Lectures on Elliptic Curves (London Mathematical Society Student Texts)

London Mathematical Society Student Texts 24 Lectures on Elliptic Curves J.W.S. Cassels Department of Pure Mathematics...

Author: J. W. S. Cassels

46 downloads 1157 Views 2MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

London Mathematical Society Student Texts 24

Lectures on Elliptic Curves J.W.S. Cassels Department of Pure Mathematics and Mathematical Statistics, University of Cambridge

Tlrr ",hl IJ/II!~ (lICQlflbmJIlt'

UtJlPrrlllr

'''p",,1 Q,u/.rrll ~II tItllmtC'r (1/ books 11'83

HI"lIr}"

'''''''t'd h, VIII "' IJJ4.

TM Uni ...,!;ly IKu p"",fti

tIItIi publislt"J rfJIII,,,utJlUly sin"," "84.

CAMBRIDGE UNIVERSITY PRESS Cambridge New York Port Chester Melbourne Sydney

Published by the Press Syndicate of the University of Cambridge The Pitt Building, Trumpington Street, Cambridge CB2 lRP 40 West 20th Street, New York, NY 10011-4211, USA 10 Stamford Road, Oakleigh, Melbourne 3166, Australia

© Cambridge University Press 1991 First published 1991 Printed in Great Britain at the University Press, Cambridge

Library 0/ Congress cataloging in publication data available A catalogue record/or this book is available/rom the British Library

ISBN 0521 41517 9 hardback ISBN 0521 42530 1 paperback

Contents

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Introduction Curves of genus O. Introduction p-adic numbers The local-global principle for conics Geometry of numbers Local-global principle. Conclusion of proof Cubic curves Non-singular cubics. The group law Elliptic curves. Canonical form Degenerate laws Reduction The p-adic case Global torsion Finite basis theorem. Strategy and comments A 2-isogeny The weak finite basis theory Remedial mathematics. Resultants Heights. Finite basis Theorem Local-global for genus 1 Elements of Galois cohomology Construction of the jacobian Some abstract nonsense Principal homogeneous spaces and Galois cohomology

1 3 6 13 17 20 23 27 32 39 42 46 50 54 58 66 75 78 85 89 92 98 104

VI

23 24

25 26

The Tate-Shafarevich group The endomorphism group Points over finite fields Factorizing using elliptic curves Formulary Further Reading Index

108 114 118 124

130 135 136

o Introduction

Diophantine equations, that is to say equations whose solution is to be found in integers, or, alternatively, in rationals, have fascinated man from the earliest times: a Babylonian clay tablet dated to between 1600 and 1900 B.C. lists 15 solutions of the "Pythagorean" equation

X2

+ y2 = Z2.

Diophantos himself lived in Alexandria in the 3rd Century A.D. We shall meet some of his ideas. His work was continued by Hypatia, the only female mathematician of antiquity whose name has come down to us. (She was cruelly done to death by the Christians: their leader was canonized.) Another mathematician whose ideas continue to playa key role is Fermat (1601-1665). For a fuller historical account in a modern context, see A. Weil Number theory: an approach through hi~tory from Hammurabi to Legendre (Birkhiiuser, 1983). [For Hypatia, see Gibbon Decline and Fall.] In this course we concentrate attention on rational solutions of Diophantine equations. The study of integral solutions requires further considerations, which we shall not touch on. It is now clear that an appropriate language to discuss many aspects of Diophantine equations is that of algebraic geometry: not so much the classical algebraic geometry, which works over the complex numbers, but a version working over a general ground field such as the field Q of rationals and often called "Diophantine geometry". Some of the arguments and results of classical geometry go over to Diophantine geometry unchanged, for some the conclusions are more limited, and for others we

2

Lecture3 on Elliptic Curve3

must make further hypotheses which are automatically satisfied in the classical theory. Diophantine equations can be interpreted as questions about the existence of points on algebraic varieties. Here we will be concerned only with curves. Geometers classify curves by a non-negative integer, the genus. The Diophantine theory of curves of genus 0 is well understood. For curves of genus 1, there is a rich body of well-established theory and an equally rich corpus of conjecture which is currently beginning to succumb to intensive research. The Diophantine theory of curves o£ genus> 1 is in a rudimentary state (despite Faltings' Theorem). The main subject of this course is some of the basic Diophantine theory of Curves of genus 1. To set the scene, we start with an account of genus O. Here the situation is dominated by the local-global principle (Hasse principle). This relates behaviour over the rational field Q to that over its local completions, the p-adic fields Qp, where things are simpler. A unifying theme for curves of genus 1 is the extent to which local (i.e. p-adic) behaviour determines rational behaviour. This material generalizes smoothly to algebraic number fields but we have restricted attention to the rationals in the belief that new concepts are easiest acquired in the simplest contexts. The final three sections mark a change of goal. Two of them introduce the more sophisticated theory over finite fields, culminating in the estimates for the number of points known as the "Riemann hypothesis for function fields" (of genus 1). The very last section indicates how these ideas are used in the modern technology for factorizing large integers. Prerequi3ite3. In this course the prerequisites have been reduced to a minimum. We have spoken above about curves of genus 0 and 1, but the focus will be on concrete classes of curves such as conics and plane cubics. The p-adic numbers are introduced from scratch. A knowledge of algebraic number theory is not required, provided that the reader is prepared to take one statement on trust. Algebraic number theory is, however, indispensable for many applications, as we shall indicate in optional passages. We do require the rudiments of Galois theory: indeed one of the interests will be its application in novel contexts.

1 Curves of genus

o.

Introduction

We shall say that a point is rational, or defined over Q, if its coordinates are rational. A curve is said to be defined over Q if it is given by an equation or equations with coefficients in Q. [Unfortunately the term "rational curve" was preempted by the geometers as a synonym for "curve of genus O".J More generally we shall say that we are working over Q, or that the ground field is Q, if all the coefficients of the algebraic expressions involved are in Q. Sometimes elementary geometric arguments continue to be valid when we work over Q. For example, consider a cubic curve such as

C:

X2 _ y2

= (X _

2Y)(X 2 + y2),

which has a double point at the origin.

A line through the origin meets the curve in one further point, so giving

Lecture~

4

on Elliptic

Curve~

a description of all the points on the curve. More precisely, consider the line

x =sY for given s. This meets the Curve where

y2(S2 -1)

= y3(s -

2)(s2

+ 1),

and so in the point (x, y) where

s(s2-1) (s - 2)(s2 + 1) , (s-2)(s2+1)· Conversely, given (x,y) on the curve, it is of the above form with x

=

~~~~~~

s

y=~-..,..,..~--

= x/yo

We say that C is birationally equivalent to the line [given by a single variable and no equation]. In this case the birational equivalence is defined over Q [i.e. the rational functions expressing the equivalence have coefficients in Q. Note the unfortunate clash in the double meaning of the term "rational"]. In general there is a 1 - 1 correspondence between the rational points on the one curve and those on the other, the correspondence being given by the birational correspondence. There are, however, exceptions. For example s = 2 does not correspond to any point (x,y) and s = ±1 both correspond to (x,y) = (0,0). If we had had X 2 _2y2 instead of X 2 _ y2 on the left hand side, then (x,y) = (0,0) would not correspond to any rational value of s. It is not difficult to see however that if two curves are birationally equivalent over Q there are only finitely many rational points on the ones which do not correspond to rational points on the other. To study the rational points on a curve, it is thus sufficient to consider it up to a birational equivalence defined over Q. A classical theorem working over the complex field C states that every curve of genus is birationally equivalent to the line: we could treat this as a definition of "genus 0". When the ground field is Q, this theorem no longer holds. Instead we have the

°

Fact. A curve of genu~

°

defined over Q i~ birationally equivalent over

Q either to the line or to a conic. This reduces the Diophantine study of curves of genus conics.

°

to that of

Theorem 1. A conic defined over Q i~ birationally equivalent to the line if and only if it ha3 a rational point.

1: Curvl!~ of gl!nu~ 0

5

Proof. The "only if' part is trivial. Suppose then that there is a rational point. After a change of co-ordinates we may take it to be the origin, so that the equation of the conic is

FI (X, Y)

+ F2(X, Y) = 0,

where Fj is homogeneous in X, Y of degree j. The birational equivalence with the line follows by putting X = sY, as in the cubic case discussed earlier. The Diophantine theory of curves of genus 0 is thus reduced to deciding when a conic defined over Q has a rational point. It is certainly easy to write down conics without rational points. For a change, let us use homogeneous co-ordinates. There is no rational point on

X2

+ y2 + Z2 = 0,

since clearly there are no real points. Again, there are no rational points on

For suppose (x, y, z) were such a rational point. By homogeneity, we may suppose that x, y, z are integers without common divisor. Now (*) implies x 2 + y2 == 0 (3) and so x == y == 0 (3). Then (*) gives z == 0 (3), so x, y, z have the common factor 3: a contr~dicition. For our purposes, it is convenient, and ultimately indispensable, to express the last argument in a different way. We shall introduce the fields Qp of p-adic numbers, where p is a prime (here p = 3); and what we have just done can be expressed as proving that there are no points on (*) defined over Q3.

2 p-adic numbers

Most of the familiar properties of the ordinary absolute value on the real or complex fields are consequences of the following three: (i) (ii) (iii)

Irl ~ 0, with equality precisely for Irsl = Irllsl· Ir + sl ~ Irl + lsi·

r =

O.

A real-valued function 1.1 on a field k is said to be a valu.ation if it satisfies (i), (ii) (iii). Since (_1)2 = 1, properties (i)-(iii) imply that 1- 1\ = 1, 1- rl = Irl (all r). The rational field Q has other valuations than the absolute value. Let p be a fixed prime. Any rational r -I- 0 can be put in the shape r

= pP u / v ,

p E Z,

11.,

V E Z, p

A11., P Av.

We define

and

10lp = O. This definition clearly satisfies (i), (ii) above. Let s = pU m / n

m, nEZ, p

1 m, PAn,

so

Islp = p-u, where without loss of generality (7

~ p, i.e.

Islp

~

Irlp·

number~

2: p-adic

7

Then

+ s = pP(un + p"-Pmu)/un. The numerator un +p"-P mu is an integer, but, at least for r

Here p Aun. for p = 17, it may be divisible by p. Hence Ir

+ sip

~

p-P,

that is (iii*) Ir + sip ~ max{lrlp, Islp}· Clearly (iii*) implies (iii), so lip is a valuation. We call it the p-adic valuation. The inequality (iii*) is called the ultrametric inequality, since (iii), the triangle inequality, expresses the fact that Ir - sl is a metric. A valuation which satisfies the ultrametric inequality is said to be nonarchimedean. We can transfer familiar terminology from the ordinary absolute value to the p-adic case. For example, we say that a sequence {an}, n = 1,2, ... is a fundamental ~ equence if for any e > 0 there is an no (e) such that lam - anl p < e

m,n ~ no (e).

whenever

The sequence {an} converge~ to b if (all n ~ no (e)). For example let

p=5 and consider the sequence

{an}:

3,

33,

333,

3333,

Then

(m

~

n)

I.e.

(m

~

n).

Hence {an} is a fundamental sequence. Indeed it is a convergent sequence, since

I.e.

and so

5-adically.

Lect1l.Te~

8

on Elliptic

C1l.TVe~

As the above example shows, the main difficulties with the p-adic valuation are psychological: something is p-adically small if it is divisible by a high power of p. Not every p-adic fundamental sequence is convergent. Let us take p = 5 again. Then we construct a sequence of an E Z such that

and an+l

== an (5 n ).

We start with al = 2. Suppose that we already have an for some nand put an+l = an + b5 n , where b E Z is to be determined. We require (an

+ b5 n )2 + 1 == 0 (5

n

+ 1 ),

that is

where we already have c

= (a~ + 1)/5

n

E Z.

Clearly 5X an and so we can solve the congruence (*) for the unknown b. The sequence {an} just constructed is a 5-adic fundamental sequence since

(m;::: n). Suppose, if possible, that an tends 5-adically to some e E Q. Then

a! + 1 -+ e 2 + l. On the other hand, by our construction, a~

+ 1 -+ O.

Hence e + 1 = OJ a contradiction. Just as the real numbers are constructed by completing the rationals with respect to the ordinary absolute value, so the rationals can be completed with respect to lip to give the field Qp of p-adic n1l.mbeT~. In fact the process can be simplified because I Ip is non-archimedean. For the reader who is unfamiliar with this way of constructing the reals, we sketch a construction of Qp at the end of this section. We say that a field K is complete with respect to a valuation 1.1 if every fundamental sequence is convergent. A field K with valuation 11.11 is said to be the completion of the field k with valuation 1.1 if there is an injection 2

)..: k

-+

K

2: p-adic

n'Umber~

9

which preserves the valuation:

(a E k) and such that (i) (ii)

K is complete with respect to 11.11 K is the closure of )..k with respect to the topology induced by 11.11 (K is not "too large").

The completion always exists and is unique (up to a unique isomorphism). We henceforth identify k with )..k and 1.1 with 11.11, so regard Ie as a subfield of K. We now discuss the structure of the p-adic field Qp with its valuation

lip· We note that if For by (iii*) la + blp 5 lalp and, since a = (a + b) + (-b), we have a contradiction if la + blp < lalp" It follows that the set of values taken by I Ip on Qp is precisely the same as the set for Q. Indeed if a E Qp, a i- 0 then by (ii) of the definition of the completion, there is an a E Q with la - alp < lalp, so lalp = lalp. The set of a E Qp with lal 5 1 is called the set of p-adic integer~ Zp. Because lip is non-archimedean, Zp is a ring:

lalp, l/1I p 51=? laf1lp 5

1,

la + /1I p 5

l.

A rational number b is in Zp precisely when it has the form b = 'U/v, where 'U, v E Z, p 1 v. The numbers 15 E Qp with 1151 = 1 are the p-adic 'Unit~. From what was said about the values taken by 1.l p on Qp, every f1 i- 0 in Qp is of the shape f1 = pRe, where n E Z and 15 is a unit. The units are just the elements 15 of Qp such that 15 E Zp, 15- 1 E Zp. As we have already noted, elementary analysis continues to hold in Qp, but can be simpler; as the following lemma shows.

Lemma 1. In Qp the ~erie~

E: f1R converge~ if and only if f1R

-+

o.

Proof. By sayink that the sum converges, we mean, of course, that the partial sums tend to a limit. That convergence implies f1n -+ 0 is true even in real analysis. To

Eo

Lecture3 on Elliptic Curve3

10

prove the opposite implication, we note that N M N I

L - Lo

Ip

=1

o

L

{in Ip

M+I

~

max

M
l{inlp

by an obvious extension of the ultrametric inequality (iii*) to several summands. Hence

{E: {in} is a fundamental sequence, so tending to

a limit by the completeness of Qp. We are now in a position to give an explicit description of Zp. We write

A={0,1, ... ,p-1}. Lemma 2. The element3 of Zp are preci3ely the 3um3

where

(all n). Proof. By the preceeding lemma, the infinite sum converges, and its value is clearly in Zp. Now let a E Zp be given. There is abE Q such that Ib - alp < 1, and it is easy to prove that there is precisely one ao E A such that lao - blp < 1. Then a

= ao + pal

where lall ~ 1, i.e. al E Zpo Proceeding inductively, we get a

= ao + alP + ... + aNpN + aNpN+I

with aN E Zp. For the final result we must distinguish between p

= 2 and p -I- 2.

Lemma 3 (p -I- 2). Let a E Qp be a unit. A nece33ary and 3ufficient condition that a = {i2 for 30me {i E Qp in that there i3 30me I E Qp with

Proof. Necessity is obvious. We have already in effect given a proof in the special case p = 5, a = -1. That in the general case is similar: one

11 constructs inductively f31

="

f32, f33, ... such that 1f3~ - 011 ~ p-n

lf3n+1 - f3nl

~ p-n

+ Ii, so 2 f3~ + 2f3nli + li

If we already have f3n, we take f3n+1 = f3n

f3~+1 = and it is enough to take

Ii = (01 - f3~)/2f3n. This lemma ceases to hold for p

= 2 (consider 01 = 5, f3 = 1). We have

Lemma 4 (p = 2). Let 01 E Q2 be a unit. A neceHary and 3ufficient condition that 01 = f32 for 30me f3 E Q2 i3 that 101 - 11 ~ 2- 3 . Proof. Here again, the necessity is obvious. For sufficiency we construct a sequence f31 = 1, f32, f33, ... as in the previous proof. The details are left to the reader. We conclude this section be the promised sketch of the construction of QpDenote by ~ the set of fundamental sequences {an} for lip, where an E Q. Then ~ is a ring under componentwise addition and multiplication. {an}

+ {b n } = {an + bn } : {an}{b n } = {anb n } .

. A sequence {an} is a null sequence if an --+ 0 (p-adically). The set IJt of null-sequences is clearly an ideal in ~. Let {an} E ~ but {an} ~ 1Jt. Then it is easy to see that there is at least one N such that IaN - ani < laNlp for all n > N. Then lanlp = laNlp for all n ~ N. We write l{an}lp = laNIp- If an i- 0 for all n, it is now easy to deduce that {aNI} E ~. We show that IJt is a maximal ideal in~. For, if not, let 9J1 be a strictly bigger ideal than 1Jt. It must contain an {an} ~ 1Jt. Then only finitely many of the an can be 0, and replacing them by (say) 1 merely adds an element of 1Jt. Hence we can suppose that an i- 0 for all n. Then {a;l} E ~, and so {a;l}{a n } E 9J1. Hence we should have 9J1 = ~, a contradiction. We conclude that IJt is maximal, and thus ~/1Jt is a field. The field Q is mapped into ~ /1Jt by r--+{r}E~.

The function I{ an} I on ~ induces a function on ~/1Jt which is easily seen to be a valuation and to coincide with lip on the image of Q.

12

Lectures on Elliptic

Curve~

Finally, it is not difficult to check that 'J /1Jt is itself complete by a diagonal argument on a sequence of elements of 'J.

§2. Exercises 1. For each of the sets of p, m, r given, either find an x E Z such that

Ir - xl p

~

p-m,

or show that no such x exists. (i) (ii) (iii) (iv) (v)

p = 257, r = 1/2, m = 1; p = 3, r = 7/8, m = 2; p = 3, r = 7/8, m = 7; p = 3, r = 5/6, m = 9; p = 5, r = 1/4, m = 4.

2. Construct further examples along the lines of Exercise 1 until the whole business seems trivial. 3. For given p, m, r either find an x E Z such that

Ir -

x 2 1p ~p-m

or show that no such x exists.

(i)

p = 5, r = -1, m = 4;

(ii) (iii) (iv) (v) (vi) (vii)

p = 5, r = 10, m = 3; p = 13, r = -4, m = 3; p=2,r=-7,m=6; p = 7, r = -14, m = 4; p = 7, r = 6, m = 3; p= 7, r = 1/2, m = 3.

4. As Exercise 2. 5. Let p > 0 be prime, p == 2 (3). For any integer a, p there is an x E Zp with x 3 = a.

1 a,

show that

3 The local-global principle for conICS

We have seen that the theory of curves of genus 0 over Q turns on deciding whether a given conic has a rational point. We use homogeneous co-ordinates. A conic C defined over Q is given by an equation

F(X) = where X

L IijXiXj = 0

= (X 1 ,X2 ,X3 ), Iij = Iji E

Q

and the quadratic form F (recall a form is a homogeneous polynomial) is nonsingular, i.e. det(fij)

i- O.

In our initial discussion we noted that, apart from reality considerations, we could disprove the existence of rational points by congruence considerations. These we now replace by reference to p-adic numbers. A criterion for the existence of a rational point on a conic was given by Legendre. It was left to Hasse to give it the following succinct formulation.

Theorem 1. A necessary and sufficient condition for the existence of a rational point on a conic C defined over Q is that there is a point defined over the real field R and over Qp for every prime p. Necessity is trivial. We shall prove sufficiency, but it will require some time and preparation. First we introduce some conventional terminology.

14 The real field R is somewhat analogous to the Qp and is conventionally denoted by Qoo. When we write Qp we will not include p 00 unless we explicitly say so. The fields Qp (including p 00) are called the localizations of Q. In contrast, Q is called the global field. We say that something is true "everywhere locally" if it is true for all Qp (including 00). In this lingo the theorem becomes "A necessary and sufficient condition for the existence of a global point on a conic is that there should be a point everywhere locally" . The local-global theorem for conics implies a local-global theorem for curves of genus 0 but some care must be taken in the formulation ["point" must be interpreted as "place"]. We do not pursue this further.

=

=

In the rest of this section we transform the theorem into a shape better suited for attack l . A transformation

with

tij E Q, det(tij) "# 0 takes the quadratic form F(X) into a quadratic form G(Y), say. Then T takes points defined over Q on F(X) = 0 into points defined over Q

=

=

on G(Y) 0 and, similarly, the inverse T- l takes points on G(Y) 0 to points on F(X) = O. Likewise for points defined over Qp for each p (including 00). Hence the theorem holds for F(X) 0 if and only if it holds for G(y) = n. By suitable choice ot transformation T we thus need consider only "diagonal" forms

=

By substitutions Xj generality that the

F(X) = hX~ + hX~ + hX;. --> tjXj (tj E Q) we may suppose without loss of

Ij E Z are square free. If h, 12, h have a prime factor p in common, We replace F(X) by p-l F(X). If two of the Ij, say h, h have a prime p in common but pI

h,

we replace X3 by PX3 and then divide F by p. Both of these

1 The details of the proof of Theorem 1 will not be required for the treatment

of elliptic curves. The reader who is interested only in the latter should omit the rest of this § and also omit §§4,5.

3: The local-global principle for conics

15

transformations reduce the absolute value of the integer hhh. After a finite number of steps we are reduced to the case when fd2h is square free. We have thus proved the

Metalemma 1. To prove the Theorem, it is enough to prove it for conics

F(X)

= flX~ + hX~ + hX; = 0,

where!; E Z and fdd3 is square free. The next stage is to draw conclusions from the hypothesis that a conic as described in the Metalemma has points everwhere locally. There is a point defined over Qp when there is a vector a (al,a2,a3)"# (0,0,0) with aj E Qp such that F(a) = O. By multiplying the aj by an element of Qp we may suppose without loss of generality that

=

maxlajlp

= 1.

(*)

For our later purposes we have to consider several cases.

First case. p"# 2, p I hhh· Without loss of generality pi h, so pI h. pI h· Then Ifla~lp < 1. Suppose, if possible that la21p < 1. Then

Iha~lp Iha~lp

= Iha~ + ha~lp

= Iha~ + ha~lp 5

<1 p-2

and so lall p < 1 since h is square free. This contradicts the normalization (*), and so la21p la31p 1. But now

=

=

Iha~

+ ha~lp <

1.

On dividing by the unit a2, we deduce that there is some rp E Z such that

=

Second case. p 2, 21 hhh. It is easy to see that precisely two of the aj are units, say a2 and a3. Now a 2 1 or 0 (4) for a E Z; and so

=

h+h=0(4).

=

Third case. p 2, 2 I flhh, say 2 I II- Now la212 a 2 1 (8) for a E Z, 21 a; and so

=

h + h =0 (8) or

fl

+ 12 + h

=0 (8)

= la313 = 1.

Now

16

In the next two sections, we show that the conditions just derived are sufficient to ensure the existence of a global point on F(X) O.

=

§3. Exercises 1. (i) Let p > 2 be prime and let b, c E Z, p 1 b. Show that bx2 + c takes precisely Hp + 1) distinct values p for x E Z. (ii) Suppose that, further, a E Z, p 1 a. Show that there are x, y E Z such that bx 2 + c == ay2 (p).

=

2. Let a, b, c E Zp, lal p Iblp = Iclp = 1 where p is prime, p > 2. Show that there are x, y E Zp such that bx 2 + c ay2.

=

=

3. Let p > 2 be prime, a'i E Z (1 ~ i, j ~ 3), aii a'i and let d = det(a'i). Suppose that p 1 d. Show that there are Xl, x2, x3 E Z, not all divisible by p, such that L',i a'ixixi == 0 (p).

z, 21 abc. Show that a necessary and sufficient condition that the only solution in Q2 ofax 2 + by2 + cz 2 0 is the trivial one is that a == b == c (4). 4. Let a, b, c E

=

5. For each of the following sets of a, b, c find the set of primes p (including 00) for which the only solution ofax 2 + by2 + cz 2 0 in Qp is the trivial one:

=

(a, b, c) (ii) (a, b, c) (iii) (a, b, c) (iv) (a, b, c) (i)

= (1, 1, -2)

= (1,1, -3) = (1, 1, 1) = (14, -15, 33)

6. Do you observe anything about the parity of the number N of primes (including 00) for which there is insolubility? If not, construct similar exercises and solve them until the penny drops. 7.(i) Prove your observation in (6) in the special case a c -s, where r, s are distinct primes> 2. [Hint. Quadratic reciprocity] (ii) [Difficult]. Prove your observation for all a, b, c E Z.

=

= 1, b = -r,

4 Geometry of numbers

At this stage we require a tool from the Geometry of Numbers, which we shall develop from scratch. A generalization of the pigeon-hole principle (Schubfachprinzip) says that if we have N things to file in H holes and N > mH for an integer m, then at least one of the holes will contain ~ (m + 1) things. We start with a continuous analogue. Let R n denote the vector space of real n-tuples r = (rl, ... , rn). It contains the group zn of r for which rj E Z (all j). By the volume V(S) of a set S C R n we shall mean its Lebesgue measure, but in the applications we will be concerned only with very simple-minded S. Lemma 1. Let m > 0 be an integer and let S C R n with V(S) > m. Then there are m

+ 1 di3tinct point3 so, ... ,Sm Si -

Sj

E

zn

(o::=; i,

j

of S such that

: =; m).

Proof. Let W C R n be the "unit cube" of points w with

o::=; Wj < 1

(l::=;j::=;n).

n

Then every x E R is uniquely of the shape

x= w+z, where z E zn. Let .,p( x) be the characteristic function of S (= 1 if XES,

18

Lecture3 on Elliptic Curve3

= 0 otherwise).

Then

< V(S)

m

r 1/;(x)dx

=

Jan

=

r (L 1/;( w + Z)) dw.

Jw

_Eln

Since V(W) = 1, there must be some Wo E W such that

L

1/;(wo +z) > m,

_El n

so We may now take for the Sj the Wo

;::: m

+ 1.

+ z for which 1/;(wo + z)

> O.

The set S is said to be 3ymmetric (about the origin) if -x E S whenever xES. It is convex if whenever x, YES, then the whole linesegment (0~~~1)

joining them is in S. In particular, the mid-point Theorem 1. Let A be a. 3ubgroup of 3ymmetric convex 3et of volume

zn

Hx + y) is in S.

of index m. Let

CeRn

be a.

V(C) > 2nm. Then C a.nd A ha.ve a. common point other tha.n 0 = (0, ... ,0). Proof. Let S

= ~C

be the set of points

V( ':C)

tc,

C

E C. Then

= Tnv(c) > m.

2

By Lemma 1, there are m

+ 1 distinct points Co, ... , C

':C· - ':c· 2 2] I

E

zn

~

(0

i, j

~

m

E C such that

m).

+ 1 points

There are m

1

1

(O~i~m)

-Cj--CO 2 2

and m cosets of zn modulo A. By the pigeon hole principle, two must be in the same coset, that is there are i, j with i f. j such that 1 -Cj 2

Now

-Cj

1 -Cj 2

E A.

E C by symmetry; and so 1 -Cj -

2

by convexity.

1

-c· 2]

1

1

= -Cj + -(-c·) 2 2 ]

EC

§4: ExeTcises

19

Note. Lemma 1 and Theorem 1 with m = 1 are due to Blichfeldt and Minkowski respectively. The generalizations to m > 1 are by van der Corput.

As a foretaste of the flavour of the application in the next section, we give Lemma 2. Let N be a. positive integeT. Suppose tha.t theTe is a.n I E Z such tha.t

12 Then N

= u +v 2

2

=:0

-1 (N).

fOT some u, v E

z.

PTOOf. We take n = 2 and denote the co-ordinates by x, y. For C we take the open disc

of volume (= area)

= 271"m > 22m.

V(C)

The subgroup A of Z2 is given by x, y E Z,

Y

=:0

Ix (m).

It is clearly of index m. Hence by the Theorem there is

(0,0)

f.

(lL,V) E AnC.

Then

and

u 2 +v 2 =:ou 2(1+12)=:oO (m). Hence u + v = m, as required. We note, in passing, that the condition of the lemma satisfied for primes p wi th p =:0 1 (4). 2

2

IS

certainly

§4. Exercises 1. Let m E Z, m > 1 and suppose that there is some fEZ such that Show that m = u 2 + uv + v 2 for some u, v E Z.

P + f + 1 =:0 0 (m). 2. Find a prime p

> 0 for which there is an fEZ such that 1+

but p is not of the shape u

2

5P =:0 0 (p)

+ 5v 2 (u,

v E Z).

5 Local-global principle. Conclusion of proof

We now complete the proof of the local-global principle for conics using the theorem of the last section. We recall that we had reduced the proof to that for II

X; + hxi + hxi = 0

where h, h, h E Z and II hh is square free. We assume that there are points everywhere locally and we showed that this implied certain congruences to primes p dividing 2Idd3. We first define a subgroup A of Z3 by imposing congruence conditions on the components of x = (XI, X2, X3). First ca.se. p

there is an

Tp

2, p 1 Idd3, say p E Z and that

f.

I II·

We saw (end of §3) that then

h + r;h == 0 (p). We impose the condition

Then

F(x)

= hx~ + hx~ + hx~ == (12 + T:h)x~ == 0 (p).

Second case. p

= 2, 21 hhh. Then without h + h == 0 (4).

loss of generality

5: Local-global principle. Conclu3ion of proof

21

We impose the conditions Xl

== 0 (2)}

X2 == X3 (2) , which imply

F(x) == 0 (4). Third case. p =

2,21 hhh, say 21 /1. Then s2/1 + h + h == 0 (8),

where s = 0 or 1. We impose the conditions

(4)}

X2==X3 Xl == JX3 (2) , which imply

F(x) == 0 (8). To sum up. The group A is of index m (say) = 41/1 h h 1in Z3, where throughout this section II is the absolute value. Further,

F(x) == 0 for x EA. We apply the theorem of the previous section to A and the convex: symmetric set

C: Ihlx~

+ Ihlx~ + Ihlx~ < 4lfd2hl·

School geometry shows that

V( C) = (-11"/3) .23 .14fdd31 > 2314fdd31 =m.

Hence there is an c

f.

0 in An C. For this x we have

F(x) == 0

(4liIhhD

and

IF(x)1 ~ IiI Ix~ + Ihlx~ + Ihlx~ < 41hhhii so

F(x) as required. We conclude with some remarks.

= 0,

22

Lecture3 on Elliptic Curve3

Remark 1. We have not merely shown that there is a solution of F(x) = 0, but we have found that there is one in a certain ellipsoid. This facilitates the search in explicitly given cases.

e. We have made no use of the condition of solubility in Qp for p l2Idd3. In fact this condition tells us nothing [ef. §3, 'Exercises 2, 3J. It is left to the reader to check that for any II, h, 13 and p with p l2Ilhh there is always a point defined over Qp on It xi + hxi + hxi = o. Remark

Remark 3. We have also nowhere used that there is local solubility for Qao

= R.

Hence solubility at Qao is implied by solubility at all the Qp (p f. 00). This phenomenon is connected with quadratic reciprocity. In fact for any conic over Q, the number of p (including 00) for which there is not a point over Qp is always even [ef. §3, Exercises 6,7J. See a book on quadratic forms (such as the author's).

§5. Exercises 1. Let F(X, Y, Z) = 5X 2

+ 3y + 8Z + 6(YZ + ZX + XY). 2

2

Find rational integers x, y, z not all divisible by 13, such that

F(x,y,z) == 0 (mod 13 2 ). [Hint.

ef. Hensel's Lemma 2 of §10.J

2. Let F(X, Y, Z)

= 7X 2

+ 3y

2

-

2Z 2

+ 4YZ + 6ZX + 2XY.

Find rational integers x, y, z not all divisible by 17 such that

F(x, y, z) == 0 (mod 17 3 ).

6 Cubic curves

In this section we consider curves given by

where F is a homogeneous cubic form. The case of interest is when the ground field is the rationals Q, but our initial remarks apply to any ground field. A point x on C is said to be 3ingula.r when

8F

8X.(x)=0

(j=1,2,3).

]

If we choose co-ordinates so that x = (0,0,1), this is equivalent to F not containing terms in X:, X1Xi, X2Xi. A singular point counts with multiplicity at least 2 as an intersection with a line. More precisely, if a, b are two points on the line, the general point on it is >.a + JLb, where the numbers >., JL are not both O. The intersections with Care given by F(>.a+ JLb)

= 0,

a homogeneous cubic in >., JL. What is claimed is that if one of the intersections is a singular point of C then the corresponding ratio>. : JL occurs as a multiple root of (*). An easy way to check this is to take b = x.

24

Lectures on Elliptic Curves

Suppose that C has two distinct singular points x, y. The line joining them cuts C at both x, y with multiplicity;::: 2. This can happen only if F(AX + J.LY) vanishes identically, i.e. if C contains the whole line. If we suppose, as we shall, that C is irreducible (i.e. that F does not factorize), this cannot happen. An irreducible cubic curve has at most one singular point. Now take the ground field to be Q. If there is a singular point over the algebraic closure Q, there is at most one. By Galois theor/ it must be defined over Q. Hence, as we have already seen in §1, C is birationally equivalent over Q to the line. From now on we restrict attention to non-singular cubic curves, i.e. those which have non-singular points over Q. Let a, b be rational points on C. The line joining them meets C in a third point, in general distinct: it is also rational since it is given by a cubic equation, two of whose roots are rational. This process was used already by Diophantos to find new unobvious points from known obvious ones. The variant in which one takes the third point of intersection with the curve of the tangent at a rational point was, according to Weil, first noted by Newton. An older generation of mathematicians refer to these as the "chord and tangent pro cesses" . In general, starting from one rational point a on C one obtains infinitely many by the chord and tangent processes. If this is not the case, a is said to be exceptional. For example we have Lemma 1. Let a ;::: 1 be a cubic-free integer and let

C: X 3

+ y3 -

aZ 3

= O.

The point (1, -1,0) is exceptional. For a = 1 the points (0,1,1), (1,0,1) are also exceptional. For a = 2 the point (1, 1, 1) is exceptional. No other rational point is exceptional. Proof. We first show that the given points are indeed exceptional. The tangent at (1, -1,0) is X +Y = 0, which meets C only at (1, -1,0). The other cases for a = 1 are similar. The tangent at (1, 1, 1) for a = 2 is X + Y - 2Z = 0, which meets C again only at (1, -1,0). Let x = (x, y, z) be a rational point other than those named. We may

2

For the cognoscenti. If the ground field is not perfect, the conclusion does not necessarily hold. See Note a.t end of §9.

§6: Exercises

25

suppose that x, Y, Z are integers without common factor. The equation for C implies that then x, y, Z are coprime in pairs. Let Xl = (Xl, Yl, Zl) be the third point of intersection, where again 3 Xl, Yl, Zl are integers without common factor. It may be verified that 3 3 3 Xl : Yl : Zl = X(X3 + 2y ) : -y(2x + y3) : Z(X3 _ y ) Let d be the greatest common divisor of the three terms on the right hand side. If a prime p divides both X and d it must also divide Y, a contradiction. Hence d divides X3 + 2y 3 and 2X3 + y3. It thus divides 3X 3 and 3y 3, so d = 1 or 3. Hence Zl

= ±Z(X3 -

or

y3)

Zl

= ±Z(X3 _

y3)/3.

In either case, it is readily verified that IZII > Izi except for the X listed in the enunciation. By repeating the tangent process we thus get a sequence of points x, Xl, X2, ... with

Izi < IZII < IZ21 < .... Hence the

Xi

are distinct, and

X

is not exceptional.

§6. Exercises 1. (i) Show that the cubic curve y2 Z = X 3 + AX Z2

+ B Z3

is non-singular provided that

4A 3 (ii)

+ 27 B2 -I- O.

If 4A 3 + 27 B2 = 0, find a singularity and decide whether it is a cusp or a double point with distinct tangents.

2. (i) Let where ala2 a 3

-1-0.

Show that F(x) = 0 is non-singular provided that 3 al a2a3 + d -I- O. (ii)

If a~

3

= a2 = a3 = 1, d = -3, show that any = x~ = x~ = Xl X2 X3 = 1 is a singularity.

al

point

(Xl'

X2, X3) with

This is essentially a special case of elegant formulae of Desboves for the chord and tangent processes. See Exercises and Formulary.

26

LectuTe3 on

Elliptic

CUTve3

(iii) How does the result of (ii) square with the result proved in the text that a cubic curve has at most one singularity? 3. Let F(x) be as in the previous question and suppose that F(x) = 0 is non-singular. (i) Let F(x) = O. Show that the third intersection t of the tangent at X is given by tj

= Xj(aj+lx}+l

- aj+2x}+2)

(j

= 1,2,3),

where the suffixes are taken mod 3. (ii)

Let X, y be distinct points on F(X) = O. Show that the third intersection z of the line joining them is given by Zj

=

2

2

XjYj+1Yj+2 - YjXj+1Xj+2·

[Formulae of DesbovesJ. 4. Starting with the solution (2, -1, -1) of X 3 distinct solutions.

+ y3 + 7Z 3 = 0, find 10

7 Non-singular cubics. The group law

Let C be a non-singular cubic curve and let

0

be a rational point on

C. We show that the set of rational points on C has a natural structure of commutative group with 0 as neutral element ("zero"). Hence the ground field is arbitrary, the curve C is defined over it; and by rational point we mean point defined over the ground field. The group law is defined as follows. Let a, b be rational points. Let d be the third point of intersection with C of the line through a, b. Let e be the third point of intersection of the line through 0, d. Then we write a

+b =

e.

a

The construction has to be interpreted appropriately if two or more of the points involved coincide. For example if b = a we take the tangent at a.

28

Lectures on Elliptic Curves

We have to show that this operation tative group. Clearly

"+"

gives a structure of commu-

and

for all a. Next we construct the inverse. Let the third intersection of the tangent at 0 be k. Let a- be the third intersection of the line through a and k. Then by definition

a

+ is associative: (a + b) + c = a + (b + c).

The crunch is to show that

We give two proofs; the first geometric, the second more fundamental. Let a, b, c be given. Consider the diagram

r

w

a

v

f s

t

b

c

u

d

e

0

In

n

Here r, s, t, 1, m, n are the names of lines and the remaining symbols

29

7: Non-singular cubics. The group law.

are points on C. All except f, ware intersections of two of the lines. The whole figure is determined once a, b, c and are given. e, and so (a + b) + c is the third intersection of the We have (a + b) line through 0, f. Similarly a + (b + c) is the third intersection of the line through 0, w. To prove associativity, we thus have to show that f, ware not as shown but coincide with the unlabelled intersection of the lines r, m. We now recall a geometrical

°

=

Lemma 1. Let Xl, . .. ,X8 be 8 points of the plane in general position4 . Then there is a. 9th point y such tha.t every cubic curve through Xl, ... ,X8 a.lso pa.sses through y. We briefly recall the proof of the lemma. A cubic form F(X), X = (Xl, X 2 , X 3 ) has 10 coefficients. An equation F(x) == 0 imposes a linear condition on the coefficients. Passing through Xl, ... ,Xs imposes 8 conditions. Hence if FI(X), F2(X) are linearly independent forms through the 8 points, any other F is of the shape

F(X)

=

= AFI(X) + J-lF2(X).

=

=

Now FI 0, F2 0 have 9 points in common; and clearly F 0 passes through them all. Now to the application of the Lemma. Let an equation for the line I 0 etc. and consider the two (reducible) cubics be leX)

=

FI(X) F2(X)

= I(X)m(X)n(X) = 0 = r(X)s(X)t(X) = o.

Our nonsingular cubic C passes through 8 of the points of intersection of

= =

=

FI 0, F2 0 and so by the Lemma must pass through the 9th. Hence f w, as required. We now present a second proof of the associativity of the relation "+" for points which is more basic. A linear form leX) (say) does not give a meaningful function on the curve C because the coefficients X are homogeneous. On the other hand, if t(X) is another linear form, then the quotient

g(X)

= I(X)/t(X)

does give something meaningful. In the situation just discussed, the line

4

This is the geometer's way of saying "such that the proffered proof works". In this case, what is needed is that the Xj give linearly independent conditions on the coefficients of F: so no 4 on a line and no 7 on a conic.

30

Lectures on Elliptic Curves

I(X) = 0 passes through a, h, d and t(X) = 0 through d, 0, e, all being points on C. The function g(X) thus has a zero a, h and a pole at 0, e. At the point d there is neither a zero nor a pole, as the zeros of the linear forms cancel out. There is the notion of the order of a pole or zero at a nonsingular point of an algebraic curve which generalizes in an obvious way the notion of the order of a zero or pole of a rational function of a single variable. In our case, g(X) clearly has simple poles at a, h and simple zeros at 0, e. The equation e = a+ h is equivalent to the existence of such a function. Similarly, the equation

x=(a+h)+c is equivalent to the existence of a function with simple poles at a, h, c, a double zero at 0 and a simple zero at x. The equation

(a+h)+c=a+(h+c) is now obvious. This point of view shows that the group law is unchanged under birational equivalence, since it depends only on the function field of the curve. The geometer would say that a+ h = c precisely when the divisor {a, h} is linearly equivalent to the divisor {o, c }. We conclude with an informal explanation of what is meant by saying that a nonsingular cubic curve is of genus 1. Let r ;::: 2 and let XI,··· ,Xr,YI,·.· ,Yr-I be points onC,for simplicity all distinct. By manipulating linear forms in X, as we did in the construction of g(X), one can construct a function h(X) on the curve where only poles are simple poles at XI, ... , Xr and which has zeros at YI, ... , Y r-I. Then h(X) has one further zero, which is completely determined. Contrast the position on the line. Let CI, ..• , C r , d l , ..• , d r be any 2r distinct numbers. Then the function

II(T - d j ) / II(T ]

Cj)

]

has simple zeros at the dj, simple poles at the Cj and no further zeros or poles (even at infinity). The genus of a curve is a measure of the freedom in imposing the zeros . and poles of a function. The precise statement, which we shall not need, is slightly complicated and is called the Riemann-Roell. Theorem.

31 §7. Exercises l. Let 0, a be rational points on the nonsingular cubic C. Construct the point -a with respect to the group law for which 0 is the neutral element.

2. Let 0, 01 be rational points on the nonsingular cubic C. Show how the group law for which 01 is the neutral element can be expressed in terms of that for which 0 is the neutral element. 3. Let 0, a be rational points on the nonsingular cubic C and suppose that 3a = 0 with respect to the group law based on o. Let b = 2a. Show that each side of the triangle 0, a, b meets the tangent to C of the opposite vertex at a point of C. Take 0, a, b as the triangle of reference and express this condition in terms of the coefficients of the cubic form determining C.

4. Let C be the curve

X3

+ y3 _

X Z2 - Y Z2

+ 7XY Z = 0

and let x = (x, Y, z) be a point on C defined over some Qp. Show that Ylx -+ -1 as x -+ (0,0,1) (with respect to the p-adic topology). 5. In this question everything is defined over Qp for some p. Let a be a nonsingular point on the cubic curve

F(X, Y,Z)

=0

and let t(X) = 0 be the tangent. Let I(X) = 0, m(X) = 0 be lines through a distinct from the tangent. Show that there are d, e, J such that

d/(X) + em(X) + Jt(X) (identically) with d f. 0, e f. O. Show that m(x)ll(x) as x

-+

a.

-+

-die

=0

8 Elliptic curves. Canonical Form

We are concerned with algebraic curves defined up to a birational equivalence over the ground field. For genus 0 we saw that every curve is equivalent to a conic (or line). For genus 1 no such reduction to a special fonn or forms is possible. The situation changes when we are also given a point on the curve which is defined over the ground field (a "rational point"). It is convenient to have a special name for this situation: an elliptic curve is a curve of genus 1 together with the specification of a rational point on it. As canonical form we take C : y2 = X 3 + AX + B or, in homogeneous co-ordinates y2 Z = X 3 + AX Z2

+ B Z3 .

The right hand side does not have multiple roots provided that 4A 3

+ 27B2 f. O.

The specified rational point 0 is the point (X, Y, Z) = (0,0,1) at infinity. Since the line at infinity is an inflexional tangent at 0, the group law on C is especially simple:

-(x, y)::= (x, -y) and a + b + c = 0 precisely when a, b, c are collinear. We shall find this choice of canonical form particularly convenient when the ground field is Q. When the ground field is of characteristic 2 or 3, we can no longer use C as a canonical form but must use 3 2 y2 + a1XY + a3 Y = X + a 2 X + a4 X + a6.

8: Elliptic curves. Canonical Form.

33

However this is quite peripheral to our purposes and we leave it to the reader, if she wishes, to deal with these cases. As we have not formally defined curves of genus 1, we will not gi ve a formal proof that elliptic curves are birationally equivalent to the canonical form. In compensation we will give detailed algorithms for converting certain kinds of elliptic curves to that form. These could well be omitted at first reading. Fact. (characteristic f:. 2,3). Any elliptic curve is birationally equivalent over the ground field to the canonical form for some A, B. More precisely the curve is equivalent to C and the equivalence takes the specified rational point 0 on it into the point at infinity on C. Proof for the Cognoscenti. By the Riemann-Roch theorem, the set of functions on the curve with at worst a pole of order 2 at 0 has dimension 2. Let a basis be 1, (. Similarly the set offunctions with at worst a triple pole is of dimension 3 at 0, with basis say 1, C .". Then the functions

."2,.,,(,.,,,(3,(2,(,1 all have at worst a pole of order 6. By the Riemann-Roch Theorem, there must be a linear relation between the 7 listed functions. The relation must involve both and .,,2. A transformation

e

+ C2 ." --+ C3'" + C4( + Cs ( --+ Cl(

reduces the relation to

.,,2 =

e +H( +B

for some A, B. Note for the Cognoscenti. The reason why there is no canonical form, or finite family of canonical forms for Curves of genus 1 is that

2(g - 1) = 0

for g = 1.

For every other genus we can use the di visor of the differential of a function defined over the ground field to give a birational map. For example, for genus 2, there is always equivalence with some curve y2 = sextic in X. Particular cases. The above proof does not, in any case, usually provide a practical algorithm. We discuss some special cases. Note that it is

34

Lectures on Elliptic Curves

enough to transform the curve into the shape C. For if it takes 0 into a, we can make the translation x -+ x - a on C. (i) Cubic curve 1). Rational point 0 has inflexional tangent. Here a linear tranformation of co-ordinates is enough, taking 0 to 0 and the tangent to be line at infinity. For example

0= (1, -1,0).

Put

y=u-v. Then

so

where

Xl = -6dZ, (ii) Cubic curve 1). Rational point 0 not on inflexional tangents. The tangent at 0 meets 1) again at a rational point P, say. We may take an affine system of co-ordinates with P as origin and with the tangent as Y-axis

The argument is due to Nagell: Sur les proprietes arithmeUques des cu biques planes du premier genre. Acta Math. 52 (1928-9), 92-106. Older geometrical techniques (adjoint curves etc.) had shown that every elliptic curve is birationally equivalent to a cubic, but he was the first to show that it can be reduced to the canonical form.

35

8: Elliptic curves. Canonical Form. Then the curve

1)

is given by F(X, Y) = 0, where

F(X, y)

= F1(X, Y) + F2(X, Y) + F3(X, V),

with F j is homogeneous of degree j. The Y-axis meets the curve at (0, y), where

0= yF1(0, 1)

+ y2 F2(0, 1) + l F3(0, 1).

Since the Y-axis is a tangent, we have a double root:

F2(0, 1)2 - 4F1 (0, 1)F3(0, 1)

= 0.

Now consider the intersection of the curve with Y = tX. Then

0= XFl(l, t)

+ x 2F2(1, t) + x 3F3(1, t).

Discarding the solution x = 0, we have 52

F2(1, t)2 - 4Fl(1, t)F3(1, t)

=

= G(t)

(say),

where 5

=

2F3(1, t)x

+ F2(1, t).

Now G(t) is a cubic by (*); and we achieve the canonical form by a linear transformation on 5, t. (iii) Curve 1) is y2 = Quartic in X with rational point. Let the rational point be (a, b). By a transformation 1 Y

X--+ X-a'

Y--+ (X-a)2'

we may suppose that the rational point is at infinity:

y2 where ality

14

=

is a square.

10 +!IX +hX2 +hX 3 +I4X\ On dividing by 14, we have without 14 =

We can write the right hand side

G(X)2 where

1. as

+ H(X),

G(X) =X 2 +glX +go H(X)

=

h1X

+ ho,

and the 9j, h j are easily given in terms of the The equation of the curve is now

(Y

+ G(X))(Y - G(X)

Put

Y

+ G(X)

=

T,

=

Ij.

H(X).

loss of gener-

Leciure3 on Elliptic Curve3

36 so

Y _ G(X) == H(X) T and

H~X) .

2G(X) == T _

Multiply by T2 and put T X == S. We get

2S2

+ 2g

l

TS

+ 2goT2 == T3 - hS - hoT.

This is readily brought to the canonical form. (iv) Inter3ection of two quadric 3urface3 with a rational point. We use homogeneous co-ordinates X, Y, Z, T and may suppose that the common rational point is (0,0,0,1). The two quadric forms are thus of the shape

where L, M are linear in X, Y, Z and R, S are quadratic. Suppose, first, that L and M are linearly dependent. Then without loss of generality M == O. The intersection is

S(X, Y, Z) == 0,

T == R(X, Y, Z)/ L(X, Y, Z);

which is of genus O. Otherwise, eliminating T, we have C(X, Y, Z)

= LS -

RM == 0,

where C is a homogeneous cubic. It has the rational point

L(X, Y, Z) == M(X, Y, Z) == O. Hence we are reduced to an earlier case.

§8. Exercises 1. Transform the following curves to canonical form:

(i) X 3 + y3 + dZ 3 = 0 (ii) X 3 + y3 + Z3 - 3mXYZ == 0 (iii) y2 _ kT2 = X2, y2 + kT2 == Z2 (iv)

X~X2 -XIX~ -XIX~ +X~X3 ==0

2. [Difficult]. Show that the group law on

X2 == y2 _ T2,

Z2 == y2

+ T2

37 with (1,1,1,0) as neutral element is given by

X3

= XI + X2, where

X3 = X2t2YIZI - x l t l Y2 Z2 Y3 = Y2 t 2z I XI - yl t l z2X2 Z3

= Z2t2XIYI

- zItlX2Y2

t3 = t~x~ - t~x~

= t~y~ -

t~y~ = t~z: - t:zr

3. (i) Find all the points defined over the field F 5 of 5 elements on each of

y2Z y2 Z

= X 3 + XZ 2 = X 3 + 2X Z2

y2 Z = X 3 + Z3. Check in each case that they form a group under the group law, with (0,1,0) as neutral element. (ii)

As (i) but with other Fp and other curves

y 2Z = X 3 + AXZ2

+ BZ3.

Find an example where the group is not cyclic. Can you find an example where the group requires more than 2 generators? 4. In the curves considered below, the point at infinity is taken as neutral element for the group law. (i)

Let y2 = (X - Cl!)(X2 +aX +b) be an elliptic curve. Show that the transformation X -+ X + (Cl!, 0) induces a fractional-linear transformation

T: x Check that T2 : x (ii)

-+

-+

(t11X

+ t I2 )/(t 2I x + t22).

x.

Consider y2 = (X - Cl!1)(X - Cl!2)(X - Cl!3) and let T I , T 2, T3 be = Cl!j (j = 1,2,3). Show that T I , T 2, T3 commute and that

as in (i) with Cl!

(iii) Let 'Fj be the 2 x 2 matrix of coefficients G:~ ::~) in (i) with Cl! = Cl!j (j = 1,2,3). Show that

7-.72

+ 727-.

=

O.

(iv) Find the fixed points of TI and show that they are interchanged by T2 • 5. Find a necessary and sufficient condition that a line Y

lX+m

38

Lecture3 on Elliptic Curve3

should be an inflexional tangent to

y2

= X 3 + AX + B.

Hence find a general formula for the curves in canonical form having a rational point of order 3.

6. Find a necessary and sufficient condition that a line Y should be an inflexional tangent to y2 = X(X2 + aX + b).

=

IX

+m

Hence find a general formula for curves in canonical form having a point of order 6.

7. Let F(X, Y, Z) = X2y

+ X Z2 + 2y3 + Z3.

Find a birational transformation defined over Q taking the curve F = 0 into canonical form with the point (1,0,0) going to the point at infinity. 8. Find a birational transformation defined over Q taking

xi - 2X~

+ X~ = 0,

X~ - 2X~

+ X~ = 0

into canonical form, with (1, 1, 1, 1) going to the point at infinity. 9. Invent similar exercises to the two preceding, and solve them.

9 Degenerate laws

In this section we consider the curve

C : y2

= X

3

+ AX + B

(1)

when

(2 ) There is then precisely one singular point. We recall that if (2) does not hold, there is a group law on the curve given by 6

a+b+c=O whenever a, b, c continues to give case (2), and we There are two

are the intersection of a line with C. We show that this a group law on the nonsingular points in the degenerate find out what it is. cases, the second with two subcases.

Fir3t ca3e. CU3p. Suppose A

= B = 0, so

C: y2Z = X 3 with a singular point at the origin. Any line not passing through the origin can be written Z = IX

+ mY.

It meets C where

6 We write indifferently 0 or

0

for the neutral element of the group law.

Leciure3 on Elliptic Curve3

40

If the three points of intersection are that

(Xj,Yj,Zj)

(j

= 1,2,3), it

follows

where Uj

= Xj/Yj.

We therefore have the additive group, the zero being the point (0,1,0) at infinity. Second ca3e 7 . Double point. (Characteristic -I- 2). If not both A, B vanish, then, after a transformation X ---+ X + constant, we have

(C

-I- 0),

I.e.

(y2 _ CX2)Z = X3. Suppose, first, that C

= 12

is a square. Put

V=Y-IXj so C is given by

B/UVZ = (U - V)2. Any line not passing through the origin can be written

Z = lU+mV. It meets C where

(U - V)3 - B/UV(1U + mV) If the points of intersection are

(Uj,Vj,Zj)

(j

=

O.

= 1,2,3), then

We have the multiplicative group. Now suppose that C is not a square. Adjoin I to the ground field, where 12 = C. For a point (x, Y, z) on C, put Y + IX Y -Ix

-- = r

+ 51

(say),

where

We now have a "twisted" multiplication law on (*). Compare the multiplication of the complex numbers x + iy with x2 + y2 = 1.

7

We shall not require the details about this case in later work.

9: Degenerate law3

41

Note for the Cogno3centi. In characteristic 2 the curve

c:

y2 Z

= X 3 + AX Z2 + B Z3

is always singular. Write the equation as

(y2 _ BZ2)Z

=

X(X2

+ AZ2).

Over a finite (or, more generally, a perfect) field, we have

B for some

Cl!,

p.

= p2,

A

= Cl!2

Then the curve is

(Y

+ pZ)2 Z =

X(X

+ Cl!Z)2j

which is clearly singular. If the ground field is not perfect, we may have an example of a singularity defined over an inseparable extension, compare footnote in §6.

10 Reduction

The philosophy is to approach the rational field Q through the local fields Qp and, similarly, to approach the Qp through the finite fields F p by reduction modulo p. We do no more than is required for the applicat ions. The mod p map Zp -+ F p is denoted by a bar a -+ 7.1. This is extended to the corresponding 2-dimensional projective planes V, V as follows. Let (aI, a2, aJ) be projective co-ordinates of a point a of V. By multiplying aI, a2, aJ by the same element of Qp, we have without loss of generality max{lall, la21, laJI}

= 1,

where II = lip· Then (7il, a2, aJ) are the co-ordinates of a well-defined point Ii of V. In a similar way, we define the reduction I of a line

1:

llX l

+ 12X2 + IJXJ =

O.

If the point a lies on the line 1, then clearly Ii lies on 1. We need only the least sophisticated of the many ways of reducing a cubic curve

c:

F(X)=O

defined over Qp. Here

F(X)

=

L

!ijkXiXjXk E

Qp[X]

i~j~k

where the

!ijk

E Qp are not all 0 and without loss of generality

IP~ I!ijkl

= 1.

10: Reduction

43

Then

F(X)

=

L

-hkXiXjXkl E fp[X]

i~j9

is not the zero polynomial, and defines the reduced curve

C: F(X)

=

0

8

over f p . It may, of course, be reducible . If a point a lies on C, then clearly Ii lies on C. There is a weak converse

Lemma 1. Let b be a non3ingular point oiC. Then there i3 an a on C 3uch that Ii = b.

Note. The notation b is intended to denote a point defined over fp not necessarily derived from a b. We say that b lift3 to a. It is easy to see by examples that a singular point on C mayor may not lift to a point of C (cf. Exercises). We construct a by successive approximation ala Newton. The generic term for such constructions in p-adic analysis is Hensel's Lemma.

Lemma 2. Let G(T) E Zp[T] and let to E Zp be 3uch that

IG(to)1 < 1,

IG'(to)1 = 1,

where G' i3 the formal derivative of G. Then there i3 atE Zp 3uch that G(t)

It -

=0

to I :::; G(to).

Assuming the truth of Hensel's Lemma for the moment, we complete the proof of the Lemma. Since b is nonsingular on C, we may suppose that

aF -

aX (b) l

Pick any bj E Zp such that Hensel's Lemma apply to

G(T)

b

=

"I- O.

(hl , . . . ,bn ).

= F(T, b2 , ..•

Then the conditions of

,b n ),

Put a = (t, b2 , ..• ,b n ), where t is provided by Hensel. Clearly F(a) = 0, Ii = b, so a does what is required.

It remains to prove the Hensel's Lemma. Let U be an indeterminate.

F(X) factorizes. There is an unfortunate dash of meanings between "reduced" (mod p) and "reducible".

8 In the sense that

44

Lecture3 on Elliptic Curve3

Then

G(T + U)

G(T)

=

where G j E Zp[T] and G 1

+ UG1(T) + U2G2(T) + ...

= G'.

Now define

u = -G(to)/G'(to),

so

Hence

where tl

= to + u.

Clearly

IG'(tdl = IG'(to)1 = 1. We may therefore iterate the process and get a fundamental sequence (t ~ 0). The limit t clearly does what is required.

tj

We shall also need information about the behaviour of the intersection of a line and a cubic curve under reduction. From what we have already proved, if 1 meets C in a, then I meets C in Ii. But suppose that 1 meets C in a, b with a f= b: if Ii = h, can we be sure that it has multiplicity ~ 2 in the intersection? The following lemma confirms expectations.

Lemma 3. Supp03e that the line 1 meet3 the cubic curve C in a, b, c, multiple point3 of inter3ection being given with their multiplicitie3. Then either (I)

(II)

the entire line I i3 in C or I meet3 C in Ii, h, c, multiple

point3 occuring with the correct mul-

tiplicitie3. Proof. We have without loss of generality

Consider

G(Xl,X2) Its reduction is

= F(X 1,X2, -IIXl = Zp[X 1 ,X2 ].

-12X2)

§1 0: Ezercis es IfG(XI,X2) that

45

= 0, we have case (I) ofthe

Lemma, so we may suppose

We normalize the coefficients of a, b, c so that max(lall, la21, la31)

= l.

Since la = 0, it follows that

. Cal, --a2)

i- (0,0)

etc. By hypothesis, there is some>. E Qp such that

G(X I ,X2)

= >.(a2XI - a I X 2)(b 2X I = >'H(XI,X2).

bI X 2)(C2 X I -

C I X 2)

Now

H(XI, X 2)

=

(a2XI - aI X 2)(b2X I - bIX2)(C2XI - CI X 2)

i- O. Hence G, H differ only by a scalar multiple, which is what we needed to prove.

§10. Exercises X 3 + paver Qp. Show that the point (0,0) on the mod p curve does not lift to a point of C.

l. (i) Let C be the curve

(ii)

y2

=

Find an example of an elliptic curve Cover Qp such that the mod p curve has a cusp which is the reduction of a point on C.

2. Find examples of curves Cover Qp such that the mod p curve has a. double point with distinct tangents which (i) lifts, (ii) does not lift, to

C.

11 The p-adic case

Let

c:

= x 3 + AX + B

y2

be an elliptic curve defined over Qp, so

4A 3

+ 27B2 1= 0

and, without loss of generality,

A,B E Zp. In this section we study the group (5 of points on C defined over Qp. Our tool will be the theory of reduction developed in the preceeding section. For this, we write C homogeneously C: y 2Z=X 3 +AXZ 2 +BZ 3. The reduced curve

c:

y2 Z

= X 3 + AX Z2 + B Z3

over Fp may be singular but (with an eye to Lemma 3 of §10) we note that C does not contain a "line. -;;;-{o) Let (5 denote the set of points on C defined over Fp and let (5 C (5 be the non-singular points. Write (5(0) C (5 for the set of points which reduce mod p to

-(0) (5

The map (5(0) --+ ~o)

is surjective by Lemma 1 of §1O. How does the group structure behave? Let a, b, c E a+ b + c = o.

(5

with

47

11: The p-adic cau

This holds if and only if a, b, c are the intersection of C with a line L Then the reductions Ii, b, c are the intersections of C with 1 On C we have defined a group law only for the non-singular points_ If Ii, b,

c E -(0) IB ,

then

Ii+b+c=o. To sum up so far, we have a subgroup IB(O) of IB such that there is a group homomorphism IB(O) -+ IB(O) onto IB(O). The kernel of this homomorphism is the set of points which map into 0, that is, in inhomogeneous co-ordinates, 0 itself together with the (x, y) E IB with x ¢ Zp, Y ¢ Zp. This is called the kernel of the reductio n. Next, we look at the structure ofthe kernel of reduction. If (x, y) E IB, x, y ¢ Zp, then clearly IYl2 = Ixl 3 and so

IYI=ln

Ixl=p2n,

for some n ~ l. We call n the le-uel of (x, y). For (x, y) not in the kernel of reduction the level is 0, by definition. The level of 0 is 00. Now for integer N ~ 1 make the transformation

Xw

= iNX,

YN

= lNy,

ZN

= Z,

so the equation of C becomes

CN:

y~ZN = Xlv

+ p4 AXNZ-:V + p6 BZlv.

We may use the new co-ordinates for a reduction mod p: the reduced curve IS

CN:

y~ZN = Xlv·

We can now transfer what was done earlier to the new situation. A point (x, y) maps into the singular point (0,0) ofC N if its level is < N. It is in the kernel of reduction for CN if its level is > N. Finally, the group of the non-singular points on the C N defined over F p is the additive group of Fp. They are in the image of IB, as before. For N ~ 1 define IB(N) to be the set of points of IB of level ~ N. We have proved

Lemma 1. The IB(N) are groups and IB

:J

IB(O)

:J

1B(1)

:J ... :J IB(N) :J ....

The quotient graphs of IB(N) jlB(N+I) for N ~ 1 are cyclic of order p. The quotient IB(O) jlB(l) is isomorphic to the group of nonsingular points on C. Further, nlB(N) =

N

{a}.

48

Leciure3 on Elliptic Curve3

The sequence of groups is called the p-adic filtration. Corollary. Let x = (x, y) E \5 be of finite order prime to p. Then x, y E Zp. Proof. Otherwise x is of some level n ~ 1. Then x E \5(n), x ¢ \5(n+l) and so maps into a non-zero element of \5(n) /\5(n+l). But this is of order

p. Our next aim is to free the statement in the Corollary from the requirement that the order is prime to p. The homomOl'phism of \5(N) /\5(N+l) to the additive group mod p is given by (X,y)---+p-N X/ y modp.

For x E \5(1) we introduce u(x) defined by

u(x) u(o)

= x/y = O.

(x

= (x,y)),

Note that lu(x)1 = p-n, where n is the level of x. Lemma 2. Let Xl, x2 E \5(1). Then

IU(Xl

+ X2) -

u(xd - u(x2)1 S; max {lu(xdI

Proof. We may suppose that none of Xl, X2, Xl of generality

+ X2

5

,

I(X2W}.

is o. Without loss

lu(xdl ~ IU(X2)1· Define N to be the level of Xl' We use the co-ordinates X N , YN and the curve CN introduced above. Since neither Xl, nor X2 maps into the singularity (0,0) of the line joining them has the shape

eN,

ZN = IX N

+ mYN ,

where

III

S; 1,

This meets C where

°= - Y~(lXN +

mYN)

+ X~

+ p4N AXN(lXN + myN )2 + IN B(IXN + myN )3 =C3X~ + C2 x':"YN + C1XNY~ + coY~

49

11: The p-adic ca3e (say). Here C3 C2

= 1 + p4N Al2 +p6N Bl 3 = 2p4NlmA + 3l N 12mB,

so

= 1,

IC31

The roots XN/YN of (*) are _p-Nu(xI + X2)' p-Nu(xJ) and p-Nu (X2). Since the sum of the roots is -C2/C3, the result follows. Corollary 1.

lu(sx)1 = lsi lu(x)1 for all x E \5(1) and all s E Z. Proof. By induction, for s

> 0 we

have

lu(sx) - su(x)1 ::; lu(xW· This proves the result for p power of pin s.

1s

and for s = p. Now use induction on the

Corollary 2. \5(1) i3 tor3ion-free.

+

Corollary 3. Supp03e that p -I- 2, 14A3 27B21 3ubgroup of \5 i3 i30morphic to a 3ubgroup of \5. Proof. For \5

= 1.

Then the tor3ion

= \5(0) j and so \5

= \5/\5(1),

where \5(1) is torsion free. Note for the Cogn03centi. This all generalizes to algebraic extensions of Qp. The proof that torsion points of order prime to p have integral co-ordinates continues to hold, but that for points of p-power order may break down if there is ramification. There is a power-series in u = u(x) which gives a parametrization of the group \5(N) for large enough N. This was originally shown by transferring the formulae from the complex variable case. A modern approach is by formal groups and formal logarithms, see, for example, Silverman's book.

12 Global torsion

Let

c:

= X

y2

3

+ AX + B

be an elliptic curve over Q, so

4A 3

+ 27B2 -I- 0

and without loss of generality

A,B E l. Theorem 1. The group of rational points on C of finite order is finite. If (x, y)

-I- 0

is of finite order, then

x, y E l and

y=o

or

Proof. Let 15 be the group of points on C defined over Q and let I5 p be the group for Qp, where p runs through the primes. Let (x, y) -I- 0 be torsion. Since 15 C 15 p we have

xElp,

YElp

x E l,

y E l.

for all p, and so Now let p be any prime with p -I- 2, p 1 (4A 3 + 27B 2 ). Then by the last Corollary of §ll, the torsion group of 15 is isomorphic to a subgroup of the group of points over Fp = l mod p. Hence the torsion group is finite. By looking at different p, one can in general restrict the order of

51 the torsion group severely. But the following argument makes it easy to find the torsion points themselves. If 2(x,y) = 0, then y = O. Otherwise, 2(x,y) = (X2,Y2) (say) is also torsion, so X2, Y2 E Z. Now taking the tangent at (x, y), we have (cf. Formulary)

3X 2 +A)2

and so y2 = But now,

(3X2+A)2

+ 2x = ( 2y . 4( x 3 + Ax + B) x 3 + Ax + B divides (3x 2 + A)2. X2

(3X 2 + 4A)(3X2

+ A)2 == 4A 3 + 27B2 mod (X 3 + AX + B)

in Z[X, A, B], as in readily verified. Hence

y2 I (4A3

+ 27B 2),

as required. [For more on identity (*), see §16].

Note. There are stronger statements about the torsion of C when AB = 0, see Exercises. Mazur has determined all possible forms of the torsion group. It is one of

Z/nZ

1:::;

n:::;

10

or

n

= 12

or

Z/2Z x 1/2nZ

1:::;

n :::; 4;

all of which occur.

§12. Exercises 1. Find the torsion groups over Q of the following elliptic curves:

Y 2 =X 3 +1 (ii) y2 = X 3 - 43X + 166 (iii) y2 = X 3 - 219X + 1654 (iv) y2 = X(X - l)(X + 2) (v) y2 = X(X + l)(X + 4) (vi) X 3 + y3 + Z3 - 15XYZ = 0 (vii) y2 = X(X + 81)(X + 256) (viii) X~ X 2 - X1X~ - X1X~ + X~X3 = 0 [Note: not a random sample!]

(i)

Lecture3 on Elliptic Curve8

52

2. Fill in the details of the sketched proof of the following theorem 9 [or find a better one!]. Theorem. Let A E Z be 4·th power free. Then all the tor8ion point8 on C : y2 == X(X2

+ A)

are given by (I), (II), (III) below:

(I) (0,0) of order 2. (II) If A == 4, the point8 (2, ±4, 1) of order 4. (III) If A = _C 2, C E Z, the point8 (±C,O) of order 2. Sketch proof. (i)

If (x, y)

= 2(a, b), then x

= (a 2 -

A)2 /4b 2.

(ii) The points of order 2 are as stated. (iii) (0,0) = 2( a, b) for some (a, b) precisely when A = 4. The (±C,O) are never of form 2( a, b). From now on, let (a, b) be a point of odd order. (iv) a =0 (v) If d = gcd(a, A) then a = da), A = dA) b = dvb l where b~ = al(da~ + Ad. (vi) There exists f, g, h such that gcd(f,g) = 1 and al = ±j2, da~ + Al = ±g2, bl = fg, d = ±h2 (vii) a 2 - A = 2h4j4 =f h 2g 2, b = h2fg. (viii) a 2 - A == 0 (mod 2b). (ix) Hence f = 1, 9 == 0 (2), h == 0 (2). [Hint. First show that fig]. (x) Hence 24 I A. (xi) Contradiction! 3. Fill in the sketched proof ofthe following theorem lO [or find a better]. Theorem. Let B E Z be 6-th power free and let

c:

y2

= X + B. 3

All the tor3ion point3 are given by the following. (I) If B == C 2, the point8 (0, ±C) of order 3.

(II) If B 9

)0

= D3,

the poini8 (-D, 0) of order 2.

d. T.Nagell. Solution de quelques problemes dans la theorie arithmetique des cubiques planes du premier genre. Skrifter utg. av det nor.ke viden3k.-akad i Oslo, MaJ.-naturv. kl. 1935, No 1, 1-25. The result is due to R.Fueter: Ueber kubische diophantische Gleichungen. Comm. Math. He/v. 2 (1930), 68-89; but the argument suggested is based loosely on L.J .Mordell. The infinity of rational solutions of y2 = x 3 + k. J. London Math. Soc. 41 (1966), 523-525.

53 (III) If B = I, the point3 (2, ±3) of order 6. (IV) If B = -432 = _24.3 3 , the point3 (12, ±36) of order 3. Sketch proof. (i)

If (x,y) = 2(a,b), b f= 0 then

x=(w-2)a, (ii) the elements of 2-power order are as stated. (iii) Elements (0, b) are of order 3. From now on, let (a, b) be of odd order with a f= O. The strategy is to show that w E Z. The cases with w = 1, 2, 3 are then easily dealt with. Otherwise, Ixloo > lal oo and so on repeated duplication Ixloo -+ 00 a contradiction. We sketch a proof that w E Z. (iv) IfplB,p1athenp1x. (v) If pi B, p 1 x then p 1 a [Hint. Consider repeated duplication.] (vi) If 3' II b, 3m II a then I = 0, 1 or I = 2, m ? 1. [Hint. If I = 3 deduce that either 31 x or 36 I B] (vii) Hence wE Z3. (viii) w E Z2. (ix) wE Zq for qlB, q f= 2, 3. (x) Hence w E Z. 4. Show that is birationally equivalent to y2 = X 3 _ 24.33.d2

If d > 0, dE Z is cube free, deduce from the preceding exercise that the only cases of torsion are

= 1, d = 1, d

(1,0, -1) and (0,1, -1) of order 3. (1,1, -1) of order 2.

Compare with results of §6 on exceptional points. 5. Let sEQ. Show that if there is one k E Q such that X

3

+ 5X + k =

0

has 3 rational roots, then there are infinitely many. [Hint. Let "U be a rational root. Find the condition, in terms of that the two remaining roots are rational.] 6. Let k E Q, k

f=

O. Show that if there are two X

3

+ 5X + k =

5

E Q such that

0

has 3 rational roots, then there are infinitely many.

5, "U,

k:

13 Finite Basis Theorem. Strategy and comments

The objective of the next few sections is the following. Theorem 1. The group 15 of rational pointJ on an elliptic curve defined over Q iJ finitely generated. The theorem is due to Mordell and it was generalized to number fields by Wei!. It is usually referred to as the Mordell (or Mordell-Weil) Finite BaJiJ Theorem. For example I I , when Cis

y2

= X(X2 + 877)

the group 15 is generated by (0,0) of order 2 and (u/v,r/s) of infinite order, where u = 37 5494 5281 2716 2193 1055 0406 9942 0927 9234 6201, v = 6215 9877 7687 1505 4254 6322 0780 6972 38044100, r =

256 2562 6798 8926 8093 8877 6834 0455 1308 9648 6691 5320 4356 6034 6478 6949,

5

= 4900

7802 3219 78758895 9802 9339 9592 8925 0960 6161 6470

7799 7926 1000. The proof of Theorem 1 subdivides into two parts requiring different ideas and techniques.

11

A. Bremner, J.W.S. Cassels: On the equation y2 = X(X2 +p). Math. Compo 42 (1984), 257-264.

13: Finite baJiJ Theorem. Strategy and commentJ

55

(i) The "weak finiteness theorem" that rtJ /2rtJ is finite. The proof depends on the construction of a map of rtJ /2rtJ into a finite group. The proof is in some ways easier if rtJ has a point of order 2 and we do this first. For this we need to know about isogenies. It is rather remarkable that the proof of the weak theorem is not constructive - that is, it does not give an infallible procedure, even in principle, for determining rtJ/2rtJ. Even today no algorithm is known. (ii) The second part of the proof of the finite basis theorem is a "descent". Suppose that we have a set of representatives b l , . . . , b r of the classes of rtJ /2rtJ. Let a be any point. Then there is some s, 1 :::; s :::; r such that

a-b. E 2rtJ, I.e.

a

= b. + 2c,

c E rtJ.

The height measures the size of the numbers involved in a point of rtJ. For example if x = (x, y) and x = u/v with u, v E Z in its lowest terms, we can take H(x) = max(lul, Ivl) (absolute values). Now it follows from (*) that H(c) < H(a); at least if H(a) is greater than some Ho. It follows that rtJ is generated by the b. and the finitely many a with b(a) :::; Ho. We conclude this section by giving one of Fermat's own descent arguments. He wished to show that there are no integer solutions of

X 4 + y4 = Z4

X

f.

0, Y

f. o.

This is a curve of genus 3 (not that Fermat knew about the genus), but he remarked that it is enough to disprove

X 4 + y4 = Z2

X

f.

0, y

f.

0

(*)

On writing (*) in the shape

(Z/Y2)2 = 1 + (X/y)4 one sees that we have an elliptic curve, though not given in canonical form. However, following Fermat, we consider integer solutions of (*). If (*) has an integral solution, we take one (x, y) for which max(lxl,IYI) is > 0 and as small as possible. (II is the absolute value). Then x, y, z have no common factor, and indeed are coprime in pairs. Since X4 == 1 mod 4 if x is odd, one of x, y must be odd and the other even. We

Lecture3 on Elliptic Curve3

56 suppose that

21 z.

21 y,

2/ x, Write (*) in the shape

(z

+ y2)(Z _

y2) = x4.

Since z, y are both odd, the two factors on the left are divisible by 2 but only one is divisible by 4. Hence (taking z > 0) we have two possibilities, where u, v E Z: Second Case z

+ y2 =

Z _

2u 4 8v 4

y2 =

The first case gives

= 4u4 _

y2

v4,

which is impossible mod 4. Hence we have the second case: y2 = u 4 _ 4u4. Now and so u

2

+y =

u2

_

v4

+ S4

Y

2v

4

= 2s 4

for some r, s E Z. Hence = u2•

This is another solution of (*). Further, X4

Hence rs

= 16u 4 v4 = 16u 4 r 4 s 4 •

"I- 0 and max(/r/,/s/)

< Ixl ::; max(/xJ, IYI)·

This contradicts the assumed minimality of the original solution, and so we have a contradiction. Note that (r,s,u) --+ (x,y,z) is multiplication by 2. Thus Fermat's descent is essentially a converse of Diophantos' ascent. Note also that multiplication by 2 has been divided into two steps via another curve

This is the phenomenon of isogeny, which we explore in the next section.

§13. Exercises 1. Let C

Xl

+ AX + B

be defined over Q. Let Q(.Jd) be

57 a quadratic extension of Q and let the non-trivial automorphism be denoted by ('). Let x be a point of C defined over Q( Vd). Show that x + x' is defined over Q and that x - x' = (IL, v) where u and v / Vd are inQ. Deduce that the group of points on C defined over Q( Vd) may be determined once the groups over Q on C and dy2 = X 3 + B are known.

2. This question assumes knowledge of the arithmetic of Q(p) where p3 = 1, p f:- l. Fill in the details of the sketched proof of the Theorem. Ld d = qIq2 where qI > 0, q2 > 0 are rational primes with ql == 2 (9), q2 == 5 (9). Then the only rational point on

C:

X; + X; + dX; =

0

i3 (1, -1, 0). Skdch proof.

It is enough to prove that the only points on C defined over Q(p) are those with X3 = 0 (ii) If x = (Xl, X2, X3) is defined ovt.f Q(p) and on the curve, without loss of generality XI, X2, X3 are coprime in pairs in Z[p]. (iii) (XI + X2)(pXI + p-I X2 )(p- I XI + PX2) = -qlq2X~, There are O!l, 0!2, 0!3, ~ I, 6, 6 E Z[p] such that either I PXI +P- X2 =0!2~~' Xl + X2 = O!l~:' (i)

p-I XI

+ PX2 = 0!3~~,

0!10!20!3

= d,

or

+ X2 = ).O!l~~' + PX2 = ).0!3~:'

Xl p-I XI

PXI

+ p-I X2

= ).0!2~~'

0!10!20!3 = d

where). = p - p-I [= H]. (iv) O!l~~ + 0!2a + 0!3a = 0, 0!10!20!3 = d, (v) Any rational ql-adic unit is congruent to a cube mod q, but pis not congruent to a cube. And similar for q2' (vi) After multiplying O!I, 0!2, 0!3 all by p, or by p2, if necessary, we may suppose that {O!l' 0!2, 0!3} is a permutation if {±1, ± 1, ±ql ± q2} or {±1, ±ql, ±q2}. (vii) The equation ~~ + qI~~ + q2~~ = 0 is impossible mod 9 [and indeed mod ).3]. (viii) If {0!1,0!2,O!d is a permutation of {±I,±I,±d}, then 1~16~31°o

< IXI X2X31°o'

14 A 2-isogeny

An i30geny is a map

C-.D of elliptic curves defined over the ground field and taking the specified rational point Oc on C into that on D. Clearly the kernel of the isogeny, i.e. the set of points mapped into Ov is a finite group and is defined over the ground field as a whole. In this section we consider the case when C has a rational point of order 2. It is convenient to modify our canonical form to

C:

y2

= X(X2 + aX + b),

the point of order 2 being (0,0). The function on the right hand side may not have a double root, so a2

b # 0,

-

4b

# O.

We take Q to be the ground field. Let x = (x, y) be a generic point of Cj that is, x is transcendental and y is defined by

y2=x(x 2 +ax+b). The field Q( x, y) is known as the junction field of Cover Q. Let XI

= X

+ (0,0).

The transformation is an automorphism of Q( x, y) of order 2. We will find the fixed field.

59

14-· A 2-isogeny

The line through (0,0) and (x, y) is

X

= tx,

which meets C in (0,0), x and Xl

YI

= (Xl, -Yl).

-Xl

We get

= b/x = -by/x 2 .

is clearly t2, which is 2 (/)2 yx =x -+-ax-+-b

One invariant under

t2 =

Y =ty,

X -+ Xl

X

=A

(say) [=

X

+ Xl + a].

Another is y

+ YI = I-'

(say) .

To find an algebraic relation between A, I-' we compute 1-'2

= y2(1_ b/x 2)2 2 = x + ax + b(x2 _

+ b2/x2).

2b

X

Here the first factor is just A. The second is

(x

+ b/x)2 -

4b

= (A -

a)2 - 4b

= A2 -

2aA

+ (a 2 -

4b).

Hence 1-'2

= A(A2 -

2aA + (a 2 - 4b)).

Conversely, we can express x, y in terms of A, I-' and

= y/x,

AI / 2 slfice

= b/x A = + (b/x) + a.

A- 1 / 21-'

X X

Hence X

1 = -(A + A- 1 / 21-'_ a), 2

The field extension Q( x, y) /Q( A, 1-') is of degree 2 and so by Galois theory Q(A, 1-') is the complete field of invariants. The point (A, 1-') is a generic point of 1): y2 X(X2 - 2aX + (a 2 - 4b)).

=

The map

q,:

C-+1)

given by

X=(X,y)-+A=(A,I-')

60 preserves the group law 12 . For let a, b be points on C and let f E Q(x) be a function with simple poles at a, b and simple zeros at 0, a + b. Let II be the conjugate under x -> Xl. Then fh E Q(A): as a function of A it clearly has simple poles at ¢I(a), ¢I(b) and simple zeros at ¢I(o) 0 and ¢I(a + b). Hence

=

¢I(a

+ b)

= ¢I(a) + ¢I(b).

The equation for 1) has the same general shape as that for C. On repeating the process with A and 1), we get p, (1' with (1'2

= p(p2 + 4ap + 16b);

and so {= p/4,

'7

= (1'/8

is a generic point of C again. The points mapping into (A, 1-') = (0,0) are just the 2-division points other than (0,0). Hence the kernel of the map (x, y) -> ({, TJ) is just the 2-division points and o. So the map must be multiplication by ±2. We now consider the effect of the isogeny ¢I:

C->1)

on rational points. Denote the rational points on C, 1) by Q5, " respectively. We denote the multiplicative group of nonzero elements of Q by Q*. Lemma 1. Lei (u, v) E ". Then (u, v) E ¢lQ5 precisely wh en either u E (Q*)2 or u = 0, a2 - 4b E (Q*)2. Proof. For u i- 0, this follows by specializing A -> u, I-' -+ v in (*). The point (A,I-') (0,0) comes from the points (a, 0) where a 2 + aa + b 0: and a E Q if and only if a 2 - 4b E (Q*)2. This suggests the map

=

=

given by

q«u, v)) q(o) 12

= u(Q*)2

(u i- 0) 2 = (a _4b)(Q*)2 (u=O)

= (Q*)2.

The argument is quite genera! for isogenies of any degree. Note that the norm of J for the extension Q(x)/Q(A), cf. §24, Lemma 1.

JIt is

61 We note that the equation v 2 = u(u 2 - 2au

+a

2

-

4b)

implies that

q((u, v)) = (u 2 - 2au

+ a2 -

4b)(Q*)2

whenever the right hand side is defined. Lemma 2. The map

q: "

-+

Q* /(Q*)2

i3 a group homomorphism. Proof. Write the equation of D as

V 2 =U(U2+ a1 U+b 1).

D: Let

Uj

= (Uj, Vj) (j = 1,2,3) Ul

E 1l with

+ U2 + U3 = 0,

so they are the intersection of D with a line

v

= lU

+m.

Substituting in the equation for D, we have

U(U2 + a1U + bd - (IU + m)2 = (U - uJ)(U -U2)(U- U3). Hence

This implies that

q( Ul )q( U2 )q( U3) = (Q*)2 except, possibly, when one of the case is left to the reader.

Uj

is (0,0). The verification in this

Lemma 3. The image of

i3 finite.

Proof. Without loss of generality al E Z,

An element of Q* /(Q*)2 may be written r(Q*)2, where r

E Z,

square free.

62

Lecture3 on Elliptic Curve3

We show that r(Q·)2 is in the image of q only when rib!. Suppose that q( (u, v)) = r(Q·)2. Then there are s, t E Q such that 1.1.

2

+ a! u + b! = rs2 u

Put t

= 11m,

= rt 2 .

where

I,m El, Then, on eliminating

gcd( I, m)

= 1.

1.1.,

r214

+ a! r/ 2m 2 + b! m 4 = rn 2,

where n = m 2 s E l. Suppose that there is a prime p with p I r, p l. b!. Then p I m, so p2 I rn 2 and hence pin because r is square-free. Then p3 I r2[4, so p 1[, contrary to gcd(l, m) = 1. Putting the three lemmas together, we get the Theorem 1. J'J/rPQj i3 finite. Corollary. Qj 12Qj i3 finite. Proof. Consider the exact triangle

c

x2

---+

c

D

where J'J /rPQj and Qj NJ'J are both finite. By considering in detail the equations arising in the Lemma 3, we can get more information about Qj 12(5; e.g. by looking at the equations locally. There is, however, no local-global theorem and indeed even today there is no algorithm for deciding whether or not there is a solution. We shall come back to these questions in a late section. So one should not conclude from the fact that we can determine Qj 12Qj in the examples that one can always do so.

14: A 2-isogeny

63

We first enunciate more precisely what was proved. Lemma 4. The group J'J/¢Q5 U i30morphic to the group of q(Q*)2

In

Q* /(Q*)2 where (i)

q E Z i3 3quare-free and q The equation

(ii)

ql4

+a

l

I bl 12m 2

+ (b

l

/q)m 4 = n 2

ha3 a 30lution in 1, m, n E Z not all O. Further, the point (0,0) of J'J corre3pond3 to q of bl

= the 3qu.are-free kernel

.

Example 1.

+ 6)

c:

y2 = X(X2 - X

D:

Y2=X(X2+2X-23)

For J'J/ ¢Q5 we have q I (-23). Since -23 corresponds to (0,0), we need look at only one of q = +23, q = -1, say the latter. The equation of Lemma 4 is

I.e.

_(12 _ m 2)2

+ 24m 4 = n

2

,

which is impossible in Q3. Hence J'J/¢Q5 is generated by (0,0). For Q5/1/;J'J, we have q I 6, so q = -1 or q = ±2, ±3, ±6. Since the form X 2 - X + 6 is definite, we must have q > O. Hence q = 2,3 or 6; and 6 belongs to (0,0). Thus it is enough to look at one of 2,3, say 2. The equation is 214 _1 2 m 2 + 3m 4 = n 2 , which is seen to have the solution (I, m, n) = (1,1,2). This corresponds to (x,y) = (2,4). It follows that Q5 /1j;J'J is generated by (0,0) and (2,4). To find generators for Q5 /2Q5 we need to look at the effect of ',p on the generators of J'J/¢Q5. In this case ¢(O, 0) = 0, so Q5/2Q5 is also generated by (0,0) and

(2,4), Second example. This is related to Fermat's equation U 4 V 4 = V 4.

+

Then

64

LectuTe3 on

Elliptic

CUTVf3

satisfy

c:

y 2 ==X(X 2 _1),

so

D : y2 == X(X2

+ 4).

For J'J/¢Qj, we have q I 4, so q == -1, ±2. Since X 2 + 4 is definite, we need q > 0, so only q == 2 needs to be looked at. The relevant equation is 2/4 + 2m 4 = n 2 , which has the solution (1, m, n) = (1,1,2), giving (X, Y) = (2,4) as the generator of J'J/¢Qj. The point (0,0) is in cPQj. For Qj/1/;J'J, we have q I (-1). Since -1 belongs to (0,0), there is nothing to do. Then Qj/1/;J'J is generated by (0,0) and Qj/2Qj is generated by (0,0) and 1/;(2,4) = (1,0).

§14. Exercises 1. Find (i) (ii)

a set of generators for Qj/2Qj, where Qj is the group of rational points and the 2-power torsion, for the following curves

y2 == X(X2

+ 3X + 5)

=

y2

= X(X2 + 4X - 6) = X(X2 - X + 6)

y2

X(X2 - 4X

+ 15)

y2

y2 == X(X2 y2

= X(X2

+ 2X + 9) - 2X

+ 9)

2. Invent similar questions to 1 and solve them. [Note. You cannot expect to determine Qj /2Qj in every case, but you can majorize its order. It might be helpful to write a Mickey Mouse program to look for points with small co-ordinates.] 3. Let C : y2 == X(X2 = -2a, bl = a 2 - 4b.

+ aX + b),

D : y2 = X(X2

+ a1X + bd

with

al

(i) (ii)

Show that the odd torsion groups are isomorphic Assuming the finite basis theorem, show that the ranks [= number of generators of infinite order] are the same

§14: ExerciJ eJ

65

(iii) give an example to show that the orders of the groups of 2-power torsion need not be the same. Determine what the possibilities are. 4. (i) Construct an elliptic curve with a torsion element of order 8. (ii) Show that no torsion element can have order 16. (iii) Determine all abstract groups of 2-power order which can isomorphic to the 2-power torsion of an elliptic curve. Give elliptic curves in the possible cases and give a proof of impossibility for the others. 5. (Another kind of isogeny). Let

C: y2 = X 3 +B be defined over Q and let f32 (i) (ii)

= B,

f3 E Q.

Show that y = ±f3 are inflexions and that 2(0, (3) = (0, -(3). Let x = (x, y) be generic and put X2

= X

+ (0, -(3).

Show that ~

= x + Xl + X2,

TJ

= Y + Yl + Y2

are functions of (x, y) defined over Q and that

D:

TJ

2

=C-27B.

(iii) Show that the repetition of the above map is (essentially) multiplication by 3. (iv) Denote by Q5, " the groups of rational points on C, D respectively. Denote by Q(f3)* the multiplicative group of non zero elements of Q(f3). If (x,y) E Q5 and y

+ f3 E {Q(f3)'}3

show that x is in the image of " under D --> C. [Hint. Put y + f3 = (u + v(3)3 and equate the coefficients of f3.] (v)

Show that

(x,y)

-->

(y

+ (3){Q(f3)"}3

is a homomorphism J.l:

Q5 -->

Q*(f3)/{Q(f3)*p

whose kernel is the image of ". (vi) (Requires algebraic number theory). Show that the image of J.l is finite [Hint. cf. §16]. (vii) Deduce that Q5/3Q5 is finite.

15 The weak finite basis theorem

In this section we show that Qj /2Qj is finite, where Qj is the group of rational points on the elliptic curve

y2

= F(X),

where

F(X)=X3+AX+B, The argument has similarities with that in the previous section, where we made the addition assumption that F(X) has a rational root. Here we treat in a uniform manner the cases when F(X) has 3 rational roots, one rational root, no rational root. We work with the commutative ring Q[8j

= Q[Tj/F(T),

where T is a variable and 8 is the image of T. Then Q[8j is the direct sum of as many fields as F(T) has irreducible factorsl3. There is a norm map Norm:

Q[8j-> Q

defined as follows. Let a E Q[8j. The map ( -> a(

13

( E Q[8j

The preceding section has proved the weak fini te basis theorem when F(T) has a rational root, so it would be enough to consider the case when Q[8] is a field. This brings some minor simplifications to the proof.

15: The weak finite ba3i3 theorem

67

takes Q[0j into itself. If Q[0j is regarded as a 3-dimensional vector space over Q, the map is linear and its determinant is defined to be Norm(a). Clearly Norm( a,B)

= Norm( a) Norm(,B)j

and a is invertible (i.e. has an inverse) precisely when Norm(a) is readily checked that Norm(a - 0)

= F(a)

f=

O. It

(a E Q).

Denote by Q[0j' the multiplicative group of invertible elements of Q[0j. We shall work with the group 2 M c Q[0r /(Q[0n consists of the a(Q[0j*)2 for which Norma E (Q*)2. There is a map defined as follows. (i) (ii)

1-'(0) = 1(Q[0j*)2 if a = (a, b) E Q5, b f= 0, then

I-'(a) = (a - 0)(Q[0n 2 (iii) ifl4 a = (a,O), then F(a) = 0, so one of the summands in the expression of Q[0j as a sum of fields is a copy of Q arising from the map 0 -> a. Hence this component of a - 0 is O. We replace (patch) this component with a.ny element of Q* such that the norm of the new element of Q[0j is in (Q*)2. Lemma 1. The map I-' i3 a group homomorphjJm.

Proof. Let aj = (aj,b j ) (j = 1,2,3) be elements of al so that they lie

011

Q5

with

+ a2 + a3 = 0,

a line

Y

= IX + m

I,m E Q.

Then

F(X) - (IX

+ m)2

=

(X - ad(X - a2)(X - a3).

Replace X by 0: (al - 0)(a2 - 0)(a3 - 0)

14

d. preceding footnote.

= (k0 + m)2.

Lecture3 on Elliptic Curve3

68

If all the bj i- 0, then the al - 0 are invertible and we are done. It remains to deal with the case when F(T) is reducible and at least one of the roots is among the aj. If only one of the roots, e (say), of F(T) is among the aj, then Q[0] is a direct sum KI EB K2 or KI EB K2 EB K3 of fields, where KI is the copy of Q given by 0 --> e. The given proof shows that the Lemma holds for the components in K j (j i- 1). Since we have patched things so that the norms are always a square, the Lemma must hold for the KI-components as well. The remaining case is when all the bj are and the aj are the roots of F(T). Then Q[0] is the direct sum of three copies K j of Q by 0 --> aj (j = 1,2,3). The components of 0 - al in K 2 , K3 are a2 - ai, aJ - al respectively. Hence the patch for the zero compound of 0 - al in KI is (a2 - aI)(aJ - aI)(QO)2. Now the truth of the Lemma follows by direct calculation.

°

Lemma 2. The kernel of J.L i3

2~.

Proof. Since M has exponent 2, the kernel certainly contains 2Q5. We have to show it is no bigger. Suppose that

a=(a,b). a - 0 = (P202

+ PI 0 + pd

for some po, PI, P2 E Q. Further, P2

i- 0,

since 0 does not satisfy any equation of degree We can find So, SI, ro, rl E Q such that

(s 1 0

< 3.

+ SO)(P202 + P I 0 + Po) = r l 0 + ro,

Sillce the vanishing of the 0 2 -component on the right hand side IS a linear condition on So, SI. If SI = 0, So i- 0, we would have P2 = 0. Hence, without loss of generality, SI

=

-1.

Now

15

A moment's consideration shows that this statement remains true when + PI 8 + Po is not invertible.

b = 0, though then P282

15: The weak finite ba3i3 theorem On replacing

69

e by an indeterminate X, we have (rlX

+ rd -

since the coefficient of X Hence the line

3

(so - X)2(a - X) = F(X),

is l.

Y=rIX+ro meets y2 = F(X) in (a, ±b) and (so, t) (twice) for some t. It follows that (a,b) E 2Q5, as required. Theorem 1. Q5 /2Q5 i3 finite.

Proof. It is enough to show that the image of J.' :

Q5 ->

M is finite.

We may suppose without loss of generality that

A,B E Z. Let x

= (x,y)

E Q5. Then y2

= F(x)

x=r/t 2,

implies that

y=s/t 3

where r, s, t E Z,

gcd(r, t)

= gcd(s, t) = 1,

and

To illustrate ideas, suppose for now that the roots el, e2, e3 of F(X) are rational, and so in Z. Then

Now gcd{(r - el t 2 ),(r - e2t2)} divides (el - e2)t 2 and (el - e2)r, so divides (el - e2): and similarly for the other pairs of factors. Hence and by (*)

r-

ej

= djv],

where d j is square free,

djl(el - e2)(e2 - e3)(e3 -

ed,

and

d l d2d3 = square. There are thus only finitely many sets {d l ,d2,dd; which proves the theorem in this case.

70

Lectu.re3 on Elliptic Cu.rve3

Before leaving this special case, we note that (VI, V2, V3, t) lies on the curve given redundantly by (el - e2)t 2 = d2V~ - dIV~

(e3 - er)e

= dIV~

-d3V~

We may therefore get further information about 0/20 by looking whether there is a rational point on 7). In particular, one may be able to show that there is not a rational point by local considerations. Now consider the general case. Denote the roots of F(X) by Cj E Q = 1,2,3). We work 16 in K = Q(CI,C2,c3). As in the rational case, the ideal [r - c l t 2 ,?' - c2t2] divides CI - C2. Hence each principal ideal [r - C jt 2 ] is a square up to one of a finite number of ideal factors. The finiteness of the class-number and the finite generation of units now imply that

(j

r - Cjt2

= t5)\},

where t5 j , )..j E Q(Cj) and {t5 l , 15 2 , t5d is from a finite set. This clearly shows that the image of J.I is finite and so completes the proof of the Theorem. We now find a curve 7) with properties analogous to those of the 7) constructed above in the case when the roots are rational. We have shown that if (x, y) E 0, then x - 0

= 15)..2,

where 15, ).. E Q[0] and 15 is one of a finite set. Write

)..=vo+v I 0+v 20 2

(vjEQ).

Then the right hand side becomes

Ho(v)

+H

I

(v)0

+ H2(V)0 2,

where Hj(v) E Q[v] is a quadratic form depending on 15. Hence there is a rational point (v, t) on

H2(V)

=0

H 1 (v)

= _t 2 .

7):

{

16 This is the Dnly place where the use Df algebraic number theDry is unavDid-

able. If she dDes nDt knDw the theDry, the reader shDuld take it Dn trust that it is very like the ratiDna.! case. But see next fDDtnDte.

15: The weak finite bll..!i3 theorem

71

Again, we can get further information on Q5 12Q5 by examining whether there is a point on V everwhere locally. If not, then 6 cannot occur. If there is, we can make s further useful transformation. If V has a point everwhere locally, there is always a point everwhere locally on the conic

H 2 (v)

= O.

There is a point on H2(V) = 0 globally by Theorem 1 of §3, and so (see exercises)

H 2 (v)

= hL2 -

MN

identically, for some h E Q and some linear forms

L(v), M(v), N(v) E Q[v]. Hence the rational points on H 2 (v) of r, s (say) by Vj

= 0 can

= Vj(r,s)

(j

be parametrized in terms

= 1,2,3)

where the Vj(l', 5) E Q[r, s] are quadratic forms. It follows that V is birationally equivalent to

V':

e = G(r,s),

where G is a quartic form. It would be possible to describe the possible equivalence classes of quartic forms G in terms of its invariants instead of the detour through algebraic number theory 17. In fact this is what Birch. and Swinnerton-Dyer did in their historic computations. [B.J. Birch and H.P.F. Swinnerton-Dyer. Notes on elliptic curves I, II. J. reine angew. Ma.th. 212 (1963),7-25; 218 (1965), 79-108]. We conclude this section by looking at a couple of examples.

Fir3t Example.

y2

= X(X2

- 1).

We considered this already as an example of isogenies. Let (r It 2 , s It 3 ) be on the curve, so

r(r

+ t 2 )(r -

The greatest common divisor of (r or r - t 2 is 1. Further,

r

= S2.

t2 )

±t

2

)

is 1 or 2: that of r and r

+t2 > r > r -

+t2

t2 .

Q5 /2Q5 withou t algebraic number theory at the expense of a fairly substantial study of binary quartic forms.

17 This line of argumen t proves the fini teness of

72

Lectu.re3 on Elliptic Curve3

Hence if r+t2=dIV~,

r=d2v~,

r-t2=d3V~

with the d j square free, the only possibilities are

(d l ,d2 ,d3) =(1,1,1),

(2,1,2),

(1, -1, -1),

(2, -1, -2). These are all realized by the points of order 2. Hence 0/20 is generated by them.

Second exa.mple. Most applications require algebraic number theory. We give one such application, to which we will want to refer later. The curve

is birationally equivalent to

y2 = X 3 _ 33(30)2. We shall work in Q(6) where 63 = 30. This has class number h = 3 and fundamental unit l8 7] = 1 + 96 - 36 2. The roots of F(X) = X 3 - 33(30)2 are 36 2, 3p6 2 , 3p 262 , where p3 = l. In our usual notation, if (r / t 2 , S / t 3 ) E 0, a prime common ideal divisor of any two of r - 36 2t 2, r - 3p6 2t 2, r - 3p 262t 2 must divide 2.3.5. Since 2, 3, 5 ramify completely, perfect ideal square. In the real embedding, clearly r -

36 2 t 2 must be a

36 2 t 2 > 0,

and so either r - 36 2t 2 = (l!2 or r - 36 2t 2 = We disprove the second alternative. Put

(l!

r -

7](l!2

for some

(l!

E Q( 6).

= U + v6 + w6 2 .

Equating coefficients of powers of 6 in r -

18

36 2 t 2

= 7](l!2,

As it can be mildly troublesome to check that a unit is fundamental, all we actually use is tha.t ." > 0 in the real embedding and." is not a square. The last fact follows by looking at ." modulo [2 - 6, 11].

§15: Exerci3 e3

73

we get

+ 2uv - 9av 2 - 180uw + 540vw + 30w 2 = -3u 2 + 18uv + v 2 + 2uw - 180vw + 270w 2 •

o= -3t 2

9u 2

On putting

+ 90i,

u = -28e

v w

= -ge + 29f, = 9 - 3e + 9i,

in the first equation, it becomes

o= 30g

2

-

4ef.

:

30n 2

Hence there are m, n such that e: f: 9 = m

2

:

2mn.

On substituting in the second equation, we get for some 1:

-312

= 3m 4

+ 1620m 2 n 2 - 10800mn3 + 27900n4. -

112m 3 n

But this is impossible in Q2. (Consider separately). Hence rtJ /2rtJ is the trivial group.

Inl2 :::; Iml2

and

Inl2 > Iml2

§15. Exercises l. Determine the 2-power torsion and sets of representatives rtJ /2rtJ for = F(X) in the following cases.

y2

(i) (ii) (iii) (iv) (v)

F(X) F(X) F(X)

= X(X - 3)(X + 4) = X(X - l)(X + 3) = X(X + l)(X - 14)

etc. etc.

2. (i) Give the general form of an elliptic curve with a rational point of order 4. [Hint: use isogenies.] (ii) Show that an elliptic curve cannot have two independent rational points of order 4, i.e. points a, b such that 4a = 4b = 0, 2a i= 2b, 2a i= 0, 2b i= o. 3. Make more explicit the algorithms of the text for the case of rational roots. More precisely, let

74

Lect-ure3 on Elliptic Curve3

where ej E Q and let aj:

0-+ej

(j=1,2,3)

be the homomorphisms of Q[0] into Q. (i)

For given t l , t 2, t3 E Q, find an explicit>. = 10 + 11 0+ 120 2 (lj E Q) with

= tj

(j=1,2,3).

x-ej=t~

(j=1,2,3).

aj(>') Show that>. is unique. (ii)

Let x E Q be such that Show that the>. constructed in (i) satisfy >.2 = x - 0.

(iii) Find in terms of the tj, ej the So E Q such that (so-0)>.=ro+r I 0 has no terms in 0 2.

(say)

(iv) Show that (x, t l t 2 h) = 2(so,?) for some? E Q. (v) On replacing tj by Hj (independent signs) show that one gets in general further Xl E l!5 with 2Xl = x. What is the relation between the different Xl? (vi) Using the above with F(X) = X(X - 3)(X + 5) and X = (4,6), find all the Xl with 2Xl = X. 4. [Fermat, Euler]. By transforming it to canonical form, or otherwise, show that the only rational points (Xl, X2, X3, X4) on the curve

X~ - 2X~

+ xi =

0,

X~ - 2Xi

+ X~

= 0

are those with x~ = x~ = x~ = x!. If nl < n2 < n3 < n4 < are integers in arithmetic progression, deduce that they cannot all be perfect squares.

16 Remedial mathematics. Resultants.

As they are often not included nowadays in undergraduate courses, we give here some basic facts about resultants on discriminates. The ground field is arbitrary. Let

F(X)

= fNx n + fn_1X n- 1 + ... + fa

G(X)

=

9mXm

+ 9m_ 1 X m- 1 + ... + 90

be polynomials. The polynomials

F(X) XF(X)

xm-IF(X) G(X)

xn-1G(X) can be regarded as m+n linear forms in the m+n variables xm+n-l, ... ,1 (the "forgetful functor"). The determinant R(F, G) is the resulta.nt of F, G. It is defined only up to sign. By eliminating xm+n-I, ... , X determinant ally, we express R(F, G) as a linear combination of the rows (*), that is

A(X)F(X) + B(X)G(X)

= R(F, G),

where A(X), B(X) have degrees"':; m - 1, ~ n - 1 respectively.

(1) If

Lecture3 on Elliptic Curve3

76

F, G have coefficients in a ring, say Z, then R(F, G) E Z and A(X), B(X) E Z[X]. If F(X), G(X) have a common zero x (in the algebraic closure), then (1) implies that R(F, G) = O. Conversely, suppose that R(F, G) = O. Then the (*) are linearly dependent, and so there are A(X), B(X) of degrees ::; m - 1, n - 1, not both zero l9 , such that

A(X)F(X) + B(X)G(X)

= O.

m (i.e. In i= 0, 0), it follows that F(X), G(X) have a common factor, and so a

If we suppose that F(X), G(X), have precise degrees n, gm

i=

common zero in the algebraic closure. If In = gm = 0, then clearly R(F, G) clearly

R(F, G)

= O. If In i= 0 but

gm

= 0,

then

= InR(F,G*),

where

G*

=

gm_IX m- 1

+ ... + go.

Hence the elegant formulation is that the homogeneous forms

InX n + In_IXn-IU gmX

m

+ ... + IoU n

+ ... + goU m

have a common zero (x, u) i=. (0, 0) in the algebraic closure if and only if R(F, G) = O. Revert to the inhomogeneous polynomials and let

F(X) = In G(X) If 1m, gn,

= gm

II(X - OJ) II(X - rpk).

°1, ... , On, rpl , ... , rpm

R

are taken as variables, R( F, G) is a polynomial in them. It vanishes when any OJ is equal to any rpk. Hence and from considerations of degree,

R(F, G)

= ±I::'I::' II (OJ

- rpk)

j,k

19

=

±I::' II G(Oj)

=

±g;;'

II F(rpk).

The particular A(X), B(X) given by the determinanta.i elimination which gave (1) may, of course, both be o.

77

§16: Exerci3e3

Let H = H(X) be a further polynomial. Then it readily follows tha.t

R(F,GH)

=

±R(F,G)R(F,H).

Further, if G I , G 2 have the same degree m a.nd G I by F, we have

R(F, Gd

=

-

G 2 is divisible

±R(F, G2).

Finally, we put G = F ' , the (formal) derivative. Since

F'(O;)

= In II(Oi -

OJ)

j~1

we have i<j

The function on the right side with + is the di3crimina.nt D(F). It va.nishes precisely when F has a multiple root. For example, when F(X) = X3 and (1) gives

(6AX2 - 9BX

+ AX + B, we have D

=

4A3 + 27 B2,

+ 4A2)(3X2 + A) - (18AX - 27B)(X2 + AX + B) = 4A 3 + 27B2. §16. Exercises

1. Let F(X) E Zp[X] have discrimina.nt D a.nd let a E Zp. IT

IF(a)lp < IDlp, show that IF'(a)lp 2: IDlp·

17 Heights. Finite Basis Theorem.

We a.re now in a. position to introduce the notion of height, and so to complete the proof of the Finite Basis Theorem. Let u = (ua, ... , un) be a. point of projective n-dimensiona.l spa.ce over Q. As the co-ordina.tes are homogeneous, we ma.y suppose without loss of genera.lity tha.t gcd(ua, ... ,u n )

Uj E Z,

= l.

(1)

The height H(u) of u is defined to be

H(u)

= m~x IUjl J

with the a.bove norma.liza.tion. In this section II = 1100 is the a.bsolute va.lue. We sha.ll ma.inly but not exclusively be concerned with the projective line. We identify x E Q with the point (x, 1) on the line, and so write

H(x)

= maxilua I, lUll}

if x = Ua/Ul with Ua, Ul E Z as a. fra.ction in its lowest terms. Lenuua 1.

(i)

Let D(Ua, UJ), E(Ua, Ul ) E Q[Ua, Ud be form3 of the 3ame degree n. Let u = (ua,ud be a point on the rational projective line, and 3UppOJe that D(u), E(u) do not both vani3h. Then

H(D(u),E(u)) where c i3 independent of u.

~

cH(ut,

17: Height3. Finite Ba3i3 Theorem.

(ii)

79

Supp03e, further, that the re3u/tant of D, E i3 not 0. Then there

i3 a , > 0, independent of u, 3uch that

H(D(u), E(u)) ;::: ,H(ut. Note. The a.dditiona.l hypothesis in (ii) is equiva.lent to supposing tha.t D, E do not ha.ve a. common zero over the a.lgebra.ic closure Q. Proof. By homogeneity, we ma.y suppose tha.t

D(Uo, Ud, E(Uo,Ud E Z[Uo,Ud a.nd tha.t u = (tLo,tLd is norma.lized by (1). Clea.rly ID(u)l, IE(u)I":::: c{ma.x(luol, IUIW for some c. In genera.l D(u), E(u) will ha.ve a. common fa.ct or , but in a.ny ca.se this implies the conclusion of (i). Now suppose tha.t the hypotheses of (ii) hold a.nd let R be the resulta.nt. Then there a.re homogeneous forms Lj(Uo, Ud, Mj(Uo, Ud E Z[Uo, Ud (j = 0,1) such tha.t

LjD

+ MjE = RU;n-1

(j

= 0,1).

On substituting u for U we deduce tha.t gcd{ D( u), E( u)} IR. Further, a.s in the proof of (i), there is a. c' such tha.t I IL;(u)l, IMj(u)I":::: c'{ma.x(luol, luIW(j = 0,1).

011 substituting in (*) (with u for U), we obta.in the conclusion of (ii) with, = IRI/2c'. Now let u, v be two points on the projective line a.nd let w=(uoVO,UOVI +UIVO,UIVI)

= (WO,WI,W2)

(sa.y).

Lenuna 2. 1 -<

H(w) <2 2 - H(u)H(v) - .

Proof. Let u, v be normalized by (1). Then the right ha.nd inequality is immedia.te. It is rea.dily verified tha.t Wo, WI, W2 ha.ve no common fa.ctor, so it will be enough to show tha.t 1 ma.x(lwol, IWII, IW21);::: '2 {ma.x(luoI, IUII)}{ma.x(lv.l, IVII}i

80

Lecture3 on Elliptic C1LrVe3

which is a. simple exercise left to the rea.der. Ba.ck to the elliptic curve

y2

C:

= X 3 + AX + B

with

A,B E Z,

4A 3

+ 27B2 i- O.

It is convenient (a.nd conventiona.l) to define the height H(x) of a. ra.tiona.l point x = (x, y) on C to be the height H( x) of its X -co-ordina.te. In other words, if x = (x, y, z) in homogeneous co-ordina.tes, we ha.ve

H(x) H(o)

= H(x, z). = 1.

Lemrna 3. There are con3tant3 Cl, I

> 0

depending only on C 3uch

that

H(2x) H(x)4 -

<---
'V

/1 -

Proof. Writing x = (x,y), 2x = (X2,Y2), we ha.ve (d. Formulary)

X2

=

D(x)/E(x),

where

D(x)

= (3x + A)2 -

E(x) = 4(x

3

8:1:(x 3

+ Ax + B)

+ Ax + B)

Now the resulta.nt of 3x2 + A a.nd x 3 + Ax + B is 4A 3 + 27 B2 i- 0, a.nd the formula.e of the previous section show tha.t the resultant R of D(x), E(x) is a. power of 4 times (4A 3 + 27B2)2. Hence the conditions of both parts of Lemma. 1 a.pply with x = UO/Ul a.nd n = 4; and the result follows. 20 Lemma 4. Let Xl, X2 E
H(XI where

C2

depend3

+ x2)H(XI - X2) 0

nly

0

~ c2H(Xl)2 H(X2)2,

n C.

Proof. Write

20 In fact in the proof of Lemma l(ii) in this case one may take

4A 3

+ 21 B2

instead of R since a factor 4A 3 + 27 B2 cancels from the L j' M j . Compare the formula (*) at the end of §12. Detailed formulae are in Silverman's book.

81

17: Height3. Finite Ba3i3 Theorem.

a.nd

(Xj,Yj) as usua.l. Then (cf. Formulary)

Xj =

(l,x3

+ X4,X3X4)

= (Wo, WI, W 2)

as elements of the projective pla.ne, where 2 W o = (X2 - xd WI = 2(XIX2

+ A)(xI + X2) + 4B

W2 = x~x~ - 2AxIX2 - 4B(xI

+ X2) + A2

On writing XI, X2 as quotients of integers a.nd homogenizing, it is rea.dily seen tha.t H(Wo, WI, W 2) ~ C3 H(XI)2H(X2)2 for some

On the other ha.nd,

C3.

H(Wo, WI, W 2) = H(I,x3 + X4,X3X4) 1 ~ "2 H (X3)H(X4) by Lemma. 2. The truth of the lemma. follows with

C2

= 2C3.

Corollary.

Min(H(xI .h Wit

C4

= C2

1/2

+ X2), H(xI - X2))

~

c4H(XI )H(X2)

.

In a.nother direction we ha.ve

Lenul.la 5. Let). be given. There are only finitely many x E 0 with.

H(x)

~

)..

Proof. For x

= (x, y)

a.nd Iuol, lUll

~)..

with H(x) ~ ).; tha.t is x

=

UO/UI

with

Uo, UI

EZ

We a.re now in a. position to prove the

Finite Basis Theorem.

The group 0 of rational point3 i3 finitely

generated. Proof. By the "wea.k" theorem [§15, Theorem 1], 0/20 is finite. Let

hI, ... , h. E 0 be representa.tives of the classes of 0 modulo 20. Now let a E 0. There is some j such tha.t a ± h j E 20 for both choices of sign. By Lemma. 4, Corolla.ry, there is one choice of sign such tha.t

Lecture~

82 Now a

± bj

on Elliptic Curve~

= 2c, c E 0, a.nd so

H(a ± b j ) ~ "'(lH(C)4 by Lemma. 3. Putting everything together, we ha.ve

H(C)4

~

{;lc4H(a)H(b j ) ~ K.H(a), .

where

Hence either

H(c)

~

1

"2H(a)

or

H(a) ~ (16K.r/3 = ).

(sa.y).

It follows rea.dily tha.t 0 is genera.ted by the bj a.nd the a with ~ ).. But the la.tter a.re finite in number by Lemma. 5.

H(a)

We ·conclude this section with a. brief review of the properties of heights. The inequa.lity in Lemma. 4 is supplemented by one in the other direction: where /"l > O. Indeed the W o, WI, W 2 of the proof of Lemma. 4, considered a.s functions of indetermina.tes x I, X2, ha.ve no common zero in the a.lgebraic closure: for Wo = 0 implies X2 = XI a.nd then WI, W 2 become the functions D, E used in the proof of Lemma. 3. Now (*) follows from a.n appropria.te genera.liza.tion of Lemma. 1. Note tha.t Lemma. 3 is now just the ca.se X2 = XI of the extended Lemma. 4. We now move over to the loga.rithmic height

h(x) = log H(x), so tha.t the extended Lemma. 4 gives Ih(xI

+ X2) + h(xI

- X2) - 2h(xd - 2h(X2)1 ~ c

for some consta.nt c. In particula.r, Ih(2x) - 4h(x)1 ~ c. It follows tha.t

h(x) = lim h(2nx)/4n n-ao

exists, a.nd sa.tisfies h(xI

+ X2) + h(xI

- X2)

= 2h(xd + 2h(X2).

§17: Exercises

83

It is now an undergraduate exercise (cf. Exercises) to deduce that

h(Xl + X2) - h(xt} - h(X2) is bilinear in Xl, x2; and so that h(x) is a quadratic form on
h(nx) so h(x)

= 0 if x

= n2 h(x),

is torsion: the conVerse holds by Lemma 5 and since

h(x) - h(x) is bounded.

§17. Exercises 1. (i) Let a E Q, a "# O. Show that many primes p and that

IT p inc

(ii)

lalp = 1 except for

at most finitely

lalp = 1.

00

Let UQ, ... , Un E Q, not all O. Show that max: IUj Ip at most finitely many p and that

IT

= 1 except for

m~ IUjip = H(u)

.

pIne oc

is the height of the point u

J

= (UQ, ... , un) in projective space.

2. (Required in text.) Let f(x) be a function defined for x in a group 9Jl and taking values in a field of characteristic "# 2. Suppose that

f(x + y) + f(x - y)

= 2f(x) + 2f(y)

for all x, y E 9Jl. Show that

f(x)

= B(x, x),

where B(x, y) is a symmetric bilinear form. [Hint. Take 1

B(x, y)

= "2{J(x + y) -

f(x) - f(y)}.

One has to show that

B(x + z, y)

= B(x, y) + B(z, y),

i.e. that

+ f(z) = f(y + z) + f(z + x) + f(x + y).

f(x + y + z) + f(x) + f(y)

22

There are different definitions of the canonical height. constant factor.

They differ by

a

84

LectuTe3 on Elliptic CUT'ue3

One opening ga.mbit is to observe tha.t (x

+ Y + z) + x = (x + z) + (y + z).]

3. Let C: X 3 + AX + B a.nd suppose tha.t Xl, X2 are independent generic points. Let X3 = Xl + X2, X4 = Xl - X2' Show tha.t

+ x2 + X3) = (Yl - Y2)2 (Xl - X2)2(XI + X2 + X4) = (Yl + Y2)2. + x2 + X3, Xl + X2 + X4 are roots of a.n equa.tion 2 (Xl - x2)2T + uT + v = 0, (Xl -

Deduce tha.t

Xl

X2)2(J.·1

where u, v a.re polynomia.13 in Xl, X2' Deduce tha.t a. simila.r result holds for X3, X4. 4. (Required in text.) Let G(X) E Q[X] be a. nonsingula.r qua.dra.tic form in X = (X,Y,Z) a.nd suppose tha.t there is a.n X = (x,y,z) i- (0,0,0) such tha.t G(x) = 0. Show tha.t there a.re linea.r forms L(X), M(X), N(X) E Q[X] a.nd a. dE Q' such tha.t G(X)

= L(X)M(X) + dN(X)2.

[HintJ. Without loss of genera.lity X = (1,0,0). After a. linea.r tra.nsforma.tion on Y, Z, we ma.y suppose G(X) XY + form in Y, Z. (iii) Complete the squa.re with respect to Z.] (i) (ii)

=

5. Let h be the ca.nonica.l height on some curve C a.nd suppose tha.t there are representa.tives of a.ll classes of 0/20 in h(x) :::; t for some t. Show tha.t 0 is genera.ted by the a E 0 with h( a) :::; t.

18 Local-global for genus 1

Our attention now moves from elliptic curves to curves of genus 1 in general. In this section we give a couple of examples to show that there is no local-globa.l principle for rational points on curves of genus 1. Subsequently, we shall give a structure to the "obstruction" to a. loca.l-globa.l principle, namely the Tate-Shafarevich group. The two examples we shall discuss are 3X 3 + 4y3 + 5Z 3 = 0, (1) due to Selmer, and

(2) due (independently) to Lind and Reichardt. The techniques we have developed so far enable us to disprove the existence of rationa.l points_ We have not, however, developed techniques to show that there are solutions everwhere locally. This is because we have left a fairly highbrow discussion of curves of genus lover finite fields until the end (§25). The reader may, of course, verify for any given p that there is a point defined over Qp but this can never disprove the existence of some P > 10 10 (say) such that (1) or (2) ha.s no solution in Qp. We sha.ll a.ssume without present proof that a curve of genus lover a finite field F p a.lways ha.s a. point defined over Fp (§25, Theorem 2). If, therefore, a curve such as (1) or (2) reduced mod p is still of genus 1, then there is a point mod p which can, by Lemma 1 of §10, be lifted to a point defined over Qp-

86

Lecture3 on Elliptic Curve3

Assuming this 22 , the only Qp to be considered for (1) a.re p = 2, 3, 5 a.nd the only ones for (2) a.re p = 2, 17. It ma.y confidently be left to the rea.der to confirm tha.t there a.re points for these p. The disproof of ra.tiona.l points on (1) uses

Lemma 1. Let a, b, e be di3tinct integer3 > 1 and 3upp03e that d = abc i3 cube free. Suppo3e that there are u, v, w E Z not all 0 3uch that au

l

+ bv l + ew l

Then there are x, y, z E Z with z Xl

Proof. Let p3

= 1,

=

i- 0 3uch

o. that

+ yl + dz = O. l

pi-I a.nd put ~

=

T/

= au l

au

l

+ pbv l + p 2 ew l + p 2 bv l + pew l .

Then ~

p~

+ T/

= 3au

l

2

+ p T/ = 3ew l l p2~ + PT/ = 3bv a.nd so , = -3uvw.

Now the two points (CPT/,'l, (77,p2~,'l a.re conjuga.te over Q. Hence the line joining them meets Xl + y l + dZ l = 0 in a. point defined over Q a.nd distinct from (1,-1,0).

Lemma 2. The only point defined over Q on

Xl

+ y l + 60Z l = 0

i3 (1, -1, 0). Proof. There is no torsion, e.g. by the discussion of exceptiona.l points on cubic curves (§6, Lemma. 1). The curve is bira.tiona.lly equivalent over Q to

22 For the specific curves (I), (2) the number of points mod p may be computed (or estimated) by other fairly elementary means, e.g. by the use of finite Fourier analysis.

18: Local-global for

genu~

1

87

for which 0/20 is trivia.l by the proof a.t the end of the section on the wea.k theorem (§15, Second example). It follows from the Finite Basis Theorem tha.t 0 is trivia.l. Theorem 1. There are no rational point~ on..{l). Proof. The la.st two lemma.s.

The preceding proof used the theory of a.lgebra.ic numbers. The next proof works entirely in the ra.tiona.ls. point~

Theorem 2. There are no rational

on (2).

Proof. If not, suppose (x, y) is on (2). Let x = alc as a. fra.ction in its lowest terms. Then

a 4 -17c 4

= 2b 2 ,

gcd(a,c) =gcd(b,c) =gcd(a,b) = 1.

Putting

we ha.ve

This equa.tion is soluble everwhere loca.lly, so globa.lly, and in fa.ct 52 _17.12

=

2.22.

Now

(5A

+ 17C + 4b)(5A. + 17C -

4b) = 17(A + 5C)2.

If there is a. common odd prime divisor of the two factors on the left

hand side, it divides 5A + 17C a.nd A + 5C, so divides 8A and 8C: a. contra.diction. The two fa.ctors on the left ha.nd side ha.ve the sa.me sign, which for A = a 2 , C = c 2 must be positive. Hence for integers u, v there is one of two possibilities First Case 2

+ 17c ± 4b =

5a 2

+ 17c2 =f 4b =

5a

2

a2

17u

Second Case 34u 2

2

2v 2

+ 5c 2

uv

2uv

In the first ca.se 10a 2

a2

+ 34c2

+ 5c 2

= 17u 2

=uv.

+ v2

LectuTe3 on Elliptic CUTve3

88

We show tha.t this is impossible in Q17. Write

II =

1117. By homogeneity

ma.x(lal, Icl, 111.1, Ivl) = 1. Since 10 is a. qua.dra.tic non residue mod 17, we ha.ve

lal < 1,

Ivl < 1.

The second equa.tion gives

Icl < 1. Fina.lly, the first equa.tion gives

111.1 < 1. Contra.diction. The second case gives 5a

+ 17 c2 = 17u.2 + v 2 a 2 + 5c 2 = 2uv. 2

The proof tha.t this is impossible in Q17 is similar.

§18. Exercises 1. [Uses a.lgebra.ic number theory.] Supply the deta.ils of the following a.lterna.tive proof of Theorem 2.

(i)

(ii)

The field Q( J17) has class number 1. A basis of integers is 1, + J17). A fundamenta.l unit is 4 + J17 of norm -1. The prime 2 splits into (5 ± J17)/2. Suppose a' - 17c' = 2b 2 with a, b, c E Z, gcd(a, c) = 1. Then a, c are 0 dd a.n d

t(1

are coprime. (iii)

for some unit (iv) (v)

TJ

and some integer p..

> 0 in both rea.! embeddings. Hence TJ is a. square and so can be a.bsorbed in p.2. Put 77 = 1, P. = (11. + vJ17)/2 in and equa.te terms independent of J17. Then 4a 2 = 5(11.2 + 17v 2 ) ± 34uv, which is impossible in Q3 (and in QJ7).

TJ

19 Elements of Galois cohomology

In the next section we have occasion to consider two curves which are both defined over Q and which are birationally equivalent over Q. Here we consider a simpler case and then set up some general machinery. The conic

A: X~ +X~

=3

has no rational point and so is not equivalent over Q to the line (coordinate Y, no equation). They are, however, equivalent over Q( v'3), for example by the equations

y

= (Xl

- .J3)/X2 X2 ==

-2v'3y -2--·

Y +1 Let y be transcendental, so XI, X2 is a generic point of A. The Galois group Gal(Q( v'3)/Q) can be made to act in two different ways on Q(v'3,y) = Q(v'3,XI,X2). We can either make it act trivially on y or we can make it act trivially on (XI,X2). In the first case, the non-trivial element of the Galois group induces the automorphism

of A. In the second case, it induces the automorphism y

of the line.

-+

-l/y

LectuTe~

90

on Elliptic

CUTve~

In the example, we have used the birational equivalence to identify the two function fields. In the general theory it is better to make it explicit. Let A, B be two curves defined over Q and let

A-+B

rjJ:

be a birational equivalence defined over Q. Let u E Ga.l(Q/Q). We can let u act on the coefficients in rjJ and so obta.in another birational equivalence

A

crrjJ:

-+

B.

Then O,,(say) == (UrjJ)rp-l:

B -+ B

is a birational automorphism defined over Q. We can act on 0" by T E Gal(Q/Q). Then TO" == (TUrjJ)( TrjJ)-1 == [(TUrjJ)rp-l][rjJ(TrjJ)-I] == Or"O;1 .

Hence Or" == (TO,,)Or.

This is the·l3 cocycle identity and {O,,} is a cocycle. Let there be another birationa.! equivalence

A

rjJ':

-+

B

defined over Q, so rjJ'

= wrjJ

for some automorphism w:

B -+ B.

Then == uwO"w- 1.

The two cocyles {O,,} and {O~} are said to be cobounding. If rjJ is defined over Q, we have O~ = (uw)w- 1, a cobounda.ry. In this case A, Bare birationally equivalent over Qj but we have chosen to use a different equivalence.

23

We owe the rococo terminology to the topologists.

§19: Exerci3e3

91

GivenS and the co cycle {O,,}, we can reconstruct A (up to a birational equivalence defined over Q). For let x be a generic point of B. We define an action U of the u E Ga.l(Q/Q) on Q(x) as follows:

U acts ~n Q by u } ux = Orrx. Then for

T

E Ga.l(Q/Q) we have

T(ux)

= (TO,,)(Tx) = (TO,,)Or X

Thus

(Tci)

= TU.

The fixed field of the U is a function field over Q, and so gives A up to birational equivalence over Q.

§19. Exercises 1. Let u run through Ga.l( Q/Q). Find a cocyle {O,,} of birationa.l automorphisms which twist the line into

X~ +X~

= n,

where n is any given element of Q* . When n = 5 give an explicit representation of your co cycle as a coboundary. Is your cocycle a coboundary when n = 3?

20 Construction of the jacobian

Let V be a. curve of genus 1 defined over Q. In this section we construct an elliptic curve C, a.lso defined over Q, which is closely rela.ted to it. This rela.tionship will be exploited in subsequent sections. We must initially consider bira.tiona.l equivalences between elliptic curves. We work a.t first over a. genera.l field. Let

(j = 1,2) and let

rj>:

C1

-+

C2

be a. bira.tional correspondence. By considering rj>(x) - rj>(01) instea.d of rj>(x), we ma.y suppose without loss of generality tha.t

rj>(od =

02,

where OJ is the point a.t infinity on Cj. The correspondence must ta.ke functions with poles of order 1 into such functions. Hence

rj>(X)

= aX + b

for some a, b. Similarly

rj>(Y)

= cY = cY + dX + e.

The form of the equa.tions for Cj imply tha.t

d a.nd so

= e = 0,

b = 0,

a

3

= c2

93

20; Con3truction of the jacobian

for some s. Hence

B 2 =s6B 1 .

A2=S4Al'

(1)

In particular, AU B~ = A~ / Bi is invariant under birationa.l equivalence. It is conventional to work with the birational invariant

..

1728(4A3)

] = ](C) = 4A3 + 27 B2 of

y2

C:

= X 3 + AX + B.

The notation j is standard. The constant 1728 = 12 3 is suggested by the complex variable theory. Note that every elliptic curve gives a finite value of j: it is the degenerate curves that send j to infinity. Lemma 1. Two elliptic curve.! in canonical form which are birationally equivalent are related by (1) for 30me s. In particular, they have the 3ame j -invariant. Further, s i3 in any field over which the curve3 and the equivalence are defined.

Corollary. Any birational equ.i·ualence of the elliptic curve

C: taking a into

0

i3 of the form

y If AB i- 0, then = 1.

= x 3 + AX + B

y2

s2

=

--+

s3y,

1. If B

X

= 0,

--+ s2 X.

then

s4

=

1 and

if A =

0, then

s6

Proof. Clear from (1) with C = C1

= C2 •

Let us return to the main topic of the section. Let V be a curve of genus 1 defined over Q. In general it will not have a rationa.l point and, if it has, we may not be able to find one: but there is no difficulty in finding a point defined over Q. Hence there is a birationa.l correspondence rI>:

V-. C

defined over Q, where C is in canonical form but defined over Q. Let u E Gal(Q/Q). We can act on the birational correspondence with u and obtain uri>:

V

--+

uC,

where uC:

y2

= X 3 + u AX + u B.

Lecture3 on Elliptic Curve3

94

Now C and uC are birationally equivalent over Q by (ur/> )r/>-l. Hence

uj(C) = j(uC) = j(C); that is, j(C) E Q or equivalently A 3 /B 2 E Q if AB i- O. Hence by a transformation X -+ t 2 X, Y -+ t 3 y (t E Q) we may suppose without loss of generality that C is defined over Q. Of course in general r/> is defined only over Q. Now is an automorphism of C. Suppose, first, that

AB

i- O.

Then by Lemma I, Corollary, the automorphism 0" of C must be

0,,:

x

-+

c"x

+ a"

for some point a" defined over Q and c" = ±1. We are in the position discussed in the previous section, so

Or" = (TO,,)Or' In particular, since c" E Q, we have

so c" is a group character. We would like to ensure that d E Q such that

CrT

is always 1.. If not, there is some

The transformation

X

-+

y

dX,

-+

dv'dY

gives a new C defined over Q: and with this we do indeed have always.

CrT

=1

If AB = 0, the same conclusion holds but the argument is a little deeper24. Suppose that B = 0, so c~ = 1, where we define

x

-+

cx

by

x

-+

c 2 X,

Y

-+

Now Gal(Q/Q) acts on c, and

Cr"

= (Tc,,)cr'

24 And may be omitted at first reading.

cY.

§20: Exerci3e3

95

By "Hilbert 90" (see Exercises) there is a. Ii E Q with Ii' E Q such tha.t uli

= c"li.

We can now modify C, a.s before, so tha.t c"

= 1 identica.lly on

the new

C. Similarly for A = O. Thus in every ca.se we ha.ve found a. C defined over Q and a. bira.tional equi va.lence

rp: V-+C defined over Q such tha.t

(Urp)rp-l=(),,:

x-+x+a"

for a.ll u E Ga.l(Q/Q). To sum up, we ha.ve proved: Theorem 1. Let V be a curve of genu3 1 defined over Q. There i3 an elliptic curve C defined over Q and a birational equivalence

rp:

V-+C

defined over Q 3Uch that. for every u E Ga.l(Q/Q), the map

(),,=(Urp)rp-l:

C-+C

i3 of the f07'm

for 30me a" E 15. Further, C i3 unique up to birational equivalence over

Q.

The elliptic curve C is the jacobian of V. Before exploring this situa.tion further, we require some new ma.chinery, introduced in the next section.

§20. Exercises 1. Construct the ja.cobian of (i) y2 = aX' + bX 2 + c (a, cEQ·, bE Q, b2 - 4ac i- 0). (ii) aX 3 + by3 + cZ 3 = 0 (a, b, cEQ·). (iii) aX 3 + by3 + cZ 3 + mXYZ = 0 (a, b, c, m E Q.). (iv) y2 = aX' + bX 3 + cX 2 + dX + e.

2. Let V be the curve of genus 1 given by the redundant equa.tions

(e2 - el)t 2 = dlV~ - d2V~ (e3 - e2)t2 (el - e3)t2

= d2V~ = d3V~ -

d3V~ dlV~,

§lW: Exerci3e3 where el, e2, el are distinct a.nd dj E Q*, d l d 2dl = 1. Show tha.t there is a. point of V defined over K. = Q( d: 12 , d~/2) and hence find a. ma.p

r/>: V-+C defined over K. into

C:

y2

= (X -

el)(X - e2)(X - el).

Show tha.t the cocycle

(Ur/»rp-I for

U

= Orr:

C -+ C

E Gal( K./Q) is of the type

x: -+ where 2a rr

= o.

x

+ a rr

Deduce tha.t C is the jacobian of V.

3. In this exercise the ground field is Q(p), where pl Let a, b, c E Q(p), and let V: aU l + bV l + cW l

C:

Xl

= al/lU,

y

Pi-I.

+ yl + abcZ l = 0.

Put K. = Q(p,al/l,bl/l) and let r/>: V X

= 1,

-+

C be given by

= bl/lV,

Z

= a-l/lb-l/lW

Show tha.t the corresponding Orr is

Orr:

x-+x, or x+(p,_p2,O) or x+(p2,_p,O).

Deduce tha.t C is the ja.cobia.n of V. The rema.ining exercises fill in the proof tha.t (in the nota.tion of the text) one can arra.nge to ha.ve err = 1 when AB = 0. 4. Let K./ k be a. fini te norma.l (separa.ble) extension of fields of degree n. Let Cl!1, ... , Cl!n be a. ba.sis of K./ k a.nd let UI, ... , Un be the elements of the Galois group. Show tha.t

[Hint. K. = k(f3) for some f3. Note. In wha.t is still the finest introduction to Galois theory, (Ga.loi3 Theory. Notre Dame Ma.thema.tical Lectures 2, 1942. Second edn., 1948.) E. Artin proves this a.t the onset by an induction argument.] 5. Let K./k be a. finite normal (separable) extension. For let Orr E k* be given sa.tisfying the co cycle identity

Orrr

= (TOrr)Or.

Show tha.t {Orr} is a. co boundary, i.e. tha.t

Orr

= (u'Yh- 1

(all u),

U

E Gal(K./k)

§20: Exerci3e3 for some 'Y E It·. [Hint. Let>. E

It.

97

Show that 'Y

= L lIa{u>.) a

does what is required provided that 'Y -I O. Use Lemma 2 to show that >. can be so chosen. Note. This result is usually known as Hilbert 90 because it is Satz 90 in Hilbert's Zahlbericht - his report on algebraic number theory to the German Mathematical Society at the end of the last century.] 6. Let n > 1 be an integer. For u E Gal(Q/Q) let lIa be an nth root of 1 and suppose that {lIa} is a cocycle. Show that there is a Ii E Q such that lIa = uli/Ii and lin E Q.

21 Some abstract nonsense 25

Let f be a finite group which acts on an abelian group A (written additively). The action is written ooA (00 E f, a E A). A cocycle is a map f -+ A, say

(J'

--+

au

which satisfies the cocyle identity

(00, rEf). note that for r

= 1 (the

identity of f) this implies al

= O.

If b E A, then it is easy to see that ar

= oob - b

is a cocyde. Cocydes of this type are called cobou.ndarie3. Cocydes form a group under elementwise addition

{au}

+ {bu}

=

{au

+ bu}.

The coboundaries are a subgroup. The quotient group is

Hl(f,A),

25 This is a self-contained account of what is needed from the cohomology of groups and commutative Galois cohomology. For how it fits into a wider picture, see, for example, Chapters IV and V of J.W.S. Cassels and A. Frohlich (Editors) Algebraic number theory, Academic Press (1967). The treatment here is suggested by that in C. Chevalley Class field theory, Nagoya (1954).

99 the fir3t cohomology grov.p. Now f acts on the whole situation ("transfer of structure"). facts on itself by inner automorphisms. So r acts on the map (cocycle)

{au}:

u

-+

au

to give

Or, writing u for rur- I , This i3 a cocycle, as it has to be; and indeed r{ au} - {au}:

(j

--+

aUT - aT - au

is a coboundary. Hence Lemma

o.

f act3 trivially on HI(f,A).

Lemma 1. Every dement of HI(f,A) i3 of finite order dividing 26 ~f. Proof. Let the element be represented by the co cycle {au}. Then, from what we have seen, it is also represented by the co cycle

r{a u }

= {aur

- ar}.

But now

L r{a

u}

= {OJ

r

[Recall that al = 0.] Lemma 2. Let m E Z, m > 1. Denote by 6. m C A the 3d of dement" of order dividing m. Sv.pp03e that every dement of A i3 divi3ible by m in A. Then every dement of HI (f, A) of order m i3 repre3entable by a cocycle {d u }, d u E 6 m . Proof. Let the given element of HI(f,A) be represented by {au}. By

hypothesis, m{ au} is a coboundary, say

mau=ub-b

(bEA).

Under the hypotheses of the Lemma, b = me, e E A so

ma u = muc-me 26 We use ~ for the cardinality of a set.

Lecture3 on Elliptic Curve3

100 that is

m(a u

-

o'C

+ c) = O.

Hence the element of HI is represented by 0' -+

au -

o'C

+ c E 6.

m ,

as required. Denote by Af the set of elements of A fixed by f: a E Af <=> O'a

=a

Lemma 3. Notation and hypothe3e3

(all

0'

E

r).

in previo1L3 Lemma. Then

a3

Af /mAf 13 canonically i30morphic to a 3ubgroup of HI (f, 6. m

).

Proof. Let a E Af. By hypothesis

bE A.

a'= mb On applying

0'

E f, we have

a = O'a = mO'b,

and so md u =0,

dO'

= O'b -

b.

Hence {dO'} is a cocycle with values in 6. m (indeed it becomes a. coboundary in .4). For given a, any other choice of b is of the type b + c, c E 6. m • Hence the element of HI(f,6. m ) given by {dO'} is uniquely determined by a. If a E mAf, we may take b E Af, so dO' = 0 for all 0', and the image in HI(f, 6. m ) is O. Conversely suppose that the co cycle constructed above is a. coboundary, so

VO' E f, some

e E

6. m

Then O'(b - e) = b - e

(all

0'

E

f) :

and so m(b - e)

= a.

We can put the last two lemmas together. We repeat the hypothesis. Theorem. Supp03e that m

>1

i3 an integer and that every element

of A i3 di'ui3ible by m. Then the 3equence

101 i3 exact, where [... ]m denote3 the grov.p of dement3 of order dividing m, and the third map i3 indv.ced by 6 m '-> A. Proof. After Lemmas 2, 3 we need only prove exactness a.t HI(r, 6 i.e. that the image of

m ),

is exactly the kernel of

HI(r, 6

m ) -+

[Hl(r, A)]m.

Consider first an element of the image, given (say) by the co cycle = ub - b, b E A and so {d .. } considered as taking values in A, is a coboundary. Thus Image C Kernel. Now let the co cycle represented by {d .. } be the kernel, i.e. {d .. } is a coboundary for A: d .. = ub - b some b E A. then {d .. } By hypothesis, d u

u(mb) - mb = md .. = 0

(all

u)

and so mb E Af. Hence Kernel C Image. Galoi3 cohomology. Let k be a field and k its separable closure (= algebraic closure in characteristic 0, the case of interest). Put

r We say that the action a

-+

= Gal(k/k).

ua (u E

r, a

E A) of r on the a.belian group

A is contin'1L0v.3 if:

For every a E A there is an extension K. of k of finite degree [K. : k] (depending on a) such that ua

=a

(all u E Gal(k/K.) C Gal(k/k)).

Note 1. An example is: k

over Q, A

< 00

= Q, C a

curve y2

= X 3 + AX + B

defined

= (5.

Note 2. If A has any natural topology, this is disregarded. For us the word "continuous" is just a term of art. The action is continuous in the usual sense if r is given an appropriate topology and A the di3crete topology.

A continv.0v.3 cocycle is a map (J'

--+

au

(u E

r,a .. A)

which (i)

satisfies the co cycle identity

(u,rEr) (ii)

is continuous in the sense that there is a normal extension K./k of

102

Lectures on Elliptic Curves

finite degree [It : k] < 00 such that au depends only on the action of (J" on It [Of course It may depend on {au}]. In particular, (all

E Gal(k/It)),

T

so (all

T

E Gal(k/ It)

and hence

au

E

It

(all

(J"

in Galk/k).

If {au}, {b u } are continuous co cycles, then clearly {au + bu } is continuous. A coboundary {uc - c} c E A is automatically continuous, by our hypothesis that f acts continuously on A.

Definition. HI (f, A) is the group of continuous cocycles modulo coboundaries. By following the proofs of the f finite case it is straightforward to prove Theore In L HI (f, A) is torsion (i. e. every element has finite order). Theorem 2. Let m > 1 be an integer and suppose that every element of A is divisible by m. Then the sequence 0--+ A r /mAr --+ HI(f, 6. ) --+ [HI(f, A)]m --+ 0 m

exact where (as in the previous section) (i) A r is the set of a E A fixed by f. IS

(ii) 6. m is the set of elements of A of order dividing m. (iii) [HI(f, A)]m is the set of elements of HI(f, A) of order dividing m.

Appendix. 27 Localization Let p be a fixed prime. Choose a fixed embedding

>.: Q '---+ Qp. Write

27 May be omitted at first reading. As will be explained, the result obtained

here is obvious from another point of view in the context of the conrse.

§21: Appendix. Localization

103

f = Gal(Q/Q) so

>.

f p = Gal(Qp/Qp); induces an embedding

>'*: fp

f.

'--+

Let A be a continuous f-module. Then it IS vIa >'* a continuous f,-module. Let {au}, (J" E f be a continuous co cycle. By restricting u to f p, we have a continuous f p co cycle. Hence we have a group homomorphism

>.I:

HI(f,A)

--+

HI(fp,A)

[localization: A special case of the "restriction map"]. Ostensibly >'1 depends on the embedding >., but we show that it does not. Any embedding A of Q '--+ Qp is of the shape

A = >'1-', where I-' is an automorphism of Q/Q. By the analogue of Lemma 0 of the "Finite f" section, I-' acts trivial on Hl(f, A), and so AI = >'1. Thus the map

is canonical. In the context of the course, we have an elliptic curve y2

=X 3 +AX +B

defined over Q. Let ~, ~p be the points defined over Q, Qp respectively. We are concerned with the map HI(f,~) --+ HI(fp,~p),

which may be regarded as Hl(f, ~)

--+

Hl(fp, ~)

--+

HI(fp, ~p),

the second induced by the embedding ~ '--+ ~p.

Later we interpret an element of HI (f, ~) as a curve V defined over Q together with a choice of structure as a principal homogeneous space. A curve V defined over Q is certainly defined over Qp. with its structUl"e of principle homogeneous space it thus corresponds to an element of HI(fp, ~p). The resulting map HI(f, ~) --+ HI(fp, ~p) is precisely the one constructed above.

22 Principal homogeneous spaces and Galois cohomology

Let V be a curve of genus 1 defined over Q. Theorem 1) that there is an elliptic curve

c:

y2

We ha.ve seen (§20,

= X 3 + AX + B

defined over Q and a birational equivalence

,p: V-+C defined over Q. Further, for any

U

E Gal(Q/Q) the map

(U,p),p-l: C -+ C is of the type x

-+

x

+ au,

where au E (5. The elliptic curve C is unique up to a transformation

X Of course V.

-+ s2 X,

,p and the

au

Y

-+

s3y,

S

E Q*.

are far from being unique. C is the jacobian of

We have to discuss how far the elements of the above situation are arbitrary. We note first that (by the previous discussion) the au satisfy the co cycle identity

Now the au are in the commu.tative group machinery of §21.

(5,

and we ma.y invoke the

22: Principal homogeneo1l.3 3pace3 and Galoi3 cohomology

105

On replacing the map ¢ by ¢1/;. where

1/;: C--+C, x--+x+b

(bE~),

we replace {au} by

au+(oob-b) where oob - b is a coboundary. In the commutative case, the coboundaries a.re a subgroup of the co cycles and so {aT} determines an element of the quotient group cocycles/coboundaries

= Hl(f, ~)

- the first cohomology group, where f = Gal(Q/Q). We now look at the information which an element of Hl(f, ~) gives us about V. In the first place, we certainly can construct a curve V and a. birationa.l equivalence ¢ by our general machinery. To remind: let x be a generic point of C. There is an action u of Gal(Q/Q) on Q(x) given by (i) u acts like 00 on Q (ii) ii"x = x + au. Then the fixed field is the function field of a curve V defined over Q and ¢, defined over Q, is given by the identification of the two function fields over Q. The map ¢ gives V a structure of principal homogeneo1l.3 3pace over C in the following sense. Let ~ I' ~2 be independent generic points on V, which we treat as fixed under Gal(Q/Q). Put

Then oo6(~1 '~l) = (¢(~l)

+ au - (¢(~2) + au)

= 6(~1'~2)· That is, the algebraic map from two copies of V to C given by 6 is defined overQ. Clearly 6(~1'~2) + 6(~2'~3) = 6(~1'~3)· Hence the co cycle {au}, or the corresponding elements of HI(f,~), determines the pair (V,6). The co cycle {-aa} determines the pair (V, -6). Thus to get a group structure we must consider not just the curves V with given jacobian, but the pairs (V, 6) where 6 is a structure of principal homogeneous space. The above account overlooks one tricky point. An element of HI (f, ~ ) determines the function field of V, and so determines V only up to

106

Lectures on Elliptic Curves

birational equivalence defined over Q. Now it can happen that there is a birational automorphism of V defined over Q which interchanges 6. and -6 (!). A trivial example is when C is regarded as its own jacobian. Consider two maps

(j=1,2) where ¢l is x -+ x and ¢2 is x -+ -x. In both cases the cocycle au is identically O. In the first case, 6 1(XI, X2) = XI - X2i and in the second 6 2(XI,X2) = X2 - Xl. The two are taken into one another by the automorphism X -+ -x of C = V. In the example just above, we have the trivial element of HI(f, ~). There is the same phenomenon for elements of order 2 (and only for them) [Exercise for reader!]. To deal with this difficulty, we shall identify two structures of principal homogeneous space which are birationally equivalent. With this convention each element of HI(f, ~) defines a unique principal homogeneous space. Conversely, a structure of principal homogeneous space determines the element of HI(f, ~). Consider the map

¢:

V

-+

C.

By our initial construction, the corresponding co cycle is au

= (u¢)(~) = ¢(~),

where ~ is a generic point of V fixed under Galois. Now let Cl! be a.ny algebraic point on V (i.e. defined over 0'(¢(Cl!)) since

0'

ij).

Then

= (O'¢)(UCl!) = ¢(uO/) + au,

acts both Cl! and on the coefficients of the map ¢. Hence 6(0/,0'Cl!)

= ¢(O/) = ¢(O/) -

¢(uO/) u(¢(O/))

+ au

Thus {6( Cl!, 0'Cl!)} u is a cocycle, and differs from {au} u by a coboundary. To sum up: Theorem There is a canonical isomorphism between principal homogeneous spaces (V, 6) (up to birational equivalence over Q) and elements of HI (f, ~). The element corresponding to (V, 6) is given by the cocyle {6.(0/, uO/)}u,where 0/ is any algebraic point on V.

Note 1. Principal homogeneous spaces were introduced by Wei!. He defined their group structure directly, not by refernce to HI(f, ~).

§22: Exercis es

107

Note 2. For the cognoscenti. The "jacobian" defined here is a refinement of the classical notion defined over the complex numbers. Recall that a divisor a on V is a map from the algebraic points a on V to Z which is 0 for all except at most finitely many a. It is defined over Q if it is invariant. (in an obvious sense) under Gal(QIQ). The degree is no, where a is a --+ no. Suppose that a is of degree O. The jacobian map is the map from a to

E

o

the summation being that on C. The divisor a is in the kernel of the map precisely when the ¢(a) with their multiplicities are the poles and zeros of a function on C. Identifying V and C via ¢, this is the same as saying that a is the divisor of a function on V [a principal divisor]. If a is defined over Q, then J ac( a) is defined over Q, as follows easily from the formula for u¢(a). Hence we have group monomorphism. Divisors of degree 0 on V defined over Q --+ (5. Principal such divisors A final point. If the divisor a of degree 0 is defined over Q and is principal, then it is the divisor of a function on V defined over Q. For suppose that f is a function with divisor V defined over Q. Let u E Gal(QIQ). Then a is also the divisor of u f and so uf

jE """""Q .

It is readily checked that u --+ u f I f is so is a coboundary by Hilbert 90 [§20, for some).. E Q* and all u. Then).. - I f over Q, and has divisor a, as required. and applies to curves of any genus.]

a co cycle with values in Q*; and Exercise 5]. Hence u f I f = u)..l).. is fixed under Galois, i.e. defined [Of course this remark is general,

§22. Exercises 1. If €, x are generic points of V, C respectively, fixed under Galois, show that the function A(€,x) = rl(¢(O + x) is defined over Q and investigate its properties.

23 The Tate-Shafarevich group

We put together the results of the two previous sections. As before, let

C:

y2

=

x 3 + AX + B

be an elliptic curve defined over Q. The groups of points defined over Q, Q respectively are l5, l5j and r is Gal(Q/Q). We have seen that the first cohomology group Hl(r, (5) is canonically isomorphic to the group of equivalence classes of {V,6} where V is a curve of genus 1 and 6 is a stl'l1cture of principal homogeneous space on it. This group is often referred to as the Weil-Chatelet group and denoted by WC = WC(C). Let m > 1 be an integer. The group l5 is divisible by m since finding a b such that mb = a E l5 is just a matter of solving some algebraic equations. The exact sequence of the previous section is now 0--+ l5/ml5 --+ Hl(r, 6 m)

-+

[Hl(r, (5)]m --+ 0,

where 6 m C l5 is the group of elements of l5 of order m and the [... ]m denotes the subgroup of elements of order dividing m. We now have an approach to the weak Mordell-Weil theorem. We would like to find the elements of Hl(r, 6 m ) which are the images of l5 /ml5. By the exactness of the sequence these are precisely the kernel of the map

Hl(r, 6 m) --+ Hl(r, (5) = WC(C). Being in the kernel means that the image is a trivial principal homogeneous space {V, 6}j i.e. that there is a point on V defined over Q. For m = 2 we are back in the situation discussed in the proof of

109

The Tate-Shafarevich group

the Weak Mordell-Weil Theorem. There we displayed the curve V in the image {V,6} of an element of HI (f, 6 2 ) as the intersection of two quartic surfaces 28 . As we have already emphasised, there is even now no algorithm for deciding whether or not there is a rational point on V. There is, however, no difficulty in deciding whether or not there is a point on V everywhere locally. As we shall see in a moment, the elements of we for which there is a point on V everywhere locally form a subgroup. It is known as the Tate-Shafarevich group and is usually denoted 29 by the Russian let ter III ("sha"). To show that III is a subgroup we must discuss localization. For any prime p (including 00) we use a suffix p to denote an object defined over Qp instead of over Q. There is an obvious map Jp:

we -+ we p

which takes the equivalence class of a principal homogeneous space (V, 6) defined over Q into the class of the same {V, 6} considered over Qp. The non-cohomological description of the composition of principal homogeneous spaces works entirely over the ground field: thus it shows immediately that the localization jp respects the group law; but we have not explained that description. From the cohomological point of view, we have a map Jp:

HI(f, (5)

-+

HI(fp, l5 p ),

induced by the inclusion l5 C l5 p . This situation was discussed at the end of §21, where it was shown that jp is a group homomorphism and is independent of the choice of inclusion Q C Qp. Clearly III is the intersection of the kernels of all the localization maps ill (including p = 00). For given m, denote by Sm the group of elements of HI(f, 6 m ) which map into III C HI(f, (5). It is called the mth Sehner group. Now we have the exact sequence

o -+ l5 /ml5 -+ Sm

-+ [

III 1m

-+

o.

For m = 2, which we encountered in the proof of the weak MordellWeil Theorem, we saw that S2 is finite and effectively constructible. It

28 The au thor apologizes for the clash between 6 denoting a structure of prin-

cipal homogeneous space and 62, the group of elements of order 2 in

l5.

29 This is the author's most lasting contribution to the subject. The original notation was TS, which, Tate tells me, was intended to continue the lavatorial allusion of we. The Americanism "tough shit" indicates the part that is difficult to eliminate.

110

Lectu.re3 on Ellip tic Cu.rve3

can be shown by a more sophisticated version of the same argument that the same things hold for Sm and general m, though now the effective constructibility tends to be not very practical. To sum up. The Selmer group is knowable. It majorizes rtJ /mrtJ and the "error" is given by III, which can be called the obstruction to the local-glocal principle for curves of genus 1 with the given jacobian C. This is as far as we shall go in this direction with the theory. We conclude with background comments. Before all this theory was invented, Selmer embarked on a massive programme to find the Mordell- Weil groups of elliptic curves, especially those of the type

C: Xl

+ yl + dZ l = 0,

where d E Z. He used descent arguments to bound the Mordell-Weil rank. Also, by a direct search, he found rational points on C and so bounded the Mordell-Weilrank from below. Most often the upper and the lower estimates for the rank coincided, but when there was a discrepancy the difference was always even. Moreover, estimates for the rank derived from different types of descent (e.g. majorization of rtJ /2rtJ and rtJ /3rJ'J) always differed, if at all, by an even integer. After the group III was discovered by Tate and Shafarevich, it was natural to look for the explanation of this phenomenon in the structure of III. It turns out that there is a skew-symmetric form on III whose kernel is the group of infinitely-divisible elements of III. It always looked improbable that there are infinitely-divisible elements and by now there is much evidence (but no proof) that they do not exist. If there are no infinitely divisible elements, the existence of the skew-symmetric form shows that the order of [ III 1m is a square. This explains Selmer's observation. There is not merely a local-global principle for curves of genus 0, but it has a qUiUltitative formulation (and also, more generally for linear algebra groups. The modern formulation is in terms of the "Tamagawa number"). On the basis of massive calculations (this time on a computer) Birch and Swinnerton-Dyer proposed what can be regarded as a quantitative local-global theorem for elliptic curves. In their formula there is a number, not otherwise accounted for. In all their calculations the mysterious number turned out to be an integer and indeed a perfect square. It was natural to interpret this integer as the order of III (supposed

The Tate-Shafarevich group

111

finite), and, once made, this identification was supported on other grounds. The Birch-Swinnerton-Dyer conjectures were widely generalized and further evidence for their plausibility were adduced. It is only in the last few years that progress has been made with their proof. Until the very recent work of Rubin and Kolyvagin there was not even a single elliptic curve for which III had been proved to be finite.

§23. Exercises 1. Let TIl, n be integers, min. Show that there is a group homomorphism >.. such that

~

_

Hl(r,6 m )

'\.

1.\ Hl(r,6n)

cOInlnutes. Hence show that there are p., v such that

0-

Hl(r,6n)

1.\ 0-

is exact and commutative. Describe p., v explicitly.

Hl(r,6 m )

-

-

0

-

0

24 The endomorphism ring

In this section, the ground field k is any field, possibly of characteristic 3. [This last restriction solely because of our choice of canonical form.] The main objective is the application to the estimation of the number of points over finite fields, but we do a little more, to set things in context. Let

p

-I 2,

C:

y2

= X 3 + AX + B

be an elliptic curve defined over k. An endomorphism of C (over k) is a rational map

¢: C-+C defined over k, for which

¢(o)

= o.

One endomorphism is the constant isomorphism which maps C entirely onto o. Otherwise, if x is a generic point of C, then so is ~

= ¢(x)

and k( x) / k( 0 is an algebraic extension. We define the degree of ¢ to be

d(¢) = [k(x) : kW]. By convention, the degree of the constant endomorphism is O. The first lemma shows that ¢ respects the group structure of C. It is not really needed for what follows, but it helps to set ideas. In the application to finite fields, the conclusion will be obvious.

24,' The endomorphi3m ring

113

Lemma 1. Let a, b be point3 of C. Then

rP(a + b) = rP(a)

+ rP(b).

Sketch proof. By extending the ground field if necessary, we may suppose that a, b are defined over k. If rP is the constant endomorphism, there is nothing to prove .. Otherwise, let x be a generic point ( = rP(x). By the definition of the group law, there is a

>.

=

>.(x)

E k(x)

whose only zeros are simple zeros at a, b and whose only poles are simple poles at 0, a + b. Let

>.. Then the zeros of A are just simple zeros at rP( a), rP(b) and the poles of A are just simple poles at rP( a + b) and at 0 = rP( 0). A = A(()

= Normk(el/k(xl

Note. cf. §14, Lemma 1. The proof above follows that in Silverman, Theorem 4.8 (p. 75), where it is proved for isogenies and the treatment is fuller. For the cOl'l'esponding result for abelian varieties of any dimension, see D. Mumford, Abelian Varietie3 (Oxford, 1970), p.43, Corollary 3 or H.P.F. Swinnerton-Dyer, Analytic theory of abelian varietie3 (Cambridge, 1974), Theorem 32 or S. Lang, Abelian varietie3 (New York and London, 1959), Chapter II, Theorem 4.

All we shall need is the Corollary. Let x, ( be a3 above and let

x=(x,y), Then

CE

(= (C7])·

k(x), and

[k(x) : k'(C)] = [k(x): k(()] Proof. For rP( -x)

= d(rP).

= -rP(x) = -(.

For any two endOinorphisms rP, 1/;, we defined the sum rP product rPV' by

(rP + 1/;)(x) = rP(x) (rP1/;)(x)

+ 1/; and the

+ 1/;(x),

= rP(1/;(x)),

where x is a generic point. It is readily verified that this gives the set of endomorphisms the stl'Ucture of a (not necessarily commutative) ring.

114

Lectures on Elliptic Curves

Lenuna 2.

d(¢lj;)

= d(¢)d(lj;).

Proof. Clear.

Lemlna 3.

d(¢

+ lj;) + d(¢ -lj;) = 2d(¢) + 2d(lj;).

Proof. Let x = (x, y) be a generic point, and put

¢(x)

= ~l'

= ~2' (¢ + lj;)(x) = ~3' (¢ -lj;)(x) = ~4' lj;(x)

so ~3 =~l +~2'

~4

= ~l

-

~2·

Then ~j E

k(x),

(j=1,2,3,4)

where ~j

= (~j, 7/j).

We argue as in the corresponding results for heights (§17, Lemma 4). The degree of an element of k( x) corresponds to the height of an element of Q. As k(x) has no archimidearI valuations trivial on k, the results are more precise. By the formula for sum arId difference, we have

1: 6

+ C4 : 6C4 = + A)(CI + 6) + 4B : C~C~ - 2ACl6 - 4B(~1 + 6) + A2.

(CI - 6)2 : 2(c16

A similar argument to that for heights 30 gives deg(6)

+ deg(C4) = 2 deg(cI) + 2 deg(6),

where "deg" is the degree as a rational function of x (= maximum of the degrees of numerator and denominator.) This result now follows from Lemma 1, Corollary.

30 d. also (*) of §17

24: The endomorphism ring

115

Corollary. There are r, .':I, t E Z, depending on ¢, 1/;, such that ~m¢+n1/;)=rm2+.':Imn+t~ for all m, 71 E Z. Further, r ~

t

0,

~

0,

Proof. The first part follows exactly as for heights. 3 ! For the second, d(.) ~ 0 by definition, so the quadratic form in m, n is positive semidefinitive or definite.

The rest of this section is not needed for the application to finite fields. By abuse of notation we denote the constant endomorphism by 0 and the identity endomorphism ¢(x) = x by 1. Lennna 4. Every endomorphism ¢ satisfies a quadratic equation

¢2 -.':I¢ + t

= 0,

whe7·e .':I, t E Z. Proof. By the preceding Lemma,

d(m + n¢) = m 2 + .':Imn + tn 2 for some .':I, t E Z and for all m, n E Z. Let IE Z. Then

cl(¢ + I)

= d(¢ -

s -I)

= 12 +.':11 + t.

Hence by Lemma 2

d((¢ + I)(¢ -.':I -I))

= (/2 +.':11 + t)2.

But

(¢ + I)(¢ -.':I -I)

= ¢2

- s¢ -1(.':1 + I).

Hence and by Lemma 3, Corollary, with ¢2 - .':I¢, 1 for ¢, 1/;, we have

d(¢2 -.':I¢ + n) for all

71

= (-n + t)2

E Z. In particular,

d(¢2_.':I¢+t)=0. But the only endomorphism of degree 0 is the constant endomorphism

O. 3! d. §1 7, Exercise 2.

Lectu.res on Elliptic Cu.rves

116

Note. As was shown by DeUI·ing, the endomorphism ring is isomorphic to one of: (i)

Z. (ii) a ring of integers in an imaginary quadratic field (iii) a ring of integers in a generalized quaternion skew field. The last case can occur only in characteristic p "I- OJ and the skew field is very special.

§24 Exercises l. Suppose that the ground field contains an element i with i 2 = -1 and that its characteristic is not 2. Let C be y2 = X 3 AX for some A "I- O. Show that

+

c:

Y

-+

iY,

X-+X

is an endomorphism. Construct the endomorphism 1 + c and check that (1 endomorphisms.

+ c)2 = 2c

as

2. Suppose that the characteristic of the ground field is not 2 or 3 and that it contains p with p3 = 1, p "I- 1. Let C be y2 = X3 + B for some B "I- O. Show that

>.:

X

-+

pX,

is an endomorphism. Construct the endomorphism>. - >. 2 and show that (>. - >.2)2 = -3 as endomorphisms. 3. Suppose that the characteristic of the ground field is not 2. For a detel·mine the b such that the isogenous curves

C: C1

:

y2

"I- 0

= X(X2 + aX + b)

y2 = X(X2 - 2aX

+ a2 -

4b)

are birationally equivalent over the algebraic closure. Show that they are equivalent over the ground field provided that -2 is a square in it. Denote the isogeny, considered as an endomorphism of C, by p.. Show that p.2 = -2 as endomorphisms. 4. Let ¢:C-+C be an endomorphism and suppose that ¢2 _ s¢

+t = 0

s, t E Z.

117

§24: ExerciJes For positive integer m show that

!/J =

IjJm satisfies

!/J2- Sm !/J+t m =O, where Sm, tm E I are defined as follows. Let T2 - sT + t = O. Then

G,

(3 E

Q be the roots of

5. (i) Let IjJ be an endomorphism and define 1jJ' by 1jJ' = IjJ

if

otherwise 1jJ' = s - 1jJ, where 1jJ2 - sljJ

IjJ E Ij

+ t = O.

Show that

= d(IjJ). be a generic point and let €!, ... '€I be the points of C defined 1jJ1jJ' = 1jJ'1jJ

(ii)

Let x over k( x) (k = ground field) such that 1jJ( €j) = x (with appropriate multiplicities if IjJ is inseparable). Show that

1jJ'(x)

= LXj

(addition on C). (iii)

If!/J

is another endomorphism, show that

and

(1jJ+!/J)'=IjJ+!/J'.

25 Points over finite fields

We denote by F 9 the field of q elements and denote its characteristic by p, so q is a power of p. Our objective is the Theorem 1. Let

c:

y2

= X 3 + AX + B

be an elliptic curve over a finite field F q. The number N of point" of C defined over F 9 satisfies

We shall give the main idea of a proof but will have to be impressionist on one of the ingredients. Because of our canonical form, we shall assume that p =f 2, 3. Note that N includes the point 0 "at infinity". At the end of the section we shall indicate the proof of a couple of other results. Let x = (x,y) be a generic point. We show that rfJ(x) = (x q ,y9) is also on the curve. Indeed, since we are in characteristic p I q,

(y9)2

= x 3 + Ax + B = (x 9)3 + A9 x 9 + Bq =

(x 9 )3

+ Ax 9 + B,

as A9 == A, B9 == B. This is the Frobenius endomorphism. Now let u = (u, v) be a point defined over the algebraic closure Then

Fp.

25: Points over finite fields

119

so u is defined over Fq precisely when it is a fixed point of IjJ or, what is the same thing, when

(ljJ-l)u=o, where 1 is the identity endomorphism and IjJ - 1 is defined in terms of the endomorphism ring. 3 In the notation of the previous section, clearly

d(ljJ)

=q

and so by §24, Lemma 3, Corollary

d(ljJ-l)=q-s+l where We have seen that a point defined over Fq is actually defined over F q precisely when it is the kernel of IjJ - 1. But the degree of an endomorphism is equal to the number of algebraic points in the kernel, each counted with its multiplicity. If therefore we can show that the points of the kernel of IjJ - 1 have multiplicity 1, we are done. It is here that we have to leave a lacuna. One argument, which can be made precise, is to observe that dx q /dx = qx q - 1 = 0 in characteristic p, and so the differential of the map IjJ - 1 is the same as that of the map -1, and hence never O.

Note. The result is due to Hasse by essentially the same proof. It is often referred to as the "Riemann hypothesis for function fields" (of genus 1) because of an analogy with Riemann's notorious unproved conjecture about the zeros of the usual ("Riemann") zeta function. It was generalized to curves of any genus by Wei I and to algebraic varieties by Deligne. The analysis of the action of the Frobenius map IjJ is still a central theme of modern arithmetic geometry. Theorem 2. Let V be a cur've of genus 1 defined over F q. Then it ha.'J a point defined over F q'

Proof. We developed the theory of the jacobian in characteristic 0, but it holds for general characteristics. Let C be the jacobian of V and let ~ be the group of points on C defined over F q. It is enough to show that

Hl(f, 0) is trivial, where

120

Lectures on Elliptic Curves

The group r is genel'ated 32 by the Frobenius automorphism "y (say): a -+ a q. We have to show that any cocycle {a..} is trivial. It is enough to show that

a.., = for some b E

~.

1'b - b

Now

1'b - b

= (rP -l)b

where rP is the "geometrical" Frobenius, so rP - 1 is not the constant endomorphism. For any C E ~ we can thus solve (rP - l)b = C for b, since we are working in the algebraic closed field. In particular, this holds for c = a..,. The co cycle identity gives inductively that a .. = ub - b

U

=

1',1' 2 ,1' 3 , ...

and we are done. Note. For a broad generalization, see S. Lang, Algebraic groups over finite fields. Amer. J. Math. 78 (1956), 535-563. The Theorem is due to F.K. Schmidt and the idea behind his proof is amusing. He used analytic means to estimate the number of points defined over the extension fields F qft. In particular, he showed that the number is > 0 for all large enough n. Let b l , ... , b n be n conjugate points defined over F qft and Cl, ... ,Cn+1 be similar conjugates defined over F qft+l. Then by Riemann-Roch there is a function whose poles are simple poles at the Ci and which has simple zeros at the b j . It has one further zero; which must be defined over F q.

Theorem 3. Let

>.: CI

-+

C2

be an isogeny of elliptic curves, everything defined over F q • Then Nl N 2 , where N j is the number of points on Cj defined over F q.

=

N ate. An isogeny is defined to be a rational map onto such that >.( od = 02. Lemma 1 of the preceding section extends to isogenies, whidl gives compatibility with the usage earlier in the course. Proof. Let rPj be the Frobenius on C j • Clearly the diagram

32 "topologica.lly", tha.t is the group genera.ted by .., is everywhere dense in the

ga.lois topology.

§25: Exercises

411

C1

--+

1~

121

C1

1~

41. C2 C2 --+ is commutative, and hence so is 1 41,C1 --+

C1

1~

1~

2 --+ C2 C2 41.It follows that the degrees

d( 1/>1 - 1) = d( 1/>2 - 1) are equal. But (proof of Theorem 1), this is just NI

= N2•

Example. The numbers of solutions of y2

==

==

x(x 2

x(x2

+ ax + b) (mod p)

and y2

_

2ax

+ a2 -

4b) mod p)

are equal, where a, b are integers and p is any prime with 2b(a 2

-

4b) ¢ 0 (mod p).

§25. Exercises 1. Let p be prime, p elliptic curve

==

2 (3). Show that the number of points on the

defined over F p is p + 1. [Hint. Given Y, solve for X]. 2. Let p be prime, p elliptic curve

==

3 (4). Show that the number of points on the

y2 defined over F p is p + 1. [Hint. Consider ±X together].

= X(X2 + A)

Lectures on Elliptic Curves

122

3. Let C be an elliptic curve defined over Fp and let N(n) be the number of points defined over F q, where q = pn. Show that there are a, (J E Q such that a{J

=p

and

N( n)

= pn + 1 _ an -

(In.

Hence show that all the N(n) are detennined by the value of N(l). Hence determine N(2) for

Y 2 =X 3 +X+1, with p

= 3.

[Hint. §24, Exercise 4]. 4. [Preparation for next exercises.] Let A :J Z be a commutative ring without divisors of 0 [an integral domain]. Suppose that every>. E A satisfies an equation >.2 + a>. + b = 0 (a, bE Z, depending on >.). Show that either A = Z or A = Z[a] for some single element a E A.

5. Let p == 1 (4) be prime and C: y2

=

X(X2

+ A)

an elliptic curve defined over F p. Let () E F p, ()2

Show that

X -+ -X 2 is an endomorphism of C, and that c + 1 = o. Let IjJ be the Frobenius. Show that IjJc = cljJ and deduce that

c:

Y

= -1.

()Y,

-+

IjJ

= u + Vc

for some u, v E Z with 1£2 + v = p. Show, further, that the number N of points on C defined over F p is 2

N

= p+ 1- 2u.

Evaluate N for some A andp and check that u (say) and satisfies u 2 + v 2 = p for some v E Z.

= t(p+1-N) E Z

6. Let p == 1 (3) and let C:

y2 = X 3

+B

be an elliptic curve defined over F p. Let () E F p, that >.:

y-+y,

is an endomorphism of C and that >.2

X

-+

()X

+ >. + 1 = o.

()3

= 1, () 10-1.

Show.

123

§25: Exercises Show that the Frobenius I/> satisfies 1/>).. previous Exercise.

= )..1/>.

Now continue as in the

7. Let

c:

y2

= X(X2

+4CX +2C 2)

be an elliptic curve defined over F p , where p is prime and -2 is quadratic residue. Show that the number N of points is of the shape N

where

1£

=p+ 1- 2u,

E Z and there is a v E Z such that u

[Hint. §24, Exercise 3.]

2

+ 2v 2 = p.

a.

26 Factorizing using elliptic curves

The problem of finding a factor of a given large integer has fascinated mathematicians through the ages. Recently the question has assumed practical, and indeed political, significance with the use of the products of lru·ge primes in cryptology. It is usually (but not always) easy to prove that a given composite integer n is composite, e.g. if there is an a > 1 with a n - 1 ¢ 1 mod n. But finding an actual nontrivial factor is a completely other matter! For the logician, of course, the problem of factorizing an integer n is constructive. All one has to do is to test all integers m < n 1 / 2 for divisibility. When, say, n has 100 decimal digits, this could take longer than the age of the universe. What are needed are practical methods. Recently H.W. Lenstra Jr. has shown that elliptic curves provide powerful methods for this problem. We will sketch one of his attacks. Lenstra's method is suggested by Pollard's "p - 1 method". Let n be a large integer with an unknown prime factor p. Let a be an integer and consider m

= gcd( a k -

1, n)

for some integer A~. If I.: I (p - 1) then pi m. Unless we are unlucky, not all the other primes q I n will divide mj and so m would be a nontrivial factor of n. One does not evaluate CLk, of course, but works modulo n. There is an algorithm which works in O(log k) steps (d. Exercises). Evaluating the gcd is cheap, using Euclid's algorithm. Pollard's method is particularly effective if n is divisible by a prime

26: Factorizing using elliptic curves

125

p for which all the prime factors of p - 1 are comparatively small. The

accepted recipe is to take k of the shape 33

k

= k(b) =

IIpe(q),

q9 where q runs through the primes and qe(q) is the longest power of q which is ::; b. Here b is chosen suitably, in a way which will be described later. The chances of success with this method of Pollard's appear to be best when the smallest prime factor p of n is substantially smaller than n 1 / 2 . But even, then, we may be out of luck if p - 1 has some largish prime factors. One can try to find a value of a whose exponent mod p is substantially smaller than p - 1, but that is not very promising. Lenstra observed that Pollard's method depends on the fact that the residue classes mod p have a group structure, and that elliptic curves provide other groups which can be used for the same purpose. Let

c:

y2 Z :::: X 3

+ AX Z2 + B Z3

be an elliptic curve and let (x,y,z) with x, y, z E Z be a point on it. Let

k(x, y, z) ::::

(Xk, Yk, Zk),

where k > 1 is an integer and Xk, Yk, zk E Z. Now let p be a prime, and suppose that C mod p (in an obvious sense) is an elliptic curve over Z mod p. The mod p points form a group whose order

N

= Np = Np(A,B)

satisfies

IN If N

I k,

the point (x k, Yk,

Z k)

(p + 1)

1< 2JP.

mod p is the "point at infinity", that is

pi Zk· Given A, B, x, y, z, values of (Xk, Yk, Zk) can be computed in O(log k) steps involving addition, multiplication subtraction. Since we are using homogeneous co-ordinates, there is no need to divide. The resulting values of Xk, Yk, Zk may have a common factor, but this does not disturb the conclusion that Np I k implies p I Zk. N ow let n be the large integer to be factorized and let k = k( b) for some suitable b, as before. Then we can evaluate Xk, Yk, Zk mod n in O(log ~~) steps of a.ddition, multiplication, subtraction modulo n. The 33 That. is, k is the ged of the integer. ~ b.

126

Lectures on Elliptic CurveJ

unknown prime divisor p of n will divide and then p divides m

Zk

mod n provided that Np

I k:

= gcd(n, Zk).

If Zk = 0 (mod n), we are out of luck. Otherwise m will be a nontrivial divisor of n: which is what we want. It can, of course, happen that m = 1, if Np 1 k for all pin. If this happens, we select other values of A, B, x, y, Z (and, possibly, k) and try, try, try again.34 The above account leaves a couple of questions unanswered. (i) How do we choose the initial curve C and the point (x, y, z)? Since all the calculations are mod n, it is enough to find A, B, x, y, Z E Z such that mod n. An obvious way is to put Z = 1, choose A, x, y at random and use the equation to determine B. Since we naturally suppose that we started off by checking that n has no small divisors, the chance that C is not an elliptic curve for any pin is negligible. In any case, there is no harm in running through the algorithm: at worst we will draw a blank. Alternatively, one can compute

1 = gcd(n,4A3

+ 27B 2 ).

If 1 = 1, we are OK. If 1 < 1 < n, we have a non-trivial factor of n, which is what we want. If I = n, which is highly unlikely, we abort the run _and choose fresh A, B, x, y, z. (ii) What is the optimal choice of b in k = k(b)? It turns out that this depends on the smallest prime divisor p of n: which is, of course, unknown. We argue heuristically. Let 1 < s < t, where t is an integer. We say that t is s-smooth if every prime divisor q of t is less than s. It is known that the number of integers t < T, for given T, which are T1/U-smooth is very roughly u-1/uT. Put

L = L(T) = exp(v'(logTloglogT)) and let 0 < O! < 00. On putting T 1 / U = La, we deduce that the number of t :s T which are La-smooth is roughly L -1/2aT. We shall paraphrase 34 For the distribution of Np over curves, See B.J. Birch: How the number of points of an elliptic curve over a fixed prime varies. J. London Math. Soc. 43 (1968), 57-60.

U: Factorizing using elliptic CUT1Jes

127

this to the statement that the probability P that a random integer t in the neighbourhood of T is La-smooth is P = L- l / 2 a. We shall choose the best value of O! later. Let p be the unknown smallest prime factor of n. Put L = L(p). We have seen that the order Np = Np(A, B) of the points mod p on C is approximately p. Assuming that Np behaves reasonably randomly as A, B vary, the probability P that Np is La-smooth is P = L- l / 2 a. Tal.::e

k

= k(b).

Then all the prime factors of Np divide k. The practitioners of the mystery of factorization assume that it is highly probable that indeed Np I ~~, which we suppose. The number of steps in one run of the algorithm is O(log k), which is very roughly b = La. To sun1. up. The amount of work in a run of the algorithm is about L"'. The probability of success in a single sun is about L-l/ 2 a. Hence the expected work to find a nontrivial factor is about

L a +I / 2a . This is minimized at O!

= 1/.../2,

wh:ich is therefore the optimal choice. The above estimates depend on the size of the unknown least prime factor p of n. The worst case scenario is when p is nearly n 1 / 2 • However, one expects the Lenstra algorithm to be most effective when the smallest prime factor is much smaller. Thus it works better on "naturally occurring" integers n than on the integers n used in some cryptosystems, which are the product of two nearly equal primes. If nothing is known a priori about the primes in n, a good strategy is to start with a. comparatively small b and to increase it gradually if necessary. We have chosen a version of the Lenstra algorithm which is easy to describe, rather than one which minimizes computation time. In practice, further devices and stratagems are brought into play. We do not go into this here, but conclude with a variant in the spirit of the course. In the variant, one considers the elliptic curve

C:

Cy2

= X 3 + AX + B

for some C '" 0, where we now take the inhomogeneous form. Recall that if (Xl,Yl) and (X2,Y2) are points on the curve and

(Xl, Yl)

= (Xl,Yl) + (X2,Y2),

(l·4,Y4) = (Xl,yd - (X2,Y2)

128

Lectures on Elliptic Curves

then :1:3, X4 are the roots of a quadratic equation whose coefficients are polynomial in Xl, X2, A, B (but not C). If now k is a positive integer and if, to change the notation, (x, y) is a rational point on C and (Xk,Yk) = k(x,y), then the classical algorithm for computing gk can be modified to give an algorithm to compute X k in O(log k) steps (d. Exercises) . Now write X = U/V and work homogeneously. If X = u/u, then Xk = Xk/Uk where Uk, Uk are obtained from u, U by O(log k) additions, subtractions and multiplications, but no divisions. Now, as before, let n be the number to be factorized and p an unknown prime divisor. Suppose that A, B, u, U E Z and work mod n. then, as before, if N p I k then p I Uk and we can expect that gcd( Uk, n) is a non-tri.vial divisor of n. In this version of the algorithm we may choose A, B, u, U entirely arbitrarily. Put x = u/u, y = 1. Then, unless we are strikingly unlucky, the point (x, y) lies on C for some C E Q* which need not be evaluated, as it is never needed. Elliptic curves me used also in primality testing and in other unexpected ways: for example, finding square roots modulo a large prime. See A.K. Lenstra and H.W. Lenstra Jr., Algorithms in number theory. Chapter 12 (pp.673-715) of: Handbook of theoretical computer Jcience, vol. A (ed. J. van Leeuwen), Elsevier, 1990.

§26. Exercises 1. [Motivation for next question.] Let

G be an abelian group and n a·

positive integer. For 9 E G show that the following algorithm computes gn in O(log n) operations. N = n, Y = 1 E G, Z = 9 (ii) IF N = 0, GOTO END (iii) M = [N/2]' E = N - 2M (iv) IF E = 1 THEN Y = 1'Z (v) N = M, Z = Z2 (vi) GOTO (ii) END [1' = gn].

(i)

2. Let C: 1'2.= X 3 + AX + B be an elliptic curve. For positive odd integer n and a = (a, b) on C, check that the following algorithm computes u, where na = (u,v), in O(logn) steps.

§~6:

Exercises

129

We recall that there is a rational function d( x) such that if x = (x, y) then 2x = (d(x),?) for some ? Further, there is a quadratic q(T) = q(T; Xl, X2) whose coefficients are rational in Xl, x2 and whose roots are X3, X4 ifx3 = Xl +X2, X 4 = Xl-X2(i) N = n, X = a, Y = a, Z = a (ii) IF N = 0, GOTO END (iii) M == [Nj2], E = N - 2M. (iv) Z = d(Z). (v) IF E = 1 GOTO (viii) (vi) [Check that Y is a root of q(T; X, Z).] Y IS THE OTHER ROOT

OF q(T;X,Z) (vii) GOTO (ix) (viii) [Check that X is a root of Q(T; Y, Z).] X IS THE OTHER ROOT

OF q(T; Y, Z). (ix) N = M (x) GOTO (ii). END [X = u, where n(a,b) = (tL,v).] 3. Suppose that ( a, b) lies on

C*: Ey 2

= X 3 + AX + B

for SOlne E I- O. Let n( a, b) = (ti, v) on C'. Show that u is given by the algorithm in (2). [i.e. the algorithm is independent of E.]

Formulary

Desbo'Ues' Form'ulae:15 . These are for

+ U2X~ + a3X: + dX X 2X a = o. nonsingulal' if 27cIIU2U3 + d I- O. The residual intersection t ulX:

I

3

This is the tangent at x is

of

(j taken mod 3) The third intersection z of the line joining x, y is

(j mod 3). Canonical curve.

y2 = X 3 Ifx

= (x,y),

+ AX + B.

then -x = (x,-y).

Addition formula. Let Xl

= (Xl, yd,

and

x=(x,y).

35 A. Desboves. Resolll tion en nombres entiers et sous sa. forme Ia. plus genlhale, de I'equa.tion cubique, homogene a. trois inconnues. Nouv. Ann. d. la Math., ser. III, vol. 5 (1886), 545-579.

131

Formulary

If X2 = -Xl, we have X = o. If X2 = Xl, we apply the duplication formula, given below. Otherwise, we may suppose that

x20F The line joining

Xl, X2

Xl·

is

Y=IX+m, where m= X2

Xl -

This line cuts the curve in -(Xl

Xl, X2

and

+ X2) = -X = (X, -y).

The roots of

Xl are

Xl, X2

+ AX + B -

(IX

+ m)2

and x. Hence

and so

Further,

y

= -Ix -m;

and so

where

WI

= 3XlX~

1¥2

=

+ x~ + A(XI + 3X2) + 4B

symmetric.

Du.plication formula. Here we consider

(X2,Y2) If y

= 0 we have X2 = o.

= X2 = 2x = 2(x,y).

Hence we may suppose

We need the tangent

Y =IX+m at x. Since formal differentiation on the curve gives

ydY

X2

2 dX = 3

+ A,

we have

1 = (3x2

+ A)/2y.

132

Lectures on Elliptic Cu.rveJ

Hence (as for addition formula)

X2 == 12 - 2x

+ A)2 _

_ (3x2 -

4y2

8xy2 . '

I.e.

X4 -2Ax2 -8Bx +A2 4(x 3 + Ax + B) To find Y2 we need the value m==

_x3

+ Ax + 2B 2y

which is determined by Y == Ix

+ m.

Now

Y2 == -lx2 - m; which gives

(2y)3 Y2 == x 8

+ 5Ax 4 + 20Bx 3 - 5A 2x 2 - 4ABx - A a - 8B2.

Formulae in X only. Let Xl

==(XI,Yt),

with

Let

+ X2 == (Xa,Ya)

X3

==

XI

X4

==

XI -

X2 ::::

(X4,Y4).

Then

+ X4) :::: 2(XIX2 + A)(xI + X2) + 4B, X2)2 X3X4 == X~X~ - 2AxIX2 - 4B(xI + X2) + A2.

(XI - X2)2(;J:3

(Xl This follows from the expression for x in the addition formula. The value of X3 is x as given and that of X4 is obtained from it merely by changing the sign of YI Y2. Hence the formula for Xa + X4 is immediate. That for XaX4 comes by substituting for YfY~ in the product and cancelling (Xl - X2)2. [Alternatively, d. §17, Exercise 3.]

133

Formulary Multiplication 38 . Let (Xm, Ym) = m(X, Y) where m E Z. Then

X

_ X!/J!. - !/Jm-I!/Jm+l !/J~

" M -

,

y. !/J2m m = 2!/J~'

where !/Jo

= 0,

!/JI

= 1,

·,p2

= 2Y,

= 3X 4 + 6AX 2 + 12BX - A 2, 1P4 = 4Y(X 6 + 5AX' + 20BX 3 - 5A 2X 2 !/J2n+1 = !/J~ !/In+2 -!/J~+t"lj;n-I' Y!/J2n = !/In{!/J~-1!/Jn+2 -!/J~+I!/Jn-d· !/J3

4ABX - 8B 2 _ A 3 ),

This is an exercise on the fact that a function is defined up to multiplica.tive constant by its zero and poles. We determine the constants by looking at the behaviour at 0 using the local uniformiser

t

= X/Y.

!/Jm is defined by (i) (ii)

it has a simple zero at all a Iit behaves like mC m·+ 1 at o.

0

with ma

= O.

(a defined over Q).

More precisely

(I)

if m is odd, there are t(m 2 - 1) pairs (aj, ±b j ) of m-division pairs and

(II)

If m is even, the three 2-division points are m-division points, and there are t(m 2 -4) pairs (aj,±bj), bj I- O. Then !/Jm

= myII(X -

aj).

Now for all m, even or odd, we have

38

d. H. Weber, Algebra III, §58; but we have adjusted the sign of .pm so tha.t the leading term is always positive.

134 at

0,

Lecturea on Elliptic Curvea

and

has no poles except at o. Further, Xm - X vanishes at a only if (m + l)a = Hence

0

or (m -l)a = o.

where the constant is right since both sides behave like (m 2 - 1)/m 2 t 2 at o. This gives the formula for X m . That for Ym follows immediately from the specification of the poles and zeros. It remains to give the recurrence relation. For integers /, m we have Xl = X", precisely when either (l +m)(X, Y) = 0 or (1- m)(X, Y) = o. Hence

Xl - Xm

= !/Jm+l!/Jm-d!/J~!/J!';

the constant being determined by the behaviour at o. But

Xl - Xm = (X - Xm) - (X - Xl) Hence by (*)

!/Jr!/Jm+l!/Jm-l -!/J!.!/Jl+l!/J/-l

= !/Jm+l!/Jm-l. Put 1== n, m == n Put 1== n - 1,

+ 1, so !/Jm-l = 1 and

!/J2n+l = !/J~ !/In+2 -!/J~+l!/Jn-l m = n + 1 so !/Jm-l = !/J2 = Y. Then Y V'2n = !/In {!/J~-1!/Jn+2 -!/J~+l!/Jn-d·

Further Reading

Cassels, J.W.S. Diophantine equations with special reference to elliptic curves, J. London Math. Soc. 41 (1966),193-291. Husemoller, D. Koblitz, N. 1984.

Elliptic curve3, Springer, 1987.

Introduction to elliptic curve3 and modular form3, Springer,

Lang, S. Fundamental3 of diophantine geometry, Springer, 1983. [The first edition is less complete but more coherent: Diophantine geometry, Interscience, 1962.] Serre, J.-P. Lecture3 on the Mordell- Weil theorem, Vieweg, 1989. [Notes of a course given in 1980-81] Silverman, J.H.

The arithmetic of elliptic curve3, Springer, 1986.

Tate, J. The arithmetic of elliptic curves, Invent. Math. 23 (1974), 179-206.

INDEX

birationally equivalent 4 Birch 71, 110, 126(fn) Blichfeldt 19 Bremner 55(fn) canonical form 32 et seq canonical height 83 Chatelet 108 chord and tangent processes 24 coboundary 90 cobounding 90 cocycle 90, 98 cocycle identity 90, 98 cocycle (continuous) 101 cohomology (Galois) 89 et seq cohomology group 98 et seq complete, completion 8 continuous (action), (cocycle) 101 convex (pointset) 18 cubic curves 23 et seq defined over 3 degenerate (laws) 39 et seq Deligne 121 Desboves 25(fn), 26, 130 Deuring 116 Diophantine geometry Diophantos 1, 24 discriminant 11 elliptic curve 32 endomorphism 112 et seq everywhere locally 14 exceptional (point) 24 Fermat 1, 55, 63 filtration (p-adic) 48 finite basis theorem 54 et seq finite basis theorem (weak) 55 forgetful functor 75 form 13 Frobenius endomorphism 118 Fueter 52(fn) function field 58 fundamental sequence 7 Galois cohomology 89 et seq, 101 et seq general position 29

generic point 58 genus 30 genus 0 4 et seq genus 1 30, 32 globally 14 group law 27 et seq HI 99 Hasse 119 Hasse principle: see local-global principle height 55, 78 et seq height (canonical) 83 height (logarithmic) 82 Hensel 43 'Hilbert 90' 95,97 homogeneous spaces: see princicpal homogeneous space Hypatia 1

integer (p-adic) 9 invertible 67 irreducible (curve); see also reducible isogeny 58

24

jacobian (of curve of genus 1) 92 et seq, 95, 107 j-invariant 93 kernel of reduction Kolyvagin 111

47

Lang 120 Lenstra 124, 128 level (of point in p-adic case) 47 lift 43 Lind 85 locally 14 local-global principle 2, 13 et seq, 85 et seq localization 14, 103 logarithmic height 82 Mazur 51 Minkowski 19 Mordell 19 Mordell Theorem, Mordell- Weil Theorem; see finite basis theorem

Index

multiplicity

23, 44

Nagell 34(fn) , 52(fn) neutral element (of group) Newton 24, 43 nonsense 98 et seq non-archimedean 7 non-singular 24 norm (map) 66

valuation 6 valuation (p-adic) 7 van der Corput 19 27

patch 67 pole 30 Pollard 124 principal homogeneous spaces 104 et seq p-adic filtration 48 p-adic integers 9 p-adic numbers 6 p-adic units 9 p-adic valuation 7 rational curve (= curve of genus 0) 3 rational (point etc.) 3 reducible (curve): see also irreducible 43(fn) reduction mod p 42 et seq Reichardt 85 resultant 75 et seq "Riemann hypothesis for function fields" 2, 119 Riemann-Roch theorem 30 Rubin 111 Schmidt 120 Selmer 87, 110 Shafarevich 85 singular (point) 23 Swinnerton-Dyer 71, 110 symmetric (pointset) 18 Tamagawa number 110 Tate 85, 109(fn) Tate-Shafarevich group 85, 109 et seq

torsion 102 triangle inequality

7

ultrametric inequality unit (p-adic) 9

7

weak finite basis theorem 55, 66 et seq Well 1, 54, 108, 119 Weil-Cha.telet group 108

137

Lectures on Elliptic Curves (London Mathematical Society Student Texts)