For $E:y^2=x^3+a{x}^2+bx$ with rational 2-torsion $(0,0)$, the quotient by that point is the two-isogenous curveThe two-isogeny descent maps a nonexceptional point to the square class of its $x$-coordinate, with $(0,0)$ mapping to $[b]$. The images are finite collections of squarefree divisors of $b$ and $a^2-4b$, determined by testing the associated homogeneous quartics for rational points. If their orders are $2^s$ and $2^{s^{\prime }}$, thenwhich determines the Mordell-Weil rank $r$.

The method requires a rational 2-isogeny, and deciding whether every locally soluble quartic is globally soluble can be difficult. Computing only local conditions gives a 2-isogeny Selmer group and hence an upper bound; a nontrivial Tate-Shafarevich group can make that bound strict. Even after finding the rank, a separate saturation and point search may be needed to find generators.

Take $S$ to contain every finite prime dividing $n$ and every prime of bad reduction of $E$. The local theory of reduction of an elliptic curve shows that Kummer classes of rational points are unramified outside $S$. Choose a basis of the constant group $E[n]\cong (\mathbb{Z}/n\mathbb{Z}{)}^2$. Kummer theory and the Weil pairing identify the resulting two scalar coordinates ofwith power classes in $K^{\ast }/(K^{\ast }{)}^n$. The ramification statement places both coordinates in $K(S,n)$. Restriction to $\Gamma$ is injective by the nondegeneracy proved in part b, and therefore

Define the S-unramified power class group byThere is an exact sequence from the $S$-unit group modulo $n$th powers into $K(S,n)$ and then into the $n$-torsion of the ideal class group. By the Dirichlet unit theorem,after absorbing the fixed roots of unity into the exponent. The ideal class group has fixed finite order $h_K$. Since $n\ge 2$, choose a constant $c$ depending only on $K$ with $h_K$ and the unit contribution bounded by $n^c$. Then

For $[P]\in \Gamma$, choose $Q$ with $nQ=P$ and define the elliptic Kummer pairingReplacing $Q$ by $Q+T$ with $T\in E[n]$ changes nothing because all $n$-torsion is $K$-rational; replacing $P$ by $P+nR$ permits replacing $Q$ by $Q+R$, again without changing the value. The group laws prove bilinearity. An automorphism pairing trivially with every class fixes every division point and hence $L$. Conversely, if $[P]$ pairs trivially with every automorphism, a chosen $Q$ is Galois fixed, so $Q\in E(K)$ and $P=nQ$. The pairing is therefore nondegenerate.

For $[x]\in \Delta$, choose ${\alpha }_x$ with ${\alpha }_x^n=x$ and define the Kummer pairingChanging $x$ by an $n$th power or changing its root leaves the quotient unchanged because ${\mu }_n\subset K$. Multiplication of radicals proves bilinearity. If an automorphism pairs trivially with every class, it fixes all generating radicals and hence all of $L$. If a class pairs trivially with every automorphism, its radical lies in $K$, so the class is trivial. Thus the pairing is well-defined, bilinear, and nondegenerate on both sides.

Writing $X=u$, $Y=v$, and $Z=-w$ turns the cubic into $X^3+Y^3=Z^3$. The birational coordinatesgive the Weierstrass equationThe original projective cubic has no common zero of its three partial derivatives modulo any $p\ne 3$, so it is already a smooth proper model and $C$ has good reduction at every such prime.

If $p\equiv 1(\mathrm{mod}3)$, then ${\mu }_3\subset {\mathbb{F}}_p$, all nine inflection points are rational, and $C({\mathbb{F}}_p)$ contains $(\mathbb{Z}/3\mathbb{Z}{)}^2$, so it is not cyclic. If $p\equiv 2(\mathrm{mod}3)$, cubing is a bijection on ${\mathbb{F}}_p$. Counting on the Fermat model gives $\#C({\mathbb{F}}_p)=p+1$. A finite elliptic-curve group has the form $\mathbb{Z}/d\mathbb{Z}\times \mathbb{Z}/e\mathbb{Z}$ with $d\mid e$ and $d\mid p-1$, so $d\mid \gcd (p-1,p+1)=2$. For odd $p$, the equation $x^3=432$ has exactly one root because cubing is bijective, so there is only one nonzero rational 2-torsion point and $d\ne 2$. Hence the group is cyclic. For $p=2$ it has order three and is cyclic as well.

The Weil pairing $e_3:C[3]\times C[3]\to {\mu }_3$ is nondegenerate and Galois equivariant. If all of $C[3]$ is rational over a field, pairing a basis produces a primitive cube root of unity in that field. Thus a quadratic field with full 3-torsion must contain $\mathbb{Q}({\zeta }_3)$ and must equal it.

More generally, if $E({\mathbb{F}}_p)[\ell ]\cong (\mathbb{Z}/\ell \mathbb{Z}{)}^2$, Frobenius acts as the identity on $E[\ell ]$. Its characteristic polynomial $X^2-aX+p$ is therefore congruent to $(X-1{)}^2$ modulo $\ell$. Comparing coefficients givesIn particular $\#E({\mathbb{F}}_p)=1+p-a$ with $a\equiv 2(\mathrm{mod}\ell )$.

The Hessian determinant of $u^3+v^3+w^3$ is a nonzero scalar multiple of $uvw$. Hence the inflection points areThere are nine of them. Since $O_C=(1:-1:0)$ is an inflection point, these are exactly $C[3]$. They are all defined overso $C(K)[3]\cong (\mathbb{Z}/3\mathbb{Z}{)}^2$.

Apply the Riemann-Roch theorem to the divisors $nO$. Since the genus is one and the canonical divisor is trivial, $\ell (nO)=n$ for $n\ge 1$. ChooseThen $x$ and $y$ have exact pole orders two and three at $O$. The seven functionslie in the six-dimensional space $L(6O)$, so they satisfy one relation. Comparing pole orders and completing squares and cubes gives a nonsingular Weierstrass equation of an elliptic curveThe functions $1,x,y$ define the morphism $P\mapsto (x(P):y(P):1)$ away from $O$. Their pole orders show that it extends with $O\mapsto (0:1:0)$. It has degree one and is therefore an isomorphism of smooth projective curves.

For $E:y^2=x^3+x+1$, the duplication formula isAt $P=(0,1)$, the tangent slope is $1/2$, so $x(2P)=1/4$ and $v_2(x(2P))=-2$. If $v_2(x(Q))=-2m<0$, the unique lowest-valuation terms in the numerator and denominator are respectively $x(Q{)}^4$ and $4x(Q{)}^3$, givingInduction yields $v_2(x(2^{m}P))=-2m$.

For a minimal integral equation, let $t=-x/y$ be the parameter of the formal group of an elliptic curve. Definewhere $E_1$ is the kernel of reduction to the identity. The parameter identifies $E_r$ with the formal group on $p^r{\mathbb{Z}}_p$. For odd $p$, the formal logarithm converges on $p{\mathbb{Z}}_p$ and is an analytic group isomorphism

For $p=2$, the logarithm gives $E_2({\mathbb{Q}}_2)\cong 4{\mathbb{Z}}_2$. The formal duplication series satisfies $[2](T)=2T+O(T^3)$, so $[2](2u)/4\equiv u(\mathrm{mod}2)$; successive lifting makes $[2]:E_1\to E_2$ surjective. Its kernel is rational 2-torsion, but $x^3+x+1$ has no root in ${\mathbb{Q}}_2$ because it has no root modulo $2$. Thus $[2]$ is an isomorphism and

A one-dimensional commutative formal group law over a ring $R$ is a series $F(X,Y)\in R[[X,Y]]$ satisfyingAn isomorphism from $F$ to $G$ is a series $h(T)=uT+O(T^2)$ with $u\in R^{\ast }$ and

Over a characteristic-zero field $K$, every such formal group is isomorphic to the additive formal group. Differentiate the associativity identity and define the invariant differentialTermwise integration is possible in characteristic zero; the formal logarithmhas leading term $T$. Invariance of ${\omega }_F$ givesand evaluation at $(0,0)$ removes the integration constant. Hence ${\log }_F(F(X,Y))={\log }_F(X)+{\log }_F(Y)$. Its unit linear coefficient gives a compositional inverse, so it is an isomorphism to $X+Y$. Therefore any two one-dimensional commutative formal groups over $K$ are isomorphic.

Equality of the two point groups implies equality of their orders. Since ${\alpha }^2+{\beta }^2=a^2-2p$,soIts two integral solutions are $a=p+1$ and $a=-p$. The Hasse theorem for elliptic curves excludes the first for every prime and permits the second only when $p\le 4$. Thus $p=2$ or $p=3$.

Both occur. Over ${\mathbb{F}}_2$, the smooth curve $y^2+y=x^3+x$ has five rational points and trace $-2$. Over ${\mathbb{F}}_3$, the smooth curve $y^2=x^3-x+1$ has seven rational points and trace $-3$. In either case the point-count formula gives $\#E({\mathbb{F}}_{p^2})=\#E({\mathbb{F}}_p)$. Since $E({\mathbb{F}}_p)\subseteq E({\mathbb{F}}_{p^2})$, equal orders give equality of groups.

The zeta function of an elliptic curve over a finite field is the formal power seriesThe proof of Hasse's theorem gives the characteristic equation ${\pi }^2-[a]\pi +[p]=0$. If $\alpha ,\beta$ are the roots of $X^2-aX+p$, then the elliptic-curve point count over a finite field isUsing $\exp ({\sum }_{r\ge 1}{u}^r{T}^r/r)=(1-uT{)}^{-1}$ therefore gives

The Hasse theorem for elliptic curves states thatLet $\pi$ be the Frobenius isogeny of an elliptic curve and put $a=p+1-\#E({\mathbb{F}}_p)$. The degree on $\mathrm{End}(E)$ is a positive-definite quadratic form, its associated bilinear form gives $\mathrm{tr}(\pi )=a$, and $\mathrm{deg}\pi =p$. Consequentlyfor all integers $m,n$. If $a^2-4p>0$, this real quadratic form is indefinite, so by density of rational slopes it is negative at some nonzero integer pair $(m,n)$, contradicting nonnegativity of the degree. Hence $a^2\le 4p$, which is the claimed bound.

Assume multiplication in $M$ were recursive. The multiplication half of Tennenbaum's coding argument says that, for a fixed nonstandard code $c$, bothare computably enumerable from the multiplication table. The proof uses the canonical prime-power coding in PA; bounded inequalities are replaced by existential sum-of-four-squares conditions using the Lagrange four-square theorem, and the resulting witnesses can be searched for effectively from multiplication. Dovetailing the two searches decides the coded set. Applied to $c$, this would make $X$ recursive, contradicting the hypothesis. Therefore multiplication in $M$ cannot be recursive.

The Tennenbaum theorem states that no countable nonstandard model of Peano arithmetic has a presentation on $\mathbb{N}$ in which both its addition and multiplication operations are recursive.

Suppose such a formula $\theta (x)$ existed. Apply the diagonal lemma to $\neg \theta (x)$ to obtain a sentence $\sigma$ for whichBecause $M\models {\mathrm{PA}}^{-}$, the equivalence holds in $M$. But the defining property of $\theta$ says $M\models \theta (┌\sigma ┐)$ exactly when $M\models \sigma$, producing $M\models \sigma$ exactly when $M/\models \sigma$, a contradiction.

The diagonal lemma says that for every one-variable formula $\theta (x)$ there is a sentence $\gamma$ such thatLet $d(n)$ be the computable function taking the code of a one-variable formula $\alpha (x)$ to the code of $\alpha (\bar{n})$. By the assumed representation theorem, choose a Sigma-1 formula $D(x,y)$ representing $d$. Given $\theta$, putand let $b=┌\beta ┐$. Taking $\gamma =\beta (\bar{b})$, representability proves in $T$ that the unique relevant $y$ is $d(b)=┌\gamma ┐$, yielding the required equivalence.