Elliptic Curves and their Torsion

Elliptic Curves and Their Torsion C ONTENTS 1 Introduction 1.1 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 2 Elliptic Curves and Maps Between Them 2.1 The Group Operation . . . . . . . . . 2.2 Weierstrass Equations . . . . . . . . . 2.3 Maps Between Elliptic Curves . . . . 2.4 Dual Isogenies . . . . . . . . . . . . . . . . 2 2 3 8 9 3 Local Theory 3.1 Reduction Modulo mv . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Elliptic Curve Formal Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Torsion Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 12 13 15 4 Applications to Global Theory 16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I NTRODUCTION Elliptic curves are bountiful geometric objects that are simultaneously of great arithmetic interest. Definition 1.1. An elliptic curve is a pair (E/K, O), where E/K is a smooth curve of genus one and O is a point in E(K). The distinguished point O is usually implicit, so we often denote elliptic curves simply with E/K. Now let K be a number field, and let C/K be a smooth curve of genus g with nonempty C(K). It is a basic result that C(K) is infinite when g = 0, while a deep theorem of Faltings proclaims C(K) is finite in the g ≥ 2 case [Fal83]. When g = 1, elliptic curves come into view and expose their rich behavior. Elliptic curves can be equipped with a group structure given by morphisms, making them a first example of abelian varieties. It is here, at this group structure, where arithmetic and geometry interact and produce many beautiful theorems. Consider the following result of Weil generalizing an earlier theorem of Mordell: Theorem 1.2 (Mordell–Weil [Mor22, Wei29]). Let K be a number field, and let E/K be an elliptic curve. Then E(K) is a finitely-generated abelian group. This yields a decomposition E(K) ∼ = E(K)tors × Zr . Depending on whether r is positive, we see E(K) could be either finite or infinite—an intermediary between the g = 0 and g ≥ 2 cases. We now turn to the torsion factor E(K)tors , which will remain the focus for the rest of this report. 1 Mathematicians have developed much general theory for analyzing the torsion part of E(K). Here, one can powerfully restrict the possibilities for E(K)tors in terms of n = [K : Q], the degree of our number field. More precisely, we can uniformly bound E(K)tors using n as follows: Theorem 1.3 (Merel [Mer96]). Let n ≥ 1 be an integer. There exists a constant C(n) such that, for all number fields K with degree [K : Q] at most n and all elliptic curves E/K, we get #Etors (K) ≤ C(n). This celebrated theorem of Merel is the culmination of a landmark result of Mazur classifying all possibilities for Etors (K) for K = Q [Maz77]. Note that this is the n = 1 case of Merel’s theorem. In addition to Merel’s results, the torsion theorem of Mazur also inspired similar classifications of Etors (K) for all number fields with degree n ≤ 14 [Kam92, KM95, Abr95]. But how does one actually calculate Etors (K)? That is, given an elliptic curve E/K over a number field, what are some methods of discerning the torsion subgroup of E(K)? This is the question we shall tackle in our report. The contents of this report are based on a reading course of [Sil09], though we aim to take a different perspective on the theory. Throughout this report, we assume familiarity with algebraic geometry and algebraic number theory at the level of a first c ourse. Background equivalent to [Kem93], [Cas67], and [Frö67] is more than enough. 1 ELLIPTIC CURVES AND MAPS BETWEEN THEM To begin our study, we set up some preliminary facts concerning the category of elliptic curves. Since we intend to do number theory, we lose nothing by letting our base field K be perfect. We shall maintain this assumption throughout this report. 2.1 The Group Operation In §1, we advertised that elliptic curves can be given a natural group structure. Our first construction of this group operation is very intrinsic and relies on the Picard group. Here, the following lemma is invaluable. Lemma 2.1. Let E/K be a smooth curve of genus one, and let P and Q be points in E. Then the divisors (P ) and (Q) are linearly equivalent if and only if P = Q. For this lemma, we shall need a corollary of the Riemann–Roch theorem, and we reproduce it below. Theorem 2.2 (Riemann–Roch). Let C/K be a smooth curve of genus g, and let D be a divisor of C satisfying deg D > 2g − 2. Then `(D) = deg D − g + 1. Proof. See Corollary II.5.5.(c) in [Sil09]. Proof of Lemma 2.1. One direction is immediate, so start by writing div f = (P ) − (Q) for some f in K(E). Now f lies in L((Q)), and since E is smooth of genus one, the Riemann–Roch theorem yields`((Q)) = 1. Because L((Q)) includes K, we see in fact L((Q)) = K. So f is a constant, which implies div f = 0 and consequently P = Q. Note that this already differs from the genus zero case, where smooth curves are isomorphic to P1 and thus have distinct points with linearly equivalent divisors. Next, recall the definition of Pic0(E). 2 E LLIPTIC C URVES AND T HEIR T ORSION Definition 2.3. Let C/K be a curve. Its divisors of degree zero form a subgroup, which we denote by Div0 (C). This subgroup contains the principal divisors, and we denote the image of Div0 (C) under the quotient map Div(C) −→ Pic(C) by Pic0 (C). Returning to the task at hand, let (E/K, O) be an elliptic curve. Using Lemma 2.1, we now construct a bijection between E and Pic0 (E) with the intent of inducing a group structure on E from that of Pic0 (E). Proposition 2.4. Let [D] be an element of Pic0 (E), where D ∈ Div0 (E) is a representative of [D]. There σ exists a unique point P in E satisfying [D] = [(P ) − (O)], and the map Pic0 (E) −→ E sending [D] to its corresponding point P is a bijection. Proof. As E is smooth of genus one, we see `(D + (O)) = 1 by Riemann–Roch. Therefore we may choose a nonzero f in L(D + (O)). This f satisfies div f ≥ −D − (O), and the right hand side has deg(−D − (O)) = −1. Yet deg div f = 0, so we must have div f = −D − (O) + (P ) for some point P of E. This relation shows D and (P ) − (O) are linearly equivalent. We want to show this P is independent of our choice for D, but first let’s take a step back. Let D0 be any divisor in Div0 (E). Let P 0 be a point of E satisfying [D0 ] = [(P 0 ) − (O)], at least one of which is guaranteed to exist by the above paragraph. Subtracting this from [D] = [(P ) − (O)] yields [D − D0 ] = [(P ) − (P 0 )]. Now if [D] = [D0 ], this indicates [(P )] = [(P 0 )] and hence P = P 0 by Lemma 2.1. Therefore the point P corresponding to [D] is unique, so the map σ is well-defined. The injectivity of σ also follows from this equation, for σ[D] = P and σ[D0 ] = P 0 . When σ[D] = σ[D0 ], we see [D − D0 ] = 0. Finally, for all points P in E, clearly σ[(P ) − (O)] = P , which makes σ surjective as well. σ Definition 2.5. Let (E/K, O) be an elliptic curve, and let Pic0 (E) −→ E be the bijection constructed in Proposition 2.4. The (algebraic) group operation of (E/K, O) is the group structure induced on E by σ, that is, the group whose identity element is given by σ(0) and whose binary operation and inverse are E×E σ −1 × σ −1 / Pic0 (E) × Pic0 (E) ⊗ / Pic0 (E) σ /E, σ −1 −1 σ E −→ Pic0 (E) −→ Pic0 (E) −→ E where ⊗ and −1 are the usual addition and negation in Pic0 (E), respectively. We denote the group operations
by E × E −→ E and E −→ E. Remark 2.6. We shall give a geometric definition for the group operation in the next subsection. The group axioms for E follow from those for Pic0 (E). In particular, we see E is abelian and notice that σ(0) = σ[(O) − (O)] = O. Thus for any elliptic curve the identity is precisely the distinguished point: specifying this point is akin to specifying the identity of a group. This choice does not affect the elliptic curve structure much, however—see Example 2.27. 2.2 Weierstrass Equations Observe that Definition 1.1 captures the essential abstract qualities of elliptic curves—the fact that E/K is smooth of genus one is crucial in our applications of the Riemann–Roch theorem, and the distinguished point O plays a central role in the group operation as the designed identity element. Similarly, Definition 2.5’s characterization of the group structure helps verify various algebraic properties. However, these definitions offer little, if any geometric intuition about elliptic curves and their group structures. The abstract nature of these definitions also render explicit calculations difficult. In this section, we intend to remedy both these issues. The titular Weierstrass equations make elliptic curves more concrete. 3 Definition 2.7. A Weierstrass equation is the curve E/K in P2 given by the projective closure of y 2 + a1 xy + a3 y = x3 + a2 x2 + a4 x + a6 where the coefficients ai lie in K. Using the coordinates x = X/Z and y = Y /Z, one can easily check the only point at infinity on E is O = [0, 1, 0]. Note the similarities in notation between the above definition and Definition 1.1. We shall connect them more explicitly soon, but we first offer a few simplifying changes of variables and important quantities associated with any Weierstrass equation. Proposition 2.8. Let E : y 2 + a1 xy + a3 y = x3 + a2 x2 + a4 x + a6 be a Weierstrass equation over K. If char K 6= 2, the quantities b2 = a21 + 4a2 , b4 = 2a4 + a1 a3 , b6 = a23 + 4a6 and change of variables y 7→ 21 (y − a1 x − a3 ) yield the Weierstrass equation y 2 = 4x3 + b2 x2 + 2b4 x + b6 . Proof. This is a simple polynomial calculation. Proposition 2.9. Suppose char K 6= 2, 3, and let E : y 2 = 4x3 + b2 x2 + 2b4 x + b6 be the Weierstrass equation obtained in Proposition 2.8 after a change of variables. Setting   x − 3b2 y 2 3 , c4 = b2 − 24b4 , c6 = −b2 + 35b2 b4 − 216b6 , and substituting (x, y) 7→ 36 108 gives the Weierstrass equation y 2 = x3 − 27c4 x − 54c6 . Proof. This too is a straightforward exercise in polynomial manipulation. Remark 2.10. Proposition 2.9 shows that, when K is a number field or some associated completion, we need only consider Weierstrass equations in the form y 2 = x3 + Ax + B. But, in the spirit of number theory we are also naturally led to consider objects over finite fields, so the most general form of Definition 2.7 remains relevant. As one might expect, proofs using the simplified Weierstrass equations of Propositions of 2.8 and 2.9 are much simpler than the general case—and we stress that Weierstrass equations over arbitrary characteristic are important. At this point, notice the quantities defined in Propositions 2.8 and 2.9 are well-defined for any Weierstrass equation E/K regardless of char K. Definition 2.11. Define three more values b8 = a21 a6 + 4a2 a6 − a1 a3 a4 + a2 a23 − a24 ∆ = −b22 b8 − 8b34 − 27b26 + 9b2 b4 b6 and j = c34 if ∆ 6= 0 ∆ The quantity ∆ is the discriminant of E, and the quantity j is the j-invariant of E. Remark 2.12. Recall the Weierstrass equation y 2 = f (x) provided by Proposition 2.8. Letting ∆2 be the discriminant of f (x), a straightforward calculation reveals ∆2 = 16∆. We shall further justify our nomenclature for ∆ and j with the following proposition. Proposition 2.13. (a) A Weierstrass equation is smooth if and only if ∆ 6= 0. (b) Let E/K and E 0 /K be two smooth Weierstrass equations. Then E and E 0 are isomorphic over K if and only they share the same j-invariant. 4 E LLIPTIC C URVES AND T HEIR T ORSION (c) For any j0 in K, there exists a Weierstrass equation E/K(j0 ) with j-invariant equal to j0 . Proof. See Proposition III.1.4 in [Sil09]. This proposition results from myriad casework and polynomial calculations. The char K 6= 2, 3 cases are much easier than that of general characteristic; here the principle outlined in Remark 2.10 already comes into play. Remark 2.14. For non-smooth Weierstrass equations, one can obtain finer information about their singularities. This data is dictated by the value of c4 —see Propositions III.1.4.(a) and III.2.5 in [Sil09]. Thus the j-invariant offers a complete parameterization of the geometry of Weierstrass equations, that is, their isomorphism classes over the algebraic closure K. However, two Weierstrass equations with the same j-invariant j0 ∈ K are not necessarily isomorphic over K(j0 )! Example 2.15. Consider the Weierstrass equations given in Examples 4.3 and 4.4. Both easily have jinvariant j = 0, yet they have differing torsion subgroups Etors (Q) and hence nonisomorphic subgroups of rational points E(Q). Thus they are not isomorphic over Q(0) = Q. Earlier, we asserted that Weierstrass equations provide a more concrete approach to elliptic curves. We now make good on our promise and explicitly relate the two. Theorem 2.16. Let (E/K, O) be an elliptic curve. φ (a) There exist x and y in K(E) such that the map E −→ P2 defined by φ = [x, y, 1] is an isomorphism from E to a Weierstrass equation with coefficients in K and φ maps O to [0, 1, 0]. (b) Let E1 /K and E2 /K be two Weierstrass equations for E satisfying the properties enumerated in (a). Then E1 and E2 are isomorphic by a change of variables in the form X2 = u2 X1 + r Y2 = u3 Y1 + su2 X1 + t for some u in K × and r, s, t in K. (c) Conversely, by choosing a distinguished point O, every smooth Weierstrass equation E/K is an elliptic curve (E/K, O). Proof. See Proposition III.3.1 in [Sil09]. Notice the smoothness and genus of E are crucial for applying the Riemann–Roch theorem and subsequently obtaining a Weierstrass equation relation. Definition 2.17. Let (E/K, O) be an elliptic curve. Any pair of functions x and y in K(E) satisfying the properties listed in Theorem 2.16.(a) are called Weierstrass coordinate functions. In light of Theorem 2.16, every elliptic curve admits Weierstrass coordinate functions. Therefore we may view elliptic curves and smooth Weierstrass equations as the same objects—with the distinguished point O = [0, 1, 0] at infinity being understood—and we shall readily make this identification throughout this report. Part (b) of Theorem 2.16 answers the important question of how flexible one can be when choosing Weierstrass coordinates for an elliptic curve. For a fixed elliptic curve, we naturally wonder how our menagerie of associated quantities changes as we vary these Weierstrass coordinates. Proposition 2.18. Let E/K be an elliptic curve, and consider the change of variables x = u2 x0 + r y = u3 y 0 + su2 x0 + t 5 for some u in K × and r, s, t in K. The associated quantities for these primed coordinates are a01 = u−1 (a1 + 2s) c04 = u−4 c4 a02 = u−2 (a2 − sa1 + 3r − s2 ) c06 = u−6 c6 a03 = u−3 (a3 + ra1 + 2t) ∆0 = u−12 ∆ a04 = u−4 (a4 − sa3 + 2ra2 − (t + rs)a1 + 3r2 − 2st) j0 = j a06 = u−6 (a6 + ra4 + r2 a2 + r3 − ta3 − t2 − rta1 ) b02 = u−2 (b2 + 12r) b04 = u−4 (b4 + rb2 + 6r2 ) b06 = u−6 (b6 + 2rb4 + r2 b2 + 4r3 ) b08 = u−8 (b8 + 3rb6 + 3r2 b4 + r3 b2 + 3r4 ) Proof. This follows by a routine polynomial calculation. Note the j-invariant remains unchanged, as expected. Proposition 2.21 is invaluable whenever one tries to extract intrinsic information about elliptic curves from their corresponding Weierstrass equations, which we shall do in §3. Now that we have Weierstrass equations under our belt, let us use them to present an equivalent, geometric definition of the group operation. This alternative construction is heavily dependent on secant lines. Definition 2.19. Let C/K be a smooth curve, and let P and Q be points on C. The secant line on C defined by P and Q is the smooth curve L in P2 given as follows. If P 6= Q, let L be the unique line going through P and Q—otherwise, let L be the line tangent to C at P = Q. Theorem 2.16 shows elliptic curves are plane curves, which allows us to use Bezout’s theorem. Definition 2.20. Let E/K be an elliptic curve. Let P and Q be points on E, and let L be the secant line on E defined by P and Q. Since Weierstrass equations are given by cubics, Bezout’s theorem shows E ∩ L = {P, Q, R} as a multiset. Next, let L0 be the secant line on E defined by O and R. Applying Bezout again indicates E ∩ L0 = {O, R, S} as a multiset. Finally, let L00 be the secant line on E defined by O and P . As usual E ∩ L00 = {O, P, T } by Bezout’s theorem. ⊕ The (geometric) group operation is given by the binary operation E × E −→ E mapping (P, Q) 7→ S and the inverse map E −→ E that sends P 7→ T . For an illustration, see Figure 1. First, we verify this yields the same group structure given in Definition 2.5.
Proposition 2.21. Let E/K be an elliptic curve. The algebraic group operation E×E −→ E and geometric ⊕ group operation E × E −→ E are the same map, as are E −→ E and E −→ E. Proof. In the situation of Definition 2.20, let f (X, Y, Z) and f 0 (X, Y, Z) be the homogeneous linear equations defining L and L0 , respectively. Then f /Z and f 0 /Z lie in K(E). From the definitions of L and L0 , we see {P, Q, R} are precisely the zeros of f on E and {O, R, S} are precisely the zeroes of f 0 on E. The function Z defines the line at infinity, which only intersects E at O and thus does so with multiplicity 3 by Bezout. This information lets us calculate div(f /Z) = (P ) + (Q) + (R) − 3(O), div(f 0 /Z) = (R) + (S) − 2(O) =⇒ div(f 0 /f ) = (S) − (P ) − (Q) + (O) =⇒ 0 = [(S) − (O)] − [(P ) − (O)] − [(Q) − (O)] = σ −1 (P ⊕ Q) − σ −1 (P ) − σ −1 (Q) =⇒ P ⊕ Q = σ(σ −1 (P ) + σ −1 (Q)) = P
Q 6 E LLIPTIC C URVES AND T HEIR T ORSION P Q T E L'' L O L' R S Figure 1: The geometric group operation on an elliptic curve E/K. Here S = P ⊕ Q and T = P. as desired. Letting f 00 (X, Y, Z) be the homogeneous linear equation defining L00 indicates its zeroes on E are exactly {O, P, T }, and the similar calculation div(f 00 /Z) = (P ) + (T ) − 2(O) =⇒ 0 = [(P ) − (O)] + [(T ) − (O)] =⇒ σ −1 ( P ) = [(T ) − (O)] = −[(P ) − (O)] = −σ −1 (P ) =⇒ P = σ(−σ −1 (P )) = P shows the inverse maps are also the same. Proposition 2.21 enables us to interchangeably use the algebraic and geometric definitions for the group + − operation, which we will simply denote by E × E −→ E and E −→ E. The geometric description of addition in E allows explicit calculations with polynomial equations—see Group Law Algorithm III.2.3 in [Sil09]. As a corollary, we see elliptic curves are abelian varieties. + Corollary 2.22. Let E/K be an elliptic curve. Then the addition and negation maps E × E −→ E and − E −→ E are morphisms defined over K. Proof. See Theorem II.3.6 in [Sil09]. While Silverman uses translation maps to offer a cleaner proof, this is merely another application of these explicit group operation formulas; see Remark II.3.6.1 in [Sil09]. This in turn shows the rational points of an elliptic curve form a subgroup. Corollary 2.23. Let E/K be an elliptic curve. Then E(K) is a subgroup of E. + Proof. The identity O is in E(K), and E(K) is closed under addition since E × E −→ E is a morphism defined over K. 7 2.3 Maps Between Elliptic Curves We have seen that elliptic curves are abelian varieties, that is, projective varieties and abelian groups in a compatible way. As is standard category-theoretical practice, next we turn to morphisms of elliptic curves. To reflect that elliptic curves are both varieties and abelian groups, their hom-sets should be the intersection of variety and abelian group hom-sets. We also expect morphisms of elliptic curves to have abelian group and ring structures similar to those of abelian group homomorphisms. To obtain all this structure, it is enough to require that morphisms preserve the identity. Definition 2 .24. Let (E1 /K, O 1 ) and (E2 /K, O 2 ) be elliptic c urves. An isogeny from E 1 to E 2 is a morφ phism E1 −→ E2 that sends φ(O1 ) = O2 . If φ is constant, it must be valued on O2 . We call this the zero isogeny and denote it by φ = [0]. If φ is not the zero isogeny, it is a non-constant morphism of smooth curves, which makes it finite and surjective. Therefore we may consider the degree deg φ. For the zero isogeny, we set deg[0] = 0. Before we get too carried away, let us verify that isogenies automatically preserve addition. φ Proposition 2.25. Let E1 −→ E2 be an isogeny. Then φ is a group homomorphism. Proof. Of course [0] is the trivial homomorphism, so suppose φ is non-constant. Here φ induces a homoφ∗ morphism Pic0 (E1 ) −→ Pic0 (E2 ), and since φ sends O1 to O2 it forms the commutative diagram below. Pic0 (E1 ) φ∗ σ1 / E1 φ  Pic0 (E2 ) σ2  / E2 But the group structure on Ei is induced from that of Pic0 (Ei ) via σi . Therefore φ is also a group homomorphism. Thus we see isogenies are precisely the morphisms of elliptic curves we want. Example 2.26. Let E/K be a smooth curve of genus one, and let O and O0 be two points in E(K). We τO 0 can define a morphism of varieties E/K −→ E/K by sending P 7→ P + O0 , where + is taken in the τO 0 elliptic curve (E/K, O). Corollary 2.22 indicates this is an isogeny (E/K, O) −→ (E/K, O0 ). Letting − be negation in the elliptic curve (E/K, O), note that τ−O0 provides an inverse for τO0 . Therefore the elliptic curves (E/K, O) and (E/K, O0 ) are canonically isomorphic over K, so the choice of distinguished point does not truly affect our elliptic curve. φq Example 2.27. Let E/Fq be an elliptic curve, and let E −→ E be the Frobenius endomorphism defined by sending (x, y) 7→ (xq , y q ). The Frobenius endomorphism is well-defined since taking q-th powers fixes Fq and therefore preserves the equation defining E. In fact, Galois theory tells us E(Fq ) is precisely the set fixed by φq . Since φq fixes O, it is an isogeny. Definition 2.28. Let E1 /K and E2 /K be elliptic curves. We write Hom(E1 , E2 ) for the set of isogenies φ E1 −→ E2 . From here, we form the special hom-sets End(E1 ) and Aut(E1 ) as usual. Corollary 2.22 indicates Hom(E1 , E2 ) is closed under pointwise addition, making it an abelian group. Using composition of isogenies as multiplication turns End(E1 ) into a ring. Elliptic curve hom-sets lack torsion, a fact that shall play a key role in the classification of elliptic curve endomorphism rings. 8 E LLIPTIC C URVES AND T HEIR T ORSION Theorem 2.29. Let E1 /K and E2 /K be elliptic curves. (a) The abelian group Hom(E1 , E2 ) is torsion-free. (b) The ring End(E1 ) has no zerodivisors. In particular, it has characteristic 0. Proof. See Proposition III.4.2 in [Sil09]. Note that, after applying explicit group law calculations, the multiplicativity of deg plays a crucial role in reducing to the fact that Z is an integral domain. Let E/K be an elliptic curve. Extending our nomenclature for the zero isogeny, for any integer m we denote the image of m under the unique ring homomorphism Z −→ End(E) by [m]. Theorem 2.29 shows this homomorphism is injective, so for nonzero m the morphism [m] is a finite map. This makes the m-torsion subgroup of E finite, since E[m] = ker[m] = [m]−1 (O). Here we make our first step towards analyzing the torsion subgroup of elliptic curves. 2.4 Dual Isogenies φ Let E1 −→ E2 be a nonzero isogeny. While proving Proposition 2.25, we noticed that, under the identifiφ∗ σ i cation Pic0 (Ei ) −→ Ei , our isogeny φ corresponds to the homomorphism Pic0 (E1 ) −→ Pic0 (E2 ). But φ φ∗ induces a homomorphism on Picard groups in the other direction as well, namely Pic0 (E2 ) −→ Pic0 (E1 ). It turns out this φ∗ also corresponds to an important isogeny. φ b φ Proposition 2.30. Let E1 −→ E2 be a nonzero isogeny. Then the map E2 −→ E1 defined by σ −1 φ∗ σ 2 1 E2 −→ Pic0 (E2 ) −→ Pic0 (E1 ) −→ E1 is an isogeny. Setting φb = [0] when φ is the zero isogeny, in any case φb is the unique isogeny that satisfies φb ◦ φ = [deg φ]. Proof. See Theorem III.6.1 in [Sil09]. φ b φ Definition 2.31. Let E1 −→ E2 be an isogeny. The dual isogeny to φ is the isogeny E2 −→ E1 constructed in Proposition 2.30. The dual isogeny satisfies many nice algebraic properties, from which one can deduce much information about elliptic curves. We begin by providing some of these properties—we promise to give applications immediately afterwards. φ ψ λ Proposition 2.32. Let E1 −→ E2 , E1 −→ E2 , and E2 −→ E3 be isogenies. b (a) We get deg φb = deg φ and φb = φ. c = [m] and deg[m] = m2 . (b) For all integers m, we obtain [m] b and φ b \ (c) We have λ[ ◦ φ = φb ◦ λ + ψ = φb + ψ. b presents the most difficulty. Proof. See Theorem III.6.2 in [Sil09]. Note that proving λ[ ◦ φ = φb ◦ λ Let E/K be an elliptic curve. With these properties in hand, we provide a characterization of the possibilities for End(E). This relies on the following abstract lemma. 9 Lemma 2.33. Let R be a ring. If R satisfies the following properties (a) R has characteristic zero and has no zerodivisors. (b) R is a free Z-module of rank at most four. b· (c) R has an anti-involution R −→ R that fixes Z. (d) For all a in R, the product ab a is a non-negative integer for which ab a = 0 if and only if a = 0. then R is isomorphic to one of the following rings: (i) The integers Z. (ii) An order in an imaginary quadratic number field. (iii) An order in a quaternion algebra over Q. Proof. See Theorem III.9.3 in [Sil09]. To apply Lemma 2.33, we need only borrow fact (b) from elsewhere. Lemma 2.34. Let E/K be an elliptic curve. Then End(E) is a free Z-module of rank at most four. Proof. See Corollary III.7.5 in [Sil09]. The Tate module is central to the proof and in fact to much of the theory of elliptic curves, but we shall not cover it here. For reference, see III.7 in [Sil09]. Corollary 2.35. Let E/K be an elliptic curve. Then End(E) is either Z, an order in an imaginary quadratic number field, or an order in a quaternion algebra over Q. Proof. Refer to the hypotheses of Lemma 2.33. Theorem 2.29 shows End(E) satisfies (a), Lemma 2.34 indicates End(E) satisfies (b), Proposition 2.32 shows the dual isogeny provides the anti-involution needed for (c), and Proposition 2.32 shows ab a = deg a here, which clearly satisfies (d). The corollary follows from Lemma 2.33. Next we shall prove the Hasse bound, which restricts the number of rational points on elliptic curves over finite fields. This will be useful later when we reduce questions about elliptic curves over local fields to ones about elliptic curves over finite fields. Using the connections between duals and degree established in Proposition 2.32, we start by showing the deg function provides a positive-definite quadratic form on hom-sets. deg Corollary 2.36. Let E1 /K and E2 /K be elliptic curves. Then Hom(E1 , E2 ) −→ Z is a positive-definite quadratic form. Proof. Once we show the degree map is indeed a quadratic form, it follows immediately from the definition φ of deg and our convention deg[0] = 0 that deg is positive-definite. For any isogeny E1 −→ E2 , we easily ψ have deg(−φ) = deg [−1] ◦ φ = deg[−1] deg φ = deg φ. Finally, let E1 −→ E2 be another isogeny. we use the embedding Z −→ End(E1 ) given by Theorem 2.29 and the properties in Proposition 2.32 to see b \ [deg(φ + ψ) − deg φ − deg ψ] = (φ + ψ) ◦ (φ + ψ) − φ ◦ φb − ψ ◦ ψb = φ ◦ ψb + ψ ◦ φ. Now this is Z-bilinear in φ and ψ, so deg is indeed a quadratic form. We intend to apply this positive-definite quadratic form using the following general inequality. 10 E LLIPTIC C URVES AND T HEIR T ORSION d Lemma 2.37. Let A be an abelian group, and let A −→ pZ be a positive-definite quadratic form. Then for all a and b in A, we have d(a − b) − d(a) − d(b) ≤ 2 d(a)d(b). Proof. See Lemma V.1.2 in [Sil09]. Before we can proceed with the Hasse bound, we need a lemma regarding the separability of the Frobenius endomorphism. φq Lemma 2.38. Let E/Fq be an elliptic curve, and let E −→ E be the Frobenius endomorphism. Then the morphism [1] − φq is separable. Proof. See Corollary III.5.5 in [Sil09]. This depends on the invariant differential, which reduces questions about elliptic curve addition to vector space addition—for more on the invariant differential, see III.5 in [Sil09]. √ Theorem 2.39 (Hasse). Let E/Fq be an elliptic curve. Then #E(Fq ) − q − 1 ≤ 2 q. φq Proof. Let E −→ E be the Frobenius endomorphism. We remarked in Example 2.27 that E(Fq ) consists precisely of the fixed points of φq , which in turn are simply the elements of ker([1] − φq ). This kernel is the fiber ([1] − φq )−1 (O). Now E is infinite, and almost all fibers have cardinality degs ([1] − φq ). Since [1] − φq is a homomorphism, all fibers in fact have the same cardinality. Thus #E(Fq ) = # ker([1] − φq ) = degs ([1] − φq ), and Lemma 2.38 indicates this is deg([1] − φq ). As we know deg[1] = 1 and deg φq = q, applying Lemma 2.37 with a = [1] and b = φq finishes the proof. Let m be a positive integer. We can also use Proposition 2.32 to gleam much information about the specific m-torsion of elliptic curves. First, we give a lemma concerning the separability of [m]. Lemma 2.40. Let E/K be an elliptic curve. If char K - m, then [m] is separable. Proof. See Corollary III.5.4 in [Sil09]. As in Lemma 2.37, this relies on the invariant differential. Proposition 2.41. Let E/K be an elliptic curve, and let m be a positive integer. If char K - m, then E[m] is isomorphic to Z/mZ × Z/mZ as abstract groups. Proof. Lemma 2.40 indicates degs [m] = deg[m], and as in the proof of Hasse’s bound we obtain # ker[m] = degs [m]. Now Proposition 2.32 provides deg[m] = m2 , and ker[m] is precisely E[m]. Therefore #E[m] = m2 . We know E[m] is a finite abelian group, and by induction the structure theorem for finite abelian groups shows E[m] must be isomorphic to Z/mZ × Z/mZ. Remark 2.42. When char K is positive and divides m, the nature of E[m] depends on whether the dual of the p-th power Frobenius endomorphism is separable. In fact, this property has a variety of equivalent characterizations—see V.3 in [Sil09]. Since E(K)[m] is a subgroup of E[m], Proposition 2.41 significantly bounds the torsion of E(K). L OCAL T HEORY Let K be a number field, and let E/K be an elliptic curve. Our goal is to analyze Etors (K), and, motivated by the fruitful algebraic number theoretic interaction between global and local fields, we now turn to analyzing elliptic curves over the latter. Throughout this section, let v be a normalized non-Archimedean valuation of K, let |·|v be the corresponding absolute value, let Kv be the associated completion, let Ov be the ring of integers of Kv , let π be a uniformizer of Ov , let mv = πOv be the maximal ideal of Ov , and let kv = Ov /mv be the residue field. 11 Reduction Modulo mv 3.1 e /kv via the usual quotient Let E/Kv be an elliptic curve. We would like to reduce this to an elliptic curve E map Ov −→ kv , yet E/Kv has points with coordinates in Kv , not necessarily Ov . We describe how to reduce these points modulo mv below. Definition 3 .1. Let P be in P n (Kv ), and let P = [x0 , . . . , x n ] be homogeneous coordinates for P lying in Kv . We may scale [x0 , . . . , xn ] by powers of π such that every xi lies in Ov and at least one xi lies in O× —namely, multiply [x0 , . . . , xn ] by the −min{x0 , . . . , xn }-th power of π. Then [x e0 , . . . , x en ] lies in v Pn (kv ), where x ei is the reduction of xi modulo mv . q The reduction modulo mv map Pn (Kv ) −→ Pn (kv ) is given by sending P to [e x0 , . . . , x en ]. To see this is well-defined, let [x00 , . . . , x0n ] be another such representative of P , and let [e x00 , . . . , x e0n ] be the corresponding reduced point. Since there exists some λ in Kv satisfying x0i = λxi for all i, we see x e0i = µ ex ei , where µ e is − ord λ × v the reduction of λπ ∈ Ov modulo mv . Let y 2 + a1 xy + a3 y = x3 + a2 x2 + a4 x + a6 be a Weierstrass equation for E/Kv . The image of q E(Kv ) under the reduction modulo mv map P2 (Kv ) −→ P2 (kv ) obviously satisfies the reduced equation y2 + e a1 xy + e a3 y = x3 + e a2 x2 + e a4 x + e a6 . If the Weierstrass equation defined by this equation is smooth, it indeed provides an elliptic curve E 0 /kv . However, there could be many Weierstrass equations for E/Kv , so one must discern which ones reflect the essential properties of E/Kv after reducing modulo mv . Definition 3.2. Let E/Kv be an elliptic curve, and let y 2 + a1 xy + a3 y = x3 + a2 x2 + a4 x + a6 be a Weierstrass equation for E. If all the ai lie in Ov and v(∆) is minimal while upholding this condition, we say this is a minimal equation for E. We begin by checking this definition is not vacuous. Proposition 3.3. Let E/Kv be an elliptic curve. Then E has a minimal equation. Proof. Let y 2 + a1 xy + a3 y = x3 + a2 x2 + a4 x + a6 be a Weierstrass equation for E/Kv . Proposition 2.21 indicates the substitution (x, y) 7→ (u−2 x, u−3 y) yields another Weierstrass equation for E/Kv with ai replaced by ui ai , so taking u = π N for sufficiently high N yields a Weierstrass equation with coefficients in Ov . Now note that since ∆ is a polynomial in the ai , so ∆ is in Ov if the ai are. Thus v(∆) is non-negative, and we may apply well-ordering to show minimal equations exist. Minimal equations are precisely the Weierstrass equations that preserve nice properties when reduced modulo mv . Before elaborating, we clarify which of the changes of variables outlined in Proposition 2.16 preserve minimality. Proposition 3.4. Let E/Kv be an elliptic curve. (a) A minimal equation is unique up to change of coordinates in the form x = u2 x0 + r y = u3 y 0 + su2 x0 + t for some u in Ov× and r, s, t in Ov . (b) As a converse, any substitution used to obtain a minimal equation from a Weierstrass equation with coefficients in R is in above form, except the restriction on u is relaxed to u ∈ Ov . Proof. This is a routine calculation using Proposition 2.21 and basic properties of valuations—see Proposition VII.1.3 in [Sil09]. Returning to our original plan, we use minimal equations to define elliptic curves reduced modulo mv . 12 E LLIPTIC C URVES AND T HEIR T ORSION Definition 3.5. Let E/Kv be an elliptic curve. We denote the Weierstrass equation obtained from reducing e v. a minimal equation for E modulo mv by E/k e v is not necessarily smooth, so it may not define an elliptic curve over kv . We will Remark 3.6. This E/k e restrict to the E/kv smooth case, but as in Remark 2.14 the singular case also entails a rich theory. For reference, see Chapter VII in [Sil09]. In a manner reminiscent of the short exact sequence 0 −→ mv −→ Ov −→ kv −→ 0, we obtain a similar short exact sequence of elliptic curves. e v ) is smooth. Theorem 3.7. Let E/Kv be an elliptic curve such that E(k q e v ). (a) Then the reduction modulo mv map induces a surjective group homomorphism E(Kv ) −→ E(k e v . We denote it by (b) The kernel ker q is independent of the minimal equation chosen for defining E/k E1 (Kv ). Altogether we obtain a short exact sequence e v ) −→ 0. 0 −→ E1 (Kv ) −→ E(Kv ) −→ E(k Proof. See Proposition VII.2.1 in [Sil09]. Remark 3.8. The suggestive notation E1 (Kv ) indeed generalizes to En (Kv ) for arbitrary non-negative integers n—see Exercise VII.7.4 in [Sil09]. 3.2 Elliptic Curve Formal Groups e v ). The latter is finite In the previous subsection, we reduced the study of E(Kv ) to that of E1 (Kv ) and E(k since kv is a finite field, so now we turn to E1 (Kv ). Since Kv is a non-Archimedean local field, it is amenable to analytic arguments. Here, they manifest as formal power series expansions of group operations. Let us take a brief abstract excursion into formal groups. Definition 3.9. Let A be a commutative ring. A formal group over A is a power series F (X, Y ) in two variables with coefficients in A satisfying (a) F (X, 0) = X and F (0, Y ) = Y . (b) There exists a unique power series i(T ) in one variable with coefficients in A satisfying F (T, i(T )) = 0. (c) F (X, F (Y, Z)) = F (F (X, Y ), Z). (d) F (X, Y ) = F (Y, X). (e) F (X, Y ) = X + Y mod (X 2 , XY, Y 2 ). We denote formal groups by F/A. F Remark 3.10. Pretending that F (X, Y ) gives a binary operation A×A −→ A, note that (a)–(d) in Definition 3.9 precisely state that F provides a commutative group structure, while (e) says that to first order F simply corresponds to the usual ring addition. 13 Example 3.11. Let E/Kv be an elliptic curve. We aim to construct a formal group over Kv corresponding to elliptic curve addition. Since power series expansions happen best around the origin and the identity element, we first make a change of variables that sends O to (0, 0). More specifically, we set z = −x/y and w = −1/y, transforming the defining Weierstrass equation to w = z 3 + a1 zw + a2 z 2 w + a3 w2 + a4 zw2 + a6 w3 . Notice this is a polynomial expression for w in terms of w and z. By inductively substituting the right hand side, we obtain a formal power series of w in z. Thus we may use z to parametrize our formal group. By using explicit polynomial formulas for the elliptic curve group operation, we can construct two formal power series F (z1 , z2 ) and i(z) that correspond to the elliptic curve group operations. For detailed calculations of this procedure, see IV.1 in [Sil09]. Let A be a commutative ring. The collection of formal groups over A forms a category once we define appropriate morphisms. Definition 3 .12. Let F /A and G/A be formal g roups. A homomorphism from F to G over R is a power series f (T ) in one variable with coefficients in R such that f(F (X, Y )) = G(f (X), f (Y )). Remark 3.13. From here, one defines endomorphisms and isomorphisms of formal groups as u sual. Once again pretending that F and G provide commutative group structures, if we additionally pretend that f (T ) f creates a map A −→ A, then Definition 3.12 indicates f induces a group homomorphism between the groups provided by F and G. Example 3.14. Let F/A be a formal group, and let m be an integer. We can inductively define a power series fm (T ) by setting f0 (T ) = 0 fm+1 (T ) = F (fm (T ), T ) fm−1 (T ) = F (fm (T ), i(T )). These fm are formal group endomorphisms of F/A. They are analogous to multiplication by m endomorphisms of abelian groups. In fact, if m is a unit in A, then fm is a formal group isomorphism—see Proposition IV.2.3 in [Sil09]. This reflects the following fact: let End A be the endomorphism ring of the additive group of A, and let Aut A be the corresponding automorphism group. Then if A −→ End A sends a to the multiplication by a map, the units A× are mapped to Aut A. In Remarks 3.10 and 3.13, we commented that formal groups and their morphisms could ostensibly form groups if only they formed actual maps between sets. The metric properties of Kv allow us to do just that—here we can evaluate the power series described in Examples 3.11 and 3.14 on mv . Definition 3.15. Let E/Kv be an elliptic curve, and let F/Kv be its corresponding formal group law as b v ), is the group given described in Example 3.11. Then the group associated to F/Kv , denoted by E(m b as follows. The underlying set of E(mv ) is mv , the binary operation mv × mv −→ mv maps (z1 , z2 ) to F (z1 , z2 ), and the inverse map mv −→ mv takes z to i(z). We now relate this to our original discussion of E1 (Kv ). b v ) be the group Proposition 3.16. Let E/Kv be an elliptic curve given by a minimal equation, and let E(m b described in Definition 3.15. Then E1 (Kv ) and E(mv ) are isomorphic via the map   z 1 b E(mv ) −→ E1 (Kv ) that sends z 7→ ,− . w(z) w(z) Proof. See Proposition VII.2.2 in [Sil09]. Therefore we may use formal group methods to study E1 (Kv ) and by extension E(Kv ). 14 E LLIPTIC C URVES AND T HEIR T ORSION 3.3 Torsion Points b v ). First, we start with a lemma concerning the torsion of E(m b v ) be the group given in Definition 3.15. Let Lemma 3.17. Let E/Kv be an elliptic curve, and let E(m b v ) has order a power of p. p = char kv . Then every torsion element in E(m Proof. As an immediate reduction, we may multiply torsion elements by powers of p to show it is enough to prove there are no nontrivial torsion elements with order relatively prime to p. Let m be a positive integer prime to p. Then m is not in mv , so it is a unit in Ov . Now multiplication by m is precisely the group endomorphism induced by fm from Example 3.14, and because fm was a formal group isomorphism, b v )[m] = 0. multiplication by m is an actual group isomorphism. Thus it has trivial kernel, making E(m We immediately use Lemma 3.17 along with our short exact sequence from Theorem 3.7 to obtain the following result. Theorem 3.18. Let E/Kv be an elliptic curve, let m be a positive integer not divisible by p = char kv , and q e v is smooth. Then the reduction map E(Kv )[m] −→ e v )[m] on m-torsion is injective. suppose E/k E(k Proof. Since Proposition 3.16 and Lemma 3.17 indicate E1 (Kv ) has no nontrivial m-torsion, the m-torsion of E(Kv ) trivially intersects E1 (Kv ). From here, the short exact sequence provided in Theorem 3.7 indie v ). cates the m-torsion of E(Kv ) embeds into E(k Theorem 3.18 serves as a power tool to calculate Etors (K). The canonical embedding K −→ Kv allows one to embed E(K) −→ E(Kv ), and this injection preserves m-torsion points. Then by choosing various e v ), one obtains an upper bound for Etors (K) valuations v and explicitly calculating the reduced curves E(k using these injections. Next, we seek a way to provide lower bounds for Etors (Kv ), which will similarly provide lower bounds for Etors (K). The following result for general number fields achieves this by narrowing the possibilities for b v ). pn -torsion of E(m b v ) be the group given in Definition 3.15. Let Lemma 3.19. Let E/Kv be an elliptic curve, and let E(m b v ), then v(z) ≤ v(p)/(pn − pn−1 ). p = char kv . If z is a nontrivial torsion element of order pn in E(m Proof. See Theorem IV.6.1 in [Sil09]. Proposition 3.20. Let E/Kv be an elliptic curve with Weierstrass coordinates given by a minimal equation for E, and let P be a nontrivial torsion point in E(K) of order m. (a) If m is not a power of p = char kv , then the coordinates of P lie in Ov .   v(p) (b) Let r = n . If m = pn for some n ≥ 1, then v(x(P )) ≥ −2r and v(y(P )) ≥ −3r. p − pn−1 Proof. Let y 2 +a1 xy +a3 y = x3 +a2 x2 +a4 x+a6 be the Weierstrass coordinates defining E/Kv , which is minimal by hypothesis. If either x(P ) or y(P ) lies in Ov , then the other must as well since Ov is integrally closed. Therefore we may consider the case where both coordinates of P have negative valuation. Taking v of both sides of the Weierstrass coordinates yields min{2v(y(P )), v(a1 ) + v(x(P )) + v(y(P ))} = min{2v(y(P )), v(a1 ) + v(x(P )) + v(y(P )), v(a3 ) + v(y(P ))} ≤ min{3v(x(P )), v(a2 ) + 2v(x(P )), v(a4 ) + v(x(P )), v(x(P ))} = 3v(x(P )) 15 where strict inequality can only occur if 2v(y(P )) = v(a1 )+v(x(P ))+v(y(P )). If this indeed occurred, we would have v(a1 ) + v(x(P )) + v(y(P )) < 3v(x(P )) and v(y(P )) = v(a1 ) + v(x(P )). Because v(a1 ) ≥ 0, we see v(y(P )) ≥ v(x(P )). But we also have v(y(P )) − v(x(P )) < v(x(P )) − v(a1 ) < 0, a contradiction. Finally, if 2v(y(P )) > v(a1 ) + v(x(P )) + v(y(P )), then we see v(y(P )) > v(a1 ) + v(x(P )) ≥ v(x(P )). But then our equality becomes v(y(P )) ≤ v(a1 ) + v(y(P )) = 2v(x(P )) < v(x(P )), a contradiction, so the only possibility is that the above equality takes the form 2v(y(P )) = 3v(x(P )). b (mv ) We may write this integer as −6s for some positive integer s. The inverse E1 (Kv ) −→ E of the map described in Proposition 3.16 sends P 7→ −x(P )/y(P ), which lands in mv because s = v(−x(P )/y(P )). Lemma 3.17 and the isomorphism given by Proposition 3.16 indicate P must have order a power of p, finishing the proof of ( a). Lastly, Lemma 3.19 indicates s ≤ v (p)/(pn − p n−1 ), concluding the proof of (b). A PPLICATIONS TO G LOBAL T HEORY Let E/Q be an elliptic curve. We can deduce from Proposition 3.20 the following theorem of Lutz and Nagell, which gives a finite set of possibilities for the elements of Etors (Q). Theorem 4.1 (Lutz–Nagell). Let E/Q be an elliptic curve given by an equation of the form y 2 = x3 +Ax+ B, where A and B are integers. If P is a nontrivial torsion point, then its coordinates are both integral. Furthermore, either y(P ) = 0 or y(P )2 divides 4A3 + 27B 2 . Proof. See Corollary VIII.7.2 in [Sil09]. Proposition 3.20 provides most of the work, and the divisibility statement y(P )2 | 4A3 + 27B 2 is done via the polynomial calculations using Group Law Algorithm III.2.3 in [Sil09]. Recall from §1 that Mazur’s torsion theorem provides a finite set of groups to which E tors (Q) may be isomorphic. Theorem 4.2 (Mazur [Maz77]). Let E/Q be an elliptic curve. Then Etors (Q) is isomorphic to one of the following: (i) Z/nZ for 1 ≤ n ≤ 10 or n = 12 (ii) Z/2Z × Z/2nZ for 1 ≤ n ≤ 4. We shall utilize results from §3 to show that each of the above 15 groups are indeed achieved as Etors (Q) for some appropriate E/Q. We outline our strategy for calculations as follows. Given Weierstrass coordinate functions for E/Q, we calculate the discriminant ∆. For any prime number p, consider the corresponding elliptic curve E/Qp obtained by viewing the Weierstrass coordinates for E/Q as given over Qp . This E/Qp still has discriminant ∆, so of course these Weierstrass coordinates are minimal if v(∆) = 0, that is, p does e p given by Definition 3.5, which not divide ∆. For such p, we may reduce modulo p to the elliptic curve E/F we can calculate in finite time, and apply Theorem 3.18 to bound Etors (Q) above. To obtain a lower bound, we make use of the transformations given by Propositions 2.8 and 2.9 to transform E/Q to a Weierstrass equation E 0 /Q of the form given in Theorem 4.1 if need be. From here, the geometric definition of the group structure shows that nontrivial 2-torsion points P are precisely those with y(P ) = 0, and we systematically check for torsion elements using the possibilities given by Theorem 4.1. Example 4.3. Consider the Weierstrass equation E/Q given by y 2 = x3 − 2. It has ∆ = −26 33 . We e 5 = 6, which implies there is only nontrivial 2-, 3-, and 5-torsion, and #E/F e 7 = 7, calculate #E/F which implies there is only nontrivial 7-torsion. Altogether E(Q) has no nontrivial torsion, which makes Etors (Q) ∼ = Z/1Z. 16 E LLIPTIC C URVES AND T HEIR T ORSION e 5= Example 4.4. Let E/Q be given by y 2 = x3 +8, which has discriminant ∆ = −210 33 . The value #E/F e 13 = 16 implies there is only 6 implies there is only nontrivial 2-, 3-, 5-, and 6-torsion, while #E/F e 5 = 6 implies nontrivial 2-, 4-, 8-, 13-, and 16-torsion. Altogether there can only be 2-torsion, and #E/F the 2-torsion is at most Z/2Z. We indeed have the 2-torsion point (−2, 0) in E(Q), so Etors (Q) ∼ = Z/2Z. Example 4.5. Consider the Weierstrass equation E/Q given by y 2 = x3 + 4. It has ∆ = −28 33 . We e 5 = 6, which implies there is only nontrivial 2-, 3-, 5-, and 6-torsion, and #E/F e 7 = 3, calculate #E/F which implies there is only nontrivial 3- and 7-torsion. Altogether E(Q) only has nontrivial 3-torsion, e 7 = 3 implies it is at most Z/3Z. We indeed find a nontrivial torsion point (0, 2), so we have and #E/F Etors (Q) ∼ = Z/3Z. e 3=4 Example 4.6. Let E/Q be given by y 2 = x3 +4x, which has discriminant ∆ = −212 . The value #E/F e 5 = 8 implies there is only nontrivial 2-, implies there is only nontrivial 2-, 3-, and 4-torsion, while #E/F 4-, 5-, and 8-torsion. Altogether there can only be 2- and 4-torsion. We can find all the nontrivial torsion by inspection—they are {(2, 4), (2, −4), (0, 0)}, and only (0, 0) is 2-torsion. Therefore the only possibility for this group is Etors (Q) ∼ = Z/4Z. Example 4.7. Consider the Weierstrass equation E/Q given by y 2 − y = x3 − x. It has ∆ = −11. e 2 = 5, which implies there is only nontrivial 2- and 5-torsion, and #E/F e 3 = 5, We calculate #E/F which implies there is only nontrivial 3- and 5-torsion. Altogether E(Q) only has nontrivial 5-torsion, e 7 = 5 implies it is at most Z/5Z. Changing coordinates to the isomorphic over Q Weierstrass and #E/F equation E 0 /Q, we get 4A3 + 27B 2 = 28 312 11. Testing points, we indeed find a nontrivial torsion point (−12, 108), so we have Etors (Q) ∼ = Z/5Z. e 5=6 Example 4.8. Let E/Q be given by y 2 = x3 +1, which has discriminant ∆ = −24 33 . The value #E/F e 7 = 12 implies there is only nontrivial 2implies there is only nontrivial 2-, 3-, 5-, and 6-torsion, while #E/F , 3-, 4-, 6-, 7-, and 12-torsion. Altogether there can only be 2-, 3-, and 6-torsion. We indeed have a 2-torsion e 5 = 6 then implies point (0, −1), and we also have another nontrivial torsion point (−1, 0). The count #E/F the 2-torsion is at most Z/2Z, so (−1, 0) must be either 3- or 6-torsion. This forces Etors (Q) ∼ = Z/6Z. Example 4.9. Consider the Weierstrass equation E/Q given by y 2 = x3 − 43 + 166. It has ∆ = −219 13. e 3 = 7, which implies there is only nontrivial 3-, and 7-torsion, and #E/F e 5 = 7, We calculate #E/F which implies there is only nontrivial 5- and 7-torsion. Altogether E(Q) only has nontrivial 7-torsion, and e 3 = 7 implies it is at most Z/7Z. Testing points, we indeed find a nontrivial torsion point (3, 8), so #E/F we have Etors (Q) ∼ = Z/7Z. Example 4.10. Let E/Q be given by y 2 + 7xy = x3 + 16x, which has discriminant ∆ = 28 34 17. e 5 = 8 implies there is only nontrivial 2-, 4-, 5-, and 8-torsion, while #E/F e 7 = 8 The value #E/F implies there is only nontrivial 2-, 4-, 7-, and 8-torsion. Altogether there can only be 2-, 4-, and 8e 5 = 8 indicates the 4-torsion is at most Z/4Z. We find the torsion points torsion. Furthermore, #E/F {(0, 0), (−2, 4), (−2, 10), (8, 16)} by inspection, so #Etors (Q) ≥ 5 and hence Etors (Q) ∼ = Z/8Z. Example 4.11. Consider the Weierstrass equation E/Q given by y 2 + xy + y = x3 − x2 − 14x + 29. It e 5 = 9, which implies there is only nontrivial 3-, 5-, and 9-torsion, has ∆ = −29 35 . We calculate #E/F e 7 = 9, which implies there is only nontrivial 3-, 7-, and 9-torsion. Altogether E(Q) only and #E/F has nontrivial 3- and 9-torsion. Switching to the Weierstrass equation E 0 /Q, which has 4A3 + 27B 2 = 217 317 , we find the nontrivial torsion points {(27, 864), (−117, 1296), (99, 648)}. Thus #Etors (Q) ≥ 4, and Mazur’s torsion theorem informs us Etors (Q)  Z/3Z × Z/3Z. So we see Etors (Q) ∼ = Z/9Z is the only possibility. Example 4.12. Let E/Q be given by y 2 + xy = x3 − 45x + 81, which has discriminant ∆ = 210 35 11. e 7 = 10 implies there is only nontrivial 2-, 5-, 7-, and 10-torsion, while #E/F e 13 = 10 The value #E/F implies there is only nontrivial 2-, 5-, 10-, 13-torsion. Altogether there can only be 2-, 5- and 10-torsion. 17 e /F7 = 10 indicates the 2-torsion is at most Z/2Z and the 5-torsion is at most Z/5Z. Furthermore, #E Turning to the Weierstrass equation E 0 /Q with 4A3 + 27B 2 = −218 317 11, we find t he 2 -torsion point (75, 0). We also obtain a nontrivial non 5-torsion point (219, 1296). Therefore Etors (Q) ∼ Z/10Z. = Example 4.13. Consider the Weierstrass equation E/Q given by y 2 + 43xy − 210y = x3 − 210x2 . It has e /F11 = 12, which implies there is only nontrivial 2-, 3-, 4-, 6-, 11-, and ∆ = 212 36 53 74 13. We calculate #E e 12-torsion, and #E /F13 = 12, which implies there is only nontrivial 2-, 3-, 4-, 6-, 12-, and 13-torsion. Altogether E(Q) only has nontrivial 2-, 3-, 4-, 6-, and 12-torsion. Switching to the Weierstrass equation E 0 /Q, which has 4A3 +27B 2 = −220 318 53 74 13, we find the only nontrivial 2-torsion point is (3531, 0). Checking for more torsion yields {(10587, 952560), (4107, 77760), (1515, 163296), (3027, 22680), (−4533, 508032)}. Thus #Etors (Q) ≥ 7. So Mazur’s torsion theorem informs us Etors (Q) ∼ Z/12Z is the only possibility. = e /F3 = 4 Example 4.14. Let E/Q be given by y 2 = x3 −4x, which has discriminant ∆ = 212 . The value #E e implies there is only nontrivial 2-, 3-, and 4-torsion, while #E /F5 = 4 implies there is only nontrivial 2-, 3-, e /F3 = 4 indicates the torsion 4-, 5-torsion. Altogether there can only be 2- and 4-torsion. Furthermore, #E subgroup has order at most 4. We immediately find the nontrivial 2-torsion points {(0, 0), (2, 0), (−2, 0)}, which makes Etors (Q) ∼ Z/2Z × Z/2Z. = Example 4.15. Consider the Weierstrass equation E/Q given by y 2 = x3 + 2x2 − 3x. It has ∆ = 28 32 . e /F5 = 8, which implies there is only nontrivial 2-, 4-, 5-, 8-torsion, and #E e /F7 = 8, We calculate #E which implies there is only nontrivial 2-, 4-, 7-, 8-torsion. Altogether E(Q) only has nontrivial 2-, 4-, e /F7 = 8 indicates #Etors (Q) ≤ 8. We find the nontrivial 2-torsion points and 8-torsion. The count #E {(0, 0), (1, 0), (−3, 0)}, and we also find another torsion point (−1, 2 ). Thus # Etors (Q) ≥ 5, so we must have Etors (Q) ∼ Z/2Z × Z/4Z. = Example 4.16. Let E/Q be given by y 2 + 5xy − 6y = x3 − 3x2 , which has discriminant ∆ = 22 36 52 . The e /F7 = 12 implies there is only nontrivial 2-, 3-, 4-, 6-, 7-, and 12-torsion, while #E e /F11 = 12 value #E implies there is only nontrivial 2-, 3-, 4-, 6-, 11-, and 12-torsion. Altogether there can only be 2-, 3-, 4-, 6-, e /F7 = 12 indicates the torsion subgroup has order at most 12. We turn to and 12-torsion. Furthermore, #E the Weierstrass equation E 0 /Q, which has 4A3 + 27B 2 = −210 318 52 . We immediately find the nontrivial 2-torsion points {(−177, 0), (66, 0), (111, 0)}, and we also find a 3-torsion point (−69, 1 620). Therefore the torsion subgroup must be Etors (Q) Z/2Z × Z/6Z. ∼ = Example 4.17. Consider the Weierstrass equation E/Q given by y 2 +17xy −120y = x3 −60x2 . It has ∆ = e /F11 = 16, which implies there is only nontrivial 2-, 4-, 8-, 11-, and 16-torsion, 28 38 54 72 . We calculate #E e and #E /F13 = 16, which implies there is only nontrivial 2-, 4-, 8-, 13-, and 16-torsion. Altogether E(Q) only has nontrivial 2-, 4-, and 8-torsion, because Mazur’s torsion theorem rules out 16-torsion. Our count e /F13 = 16 implies #Etors (Q) ≤ 16. Switching to the Weierstrass equation E 0 /Q has 4A3 + 27B 2 = #E −216 320 54 72 , we first find the 2-torsion points {(282, 0), (−1293, 0), (1011, 0) }. Afterwards, we also find other nontrivial torsion points {(1227, 22680), (147, 12960), (2307, 97200), (−285, 27216), (−933, 29160)} via checking the possibilities outlined by Lutz-Nagell. So #Etors (Q) ≥ 9, which forces #Etors (Q) = 16. The only such possibility for Etors (Q) is Z/2Z × Z/8Z. R EFERENCES [Abr95] Dan Abramovich. Formal finiteness and the torsion conjecture on elliptic curves. A footnote to a paper: “Rational torsion of prime order in elliptic curves over number fields” [Astérisque No. 228 (1995), 3, 81–100; MR1330929 (96c:11058)] by S. Kamienny and B. Mazur. Astérisque, (228):3, 5–17, 1995. Columbia University Number Theory Seminar (New York, 1992). [Cas67] J. W. S. Cassels. Global fields. In Algebraic Number Theory (Proc. Instructional Conf., Brighton, 1965), pages 42–84. Thompson, Washington, D.C., 1967. 18 E LLIPTIC C URVES AND T HEIR T ORSION [Fal83] G. Faltings. Endlichkeitssätze für abelsche Varietäten über Zahlkörpern. 73(3):349–366, 1983. [Frö67] A. Fröhlich. Local fields. In Algebraic Number Theory (Proc. Instructional Conf., Brighton, 1965), pages 1–41. Thompson, Washington, D.C., 1967. Invent. Math., [Kam92] S. Kamienny. Torsion points on elliptic curves and q-coefficients of modular forms. Invent. Math., 109(2):221–229, 1992. [Kem93] George R. Kempf. Algebraic varieties, volume 172 of London Mathematical Society Lecture Note Series. Cambridge University Press, Cambridge, 1993. [KM95] S. Kamienny and B. Mazur. Rational torsion of prime order in elliptic curves over number fields. Astérisque, (228):3, 81–100, 1995. With an appendix by A. Granville, Columbia University Number Theory Seminar (New York, 1992). [Maz77] B. Mazur. Modular curves and the Eisenstein ideal. Inst. Hautes Études Sci. Publ. Math., (47):33– 186 (1978), 1977. [Mer96] Loı̈c Merel. Bornes pour la torsion des courbes elliptiques sur les corps de nombres. Invent. Math., 124(1-3):437–449, 1996. [Mor22] Louis J. Mordell. On the rational solutions of the indeterminate equations of the third and fourth degrees. Mathematical Proceedings of the Cambridge Philosophical Society, 21:179–192, 1922. [Sil09] Joseph H. Silverman. The arithmetic of elliptic curves, volume 106 of Graduate Texts in Mathematics. Springer, Dordrecht, second edition, 2009. [Wei29] André Weil. L’arithmétique sur les courbes algébriques. Acta Math., 52(1):281–315, 1929. 19