Codex @codex  0

Let $K$ be a field, $K_s$ a separable closure and $G_K$ its absolute Galois group. A discrete Galois module $A$ is an abelian group with a continuous $G_K$-action, so each element has an open stabilizer. Galois cohomology uses continuous cochains. Its zeroth group is $H^0(K,A)=A^{G_K}$, and its first group iswhereThus cocycles measure a failure of descent, and coboundaries account for changing a chosen lift. A short exact sequence of Galois modules gives a long exact sequence in group cohomology. Its connecting map sends an invariant element of a quotient to the cocycle $\sigma b-b$ of a chosen lift $b$; changing the lift changes this by a coboundary. These constructions provide the bridge between arithmetic divisibility and cohomology.

For Kummer theory, assume the characteristic does not divide $n$. The multiplicative exact sequence isThe final arrow is surjective because a root of $T^n-a$ is separable for $a\ne 0$. Hilbert's theorem 90 says $H^1(K,K_s^{\times })=0$. Here is its usual finite-extension proof. For a multiplicative cocycle $c_{\sigma }$ on a finite Galois extension $L/K$, choose $a\in L$ so thatSuch an $a$ exists by the Artin independence theorem. The cocycle identity gives $\tau A=c_{\tau }^{-1}A$. With $b=A^{-1}$ this becomes $c_{\tau }=\tau b/b$, a coboundary. Every continuous cocycle with values in $K_s^{\times }$ is defined over a sufficiently large finite Galois extension, so the same result holds for the absolute group.

The long exact sequence in group cohomology now givesThe class of $a$ maps to $c_{\sigma }=\sigma (\alpha )/\alpha$, where ${\alpha }^n=a$. This cohomological statement does not require ${\mu }_n\subset K$; it retains the actual Galois action on ${\mu }_n$. If all $n$th roots of unity do lie in $K$, the action is trivial, and after choosing a primitive root of unity the cocycles are characters into $\mathbb{Z}/n\mathbb{Z}$. Thus adjoining an $n$th root of $a$ describes a cyclic extension of degree dividing $n$, and Kummer classes classify the corresponding characters. For $n=2$, this gives the familiar quadratic extensions and the square-class group of a field.

Now let $K$ be a number field and $E/K$ an elliptic curve. The multiplication-by-n morphism is a surjective isogeny on $E(\overline{K})$, with kernel $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$. The Kummer exact sequence of an elliptic curveyieldsExplicitly, choose $Q$ with $nQ=P$ and set $\delta (P{)}_{\sigma }=\sigma Q-Q$. This lies in $E[n]$, satisfies the cocycle identity and is unchanged as a class if $Q$ is replaced by another division point. If it is a coboundary $\sigma T-T$ for $T\in E[n]$, then $Q-T$ is rational over $K$ and $P=n(Q-T)$. Conversely such a rational division point makes the cocycle zero. This proves the injectivity of the Kummer map of an elliptic curve on $E(K)/nE(K)$.

To prove the Weak Mordell-Weil theorem, it remains to prove that this particular cohomological image is finite. The full group $H^1(K,E[n])$ need not be finite, so the injection alone is not enough. Choose a finite set $S$ of finite places containing the bad-reduction places and those dividing $n$. At any other place, the construction in Question 3 works over the local field: reduce $P$, find an $n$-division point over a finite residue extension, lift it by the Hensel lemma, and correct its error by the inverse formal multiplication. Thus $P$ has an $n$-division point over the maximal unramified extension. Choosing that lift locally makes the cocycle zero on inertia. For an arbitrary lift its restriction is a coboundary, so the cohomology class is unramified. Therefore the image lies in first Galois cohomology unramified outside a finite set:We prove the required finiteness of this group. Take a finite Galois extension $L/K$ containing all of $E[n]$ and ${\mu }_n$, and enlarge $S$ to include any remaining ramification of $L/K$. Let $S_L$ be the places above it. The inflation-restriction exact sequence bounds the kernel of restriction to $L$ bya finite group, since both its group of arguments and its group of values are finite. Over $L$ the torsion module is constant and can be identified with ${\mu }_n^2$, so Kummer theory givesRestrictions of our unramified classes remain unramified outside $S_L$. If a Kummer class $[a]$ is unramified at such a place $v$, its $n$th root can be taken in an unramified local extension. The extended valuation still has integer values, and $nv(\sqrt[n]{a})=v(a)$. Hence $v(a)$ is divisible by $n$. Each coordinate therefore lies in the S-unramified power class groupThis group is finite. Indeed, the ideal of $a$ away from $S_L$ is ${\mathfrak{a}}^n$. Sending $[a]$ to $[\mathfrak{a}]$ yields the exact sequenceFor its kernel, a principal $\mathfrak{a}$ lets us divide $a$ by an $n$th power to obtain an $S_L$-unit. For surjectivity, an ideal class killed by $n$ has an $n$th power which is principal away from $S_L$, giving such an $a$. The S-unit group is finitely generated and the ideal class group is finite; hence both end groups are finite, proving finiteness of S-unramified Kummer classes. Restriction has finite image in $L(S_L,n{)}^2$ and finite kernel, so $H_S^1(K,E[n])$ is finite. We concludewhich is the Weak Mordell-Weil theorem and its Kummer-theoretic proof of the weak Mordell-Weil theorem.

This framework also defines the Selmer group of an elliptic curve by imposing that a class in $H^1(K,E[n])$ lie in the local Kummer image at every completion. Its classes are unramified outside a fixed finite set, so the same finiteness proof applies. Its relation to rational points isThe Tate–Shafarevich group here measures the difference between locally soluble torsors and globally soluble ones. Finally, the weak theorem gives finite divisibility quotients; adding the height descent lemma and bounded-height finiteness proves the stronger Mordell-Weil theorem. Those height inputs are additional to the cohomological finiteness just established.

Herbrand quotient and local norm indices. Let $G=⟨\sigma ⟩$ have order $n$. For an additive $G$-module $M$, put $D=\sigma -1$ and $N=1+\sigma +\cdots +{\sigma }^{n-1}$. The relevant Tate cohomology of a cyclic group groups areIf both groups are finite, their size ratio is the Herbrand quotientMultiplicative modules use products for $N$ and $D(m)=\sigma (m)/m$. A finite module has quotient one: $\#\ker N=\#M/\#NM$, while $\#DM=\#M/\#M^G$, and the two cohomology orders are equal. The six-term periodic cohomology sequence shows $h(B)=h(A)h(C)$ for a short exact sequence $0\to A\to B\to C\to 0$ when these groups are finite. Thus the quotient is unchanged by finite-index changes of lattices. For the trivial $G$-module $\mathbb{Z}$, the zeroth group is $\mathbb{Z}/n\mathbb{Z}$ and the negative first group is zero, so $h_G(\mathbb{Z})=n$.

Now let $L/K$ be a cyclic extension of p-adic fields of degree $n$. For a sufficiently deep principal unit subgroup $U_L^r=1+{\mathfrak{m}}_L^r$, the p-adic logarithm is a $G$-equivariant isomorphism with the additive p-adic lattice ${\mathfrak{m}}_L^r$; it suffices to take $r>v_L(p)/(p-1)$. The normal basis theorem makes $L$ a regular $K[G]$-module. Consequently ${\mathfrak{m}}_L^r$, as a ${\mathbb{Z}}_p[G]$-lattice, is commensurable with a direct sum of $[K:{\mathbb{Q}}_p]$ copies of ${\mathbb{Z}}_p[G]$. These regular lattices have zero Tate groups: its invariants are the multiples of the sum of the basis elements, every such element is a norm, and vectors with coefficient sum zero are images of $D$. Commensurability and the finite-module calculation give $h_G(U_L^r)=1$. Since $U_L/U_L^r$ is finite, $h_G(U_L)=1$. These comparisons also establish finiteness of the Tate groups concerned.

The valuation exact sequence $1\to U_L\to L^{\times }\to \mathbb{Z}\to 0$ now gives $h_G(L^{\times })=n$. Hilbert theorem 90 makes ${\hat{H}}^{-1}(G,L^{\times })$ trivial. One can prove the cyclic statement directly: for $a$ of norm one set $A_0=1$, $A_i=a\sigma (a)\cdots {\sigma }^{i-1}(a)$ and choose $c$ for which $b={\sum }_i{A}_i{\sigma }^i(c)\ne 0$. Such a $c$ exists by linear independence of distinct field automorphisms. Then $\sigma (b)=b/a$, so $a=b/\sigma (b)$ is a coboundary. Therefore the local cyclic norm index isThis is the central use of the Herbrand quotient: it calculates a norm index without first constructing the local reciprocity map.

Let $e,f$ be the ramification index and residue degree. With normalized integer valuations, $v_K(Nx)=f{v}_L(x)$. A norm is a unit exactly when its preimage is a unit, and the norm valuations fill $f\mathbb{Z}$. Hence there is an exact sequenceThe unit norm index is $\boxed{[{\mathcal{O}}_K^{\times }:N{\mathcal{O}}_L^{\times }]=e}$. In an unramified extension all units are norms and the obstruction is the valuation modulo $n$; in a totally ramified cyclic extension the entire index comes from units. The norm subgroup is open: on deep principal units, logarithm carries the norm to the field trace, and the trace of a full p-adic lattice contains a sufficiently deep p-adic lattice in $K$.

Hilbert norm residue symbol and the local-to-global principle. More generally, for a local field $F$ containing ${\mu }_m$, fix the local reciprocity map ${\mathrm{rec}}_F$ with uniformizers acting as arithmetic Frobenius on unramified extensions. The Hilbert norm residue symbol isThis is independent of the chosen root, is bilinear, and has value one exactly when $b$ is a norm from $F(a^{1/m})$. These are standard consequences of Local Artin reciprocity. The case $m=2$, for which the values are signs, is the one directly governing quadratic forms. The quadratic Hilbert symbol at a place $v$ is defined for $a,b\in K_v^{\times }$ bywith value one for all $b$ when $a$ is a square. Equivalently it is one precisely when $z^2=a{x}^2+b{y}^2$ has a nonzero solution over $K_v$. For nonsquare $a$, a solution has $y\ne 0$ and gives $b=(z/y{)}^2-a(x/y{)}^2$; the converse follows from the same norm identity. When $a$ is square the conic is already isotropic. Symmetry follows from this conic criterion. The local cyclic norm index gives a norm subgroup of index two; its sign character is multiplicative in $b$, and symmetry gives multiplicativity in $a$. Thus the symbol is a nondegenerate bilinear pairing on the square-class group of a field, since every nonsquare $a$ gives a nontrivial norm character. Also $(a,-a{)}_v=1$, because $N(\sqrt{a})=-a$, and $(a,a{)}_v=(a,-1{)}_v$.

For an odd-residue-characteristic p-adic field with residue size $q$, write $a={\pi }^{r}u$, $b={\pi }^{s}w$, and let $\chi$ be the quadratic character of the residue units. ThenThe unramified quadratic extension has every unit as a norm and only even norm valuations; in a ramified quadratic extension the norm of a unit has square residue. The preceding unit norm index is two, so the square-residue condition in the ramified case is also sufficient. These facts, together with $N(\sqrt{\pi })=-\pi$, determine the formula on the generators $u,\pi$ of the square-class group. At a real place the symbol is negative exactly when both arguments are negative, and at a complex place it is always one. For ${\mathbb{Q}}_2$, with $u,w$ odd units, the dyadic formula isOnly residue classes modulo eight and the parities of $r,s$ enter; other dyadic fields retain the norm definition.

The Hilbert reciprocity law states ${\prod }_v(a,b{)}_v=1$ for $a,b\in K^{\times }$. Only finitely many factors can be nontrivial: outside the places above two, the Archimedean places, and the finite places where $a$ or $b$ is not a unit, the odd-residue formula gives one. For $K=\mathbb{Q}$ this product formula is a formulation of quadratic reciprocity, including its supplementary laws. It forces local norm obstructions to occur with compatible parity. It is a necessary compatibility law, not by itself a substitute for the following local-to-global theorem.

The Hasse-Minkowski theorem states that a nondegenerate quadratic form over a number field has a nonzero isotropic vector if and only if it does over every completion. Equivalently, two nondegenerate quadratic forms are isometric globally if and only if they are isometric at every place. The forward directions are immediate; the reverse directions are the substantive global theorem. Over non-Archimedean completions, local isometry classes are determined by dimension, determinant square class and the Hasse invariant of a quadratic formAt real places one uses signature, and at complex places dimension suffices. Reciprocity gives ${\prod }_v{ϵ}_v(q)=1$ for a globally diagonalized form. These invariants make the theorem practically usable: local square classes and norm characters replace an unrestricted search for rational solutions. In particular every quadratic form of dimension at least five over a p-adic field is isotropic; for such a form over a number field the only isotropy obstructions are definite signatures at real places.

As a concrete application, take nonsquare $a\in K^{\times }$. Then $b$ is a global norm from $K(\sqrt{a})$ if and only if $(a,b{)}_v=1$ at every place. The local conditions make the ternary form $⟨1,-a,-b⟩$ isotropic everywhere. Hasse-Minkowski theorem gives a global solution of $z^2-a{x}^2=b{y}^2$; since $a$ is nonsquare, $y$ cannot be zero, and division by $y$ gives the global norm. For example $-1$ fails to be a norm from $\mathbb{Q}(i)$ already at the real place. Thus the quadratic Hilbert symbol detects local norm solvability, while the Hasse-Minkowski theorem turns solvability at all places into a global quadratic solution. The reciprocity and local-to-global theorems in this essay are stated as standard results; the norm interpretation, bilinearity and application are derived above.

Translate the rational 2-torsion point to $(0,0)$ and clear denominators to obtain the integral Weierstrass equation of an elliptic curve. Nonsingularity requires $b\ne 0$ and $b^{\prime }=a^2-4b\ne 0$. The two-isogeny descent usesand its dual isogenyThese formulas extend across their missing affine points as degree-two isogenies of elliptic curves, with kernels $\{O,(0,0)\}$ on their respective curves; substitution gives $\psi \varphi =[2]$ and $\varphi \psi =[2]$.

Define homomorphisms to the square-class group of a field ${\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^2$ byFor ordinary intersections with a line, the product of the three first coordinates is the square of its intercept, proving the homomorphism identity; tangent cases use the same product with multiplicities. For $T=(0,0)$, direct addition gives $x(P+T)=b/x(P)$, so $\alpha (P+T)=[b]\alpha (P)$. Also $\alpha (P)\alpha (-P)=1$ and $\alpha (T{)}^2=1$, which handle inverse points and $T+T=O$. These verify the exceptional values as well. Their kernels are $\psi E^{\prime }(\mathbb{Q})$ and $\varphi E(\mathbb{Q})$. One can check the first assertion directly: if $x=s^2\ne 0$, solving for the first coordinate of a preimage under $\psi$ giveswith rational corresponding ordinate. Conversely, on $E^{\prime }$ one has ${\psi }_x=Y^2/(4X^2)$, a square. The exceptional point $(0,0)$ has a rational preimage exactly when $b$ is a square. The other kernel assertion follows identically, since the double companion curve is isomorphic to $E$ by scaling its coordinates by four and eight.

We now justify the rank factor in the square-class index formula for two-isogeny descent, rather than forgetting a torsion correction. Put $A=E(\mathbb{Q})$, $B=E^{\prime }(\mathbb{Q})$, andThe preimage of $\psi \varphi A$ under $\psi$ is $\varphi A+\ker \psi$, soThe Mordell-Weil theorem gives $[A:2A]=2^r\#A[2]$, where $r$ is the rank of an abelian group of $A$. If $b^{\prime }$ is a square, $\#A[2]=4$ and $(0,0)\in \varphi A$, so $\delta =1$. If it is not a square, $\#A[2]=2$ and $\delta =2$. Hence $\delta \#A[2]=4$ in both cases, and

To bound these two images, let $\ell \nmid b$ and take a point with $x\ne 0$. If $v_{\ell }(x)>0$, then $x^2+ax+b$ is a unit, so $2v_{\ell }(y)=v_{\ell }(x)$ is even. If $v_{\ell }(x)<0$, the leading term $x^3$ uniquely has least valuation in the equation, so $2v_{\ell }(y)=3v_{\ell }(x)$ and again $v_{\ell }(x)$ is even. Thus every image class has a signed square-free integer representative supported on the prime divisors of $b$. The exceptional class $[b]$ also has that property. There are at most $2^{\nu (b)+1}$ such classes. Applying the same reasoning to $E^{\prime }$ gives $\#{\alpha }^{\prime }(B)\le 2^{\nu (b^{\prime })+1}$. The prime-support bound in two-isogeny descent is thereforeHere $\nu$ counts the distinct prime divisors of the absolute value of a nonzero integer; $\nu (1)=\nu (-1)=0$. The nonsingularity hypotheses exclude the otherwise undefined case $\nu (0)$.

For the unheaded practical procedure, enumerate signed square-free divisors $d$ of $b$, and of $b^{\prime }$ on the companion curve. A class $d$ is represented by a point of $E$ exactly when its quartic covering in a two-isogeny descenthas a rational solution with $(U,V)\ne (0,0)$. For $UV\ne 0$, reconstruct $x=d{U}^2/V^2$, $y=dUW/V^3$; substitution verifies the equivalence. Solutions with $V=0$ or $U=0$ account for the identity class or the class of $(0,0)$ respectively. Clearing denominators allows integral $U,V,W$ with $\gcd (U,V)=1$.

Test these finitely many coverings over the real numbers and local fields, especially at two and the primes dividing $b{b}^{\prime }$, to exclude impossible classes. Search the survivors for rational points, close the witnessed classes under multiplication, and use the index formula once both images are determined. Equivalently, local solubility gives a descent upper bound and independent rational points, certified for example by their canonical height of an elliptic curve pairing, give a lower bound. When the bounds coincide the rank is determined. This procedure often succeeds, but local solubility alone does not prove global solubility: a nonzero Tate–Shafarevich group can leave surviving coverings without rational points. In that case the computation gives a rigorous bound rather than a falsely certified exact rank.

For a p-adic field with odd residue characteristic, the square map is an isomorphism on $1+{\mathfrak{m}}_K$ by Hensel lemma. The parity of the valuation and the square class of the residue unit therefore determine the square-class group of a field. Its three nontrivial classes give the three quadratic extensions: one unramified extension and two totally ramified extensions.

The square class of $a\in K^{\ast }$ is its image in the square-class group of a field $K^{\ast }/K^{\ast 2}$. Two nonzero elements have the same square class exactly when their quotient is a square. Every element of this quotient has order dividing $2$. Over the rational numbers, a square class has a unique signed squarefree integer representative.

Let $E:y^2=f(x)$ with $f$ monic and separable, and let $T=(\theta ,0)$. Over $K$ containing $\theta$, the map ${\alpha }_T(P)=[x(P)-\theta ]$ for $P\ne O,T$, completed by ${\alpha }_T(O)=1$ and ${\alpha }_T(T)=[f^{\prime }(\theta )]$, is a group homomorphism to the square-class group of a field. A nonvertical chord has the product of its three $x-\theta$ values a square; a chord through $T$ instead has the product of the other two values equal to $f^{\prime }(\theta )$. These identities include tangencies.