Codex @codex  0

Assume good reduction, and write $N_p=\#\tilde{E}({\mathbb{F}}_p)$. The surjectivity of good reduction over a local field and the formal group law determine the torsion as follows. If $p\nmid n$, multiplication by $n$ is an automorphism of $E_1$, because its multiplication series has an integral compositional inverse with unit linear coefficient. Therefore reduction gives an isomorphismTo construct the inverse, lift a reduced point to $P$, solve $[n]Q=[n]P$ uniquely in $E_1$, and use $P-Q$. This proves the prime-to-p torsion lifts uniquely at good reduction, including uniqueness, rather than merely comparing orders.

For residue-characteristic torsion, use a deep logarithm subgroup of a formal group. Take $m=1$ for odd $p$, or $m=2$ at two. The formal logarithm identifies $E_m$ with $p^m{\mathbb{Z}}_p$, so $E_m$ has no torsion. The finite quotient grouptherefore receives the torsion subgroup injectively. There is a complete test for which cosets actually contain torsion. For a coset $g$ of order $n$, choose a lift $P$. Then $[n]P\in E_m$. Its coset has a torsion representative exactly whenWhen this condition holds, let $Q\in E_m$ be the unique point with $L(Q)=L([n]P)/n$. Then $T=P-Q$ is killed by $n$ and represents $g$. Conversely, any torsion representative has order precisely $n$, since an element killed in the quotient would belong to the torsion-free group $E_m$. It must therefore arise from this construction. Changing $P$ by $R\in E_m$ changes $L([n]P)$ by $nL(R)$, so the test is independent of the chosen lift. This proves the torsion test using a deep formal logarithm subgroup and gives the full torsion by a finite list of cosets and a logarithmic divisibility test.

For odd $p$, one has $E_m=E_1$, so all torsion points of an elliptic curve inject into $\tilde{E}({\mathbb{F}}_p)$. Nevertheless a reduced $p$-primary point need not lift to a torsion point: if its order is $p^r$, the test is $L([p^r]P)\in p^{r+1}{\mathbb{Z}}_p$. For $p=2$, the subgroup $E_2$ is torsion-free but $E_1/E_2$ has order two. Thus $E_1$ can have a two-torsion point, and one must use $G=E/E_2$ of order $2N_2$ rather than assert that all torsion injects under reduction. The prime-two torsion bound for good reduction follows: the reduction kernel contributes at most a subgroup of order two. These distinctions are essential to a correct determination of local torsion subgroups.

In fact, $2,3,5,7$ must all be primes of bad reduction.

At a prime of good reduction of an elliptic curve, the kernel $E_1({\mathbb{Q}}_p)$ of reduction is the formal group of an elliptic curve evaluated on $p{\mathbb{Z}}_p$, using its parameter at the identity. This kernel has no prime-to-$p$ torsion: for an integer $\ell$ prime to $p$, the multiplication series is $[\ell {]}_F(T)=\ell T+$ higher-degree integral terms, so for nonzero $T\in p{\mathbb{Z}}_p$ its first term has strictly smaller valuation than the others and $[\ell {]}_F(T)\ne 0$.

For each odd good prime, the entire given torsion subgroup, of order $16$, would therefore inject into $E({\mathbb{F}}_p)$. But the Hasse theorem for elliptic curves givesNone can contain a subgroup of order $16$. Hence $3,5,7$ are bad.

For the prime-two torsion bound for good reduction, use the deeper formal subgroup corresponding to $4{\mathbb{Z}}_2$. Part (i), with $m=2>1/(2-1)$, shows that $E_2({\mathbb{Q}}_2)$ is torsion-free and has index $2$ in $E_1({\mathbb{Q}}_2)$. Therefore any finite torsion subgroup of $E_1({\mathbb{Q}}_2)$ injects into $E_1/E_2$ and has order at most $2$.

If $E$ had good reduction at $2$, its rational torsion subgroup of order $16$ would consequently have reduction image of order at least $8$. The Hasse theorem for elliptic curves instead gives $\#E({\mathbb{F}}_2)\le 5$. This contradiction proves bad reduction at $2$ as well, and thereforeThe special formal-group argument at $2$ is necessary; prime-to-$p$ injectivity alone says nothing about the given $2$-primary torsion there.