A SURVEY OF THE ARITHMETIC THEORY OF ELLIPTIC CURVES

Joseph H. Silverman

Brown University

August 9 & 10, 1995

Contents

§1. Basic Definitions §2. The Group Law §3. Singular Cubics §4. Isogenies §5. The Endomorphism Ring §6. Torsion Points §7. Galois Representations Attached to E §8. The Weil pairing §9. Elliptic Curves Over Finite Fields §10. Elliptic Curves Over ℂ and Elliptic Functions §11. The Formal Group of an Elliptic Curve §12. Elliptic Curves Over Local Fields §13. The Selmer and Shafarevich-Tate Groups §14. Discriminants, Conductors, and L-Series §15. Duality Theory §16. Rational Torsion and the Image of Galois §17. Tate Curves §18. Heights and Descent §19. The Conjecture of Birch and Swinnerton-Dyer §20. Complex Multiplication §21. Integral Points

Typeset by AMS-TEX

This brief survey summarizes, without proof, some of the basic theory of elliptic curves. Proofs for most of the theorems can be found in the references listed at the end, see especially [1], [5], and [6].

§1. Basic Definitions

An elliptic curve is a pair (E, O), where E is a smooth projective curve of genus one and O is a point of E. The elliptic curve is said to be defined over the field K if the underlying curve is defined over K and the point O is defined over K.

Every elliptic curve can be embedding as a smooth cubic curve in ℙ^{2} given by an equation of the form

E : y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6}.  (1)

Such an equation is called a Weierstrass equation for E. The point O is the point [0, 1, 0] at infinity. If E is defined over K, then the a_{i}’s can be chosen in K. If in addition char(K) ≠ 2, 3, then E has a Weierstrass equation of the form

E : y^{2} = x^{3} + Ax + B.  (2)

The non-singularity assumption on E implies that the discriminant

Δ = −16(4A^{3} + 27B^{2}) ≠ 0.

We also define the j-invariant of E to be the quantity

j(E) = −1728\frac{64A^{3}}{Δ} = 1728\frac{4A^{3}}{4A^{3} + 27B^{2}} .

(When using the general Weierstrass equation (1), the formulas for Δ and j are more complicated, see [7] or [5].)

Theorem. Let E and E′ be elliptic curves defined over an algebraically closed field K. Then E is K-isomorphic to E′ if and only if j(E) = j(E′).

Two special types of elliptic curves are those with j-invariant 0 and 1728. These curves are given by equations of the form

E : y^{2} = x^{3} + Ax  j = 1728,
E : y^{2} = x^{3} + B  j = 0.

§2. The Group Law

The points on an elliptic curve form a group. The group law can be characterized in a number of equivalent ways. Let E be an elliptic curve and P, Q ∈ E. The sum P + Q is the (unique) point R satisfying

(P) + (Q) ∼ (R) + (O),

where ∼ denotes linear equivalence of divisors. Geometrically, three points sum to zero if and only if they are collinear. Using this geometric characterization, one can write down explicit formulas. For example, if P = (x, y) and P′ = (x′, y′) are on the curve given by the equation (2), then

x(P + P′) = (\frac{y′ − y}{x′ − x})^{2} − x − x′ and x(2P) = \frac{x^{4} − 2Ax^{2} − 8Bx + A^{2}}{4x^{3} + 4Ax + 4B} .

Similarly, the additive inverse of P = (x, y) is −P = (x, −y).

Repeated addition gives multiplication maps

[m] : E → E, [m]P = \{ \begin{matrix}P + P + ⋯ + P & if m > 0, \\ O & if m = 0, \\ −(P + P + ⋯ + P) & if m < 0. \end{matrix}

Further, for any point Q ∈ E, there is the translation-by-Q map

τ_{Q} : E → E, τ_{Q}(P) = P + Q.

Riemann-Roch tells us that an elliptic curve has a unique holomorphic differential (up to scalar). On the Weierstrass equations (1) and (2) it is given by

ω_{E} = \frac{dx}{2y + a_{1}x + a_{3}}  and  ω_{E} = \frac{dx}{2y}  respectively.

The uniqueness of ω_{E} implies that it is translation invariant,

τ_{Q}^{∗}(ω_{E}) = ω_{E} for all Q ∈ E.

§3. Singular Cubics

If the discriminant of a Weierstrass equation (1) or (2) vanishes, then the curve is singular, with exactly one singular point. There are two possible behaviors. Either the singular point has two distinct tangent directions (a node), or it has only a single tangent direction (a cusp). The non-singular locus is denoted

E^{ns} = {P ∈ E : P is a non-singular point of E}.

The group law described above makes the non-singular locus into a group:

E^{ns} ≅ \{ \begin{matrix}the multiplicative group 𝔾_{m} if E has a node, \\ the additive group 𝔾_{a} if E has a cusp. \end{matrix}

§4. Isogenies

A non-constant morphism ϕ : E_{1} → E_{2} between elliptic curves satisfying ϕ(O) = O is called an isogeny.

Proposition. An isogeny ϕ : E_{1} → E_{2} is always a group homomorphism. That is, ϕ(P + Q) = ϕ(P) + ϕ(Q).

It follows that the kernel of an isogeny ϕ : E_{1} → E_{2} is a finite subgroup of E_{1}. The degree of ϕ is its degree as a finite map of curves. (The constant map sending E_{1} to O is defined to have degree zero.)

Associated to an isogeny ϕ : E_{1} → E_{2} of degree n is a dual isogeny

ϕ̂: E_{2} → E_{1}

characterized by the property that

ϕ̂ ∘ ϕ = [n]_{E_{1}}  and  ϕ ∘ ϕ̂ = [n]_{E_{2}}.

The dual isogeny has the following additional properties:

ˆϕ̂ = ϕ,  { \atop ϕ + ψ} = ϕ̂ + ψ̂,  { \atop ϕ ∘ λ} = λ̂ ∘ ϕ̂,  ˆ[m] = [m].

§5. The Endomorphism Ring

The set of isogenies from E to itself, together with the zero map, form a ring which we denote by End(E) and call the endomorphism ring of E. We make End(E) into a ring via the rules

(ϕ + ψ)(P) = ϕ(P) + ψ(P)  and  (ϕψ)(P) = ϕ(ψ(P)).

The unit group of End(E) consists of the isomorphisms from E to itself. It is called the automorphism group of E and is denoted Aut(E).

Theorem. Let E be an elliptic curve defined over a field K.

(a) The endomorphism ring of E is one of the following three sorts of rings:

End(E) = \{ \begin{matrix}ℤ, \\ an order in a quadratic imaginary field, \\ a maximal order in a quaternion algebra. \end{matrix}

The third possibility can only occur if char(K) > 0.

(b) Assume char(K) ≠ 2, 3. Then the automorphism group of E is given by

Aut(E) = \{ \begin{matrix}μ_{2} & if j(E) ≠ 0, 1728, \\ μ_{4} & if j(E) = 1728, \\ μ_{6} & if j(E) = 0. \end{matrix}

(Here μ_{n} is the group of n^{th} roots of unity.)

An elliptic curve whose endomorphism ring is strictly larger than ℤ is said to have complex multiplication (or CM for short). For example, the curves with j = 0 and j = 1728 have CM.

§6. Torsion Points

The kernel of the multiplication-by-m map consists of the points whose order divides m. This subgroup is denoted

E[m] = ker[m] = {P ∈ E : [m]P = O}.

The torsion subgroup of E is the set of all points of finite order,

E_{tors} = {P ∈ E : [m]P = O for some m ≥ 1} = ⋃_{m≥1} E[m].

Remark. When we write E, E[m], E_{tors}, etc., we are always referring to geometric points, that is, to points defined over an algebraically closed field. If E is defined over K and we want to discuss only the points defined over K, we will write E(K), E(K)[m], and E_{tors}(K).

Proposition. Let E/K be an elliptic curve.

(a) If char(K) = 0 or if char(K) = p with p ∤ m, then

E[m] ≅ ℤ/mℤ × ℤ/mℤ.

(b) If char(K) = p > 0, then

E[p^{r}] ≅ ℤ/p^{r}ℤ or 0.

For a fixed prime ℓ, consider the inverse system of ℓ-power torsion points via the maps [ℓ] : E[ℓ^{n+1}] → E[ℓ^{n}]. The inverse limit is called the (ℓ-adic) Tate module of E and denoted

T_{ℓ}(E) = lim_{←} E[ℓ^{n}].

If char(K) ≠ ℓ, then T_{ℓ}(E) is a free ℤ_{ℓ}-module of rank 2,

T_{ℓ}(E) ≅ ℤ_{ℓ} × ℤ_{ℓ}.

It is often more convenient to work with the ℚ_{ℓ}-vector space

V_{ℓ}(E) = T_{ℓ}(E) ⊗ ℚ ≅ ℚ_{ℓ} × ℚ_{ℓ}.

§7. Galois Representations Attached to E

If E is defined over K, then its torsion points are defined over the algebraic closure of K, and we can look at the associated Galois action. To simplify our exposition, we will always assume that

K is a perfect field.

We also fix an algebraic closure K̄ of K.

The action of Galois commutes with the group law on E, so if char(K) = 0 or if char(K) = p with p ∤ m, then we obtain a two-dimensional representation

ρ̄_{m} : G_{K̄/K} ⟶ Aut(E[m]) ≅ GL_{2}(ℤ/mℤ).

These representations are extremely important in studying the arithmetic properties of E.

Proposition. The determinant det(ρ̄_{m}) of the representation ρ̄_{m} is equal to the cyclotomic character

χ_{m} : G_{K̄/K} ⟶ Aut(μ_{m}) ≅ (ℤ/mℤ)^{∗}.

The ℓ-power representations ρ̄_{ℓ^{n}} fit together to give the ℓ-adic representation of E,

ρ_{ℓ} : G_{K̄/K} ⟶ Aut(T_{ℓ}(E)) ≅ GL_{2}(ℤ_{ℓ}).

The associated vector space representation is also denoted ρ_{ℓ},

ρ_{ℓ} : G_{K̄/K} ⟶ Aut(V_{ℓ}(E)) ≅ GL_{2}(ℚ_{ℓ}).

Remark. The Tate module V_{ℓ}(E) is dual to the étale cohomology group H_{ét}^{1}(E, ℚ_{ℓ}), so the associated representation can equally well be defined using cohomology.

§8. The Weil pairing

Let E/K be an elliptic curve, and fix an integer m ≥ 2. If char(K) > 0, we assume that it does not divide m. The Weil pairing is a pairing

e_{m} : E[m] × E[m] ⟶ μ_{m}

defined as follows: Let S, T ∈ E[m]. Choose a function g on E whose divisor satisfies

div(g) = [m]^{∗}(T) − [m]^{∗}(O).

Then

e_{m}(S, T) = \frac{g(X + S)}{g(X)}

for any point X ∈ E such that g is defined at X and at X + S.

Proposition. The Weil pairing is

Bilinear:  e_{m}(S_{1} + S_{2}, T) = e_{m}(S_{1}, T)e_{m}(S_{2}, T).
e_{m}(S, T_{1} + T_{2}) = e_{m}(S, T_{1})e_{m}(S, T_{2}).
Alternating:  e_{m}(T, T) = 1.
Non-degenerate:  e_{m}(S, T) = 1 for all S ⟺ T = O.
Galois Equivariant:  e_{m}(S^{σ}, T^{σ}) = e_{m}(S, T)^{σ} for all σ ∈ G_{K̄/K}.

Let ϕ : E_{1} → E_{2} be an isogeny. Then the dual isogeny ϕ̂: E_{2} → E_{1} is dual (i.e., adjoint) with respect to the Weil pairing,

e_{m}(S, ϕ̂(T)) = e_{m}(ϕ(S), T ) for all S ∈ E_{1}[m] and T ∈ E_{2}[m].

The ℓ-power Weil pairings e_{ℓ^{n}} fit together to define a bilinear, alternating, nondegenerate, Galois equivariant pairing

e_{ℓ} : T_{ℓ}(E) × T_{ℓ}(E) ⟶ T_{ℓ}(μ),

where T_{ℓ}(μ) = lim_{←} μ_{ℓ^{n}} is the Tate module of the multiplicative group 𝔾_{m}.

§9. Elliptic Curves Over Finite Fields

Let E/𝔽_{q} be an elliptic curve defined over a field with q elements. Then the group of rational points E(𝔽_{q}) is a finite group.

Theorem. (Hasse)

|q + 1 − #E(𝔽_{q})| ≤ 2\sqrt{q}.

Proof sketch. Let ϕ : E → E be the Frobenius morphism given on Weierstrass coordinates by ϕ(x, y) = (x^{q}, y^{q}). Then E(𝔽_{q}) = ker(1 − ϕ). Further, by looking at its action on the invariant differential, one can show that the map 1 − ϕ is separable, so

#E(𝔽_{q}) = # ker(1 − ϕ) = deg(1 − ϕ).

We know that

ϕ ∘ ϕ̂ = deg ϕ = q ∈ ℤ ⊂ End(E), and we let a = ϕ + ϕ̂ ∈ ℤ ⊂ End(E).

Then for any m, n ∈ ℤ we have

0 ≤ deg(m + nϕ) = (m + nϕ) ∘ (m + nϕ̂) = m^{2} + amn + qn^{2}.

The non-negativity implies that the quadratic form is positive semi-definite, so its discriminant is non-positive, a^{2} − 4q ≤ 0. In particular, putting m = 1 and n = −1 yields

#E(𝔽_{q}) = deg(1 − ϕ) = 1 − a + q,

which combined with |a| ≤ 2\sqrt{q} gives the desired result.

Remark. Examining the above proof, we see that we have proven the following fundamental formula for the sum of the q-power Frobenius map and its dual:

ϕ + ϕ̂ = ( \begin{matrix}multiplication \\ by q + 1 − #E(𝔽_{q}) \\ on E \end{matrix}) .

Hasse’s theorem says that the trace of Frobenius, that is ϕ + ϕ̂, is an integer in End(E) of magnitude at most 2\sqrt{q}.

The zeta function of an elliptic curve E/𝔽_{q} is defined by the formal power series

Z(E/𝔽_{q}, T) = exp(∑_{n=1}^{∞} #E(𝔽_{q^{n}}) · \frac{T^{n}}{n} ).

Theorem. Let E/𝔽_{q} be an elliptic curve. The zeta function of E is a rational function of the form

Z(E/𝔽_{q}, T) = \frac{1 − aT + qT^{2}}{(1 − T)(1 − qT)},

where a is the trace of Frobenius,

a = q + 1 − #E(𝔽_{q}) = ϕ + ϕ̂.

Further,

1 − aT + qT^{2} = (1 − αT)(1 − βT) with |α| = |β| = \sqrt{q}.

Isogenous elliptic curves have the same number of points, since if ψ : E → E′ is an isogeny defined over 𝔽_{q}, then

deg(ψ)(q + 1 − #E(𝔽_{q})) = deg(ψ) deg(1 − ϕ_{E}) = deg(ψ − ψ ∘ ϕ_{E})

= deg(ψ − ϕ_{E′} ∘ ψ) = deg(1 − ϕ_{E′}) deg(ψ) = (q + 1 − #E′(𝔽_{q})) deg(ψ).

The converse is also true, but harder to prove:

Theorem. Two elliptic curves E/𝔽_{q} and E′/𝔽_{q} are isogenous over 𝔽_{q} if and only if Z(E/𝔽_{q}, T) = Z(E′/𝔽_{q}, T).

For an elliptic curve over a finite field, the p-torsion, the Frobenius map, and the endomorphism ring are closely related.

Theorem. Let E/𝔽_{q} be an elliptic curve, let p = char(𝔽_{q}) and let ϕ : E → E be the q^{th}-power Frobenius map. The following are equivalent:

(i) E[p] = 0. (ii) The dual ϕ̂ of Frobenius is purely inseparable. (iii) The map [p] : E → E is purely inseparable and j(E) ∈ 𝔽_{p^{2}}. (iv) End(E) is an order in a quaternion algebra.

If these conditions hold, we say that E is supersingular, otherwise we say that E is ordinary. If E is ordinary, then E[p] ≅ ℤ/pℤ and End(E) is an order in a quadratic imaginary field.

All supersingular elliptic curves in characteristic p have j-invariant in 𝔽_{p^{2}}. There are approximately p/12 of them (up to 𝔽̄_{p}-isomorphism).

§10. Elliptic Curves Over ℂ and Elliptic Functions

The complex analytic theory of elliptic curves is vast, so we will only hit on a few highlights. Let L ⊂ ℂ be a lattice. An elliptic function is an L-periodic meromorphic function f(z), that is, f(z + ω) = f(z) for all z ∈ ℂ and all ω ∈ L. The collection of all elliptic functions for L forms a field, denoted ℂ(L).

The Weierstrass ℘-function

℘(z) = ℘(z, L) = \frac{1}{z^{2}} + ∑_{ω∈L, ω≠0} (\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} )

is an elliptic function with a double pole at each point of L and no other poles. Also associated to the lattice L are the Eisenstein series

G_{2k}(L) = ∑_{ω∈L, ω≠0} \frac{1}{ω^{2k}} .

These series are absolutely convergent for all integers k ≥ 2. Notice that G_{2k} has the property the G_{2k}(λL) = λ^{−2k}G_{2k}(L) for any λ ∈ ℂ^{∗}. It is standard to set

g_{2}(L) = 60G_{4}(L)  and  g_{3}(L) = 140G_{6}(L).

Theorem. (a) ℂ(L) = ℂ(℘(z), ℘′(z)).

(b) The Weierstrass ℘-function and its derivative satisfy the identity

℘′(z)^{2} = 4℘(z)^{3} − g_{2}(L)℘(z) − g_{3}(L).

Further, the discriminant

Δ(L) = g_{2}(L)^{3} − 27g_{3}(L)^{2}

of the cubic polynomial is non-zero, so the equation

E_{L} : y^{2} = 4x^{3} − g_{2}(L)x − g_{3}(L)

defines an elliptic curve over ℂ.

(c) The map

ϕ_{L} : ℂ/L ⟶ E_{L}(ℂ), z ⟶ (℘(z), ℘′(z)),

is a complex analytic isomorphism of complex Lie groups.

(d) Conversely, given any elliptic curve E/ℂ, there exists a lattice L, unique up to homothety, such that E_{L} ≅ E.

Corollary. Let E/ℂ be an elliptic curve and let m ≥ 1 be an integer. Then as an abstract group, E[m] ≅ ℤ/mℤ × ℤ/mℤ.

Proof. E[m] = ker(ℂ/L ⟶^{z↦mz} ℂ/L) = (1/m)L/L ≅ (ℤ/mℤ)^{2}.

Another useful function is the Weierstrass σ-function

σ(z) = σ(z, L) = z ∏_{ω∈L, ω≠0} (1 − \frac{z}{ω} ) e^{z/ω+(1/2)(z/ω)^{2}}.

It is a theta function and can be used to construct elliptic functions. For example,

℘(z) − ℘(a) = −\frac{σ(z + a)σ(z − a)}{σ(z)^{2}σ(a)^{2}}  and  ℘′(z) = −\frac{σ(2z)}{σ(z)^{4}}.

If E_{1} and E_{2} are associated to the lattices L_{1} and L_{2} respectively, then one can show that

Hom(E_{1}, E_{2}) ≅ {α ∈ ℂ : αL_{1} ⊂ L_{2}},

where the isogeny associated to α is given analytically by

ℂ/L_{1} ⟶ ℂ/L_{2}, z ⟼ αz.

Using this, it is not hard to show that if L = ω_{1}ℤ + ω_{2}ℤ, then either (i) End(E_{L}) = ℤ, or (ii) ℚ(ω_{1}/ω_{2}) is a quadratic imaginary field, and End(E_{L}) is isomorphic to an

order in ℚ(ω_{1}/ω_{2}). Homothetic lattices correspond to isomorphic elliptic curves, so it is common

practice to use the normalized lattices

L_{τ} = τℤ + ℤ with Im(τ) > 0.

One then writes ℘(z, τ), σ(z, τ), G_{2k}(τ), etc. An elliptic function for L_{τ} is ℤperiodic, and thus may be written as a function of

u = e^{2πiz}  and  q = e^{2πiτ} .

This is equivalent to using the natural isomorphism

ℂ/L_{τ} ⟶^{∼} ℂ^{∗}/q^{ℤ}, z ⟼ u = e^{2πiz}.

Theorem.

\frac{1}{(2πi)^{2}} ℘(z, τ) = ∑_{n∈ℤ} \frac{q^{n}u}{(1 − q^{n}u)^{2}} + \frac{1}{12} − 2 ∑_{n≥1} \frac{q^{n}}{(1 − q^{n})^{2}} .

σ(z, τ) = −\frac{1}{2πi}e^{ηz^{2}/2}e^{−πiz}(1 − u) ∏_{n≥1} \frac{(1 − q^{n}u)(1 − q^{n}u^{−1})}{(1 − q^{n})^{2}}.

(Here η = η(τ) is a complex number called a quasi-period of the lattice L_{τ}.)

Finally, I want to mention the q-expansions for Δ and j and the Eisenstein series G_{2k}, and also to state Jacobi’s beautiful product formula for the discriminant function.

Theorem. As functions of q = e^{2πiτ}, the Eisenstein series G_{2k}, the discriminant function Δ(τ) and the j-invariant j(τ) have expansions

G_{2k}(τ) = 2ζ(2k) + 2\frac{(2πi)^{2k}}{(2k − 1)!} ∑_{n≥1}(∑_{d|n} d^{2k−1})q^{n}.
Δ(τ) = (2π)^{12} ∑_{n≥1} τ (n)q^{n} = q − 24q^{2} + 252q^{3} − 1472q^{4} + ⋯ ∈ ℤ[[q]].
j(τ) = q^{−1} + ∑_{n≥0} c(n)q^{n} = q^{−1} + 744 + 196884q + 21493760q^{2} + ⋯ ∈ ℤ[[q]].

(Here ζ(s) is the Riemann zeta function.)

The discriminant function also has the following product expansion:

Δ(τ) = Δ(L_{τ}) = (2π)^{12}q ∏_{n≥1}(1 − q^{n})^{24}.  ((Jacobi’s formula))

The integer coefficients τ (n) and c(n) of Δ and j have many wonderful arithmetic properties.

§11. The Formal Group of an Elliptic Curve

Substituting x = z/w and y = −1/w into a Weierstrass equation for E gives

w = z^{3} + a_{1}zw + a_{2}z^{2}w + a_{3}w^{2} + a_{4}zw^{2} + a_{6}w^{3},

and then repeated substitution (or Hensel’s lemma) can be used to express w as a formal power series w(z) ∈ ℤ[a_{1}, …, a_{6}][[z]]. This in turn can be used to express x, y, and the invariant differential ω_{E} as formal series in z, and then the group law is given by a power series F_{E}(z_{1}, z_{2}) in two variables. The first few terms of these series are:

w(z) = z^{3} + a_{1}z^{4} + (a_{1}^{2} + a_{2})z^{5} + (a_{1}^{3} + 2a_{1}a_{2} + a_{3})z^{6} + ⋯,
x(z) = z^{−2} − a_{1}z^{−1} − a_{2} − a_{3}z − (a_{4} + a_{1}a_{3})z^{2} − ⋯,
y(z) = −z^{−3} + a_{1}z^{−2} + a_{2}z^{−1} + a_{3} + (a_{4} + a_{1}a_{3})z − ⋯,
ω_{E}(z) = (1 + a_{1}z + (a_{1}^{2} + a_{2})z^{2} + (a_{1}^{3} + 2a_{1}a_{2} + 2a_{3})z^{3} + ⋯)dz,
F_{E}(z_{1}, z_{2}) = z_{1} + z_{2} − a_{1}z_{1}z_{2} − a_{2}(z_{1}^{2}z_{2} + z_{1}z_{2}^{2}) + · · · .

The formal group Ê associated to E is the formal group defined by the formal group law F_{E}(z_{1}, z_{2}) ∈ ℤ[a_{1}, …, a_{6}][[z_{1}, z_{2}]].

Let R be a complete local ring with maximal ideal 𝔭, and suppose that the a_{i}’s are in R. Then F_{E} converges for z_{1}, z_{2} ∈ 𝔭 and gives 𝔭 a group structure which we denote by Ê(𝔭). The series F_{E} also induces a group structure on the powers 𝔭^{r}, which gives Ê(𝔭) a natural filtration Ê(𝔭^{r}). The following is a general property of formal groups.

Proposition. The group Ê(𝔭) has no prime-to-𝔭 torsion. That is, if m ≢ 0 (mod 𝔭), then Ê(𝔭) has no non-trivial points of order m.

§12. Elliptic Curves Over Local Fields

For this section we set the following notation:

K a complete local field with normalized valuation v : K^{∗} → ℤ.

R the ring of integers of K. 𝔭 the maximal ideal of R. k the residue field k = R/𝔭.

A minimal Weierstrass equation for an elliptic curve E/K is a Weierstrass equation

E : y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6}

with a_{i} ∈ R and v(Δ) minimized. If char(k) ≠ 2, 3, then E always has a minimal equation with a_{1} = a_{2} = a_{3} = 0.

The reduction of E modulo 𝔭, denoted Ẽ, is then the curve over k defined by the equation

Ẽ : y^{2} + ã_{1}xy + ã_{3}y = x^{3} + ã_{2}x^{2} + ã_{4}x + ã_{6},

where the tilde denotes reduction modulo 𝔭. The curve Ẽ may be singular; its non-singular part is denoted Ẽ^{ns}. We say that

E has good (or stable) reduction if Ẽ is non-singular.

E has multiplicative (or semi-stable) reduction if Ẽ has a node. The reduction is called split if the tangent directions are defined over k, otherwise it is non-split.

E has additive (or unstable) reduction if Ẽ has a cusp.

Remark. It is becoming common to use the term “semi-stable” to refer to an elliptic curve which has either good or multiplicative reduction, while “unstable” retains its meaning of additive reduction.

Proposition. Let E/K be an elliptic curve. Then there is a finite extension K′/K such that E has either good or split multiplicative reduction over K′.

We define a filtration on E(K) by

E_{0}(K) = {P ∈ E(K) : P̃ ∈ Ẽ^{ns}(k)}
E_{1}(K) = {P ∈ E(K) : P̃ = Õ}
E_{r}(K) = {P ∈ E(K) : v(x(P)) = −2r} (for r ≥ 0).

Proposition. (a) There is an exact sequence

0 ⟶ E_{1}(K) ⟶ E_{0}(K) ⟶ Ẽ^{ns}(k) ⟶ 0.

(b) There is an isomorphism E_{1}(K) ≅ Ê(𝔭) which identifies E_{r}(K) ≅ Ê(𝔭^{r}).

(c) The quotient group E(K)/E_{0}(K) is finite. More precisely, it has order 1, 2, 3, or 4 unless Ẽ has split multiplicative reduction, in which case it is a cyclic group of order v(Δ).

Remark. Another description of the group E(K)/E_{0}(K) is that it is isomorphic to the group of components of the Néron model of E over R.

The following corollary is of fundamental importance.

Corollary. If E has good reduction at 𝔭 and m is relatively prime to char(k), then the reduction map

E(K)[m] ⟶ Ẽ(k)

is injective. Equivalently, the extension K(E[m]) generated by the m-torsion points is an unramified extension of K.

The following converse is often useful. Let I_{K̄/K} denote the inertia subgroup of G_{K̄/K}, and recall that a G_{K̄/K}-module M is said to be unramified if I_{K̄/K} acts trivially on M.

Theorem. (Criterion of Néron-Ogg-Shafarevich) The following are equivalent:

(i) E has good reduction. (ii) E[m] is unramified for infinitely many m prime to char(k). (iii) T_{ℓ}(E) is unramified for some ℓ ≠ char(k).

Corollary. If E_{1}/K and E_{2}/K are isogenous over K, then they either both have good reduction, or neither has good reduction.

An elliptic curve E/K is said to have potential good reduction if it acquires good reduction over a finite extension of K.

Proposition. An elliptic curve E/K has potential good reduction if and only if j(E) ∈ R.

§13. The Selmer and Shafarevich-Tate Groups

For this section we fix the following notation:

K a number field.

R the ring of integers of K. For any place v of K, we write K_{v} for the completion of K with respect to v.

If v is non-archimedean, we write R_{v}, 𝔭_{v}, and k_{v} for the ring of integers of K_{v}, maximal ideal of R_{v}, and residue field of R_{v} respectively.

Mordell-Weil Theorem. Let E/K be an elliptic curve. Then the group of rational points E(K) is a finitely generated abelian group.

In this section we will consider a weak form of the Mordell-Weil theorem which asserts that the quotient group E(K)/mE(K) is finite. This assertion is one of the main ingredients in the proof of the full theorem.

Fix an integer m ≥ 2 and consider the exact sequence

0 ⟶ E[m] ⟶ E(K̄) ⟶^{[m]} E(K̄) ⟶ 0.

Taking Galois cohomology gives the long exact sequence

→ E(K) →^{[m]} E(K) → H^{1}(G_{K̄/K}, E[m])

→ H^{1}(G_{K̄/K}, E(K̄)) →^{m} H^{1}(G_{K̄/K}, E(K̄)) →,

and this in turn gives the Kummer sequence for E/K,

0 → E(K)/mE(K) → H^{1}(G_{K̄/K}, E[m]) → H^{1}(G_{K̄/K}, E(K̄))[m] → 0.

Unfortunately, the group H^{1}(G_{K̄/K}, E[m]) need not be finite. However, any element of H^{1}(G_{K̄/K}, E[m]) which comes from a point of E(K) will necessarily come from a point in E(K_{v}) for every completion of K. In other words, if we consider the Kummer sequence for E/K_{v} and restriction maps on cohomology, we get a commutative diagram

0→ E(K)/mE(K) → H^{1}(G_{K̄/K}, E[m]) → H^{1}(G_{K̄/K}, E(K̄))[m] →0.
↓ ↓ ↓
0→∏_{v} E(K_{v})/mE(K_{v})→∏_{v} H^{1}(G_{K̄_{v}/K_{v}}, E[m])→∏_{v} H^{1}(G_{K̄_{v}/K_{v}}, E(K̄_{v}))[m]→0.

This suggests the following definitions: The m-Selmer group of E/K is the group

S^{(m)}(E/K) = ker{H^{1}(G_{K̄/K}, E[m]) ⟶ ∏_{v} H^{1}(G_{K̄_{v}/K_{v}}, E(K̄_{v}))}.

The Shafarevich-Tate group of E/K is the group

� (E/K) = ker{H^{1}(G_{K̄/K}, E(K̄)) ⟶ ∏_{v} H^{1}(G_{K̄_{v}/K_{v}}, E(K̄_{v}))}.

It is immediate from these definitions that there is an exact sequence

0 ⟶ E(K)/mE(K) ⟶ S^{(m)}(E/K) ⟶ � (E/K)[m] ⟶ 0.

Theorem. The Selmer group S^{(m)}(E/K) is finite, and hence E(K)/mE(K) and � (E/K)[m] are also finite.

Proof sketch. Let 𝔭 be a prime of K not dividing m for which E has good reduction. Then E[m] ↪ Ẽ(k_{𝔭}) (i.e., the m-torsion injects into the reduction modulo 𝔭). This implies that any cocycle in S^{(m)}(E/K) is unramified at 𝔭, so S^{(m)}(E/K) consists of cocycles which are unramified outside a finite set of primes, specifically the set

{𝔭 : E has bad reduction at 𝔭} ∪ {𝔭 : 𝔭 divides m}.

Finally, it is an elementary consequence of Dirichlet’s unit theorem and the finiteness of the class group that for any finite G_{K̄/K}-module M and any finite set of places S, the set of cocycles in H^{1}(G_{K̄/K}, M) unramified outside S is finite.

Remark. More generally, if ϕ : E → E′ is an isogeny of elliptic curves defined over K, there is an associated Kummer sequence

0 → E′(K)/ϕ(E(K)) → H^{1}(G_{K̄/K}, E[ϕ]) → H^{1}(G_{K̄/K}, E(K̄))[ϕ] → 0.

Using this, one defines in an analogous fashion the ϕ-Selmer group S^{(ϕ)}(E/K), which can be shown to be finite, and an associated exact sequence

0 → E′(K)/ϕ(E(K)) → S^{(ϕ)}(E/K) → � (E/K)[ϕ] → 0.

The group H^{1}(G_{K̄/K}, E(K̄)) can also be interpreted as the collection of homogeneous spaces of E/K. Generally, one defines the Weil-Châtelet group of E/K to be^{1}Actually, this is cheating a little bit. The Weil-Châtelet group is actually the group of principal homogeneous spaces for E/K. That is, an element of WC(E/K) consists of a curve C/K and a simply transitive algebraic group action of E on C defined over K. Further, in defining the associated cocycle, we need to choose an isomorphism f : C → E with the property that f^{σ} ∘ f^{−1} is a pure translation map on E.

WC(E/K) = \begin{cases}K-isomorphism classes of smooth projective curves \\ C/K such that C is isomorphic to E over K̄ \end{cases} \} .

A homogeneous space C/K represents the zero element of WC(E/K) if and only if C(K) is non-empty.

There is a natural isomorphism WC(E/K) ≅ H^{1}(G_{K̄/K}, E(K̄)) defined in the following way. Let [C/K] ∈ WC(E/K) and choose an isomorphism f : C → E defined over K̄ and a point P ∈ C(K̄). Then the cocycle

G_{K̄/K} ⟶ E(K̄), σ ⟼ f(P^{σ}) − f(P).

represents the cohomology class in H^{1}(G_{K̄/K}, E(K̄)) associated to C/K. With this identification, the subgroup � (E/K) in WC(E/K) consists of all homogeneous spaces C/K such that C(K_{v}) is non-empty for all places v of K.

Remark. Each Selmer group S^{(m)}(E/K) is effectively computable in theory, and frequently computable in practice. At present, there is no proven effective method for determining which part of S^{(m)}(E/K) comes from E(K)/mE(K) and which part comes from � (E/K).

1†

§14. Discriminants, Conductors, and L-Series

Let K be a number field and E/K an elliptic curve. For each prime 𝔭 of K we can consider a minimal Weierstrass equation for the local field K_{𝔭} and its discriminant Δ_{𝔭}. The minimal discriminant of E/K is the integral ideal

D_{E/K} = ∏_{𝔭} 𝔭^{v_{𝔭}(Δ_{𝔭})}.

If K has class number one (e.g., K = ℚ), it is possible to find a Weierstrass equation

E : y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6}

which is simultaneously minimal at all primes of K. The discriminant Δ of this global minimal Weierstrass equation is then equal to the discriminant of E/K (and is uniquely determined up to multiplication by the 12^{th}-power of a unit.)

The minimal discriminant is a measure of the bad reduction of E. Another such measure is the conductor of E/K. This is an ideal

N_{E/K} = ∏_{𝔭} 𝔭^{f_{𝔭}(E/K)},

where the exponents f_{𝔭}(E/K) are given by

f_{𝔭}(E/K) = \{ \begin{matrix}0 & if E has good reduction at 𝔭, \\ 1 & if E has multiplicative reduction at 𝔭, \\ 2 & if E has additive reduction at 𝔭 and 𝔭 ∤ 6. \end{matrix}

If 𝔭 has residue characteristic 2 or 3 and E has additive reduction at 𝔭, then the exponent of the conductor is equal to 2 + δ_{𝔭}, where δ_{𝔭} is a measure of the wild ramification in the extensions K_{𝔭}(E[m])/K_{𝔭}. Over ℚ, for example, the conductor exponents are bounded by

f_{3} ≤ 5  and  f_{2} ≤ 8.

Even in characteristics 2 and 3, the conductor can easily be computed using an algorithm of Tate and a formula of Ogg and Saito.

Remark. If E has everywhere semi-stable (i.e., good or multiplicative) reduction, then its conductor is simply the product of its primes of bad reduction.

For each prime 𝔭 of K, let q_{𝔭} be the norm of 𝔭. If E has good reduction at 𝔭, we also let

a_{𝔭} = q_{𝔭} + 1 − #Ẽ(k_{𝔭}).

The local factor of the L-series of E at 𝔭 is the polynomial

L_{𝔭}(T) = \{ \begin{matrix}1 − a_{𝔭}T + q_{𝔭}T^{2} & if E has good reduction at 𝔭, \\ 1 − T & if E has split multiplicative reduction at 𝔭, \\ 1 + T & if E has non-split multiplicative reduction at 𝔭, \\ 1 & if E has additive reduction at 𝔭. \end{matrix} In all cases the relation

L_{𝔭}(1/q_{𝔭}) = #Ẽ^{ns}(k_{𝔭})/q_{𝔭}

holds. The global (or Hasse-Weil) L-series of E/K is then defined by the Euler product

L(E/K, s) = ∏_{𝔭} L_{𝔭}(q_{𝔭}^{−s})^{−1}.

It is not hard to prove that isogenous curves have the same L-series. The converse is a consequence of (and in fact equivalent to) Faltings’ isogeny theorem.

Theorem. Two elliptic curves E/K and E′/K are isogenous over K if and only if L(E/K, s) = L(E′/K, s).

The estimate |a_{𝔭}| ≤ 2q_{𝔭}^{1/2} implies that the Euler product converges and gives an analytic function in the half-plane Re(s) > 3/2.

Conjecture. The L-series L(E/K, s) has an analytic continuation to the entire complex plane and satisfies a functional equation relating its values at s and 2 − s.

Over ℚ, the conjecture asserts that the function

ξ(E/ℚ, s) = N_{E/K}^{s/2}(2π)^{−s}Γ(s)L(E/ℚ, s)

has an analytic continuation and satisfies the functional equation

ξ(E/ℚ, 2 − s) = ±ξ(E/ℚ, s).

This is known to be true for modular elliptic curves.

§15. Duality Theory

There are both local and global duality theorems for the cohomology of an elliptic curve.

Local Duality Theorem. (Tate) Let K be a complete local field and let E/K be an elliptic curve. There is a bilinear, non-degenerate pairing

E(K) × H^{1}(G_{K̄/K}, E(K̄)) ⟶ ℚ/ℤ.

More precisely, the pairing induces a duality of locally compact groups, where E(K) is given the topology induced by the topology on K and H^{1}(G_{K̄/K}, E(K̄)) is given the discrete topology.

Here is one of the many equivalent definitions of the Tate pairing. Let P ∈ E(K) and ξ ∈ H^{1}(G_{K̄/K}, E(K̄)). Take any integer m ≥ 1 which kills ξ and consider the short exact sequence

0 ⟶ E(K)/mE(K) ⟶^{δ} H^{1}(G_{K̄/K}, E[m]) ⟶ H^{1}(G_{K̄/K}, E(K̄))[m] ⟶ 0.

Push P forward to δP ∈ H^{1}(G_{K̄/K}, E[m]), and choose some η ∈ H^{1}(G_{K̄/K}, E[m]) which goes to ξ. Then the cup product δP ∪ η is in H^{2}(G_{K̄/K}, E[m] ⊗ E[m]). Now use the Weil pairing e_{m} : E[m] ⊗ E[m] → μ_{m} to get the desired cohomology class

e_{m}(δP ∪ η) ∈ H^{2}(G_{K̄/K}, μ_{m}) ↪ H^{2}(G_{K̄/K}, K̄^{∗}) = Br(K) ≅ ℚ/ℤ. Note that the last isomorphism is the identification of the Brauer group of K with ℚ/ℤ provided by local class field theory.

The global duality theorem is only fully satisfactory in those cases that � is known to be finite.

Global Duality Theorem. (Cassels) Let K be a number field and let E/K be an elliptic curve. There is an alternating bilinear pairing

� (E/K) × � (E/K) ⟶ ℚ/ℤ

whose kernel on either side is the group of divisible elements of � (E/K). In particular, if � (E/K) is finite, then the pairing is perfect and #� (E/K) is a square.

The definition of the pairing on � is considerably more complicated, so we will not include it here.

§16. Rational Torsion and the Image of Galois

Let E/K be an elliptic curve defined over a number field. The ℓ-adic representation

ρ_{ℓ} : G_{K̄/K} ⟶ Aut(T_{ℓ}(E)) ≅ GL_{2}(ℤ_{ℓ})

determines many of the arithmetic properties of E. If E has complex multiplication, ρ_{ℓ} can be described in terms of class field theory. The following two important results give a further description of ρ_{ℓ}.

Theorem. (Serre) Assume the E does not have complex multiplication.

(a) The image of ρ_{ℓ} is of finite index in GL_{2}(ℤ_{ℓ}) for all primes ℓ.

(b) The image of ρ_{ℓ} is equal to GL_{2}(ℤ_{ℓ}) for all but finitely many primes ℓ.

Theorem. (Faltings) Let E/K and E′/K be elliptic curves. Then the natural map

Hom_{K}(E, E′) ⊗ ℤ_{ℓ} ⟶ Hom(T_{ℓ}(E), T_{ℓ}(E′))^{G_{K̄/K}}

is an isomorphism.

It is conjectured that the total index of the ρ_{ℓ}’s is bounded independently of the curve E. That is, for a fixed number field K and any non-CM elliptic curve E/K, the quantity

∏_{ℓ}[GL_{2}(ℤ_{ℓ}) : ρ_{ℓ}(G_{K̄/K})]

is bounded by a number depending only on K. In particular, the torsion subgroup E(K)_{tors} should be bounded independently of E. This last statement has recently been proven.

Theorem. (a) (Mazur) Let E/ℚ be an elliptic curve. Then E(ℚ)_{tors} is one of the following 15 groups:

ℤ/nℤ with 1 ≤ n ≤ 10 or n = 12, or ℤ/2ℤ × ℤ/2nℤ with 1 ≤ n ≤ 4.

(b) (Kamienny, Mazur, Merel) Let K be a number field of degree d. Then there is a constant c(d) so that for every elliptic curve E/K, the torsion subgroup of E/K satisfies #E(K)_{tors} ≤ c(d).

§17. Tate Curves

Let K be a local field which is complete with respect to a non-archimedean absolute value | · |_{v}. The analytic parametrization ℂ/L → E(ℂ) of an elliptic curve over ℂ does not have a direct non-archimedean analogue, because K has no discrete subgroups. However, the situation changes when one considers ℂ^{∗}/q^{ℤ}, since any q ∈ K^{∗} with |q|_{v} < 1 will generate a discrete subgroup. It turns out that suitably normalized q-expansions of ℘, ℘′ and G_{2k} give a v-adic analytic isomorphism from K^{∗}/q^{ℤ} to an elliptic curve E_{q} defined over K. However, not all elliptic curves over K arise in this fashion, as can be seen by examining the j-invariant

j(E_{q}) = j(q) = q^{−1} + 744 + 196884q + 21493760q^{2} + · · · .

It is clear that |j(q)|_{v} > 1, and so E_{q} must have multiplicative reduction.

Theorem. (Tate) Let q ∈ K^{∗} with |q|_{v} < 1. There is an elliptic curve E_{q}/K and a G_{K̄/K}-equivariant v-analytic isomorphism

ϕ : K̄^{∗}/q^{ℤ} ⟶ E_{q}(K̄).

The set of curves {E_{q} : q ∈ K^{∗}, |q|_{v} < 1} is exactly the set of elliptic curves over K with split multiplicative reduction.

If E/K satisfies |j(E)|_{v} > 1 but does not have split multiplicative reduction, then it is isomorphic over K̄ to some E_{q}. More precisely, there is a unique quadratic extension L/K such that E is isomorphic to E_{q} over L, and then

E(K) ≅ {u ∈ L^{∗} : N_{L/K}(u) ∈ q^{ℤ}} / q^{ℤ}.

Further, the extension L/K is unramified if and only if E has non-split multiplicative reduction.

§18. Heights and Descent

Let K be a number field and let M_{K} be the set of inequivalent absolute values on K, suitably normalized. The height on ℙ^{n} is the function

h : ℙ^{n}(K) ⟶ [0, ∞), h([x_{0}, …, x_{n}]) = ∑_{v∈M_{K}} log max_{0≤i≤n} |x_{i}|_{v}.

With the appropriate normalization, the height is independent of the choice of homogeneous coordinates and of the field K. For this reason, h is often called the absolute logarithmic height. The height on an elliptic curve E/K given by a Weierstrass equation is

h : E(K̄) → [0, ∞), h(P) = h([x_{P} , 1]).

Proposition. The height on an elliptic curve E/K has the following properties:

(i) h(mP) = m^{2}h(P) + O(1) for all P ∈ E(K̄). (ii) h(P + Q) + h(P − Q) = 2h(P) + 2h(Q) + O(1) for all P, Q ∈ E(K̄). (iii) For any H, the set {P ∈ E(K) : h(P) ≤ H} is finite. (The O(1) constants depend on E and, in (i), also on m.)

The canonical (or Néron-Tate) height on E/K is defined by the limit

ĥ : E(K̄) → [0, ∞),  ĥ(P) = lim_{n→∞} 4^{−n}h(2^{n}P).

Theorem. The canonical height is a positive semi-definite quadratic form on E(K) with the following properties:

(i) ĥ(P) = h(P) + O(1) for all P ∈ E(K̄). (ii) ĥ(P) = 0 if and only if P ∈ E_{tors}. Further, ĥ extends ℝ-linearly to give a positive definite quadratic form on the vector space E(K) ⊗ ℝ.

Using the canonical height, it is easy to complete the proof of the Mordell-Weil theorem.

Proof (of the Mordell-Weil theorem). The weak Mordell-Weil theorem says that E(K)/mE(K) is finite, so let P_{1}, …, P_{n} ∈ E(K) be coset representatives. Let H = max ĥ(P_{i}). I claim that the set

S = {P ∈ E(K) : ĥ(P) ≤ H}

is a generating set for E(K). Note this set is finite, since ĥ = h + O(1). Suppose that it does not generate. Let Q ∈ E(K) be a point of minimal canonical height not in the span of S. By assumption, Q = P_{i} +mR for some i and some R ∈ E(K). Then R cannot be in the span of S, so

ĥ(Q) ≤ ĥ(R) = \frac{1}{m^{2}} ĥ(mR) = \frac{1}{m^{2}} ĥ(Q−P_{i}) ≤ \frac{2}{m^{2}} (ĥ(Q)+ĥ(P_{i})) ≤ \frac{2}{m^{2}} (ĥ(Q)+H).

This implies that

ĥ(Q) ≤ \frac{2}{m^{2} − 2}H ≤ H,

which says that Q ∈ S. This contradiction completes the proof.

The bilinear form associated to the canonical height is denoted

⟨P, Q⟩_{E} = \frac{1}{2}(ĥ(P + Q) − ĥ(P) − ĥ(Q)).

Using this, the elliptic regulator of E/K is defined to be the quantity

R(E/K) = det(⟨P_{i}, P_{j}⟩_{E})_{1≤i,j≤r},

where P_{1}, …, P_{r} is a basis for E(K)/E(K)_{tors}. The elliptic regulator satisfies R(E/K) > 0.

§19. The Conjecture of Birch and Swinnerton-Dyer

The conjecture of Birch and Swinnerton-Dyer relates the L-series of an elliptic curve to many of its other arithmetic invariants. For simplicity, we will restrict ourselves to K = ℚ. Let E/ℚ be an elliptic curve, and let

Ω_{∞} = ∫_{E(ℝ)} |ω|,

where ω is the invariant differential on a minimal Weierstrass equation. Further, for each prime p, let

Ω_{p} = #E(ℚ_{p})/E_{0}(ℚ_{p}).

(Thus if E has good reduction at p, then Ω_{p} = 1. It is possible to express the Ω_{p}’s as the values of p-adic integrals, very much analogous to the archimedean integral defining Ω_{∞}.)

Conjecture of Birch and Swinnerton-Dyer. Let E/ℚ be an elliptic curve.

(a) ord_{s=1} L(E/ℚ, s) = E(ℚ).

(b) Let r = rank E(ℚ). Then

lim_{s→1} \frac{L(E/ℚ, s)}{(s − 1)^{r}} = Ω_{∞} ∏_{p} Ω_{p} \frac{R(E/ℚ) · #� (E/ℚ)}{(#E(ℚ)_{tors})^{2}}.

§20. Complex Multiplication

Recall that an elliptic curve E is said to have complex multiplication if its endomorphism ring End(E) is strictly larger than ℤ. If this happens, then the algebra K = End(E) ⊗ ℚ is a quadratic imaginary field and R = End(E) is an order in K. Fix a Weierstrass equation for E of the form

E : y^{2} = x^{3} + Ax + B with discriminant Δ = −16(4A^{3} + 27B^{2}) ≠ 0,

and define the Weber function on E to be the function

ϕ_{E}(P) = \{ \begin{matrix}(AB/Δ)x(P) & if j(E) ≠ 0, 1728, \\ (A^{2}/Δ)x(P)^{2} & if j(E) = 1728, \\ (B/Δ)x(P)^{3} & if j(E) = 0. \end{matrix}

(One can check that ϕ_{E} does not depend on the choice of Weierstrass equation.)

Theorem. With notation as above, suppose that R is the full ring of integers of K.

(a) The j-invariant j(E) is an algebraic integer.

(b) The field H = K(j(E)) is the Hilbert class field of K (i.e., H is the maximal abelian unramified extension of K).

(c) The field H({ϕ_{E}(T) : T ∈ E_{tors}}) is the maximal abelian extension K^{ab} of K.

It is possible to describe the action of G_{K^{ab}/K} on the numbers ϕ_{E}(T) via the Artin map, although this is most efficiently done using an adelic formulation. We will be content to describe the action on j(E). For each prime ideal 𝔭 of K, let F_{𝔭} ∈ G_{H/K} be the Frobenius element corresponding to 𝔭. Further, choose a lattice L ⊂ ℂ so that there is a analytic isomorphism ℂ/L ≅ E(ℂ), and define a new elliptic curve 𝔭 ∗ E to be the elliptic curve corresponding to the lattice 𝔭^{−1}L. Then the action of G_{H/K} on j(E) is determined by the relation

j(E)^{F_{𝔭}} = j(𝔭 ∗ E).

Associated to an elliptic curve E/F with complex multiplication by the full ring of integers of K is a Grössencharacter

ψ_{E/F} : A_{F}^{∗} ⟶ K^{∗}

roughly determined by the condition that for each prime 𝔓 of F, the map

[ψ_{E/F} (𝔓)] : E ⟶ E

reduces modulo 𝔓 to the 𝔓-Frobenius map on the reduced curve Ẽ. We also recall that to any Grössencharacter ψ : A_{F}^{∗} → K^{∗} is attached the Hecke L-series

L(s, ψ) = ∏_{𝔓}(1 − ψ(𝔓) N 𝔓^{−s})^{−1},

which has an analytic continuation to all of ℂ and satisfies a functional equation.

Theorem. (Deuring) Let E/F be an elliptic curve with complex multiplication by the full ring of integers of K.

(a) If K ⊂ F, then

L(E/F, s) = L(s, ψ_{E/F})L(s, \overline{ψ_{E/F}}).

(b) If K ⊄ F, let F′ = F K. Then

L(E/F, s) = L(s, ψ_{E/F′}).

§21. Integral Points

Let K be a number field, let S be a finite set of places of K including all archimedean places, and let R_{S} be the ring of S-integers of K. Let

E : y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6}

be a Weierstrass equation for E/K with integral coefficients a_{1}, a_{2}, a_{3}, a_{4}, a_{6} ∈ R_{S}, and consider the set of S-integral points on E,

E(R_{S}) = {P = (x, y) ∈ E(K) : x, y ∈ R_{S}}.

More generally, we can look at S-integral points relative to an arbitrary coordinate function on E. A fundamental theorem of Siegel says that such sets are finite.

Theorem. (Siegel) For any non-constant function f ∈ K(E), the set of S-integral points of E relative to f,

E_{f}(R_{S}) = {P ∈ E(K) : f(P) ∈ R_{S}},

is a finite set.

Siegel actually proves a more precise statement. To avoid introducing too much notation, we will only describe it for K = ℚ and R_{S} = ℤ.

Theorem. (Siegel) Let E/ℚ be an elliptic curve, let f ∈ ℚ(E) be a non-constant function, and for each point P ∈ E(ℚ), write

f(P) = a_{P} /b_{P} with a_{P} , b_{P} ∈ ℤ and gcd(a_{P} , b_{P}) = 1.

(If f(P) = ∞, set a_{P} = 1 and b_{P} = 0.) Then

lim_{\begin{matrix}P ∈E(ℚ) \\ h(f(P))→∞ \end{matrix}} \frac{log |a_{P} |}{log |b_{P} |} = 1.

Siegel’s theorems use methods from the theory of Diophantine approximation and are not effective. Baker used his results on linear forms in logarithms to give effective bounds for the size of integral points on elliptic curves. These bounds have been improved over the years, but are still quite large.

Shafarevich used the finiteness of S-integral points on the curve y^{2} = x^{3} + D to prove the following finiteness theorem for elliptic curves with prescribed bad reduction.

Theorem. Fix a finite set S of primes of K. Then there are only finitely many K-isomorphism classes of elliptic curves E/K which have good reduction at all primes not in S.

Faltings subsequently proved that the same result is true for curves of any fixed genus and for abelian varieties of any fixed dimension.

Acknowledgments. I would like to thank Rob Gross, Alice Silverberg, John Tate, and Rob Tubbs for pointing out some inaccuracies in the original draft of these notes.

References

1. A. Knapp, Elliptic Curves, Math. Notes 40, Princeton University Press, 1992.

2. N. Koblitz, Introduction to Elliptic Curves and Modular Forms, Springer-Verlag, 1984.

3. S. Lang, Elliptic Curves: Diophantine Analysis, Springer-Verlag, 1978.

4. , Elliptic Functions, Graduate Texts in Math., vol. 112, 2nd edition, Springer-Verlag, New York, 1987.

5. J.H. Silverman, The Arithmetic of Elliptic Curves, Graduate Texts in Math., vol. 106, Springer-Verlag, Berlin and New York, 1986.

6. J.H. Silverman, Advanced Topics in the Arithmetic of Elliptic Curves, Graduate Texts in Math., vol. 151, Springer-Verlag, Berlin and New York, 1994.

7. J. Tate, The arithmetic of elliptic curves, Inventiones Math. 23 (1974), 179–206.

Mathematics Department Box 1917 Brown University Providence, RI 02912 USA E-mail address: JHS@GAUSS.MATH.BROWN.EDU