat{h}(2P)=4\hat{h}(P)$, gives the reverse direction. Henceand induction yields $\hat{h}(mP)=m^2\hat{h}(P)$ for every integer $m$.

Now suppose $A/nA$ is finite and choose representatives $R_1,\dots ,R_s$. Put $R={\max }_i\hat{h}(R_i)$. For any $P$, write $P=nQ+R_i$. Nonnegativity and the parallelogram identity giveso, since $n\ge 2$,Repeated division modulo $nA$ therefore reaches the finite set $B=\{P:\hat{h}(P)\le R+1\}$. Reversing the recursion expresses every element of $A$ using $B$ and the finitely many $R_i$. This is the height descent lemma, and proves

For a reduced rational number $x=a/b$ with $b>0$, the height of a rational number isCondition (i) holds because only finitely many coprime integer pairs have bounded maximum.

Condition (iii) also holds. The standard height inequalitygivesCondition (ii) fails: for positive integers $m$,whose absolute value is unbounded. Thus precisely conditions $\boxed{\text{(i) and (iii)}}$ hold. This is consistent with $\mathbb{Q}/n\mathbb{Q}=0$ although the additive group $\mathbb{Q}$ is not finitely generated.

An isogeny of elliptic curves is a nonconstant morphism preserving identity points; it is automatically a finite surjective group homomorphism. On the affine chart $v\ne 0$, putThe equation of $E$ is $t^3+d=s^3$, and the proposed map isIt lands on $E^{\prime }$ becauseThe rational formulas extend across $v=0$ to a morphism sending $O_E$ to $O_{E^{\prime }}$. It is nonconstant, hence an isogeny. On function fields, $t$ satisfies $t^3=y$, so the degree is at most three; generically the three cube roots give three distinct preimages. Equivalently, the points with $v=0$ form its three-element geometric kernel. Therefore

The principal divisor criterion on an elliptic curve says that $D=\sum n_P(P)$ is principal exactly when $\mathrm{deg}D=0$ and $\sum [n_P]P=O$.

On $E^{\prime }:y^2+dy=x^3$, takeThe line $y=0$ meets the cubic three times at $T$, while $y$ has a triple pole at the point at infinity. HenceWith $g=u/v\in \mathbb{Q}(E)$, part (a) givesTaking divisors and cancelling the factor three yieldsPullback on degree-zero divisor classes is the dual isogeny, so the pulled-back class is represented by $\hat{\varphi }(T)$. It is principal, and therefore

The three-isogeny descent connecting map, identified through the Weil pairing with $H^1(\mathbb{Q},{\mu }_3)={\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^3$, isThe long exact sequence attached to $0\to E[\varphi ]\to E\stackrel{\varphi }{\to }{E}^{\prime }\to 0$ makes it a group homomorphism withThe function $f=y$ from part (b) gives the explicit formulaAt $T$, the value $d^{-1}$ is the leading coefficient of $y$ relative to the local parameter $x$, since $y(y+d)=x^3$ gives $y/x^3\to d^{-1}$. At $-T=(0,-d)$ the ordinary formula gives $-d$, whose class is the inverse of $d^{-1}$ because $-1$ is a cube.

Let $S$ be the primes dividing $d$. For a prime $\ell \notin S$, useIf $v_{\ell }(y)>0$, then $y+d$ is an $\ell$-adic unit, so $v_{\ell }(y)=3v_{\ell }(x)$. If $v_{\ell }(y)<0$, then $v_{\ell }(y+d)=v_{\ell }(y)$, so $2v_{\ell }(y)=3v_{\ell }(x)$. In either case $v_{\ell }(y)$ is divisible by three; the special values at $O$ and $T$ have the same property. ThereforeWhen $d=1$, this power-class group is trivial: a rational number whose valuation at every prime is divisible by three is a cube up to sign, and $-1=(-1{)}^3$. Thus $\alpha$ is trivial, its kernel is all of $E^{\prime }(\mathbb{Q})$, and