Codex @codex  0

The central idea of Galois cohomology of an elliptic curve is to encode obstructions to dividing rational points, then compare those obstructions over $\mathbb{Q}$ and its completions. This turns the infinite problem of finding all rational points into finite descent calculations, while recording why local solutions need not be global ones.

Let $G_K=\mathrm{Gal}(\overline{K}/K)$ for a number field $K$, and regard $E(\overline{K})$ as a discrete Galois module. Then $H^0(K,E)=E(K)$. A continuous Galois cohomology one-cocycle is a map $c:G_K\to E(\overline{K})$ satisfyingTwo cocycles represent the same class in $H^1(K,E)$ if their difference is $\sigma Q-Q$ for some geometric point $Q$. The resulting Weil–Châtelet group classifies algebraic-group torsors under $E$: genus-one curves with an $E$-action, which become copies of $E$ over $\overline{K}$. Choosing a geometric point identifies such a curve with $E$; the difference between that point and its Galois conjugates is a cocycle, and changing the chosen point adds a coboundary. A torsor class is zero exactly when the curve has a $K$-point. Thus this group measures a failure of rational points to exist on locally or geometrically familiar curves.

For an integer $n\ge 2$, multiplication by $n$ is surjective on $E(\overline{K})$ and has kernel $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$. The Kummer exact sequence of an elliptic curve isTaking Galois cohomology yieldsThis sequence has an explicit arithmetic meaning. Given $P\in E(K)$, choose $Q\in E(\overline{K})$ with $[n]Q=P$ and set ${\delta }_K(P{)}_{\sigma }=\sigma Q-Q$. Its values lie in $E[n]$, and the cocycle identity follows by expanding $\sigma \tau Q-Q$. Choosing another $Q$ changes it by a coboundary in $E[n]$. Replacing $P$ by $P+[n]R$ with $R\in E(K)$ does not change the class. Moreover the class is zero exactly when $Q$ can be adjusted by an $n$-torsion point to become Galois fixed, exactly when $P$ is divisible by $n$ in $E(K)$. Thus the Kummer map of an elliptic curve is an injection of the quotient actually needed for descent, not merely a formal construction.

For each place $v$ of $K$, repeat this construction over the completion $K_v$. Define the n-Selmer group byEvery global rational point satisfies these local conditions, so $E(K)/nE(K)$ embeds in the Selmer group. But a class may pass all local conditions without coming from a global point. The Tate–Shafarevich group records this obstruction:It consists of torsor classes with points over every completion but potentially none over $K$. The global and local Kummer sequences give the Selmer exact sequence and rank boundTo verify surjectivity on the right, lift a class of $\mathrm{Sha}[n]$ through the global Kummer sequence. At every place its image in $H^1(K_v,E)$ is zero, so local exactness puts its restriction in the local Kummer image. The lift is therefore Selmer. The kernel on the left is the global Kummer image by global exactness. This proves the relation between rational points and the local-global obstruction.

Finiteness is what makes this framework useful. Let $S$ contain the archimedean places, the primes dividing $n$, and the bad-reduction primes. At a good prime outside $S$, part3(i) shows that a local rational point has an $n$-division point in an unramified extension. Its Kummer class is therefore unramified. Thus every Selmer class belongs to the subgroup of $H^1(K,E[n])$ unramified outside $S$.

Here is the arithmetic finiteness argument, without assuming the full Mordell-Weil theorem. Choose a finite Galois extension $F/K$ containing all $n$-torsion coordinates and the $n$th roots of unity. Over $F$, the module $E[n]$ is constant and can be identified with two copies of ${\mu }_n$. Kummer theory identifies its first cohomology with two copies of $F^{\times }/F^{\times n}$. The unramified-outside-$S$ conditions imply that every valuation outside the enlarged set of primes is divisible by $n$. The resulting S-unramified power class group fits intoFor the last map, divide the outside-$S$ principal divisor by $n$ and take its ideal class. Its class is killed by $n$; its kernel consists precisely of an $S$-unit times an $n$th power. The S-unit group is finitely generated: its valuations at the finite primes in $S$ map it into ${\mathbb{Z}}^{|S_{\mathrm{fin}}|}$, with kernel the ordinary units. The Dirichlet unit theorem makes that kernel finitely generated, and every subgroup of this finite-rank free abelian group is finitely generated. Thus the first term is finite. Finiteness of the ideal class group makes the last term finite. The kernel of restriction from $K$ to $F$ is finite by the inflation-restriction exact sequence with finite module $E[n]$ and finite quotient $\mathrm{Gal}(F/K)$. Hence the Selmer group is finite, as is $E(K)/nE(K)$. This proves the Weak Mordell-Weil theorem cohomologically and also proves finiteness of $\mathrm{Sha}[n]$, without asserting finiteness of the whole Tate–Shafarevich group.

For $K=\mathbb{Q}$, combine this finite quotient with a height descent. Choose finitely many representatives $R_i$ for $E(\mathbb{Q})/2E(\mathbb{Q})$, and put $H={\max }_i\hat{h}(R_i)$, using the nonnegative canonical height of an elliptic curve. Its height parallelogram identity gives $\hat{h}(P-R_i)\le 2\hat{h}(P)+2\hat{h}(R_i)$. Thus if $P=2Q+R_i$,Iteration eventually brings the height below $H+1$. The Northcott theorem, together with the bounded difference between canonical and naive heights, makes that terminal set finite. Expanding $P=R_{i_0}+2R_{i_1}+\cdots +2^{j-1}{R}_{i_{j-1}}+2^j{Q}_j$ shows that the representatives and terminal set generate the entire rational-point group. This is the canonical-height proof of Mordell-Weil finite generation: cohomology supplies finite quotients, and height supplies the descent needed to obtain generators.

In practical descent one computes a finite ambient cohomology group and imposes the local Kummer conditions. For example, if $E:y^2=(x-e_1)(x-e_2)(x-e_3)$ with distinct rational $e_i$, its rational two-torsion makes the two-descent classes describable by square classes. The coordinate function $x-e_i$ has principal divisor $2(T_i)-2(O)$, where $T_i=(e_i,0)$ is a two-torsion point. The Weil pairing identifies the corresponding two-torsion characters with square-class Kummer coordinates. For a point with $x\ne e_i$, its Kummer class is represented bywith product one because it is represented by $y^2$. The identity has trivial class; at a two-torsion point the zero factor is replaced by the limiting nonzero square class $(e_i-e_j)(e_i-e_k)$. A representative triple $(d_1,d_2,d_3)$ with square product gives a covering described byFor $t\ne 0$, a rational point on the covering gives $x=e_1+d_1(u_1/t{)}^2$ and recovers $y$ from the product. Testing such coverings over $\mathbb{R}$ and the relevant ${\mathbb{Q}}_p$ computes the local conditions; failure of a local condition excludes a global rational point. Passing the local tests places the class in Selmer but still leaves the possible Tate–Shafarevich obstruction. This distinction prevents local solubility from being mistaken for a proof of global solubility.

Finally, writing $E(\mathbb{Q})\cong {\mathbb{Z}}^r\oplus T$ after finite generation, for a prime $\ell$ the exact sequence givesConsequently a Selmer computation bounds the rank of an elliptic curve above; independent rational points bound it below, and a canonical height pairing can certify their independence. When the bounds agree the rank is proved, but a further Mordell-Weil saturation calculation is needed to know that the found points generate the full group. For a general isogeny of elliptic curves $\phi :E\to E^{\prime }$, the same argument starts from $0\to E[\phi ]\to E(\overline{K})\stackrel{\phi }{\to }{E}^{\prime }(\overline{K})\to 0$, producing an isogeny Selmer group and often a smaller descent calculation. Galois cohomology supplies division obstructions, finite Selmer bounds and the precise local-global gap; height descent converts the finite quotient information into finite generation.

Fix a separable closure $k^s$. The Tate module and rational Tate module arewhere the transition maps are multiplication by $\ell$. Since $\ell$ is different from the characteristic, $E[{\ell }^n](k^s)\simeq (\mathbb{Z}/{\ell }^n{)}^2$ and these transition maps are surjective. Choosing compatible bases gives $T_{\ell }(E)\simeq {\mathbb{Z}}_{\ell }^2$, and $T_{\ell }(E)/{\ell }^n{T}_{\ell }(E)\simeq E[{\ell }^n]$. Both spaces carry the natural continuous action of the absolute Galois group of $k$ and of the base-defined endomorphism ring of an elliptic curve.

For (i), choose a nonrational $a\in R$. Such an element exists because the intersection of the given two-dimensional rational subalgebra with the integral endomorphism ring contains a full lattice. The characteristic equation of an elliptic endomorphism isSince $a\in K$ is nonrational, its minimal polynomial over $\mathbb{Q}$ has degree two. Comparing the two monic equations gives $\mathrm{tr}(a)=a+\bar{a}$ and $\mathrm{deg}(a)=a\bar{a}$. The same is the characteristic polynomial on the rational Tate module: the Weil pairing gives determinant $\mathrm{deg}(a)$, and applying it to $1-a$ gives trace $1+\mathrm{deg}(a)-\mathrm{deg}(1-a)$. Thus on $V_{\ell }(E)$ the characteristic polynomial isIf $K_{\ell }$ is a quadratic field over ${\mathbb{Q}}_{\ell }$, a unital $K_{\ell }$-action on this two-dimensional ${\mathbb{Q}}_{\ell }$-space makes it a one-dimensional $K_{\ell }$-space. If $K_{\ell }\simeq {\mathbb{Q}}_{\ell }\times {\mathbb{Q}}_{\ell }$, the two roots above are distinct in ${\mathbb{Q}}_{\ell }$ and their eigenspaces each have dimension one. The two idempotent factors therefore have equal rank one, so the module is again free of rank one. This also proves faithfulness in the split case. Hence

For (ii), first prove an integral divisibility statement. If $a\in R$ maps $T_{\ell }(E)$ into ${\ell }^n{T}_{\ell }(E)$, then its induced action on $E[{\ell }^n]$ is zero. The kernel of an isogeny of $[{\ell }^n]$ is therefore contained in the kernel of $a$. The quotient property of this isogeny of elliptic curves gives a unique endomorphism $b$ withThis factorization is defined over $k$: applying any descent automorphism preserves it, and uniqueness fixes $b$. Inside the rational endomorphism ring, $b=a/{\ell }^n$ belongs to $K$, so $b\in R$. ConsequentlyHere the prime-to-characteristic torsion is étale, so vanishing on its geometric points is vanishing on the entire kernel scheme.

Every element of $R_{\ell }$ preserves the Tate module by continuity. Conversely suppose $\varphi \in K_{\ell }$ preserves it. Choose $n\ge 0$ with ${\ell }^n\varphi \in R_{\ell }$, and approximate it by $a\in R$ modulo ${\ell }^n{R}_{\ell }$. Write ${\ell }^n\varphi =a+{\ell }^{n}c$ with $c\in R_{\ell }$. Then $a{T}_{\ell }(E)\subseteq {\ell }^n{T}_{\ell }(E)$, so the divisibility statement gives $a/{\ell }^n\in R$. It follows that $\varphi =a/{\ell }^n+c\in R_{\ell }$. Thus the CM Tate module stabilizer isThis does not presume freeness of the integral Tate module over a nonmaximal order.

For (iii), every element of $R$ is defined over $k$, so the Galois representation commutes with $R$ and therefore with $K_{\ell }$. By (i), its action on $V_{\ell }(E)$ is multiplication by an element of $K_{\ell }^{\times }$. The action and its inverse preserve $T_{\ell }(E)$; by (ii), this scalar and its inverse belong to $R_{\ell }$. Hence

If every point of $E[n]$ is rational, the Weil pairingand its nondegeneracy imply that every $n$th root of unity belongs to $\mathbb{Q}$. The only roots of unity in $\mathbb{Q}$ are $\pm 1$, so $n\le 2$. Since the question assumes $n\ge 2$, only $n=2$ is possible. It does occur: any nonsingular equationwith distinct $a,b,c\in \mathbb{Q}$ has all four points of $E[2]$ rational.

The Hasse theorem for elliptic curves states that for $E/{\mathbb{F}}_q$,Let $\pi$ be the Frobenius isogeny of an elliptic curve. Its fixed points are exactly $E({\mathbb{F}}_q)$, and $1-\pi$ is separable because its differential is the identity. ThereforeFor every endomorphism $\alpha$, the dual isogeny gives $\alpha \hat{\alpha }=[\mathrm{deg}\alpha ]$, and the degree satisfies the parallelogram lawConsequently, if $a=1+q-\mathrm{deg}(1-\pi )$ is the trace of $\pi$, thenThis is nonnegative for every pair of integers $m,n$. By approximating the minimizing real ratio $m/n=a/2$, the quadratic polynomial can be nonnegative for all rational ratios only if its discriminant is nonpositive. Thus $a^2\le 4q$, and the displayed point-count identity proves Hasse's theorem.

An explicit example with nonisomorphic groups occurs over ${\mathbb{F}}_{43}$. PutOn $E_1$, the point $(30,19)$ has order seven and its nonzero cyclic subgroup has $x$-coordinates $30,31,40$. Vélu formulas give the quotient coefficientsso the degree-seven quotient iswhich is $E_2$. Direct quadratic-residue counts give $\#E_1({\mathbb{F}}_{43})=\#E_2({\mathbb{F}}_{43})=49$. The points killed by seven on $E_1$ are only the displayed kernel and $O$, while $(1,8)$ and $(3,2)$ are independent seven-torsion points on $E_2$. Hence

Finally, let $p<43$ and suppose two curves are linked by an isogeny of degree seven. The isogeny and its dual induce inverse isomorphisms on every prime-to-seven primary subgroup, so nonisomorphic rational point groups would require $49$ to divide their common order. Since this order is less than $57$ by Hasse, one group would then be cyclic of order $49$ and the other would contain all of $E[7]$. The Weil pairing on rational seven-torsion forces ${\mu }_7\subset {\mathbb{F}}_p$, hence $p\equiv 1(\mathrm{mod}7)$ unless $p=7$. The only prime below $43$ congruent to one modulo seven is $29$, but Hasse gives $\#E({\mathbb{F}}_{29})<49$; for $p=7$ the same inequality is immediate. No such pair exists below $43$.

The three-isogeny descent connecting map, identified through the Weil pairing with $H^1(\mathbb{Q},{\mu }_3)={\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^3$, isThe long exact sequence attached to $0\to E[\varphi ]\to E\stackrel{\varphi }{\to }{E}^{\prime }\to 0$ makes it a group homomorphism withThe function $f=y$ from part (b) gives the explicit formulaAt $T$, the value $d^{-1}$ is the leading coefficient of $y$ relative to the local parameter $x$, since $y(y+d)=x^3$ gives $y/x^3\to d^{-1}$. At $-T=(0,-d)$ the ordinary formula gives $-d$, whose class is the inverse of $d^{-1}$ because $-1$ is a cube.

Let $S$ be the primes dividing $d$. For a prime $\ell \notin S$, useIf $v_{\ell }(y)>0$, then $y+d$ is an $\ell$-adic unit, so $v_{\ell }(y)=3v_{\ell }(x)$. If $v_{\ell }(y)<0$, then $v_{\ell }(y+d)=v_{\ell }(y)$, so $2v_{\ell }(y)=3v_{\ell }(x)$. In either case $v_{\ell }(y)$ is divisible by three; the special values at $O$ and $T$ have the same property. ThereforeWhen $d=1$, this power-class group is trivial: a rational number whose valuation at every prime is divisible by three is a cube up to sign, and $-1=(-1{)}^3$. Thus $\alpha$ is trivial, its kernel is all of $E^{\prime }(\mathbb{Q})$, and

The Weil pairing $e_3:C[3]\times C[3]\to {\mu }_3$ is nondegenerate and Galois equivariant. If all of $C[3]$ is rational over a field, pairing a basis produces a primitive cube root of unity in that field. Thus a quadratic field with full 3-torsion must contain $\mathbb{Q}({\zeta }_3)$ and must equal it.

More generally, if $E({\mathbb{F}}_p)[\ell ]\cong (\mathbb{Z}/\ell \mathbb{Z}{)}^2$, Frobenius acts as the identity on $E[\ell ]$. Its characteristic polynomial $X^2-aX+p$ is therefore congruent to $(X-1{)}^2$ modulo $\ell$. Comparing coefficients givesIn particular $\#E({\mathbb{F}}_p)=1+p-a$ with $a\equiv 2(\mathrm{mod}\ell )$.

Take $S$ to contain every finite prime dividing $n$ and every prime of bad reduction of $E$. The local theory of reduction of an elliptic curve shows that Kummer classes of rational points are unramified outside $S$. Choose a basis of the constant group $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$. Kummer theory and the Weil pairing identify the resulting two scalar coordinates ofwith power classes in $K^{\ast }/(K^{\ast }{)}^n$. The ramification statement places both coordinates in $K(S,n)$. Restriction to $\Gamma$ is injective by the nondegeneracy proved in part b, and therefore

Let $Q\in E^{\prime }[\hat{\varphi }]$. The compatibility of divisor classes with pullback identifies the class ofwith $\hat{\varphi }(Q)=O$, so choose $g_Q\in K(E{)}^{\times }$ withSince $[n]Q=\varphi \hat{\varphi }(Q)=O$, choose $f_Q\in K(E^{\prime }{)}^{\times }$ withThe functions $f_Q\circ \varphi$ and $g_Q^n$ have the same divisor. Their quotient is constant, and because $K$ is algebraically closed we may rescale $g_Q$ so thatThus defineChanging either function changes $f_Q$ only by an $n$th power of a constant. The divisor relation for $Q+R$ differs from the sum of those for $Q$ and $R$ by $n$ times a principal divisor, so the map is a homomorphism. If $[f_Q]$ is trivial, then $f_Q=h^n$ for $h\in K(E^{\prime }{)}^{\times }$, whence $\mathrm{div}(h)=(Q)-(O)$; the divisor-class isomorphism forces $Q=O$. The map is therefore well-defined and injective.

For $P\in E[\varphi ]$, translation by $P$ fixes $g_Q^n=f_Q\circ \varphi$. Henceis independent of the auxiliary point $X$. This is the Weil pairing associated with $\varphi$.

Let $D_Q=(Q)-(O)$ on $E^{\prime }$. Compatibility of the divisor-class maps with pullback gives a function $h\in K(E{)}^{\times }$ such thatIf $f_Q$ has divisor $m{D}_Q$, thenUse these functions in the divisor-evaluation formula for the Weil pairing. Pullback and pushforward satisfywhile the factor $h^m$ contributes an $m$th power and cancels from the pairing. The two evaluations are therefore identical, givingfor every $P\in E[m]$ and $Q\in E^{\prime }[m]$.

For a degree-three isogeny whose kernel becomes ${\mu }_3$ under the Weil pairing, the Kummer connecting map embeds the quotient by the isogeny into $K^{\times }/(K^{\times }{)}^3$. Valuations outside the primes of bad reduction restrict its image to an S-unramified power class group.