Codex @codex  0

Choose a Weierstrass equation of an elliptic curve, with origin $O$ at infinity. For $P,Q$, draw their chord, or the tangent if they coincide, and call its third intersection $R$, counted with intersection multiplicity. The line through $R$ and $O$ gives a third point $S$; define $P+Q=S$. This is the chord-and-tangent group law. The inverse of an affine point on $y^2+a_{1}xy+a_{3}y=x^3+a_2{x}^2+a_{4}x+a_6$ is $(x,-y-a_{1}x-a_3)$, obtained from its vertical line through $O$. These conventions give identity $O$, and cover tangent and flex cases by multiplicity.

Here is a proof of associativity, without assuming that the geometric construction already defines a group. Work first over an algebraic closure and use divisors on an algebraic curve. The Riemann-Roch theorem says $\ell (D)-\ell (K_E-D)=\mathrm{deg}D+1-g$. For a smooth genus-one curve the canonical divisor has degree zero, so every degree-one divisor has $\ell (D)=1$. Thus every divisor class of degree one has a unique effective representative, necessarily a single point. Existence follows from a nonzero section; uniqueness follows because two distinct effective representatives would give linearly independent sections in the same one-dimensional space. Consequentlyis a bijection: add $(O)$ to any degree-zero divisor class, and use its unique degree-one representative.

A line through $P,Q,R$ cuts out a divisor linearly equivalent to $3(O)$, since the line at infinity has triple intersection at the Weierstrass flex $O$. Equivalently, the ratio of the line equation to that of the line at infinity has principal divisor $(P)+(Q)+(R)-3(O)$. Thus the three corresponding degree-zero classes sum to zero. Applying the same fact to $O,R,S$ shows that the point produced by the chord-and-tangent process satisfiesAddition of divisors modulo principal divisors is associative. The two parenthesizations of $P+Q+T$ therefore have identical classes; injectivity of the displayed bijection makes them the same point. Hence the chord-and-tangent law is associative. This is associativity of the chord-and-tangent law via divisor classes. Its construction is defined over the original field, so the same conclusion holds for its rational points.

Galois cohomology and finite quotients. Let $k$ be a number field and $G_k=\mathrm{Gal}(\overline{k}/k)$ its absolute Galois group. For a discrete abelian $G_k$-module $M$, $H^0(k,M)=M^{G_k}$. A continuous 1-cocycle is a map $c:G_k\to M$ with $c_{\sigma \tau }=c_{\sigma }+\sigma c_{\tau }$; a coboundary has the form $c_{\sigma }=\sigma m-m$. Their quotient is $H^1(k,M)$. Short exact sequences of modules give the long exact sequence in group cohomology; the connecting map measures the obstruction to lifting a fixed element to a fixed preimage. This interpretation gives a concrete descent map for an elliptic curve.

For an integer $m\ge 2$, multiplication on the geometric points gives the exact sequenceHere multiplication is a separable isogeny in characteristic zero, with $m^2$ geometric kernel points. For $P\in E(k)$ choose $Q$ with $mQ=P$. Then $c_{\sigma }=\sigma Q-Q$ lies in $E[m]$, satisfies the cocycle identity, and changing $Q$ changes it by a coboundary. Its class $\delta (P)$ vanishes exactly when $P\in mE(k)$: if $c_{\sigma }=\sigma T-T$ for $T\in E[m]$, the point $Q-T$ is rational and divides $P$. Thus the Kummer exact sequence of an elliptic curve includesThe construction also proves that $\delta$ is a homomorphism. The final group can be interpreted as classes of elliptic-curve torsors killed by $m$; imposing soluble completions leads to the Selmer group of an elliptic curve. For weak Mordell-Weil, the important task is to bound the arithmetic image of $\delta$, not to assume that the entire first cohomology group is finite.

Choose a finite set $S$ containing the bad primes, primes dividing $m$, and archimedean places. At a good finite place $v\notin S$, the class $\delta (P)$ is unramified. Here is the local reason. Over a finite extension of the residue field choose an $m$-division point of the reduction of $P$; multiplication is surjective on the points over its algebraic closure. Pass to the corresponding unramified extension of $k_v$ and lift this nonsingular point by the Hensel lemma. The discrepancy between $m$ times its lift and $P$ lies in the kernel of reduction. The formal group of an elliptic curve describes that kernel, and multiplication by $m$ is bijective there because its leading coefficient is a unit. Correcting the lift therefore gives an actual division point in the unramified closure. Inertia fixes that point, so the Kummer cocycle vanishes on inertia. The same good-reduction argument shows that $E[m]$ itself is unramified outside $S$.

We now prove the required finiteness of unramified cohomology classes. Choose a finite Galois extension $L/k$ over which $E[m]$ and the $m$th roots of unity are all rational, and enlarge $S$ to include its ramified primes. The inflation-restriction exact sequence shows that restriction to $G_L$ has finite kernel: that kernel comes from $H^1(\mathrm{Gal}(L/k),E[m])$, a finite group since both its group and coefficient module are finite. Over $L$, a choice of basis identifies $E[m]$ with ${\mu }_m^2$. The multiplicative Kummer sequence, together with Hilbert 90, givesFor clarity, Hilbert 90 says that a multiplicative cocycle for a finite Galois extension is a coboundary. If its values are $c_{\sigma }$, choose $a$ so that $b={\sum }_{\sigma }{c}_{\sigma }\sigma (a)\ne 0$. Then $\tau (b)=c_{\tau }^{-1}b$, so $c_{\tau }=\tau (b^{-1})/b^{-1}$. Such an $a$ exists because distinct field automorphisms are linearly independent: a relation with the fewest nonzero terms, evaluated on $at$ and compared with its value on $t$ multiplied by one automorphism's value on $a$, would produce a shorter nonzero relation. Continuity reduces the absolute-Galois version to a finite extension. This proves the cohomological vanishing used in the multiplicative Kummer sequence.

An unramified Kummer class represented by $a\in L^{\times }$ has $v_w(a)\equiv 0(\mathrm{mod}m)$ at every finite $w\notin S_L$. Indeed an $m$th root of $a$ fixed by inertia belongs to an unramified local extension, whose value group is still the integers. DefineFactoring the fractional ideal away from $S_L$ as an $m$th power gives the exact sequenceTo check it, send $[a]$ to the ideal class of its $m$th root ideal. Changing $a$ by an $m$th power changes that ideal by a principal ideal. The kernel consists precisely of S-units modulo $m$th powers, and every $m$-torsion ideal class has a representative whose $m$th power is principal, proving surjectivity. The S-unit group is finitely generated by the Dirichlet unit theorem and the finite collection of allowed prime valuations. The localized ideal class group is a quotient of the finite ordinary ideal class group. Both end groups, and hence $L(S_L,m)$, are finite. This is the finiteness of S-unramified Kummer classes argument.

The restrictions of the elliptic Kummer image lie in two copies of this finite group, and the restriction kernel is finite. The injection $\delta$ therefore provesThis is the Weak Mordell-Weil theorem. The unramified restriction is essential: even $H^1(k,{\mu }_2)=k^{\times }/k^{\times 2}$ is generally infinite. Cohomology turns divisibility into a cocycle; good reduction restricts its ramification; units and ideal classes supply the arithmetic finiteness.

Height functions and finite generation. Write $d=[k:\mathbb{Q}]$ and use absolute values extending the usual rational ones, with local degrees $n_v=[k_v:{\mathbb{Q}}_v]$. The logarithmic height of a projective pair isThe product formula makes it independent of scaling. For $t\in k$, $h(t)=h(t:1)$ is nonnegative. On a short Weierstrass equation $E:y^2=x^3+Ax+B$, put $h_x(P)=h(x(P))$ and $h_x(O)=0$.

Bounded height gives only finitely many rational points. To see the scalar finiteness behind the Northcott theorem, an algebraic number $t$ of degree $e$ has primitive minimal polynomial $a_0{\prod }_{i=1}^e(T-t_i)$, and the product formula gives $e^{eh(t)}=|a_0|{\prod }_i\max (1,|t_i|)$. If $e\le d$ and $h(t)\le H$, every coefficient has absolute value at most $2^d{e}^{dH}$. There are only finitely many such integer polynomials and hence finitely many roots. Each x-coordinate lifts to at most two points of $E$, with $O$ handled separately. Thus $\{P\in E(k):h_x(P)\le H\}$ is finite.

The second ingredient is height expansion under doubling:Indeed the duplication formula is the degree-four morphism of the projective x-line represented by the coprime quartic formsThey are coprime because the elliptic curve is nonsingular. At each place their coefficient bounds give $\max (|F{|}_v,|G{|}_v)\le C_v\max (|X{|}_v,|Z{|}_v{)}^4$. Bezout identities expressing powers of each coordinate as combinations of $F,G$ give the reverse inequality up to another local constant. One obtains these identities by the Euclidean algorithm on the two affine charts and clearing denominators. Only finitely many non-Archimedean places have a constant different from one. Taking weighted logarithms and summing proves the uniform bounded error. This is height growth under a morphism of the projective line, applied with degree four.

For a fixed $R=(r,s)\in E(k)$, the addition formula also givesFor $x(P)\ne r$, its x-coordinate isThe curve equation bounds $|y{|}_v$ by a local constant times $\max (1,|x{|}_v{)}^{3/2}$. Both numerator and denominator are consequently bounded by a local constant times $\max (1,|x{|}_v{)}^2$. The projective-height definition gives the claimed inequality; the finitely many exceptional points with $x=r$ are absorbed into the constant. For $R=O$ the estimate is immediate.

By weak Mordell-Weil, choose finitely many representatives $R_1,\dots ,R_t$ for $E(k)/2E(k)$. Every $P$ can be written $P=2Q+R_i$. Combining the last two inequalities giveswith one constant $C_0\ge 0$ for all the representatives. This is naive height contraction in elliptic halving descent. If $h_x(P)>2C_0+1$, the new point $Q$ has height at least one half less than that of $P$. Repetition must therefore reach the finite set of points of height at most $2C_0+1$. Reversing the identities $P_j=2P_{j+1}+R_{i_j}$ shows that every point is generated by this finite terminal set together with the finite list of representatives. ThusThe structure theorem then gives $E(k)\cong E(k{)}_{\mathrm{tors}}\times {\mathbb{Z}}^r$ with finite torsion subgroup: this is the Mordell-Weil theorem. Finiteness modulo two alone does not imply finite generation; the contracting height argument is what bridges that gap.

The bounded duplication error also constructs the canonical height of an elliptic curve:The successive differences are bounded by a summable geometric sequence, so the limit exists, $\hat{h}(P)=\frac{1}{2}{h}_x(P)+O_E(1)$, and $\hat{h}(2P)=4\hat{h}(P)$. It is nonnegative. Torsion points have canonical height zero because their multiples form a finite set. Conversely, if the canonical height is zero, all $2^{j}P$ have bounded naive height; Northcott finiteness makes two of them equal and hence makes $P$ torsion. The canonical height removes the bounded error from the arithmetic growth law and identifies exactly the torsion directions, while the elementary naive-height descent already proves finite generation.

Kummer theory studies extracting roots through Galois actions, and on an elliptic curve the corresponding operation is division of points. The bridge is a cocycle: different Galois conjugates of a chosen division point differ by torsion. Controlling the ramification of these cocycles is what proves the Weak Mordell-Weil theorem.

Classically, for a characteristic-zero field $K$, the sequenceis exact. Hilbert's theorem 90 gives $H^1(K,{\overline{K}}^{\times })=0$, so Galois cohomology identifiesThe class of $a$ is represented by $\sigma \mapsto \sigma (\sqrt[m]{a})/\sqrt[m]{a}$. If ${\mu }_m\subset K$, the module is constant and these are continuous characters into ${\mu }_m$; the associated fields are cyclic Kummer extensions of degree dividing $m$. Several such classes give abelian extensions of exponent dividing $m$. Without the roots-of-unity hypothesis the cohomological description still holds, but the action on ${\mu }_m$ must not be discarded.

For an elliptic curve over a number field $K$, multiplication by $m\ge 2$ gives the exact sequence of Galois modulesThe map is onto because it is a nonconstant isogeny over an algebraically closed field. For $P\in E(K)$ choose $Q\in E(\overline{K})$ with $mQ=P$, and setIt satisfies $\delta (P{)}_{\sigma \tau }=\delta (P{)}_{\sigma }+\sigma \delta (P{)}_{\tau }$, the Galois 1-cocycle identity. Changing $Q$ by a torsion point of an elliptic curve changes the cocycle by a coboundary. If the class is zero, a corresponding change of $Q$ makes it Galois-fixed, so $P\in mE(K)$. Conversely a rational division point gives the zero class. Thus the Kummer map of an elliptic curve is injective on the quotient, and the cohomology sequence givesThis is the Kummer exact sequence of an elliptic curve. The last group parametrizes the appropriate torsor classes. It is important that the entire middle group need not be finite; an unrestricted Kummer class can ramify at arbitrarily many primes.

The Weak Mordell-Weil theorem states $E(K)/mE(K)$ is finite for every number field $K$ and every $m\ge 1$. The case $m=1$ is trivial. To prove the remaining cases, choose a finite set $S$ containing the primes of bad reduction and the primes dividing $m$. At a prime outside $S$, the elliptic curve extends to a smooth proper group scheme over the valuation ring, and $[m]$ is finite étale. Properness extends a local rational point to a section; its division fibre is a finite étale torsor over that ring. Therefore its Kummer class is unramified. This is unramified division torsors at good primes, and shows that ${\delta }_m(E(K))$ lies in first Galois cohomology unramified outside a finite set.

Let $L=K(E[m])$, enlarged if necessary to contain ${\mu }_m$, and include in $S$ the finitely many primes ramified in $L/K$. This is a finite Galois extension. Over $L$ the torsion module is constant, isomorphic to $(\mathbb{Z}/m\mathbb{Z}{)}^2$, and so to two copies of ${\mu }_m$. Restricting a cocycle to $G_L$ therefore reduces it to two classical Kummer classes unramified outside the primes above $S$. Such a class is represented by $a\in L^{\times }$ satisfyingWrite this power-class group as $L(S_L,m)$. The implication follows locally because, away from residue characteristic dividing $m$, the valuation of an unramified $m$th-root extension must be divisible by $m$.

Its finiteness comes from two standard arithmetic finiteness results, rather than from an assertion that all of $L^{\times }/(L^{\times }{)}^m$ is finite. The valuations outside $S_L$ associate to $a$ an ideal whose $m$th power is principal. There is an exact sequenceThe left group is finite by the finite generation of the S-unit group, and the right group is finite by finiteness of the ideal class group. This proves finiteness of S-unramified Kummer classes. Hence there are only finitely many restricted cocycles over $L$. The kernel of restriction from $K$ is contained in $H^1(\mathrm{Gal}(L/K),E[m])$, which is finite because both group and module are finite. The restricted cohomology group over $K$ is therefore finite, and its injected subgroup $E(K)/mE(K)$ is finite too. This completes a Kummer-theoretic proof of the weak Mordell-Weil theorem.

For arithmetic computation one adds local conditions. The Selmer group of an elliptic curve consists of classes in $H^1(K,E[m])$ whose restriction at every completion $K_v$ lies in the image of the corresponding local Kummer map. They are unramified outside the same finite set, so this group is finite. The failure of a everywhere locally soluble torsor to have a global point is measured by the Tate–Shafarevich group, defined as the kernel of the local restriction map on $H^1(K,E)$. The resulting exact sequence isThus the Selmer group of an elliptic curve gives a computable upper bound for the quotient; actual rational points supply lower bounds. Equality need not follow just from local solubility. Finiteness of this fixed torsion subgroup does not prove finiteness of the whole Tate–Shafarevich group.

Finally, weak finiteness alone is not finite generation: the additive group $\mathbb{Q}$ has trivial quotients by multiplication and is not finitely generated. The additional ingredient for the Mordell-Weil theorem is height descent. Choose representatives $P_i$ of $E(K)/mE(K)$ and write $P=P_i+mQ$. The quadratic growth of the canonical height of an elliptic curve, together with bounds for translation by the finitely many $P_i$, makes $Q$ have smaller height whenever $P$ is sufficiently large. Northcott theorem gives only finitely many points of bounded height, and repeated descent yields a finite generating set. This explains the roles of Kummer theory, local information and heights without conflating the weak and full theorems.

Translate the rational point of order two to $T=(0,0)$ and clear denominators to obtain an integral equationThe two-isogeny formula giveswith $\varphi :E\to E^{\prime }$ and its dual $\hat{\varphi }:E^{\prime }\to E$. One choice of signs isThese extend across their displayed poles as isogenies; their composition is $[2]$ and their kernels are the respective rational points of order two.

The two-isogeny descent maps into square classes areand the analogous map ${\alpha }^{\prime }$ on $E^{\prime }$ uses $a^2-4b$ at its point $(0,0)$. They are homomorphisms, with kernels $\hat{\varphi }(E^{\prime }(\mathbb{Q}))$ and $\varphi (E(\mathbb{Q}))$. For instance the product of the three intersection $x$-coordinates of a chord is the square of its intercept, proving the square-class addition rule; the values at exceptional points come from the same rule or from the divisor $\mathrm{div}(x)=2(T)-2(O)$. This also identifies the maps as the Kummer maps for the two isogenies.

The square-class index formula for two-isogeny descent iswhere $r$ is the rank. To see the torsion correction explicitly, put $T^{\prime }=(0,0)$ on $E^{\prime }$. Factoring multiplication by two givesThe last denominator is $4/|E(\mathbb{Q})[2]|$: $T^{\prime }$ is in $\varphi E$ exactly when the two additional torsion points of an elliptic curve of order two on $E$ are rational. Since $[E:2E]=2^r|E(\mathbb{Q})[2]|$, cancellation gives the formula in both the single and full rational two-torsion cases.

For computing the images, unit square-class bound for two-isogeny descent restricts $\alpha$ to signed squarefree divisors of $b$, and ${\alpha }^{\prime }$ to those of $a^2-4b$. To justify the prime support, negative valuations of a rational $x$-coordinate are even; at a prime not dividing $b$, a positive valuation of $x$ makes $x^2+ax+b$ a unit, so the equation again forces the valuation to be even. A candidate $d$ occurs precisely when the quartic covering in a two-isogeny descenthas a rational point, with the limiting points at $U=0$ or $V=0$ included. Clearing denominators gives integers with $\gcd (U,V)=1$. For $UV\ne 0$, the associated point is $x=d(U/V{)}^2$, $y=dUN/V^3$. Test these finitely many coverings over $\mathbb{R}$ and over relevant ${\mathbb{Q}}_q$ to eliminate impossible classes; surviving locally soluble classes give an upper bound. Finding rational points on them proves membership and often makes the bound exact. Local solubility alone need not prove global solubility, so one must retain the possible Selmer obstruction.

For the illustration takewith $p\equiv 3(\mathrm{mod}8)$. On $E_p$ all possible square classes are $1,-1,p,-p$. They all occur: $O$ supplies $1$ and the three points with $y=0$, at $x=0,p,-p$, supply $-1,p,-p$. Hence $|\alpha (E_p)|=4$.

On $E_p^{\prime }$, a nonzero real point has $X>0$, because $X(X^2+4p^2)=Y^2$. Thus only $d=1,2,p,2p$ need be considered, and $d=1$ occurs already at $O$. The other three classes are excluded as follows.

For $d=p$, the covering is $N^2=p(U^4+4V^4)$. Reducing modulo $p$ forces $p\mid N$ and $U^4+4V^4\equiv 0$. If $V$ were divisible by $p$, then $U$ would be too, contradicting primitivity. Otherwise $(U^2/(2V^2){)}^2\equiv -1(\mathrm{mod}p)$, impossible since $p\equiv 3(\mathrm{mod}4)$. For $d=2p$, the equation is $N^2=2p(U^4+V^4)$, which similarly forces $(U^2/V^2{)}^2\equiv -1(\mathrm{mod}p)$. Thus neither class occurs. These are odd-prime obstructions for the congruent-number isogeny coverings.

For $d=2$, the equation is $N^2=2(U^4+p^2{V}^4)$. If exactly one of $U,V$ is odd, its right side is $2(\mathrm{mod}8)$, not a square. If both are odd, their fourth powers are $1(\mathrm{mod}16)$ and $p^2\equiv 9(\mathrm{mod}16)$; hence the right side is $20(\mathrm{mod}32)$, also not a square. Both even is forbidden by primitivity. This is the modulo-thirty-two obstruction for a congruent-number descent class. Consequently $|{\alpha }^{\prime }(E_p^{\prime })|=1$, and the rank formula givesTo complete the congruent-number conclusion, also determine torsion. At a good prime $q\equiv 3(\mathrm{mod}4)$, the character sum for $x^3-p^{2}x$ cancels in pairs $x,-x$, so $\#E_p({\mathbb{F}}_q)=q+1$. Rational torsion injects into good reduction at every odd prime, by the formal kernel, which is a torsion-free group. If $p\ne 3$, use $q=3,7$ to bound its order by $\gcd (4,8)=4$. If $p=3$, use $q=7,11$, giving $\gcd (8,12)=4$. The three rational points of order two already give four points, so $E_p(\mathbb{Q})\cong (\mathbb{Z}/2\mathbb{Z}{)}^2$. This is rational torsion of a congruent number curve in the present cases.

A congruent number is the positive area of a right triangle with rational side lengths. A point $(x,y)$ on $E_p$ with $y\ne 0$ would give such a triangle with sidesfor which $A^2+B^2=C^2$ and $AB/2=p$. Conversely a rational right triangle of area $p$ gives a point with nonzero $y$, for example $x=p(C+A)/B$, $y=2p^2(C+A)/B^2$. But every rational point on the curve just determined is $O$ or has $y=0$. Every prime $p\equiv 3(\mathrm{mod}8)$ is therefore not a congruent number.

Let $C$ be the projective cubic of a Weierstrass equation of an elliptic curve, allowing its elliptic-curve discriminant to vanish, and let $O=[0:1:0]$. Use only the smooth locus of a variety $C_{\mathrm{sm}}(K)$: the singular point, if present, is excluded. For $P,Q$, intersect their chord with $C$, using the tangent if $P=Q$ and counting intersection multiplicity. If the third intersection is $R$, define $P+Q=-R$, wherein general Weierstrass equation of an elliptic curve coordinates. The line through $R$ and $O$ gives this reflection. A vertical chord gives $P+(-P)=O$, and the tangent at $O$ meets $C$ three times at $O$, so $O$ is the identity. The construction is symmetric in $P,Q$. It stays in the nonsingular locus: a line through a singular point has intersection multiplicity at least two there, and therefore cannot also contain two smooth intersections counted with multiplicity.

For the nonsingular case, prove associativity by transporting a known abelian group law. The Abel-Jacobi map of a genus-one curveis bijective over an algebraic closure. Indeed, the Riemann-Roch theorem in genus one says that every divisor class of degree one has a unique effective representative consisting of one point: existence follows from $\ell (D)=1$, and uniqueness follows because two distinct representatives would produce a degree-one map to the projective line, impossible for a genus one curve. Subtracting $O$ gives the claimed bijection.

Any line section represents the same divisor class as $3O$, including tangencies. Thus $P+Q+R\sim 3O$ as divisors on an algebraic curve, while the vertical line gives $R+(-R)+O\sim 3O$. HenceAddition in the Picard group is associative, soThe chord-and-tangent group law is defined over $K$, so the group operation restricts to the $K$-rational points.

For completeness, a singular Weierstrass equation of an elliptic curve produces the smooth-locus group of a singular Weierstrass cubic, not an elliptic curve. Over an algebraic closure, its normalization of an algebraic curve is the projective line; deleting the two preimages of a nodal crossing gives the multiplicative algebraic group, while deleting the single preimage of a cusp gives the additive group. For example, on $y^2=x^3$, the coordinate $u=x/y$, with $u(O)=0$, makes the smooth-locus law addition. On $y^2=x^2(x+1)$ in characteristic different from two, put $t=y/x$ and $z=(t+1)/(t-1)$, with $z(O)=1$; the chord relation gives $z(P)z(Q)z(R)=1$, so the group law is multiplication of $z$. A nonsplit node gives the corresponding form of the multiplicative algebraic group over $K$. These descriptions also establish the singular-case group laws.

The squares in the finite field ${\mathbb{F}}_7$ are $0,1,2,4$. For $x=0,1,\dots ,6$, the values of $x^3-x+1$ and the numbers of possible $y$ are respectivelyAdding $O$ yields $\#E({\mathbb{F}}_7)=12$. The Trace of Frobenius is $a=8-12=-4$. The trace of the square of an elliptic-curve endomorphism is $a^2-2q=16-14=2$, so the elliptic-curve point count over a finite field givesFor example, this trace identity follows from ${\pi }^2-[a]\pi +[q]=0$ and $\mathrm{tr}[q]=2q$.

One suitable second elliptic curve isHere $4\cdot 3^3+27\cdot 6^2\equiv 2(\mathrm{mod}7)$, so its elliptic-curve discriminant is nonzero. Its complete list of rational points is $O,(3,0),(6,3),(6,4)$, obtained by checking the seven $x$-values. For $P=(6,3)$ the tangent slope is $1$ in ${\mathbb{F}}_7$, and the elliptic-curve addition formula gives $2P=(3,0)$. Consequently $P$ has order four and $E^{\prime }({\mathbb{F}}_7)\cong \mathbb{Z}/4\mathbb{Z}$.

Let $\pi$ denote the Frobenius isogeny of an elliptic curve and write $N=\#E({\mathbb{F}}_q)$. Its degree of an isogeny is $q$. The isogeny of elliptic curves $1-\pi$ has differential equal to the identity because $d\pi =0$, so it is a separable isogeny. Its kernel consists precisely of the rational points fixed by $\pi$, giving

We use the degree parallelogram law for isogenies of elliptic curves, with degree zero assigned to the zero map:One explanation of the first identity is the divisor proof of the degree parallelogram law: on $E\times E$, the zero divisor of $x(P)-x(Q)$ is the sum of the diagonal and the graph of negation, while its pole divisor is twice each coordinate copy of $O$. Pulling the associated line bundle identity back by $(f,g)$ and taking degrees gives the identity, including exceptional cases by the line-bundle formulation. This works for a general Weierstrass equation of an elliptic curve, including characteristic two; $x$ is the quotient coordinate for negation. Polarization therefore makes degree a quadratic form on the endomorphism ring of an elliptic curve.

Set $a=q+1-N$, the Trace of Frobenius. The cross term is determined by $\mathrm{deg}(1-\pi )=1+q-a$, giving, for all integers $m,n$,If $a^2>4q$, the real degree-two polynomial $X^2-aX+q$ is negative on a nonempty open interval. That interval contains a rational $m/n$, contradicting the displayed nonnegativity after multiplication by $n^2$. Thus $a^2\le 4q$. Hasse's bounds areThe argument proves the Hasse theorem for elliptic curves without assuming its bound in advance.

Use the congruent number elliptic curve in the equivalent coordinatesThe rational point $P=(25,100)$ lies on it, since $25^3-225\cdot 25=10000$. By the preceding rational torsion of a congruent number curve result, every rational torsion point of an elliptic curve has $y=0$ or is $O$. Thus $P$ is not a torsion point of an elliptic curve, and its positive multiples give infinitely many distinct rational points with nonzero $y$.

For any such point $(x,y)$, putThe identity $(x^2-225{)}^2+(30x{)}^2=(x^2+225{)}^2$ proves that these positive rational numbers are the sides of a right triangle. Their area isAll three sides are nonzero because a point with $y\ne 0$ has $x\notin \{0,15,-15\}$. For $P$ the construction gives $(a,b,c)=(4,15/2,17/2)$.

It remains to ensure that infinitely many points do not describe only finitely many triangles. Given the ordered positive pair $b,c$, set $r=c/b$. Then $X=|x|$ satisfiesThere are at most two possible $X$, then at most two signs of $x$ and two signs of $y$. Thus each ordered triangle has at most eight preimages; allowing interchange of its legs still gives a finite number. There are infinitely many distinct rational right triangles of area $15$. This is the infinitely many rational right triangles from a nontorsion point principle.

A height function measures arithmetic size, which is what makes an otherwise infinite descent terminate. For a number field $K$, normalize absolute values to extend the standard real and $p$-adic ones, and write $n_v=[K_v:{\mathbb{Q}}_v]$. The logarithmic projective height isThe product formula makes it independent of the chosen homogeneous coordinates, and the local-degree normalization makes it independent of the number field containing them. Over $\mathbb{Q}$, $h([a:b])=\log \max (|a|,|b|)$ for coprime integer coordinates. Set $h_x(P)=h(x(P))$ on an elliptic curve, with $h_x(O)=0$.

Two features are essential. First, the Northcott theorem says that points of bounded projective height and bounded field degree form a finite set. For points on a fixed elliptic curve over $K$, each $x$-coordinate has at most two preimages, so bounded $h_x$ gives finitely many points. Second, a degree-$d$ morphism of the projective line satisfies $h(f(z))=dh(z)+O(1)$, uniformly in $z$. The upper bound comes from evaluating its homogeneous polynomials; for the lower bound, their lack of a common zero gives a resultant identity bounding the input coordinates by the output coordinates at each place. Summing the local bounds gives the asserted uniform constant.

The duplication map on the $x$-line has degree four. Nonsingularity ensures that its numerator and denominator have no common projective zero. ThereforeTelescoping defines the canonical height of an elliptic curveThe error in successive terms is bounded by a geometric series, proving convergence and the uniform bounded difference. It also gives $\hat{h}(2P)=4\hat{h}(P)$ and nonnegativity. The usual addition formula gives the approximate height parallelogram identity for $h_x$; equivalently, the unordered pair of sum and difference on the $x$-line has bidegree $(2,2)$. Applying that identity to $2^{j}P,2^{j}Q$ and passing to the limit givesIn particular $\hat{h}(nP)=n^2\hat{h}(P)$. Its polarization is the canonical height pairing, a positive semidefinite bilinear form even before finite generation has been proved. The Cauchy-Schwarz inequality for this pairing givesAlso $\hat{h}(P)=0$ precisely for torsion points of an elliptic curve: one direction follows from periodic multiples, and in the other direction all multiples have bounded $h_x$, so the Northcott theorem makes two multiples equal. Bounded canonical height of an elliptic curve likewise gives a finite set of $K$-rational points.

Now the Weak Mordell-Weil theorem gives finitely many representatives $R_1,\dots ,R_s$ for $E(K)/2E(K)$. Put $H={\max }_i\hat{h}(R_i)$. Write any point as $P=2Q+R_i$. ThenRepeatedly applying this height descent lemma eventually reaches height at most $H+1$: after $j$ steps the height is at most $H+2^{-j}(\hat{h}(P)-H)$. The set of points with height at most $H+1$ is finite. Reading the relations $P=2Q+R_i$ backwards shows that this finite set together with the $R_i$ generates $E(K)$. ConsequentlyHeights turn weak Mordell-Weil finiteness into the Mordell-Weil theorem. The canonical height pairing subsequently equips the free part with a positive definite quadratic form, useful for bounding searches and measuring independent generators; this interpretation is a consequence of the proof, not an assumption used in the descent.

An isomorphism of schemes over $\mathbb{R}$ induces a bijection on rational points. A real point of this projective plane curve would be represented by a nonzero real triple with $t_0^2+t_1^2+t_2^2=0$. Each summand is nonnegative, so every coordinate would vanish. Thus $X(\mathbb{R})=\varnothing$, whereas $[1:0]\in {\mathbb{P}}^1(\mathbb{R})$. The two real schemes are not isomorphic. The obstruction is the real conic without real rational points; nonsingularity alone does not make a real conic a projective line over its ground field.

For this integral Weierstrass equation of an elliptic curve, computeIf an odd prime divides $m$ or $m^2-1$, then $c_4$ is a unit there and $\Delta$ is not. The j-invariant of an elliptic curve consequently has negative valuation. Since good reduction implies an integral j-invariant, such a prime cannot be a prime of good reduction, regardless of whether the displayed equation is minimal. Conversely, if it divides neither factor, this equation already has unit discriminant.

At five the good possibilities have $m\equiv \pm 2$, so $m^2\equiv 4$. At seven they have $m^2\equiv 2$ or $4$. Direct elliptic-curve point count over a finite field gives the following nonzero ordinates, together with the three zero-ordinate points and $O$:At either prime, torsion-freeness of the formal group over Qp for odd p makes reduction injective on all of $E(\mathbb{Q}{)}_{\mathrm{tors}}$, so its order is at most eight. Using only prime-to-$p$ injectivity here would leave an unjustified possible $p$-primary component.

All three nonzero 2-torsion points $(0,0),(-1,0),(-m^2,0)$ are rational. The rational point $P=(m,m(m+1))$ lies on the curve, since $m(m+1)(m+m^2)=m^2(m+1{)}^2$. For an equation $y^2=x(x^2+ax+b)$ the elliptic-curve addition formula givesHere $a=1+m^2$, $b=m^2$, so $2P=(0,0)$ and $P$ has order four. The point $(-1,0)$ is not in $⟨P⟩$, whose only nonzero point of order two is $(0,0)$. Therefore $P$ and $(-1,0)$ generate a subgroup of order eight isomorphic to $\mathbb{Z}/4\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$. The upper bound proves the rational torsion in the family x times x plus one times x plus m squared:

Galois cohomology and the finite division quotient. Let $K$ be a number field, $G_K=\mathrm{Gal}(\overline{K}/K)$ with its profinite topology, and $M$ a discrete continuous $G_K$-module. Its Galois cohomology is continuous group cohomology. In degrees zero and one,Thus a crossed homomorphism measures the failure of a choice to be Galois-invariant, and changing the choice changes the cocycle by a coboundary. A short exact sequence of such modules gives a long exact sequence in group cohomology. The connecting map sends an invariant element to the cocycle obtained by lifting it and comparing its Galois translates.

For an elliptic curve $E/K$ and $n\ge 2$, multiplication by $n$ is surjective on $E(\overline{K})$ and has kernel $E[n]$. The Kummer exact sequence of an elliptic curve therefore givesExplicitly, choose $nQ=P$ and set $\kappa (P)(\sigma )=\sigma Q-Q$. Replacing $Q$ changes this by a coboundary; replacing $P$ by $P+nR$, $R\in E(K)$, does not change it. If its class is zero, some torsion translate of $Q$ is Galois-invariant, so $P\in nE(K)$. This proves injectivity of the Kummer map of an elliptic curve.

The whole group $H^1(K,E[n])$ need not be finite. The crucial restriction is ramification. Let $S$ contain the finite primes of bad reduction of an elliptic curve and those dividing $n$. At $v\notin S$, good reduction and prime-to-residue-characteristic multiplication imply that every division point of a local point is in an unramified extension, by the formal-group lifting argument. Thus every global Kummer class restricts trivially to inertia there.

Choose a finite Galois extension $L/K$ containing $E[n]$ and the $n$th roots of unity, and enlarge $S$ to include its ramified primes. Over $L$, the torsion module is constant and can be identified with ${\mu }_n^2$. By Kummer theory,For classes unramified outside the primes $S_L$ above $S$, valuations outside $S_L$ must be divisible by $n$. Their restriction images therefore lie in $L(S_L,n{)}^2$, the square of an S-unramified power class group. Its finiteness can be seen without assuming the Mordell-Weil theorem: the finiteness of S-unramified Kummer classes follows fromThe S-unit group is finitely generated by the Dirichlet unit theorem and its valuations at $S_L$. The localized ideal class group is a quotient of the ordinary ideal class group of $L$, which is finite by the finiteness of the ideal class group. The Minkowski bound for ideal classes supplies an integral ideal of bounded norm in each class, and only finitely many integral ideals have bounded norm.

The kernel of restriction from $H^1(K,E[n])$ to $H^1(L,E[n])$ is also finite: a cocycle trivial after restriction can, after subtracting a coboundary, be made to factor through the finite group $\mathrm{Gal}(L/K)$. There are only finitely many maps from that group to the finite module $E[n]$. This is the finite-extension kernel of a Kummer map mechanism. Consequently the possible Kummer classes form a finite set, provingThis is the Weak Mordell-Weil theorem. Imposing membership in the local Kummer image at every place refines the finite unramified collection to the n-Selmer group. Its relation with the obstruction to a globally rational point iswhere the last group is the $n$-torsion of the Tate–Shafarevich group. Thus local solubility gives a finite computable upper bound but can leave a genuine global obstruction.