For a ring homomorphism $A\to B$, the Module of Kähler differentials ${\Omega }_{B/A}$ is the $B$-module generated by symbols $db$, subject toEquivalently, it represents $A$-linear derivations:For $A\to B\to C$, the Transitivity exact sequence for Kähler differentials isIf $B\to C=B/I$ is surjective, the Conormal exact sequence for Kähler differentials is

Let $L/K$ be a finite field extension. By the primitive element theorem, its maximal separable field extension $L_s/K$ is simple, and transitivity reduces the calculation to a simple algebraic extension. If $L=K(\alpha )$ with minimal polynomial $m_{\alpha }$, thenThus a separable simple extension has zero differentials. Conversely, if $L/K$ is not separable, the purely inseparable part has a generator whose minimal polynomial has zero formal derivative in positive characteristic, producing a nonzero differential. Hence

Now let $\mathrm{char}K=p>0$. If $L=K(a)$, $a^p\notin K$, and $a^{p^2}\in K$, then the minimal polynomial is $T^{p^2}-a^{p^2}$ and has zero derivative, soIf $L=K(a,b)$, where $a\notin K$, $b\notin K(a)$, and $a^p,b^p\in K$, then $[K(a):K]=[L:K(a)]=p$. Both defining equations have zero derivative, and

For the three morphisms, compute the Sheaf of relative Kähler differentials on coordinate rings.

If $\mathrm{char}k\ne 2$, this is $k[y]/(y)dy$ and its support is the origin $V(y)=V(x,y)$. If $\mathrm{char}k=2$, it is free of rank one and its support is all of $X$.

Its support is the origin $V(x)$ in every characteristic; the module is $k[x]/(x)$ unless $\mathrm{char}k=2$, when it is $k[x]/(x^2)$.

Its support is the entire component $V(x)\subset X$.

The three-isogeny descent connecting map, identified through the Weil pairing with $H^1(\mathbb{Q},{\mu }_3)={\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^3$, isThe long exact sequence attached to $0\to E[\varphi ]\to E\stackrel{\varphi }{\to }{E}^{\prime }\to 0$ makes it a group homomorphism withThe function $f=y$ from part (b) gives the explicit formulaAt $T$, the value $d^{-1}$ is the leading coefficient of $y$ relative to the local parameter $x$, since $y(y+d)=x^3$ gives $y/x^3\to d^{-1}$. At $-T=(0,-d)$ the ordinary formula gives $-d$, whose class is the inverse of $d^{-1}$ because $-1$ is a cube.

Let $S$ be the primes dividing $d$. For a prime $\ell \notin S$, useIf $v_{\ell }(y)>0$, then $y+d$ is an $\ell$-adic unit, so $v_{\ell }(y)=3v_{\ell }(x)$. If $v_{\ell }(y)<0$, then $v_{\ell }(y+d)=v_{\ell }(y)$, so $2v_{\ell }(y)=3v_{\ell }(x)$. In either case $v_{\ell }(y)$ is divisible by three; the special values at $O$ and $T$ have the same property. ThereforeWhen $d=1$, this power-class group is trivial: a rational number whose valuation at every prime is divisible by three is a cube up to sign, and $-1=(-1{)}^3$. Thus $\alpha$ is trivial, its kernel is all of $E^{\prime }(\mathbb{Q})$, and

The principal divisor criterion on an elliptic curve says that $D=\sum n_P(P)$ is principal exactly when $\mathrm{deg}D=0$ and $\sum [n_P]P=O$.

On $E^{\prime }:y^2+dy=x^3$, takeThe line $y=0$ meets the cubic three times at $T$, while $y$ has a triple pole at the point at infinity. HenceWith $g=u/v\in \mathbb{Q}(E)$, part (a) givesTaking divisors and cancelling the factor three yieldsPullback on degree-zero divisor classes is the dual isogeny, so the pulled-back class is represented by $\hat{\varphi }(T)$. It is principal, and therefore

An isogeny of elliptic curves is a nonconstant morphism preserving identity points; it is automatically a finite surjective group homomorphism. On the affine chart $v\ne 0$, putThe equation of $E$ is $t^3+d=s^3$, and the proposed map isIt lands on $E^{\prime }$ becauseThe rational formulas extend across $v=0$ to a morphism sending $O_E$ to $O_{E^{\prime }}$. It is nonconstant, hence an isogeny. On function fields, $t$ satisfies $t^3=y$, so the degree is at most three; generically the three cube roots give three distinct preimages. Equivalently, the points with $v=0$ form its three-element geometric kernel. Therefore

For a reduced rational number $x=a/b$ with $b>0$, the height of a rational number isCondition (i) holds because only finitely many coprime integer pairs have bounded maximum.

Condition (iii) also holds. The standard height inequalitygivesCondition (ii) fails: for positive integers $m$,whose absolute value is unbounded. Thus precisely conditions $\boxed{\text{(i) and (iii)}}$ hold. This is consistent with $\mathbb{Q}/n\mathbb{Q}=0$ although the additive group $\mathbb{Q}$ is not finitely generated.

If $A$ is finitely generated, the structure theorem for finitely generated modules over a principal ideal domain immediately makes $A/nA$ finite.

Conversely, first replace the given height by a quadratic one. SetCondition (ii) makes this limit converge and givesThus $\hat{h}$ still has finite bounded subsets. Condition (i) also gives a global lower bound for $h$, so $\hat{h}\ge 0$. Applying condition (iii) to $2^{r}P,2^{r}Q$, dividing by $4^r$ and passing to the limit gives one direction of the parallelogram identity. Applying the same inequality to $P+Q$ and $P-Q$, and using $\hat{h}(2P)=4\hat{h}(P)$, gives the reverse direction. Henceand induction yields $\hat{h}(mP)=m^2\hat{h}(P)$ for every integer $m$.

Now suppose $A/nA$ is finite and choose representatives $R_1,\dots ,R_s$. Put $R={\max }_i\hat{h}(R_i)$. For any $P$, write $P=nQ+R_i$. Nonnegativity and the parallelogram identity giveso, since $n\ge 2$,Repeated division modulo $nA$ therefore reaches the finite set $B=\{P:\hat{h}(P)\le R+1\}$. Reversing the recursion expresses every element of $A$ using $B$ and the finitely many $R_i$. This is the height descent lemma, and proves

The natural maphas finite image by hypothesis. It remains to bound its kernel. If $P\in E(K)$ becomes $nQ$ for $Q\in E(L)$, thenis a one-cocycle for $G=\mathrm{Gal}(L/K)$. Changing $Q$ by an $n$-torsion point changes this cocycle by a coboundary, producing a well-defined map from the kernel toIf its cohomology class is zero, subtracting the corresponding torsion point from $Q$ makes $Q$ Galois fixed, so $P\in nE(K)$. The map is therefore injective. Both $G$ and $E(L)[n]$ are finite, so this group cohomology set is finite. A finite kernel and finite image give

An integral Weierstrass equation has good reduction outside the finitely many primes dividing its nonzero discriminant. This proves finiteness of the set of bad primes. To prove finiteness of rational torsion, choose two distinct good primes. The reduction of torsion points on an elliptic curve injects each primary component at a good prime of different residue characteristic, so the two finite reduced point groups bound every primary component of $E(\mathbb{Q}{)}_{\mathrm{tors}}$.

Forthe displayed equation is minimal andIts bad primes are therefore exactlyThe good reductions at $11$ and $13$ haveTheir coprime orders exclude every rational torsion primary component, including the residue-characteristic components by using the other prime. Hence

For a minimal integral Weierstrass equation, let $\tilde{E}$ be the reduced cubic and ${\tilde{E}}_{\mathrm{ns}}(k)$ its nonsingular points, with their induced group law. Define the filtration of elliptic-curve points over a local field byandThe parameter $z=-x/y$ identifies $E_1(K)$ with the formal group of an elliptic curve on $\pi {\mathcal{O}}_K$. Part (a) therefore gives $E_1(K)[n]=0$. Reduction restricts to the exact sequenceIts restriction to $n$-torsion has trivial kernel, yielding the injection

A one-dimensional commutative formal group law over ${\mathcal{O}}_K$ is a power series $F(X,Y)\in {\mathcal{O}}_K[[X,Y]]$ satisfyingA morphism $h:\mathcal{F}\to \mathcal{G}$ is a series $h(T)\in T{\mathcal{O}}_K[[T]]$ satisfyingIf $h(T)=uT+O(T^2)$, the invertible morphism criterion for formal group laws says that $h$ is an isomorphism whenever $u\in {\mathcal{O}}_K^{\times }$. Indeed, recursive coefficient comparison constructs a unique compositional inverse $j(T)$; applying $j$ to the morphism identity shows that $j$ is a morphism in the opposite direction.

The multiplication series hasSince $p\nmid n$, its linear coefficient is a unit, so $[n{]}_{\mathcal{F}}$ is an automorphism of the group $\mathcal{F}(\pi {\mathcal{O}}_K)$. Its kernel is therefore zero, and

For $E:y^2=x^3+3$, direct counting givesNeither group order is divisible by $17$, so neither group contains a point of order $17$.

At $p=17$ the Frobenius trace is zero. The elliptic-curve point count over a finite field has trace recurrenceFor every $n\ge 1$, this order is congruent to one modulo $17$. Consequently $E({\mathbb{F}}_{17^n})$ has no point of order $17$ for any $n$.

At $p=31$, the trace is $a=31+1-43=-11$. On $E[17]$, Frobenius has characteristic polynomialIts discriminant is $14$, a nonsquare in ${\mathbb{F}}_{17}$, so its two distinct eigenvalues lie in ${\mathbb{F}}_{17^2}^{\times }$. Their orders divide $17^2-1=288$, whence ${\pi }^{288}=1$ on $E[17]$. Thus all of $E[17]$ is rational over ${\mathbb{F}}_{31^{288}}$, and in particular a point of order $17$ exists over some extension with $n\ge 2$.

The Hasse theorem for elliptic curves states that, for an elliptic curve over ${\mathbb{F}}_q$,Let $\pi$ be the Frobenius isogeny of an elliptic curve and put $a=q+1-\#E({\mathbb{F}}_q)$. The fixed points of $\pi$ are $E({\mathbb{F}}_q)$, and $1-\pi$ is separable, soHence the trace of an elliptic-curve endomorphism iswhile $\mathrm{deg}\pi =q$.

The degree on $\mathrm{End}(E)$ is a nonnegative quadratic form. Polarization and the identities for the dual isogeny give, for integers $m,n$,If $a^2>4q$, this real binary quadratic form is indefinite. An open cone on which it is negative contains a nonzero rational point and therefore a nonzero integer point, contradicting nonnegativity of isogeny degree. Thus $a^2\le 4q$, which is exactly the claimed inequality.

Let $E$ be a smooth plane cubic whose identity $O$ is an inflection point. A line through $P$ and $Q$, using the tangent when $P=Q$, has a third intersection $R$ counted with multiplicity. The chord-and-tangent group law defines $P+Q$ by drawing the line through $R$ and $O$ and taking its third intersection.

The clean verification of the group axioms uses divisors. The line at infinity meets a Weierstrass cubic in $3(O)$, so three collinear points $P,Q,R$ satisfyConsequently the mapsends the chord-and-tangent construction to addition of divisor classes. The principal divisor criterion on an elliptic curve shows that this map is bijective. Associativity and commutativity therefore follow from the abelian group law on ${\mathrm{Pic}}^0(E)$. The tangent convention handles repeated intersections, $O$ represents the zero class, and the third point on the line through $P$ and $O$ represents the inverse of $P$. Hence all group axioms hold.

We give the Agrawal–Biswas primality test, which has one-sided error. Small inputs and perfect powers can first be recognized deterministically. For every remaining integer $n$, put $d=\lceil 4{\log }_{2}n\rceil$ and choose a uniformly random monic polynomialUsing repeated squaring in the quotient ring $(\mathbb{Z}/n\mathbb{Z})[X]/(r)$, test the identityThis takes time polynomial in $\log n$ because every intermediate polynomial has degree below $d=O(\log n)$.

If $n$ is prime, the intermediate binomial coefficients are divisible by $n$, so the identity always holds. Now suppose that $n$ is composite and is not a prime power. Choose a prime divisor $p$ and write $n=p^{a}m$ with $p\nmid m$ and $m>1$. Over ${\mathbb{F}}_p$,because an intermediate coefficient equal to $m$ is nonzero modulo $p$. Henceis a nonzero polynomial of degree below $n$ over ${\mathbb{F}}_p$.

Reduction of random $r$ modulo $p$ is uniform among the $p^d$ monic degree-$d$ polynomials. The polynomial $F$ has at most $n/d$ distinct monic irreducible factors of degree $d$. On the other hand, the number $I_p(d)$ of monic irreducibles of degree $d$ obeys the standard lower boundWhenever $r\mathrm{mod}p$ is one of these irreducibles but does not divide $F$, the tested congruence fails. Thus one trial detects compositeness with probability at leastafter the finitely many small $n$ are handled directly. Repeating $2d$ times makes the probability of missing a composite less than $(1-1/(2d){)}^{2d}<1/2$, while a prime is never rejected. Therefore compositeness is in RP, and primality testing is in

First suppose $L\in \mathbf{RP}\cap \mathbf{co}\text{-}\mathbf{RP}$. Run the RP algorithm for $L$ and the RP algorithm for its complement with fresh random bits. If the first accepts, output one; if the second accepts, output zero; otherwise repeat. Neither output can be wrong, and on every input the appropriate algorithm accepts in each round with probability at least $1/2$. The number of rounds is dominated by a geometric distribution of mean two, so this is an always-correct algorithm with polynomial expected running time.

Conversely, let $T$ be always correct when it halts and have expected running time at most $p(n)$. Run it for $2p(n)$ steps. Markov inequality givesAccept exactly when $T$ halts and outputs one; this is an RP algorithm for $L$. Accepting exactly when it halts and outputs zero is an RP algorithm for the complement. Thereforeis equivalent to zero-error expected polynomial time.

A language $L$ belongs to RP when a polynomial-time randomized algorithm rejects every $x\notin L$ and accepts every $x\in L$ with probability at least $1/2$.

Amplify the algorithm on length-$n$ inputs with $n+1$ independent repetitions, accepting if any repetition accepts. Its error on each positive input is at most $2^{-(n+1)}$, while it still never accepts a negative input. Choose all random bits for all repetitions in advance. By the union bound, the probability that this one fixed choice fails on at least one of the at most $2^n$ positive strings is at mostThus some random string works simultaneously for every input of length $n$. Hardwire that string into the polynomial-time computation and compile it into a Boolean circuit. The resulting polynomial-size circuit family decides $L$, proving