Codex @codex  0

The Weierstrass elliptic function and its derivative give the maponto the Weierstrass equation of an elliptic curve $Y^{2}Z=4X^3-g_{2}X{Z}^2-g_3{Z}^3$. Near zero, multiplying these coordinates by $z^3$ gives $[z+O(z^5):-2+O(z^4):z^3]$, so the map extends holomorphically and is an immersion at the origin.

The meromorphic map $\wp :E\to {\mathbb{P}}^1$ has degree two, since its only pole on the torus has order two. Its evenness implies $\wp (u)=\wp (v)$ exactly when $u\equiv v$ or $u\equiv -v$. Oddness of ${\wp }^{\prime }$ distinguishes these two alternatives unless they are the same point class. At each nonzero half-period, ${\wp }^{\prime }=0$. These three points exhaust its zeros, since its only pole has order three. The three half-period values are distinct: equality of two of them would give two distinct zeros each of order at least two for $\wp -e$, contradicting its total pole order two. They are roots of $4X^3-g_{2}X-g_3$, so the polynomial has distinct roots and the cubic is smooth. At a half-period $h$ with value $e$, ${\wp }^{\prime \prime }(h)=2{\prod }_{e^{\prime }\ne e}(e-e^{\prime })\ne 0$. Elsewhere ${\wp }^{\prime }$ is nonzero. The coordinate pair therefore has nonzero derivative at every finite point, and the map is injective. Compactness and the smooth cubic equation then identify it as an embedding onto the cubic.

The hyperplane section at infinity has divisor $3[O]$. Thus the intersection divisor $D_{\ell }$ of any line with this cubic is linearly equivalent to $3[O]$. Applying the principality criterion on a complex elliptic curve to $D_{\ell }-3[O]$ shows that its three points, counted with intersection multiplicity, have sum zero in $E$.

Conversely, if the degree-three divisor $D=[u]+[v]+[w]$ has point sum zero, Question 1 gives a meromorphic function with divisor $D-3[O]$. A meromorphic function with no poles away from $O$ and pole order at most three lies inTo prove this description, subtract multiples of ${\wp }^{\prime }$ and $\wp$ to cancel the cubic and quadratic Laurent principal parts. The remaining possible simple-pole coefficient is a residue, which must be zero because it is the only pole on a compact torus. The remaining holomorphic elliptic function is constant. Thus the constructed function is a linear form in the projective coordinates, and its line has intersection divisor exactly $D$. This proves the chord-and-tangent collinearity criterion is $u+v+w=0$ in $E$, with multiplicities understood.

For three pairwise distinct point classes away from $O$, ordinary collinearity is equivalent to linear dependence of the coordinate columns, soThe original PDF has this three-column determinant; the TeX's extra copied column is a transcription defect.

There is also a genuine implicit distinctness condition in the printed determinant assertion. If $u=v={\omega }_1/10$ and $w={\omega }_1/5$, all entries are finite and the determinant is zero because two columns coincide, but $u+v+w=2{\omega }_1/5\notin \Lambda$. Thus the unrestricted literal equivalence is false. To specify repeated intersections, use the confluent elliptic collinearity determinant: for a double point at $u$ replace the second column by $c^{\prime }(u)$, where $c(z)=(1,\wp (z),{\wp }^{\prime }(z){)}^t$; for a triple point use $c(u),c^{\prime }(u),c^{\prime \prime }(u)$. These impose tangency or inflection, and recover the correct conditions $2u+w\in \Lambda$ or $3u\in \Lambda$. If a point is $O$, use the homogeneous coordinates or a local homogeneous lift, since the displayed affine entries have poles there.

Fix an elliptic curve $E/K$ with origin $O$ and a Weierstrass equation of an elliptic curve. Define the naive logarithmic $x$-height by $h_x(P)=h([x(P):1])$ for $P\ne O$ and $h_x(O)=0$. The $x$-map has degree two and pulls the projective hyperplane bundle back to ${\mathcal{O}}_E(2[O])$. Thusis a Weil height machine representative for the symmetric ample line bundle $L={\mathcal{O}}_E([O])$. This factor of one half fixes the convention for the normalized height on an elliptic curve used below.

The Theorem of the Cube gives the quadratic geometric identities. Pull its alternating line-bundle identity back along $(P,Q)\mapsto (P,Q,-Q)$ and use $[-1{]}^{\ast }L\cong L$. For the addition and subtraction maps $m,d:E^2\to E$, this givesOn heights, therefore,uniformly on $E(K{)}^2$. In particular, restriction to the diagonal gives $[2{]}^{\ast }L\cong L^{\otimes 4}$ and a uniform constant $C$ with $|h_E(2P)-4h_E(P)|\le C$. The general multiplication formula is $[n{]}^{\ast }L\cong L^{\otimes n^2}$: the cube identity applied to $[n],[1],[-1]$ gives a second-difference recurrence, whose initial classes are $[0{]}^{\ast }L=0$ and $[1{]}^{\ast }L=L$ in the Picard group.

Define the canonical height of an elliptic curve byThe existence and bounded comparison are elementary: consecutive terms differ by at most $C{4}^{-n-1}$, so their telescoping series converges andThe bound is uniform in $P$, and the limit is nonnegative. Shifting the index gives $\hat{h}(2P)=4\hat{h}(P)$. This is the unique function within bounded distance of $h_E$ with that doubling rule: the difference of two such functions at $P$ is $4^{-n}$ times their bounded difference at $2^{n}P$, and hence zero. A change of Weierstrass model changes the naive height only by a bounded function, so the normalized limit is independent of that model.

Apply the approximate parallelogram identity to $2^{n}P,2^{n}Q$, divide by $4^n$, and pass to the limit. The bounded error disappears, yielding the exact height parallelogram identityEvenness follows already from $x(-P)=x(P)$. The second-difference recurrence along $nP$, with initial values at $0,P$, consequently gives $\hat{h}(nP)=n^2\hat{h}(P)$ for every integer $n$. The arithmetic cube identity from 2(i), scaled in the same way, also becomes an exact third-difference identity for $\hat{h}$.

The canonical height pairingis symmetric and biadditive: the difference $⟨P+Q,R⟩-⟨P,R⟩-⟨Q,R⟩$ is half the vanishing third difference. Its diagonal is $\hat{h}(P)$. Positivity gives the Cauchy-Schwarz inequality for this pairing without first assuming finite generation. Indeed $\hat{h}(mP+nQ)\ge 0$ for integers $m,n$; dividing by $n^2$ and using density of rational $m/n$ shows that the associated quadratic polynomial is nonnegative on the real line. Its discriminant therefore gives $⟨P,Q{⟩}^2\le \hat{h}(P)\hat{h}(Q)$.

The Northcott theorem and the bounded comparison make $\{P\in E(K):\hat{h}(P)\le B\}$ finite. The map $x:E\to {\mathbb{P}}^1$ has finite fibres, so bounded $x$-height indeed controls the number of points, including $O$. This proves the important criterionFor a torsion point the integer quadratic rule gives zero. Conversely, height zero makes all $2^{n}P$ belong to one finite bounded-height set; two coincide, forcing $(2^j-2^i)P=O$ for some $j>i$. This argument also proves torsion finiteness over the fixed number field.

The normalized height is functorial for an isogeny of elliptic curves $\varphi :E\to E^{\prime }$:The pullback of ${\mathcal{O}}_{E^{\prime }}([O^{\prime }])$ has degree $\mathrm{deg}\varphi$ and is symmetric. Its difference from that many copies of $[O]$ is a symmetric degree-zero line bundle, hence a two-torsion Picard class. Its height is bounded, so the ordinary height relation has a bounded error. Commuting the isogeny with $[2^n]$ and taking the normalized limit removes that error. This explains the natural quadratic scaling under multiplication and the usefulness of normalized heights in comparing isogenous curves.

Here is their role in the Mordell-Weil theorem. The separate arithmetic input is the Weak Mordell-Weil theorem, asserting finiteness of $E(K)/2E(K)$. One route uses the Kummer exact sequence of an elliptic curve to inject this quotient into $H^1(K,E[2])$. The division torsors are unramified outside finitely many places containing those over $2$ and those of bad reduction. After a finite Galois extension splitting $E[2]$, their classes are pairs of square classes with even valuations outside this finite set. These square classes form a finite group: the obstruction to being represented by an S-unit lies in the finite ideal class group's two-torsion, and the S-unit group is finitely generated, hence finite modulo squares. The inflation-restriction kernel is a cohomology group of a finite group with finite coefficients, also finite. This supplies the finite quotient without using the full theorem in advance.

Choose representatives $R_1,\dots ,R_s$ for that finite quotient and put $H={\max }_i\hat{h}(R_i)$. Every point has the form $P=2Q+R_i$. Nonnegativity and the exact parallelogram identity giveIf $\hat{h}(P)>H+1$, this decreases the height by more than $1/2$. Repeating must reach the finite set $T=\{P:\hat{h}(P)\le H+1\}$. Unwinding the halving expressions writes the initial point as an integer linear combination of the $R_i$ and a point of $T$. Thus $E(K)$ is finitely generated, the canonical-height proof of Mordell-Weil finite generation. The normalized height supplies the descent and Northcott supplies its finite endpoint; neither by itself supplies the weak theorem's finite quotient.

After finite generation, $E(K)$ is a finite torsion subgroup plus a free abelian group of finite rank. The canonical height pairing is positive-definite on the associated real vector space. To justify the latter rather than assuming it, if its nonnegative quadratic form had a real null direction, rounding longer and longer multiples of that direction to lattice points would produce infinitely many points of bounded height: the null-direction cross terms vanish, leaving only uniformly bounded rounding errors. This contradicts Northcott finiteness. Hence the free part is a Euclidean height lattice. Heights can consequently bound point searches, certify independence through positive Gram determinants, and organize the arithmetic complexity of rational points.

For the Weierstrass equation of an elliptic curve in this part, $a_1=a_2=a_6=0$, $a_3=1$, $a_4=-1$. HenceThe elliptic-curve discriminant is thereforeEvery prime other than $37$ has unit discriminant, so this integral equation gives good reduction. At $37$ the valuation is one. An Admissible change of Weierstrass coordinates changes discriminant valuations by a multiple of twelve; consequently no integral model can lower this value to zero. Thus the equation is minimal there and the reduction is genuinely bad, rather than an artifact of a nonminimal model. Explicitly $(5,18)$ is singular on the reduced affine cubic: both partial derivatives vanish there. The set of bad reduction primes is

The inverse on this Weierstrass equation of an elliptic curve is $(x,y)\mapsto (x,-y-1)$. A line $y=\lambda x+\nu$ through the points being added has third intersection $R$ with $x(R)={\lambda }^2-x_1-x_2$, and the sum is $-R$.

At $P=(0,0)$, implicit differentiation gives $\lambda =(3x^2-1)/(2y+1)=-1$. The tangent is $y=-x$. Substitution into the equation gives $x^2=x^3$, so its third intersection is $(1,-1)$, whose inverse is $(1,0)$. Next the line through $(0,0)$ and $(1,0)$ is $y=0$; its remaining intersection is $(-1,0)$, whose inverse is $(-1,-1)$. Consequently

Near $O$, put $t=-x/y$ and $w=-1/y$, or projectively $t=-X/Y$, $w=-Z/Y$. The integral Weierstrass equation of an elliptic curve becomesThe linear coefficient of $w$ at the origin is a unit, so successive coefficient comparison gives a unique series $w(t)\in {\mathbb{Z}}_p[[t]]$ beginning $t^3$. Expressing the addition morphism in the local parameters of its two inputs givesIts identity, inverse, commutativity and associativity identities follow from the corresponding elliptic group identities. This one-dimensional commutative formal group law is the formal group of an elliptic curve $\hat{E}$ attached to the model.

A point reducing to $O$ lies in the chart with $Y$ a unit and has $t,w\in p{\mathbb{Z}}_p$. The implicit equation determines $w$ uniquely from $t$. Conversely every $t\in p{\mathbb{Z}}_p$ gives the convergent solution $w(t)$ and the point $[-t:1:-w(t)]$; $t=0$ gives $O$. Hence the parameter is a bijection from the reduction kernel to $p{\mathbb{Z}}_p$. The series $F$ converges there and describes its addition. ThereforeFor nonzero $t$ with $v_p(t)=r>0$, $w(t)=t^3$ times a unit, so $v_p(x)=-2r$ and $v_p(y)=-3r$. These are the formal kernel of a minimal Weierstrass equation valuations used earlier.

The projective completion has identity $O=[0:1:0]$. For this Weierstrass equation of an elliptic curve, negation isFor distinct affine points $P,Q$, draw their chord; for $P=Q$, use the tangent with its intersection multiplicity. If the third intersection is $R$, define $P\oplus Q=-R$. A vertical chord pairs $P$ with $-P$ and gives their sum $O$; also $P\oplus O=P$. A vertical tangent at a point satisfying $2y+1=0$ gives $2P=O$.

For a nonvertical line $y=mx+b$, substitution into the cubic givesThus if $P=(x_1,y_1)$ and $Q=(x_2,y_2)$, the sum has coordinatesHere $m=(y_2-y_1)/(x_2-x_1)$ for a chord, and implicit differentiation givesfor a nonvertical tangent. These formulas include the repeated-root case. Associativity can be seen without a lengthy coordinate calculation: a line cuts the cubic in a divisor equivalent to $3(O)$, and $P\mapsto [(P)-(O)]$ identifies the curve with its degree-zero divisor class group. The chord-and-tangent operation becomes addition of divisor classes, hence is associative.

Arithmetic heights measure arithmetic complexity. For a reduced rational number $x=a/b$, its multiplicative height is $H(x)=\max (|a|,|b|)$ and its logarithmic height is $h(x)=\log H(x)$. Over a number field $K$, use the absolute projective heightNormalize the absolute values on a field by the product formula. That formula makes arithmetic height independent of the chosen homogeneous representative, and the normalization makes it independent of enlarging $K$. The Northcott theorem says that algebraic points of bounded degree and bounded arithmetic height form a finite set. For rational numbers this follows immediately by bounding the numerator and denominator. In a fixed number field, the same finiteness follows by bounding the coefficients of the minimal polynomial using its conjugates and the arithmetic height.

For an elliptic curve put $h_x(P)=h([x(P):1])$ and $h_x(O)=0$. The two points above a given $x$ show that bounded $h_x$ gives finitely many $K$-rational points. More importantly, multiplication expands this arithmetic height. To see the mechanism, choose a short Weierstrass equation of an elliptic curve $y^2=x^3+Ax+B$ over $K$. Doubling givesAfter homogenization the numerator and denominator are quartics with no common zero. At infinity the numerator is nonzero; at a root $t$ of the cubic the numerator becomes $(3t^2+A{)}^2$, nonzero by nonsingularity. For a degree-$d$ morphism of the projective line, fixed homogeneous coefficients give the upper arithmetic height bound $h(f(x))\le dh(x)+C$. A nonzero resultant supplies the reverse bound: at each place it bounds the common cancellation of the two homogeneous values, with a nontrivial constant needed at only finitely many places. Applying these bounds to duplication gives a constant $C$ independent of $P$ withThis includes points mapping to $O$, by the projective formulation.

The canonical height removes the bounded errors. With the conventional factor one half, defineThe successive terms before multiplying by one half differ by at most $C{4}^{-n-1}$. The limit exists, and summing this geometric bound givesHence bounded canonical height still gives finitely many points over the fixed number field.

To obtain the pairing, the quadratic nature comes from a uniform arithmetic height parallelogram estimate, not just from doubling. If $x=x(P)$ and $z=x(Q)$, the unordered coordinates $x(P+Q),x(P-Q)$ are the roots of the binary quadratic with coefficientsThese formulas follow by adding and multiplying the two chord expressions with slopes $(y(P)-y(Q))/(x-z)$ and $(y(P)+y(Q))/(x-z)$. Their homogenizations have bidegree $(2,2)$ and no simultaneous zero. Off the diagonal $C_2\ne 0$; on the finite diagonal $x=z=t$, $C_1=4f(t)$ and $C_0=f^{\prime }(t{)}^2-8tf(t)$ for $f(t)=t^3+At+B$, so simultaneous vanishing would contradict nonsingularity. At the double point at infinity the homogeneous $C_0$ is nonzero. Local coefficient norms, or the corresponding resultant bounds, therefore giveThe arithmetic height of a binary quadratic's coefficient vector differs by $O(1)$ from the sum of the heights of its two roots. At finite places this follows from multiplicativity of the maximum coefficient norm of products; at infinite places the fixed-degree norms are comparable. ThusApply this to $2^{n}P,2^{n}Q$, divide by $2\cdot 4^n$ and take limits. The errors vanish and give the exact height parallelogram identity. Polarization consequently makesa symmetric bilinear pairing. Nonnegativity of $\hat{h}(aP+bQ)$ for integers $a,b$, and density of rational ratios, give the Cauchy-Schwarz inequality. In particular $\hat{h}(P-Q)\le 2\hat{h}(P)+2\hat{h}(Q)$. Also $\hat{h}(mP)=m^2\hat{h}(P)$ for integers $m$. Torsion points of an elliptic curve have canonical height zero because their doubling orbit is finite; conversely, if a point has canonical height zero, all its integer multiples have bounded naive height, and finiteness forces two multiples to coincide. Thus canonical height vanishes exactly on torsion.

There is an arithmetic finiteness input before height descent: $E(K)/2E(K)$ is finite, the Weak Mordell-Weil theorem. Here is its mechanism. The multiplication exact sequence gives an injective Kummer map $E(K)/2E(K)\to H^1(K,E[2])$: choose a half-point $Q$ and use the cocycle $\sigma \mapsto \sigma Q-Q$; changing $Q$ changes a coboundary, and a trivial class means a half-point can be chosen over $K$. Let $L=K(E[2])$, a Finite Galois extension. Over $L$ the torsion module is $(\mathbb{Z}/2\mathbb{Z}{)}^2$, so Kummer theory identifies its first Galois cohomology with two copies of $L^{\times }/L^{\times 2}$.

Only classes unramified outside a fixed finite set $S$ occur. Include the primes over $2$, bad-reduction primes and the ramified primes of $L/K$. At a good prime away from $2$, multiplication by two on the proper smooth elliptic model is finite étale morphism, so the torsor of halves of a point is unramified. In square-class language, valuations outside $S$ are even. Such classes form a finite group: write the principal ideal of a representative as a square times an ideal supported on $S$. The ideal class gives an element of the finite two-torsion of the localized ideal class group; after fixing that class, ambiguity is an $S$-unit modulo squares. The $S$-unit theorem makes the latter finite. The group kernel of restriction from $K$ to $L$ is contained in $H^1(\mathrm{Gal}(L/K),E[2])$, which is finite because both the group and module are finite. This proves the weak theorem, without assuming finite generation of $E(K)$.

Finally choose representatives $R_1,\dots ,R_s$ of $E(K)/2E(K)$ and put $M={\max }_i\hat{h}(R_i)$. Every $P$ has the form $2Q+R_i$, andIf $\hat{h}(P)>M+1$, this reduces canonical height by more than one half. Iterate until a point of canonical height at most $M+1$ is reached. There are only finitely many such points, by Northcott and the bounded difference of heights. Reconstructing $P=2Q+R_i$ at every stage proves that these finitely many small points and the finitely many representatives generate $E(K)$. ThereforeThe canonical pairing is positive definite on the free part. It turns rank computations into an arithmetic lattice problem, supplies independence tests for proposed generators, and bounds searches once a arithmetic height bound is available. Weak finite-quotient finiteness alone would not prove this result: the arithmetic height contraction is the step that converts it into finite generation.

Use the invertible linear projective transformationThe identitygivesThe transformation is invertible because $d\ne 0$, and it sends $O$ to $(0:1:0)$. Hence it is an isomorphism of the pointed smooth projective curves, giving the required Weierstrass equation of an elliptic curve:For affine points $u=X/Z,v=Y/Z$, the transformation and its inverse areThese formulae are interpreted in their stated affine charts; the projective transformation handles the exceptional points without any ambiguity.

The Hessian criterion for flexes of a plane cubic applied to the defining polynomial givesConsequently the inflection points of a plane cubic on this curve are exactly its intersections with the three coordinate lines. Choose $r\in \overline{\mathbb{Q}}$ with $r^3=d$, and a primitive cube root of unity $\zeta$. The nine distinct flexes of a diagonal cubic areWith the chosen flex as identity, these points are precisely $E_d[3]$. A tangent cutting the Weil divisor $3P$ gives $3(P-O)=0$; conversely $3(P-O)=0$ makes the hyperplane Weil divisor equivalent to $3P$, which supplies a tangent with triple contact. This is the three-torsion points are flexes of a plane cubic correspondence.

On $Z=0$ only $O$ is rational, since the other cube roots of unity are not rational. On each other coordinate line a rational point exists exactly when $d$ is a rational cube, and then exactly one does. ThereforeIn particular the rational torsion subgroup cannot contain two independent points of order $3$.

One can also determine the whole rational torsion of a diagonal cubic. First it is killed by $6$. To see this, use the Weierstrass equation of an elliptic curve from (iii). At primes $\ell \equiv 2(\mathrm{mod}3)$ outside the finite set containing $2,3$ and the prime divisors of the numerator and denominator of $d$, the cube map permutes ${\mathbb{F}}_{\ell }$, sowhere the quadratic character is extended by $\chi (0)=0$, and the character sum vanishes after substituting $t=x^3-432d^2$. Reduction of torsion points on an elliptic curve injects the prime-to-$\ell$ part of rational torsion into this finite group. This injection follows because multiplication by an integer prime to $\ell$ is invertible on the formal group of an elliptic curve, and hence its reduction kernel has no such torsion.

For any prime $q>3$, choose a good $\ell \equiv 2(\mathrm{mod}3)$ with $\ell \equiv 1(\mathrm{mod}q)$; the Dirichlet theorem on primes in arithmetic progressions and the Chinese remainder theorem supply such primes outside the finite bad set. Then $q\nmid \ell +1$, excluding $q$-torsion. Similarly good $\ell \equiv 5(\mathrm{mod}12)$ exclude order $4$, and good $\ell \equiv 11(\mathrm{mod}18)$ exclude order $9$. Thus every rational torsion point has order dividing $6$.

The inversion formula in (i) shows that the only possible nonidentity rational point of order $2$ has $X=Y$ and $Z\ne 0$. It exists precisely when $(X/Z{)}^3=-d/2$, that is, when $d/2$ is a rational cube. There is at most one such point. This condition and $d$ being a cube cannot hold together, since $2$ is not a rational cube. Combining it with the three-torsion calculation gives the full answer:

For this Weierstrass equation of an elliptic curve, the inverse is $(x,y)\mapsto (x,13-y)$. At a point with $2y-13\ne 0$, implicit differentiation gives the tangent slopeIf the tangent line is $y=mx+b$, substitution into the equation shows that the three intersection abscissae sum to $m^2-1$. Two of them equal the tangency abscissa $x$, so the third is $x_3=m^2-1-2x$. Reflecting the third intersection by the inverse formula gives the elliptic curve group law from Riemann-Roch doubling formulaFor $P$, the slope is $13/(-13)=-1$, giving $x(2P)=0$ and $y(2P)=13$. For $Q$, the slope is $(12-4+13)/(6-13)=-3$, giving $x(2Q)=9-1+4=12$ and $y(2Q)=13-3+(-3)(-2-12)=52$. HenceIn particular $P$ has order exactly three: it is nonidentity and $2P=-P$.

Choose a Weierstrass equation of an elliptic curve, with origin $O$ at infinity. For $P,Q$, draw their chord, or the tangent if they coincide, and call its third intersection $R$, counted with intersection multiplicity. The line through $R$ and $O$ gives a third point $S$; define $P+Q=S$. This is the chord-and-tangent group law. The inverse of an affine point on $y^2+a_{1}xy+a_{3}y=x^3+a_2{x}^2+a_{4}x+a_6$ is $(x,-y-a_{1}x-a_3)$, obtained from its vertical line through $O$. These conventions give identity $O$, and cover tangent and flex cases by multiplicity.

Here is a proof of associativity, without assuming that the geometric construction already defines a group. Work first over an algebraic closure and use divisors on an algebraic curve. The Riemann-Roch theorem says $\ell (D)-\ell (K_E-D)=\mathrm{deg}D+1-g$. For a smooth genus-one curve the canonical divisor has degree zero, so every degree-one divisor has $\ell (D)=1$. Thus every divisor class of degree one has a unique effective representative, necessarily a single point. Existence follows from a nonzero section; uniqueness follows because two distinct effective representatives would give linearly independent sections in the same one-dimensional space. Consequentlyis a bijection: add $(O)$ to any degree-zero divisor class, and use its unique degree-one representative.

A line through $P,Q,R$ cuts out a divisor linearly equivalent to $3(O)$, since the line at infinity has triple intersection at the Weierstrass flex $O$. Equivalently, the ratio of the line equation to that of the line at infinity has principal divisor $(P)+(Q)+(R)-3(O)$. Thus the three corresponding degree-zero classes sum to zero. Applying the same fact to $O,R,S$ shows that the point produced by the chord-and-tangent process satisfiesAddition of divisors modulo principal divisors is associative. The two parenthesizations of $P+Q+T$ therefore have identical classes; injectivity of the displayed bijection makes them the same point. Hence the chord-and-tangent law is associative. This is associativity of the chord-and-tangent law via divisor classes. Its construction is defined over the original field, so the same conclusion holds for its rational points.

Put $A=\wp (w)$ and $B={\wp }^{\prime }(w)$. At $z=0$, the first column has $\wp (z)=z^{-2}+O(z^2)$ and ${\wp }^{\prime }(z)=-2z^{-3}+O(z)$, whereas the third has $\wp (-z-w)=A+Bz+O(z^2)$. Expanding the determinant, the coefficient multiplying ${\wp }^{\prime }(z)$ is $\wp (-z-w)-A=O(z)$, so the apparent cubic pole reduces to order at most two. The only other possible pole is at $z=-w$, and $f(-z-w)=-f(z)$ gives the same bound there. Thus, if $f$ is nonconstant, its total pole order and valency are at most four. A constant case is handled by finding a zero below.

Column coincidences give zeros at $z=w$, at $z=-2w$, and at the four solutions of $2z=-w$ on $\mathbb{C}/\Lambda$. The latter are distinct because $\Lambda /2\Lambda$ has four elements. If $3w\notin \Lambda$, the first two points are distinct from each other and from these four solutions.

One exceptional pole issue needs care: when $2w\in \Lambda$, the first two prospective zeros are $w$ and $0$, the possible pole locations. They are actually removable zeros. Here $B=0$, and, with $C={\wp }^{\prime \prime }(w)$, evenness about this half-period givesThe determinant becomes $(A-\wp (z)){\wp }^{\prime }(-z-w)+{\wp }^{\prime }(z)(\wp (-z-w)-A)$. Its two $C/z$ contributions cancel and it is $O(z)$; reflection transfers this conclusion to $z=w$. Thus there really are six distinct zeros also in this case.

If $3w\in \Lambda$ but $w\notin \Lambda$, then $z=w=-2w$ is one of the four solutions of $2z=-w$. All three columns coincide there, with no pole. Both the determinant and its first derivative vanish, since each term in the derivative still has two identical columns. Hence there are four distinct zeros, at least one multiple, giving at least five zeros counted with multiplicity.

For a nonconstant elliptic function, zeros and poles in a period parallelogram have equal total multiplicity, by the argument principle. Either count contradicts total pole order at most four. A constant with a zero is zero, soThis is the elliptic collinearity determinant. Consequently, when $z_1+z_2+z_3\in \Lambda$, the three vectors $(1,\wp (z_i),{\wp }^{\prime }(z_i))$ have zero determinant. The three points on the Weierstrass equation of an elliptic curve are therefore collinear in ${\mathbb{C}}^2$.

Direct substitution gives $y^2+y=x^3-x+6$ for both points. The displayed Weierstrass equation of an elliptic curve is minimal at every prime by the permitted assumption.

For $P$, neither $364$ nor $11737$ is divisible by three or five. ThereforeThe formal kernel of a minimal Weierstrass equation description gives $P\in E_1({\mathbb{Q}}_3)\cap E_1({\mathbb{Q}}_5)$. Similarly, neither $2059$ nor $98783$ is divisible by three or seven, so $Q\in E_1({\mathbb{Q}}_3)\cap E_1({\mathbb{Q}}_7)$, with the same respective coordinate valuations $-2,-3$.

If a point $T\in E_1({\mathbb{Q}}_p)$ had finite order of a group element $N=p^{a}n$ with $p\nmid n$, the point $p^{a}T$ would be killed by $n$. By prime-to-residue-characteristic multiplication on a formal group, multiplication by $n$ is injective on this kernel, so $p^{a}T=O$. Its order is therefore a power of $p$. Applying this at two distinct primes is the two-prime formal-kernel test for nontorsion: the order of $P$ would be both a power of three and of five, and the order of $Q$ both a power of three and of seven. Each would have to be the identity, although both are affine points. Both $P$ and $Q$ have infinite order.

For an integral Minimal Weierstrass equation, let $E_0({\mathbb{Q}}_p)$ be the subgroup of points whose reduction is a smooth point of the reduced cubic. Its reduction is a homomorphism to the smooth-locus group of a singular Weierstrass cubic, or to the whole reduced elliptic curve in the good-reduction case. Define the formal kernel of a minimal Weierstrass equation byIt consists of the identity and the points reducing to the identity at infinity. For a nonidentity affine point this is equivalent to $v_p(x)=-2r$ and $v_p(y)=-3r$ for some positive integer $r$.

The local parameter $t=-x/y$, with $t(O)=0$, gives the group isomorphismwhere $\hat{E}$ is the formal group of an elliptic curve. To see the local coordinates, put $w=-1/y$ in the Weierstrass equation of an elliptic curve. The resulting relation is $w=t^3+a_{1}tw+a_2{t}^{2}w+a_3{w}^2+a_{4}t{w}^2+a_6{w}^3$, and its unit linear coefficient gives a unique integral series $w(t)=t^3+O(t^4)$. Thus $x=t/w$ and $y=-1/w$ have valuations $-2v_p(t)$ and $-3v_p(t)$. The chord-and-tangent group law expressed in this parameter is precisely the integral formal group law $\hat{E}$. This description includes bad reduction; only the smooth identity neighborhood is involved.

Write the cubic in the Weierstrass equation of an elliptic curve as $f(x)=x^3+a_2{x}^2+a_{4}x+a_6$. A suitable invariant differential on an elliptic curve isIt is regular and nonzero wherever $y\ne 0$. At a point with $y=0$, nonsingularity gives $f^{\prime }(x)\ne 0$, and differentiating the equation shows $\omega =dy/f^{\prime }(x)$, again regular and nonzero. At the identity $O$, use the parameter $t=-x/y$: the expansions start $x=t^{-2}+\cdots$, $y=-t^{-3}+\cdots$, so $\omega =(1+\cdots )dt$. Thus it is a nowhere-vanishing regular differential on the whole smooth projective curve.

Here is a direct proof of translation invariance of a Weierstrass differential. Fix $Q=(u,v)$, let $P=(x,y)$ vary, and write $P+Q=(X,Y)$. On the open set where the chord-and-tangent group law uses an ordinary chord, put $h=(y-v)/(x-u)$. The addition formulas are $X=h^2-a_2-x-u$ and $Y=h(x-X)-y$. The line-intersection identity isDifferentiate this polynomial in $T$ at $T=x$ to obtain $f^{\prime }(x)-2yh=(x-u)(x-X)$. Differentiating $h$ along the curve now gives $dh/dx=(x-X)/(2y)$, and henceThis proves translation invariance on a dense open set. Since the translation on an elliptic curve is an automorphism and both sides are regular differentials, it proves invariance everywhere, including the exceptional addition cases. Translation by $O$ is the identity.

Translation invariance also gives ${\mu }^{\ast }\omega ={\mathrm{pr}}_1^{\ast }\omega +{\mathrm{pr}}_2^{\ast }\omega$ for the addition map: its differential on a tangent pair is the sum of the two translated tangent vectors. Therefore $[j{]}^{\ast }\omega =j\omega$ for every integer $j$.

Let $d_j=\mathrm{deg}[j]$, with the zero endomorphism assigned degree zero. The assumed degree identity, applied to $[j]$ and $[1]$, givesInduction gives $\mathrm{deg}[j]=j^2$ for positive $j$; negation is an automorphism, so the result holds for negative $j$ as well. This is quadratic degree recursion for elliptic multiplication.

For a prime $\ell \ne p$, the invariant differential on an elliptic curve has nonzero pullback under $[\ell ]$, so that map is a separable isogeny. Translation identifies all its fibres and their local multiplicities, so its geometric kernel has exactly its degree ${\ell }^2$ distinct points. It is killed by $\ell$, and thereforeThe algebraic closure is essential here; the assertion is not generally true for the rational-point subgroup over ${\mathbb{F}}_p$ itself. This is prime-to-characteristic geometric torsion.

For $[p]$, the pullback differential vanishes. Its total degree is $p^2$, and its inseparable degree is at least $p$, so its kernel has at most $p$ geometric points. Thus $E({\mathbb{F}}_p)[p]$ has dimension at most one over ${\mathbb{F}}_p$, while every other prime-torsion subgroup has dimension at most two. The rational-point group is finite and abelian. The structure theorem for finite abelian groups says that the number of cyclic factors of an $\ell$-primary component equals the dimension of its subgroup killed by $\ell$. Each component therefore has at most two factors. Combining the smaller primary factors into one cyclic group and the larger ones into another yieldsOne may also choose $p\nmid m$, since the $p$-primary component is cyclic. This explains two generators for elliptic curves over finite fields.

An elliptic curve has good reduction of an elliptic curve at $p$ if it admits a Weierstrass equation of an elliptic curve over ${\mathbb{Z}}_p$ whose reduced projective cubic is nonsingular. Equivalently its minimal discriminant is a $p$-adic unit.

For the given integral short equation,It therefore directly supplies good reduction outside $2,3,5$. These three primes cannot be rescued by changing the model. An admissible change of Weierstrass model changes the discriminant by a twelfth power, so its valuation changes by a multiple of twelve. The displayed valuations $4,7,4$ are not congruent to zero modulo twelve. No integral model can have unit discriminant at any of those primes. The good primes are exactly $p\notin \{2,3,5\}$.

Let $C$ be the projective cubic of a Weierstrass equation of an elliptic curve, allowing its elliptic-curve discriminant to vanish, and let $O=[0:1:0]$. Use only the smooth locus of a variety $C_{\mathrm{sm}}(K)$: the singular point, if present, is excluded. For $P,Q$, intersect their chord with $C$, using the tangent if $P=Q$ and counting intersection multiplicity. If the third intersection is $R$, define $P+Q=-R$, wherein general Weierstrass equation of an elliptic curve coordinates. The line through $R$ and $O$ gives this reflection. A vertical chord gives $P+(-P)=O$, and the tangent at $O$ meets $C$ three times at $O$, so $O$ is the identity. The construction is symmetric in $P,Q$. It stays in the nonsingular locus: a line through a singular point has intersection multiplicity at least two there, and therefore cannot also contain two smooth intersections counted with multiplicity.