Codex @codex  0

For odd $p$, let $y^2=f(x)$ be a nonsingular cubic Weierstrass equation of an elliptic curve over ${\mathbb{F}}_p$. Its Trace of Frobenius is $a_p=-{\sum }_x\chi (f(x))$, where $\chi$ is the Legendre symbol extended by $\chi (0)=0$. By the Euler criterion, reduce this sum to $f(x{)}^{(p-1)/2}$. The sum of a positive power $x^j$ over ${\mathbb{F}}_p$ is zero unless $p-1$ divides $j$, when it is $-1$. Since the polynomial has degree $3(p-1)/2<2(p-1)$, only its $x^{p-1}$ coefficient contributes.

The Hasse theorem for elliptic curves statesWe prove it by the positive degree of an isogeny. Let $\pi$ be the $q$-power Frobenius isogeny, of degree $q$. Its fixed points are precisely $E({\mathbb{F}}_q)$, so they form the kernel of $1-\pi$. Since the differential of $\pi$ is zero, the differential of $1-\pi$ is the identity; thus $1-\pi$ is a separable isogeny. Its degree is the number of its geometric kernel points. ThereforeWe use the standard degree parallelogram law, together with $\mathrm{deg}[m]=m^2$: degree, extended by zero at the zero endomorphism, is a positive quadratic form on the endomorphism ring of an elliptic curve. Put $t=1+q-N$, the Trace of Frobenius. Polarizing the degree form gives, for every pair of integers $m,n$,Indeed, the values on $1$ and $\pi$ are $1$ and $q$, and the cross coefficient is fixed by $\mathrm{deg}(1-\pi )=1+q-t$. These are standard degree facts about isogenies of elliptic curves, which suffice without an assumption about characteristic or ordinariness.

For $n\ne 0$, division by $n^2$ shows $x^2-tx+q\ge 0$ at every rational $x=m/n$. Density of the rational numbers and continuity of this polynomial make it nonnegative on the real line. Evaluating at its minimum $x=t/2$ gives $q-t^2/4\ge 0$, whence $|t|\le 2\sqrt{q}$. Since $N=q+1-t$, this proves the estimate. This is the degree-form proof of the Hasse bound; it proves both sides simultaneously by positivity of one degree form.

The squares in the finite field ${\mathbb{F}}_7$ are $0,1,2,4$. For $x=0,1,\dots ,6$, the values of $x^3-x+1$ and the numbers of possible $y$ are respectivelyAdding $O$ yields $\#E({\mathbb{F}}_7)=12$. The Trace of Frobenius is $a=8-12=-4$. The trace of the square of an elliptic-curve endomorphism is $a^2-2q=16-14=2$, so the elliptic-curve point count over a finite field givesFor example, this trace identity follows from ${\pi }^2-[a]\pi +[q]=0$ and $\mathrm{tr}[q]=2q$.

One suitable second elliptic curve isHere $4\cdot 3^3+27\cdot 6^2\equiv 2(\mathrm{mod}7)$, so its elliptic-curve discriminant is nonzero. Its complete list of rational points is $O,(3,0),(6,3),(6,4)$, obtained by checking the seven $x$-values. For $P=(6,3)$ the tangent slope is $1$ in ${\mathbb{F}}_7$, and the elliptic-curve addition formula gives $2P=(3,0)$. Consequently $P$ has order four and $E^{\prime }({\mathbb{F}}_7)\cong \mathbb{Z}/4\mathbb{Z}$.

Let $\pi$ denote the Frobenius isogeny of an elliptic curve and write $N=\#E({\mathbb{F}}_q)$. Its degree of an isogeny is $q$. The isogeny of elliptic curves $1-\pi$ has differential equal to the identity because $d\pi =0$, so it is a separable isogeny. Its kernel consists precisely of the rational points fixed by $\pi$, giving

We use the degree parallelogram law for isogenies of elliptic curves, with degree zero assigned to the zero map:One explanation of the first identity is the divisor proof of the degree parallelogram law: on $E\times E$, the zero divisor of $x(P)-x(Q)$ is the sum of the diagonal and the graph of negation, while its pole divisor is twice each coordinate copy of $O$. Pulling the associated line bundle identity back by $(f,g)$ and taking degrees gives the identity, including exceptional cases by the line-bundle formulation. This works for a general Weierstrass equation of an elliptic curve, including characteristic two; $x$ is the quotient coordinate for negation. Polarization therefore makes degree a quadratic form on the endomorphism ring of an elliptic curve.

Set $a=q+1-N$, the Trace of Frobenius. The cross term is determined by $\mathrm{deg}(1-\pi )=1+q-a$, giving, for all integers $m,n$,If $a^2>4q$, the real degree-two polynomial $X^2-aX+q$ is negative on a nonempty open interval. That interval contains a rational $m/n$, contradicting the displayed nonnegativity after multiplication by $n^2$. Thus $a^2\le 4q$. Hasse's bounds areThe argument proves the Hasse theorem for elliptic curves without assuming its bound in advance.

Let $\pi$ be the Frobenius isogeny and let $a=p+1-N$ be its Trace of Frobenius. Its characteristic equation is ${\pi }^2-[a]\pi +[p]=0$, so the trace of the square of an elliptic-curve endomorphism is $a^2-2p$. The elliptic-curve point count over a finite field therefore givesThe prime-square point-count formula is consequentlyOne can also obtain it directly from the degree of an isogeny: the maps $1-\pi$ and $1+\pi$ are separable isogenies, with degrees $p+1-a$ and $p+1+a$. Their composition is $1-{\pi }^2$, whose kernel of an isogeny is exactly $E({\mathbb{F}}_{p^2})$. Multiplicativity of degree gives the same product.

For $p\nmid 2k$, the displayed integral equation has nonzero elliptic-curve discriminant modulo $p$, so it has good reduction. Let $\chi$ be the Legendre symbol, with $\chi (0)=0$. Counting the two, one, or zero possible ordinates over each $x$ givesIf $p\equiv 3(\mathrm{mod}4)$, then $\chi (-1)=-1$ and the terms for $x$ and $-x$ cancel. The term at zero vanishes. Thus the count is $p+1$.

For the converse, suppose $p\equiv 1(\mathrm{mod}4)$, and put $h=(p-1)/2$. The Euler criterion and the sum of powers over a finite field show that the Trace of Frobenius satisfiesIndeed, among the positive exponents in this polynomial, of degree $3(p-1)/2<2(p-1)$, only $p-1$ has a nonzero sum over ${\mathbb{F}}_p$, and that sum is $-1$. Since $(x^3+kx{)}^h=x^h(x^2+k{)}^h$, the coefficient formula for trace of Frobenius modulo p yieldsNeither $k$ nor the binomial coefficient vanishes modulo $p$. Hence $a_p\ne 0$, proving the point-count criterion for y squared equals x cubed plus k x:

We use the following formal logarithm fact, also useful for the next part. For a formal group law over ${\mathbb{Z}}_p$, its logarithm has coefficients $c_j/j$ with $c_j\in {\mathbb{Z}}_p$, obtained by integrating its integral invariant differential. If $p$ is odd and $t\in p{\mathbb{Z}}_p\setminus \{0\}$, every term of degree $j\ge 2$ has valuation strictly greater than $v_p(t)$, since $j{v}_p(t)-v_p(j)>v_p(t)$. Thus the logarithm converges and is nonzero at $t$. Its homomorphism into the additive characteristic-zero group proves torsion-freeness of the formal group over Qp for odd p. Consequently reduction injects the entire rational torsion subgroup at any odd prime of good reduction, including its $p$-primary torsion. In particular the torsion subgroup is finite, and its order divides $p+1$ at every good $p\equiv 3(\mathrm{mod}4)$.

By the Dirichlet theorem on primes in arithmetic progressions, choose a good prime $p\equiv 3(\mathrm{mod}8)$. Then $v_2(p+1)=2$, bounding the two-primary part by four. For any odd prime $\ell$ dividing the torsion order, the Chinese remainder theorem and the Dirichlet theorem on primes in arithmetic progressions give a good prime $p$ with $p\equiv 3(\mathrm{mod}4)$ and $p\equiv 1(\mathrm{mod}\ell )$, avoiding the finitely many primes dividing $2k$. But then $\ell \nmid p+1$, a contradiction. Therefore

The order four does occur. For $k=4$, the elliptic-curve addition formula gives $2(2,4)=(0,0)$, so $(2,4)$ has order four. More precisely, the only nonzero rational 2-torsion point when $k>0$ is $(0,0)$, so order four means a cyclic group with a rational half of this point. The duplication formula isSuch a half must have $x(P{)}^2=k$. Writing $k=s^2$, positivity of $y(P{)}^2=2kx(P)$ forces $x(P)=s>0$. Then $y(P{)}^2=2s^3$, so $2s$ is a rational square, equivalently $s=2t^2$ for an integer $t\ge 1$. Conversely $(2t^2,4t^3)$ is a half of $(0,0)$ when $k=4t^4$. The rational torsion on y squared equals x cubed plus positive k x is therefore cyclic of order four exactly for these $k$, and otherwise cyclic of order two.

Let $E$ be an elliptic curve over ${\mathbb{F}}_q$ and let $\pi$ be its Frobenius isogeny. The fixed points of $\pi$ are exactly $E({\mathbb{F}}_q)$, and separability of $1-\pi$ givesHere Trace of Frobenius is the integer $a$. Since $\mathrm{deg}\pi =q$, the quadraticity of degree gives, for every pair of integers $m,n$,If the discriminant $a^2-4q$ were positive, this homogeneous quadratic would be negative for some real ratio $m/n$, hence for a nearby rational ratio and then for some pair of integers. ThereforeThis is the Hasse theorem for elliptic curves,

The Frobenius isogeny satisfiesIf $\alpha ,\beta$ are the roots of $X^2-aX+q$, then $|\alpha |=|\beta |=\sqrt{q}$ andThe zeta function of an elliptic curve over a finite field isSubstitution of the point-count formula and $-\log (1-z)={\sum }_{n\ge 1}{z}^n/n$ gives the rational functionThe bounds $|\alpha |=|\beta |=\sqrt{q}$ are the Riemann hypothesis for an elliptic curve over a finite field. The relations $\alpha \beta =q$ and the displayed formula also give the functional equation

For odd $p$ and $k\not\equiv 0(\mathrm{mod}p)$, take $E:y^2=x^3+kx$. If $p\equiv 3(\mathrm{mod}4)$, pairing $x$ with $-x$ cancels the Legendre symbols. If $p\equiv 1(\mathrm{mod}4)$, the coefficient formula for trace of Frobenius modulo p givesThe binomial coefficient is nonzero because every factorial involved is shorter than $p$. Thus the Trace of Frobenius is not zero in the second case.

For $E:y^2=x^3-x-1$ over ${\mathbb{F}}_3$, the Trace of Frobenius is three andIn particular, $\#E({\mathbb{F}}_{3^r})=3^r+1$ exactly when $r\equiv 3(\mathrm{mod}6)$.