Congruent numbers and elliptic curves ^{∗}

José Ignacio Cogolludo

Fall Semester 1997

e-mail address: jicogo@math.uic.edu

Introduction

We start with a classical problem: find a simple algorithm to determine whether or not a rational number can be the area of a right triangle with rational legs. Such numbers are called “congruent numbers”. Our aim is to give a number of characterizations for congruent numbers that eventually can lead to a better understanding of the problem. In order to do this we need to introduce and develop some concepts of algebraic geometry and number theory such as the theory of elliptic curves and elliptic functions. They provide an appropriate frame where to discuss the problem. Too far for the scope of this survey is to prove a partial answer given by J. Tunnell in 1983 [3]. A simplified statement of the theorem can be as follows,

Theorem 1 ([Tunnell 83]). Let n be a square-free and odd (resp. even) positive integer. Consider the following two conditions:

i) n is congruent;

ii) the number of triples of integers (x, y, z) satisfying 2x^{2} + y^{2} + 8z^{2} = n (resp. 4x^{2} + y^{2} + 8z^{2} = \frac{n}{2}) is equal to twice the number of triples satisfying 2x^{2} + y^{2} + 32z^{2} = n (resp. 4x^{2} + y^{2} + 32z^{2} = \frac{n}{2}).

∗Expository paper for Math 514 “Basic Number Theory”

Then i) implies ii); and if the weak form of the so-called Birch-Swinnerton-Dyer conjecture for the elliptic curves E_{n} : y^{2} = x^{3} − n^{2}x is true, then ii) also implies i).

The reason why this statement is general enough is given in the first section, as well as some examples and characterizations of congruent numbers. In the second section we consider the Weierstrass ℘-function in order to define the addition law on elliptic curves. The third section is devoted to the definition and properties of the Mordell-Weil group and we prove another characterization of congruent numbers relating the structure of the Mordell-Weil group of the elliptic curve E_{n} associated to the integer n.

1 Congruent numbers

We will say a rational number a = \frac{r}{s} to be congruent if there exist rational numbers X, Y and Z (which will be considered ordered X < Y < Z) such that X^{2} + Y^{2} = Z^{2} and \frac{1}{2}XY = a.

Remark 1.1. Observe that if a = \frac{r}{s} is a congruent number corresponding to a triangle of sides (X, Y, Z), then s^{2}a is a congruent number (and integer) corresponding to the triangle (sX, sY, sZ). Therefore the property of “being congruent” is invariant under multiplication by the square of a rational number. And in this class there is only one square-free representative, which corresponds to n in Theorem 1. So, it is stated without lost of generality. In what follows we will consider as congruent numbers only their square-free integer representatives.

Example 1.2. An example of a congruent number is the area of the triangle for any Pythagorean triple, that is right triangles with integer sides. The first one, or the “smallest one”, is (3, 4, 5) which provides the congruent number 6. A reasonable question would be, is this the smallest congruent number? The answer is no, since n = 5 is the area of (\frac{3}{2}, \frac{20}{3}, \frac{41}{6}). If we consider the equation

2x^{2} + y^{2} + 8z^{2} = n  (1)

with n < 5, the set of solutions coincide with the one of

2x^{2} + y^{2} + 32z^{2} = n  (2)

because z has to be 0, therefore, if we find at least one solution for (1) or (2) then condition ii) in Theorem 1 does not hold and n is not congruent. But (1, 1, 0) is solution for n = 3 and (0, 1, 0) is for n = 1. The same idea proves that n = 2 is not congruent, then in fact, if we assume Theorem 1, n = 5 is the smallest congruent.

Though easy to understand, the definition of congruent number as it is stated does not seem to be very “treatable” from a mathematical point of view. We want to reformulate the definition as follows,

Proposition 2. A positive integer number n is congruent if and only if there exists a rational number a such that a − n and a + n are both squares of rational numbers.

Proof. Suppose n is the area of (X, Y, Z) and take a = (\frac{Z}{2} )^{2} then

a ± n = (\frac{Z}{2} )^{2} ± \frac{1}{2}XY = \frac{X^{2} + Y^{2}}{4} ± \frac{1}{4}2XY = \frac{1}{4}(X ± Y)^{2} = (\frac{X ± Y}{2} )^{2}.

Conversely, if we define

X := (\sqrt{a + n} + \sqrt{a − n})

and

Y := (\sqrt{a + n} − \sqrt{a − n})

they are rational numbers and n = \frac{1}{2}XY. □

A third characterization is given by the following

Proposition 3. A positive integer number n is congruent if and only if there exists a rational solution (x, y) for the equation E_{n} : y^{2} = x^{3} − n^{2}x with x the square of a rational number of even denominator.

Proof. Let’s assume that n is congruent, by Proposition 2 we have the following equations

a ± n = (\frac{X ± Y}{2} )^{2}

whose product gives

a^{2} − n^{2} = (\frac{X^{2} − Y^{2}}{4} )^{2}.

Now, if we multiply the equation by a^{2} and call y = \frac{X^{2}−Y^{2}}{4} a and x = a, then (x, y) is a rational solution of E_{n} where x = a = (\frac{Z}{2} )^{2} is the square of a rational number. Observe that (X, Y, Z) can be written as (\frac{X̃}{s} , \frac{Ỹ}{s} , \frac{Z̃}{s}) where (X̃, Ỹ , Z̃) is a Pythagorean triple. But in a primitive one X̃ and Ỹ have different parity, therefore Z̃ is odd and then x = (\frac{Z̃}{2s})^{2} has denominator divisible by 2.

Conversely, going backwards, it is possible to reconstruct the solution of the cubic equation E_{n}. □

Before getting into the last characterization of congruent numbers we need to develop some concepts about elliptic curves.

2 Weierstrass ℘-function

Let L be a lattice in the complex plane. A lattice is the set of all integral linear combinations of two given complex numbers ω_{1} and ω_{2} linearly independent over R.

[figure: ω_{1}; ω_{2}; L]

The parallelogram defined as

Π := {aω_{1} + bω_{2} | a, b ∈ [0, 1]}

is called fundamental domain.

We define the following formal series

℘(z) = ℘(z; L) := \frac{1}{z^{2}} + ∑_{ℓ∈L\\{0\}} (\frac{1}{(z − ℓ)^{2}} − \frac{1}{ℓ^{2}} ).

Properties of ℘(z).

(P1) The sum converges absolutely and uniformly for z in any compact set of C \ L.

To prove this one only needs to sum the terms in parenthesis

\frac{1}{(z − ℓ)^{2}} − \frac{1}{ℓ^{2}} = \frac{2zℓ − z^{2}}{(z − ℓ)^{2}ℓ^{2}}

and compare these terms with |ℓ|^{−3} which converges absolutely and uniformly.

(P2) ℘(z) is a meromorphic function on C. In fact it has a pole of order 2 at each point of the lattice.

The reason is because ℘(z) − \frac{1}{(z−ℓ)^{2}} is continuous at z = ℓ. So it has poles of order 2 at lattice points and no other poles.

(P3) ℘(z) is doubly periodic with periods ω_{1} and ω_{2}, i.e. ℘(z +nω_{1} +mω_{2}) = ℘(z) for any integers n and m.

Since

℘′(z) = −2 ∑_{ℓ∈L} \frac{1}{(z − ℓ)^{3}}

is doubly periodic, then ℘(z − ω_{i}) − ℘(z) = k_{i} ∈ C. Since ℘(z) is even, then

℘(\frac{1}{2}ω_{i} − ω_{i}) − ℘(\frac{1}{2}ω_{i}) = ℘(−\frac{1}{2}ω_{i}) + ℘(\frac{1}{2}ω_{i}) = 0.

(P4) In every fundamental domain of the form α + Π with α ∉ L, there are exactly two zeroes for ℘(z).

It is nothing but the Residue Theorem applied to the doubly periodic function \frac{℘′}{℘}. On one side the integral along the boundary of α + Π is zero by the double periodicity property. On the other hand each zero (resp. pole) of ℘(z) of multiplicity m is a simple pole of \frac{℘′}{℘} with coefficient +m (resp. −m). Since we know by (P2) that ℘(z) has a double pole inside α + Π then it has exactly either two zeroes or one with multiplicity two.

(P5) The Weierstrass ℘-function defined over C/L is a double covering of the projective complex line ramified at ∞, e_{1} := ℘(ω_{1}/2), e_{2} := ℘(ω_{2}/2) and e_{3} := ℘((ω_{1} + ω_{2})/2)).

By complex analysis we know that any non-constant meromorphic function in one variable is onto. Thus, for any complex number u there exists a complex number z_{0} such that ℘(z_{0}) = u. Then ℘(z)−℘(z_{0}) has exactly two poles in the fundamental domain α + Π, and by (P4) it has exactly two zeroes, say z_{0} and z_{1}. The ramification locus coincides with those values for which z_{0} = z_{1}. Another nice application of the Residue Theorem to the function \frac{z℘′(z)}{℘(z)} shows that, counting with multiplicity, the sum of all zeroes (as complex numbers) differs from the sum of all poles by an element of the lattice L (actually one can prove this result for a general elliptic function f(z) using \frac{zf′(z)}{f(z)}). This implies z_{0}+z_{1} ∈ L because the poles are already in L. Therefore z_{0} = z_{1} means 2z_{0} ∈ L and since the only three elements in Π satisfying this property are \frac{ω_{1}}{2} , \frac{ω_{2}}{2} and \frac{ω_{1}+ω_{2}}{2} , the result holds.

Remarks 2.1. Doubly periodic meromorphic functions are also called elliptic functions. Observe that this set is closed under addition, multiplication, division, and contains the functions 0 and 1 which are the units with respect to addition and multiplication. Then they form the field of elliptic functions denoted E_{L}.

Observe that ℘(z) is even, whereas ℘′(z) is odd. In fact, algebraic combinations of these two functions generate the whole field of elliptic functions (see [2] pp. 18–19).

This fact leads to the following

Proposition 4. The function ℘′(z)^{2} satisfies the following algebraic relation

℘′(z)^{2} = 4(℘(z) − e_{1})(℘(z) − e_{2})(℘(z) − e_{3}),

where the numbers e_{i} are defined in (P5).

Proof Since ℘′(z) is odd, then ℘′(z)^{2} is even and has poles of order two at e_{1}, e_{2} and e_{3}. Then, by the Remark 2.1

℘′(z)^{2} = k(℘(z) − e_{1})(℘(z) − e_{2})(℘(z) − e_{3})

for a certain constant k.

Now, observe that ℘′(z) + 2\frac{1}{z^{3}} is continuous. So it is ℘′(z)^{2} − 4\frac{1}{z^{6}} with leading coefficient equal zero. On the other hand the leading coefficient of

k(℘(z) − e_{1})(℘(z) − e_{2})(℘(z) − e_{3}) − 4\frac{1}{z^{6}}

is k − 4, therefore k = 4. □

This equation has a basic geometric interpretation. Suppose we consider the following function

\begin{matrix}C & ⟶ & P_{C}^{2} \\ z & ⟼ & [℘(z) : ℘′(z) : 1] \\ 0 & ⟼ & [0 : 1 : 0] \end{matrix}  (3)

This map is one-to-one, because if ℘(z_{0}) = ℘(z_{1}) for two distinct complex numbers, then by Property (P5) we have z_{0} + z_{1} ∈ L and therefore ℘′(z_{0}) = −℘′(z_{1}) ≠ 0.

In other words, we have proved the following

Proposition 5. The map (3) is an analytic one-to-one correspondence between C/L and the elliptic curve

y^{2} = 4(x − e_{1})(x − e_{2})(x − e_{3}).

Example 2.2. Consider the lattice L = Z[i] of the Gaussian numbers. In this case ω_{2} = i and ω_{1} = 1. We want to obtain an equation of the elliptic curve corresponding to this lattice via Proposition 5. For that purpose we need to calculate the coefficients e_{i}. Observe that

℘(\frac{1}{2}) = \frac{1}{(\frac{1}{2})^{2}} + ∑_{ℓ∈L\\{0\}} ( \frac{1}{\frac{1}{2} − ℓ})^{2} − \frac{1}{ℓ^{2}} =

= 4(1+ ∑_{ℓ∈L\\{0\}} \frac{1}{(1 − 2ℓ)^{2}} −\frac{1}{(2ℓ)^{2}} ) = −4(i^{2}+ ∑_{ℓ∈L\\{0\}} \frac{1}{(1 − 2ℓi)^{2}} −\frac{1}{(2ℓi)^{2}} ) = −℘(\frac{i}{2})

and

℘(\frac{1}{2}) + ℘(\frac{i}{2}) + ℘(\frac{1 + i}{2}) = \frac{1}{(\frac{1+i}{2})^{2}} + ∑_{ℓ∈L\\{0\}} \frac{1}{(1 − 2ℓ)^{2}} + ∑_{ℓ∈L\\{0\}} \frac{1}{(i − 2ℓ)^{2}} +

+ ∑_{ℓ∈L\\{0\}} \frac{1}{(1 + i − 2ℓ)^{2}} − 3 ∑_{ℓ∈L\\{0\}} \frac{1}{ℓ^{2}} = −2 ∑_{ℓ∈L\\{0\}} \frac{1}{ℓ^{2}} = 0.

Therefore ℘(\frac{1+i}{2}) = 0 and the equation is of the form

y^{2} = 4x(x − e)(x + e)

that is

y^{2} = 4x^{3} − (2e)^{2}x.

Observe that we obtain the relation ℘(ω \frac{1+i}{2}) = 0 in the very same way for the lattice L_{ω} = ωZ[i]. Thus, it turns out that for appropriate values of ω we obtain the elliptic curve E_{n} : y^{2} = x^{3} − n^{2}x where n is an integer number.

3 Mordell-Weil group and congruent numbers

The correspondence of Proposition 5 allows us to carry over the group structure on C/L to the elliptic curve. Namely, if P_{1} and P_{2} are two points on the curve corresponding to the complex numbers z_{1} and z_{2} on C/L then we define P_{1} + P_{2} as the image of z_{1} + z_{2}. This is called the addition law on the elliptic curve.

There is a basic geometric interpretation for this group structure avoiding to look for the corresponding point in the fundamental domain. First of all observe that the identity element of this group is the image of 0 which is the point [0 : 1 : 0]. We will split the procedure of adding two points in two lemmas.

Lemma 2.1. The inverse of a point P = (x, y) is the point P′ = (x, −y).

Proof. Let’s calculate the sum P + P′. We will write P = (℘(z), ℘′(z)) and P′ = (℘(z′), ℘′(z′)). Since they have the same first coordinate it means that ℘(z) = ℘(z′), in other words, by Property (P5), z + z′ ∈ L, that is, P + P′ = 0. □

Lemma 2.2. Let ℓ be the line joining two points P_{1} and P_{2} then the third point of intersection of ℓ with the cubic is −(P_{1} + P_{2}) (in the case that P_{1} = P_{2} = P the line ℓ means the tangent to the elliptic curve at P.

Proof. Suppose ℓ : y = mx + b is the equation of the line joining P_{1} and P_{2}. The function ℘′(z) − m℘(z) − b has three zeroes, which are the intersections of ℓ and the elliptic curve. Let say z_{i} is the point in C/L corresponding to P_{i} (i = 1, 2, 3). Then, by Property (P5), z_{3} ≡ −(z_{1} + z_{2}) mod (L). Then P_{3} = −(P_{1} + P_{2}). □

Example 3.1. Let’s consider again the curve E_{n} : y^{2} = x^{3} − n^{2}x. In order to calculate the points of the form 2P, for example, we need the equation of the line ℓ tangent to P = (a, b). Since the gradient of F (x, y) = y^{2} −x^{3} +n^{2}x at P is ∇(F)(a, b) = (n^{2} − 3a^{2}, 2b), then

ℓ : (y − b)2b = (n^{2} − 3a^{2})(x − a)

and therefore

y = \frac{n^{2} − 3a^{2}}{2b} (x − a) + b.

Now, we want to find the third intersection point of ℓ with E_{n}, which is the solution of

(\frac{n^{2} − 3a^{2}}{2b} )^{2}(x − a)^{2} + (n^{2} − 3a^{2})(x − a) + b^{2} = x^{3} − n^{2}x

or equivalently, substituting b^{2} by a^{3} − n^{2}a,

(\frac{n^{2} − 3a^{2}}{2b} )^{2}(x − a)^{2} + (n^{2} − 3a^{2})(x − a) = x^{3} − n^{2}x − (a^{3} − n^{2}a),

and factorizing the right hand side one gets

(\frac{n^{2} − 3a^{2}}{2b} )^{2}(x − a)^{2} + (n^{2} − 3a^{2})(x − a) = (x^{2} + ax + a^{2})(x − a).

Since x ≠ a then we can divide and simplify, getting

(\frac{n^{2} − 3a^{2}}{2b} )^{2}(x − a) = (x − a)(x + 2a)

and again dividing by (x − a) and solving for x

x = (\frac{n^{2} − 3a^{2}}{2b} )^{2} − 2a = (\frac{a^{2} + n^{2}}{2b} )^{2}.

We just need to change the sign of the second coordinate to obtain the result

y = −\frac{n^{2} − 3a^{2}}{2b} (x − a) − b.

Moreover, if P has rational coordinates we can prove that the first coordinate of 2P is of the form the square of a rational number of even denominator.

Let ord_{2} denote the power of 2 dividing the numerator minus the power dividing the denominator. Observe that since n is square free then ord_{2}(n) = 0, 1. We consider four cases:

i) if ord_{2}(a) > ord_{2}(n), then ord_{2}(a^{2} + n^{2}) = 2ord_{2}(n) and ord_{2}(b^{2}) = 2ord_{2}(b) = ord_{2}(a^{3} − n^{2}a) = ord_{2}(a) + ord_{2}(a^{2} + n^{2}) = ord_{2}(a) + 2ord_{2}(n) > 3ord_{2}(n). And since ord_{2}(n) = 0, 1, then ord_{2}(2b) = 1 + ord_{2}(b) > ord_{2}(a^{2} + n^{2}).

ii) if ord_{2}(a) < ord_{2}(n), then ord_{2}(a^{2} + n^{2}) = 2ord_{2}(a) and ord_{2}(b^{2}) = 2ord_{2}(b) = ord_{2}(a^{3} − n^{2}a) = ord_{2}(a) + ord_{2}(a^{2} + n^{2}) = ord_{2}(a) + 2ord_{2}(a) = 3ord_{2}(n). Then ord_{2}(b) = \frac{3}{2}ord_{2}(a) therefore ord_{2}(2b) = 1 + ord_{2}(b) > ord_{2}(a^{2} + n^{2}).

iii) if ord_{2}(a) = ord_{2}(n) = 0, then ord_{2}(a^{2} + n^{2}) = ord_{2}((a − n)(a + n) + 2n^{2}) = 1, since ord_{2}((a − n)(a + n)) > ord_{2}(2n^{2}) = 1. Therefore ord_{2}(2b) = 1 + ord_{2}(b) > ord_{2}(a^{2} + n^{2}) = 1.

iv) if ord_{2}(a) = ord_{2}(n) = 1, then ord_{2}(a^{2} + n^{2}) = ord_{2}((a − n)(a + n) + 2n^{2}) = 3, since ord_{2}((a − n)(a + n)) > ord_{2}(2n^{2}) = 3. Therefore ord_{2}(2b) = 1 + ord_{2}(b) > ord_{2}(a^{2} + n^{2}) = 3.

This example shows the close relation between the existence of rational points on E_{n}, the construction of 2P and the fact that n is a congruent number.

In order to understand better the consequences of this example we need to define the Mordell-Weil group on an elliptic curve C. Consider the set of rational points on the curve (i.e. with rational coordinates). It is easy to see that this set is closed under addition and of course the additive identity is also a rational point. Therefore this set is in fact a subgroup of C/L. This subgroup is called the Mordell − Weil group of C. For the curves E_{n} that we are considering, we will denote this group as E_{n}(Q).

A basic theorem of Mordell states that the Mordell-Weil group is finitely generated, for a proof see [1].

In the case of the elliptic curves E_{n} associated with the square free integers n we have a certain finitely generated group E_{n}(Q). We have enriched the structure of the elliptic curve itself and this fact will help us to decide the existence of solutions of E_{n} satisfying the conditions of Proposition 3. Let start calculating the torsion part of E_{n}(Q). But before that we need a couple of results about reduction mod p.

Consider the projection map π_{p} from P_{Q}^{2} onto P_{F_{p}}^{2} for an odd prime p non dividing n. In order to do this we need to consider the unique expression of a point in P_{Q}^{2} as a triple of integer coprime numbers (x, y, z). Then the projection is always well defined because we never get π_{p}(x, y, z) = (0, 0, 0). Since addition formulae on elliptic curves are algebraic expressions, then it is clear that the projection induces a group homomorphism from E_{n}(Q) to E_{n}(F_{p}).

Lemma 3.1. Let q be a prime power of the odd prime p. Assume p |̸n and q ≡ 3(mod4). Then there are q + 1 F_{q}-points on the elliptic curve E_{n}, that is, #E_{n}(F_{q}) = q + 1.

Proof. There are always four points of order 2, namely (0, 0), the point at infinity, (n, 0) and (−n, 0) by Example 2.2. Actually, these are the only points on E_{n} having y = 0. We have therefore q − 3 possible values for x. Since q ≡ 3(mod4) then −1 is not a square in F_{q} and using the fact that F (x) = x^{3} − n^{2}x is and odd function then either F (x) or F (−x) as well as x or −x are squares in F_{q}. Then we obtain exactly two points (x, ±\sqrt{F (x)}) or

else (−x, ±\sqrt{F (x)}). So for each pair \{x, −x\} we obtain a pair of F_{q}-points on E_{n}. Then there q − 3 of them, plus the 4 previous ones, we have q + 1 F_{q}-points. □

Lemma 3.2. Let π_{p} be the projection defined above, then π_{p}(P_{1}) = π_{p}(P_{2}) if the cross-product of P_{1} and P_{2} (as vectors in R^{3}) is divisible by p.

Proof. Let us write P_{i} = [x_{i} : y_{i} : z_{i}] (i = 1, 2) and suppose that p divides the cross-product. Then we have two cases:

i) if p|x_{1}, since by assumption p divides x_{2}z_{1} − x_{1}z_{2} and x_{1}y_{2} − x_{2}y_{1} and then p divides x_{2} because it does not divide y_{1} and z_{1} by assumption. Suppose that p |̸y_{1}, then π_{p}(P_{1}) = π_{p}([0 : y_{1} : z_{1}]) = π_{p}([0 : y_{1}y_{2} : z_{1}y_{2}]) = π_{p}([0 : y_{1}y_{2} : z_{2}y_{1}]) = π_{p}(P_{2}). And analogously if we assume p |̸z_{1}.

ii) if p |̸x_{1}. Then π_{p}(P_{1}) = π_{p}([0 : y_{1} : z_{1}]) = π_{p}([x_{1}x_{2} : x_{2}y_{1} : x_{2}z_{1}]) = π_{p}([x_{1}x_{2} : x_{1}y_{2} : x_{1}z_{2}]) = π_{p}([x_{2} : y_{2} : z_{2}]) = π_{p}(P_{2}).

Conversely, suppose that π_{p}(P_{1}) = π_{p}(P_{2}), then we can assume for example, that p |̸x_{1}. Then, since π_{p}(P_{1}) = π_{p}(P_{2}) = π_{p}([x_{2} : y_{2} : z_{2}]), we also have p |̸x_{2}. Hence, π_{p}(P_{1}) = π_{p}([x_{1}x_{2} : y_{1}x_{2} : z_{1}x_{2}]) = π_{p}(P_{2}) = π_{p}([x_{2}x_{1} : y_{2}x_{1} : z_{2}x_{1}]). The first coordinates coincide, so we have that p has to divide y_{1}x_{2} − y_{2}x_{1} and z_{1}x_{2} − z_{2}x_{1}. If we repeat the argument with the second and third coordinates we obtain the last relation, namely, p has to divide y_{1}z_{2} − y_{2}z_{1}, which implies that p divides the cross-product of π_{p}(P_{1}) and π_{p}(P_{2}). □

Now we can prove the

Proposition 6. E_{n}(Q)_{tors} = Z/2Z ⊕ Z/2Z.

Proof. Suppose we had an element of finite order other than [0 : 1 : 0], [0 : 0 : 1], [n : 0 : 1] or [−n : 0 : 1] (which generate a subgroup Z/2Z⊕Z/2Z ⊂ E_{n}(Q)_{tors}), then we will have a subgroup S in E_{n}(Q)_{tors} of order either 8 or else an odd number. Consider the cross-product vector P_{ij} of each two points P_{i} and P_{j} in S (note that P_{ij} is never zero because P_{i} and P_{j} represent different points in the projective plane). Now let us denote d_{ij} the greatest common divisor of the coordinates of the vector P_{ij}. According to the Lemma 3.2 π_{p}(P_{i}) = π_{p}(P_{j}) if and only if p|d_{ij}.

This means that for all but finitely many p the map π_{p} has to be monomorphism, that is, the order of S, say s, has to divide the order of E_{n}(F_{p}). If we ask p to be congruent with 3 mod 4, we have that for all but finitely many of these, s|#E_{n}(F_{p}) = p + 1 by Lemma 3.1 but that would mean that there are only a finite number of primes congruent with 3 mod 4 and −1 mod s.

Contradiction by the theorem of distribution of primes. □

We are now ready to prove the characterization of a congruent number in terms of the Mordell-Weil group of the associated elliptic curve E_{n}.

Theorem 2 [Tunnell]. n is a congruent number if and only if E_{n}(Q) has elements of infinite order.

Proof. Suppose that n is a congruent number, then, by Proposition 3 the curve E_{n} has a rational point other than [0 : 1 : 0], [0 : 0 : 1], [n : 0 : 1] or [−n : 0 : 1]. By Proposition 6 this means that E_{n}(Q) has an element that is not in E_{n}(Q)_{tors}, therefore, it must contain an element of infinite order.

Conversely, if there is an element P of infinite order, then 2P is not zero and therefore by Example 3.1 satisfies the conditions of Proposition 6 and therefore n is a congruent number. □

References

[1] Budur, N. “The Mordell-Weil group of an elliptic curve”, expository paper for Math 514.

[2] Koblitz, N. “Introduction to elliptic curves and modular forms”, Grad. Texts in Math., Vol. 97 (1984), Springer-Verlag.

[3] Tunnell, J. “A classical Diophantine problem and modular forms of weight 3/2”, Inventiones Math., Vol. 72 (1983), pp. 323–334.