ELLIPTIC CURVES

J.S. MILNE

August 21, 1996; v1.01

Abstract. These are the notes for Math 679, University of Michigan, Winter 1996, exactly as they were handed out during the course except for some minor corrections.

Please send comments and corrections to me at jmilne@umich.edu using “Math679” as the subject.

Contents

Introduction 1 Fast factorization of integers Congruent numbers Fermat’s last theorem

1. Review of Plane Curves 2 Affine plane curves Projective plane curves

2. Rational Points on Plane Curves. 6 Hensel’s lemma A brief introduction to the p-adic numbers Some history

3. The Group Law on a Cubic Curve 12

4. Functions on Algebraic Curves and the Riemann-Roch Theorem 14 Regular functions on affine curves Regular functions on projective curves The Riemann-Roch theorem The group law revisited Perfect base fields

5. Definition of an Elliptic Curve 19 Plane projective cubic curves with a rational inflection point General plane projective curves Complete nonsingular curves of genus 1 The canonical form of the equation The group law for the canonical form

Copyright 1996 J.S. Milne. You may make one copy of these notes for your own personal use.

6. Reduction of an Elliptic Curve Modulo p 23 Algebraic groups of dimension 1 Singular cubic curves Reduction of an elliptic curve Semistable reduction Reduction modulo 2 and 3 Other fields

7. Elliptic Curves over ℚ_{p} 29

8. Torsion Points 32 Formulas Solution to Exercise 4.8

9. Néron Models 37 Weierstrass minimal models The work of Kodaira The complete Néron model Summary

10. Elliptic Curves over the Complex Numbers 41 Lattices and bases Quotients of ℂ by lattices Doubly periodic functions The holomorphic maps ℂ/Λ → ℂ/Λ′ The Weierstrass ℘ function Eisenstein series The field of doubly periodic functions The elliptic curve E(Λ) Classification of elliptic curves over ℂ Torsion points Endomorphisms Appendix: Resultants

11. The Mordell-Weil Theorem: Statement and Strategy 54

12. Group cohomology 55 Cohomology of finite groups Cohomology of infinite Galois groups

13. The Selmer and Tate-Shafarevich groups 59

ELLIPTIC CURVES iii

14. The Finiteness of the Selmer Group 60 Proof of the finiteness of the Selmer group in a special case Proof of the finiteness of the Selmer group in the general case

15. Heights 65 Heights on ℙ^{1} Heights on E

16. Completion of the Proof of the Mordell-Weil Theorem, and Further Remarks 70

The Problem of Computing the Rank of E(ℚ) The Néron-Tate Pairing Computing the rank

17. Geometric Interpretation of the Cohomology Groups; Jacobians 75 Principal homogeneous spaces (of sets) Principal homogeneous spaces (of curves) The classification of principal homogeneous spaces Geometric Interpretation of H^{1}(ℚ, E_{n}) Geometric Interpretation of the Exact Sequence Twists of Elliptic Curves Curves of genus 1 The classification of elliptic curves over ℚ (summary)

18. The Tate-Shafarevich Group; Failure Of The Hasse Principle 83

19. Elliptic Curves Over Finite Fields 86 The Frobenius map; curves of genus 1 over 𝔽_{p} Zeta functions of number fields Zeta functions of affine curves over finite fields Expression of Z(C, T) in terms of the points of C Zeta functions of plane projective curves The rationality of the zeta function of an elliptic curve Proof of the Riemann hypothesis for elliptic curves A Brief History of Zeta

20. The Conjecture of Birch and Swinnerton-Dyer 100 Introduction The zeta function of a variety over ℚ The zeta function of an elliptic curve over ℚ Statement of the Conjecture of Birch and Swinnerton-Dyer What’s known about the conjecture of B-S/D 21. Elliptic Curves and Sphere Packings 106

Sphere packings Example

22. Algorithms for Elliptic Curves 110

23. The Riemann Surfaces X_{0}(N) 112 The notion of a Riemann surface Quotients of Riemann surfaces by group actions The Riemann surfaces X(Γ) The topology on Γ\ℍ^{∗} The complex structure on Γ_{0}(N)\ℍ^{∗} The genus of X_{0}(N)

24. X_{0}(N) as an Algebraic Curve over ℚ 119 Modular functions The meromorphic functions on X_{0}(1) The meromorphic functions on X_{0}(N) The curve X_{0}(N) over ℚ The points on the curve X_{0}(N) Variants

25. Modular Forms 125 Definition of a modular form The modular forms for Γ_{0}(1)

26. Modular Forms and the L-series of Elliptic Curves 128 Dirichlet Series The L-series of an elliptic curve L-series and isogeny classes The L-series of a modular form Modular forms whose L-series have a functional equations Modular forms whose L-functions are Euler products Definition of the Hecke operators Linear algebra: the spectral theorem The Petersson inner product New forms: the theorem of Atkin and Lehner

27. Statement of the Main Theorems 140

28. How to get an Elliptic Curve from a Cusp Form 142 Differentials on Riemann surfaces The Jacobian variety of a Riemann surface Construction of the elliptic curve over ℂ

Construction of the elliptic curve over ℚ

29. Why the L-Series of E Agrees with the L-Series of f 147 The ring of correspondences of a curve The Hecke correspondence The Frobenius map Brief review of the points of order p on elliptic curves The Eichler-Shimura relation The zeta function of an elliptic curve revisited The action of the Hecke operators on H_{1}(E, ℤ) The proof that c(p) = a_{p}

30. Wiles’s Proof 153

31. Fermat, At Last 156

Bibliography 157

Introduction

An elliptic curve over a field k is a nonsingular complete curve of genus 1 with a distinguished point. If chark ≠ 2, 3, it can be realized as a plane projective curve

Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, 4a^{3} + 27b^{2} ≠ 0,

and every such equation defines an elliptic curve over k. As we shall see, the arithmetic theory of elliptic curves over ℚ (and other algebraic number fields) is a rich a beautiful subject. Many important phenomena first become visible in the study elliptic curves, and elliptic curves have been used solve some very famous problems that, at first sight, appear to have nothing to do with elliptic curves. I mention three such problems.

Fast factorization of integers. There is an algorithm for factoring integers that uses elliptic curves and is in many respects better than previous algorithms. See [K2, VI.4], [ST,IV.4], or [C2, Chapter26]. People have been factoring integers for centuries, but recently the topic has become of practical significance: given an integer n which is the product n = pq of two (large) primes p and q, there is a code for which anyone who knows n can encode a message, but only those who know p, q can decode it. The security of the code depends on no unauthorized person being able to factor n.

Congruent numbers. A natural number n is said to be congruent if it occurs as the area of a right triangle whose sides have rational length. If we denote the lengths of the sides by x, y, z, then n will be congruent if and only if the equations

x^{2} + y^{2} = z^{2}, n = \frac{1}{2}xy

have simultaneous solutions in ℚ. The problem was of interest to the Greeks, and was discussed systematically by Arab scholars in the tenth century. Fibonacci showed that 5 and 6 are congruent, Fermat that 1, 2, 3, are not congruent, and Euler proved that 7 is congruent, but the problem appeared hopeless until in 1983 Tunnell related it to elliptic curves.

Fermat’s last theorem. Recently Wiles proved that all elliptic curves over ℚ (with a mild restriction) arise in a certain fashion from modular forms. It follows from his theorem, that for an odd prime p ≠ 3, there does not exist an elliptic curve over ℚ whose equation has the form

Y^{2} = X(X + a)(X − b)

with a, b, a + b all p^{th} powers of integers, i.e., there does not exist a nontrivial solution in ℤ to the equation

X^{p} + Y^{p} = Z^{p};

—Fermat’s Last Theorem is proved!

The course will be an introductory survey of the subject—often proofs will only be sketched, but I will try to give precise references for everything.

There are many excellent books on subject—see the Bibliography. Silverman [S1,S2] is becoming the standard reference.

1. Review of Plane Curves

Affine plane curves. Let k be a field. The affine plane over k is 𝔸^{2}(k) = k^{2}.

A nonconstant polynomial f ∈ k[X, Y], assumed to have no repeated factor in k^{al}[X, Y], defines a plane affine curve C_{f} over k whose points with coordinates in any field K ⊃ k are the zeros of f in K^{2}:

C_{f}(K) = {(x, y) ∈ K^{2} | F (x, y) = 0}.

The curve C is said to be irreducible if f is irreducible, and it is said be geometrically irreducible if f remains irreducible over k^{al} (equivalently, over any algebraically closed field containing k).

Since k[X, Y] is a unique factorization domain, we can write any f as above as a product f = f_{1}f_{2} ⋯ f_{r} of distinct irreducible polynomials, and then

C_{f} = C_{f_{1}} ∪ ⋯ ∪ C_{f_{r}}

with the C_{f_{i}} irreducible curves. The C_{f_{i}} are called the irreducible components of C_{f}.

Example 1.1. (a) Let f_{1}(X, Y) be an irreducible polynomial in ℚ[\sqrt{2}][X, Y], no constant multiple of which lies ℚ[X, Y], and let f̄_{1}(X, Y) be its conjugate over ℚ (i.e., replace each \sqrt{2} with −\sqrt{2}). Then f(X, Y) =_{df} f_{1}(X, Y)f̄_{1}(X, Y) lies in ℚ[X, Y] because it is fixed by the Galois group of ℚ[\sqrt{2}]/ℚ. The curve C_{f} is irreducible but not geometrically irreducible.

(b) Let k be a field of characteristic p. Assume k is not perfect, so that there exists an a ∈ k, a ∉ k^{p}. Consider

f(X, Y) = X^{p} + aY^{p}.

Then f is irreducible in k[X, Y], but in k^{al}[X, Y] it equals (X+αY)^{p} where α^{p} = a (remember, the binomial theorem takes on a specially simple form for p^{th} powers in characteristic p). Thus f does not define a curve.

We define the partial derivatives of a polynomial by the obvious formulas.

Let P = (a, b) ∈ C_{f}(K), some K ⊃ k. If at least one of the partial derivatives \frac{∂f}{∂X}, \frac{∂f}{∂Y} is nonzero at P, then P is said to be nonsingular, and the tangent line to C at P is

(\frac{∂f}{∂X} )_{P} (X − a) + (\frac{∂f}{∂Y} )_{P} (Y − b) = 0.

A curve C is said to be nonsingular if all the points in C(k^{al}) are nonsingular. A curve or point that is not nonsingular said to be singular.

Aside 1.2. Let f(x, y) be a real-valued function on ℝ^{2}. In Math 215 one learns that ∇f =_{df} (\frac{∂f}{∂X} , \frac{∂f}{∂Y} ) is a vector field on ℝ^{2} that, at any point P = (a, b) ∈ ℝ^{2}, points in the direction in which f(x, y) increases most rapidly (i.e., has the most positive directional derivative). Hence (∇f)_{P} is normal to any level curve f(x, y) = c through P, and the line

(∇f)_{P} · (X − a, Y − b) = 0

passes through P and is normal to the normal to the level curve. It is therefore the tangent line.

Example 1.3. Consider the curve

C : Y^{2} = X^{3} + aX + b.

At a singular point of C

2Y = 0, 3X^{2} + a = 0, Y^{2} = X^{3} + aX + b.

Assume char k ≠ 2. Hence Y = 0 and X is a common root of X^{3} + aX + b and its derivative, i.e., a double root of X^{3} + aX + b. Thus C is nonsingular ⟺ X^{3} + aX + b has no multiple root (in k^{al}) ⟺ its discriminant 4a^{3} + 27b^{2} is nonzero.

Assume char k = 2. Then C always has a singular point (possibly in some extension field of k), namely, (α, β) where α^{2} + a = 0 and β^{2} = α^{3} + aα + b.

Let P = (a, b) ∈ C_{f}(K). We can write f as a polynomial in X − a and Y − b with coefficients in K, say,

f(X, Y) = f_{1}(X − a, Y − b) + ⋯ + f_{n}(X − a, Y − b)

where f_{i} is homogeneous of degree i in X − a and Y − b (this the Taylor expansion of f!). The point P is nonsingular if and only if f_{1} ≠ 0, in which case the tangent line to C_{f} at P has equation f_{1} = 0.

Suppose that P is singular, so that

f(X, Y) = f_{m}(X − a, Y − b) + terms of higher degree,

where f_{m} ≠ 0, m ≥ 2. Then P is said to have multiplicity m on C, denoted m_{P} (C). If m = 2, then P is called a double point. For simplicity, take (a, b) = (0, 0). Then (over k^{al})

f_{m}(X, Y) = ∏ L_{i}^{r_{i}}

where each L_{i} is a homogeneous polynomial c_{i}X + d_{i}Y of degree one with coefficients in k^{al}. The lines L_{i} = 0 are called the tangent lines to C_{f} at P, and r_{i} is called multiplicity of L_{i}. The point P is said to be an ordinary singularity if the tangent lines are all distinct, i.e., r_{i} = 1 for all i. An ordinary double point is called a node.

Example 1.4. The curve Y^{2} = X^{3} + aX^{2} has a singularity at (0, 0). If a ≠ 0, it is a node, and the tangent lines at (0, 0) are Y = ±\sqrt{a}X. They are defined over k if and only if a is a square in k.

If a = 0, the singularity is a cusp. (A double point P on a curve C is called a cusp if there is only one tangent line L to C at P, and, with the notation defined below, I(P, L ∩ C) = 3.)

Consider two curves C_{f} and C_{g} in 𝔸^{2}(k), and let P ∈ C_{f}(K) ∩ C_{g}(K), some K ⊃ k. Assume that P is an isolated point of C_{f} ∩ C_{g}, i.e., C_{f} and C_{g} do not have a common irreducible component passing through P. We define the intersection number of C_{f} and C_{g} at P to be

I(P, C_{f} ∩ C_{g}) = dim_{K} K[X, Y]_{(X−a,Y −b)}/(f, g)

(dimension as K-vector spaces).

Remark 1.5. If C_{f} and C_{g} have no common component, then

∑_{P ∈C(k^{al})∩C(k^{al})} I(P, C_{f} ∩ C_{g}) = dim_{k^{al}} k[X, Y]/(f, g).

This is particularly useful when C_{f} and C_{g} intersect at a single point.

Example 1.6. Let C be the curve Y^{2} = X^{3}, and let L : Y = 0 be its tangent line at P = (0, 0). Then

I(P, L ∩ C) = dim_{k} k[X, Y]/(Y, Y^{2} − X^{3}) = dim_{k} k[X]/(X^{3}) = 3.

Remark 1.7. (a) The intersection number doesn’t depend on which field K the coordinates of P are considered to lie in.

(b) As expected, I(P, C ∩D) = 1 if and only if P is nonsingular on both C and D, and the tangent lines to C and D at P are distinct. More generally, I(P, C ∩ D) ≥ m_{P} (C) · m_{P} (D), with equality if and only if C and D have no tangent line in common at P.

Projective plane curves. The projective plane over k is

ℙ^{2}(k) = {(x, y, z) ∈ k^{3} | (x, y, z) ≠ (0, 0, 0)}/ ∼

where (x, y, z) ∼ (x′, y′, z′) if and only if there exists a c ≠ 0 such that (x′, y′, z′) = (cx, cy, cz). We write (x : y : z) for the equivalence class^{1} of (x, y, z). Let P ∈ ℙ^{2}(k); the triples (x, y, z) representing P lie on a single line L(P) through the origin in k^{3}, and P ↦ L(P) is a bijection from ℙ^{2}(k) to the set of all such lines.

Projective n-space ℙ^{n}(k) can be defined similarly for any n ≥ 0.

Let U_{0} = {(x : y : z} | z ≠ 0}, and let L_{∞}(k) = {(x : y : z) | z = 0}. Then

(x, y) ↦ (x : y : 1) : 𝔸^{2}(k) → U_{0}

is a bijection, and

(x : y) ↦ (x : y : 0) : ℙ^{1}(k) → L_{∞}(k)

is a bijection. Moreover, ℙ^{2}(k) is the disjoint union

ℙ^{2}(k) = U_{0} ⊔ L_{∞}(k)

of the “affine plane” U_{0} with the “line at infinity” L_{∞}. A line

aX + bY + cZ = 0

meets L_{∞} at the point (−b : a : 0) = (1 : −\frac{a}{b}, 0). Thus we can think of ℙ^{2}(k) as being the affine plane with exactly one point added for each family of parallel lines.

A nonconstant homogeneous polynomial F ∈ k[X, Y, Z], assumed to have no repeated factor in k^{al}, defines a projective plane curve C_{F} over k whose points in any field K ⊃ k are the zeros of F in ℙ^{2}(K):

C_{F} (K) = {(x : y : z) | F (x, y, z) = 0}.

Note that, because F is homogeneous,

F (cx, cy, cz) = c^{deg F} F (x, y, z),

and so, although it doesn’t make sense to speak of the value of F at a point of ℙ^{2}, it does make sense to say whether or not F is zero at P. Again, the degree of F is called the degree of the curve C, and a plane projective curve is (uniquely) a union of irreducible plane projective curves.

The curve

Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}

1The colon is meant to suggest that only the ratios matter.

intersects the line at infinity at the point (0 : 1 : 0), i.e., at the same point as all the vertical lines do. This is plausible geometrically, because, as you go out the affine curve

Y^{2} = X^{3} + aX + b

with increasing x and y, the slope of the tangent line tends to ∞.

Let U_{1} = {(x : y : z} | y ≠ 0}, and let U_{2} = {(x : y : z)|x ≠ 0}. Then U_{1} and U_{2} are again, in a natural way, affine planes; for example, we can identify U_{1} with 𝔸^{2}(k) via

(x : 1 : z) ↔ (x, z).

Since at least one of x, y, or z is nonzero,

ℙ^{2}(k) = U_{0} ∪ U_{1} ∪ U_{2}.

A plane projective curve C = C_{F} is the union of three curves,

C = C_{0} ∪ C_{1} ∪ C_{2}, C_{i} = C ∩ U_{i}.

When we identify each U_{i} with 𝔸^{2}(k) in the natural way, then C_{0}, C_{1}, and C_{2} become identified with the affine curves defined by the polynomials F (X, Y, 1), F (X, 1, Z), and F (1, Y, Z) respectively.

The curve

C : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}

is unusual, in that it is covered by two (rather than 3) affine curves

C_{0} : Y^{2} = X^{3} + aX + b

and

C_{1} : Z = X^{3} + aXZ^{2} + bZ^{3}.

The notions of tangent line, multiplicity, etc. can be extended to projective curves by noting that each point P of a projective curve C will lie on at least one of the affine curves C_{i}.

Exercise 1.8. Let P be a point on a plane projective curve C = C_{F}. Show that P is singular, i.e., it is singular on the plane affine curve C_{i} for one (hence all) i if and only if F (P) = 0 = (\frac{∂F}{∂X} )_{P} = (\frac{∂F}{∂Y} )_{P} = (\frac{∂F}{∂Z} )_{P}. If P is nonsingular, show that the plane projective line

L : (\frac{∂F}{∂X} )_{P} X + (\frac{∂F}{∂Y} )_{P} Y (\frac{∂F}{∂Z} )_{P} Z = 0

has the property that L ∩ U_{i} is the tangent line to the affine curve C ∩ U_{i} for i = 0, 1, 2.

Theorem 1.9 (Bezout). Let C and D be plane projective of degrees m and n respectively over k, and assume that they have no irreducible component in common. Then they intersect over k^{al} in exactly mn points, counting multiplicities, i.e.,

∑_{P ∈C(k^{al})∩D(k^{al})} I(P, C ∩ D) = mn.

Proof. See [F] p112, or many other books.

For example, a curve of degree m will meet the line at infinity in exactly m points, counting multiplicities. Our favourite curve

C : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}

meets L_{∞} at a single point P = (0 : 1 : 0), but I(P, L_{∞} ∩ C) = 3. [Exercise: Prove this!] In general, a nonsingular point P on a curve C is called a point of inflection if the intersection multiplicity of the tangent line and C at P is ≥ 3.

Suppose k is perfect. Then all the points of C(k^{al}) ∩ D(k^{al}) will have coordinates in some finite Galois extension K of k, and the set

C(K) ∩ D(K) ⊂ ℙ^{2}(K)

is stable under the action of Gal(K/k).

Remark 1.10. (For the experts.) Essentially, we have defined an affine (resp. projective) curve to be a geometrically reduced closed subscheme of 𝔸_{k}^{2} (resp. ℙ_{k}^{2}) of dimension 1. Such a scheme corresponds to an ideal of height one, which is principal, because polynomial rings are unique factorization domains. The polynomial generating the ideal of the scheme is uniquely determined by the scheme up to multiplication by a nonzero constant. The other definitions in this section are standard.

References: The best reference for what little we need from algebraic geometry is [F].

2. Rational Points on Plane Curves.

Let C be a plane projective curve over ℚ (or some other field with an interesting arithmetic), defined by a homogeneous polynomial F (X, Y, Z). The two fundamental questions in diophantine geometry then are:

Question 2.1. (a) Does C have a point in ℚ, that is, does F (X, Y, Z) have a nontrivial zero in ℚ?

(b) If the answer to (a) is yes, can we describe the set of common zeros?

There is also the question of whether there is an algorithm to answer these questions. For example, we may know that a curve has only finitely many points without having an algorithm to actually find the points.

For simplicity, in the remainder of this section, I’ll assume that C is absolutely irreducible, i.e., that F (X, Y, Z) is irreducible over ℚ^{al}.

Here is one observation that we shall use frequently. Let K be a finite (of even infinite) Galois extension of ℚ, and let

f(X, Y) = ∑ a_{ij}X^{i}Y^{j} ∈ ℚ[X, Y].

If (a, b) ∈ K^{2} is a zero of f(X, Y), then so also is (σa, σb) for any σ ∈ Gal(K/ℚ), because

0 = σf(a, b) = σ(∑ a_{ij}a^{i}b^{j}) = ∑ a_{ij}(σa)^{i}(σb)^{j} = f(σa, σb).

Thus Gal(K/ℚ) acts on C(K), where C is the affine curve defined by f(X, Y). More generally, if C_{1}, C_{2}, … are affine curves over ℚ, then Gal(K/ℚ) stabilizes the set C_{1}(K) ∩ C_{2}(K) · · ·. On applying this remark to the curves f(X, Y) = 0, \frac{∂f}{∂X} (X, Y) = 0, \frac{∂f}{∂Y} (X, Y) = 0, we see that Gal(K/ℚ) stabilizes the set of singular points in C(K). Similar remarks apply to projective curves.

Curves of degree one. First consider a curve of degree one, i.e., a line,

C : aX + bY + cZ = 0, a, b, c in ℚ and not all zero.

It always has points, and it is possible to parameterize the points: if, for example, c ≠ 0, the map

(s : t) ↦ (s : t : −\frac{a}{c}s − \frac{b}{c}t)

is a bijection from ℙ^{1}(k) onto C(k).

Curves of degree two. In this case F (X, Y, Z) is a quadratic form in 3 variables, and C is a conic. Note that C can’t be singular: if P has multiplicity m, then (according to (1.7b)) a line L through P and a second point Q on the curve will have

I(P, L ∩ C) + I(Q, L ∩ C) ≥ 2 + 1 = 3,

which violates Bezout’s theorem.

Sometimes it is easy to see that C(ℚ) = ∅. For example,

X^{2} + Y^{2} + Z^{2}

has no nontrivial zero because it has no nontrivial real zero. Similarly,

X^{2} + Y^{2} − 3Z^{2}

has no nontrivial zero, because if it did it would have a zero (x, y, z) with x, y, z ∈ ℤ and gcd(x, y, z) = 1. The only squares in ℤ/3ℤ are 0 and 1, and so

x^{2} + y^{2} ≡ 0 mod 3

implies that x ≡ 0 ≡ y mod 3. But then 3 must divide z, which contradicts our assumption that gcd(x, y, z) = 1. This argument shows, in fact, that X^{2} + Y^{2} − 3Z^{2} does not have a nontrivial zero in the field ℚ_{3} of 3-adic numbers.

These examples illustrate the usefulness of the following statement: a necessary condition for C to have a point with coordinates in ℚ is that it have a point with coordinates in ℝ and in ℚ_{p} for all p. A theorem of Legendre says that the condition is also sufficient:

Theorem 2.2 (Legendre). A quadratic form F (X, Y, Z) with coefficients in ℚ has a nontrivial zero in ℚ if and only if it has a nontrivial zero in ℝ and in ℚ_{p} for all p.

Remark 2.3. (a) This is not quite how Legendre (1752–1833) stated it, since p-adic numbers are less than 100 years old

(b) The theorem does in fact give a practical algorithm for showing that a quadratic form does have a nontrivial rational zero—see (2.11) below.

(c) The theorem is true for quadratic forms F (X_{0}, X_{2}, …, X_{n}) in any number of variables over any number field K (Hasse-Minkowski theorem). There is a very down-to-earth proof of the original case of the theorem in [C2]—it takes three lectures. A good exposition of the proof for forms over ℚ in any number of variables is to be found in Serre, Course on Arithmetic. The key cases are 3 and 4 variables (2 is trivial, and for ≥ 5 variables, one uses induction on n), and the key result needed for its proof is the quadratic reciprocity law. For number fields K other ℚ, the proof requires the Hilbert reciprocity law, which is best derived as part of class field theory (see Math 776 for class field theory), but there is a more direct proof of Hilbert’s reciprocity law in Chapter 7 of O’Meara, Introduction to Quadratic Forms (which proves the Hasse-Minkowski theorem in full generality).

(d) If for a class of polynomials (better algebraic varieties), it is known that each polynomial (or variety) has a zero in ℚ if and only if it has zeros in ℝ and all ℚ_{p}, then one says that the Hasse, or local-global, principle holds for the class.

Now suppose C has a point P_{0} with coordinates in ℚ. Can we describe all the points? Yes, because each line through P_{0} will (by Bezout’s theorem, or more elementary arguments) meet the curve in exactly one other point, except for the tangent line. Since the lines through P_{0} in ℙ^{2} form a “ℙ^{1}”, we obtain in this way a bijection between C(ℚ) and ℙ^{1}(ℚ). For example, take P_{0} to be the point (−1 : 0 : 1) on the curve C : X^{2} + Y^{2} = Z^{2}. The line bX − aY + bZ, a, b ∈ ℚ, of slope \frac{b}{a} through P_{0} meets C at the point (a^{2} − b^{2} : 2ab : a^{2} + b^{2}). In this way, we obtain a parametrization (a : b) ↦ (a^{2} −b^{2} : 2ab : a^{2} +b^{2}) of the points of C with coordinates in ℚ.

Curves of degree 3. Let C : F (X, Y, Z) = 0 be a plane projective curve over ℚ of degree 3. If it has a singular point, then Bezout’s theorem shows that it has only one, and that it is a double point. A priori the singular point P_{0} may have coordinates in some finite^{2} extension K of ℚ, which we may take to be Galois over ℚ, but Gal(K/ℚ) stabilizes the set of singular points in C(K), hence fixes P_{0}, and so P_{0} ∈ C(ℚ). Now a line through P_{0} will meet the curve in exactly one other point (unless it is a tangent line), and so we again get a parametrization of the points (with finitely many exceptions).

Nonsingular cubics will be the topic of the rest of the course. We shall see that the Hasse principle fails for nonsingular cubic curves. For example,

3X^{3} + 4Y^{3} = 5Y^{3}

has points in ℝ and ℚ_{p} for all p, but not in ℚ. However, it is conjectured that the Hasse principle fails only by a “finite amount”, and that the failure is “measured” by a certain group, called the Tate-Shafarevich group.

Let C be a nonsingular cubic curve over ℚ. From two points P_{1}, P_{2} ∈ C(ℚ) we can construct^{3} a third as the point of intersection of C(ℚ) with the chord through P_{1} and P_{2}— by Bezout’s theorem, there exists exactly one such point, perhaps with coordinates in a Galois extension K of ℚ, but by the observation at the start of this section, it must be fixed by Gal(K/ℚ) and therefore lie in C(ℚ). Similarly, the tangent line at a point P ∈ C(ℚ) will meet C at exactly one other point (unless P is a point of inflection), which^{4} will lie in C(ℚ).

In a famous paper, published in 1922/23, Mordell proved the following theorem:

Theorem 2.4 (Finite basis theorem). Let C be a nonsingular cubic curve over ℚ. Then there exists a finite set of points on C with coordinates in ℚ from which every other such point can be obtained by successive chord and tangent constructions.

2I should explain why the singular point has coordinates in a finite extension of ℚ. I claim that if F (X, Y, Z) has a singular point with coordinates in some big field Ω, e.g., ℂ, then it has a singular point with coordinates in ℚ^{al} (hence in a finite extension of ℚ). Pass to an affine piece of the curve, and consider a (nonhomogeneous) cubic f(X, Y). If the curve f(X, Y) = 0 has a singular point with coordinates in Ω, then f, \frac{∂f}{∂X} , \frac{∂f}{∂Y} have a common zero in Ω^{2}, and so the ideal they generate is not the whole of Ω[X, Y]. This implies that the ideal they generate in ℚ^{al}[X, Y] is not the whole ring, and the Hilbert Nullstellensatz then implies that they have a common zero in (ℚ^{al})^{2}.

3This construction goes back to Diophantus (3rd century A.D)

4This observation was first made by Newton (1642–1727).

In fact, C(ℚ), if nonempty, can be made into an abelian group, and the finite basis theorem says that C(ℚ) is finitely generated. There is as yet no proven algorithm for finding the rank of the group.

Curves of genus > 1. Mordell conjectured, in his 1922/23 paper, and Faltings proved, that a nonsingular plane projective curve of degree ≥ 4 has only finitely many points coordinates in ℚ.

More generally, define the geometric genus of a plane projective curve C to be

p_{g}(C) = \frac{(d − 1)(d − 2)}{2} − ∑ δ_{P}

where d is the degree of C, the sum is over the singular points in C(ℚ^{al}), and δ_{P} = \frac{m_{P} (m_{P} −1)}{2} if P is an ordinary singularity of multiplicity m_{P}. Then C(ℚ) is finite if C has geometric genus > 1.

Remark 2.5. (a) Let P ∈ ℙ^{2}(ℚ). Choose a representative (a : b : c) for P with a, b, c integers having no common factor, and define the height h(P) of P to be max(|a|, |b|, |c|). The biggest remaining problem in the theory of curves of genus > 1 over ℚ is that of giving an upper bound H(C), in terms of the polynomial defining C, for the heights of the points P ∈ C(ℚ). With such an upper bound H(C), one could find all the points on C with coordinates in ℚ by a finite search.

(b) There is a heuristic explanation for Mordell’s conjecture. Let C be a curve of genus g ≥ 1 over ℚ, and assume that C(ℚ) ≠ ∅. It is possible to embed C into another projective variety J of dimension g (its Jacobian variety). The Jacobian variety J is an abelian variety, i.e., it has a group structure, and a generalization of Mordell’s theorem (due to Weil) says that J(ℚ) is finitely generated. Hence, inside the g-dimensional set J(ℂ) we have the countable set J(ℚ) and the (apparently unrelated) one-dimensional set C(ℂ). If g > 1, it would be an extraordinary accident if the second set contained more than a finite number of elements from the first set.

Hensel’s lemma.

Lemma 2.6. Let f(X_{1}, …, X_{n}) ∈ ℤ[X_{1}, …, X_{n}], and let \underline{a} ∈ ℤ^{n} have the property that, for some m ≥ 0,

f(\underline{a}) ≡ 0 mod p^{2m+1}

but, for some i,

(\frac{∂f}{∂X_{i}} ) (\underline{a}) ≢ 0 mod p^{m+1}.

Then there exists a \underline{b} ∈ ℤ^{n} such that

\underline{b} ≡ \underline{a} mod p^{m+1} ( ⟹ (\frac{∂f}{∂X_{i}} ) (\underline{b}) ≢ 0 mod p^{m+1})

and

f(\underline{b}) ≡ 0 mod p^{2m+2}.

Proof. Consider the (trivial) Taylor expansion

f(X_{1}, …, X_{n}) = f(a_{1}, …, a_{n}) + ∑_{i=1}^{n} (\frac{∂f}{∂X_{i}} )\underline{a} (X_{i} − a_{i}) + terms of higher degree.

Set b_{i} = a_{i} + h_{i}p^{m+1}, h_{i} ∈ ℤ. Then

f(b_{1}, …, b_{n}) = f(a_{1}, …, a_{n}) + ∑ (\frac{∂f}{∂X_{i}} )\underline{a} h_{i}p^{m+1} + terms divisible by p^{2m+2}.

We have to choose the h_{i} so that

f(a_{1}, …, a_{n}) + ∑ (\frac{∂f}{∂X_{i}} )\underline{a} h_{i}p^{m+1}

is divisible by p^{2m+2}. From the assumption, we know that there is a k ≤ m such that p^{k} divides (\frac{∂f}{∂X_{i}} )\underline{a} for all i but p^{k+1} doesn’t divide all of them. Any h_{i}’s satisfying the following equation will suffice:

\frac{f(a_{1}, …, a_{n})}{p^{k+m+1}} + ∑ \frac{(\frac{∂f}{∂X_{i}} )\underline{a}}{p^{k}} h_{i} ≡ 0 mod p.

Remark 2.7. If, in the lemma, \underline{a} satisfies the condition

f(\underline{a}) ≡ 0 mod p^{2m+r}

for some r ≥ 1, then the construction in the proof gives a \underline{b} such that

\underline{b} ≡ \underline{a} mod p^{m+r}

and

f(\underline{b}) ≡ 0 mod p^{2m+r+1}.

Theorem 2.8 (Hensel’s Lemma). Under the hypotheses of the lemma, there exists a \underline{b} ∈ ℤ_{p}^{n} such that f(\underline{b}) = 0 and \underline{b} ≡ \underline{a} mod p^{m+1}.

Proof. On applying the lemma, we obtain an \underline{a}_{2m+2} ∈ ℤ^{n} such that \underline{a}_{2m+2} ≡ \underline{a} mod p^{m+1} and f(\underline{a}_{2m+2}) ≡ 0 mod p^{2m+2}. On applying the remark following the lemma, we obtain an \underline{a}_{2m+3} ∈ ℤ^{n} such that \underline{a}_{2m+3} ≡ \underline{a}_{2m+2} mod p^{m+2} and f(\underline{a}_{2m+3}) ≡ 0 mod p^{2m+3}. Continuing in this fashion, we obtain a sequence \underline{a}, \underline{a}_{2m+2}, \underline{a}_{2m+3}, … of n-tuples of Cauchy sequences. Let \underline{b} be the limit in ℤ_{p}^{n}. The map f : ℤ^{n} → ℤ is continuous for the p-adic topologies, and so

f(\underline{b}) = f(lim_{r} \underline{a}_{2m+r}) = lim_{r} f(\underline{a}_{2m+r}) = 0.

Example 2.9. Let f(X) ∈ ℤ[X], and let \overline{f}(X) ∈ 𝔽_{p}[X] be its reduction mod p. Here 𝔽_{p} = ℤ/pℤ. Let a ∈ ℤ be such that \overline{a} ∈ 𝔽_{p} is a simple root of \overline{f}(X). Then \frac{d\overline{f}}{dX} (\overline{a}) ≠ 0, and so the theorem shows that \overline{a} lifts to a root of f(X) in ℤ_{p}.

Example 2.10. Let f(X, Y, Z) be a homogeneous polynomial in ℤ[X, Y, Z], and let (a, b, c) ∈ ℤ^{3} be such that (\overline{a}, \overline{b}, \overline{c}) ∈ 𝔽_{p}^{3} is a nonsingular point of the curve \overline{C} : \overline{f}(X, Y, Z) = 0 over 𝔽_{p}. Then, as in the previous example, (\overline{a}, \overline{b}, \overline{c}) lifts to a point on the curve C : f(X, Y, Z) = 0 with coordinates in ℤ_{p}.

Example 2.11. Let f(X, Y, Z) be a quadratic form with coefficients in ℤ, and let D ≠ 0 be its discriminant. If p does not divide D, then \overline{f}(X, Y, Z) is a nondegenerate quadratic form over 𝔽_{p}, and it is known that it has a nontrivial zero in 𝔽_{p}. Therefore f(X, Y, Z) has a nontrivial zero in ℚ_{p} for all such p. If p divides D, then Hensel’s lemma shows that f(X, Y, Z) will have a nontrivial zero in ℚ_{p} if and only if it has an “approximate” zero.

A brief introduction to the p-adic numbers. Let p be a prime number. Any nonzero rational number a can be expressed a = p^{r} \frac{m}{n} with m, n ∈ ℤ and not divisible by p. We then write ord_{p}(a) = r, and |a|_{p} = \frac{1}{p^{r}}. We define |0|_{p} = 0. Then:

(a) |a|_{p} = 0 if and only if a = 0.

(b) |ab|_{p} = |a|_{p}|b|_{p}.

(c) |a + b|_{p} ≤ max{|a|_{p}, |b|_{p}} (≤ |a|_{p} + |b_{p}|).

These conditions imply that

d_{p}(a, b) =_{df} |a − b|_{p}

is a translation-invariant metric on ℚ. Note that, according to this definition, to say that a and b are close means that their difference is divisible by a high power of p. The field ℚ_{p} of p-adic numbers is the completion of ℚ for this metric. We now explain what this means.

A sequence (a_{n}) is said to be a Cauchy sequence (for the p-adic metric) if, for any ε > 0, there exists an integer N(ε) such that

|a_{m} − a_{n}|_{p} < ε whenever m, n > N(ε).

The sequence (a_{n}) converges to a if for any ε > 0, there exists an N(ε) such that

|a_{n} − a|_{p} < ε whenever n > N(ε).

Let R be the set of all Cauchy sequences in ℚ (for the p-adic metric). It becomes a ring with the obvious operations. An element of R is said to be a null sequence if it converges to zero. The set of null sequences is an ideal I in R, and ℚ_{p} is defined to be the quotient R/I.

If α = (a_{n})_{n∈ℕ} is a Cauchy sequence, then one shows that |a_{n}|_{p} becomes constant for large n, and we set this constant value equal to |α|_{p}. The map α ↦ |α|_{p} : R → ℚ factors through ℚ_{p}, and has the properties (a), (b), (c) listed above. We can therefore talk about Cauchy sequences etc. in ℚ_{p}.

Theorem 2.12. (a) ℚ_{p} is a field, and it is complete, i.e., every Cauchy sequence in ℚ_{p} has a unique limit in ℚ_{p}.

(b) The map sending a ∈ ℚ to the equivalence class of the constant Cauchy sequence α(a) = a, a, a, … is an injective homomorphism ℚ ↪ ℚ_{p}, and every element of ℚ_{p} is a limit of a sequence in ℚ.

Remark 2.13. (a) The same construction as above, but with | · |_{p} replaced with the usual absolute value, yields ℝ instead of ℚ_{p}.

(b) Just as real numbers can be represented by decimals, p-adic numbers can be represented by infinite series of the form

a_{−n}p^{−n} + ⋯ + a_{0} + a_{1}p + ⋯ + a_{m}p^{m} + ⋯ 0 ≤ a_{i} ≤ p − 1.

The ring of p-adic integers ℤ_{p} can be variously defined as:

(a) the closure of ℤ in ℚ_{p}; (b) the set of elements α ∈ ℚ_{p} with |α|_{p} ≤ 1;

(c) the set of elements of ℚ_{p} that can be represented in the form

a_{0} + a_{1}p + ⋯ + a_{m}p^{m} + ⋯ 0 ≤ a_{i} ≤ p − 1.

(d) the inverse limit \underleftarrow{lim} ℤ/p^{m}ℤ.

Some history. Hilbert and Hurwitz showed (in 1890) that, if a curve of genus zero has one rational point, then it has infinitely many, all given by rational values of parameter. Poincaré wrote a long article on the rational points on curves in 1901, and is usually credited with introducing the group law on E(ℚ) and with conjecturing that E(ℚ) is finitely generated (the finite basis theorem). According to Schappacher (MathReviews 92c:14001), neither is true: although Poincaré was familiar with the use of chords and tangents to construct new rational points from old, he did not define the group law, and he didn’t conjecture the finite basis theorem, he simply assumed it was true. In his remarkable 1922/23 paper, Mordell proved the finite basis theorem, and, in a rather off-handed way, conjectured that all curves of genus > 1 over ℚ have only finitely many rational points (the Mordell conjecture). He did this without realizing E(ℚ) is a group, which complicates his proof, since he has to prove that E(ℚ)/2E(ℚ) is finite. The Mordell conjecture was proved by Faltings in 1983 (that year’s “theorem of the century”). For an interesting discussion of Mordell’s famous paper, and related history, see Cassels, Mordell’s finite basis theorem revisited, Math. Proc. Camb. Phil. Soc. (1986), 100, 31–41.

Exercise 2.14. (a) Let

F (X, Y, Z) = 5X^{2} + 3Y^{2} + 8Z^{2} + 6(Y Z + ZX + XY).

Find (a, b, c) ∈ ℤ^{3}, not all divisible by 13, such that

F (a, b, c) ≡ 0 mod 13^{2}.

(b) Consider the plane affine curve C : Y^{2} = X^{3} + p. Prove that the point (0, 0) on the reduced curve over 𝔽_{p} does not lift to ℤ_{p}^{2}. Why doesn’t this violate Hensel’s lemma?

3. The Group Law on a Cubic Curve

Let C be a nonsingular projective plane curve of degree 3 over a field k, which, for simplicity, we assume to be perfect. We are especially interested in the case k = ℚ.

As we discussed in Section 2, Bezout’s theorem (or more elementary arguments) show that the line through two points P and Q on C with coordinates in k will meet the curve in exactly one other point, which will also have coordinates in k. We write P Q for this third point. In special cases, this has to interpreted appropriately: if P = Q, then P Q is the point of intersection of the tangent line at P with the cubic; if the line through P and Q is tangent to the cubic at Q, then P Q = Q; and if P is a point of inflection, then P P = P.

If C(k) is empty, then it is not a group. Otherwise we choose a point O ∈ C(k), which will be the zero element for the group, and for any pair P, Q ∈ C(k), we define

P + Q = O(P Q),

i.e., if the line through P and Q intersects C again at R, then P + Q is the third point of intersection with C of the line through O and R.

[[Diagram omitted]] Theorem 3.1. The above construction makes C(k) into a commutative group.

In this section, we sketch an elementary geometric proof of this, which is very beautiful, at least if one ignores the degenerate cases (as we shall). In the next section, we shall give a different proof based on the Riemann-Roch theorem.

First note that the definition doesn’t depend on the order of P and Q; thus

P + Q = Q + P.

Second note that

O + P =_{df} O(OP) = P.

Given P ∈ C(k), define P′ = P (OO), i.e., if the tangent line at O intersects C at R, then P′ is the third point of intersection of the line through P and R. Then P P′ = OO, and O(P P′) = O(OO) = O, and so

P + P′ = O. [[Diagram omitted]]

Thus the law of composition is commutative, has a zero element, and every element has a negative. It remains to check that it is associative, i.e., that

(P + Q) + R = P + (Q + R).

Consider the following diagram, in which

ℓ_{1} = the line through P and Q;
ℓ_{2} = the line through Q and R;
ℓ_{3} = the line through O and P Q;
ℓ_{4} = the line through O and QR;
ℓ_{5} = the line through P + Q and R;
ℓ_{6} = the line through Q + R and P .

[[diagram omitted]]

Let

S = (P + Q)R, T = P (Q + R).

Then (P + Q) + R = OS and P + (Q + R) = OT. We shall show that S = T, which implies that (P + Q) + R = P + (Q + R).

We first need a lemma from linear algebra.

Lemma 3.2. Let P_{1}, …, P_{8} be 8 points in ℙ^{2}(k) in “general position”^{5}. Then there exists a ninth point P_{9} such that any cubic curve (not necessarily irreducible or nonsingular) passing through P_{1}, …, P_{8} also passes through P_{9}.

Proof. A cubic form

F (X, Y, Z) = a_{1}X^{3} + a_{2}X^{2}Y + ⋯ + a_{10}Z^{3}

has 10 coefficients a_{1}, …, a_{10}. The condition that F (P_{i}) = 0 is a linear condition on a_{1}, …, a_{10}, namely, if P_{i} = (x_{i} : y_{i} : z_{i}), then it is the condition

a_{1}x_{i}^{3} + a_{2}x_{i}^{2}y_{i} + ⋯ + a_{10}z_{i}^{3} = 0.

5This is the old geometers way of saying “and satisfying whatever additional conditions are needed to make the proof work”.

If the vectors (x_{i}^{3}, x_{i}^{2}y_{i}, …, z_{i}^{3}), i = 1, …, 8 are linearly independent, then the cubic forms having the P_{i} as zeros form a 2-dimensional space, and so there exist two such forms F and G such that any other such form can be written

λF + μG, λ, μ ∈ k.

Now F and G have a ninth zero in common (by Bezout), and every form λF + μG passes through it.

Remark 3.3. In order for the proof to work, we need that the points P_{1}, …, P_{8} impose linearly independent conditions on the coefficients of the cubic forms. According to [C2], this means that no 7 lie on a conic, and no 4 on a line.

We now complete the proof of the theorem. Consider the cubic curves:

C, ℓ_{1}ℓ_{4}ℓ_{5} = 0, ℓ_{2}ℓ_{3}ℓ_{6} = 0.

All three pass through the 8 marked intersection points in the above diagram, and the last two also pass through the unmarked intersection point. Therefore, if the 8 marked intersection points are in “general position”, then the unmarked intersection point is the 9th point through which all cubics must pass. In particular, C passes through the unmarked intersection point, which implies that S = T, as required.

Remark 3.4. To give a complete proof, one needs to consider the case that the 8 points are not in general position. There is a detailed elementary proof of this along the lines of the above proof in [Kn], pp67–74.

Alternatively, those who know a little algebraic geometry will be able to complete the proof as follows. We have two regular maps of projective varieties

C × C × C → C,

namely,

(P, Q, R) ↦ (P + Q) + R and (P, Q, R) ↦ P + (Q + R).

The above argument shows that they agree on an open subset of C × C × C, which is nonempty because it contains (O, O, O). Because C is separated, the set where the two maps is closed, and so is all of C × C × C.

Remark 3.5. The above construction of the group law makes it obvious that the coordinates of P + Q can be expressed as polynomials in the coordinates of P and Q. For special cubics, we shall find these polynomials later. Also, it is clear that we get the same P + Q whether we consider P and Q as elements of C(k) or of C(K) for some K ⊃ k.

4. Functions on Algebraic Curves and the Riemann-Roch Theorem

Assume (initially) that k is algebraically closed.

Regular functions on affine curves. Let C be an affine plane curve over k defined by an irreducible polynomial f(X, Y). A polynomial g(X, Y) ∈ k[X, Y] defines a function

(a, b) ↦ g(a, b) : C(k) → k

and the functions arising in this manner are called the regular functions on C.

Clearly, any multiple of f(X, Y) in k[X, Y] defines the zero function on C, and the Hilbert’s Nullstellensatz ([F] p21) shows that the converse is true (using that f irreducible implies (f(X)) is a prime ideal). Therefore the map sending g to the function (a, b) ↦ g(a, b) on C defines an isomorphism

k[X, Y]/(f(X)) ⟶^{≈} {ring of regular functions on C}.

Write

k[C] = k[X, Y]/(f(X)) = k[x, y].

Then x and y can be interpreted as the coordinate functions P ↦ x(P), P ↦ y(P) on C, and k[C] is the ring of polynomials in x and y. Note that a nonzero regular function on C will have only finitely many zeros on C, because a curve g(X, Y) = 0 will intersect C in only finitely many points unless f(X, Y)|g(X, Y).

Because (f(X)) is irreducible, k[x, y] is an integral domain, and we let k(C) = k(x, y) be its field of fractions. An element φ = \frac{g}{h} ∈ k(x, y) defines a function

(a, b) ↦ \frac{g(a, b)}{h(a, b)} : C(k) \ \{zeros of h\} → k.

We call φ a meromorphic function ^{6} on C, regular on C \ {zeros of h}.

Example 4.1. (a) Let C be the X-axis, i.e., the affine curve defined by the equation Y = 0. Then k[C] = k[X, Y]/(Y) = k[X] and k(C) = k(X). The meromorphic functions on C are just the rational functions \frac{g(X)}{h(X)}, and such a function is regular outside the finite set of zeros of h(X).

(b) Let C be the curve defined by the equation

Y^{2} = X^{3} + aX + b.

Then k[C] = k[x, y] = k[X, Y]/(Y^{2} − X^{3} − aX − b). Thus the regular functions on C are the polynomials in the coordinate functions x and y, which satisfy the relation

y^{2} = x^{3} + ax + b.

Regular functions on projective curves. Let C be a plane projective curve over k defined by an irreducible homogeneous polynomial F (X, Y, Z). If G(X, Y, Z) and H(X, Y, Z) are homogeneous polynomials of the same degree and H is not a multiple of F, then

(a : b : c) ↦ \frac{G(a, b, c)}{H(a, b, c)}

is a well-defined function on C(k) \ {zeros of H}. Such a function is called a meromorphic function on C. More precisely, let

k[x, y, z] = k[X, Y, Z]/(F (X, Y, Z)).

6Note that this is an abuse of language since φ is not in fact a function on all of C(k).

Because F is homogeneous, there is a well-defined decomposition

k[x, y, z] = ⊕_{d}k[x, y, z]_{d}

where k[x, y, z]_{d} consists of the elements of k[x, y, z] having a representative in k[X, Y, Z] that is homogeneous of degree d. Define

k(C) = k(x, y, z)_{0} = \{\frac{g}{h} ∈ k(x, y, z) | ∃d such that g, h ∈ k[x, y, z]_{d}\}.

It is a subfield of k(x, y, z), and its elements are called the meromorphic functions on C. A meromorphic defines a(n honest) function on the complement of a finite set in C(k). Let U be the complement of a finite set in C(k); then a function φ : U → k is said to be regular if there exists a meromorphic function without poles in U and agreeing with φ on U.

Remark 4.2. Recall that we have a bijection

\begin{matrix}𝔸^{2}(k) & ↔ & U_{0}(k) & ⊂ & ℙ^{2}(k) \\ (\frac{a}{c}, \frac{a}{c}) & ↔ & (a : b : c) \end{matrix}

To avoid confusion, write k[X′, Y′] for the polynomial ring associated with 𝔸^{2} and k[X, Y, Z] for the polynomial ring associated with ℙ^{2}. A polynomial g(X′, Y′) defines a function 𝔸^{2}(k) → k, and the composite

U_{0} → 𝔸^{2} ⟶^{g(X′,Y′)} k

is

(a : b : c) ↦ g(\frac{a}{c}, \frac{b}{c}) = \frac{g^{∗}(a, b, c)}{c^{deg g}}

where g^{∗}(X, Y, Z) = g(\frac{X}{Z} , \frac{Y}{Z}) · Z^{deg g} (in other words, g^{∗}(X, Y, Z) is g(X, Y) made homogeneous by using the smallest number of Z’s). Thus g(X′, Y′) as a function on 𝔸^{2} ≅ U_{0} agrees with \frac{g^{∗}(X,Y,Z)}{Z^{deg g}}. One see easily that the map

\frac{g(X′, Y′)}{h(X′, Y′)} ↦ \frac{g^{∗}(X, Y, Z)}{Z^{deg g}} \frac{Z^{deg h}}{h^{∗}(X, Y, Z)} : k(X′, Y′) → k(X, Y, Z)

is an injection, with image the subfield k(X, Y, Z)_{0} of k(X, Y, Z) of elements that can be expressed as the quotient of homogeneous polynomials of the same degree.

Now let C be an irreducible curve in ℙ^{2}, and assume that C ∩ U_{0} ≠ ∅, i.e., that C is not the “line at infinity” Z = 0. Then the map

\frac{g(x′, y′)}{h(x′, y′)} ↦ \frac{g^{∗}(x, y, z)}{z^{deg g}} \frac{z^{deg h}}{h^{∗}(x, y, z)} : k(x′, y′) → k(x, y, z)_{0}

is a bijection from the field of meromorphic functions on the affine curve U_{0} ∩ C to the field of meromorphic functions on C. Moreover, if φ′ ↦ φ, then φ(a : b : c) = φ′(\frac{a}{c}, \frac{b}{c}) for any point (a : b : c) ∈ C(k) ∩ U_{0} at which φ is defined.

Example 4.3. (a) The meromorphic functions on ℙ^{1} are the functions

(a : b) ↦ \frac{G(a, b)}{H(a, b)}

where G(X, Z) and H(X, Z) are homogeneous polynomials of the same degree.

(b) Let C be a nonsingular projective curve over ℂ. Then C(ℂ) has the structure of a compact Riemann surface, and the meromorphic functions on C(ℂ) in the sense of complex analysis are exactly the same functions as those defined above. For example, ℙ^{1}(ℂ) is the Riemann sphere, and, written inhomogeneously, the meromorphic functions in both cases are the functions \frac{g(z)}{h(z)} with each of g(z) and h(z) polynomials.

It is not true that the two notions of meromorphic function coincide for an affine curve: every meromorphic function in the above sense is also meromorphic in the sense of complex analysis, but there are more of the latter, for example, e^{z}.

The Riemann-Roch theorem. Let C be the nonsingular projective curve over a field k (still assumed to be algebraically closed) defined by a polynomial F (X, Y, Z). One tries to understand the meromorphic functions on a C in terms of their zeros and poles.

The group of divisors Div(C) on C is the free abelian group on the set C(k). Thus an element of Div(C) is a finite sum

D = ∑ n_{P} [P], n_{P} ∈ ℤ, P ∈ C(k).

The degree of D is ∑ n_{P}.

There is a partial ordering on Div(C):

∑ n_{P} [P] ≥ ∑ m_{P} [P] ⟺ n_{P} ≥ m_{P} for all P.

In particular, ∑ n_{P} [P] ≥ 0 if and only if all the n_{p} are nonnegative.

Let φ be a meromorphic function on C. By definition, φ is defined by a quotient \frac{G(X,Y,Z)}{H(X,Y,Z)} of two polynomials of the same degree, say m, and F doesn’t divide H. Assume φ ≠ 0— we may then suppose that F doesn’t divide G(X, Y, Z) (recall that k[X, Y, Z] is a unique factorization domain). By Bezout’s theorem

(deg F)m = ∑_{F (P)=0=G(P)} I(P, C ∩ {G = 0}) = ∑_{F (P)=0=H(P)} I(P, C ∩ {H = 0}).

Define the divisor of φ to be

divφ = ∑_{G(P)=0=F (P)} I(P, C ∩ {G = 0})[P] − ∑_{H(P)=0=F (P)} I(P, C ∩ {H = 0})[P]

The [P] occurring in divφ with positive coefficient are called the zeros of φ, and those occurring with negative coefficient are its poles. Note the divφ has degree zero, and so φ has as many zeros as poles (counting multiplicities). Also, note that only the constant functions will have no zeros or poles.

Given a divisor D, we define

L(D) = {φ | divφ + D ≥ 0} ∪ {0}.

For example, if D = [P] + 2[Q], then L(D) consists of those meromorphic functions having no poles outside {P, Q} and having at worst a single pole at P and a double pole at Q. Each L(D) is a vector space over k, and in fact a finite-dimensional vector space. We denote its dimension by ℓ(D).

Theorem 4.4 (Riemann-(Roch)). There exists an integer g such that for all divisors D

ℓ(D) ≥ deg D + 1 − g,

with equality for deg D sufficiently large (in fact, equality for deg D > 2g − 2).

Proof. See [F] Chapter 8.

The integer defined by the theorem is the genus of C.

Example 4.5. Let a_{1}, …, a_{m} ∈ k = 𝔸^{1}(k) ⊂ ℙ^{1}(k), and let D = ∑ r_{i}[a_{i}] ∈ Div(ℙ^{1}), r_{i} > 0. The meromorphic functions φ on 𝔸^{1} with their poles in {a_{1}, …, a_{m}} and at worst a pole of order r_{i} at a_{i} are those of the form

φ = \frac{f(X)}{(X − a_{1})^{r_{1}} ⋯ (X − a_{m})^{r_{m}}} , f(X) ∈ k[X].

The function φ will not have a pole at ∞ if and only if deg f ≤ ∑ r_{i} = deg D. The dimension of L(D) is therefore the dimension of the space of polynomials f of degree ≤ deg D, which is deg D + 1. This is as expected, because ℙ^{1} has genus 0.

The group law revisited. The divisor of a meromorphic function on C is said to be principal. Two divisors D and D′ are said to be linearly equivalent, D ∼ D′, if they differ by the divisor of a function.

We have groups

Div(C) ⊃ Div^{0}(C) ⊃ P (C)

where Div^{0}(C) is the group of divisors of degree 0 on C, and P (C) is the group of principal divisors. Define Picard groups:

Pic(C) = Div(C)/P (C), Pic^{0}(C) = Div^{0}(C)/P (C).

Remark 4.6. We are interested in these groups when C is a projective curve, but the number theorists may be interested to note that when C is a nonsingular affine curve, k[C] is a Dedekind domain, and Pic(C) is its ideal class group.

Consider now a nonsingular projective curve of genus 1—according to the formula on p9, a nonsingular plane projective curve will have genus 1 if and only if it has degree 3. According to the Riemann-Roch theorem,

ℓ(D) = deg D if deg D ≥ 1.

Proposition 4.7. Let C be a nonsingular projective curve of genus 1, and let O ∈ C(k). The map

P ↦ [P] − [O] : C(k) → Pic^{0}(C)

is bijective.

Proof. We define an inverse. Let D be a divisor of degree 0. Then D + [O] has degree 1, and so there exists a meromorphic function φ, unique up to multiplication by a nonzero constant, such that div(φ) + D + [O] ≥ 0. The only divisors ≥ 0 of degree 1 are of the form [P]. Hence there is a well-defined point P such that D + [O] ∼ [P], i.e., such that D ∼ [P] − [O].

Thus we have a canonical bijection C(k) → Pic^{0}(C), from which C(k) inherits the structure of an abelian group. Note that this group structure is determined by the condition: P + Q = S if and only if [P] + [Q] ∼ [S] + [O].

I claim that this is the same structure as defined in the last section. Let P, Q ∈ C(k), and suppose P + Q = S with the law of composition in §3. Let L_{1} be the line through P and Q, and let L_{2} be the line through O and S. From the definition of S, we know that L_{1} and L_{2} have a common point R as their third points of intersection. Regard L_{1} and L_{2} as linear forms in X, Y, Z, and let φ = \frac{L_{1}}{L_{2}} . Then φ has zeros at P, Q, R and poles at O, S, R, and so

div(φ) = [P] + [Q] + [R] − [O] − [S] − [R] = [P] + [Q] − [S] − [O].

Henc [P] + [Q] ∼ [S] + [O], and P + Q = S according to the group structure defined by the bijection.

Perfect base fields. Let C be a nonsingular absolutely irreducible plane projective curve over a perfect field k (e.g., a field of characteristic zero or a finite field), and let F (X, Y, Z) be the polynomial defining C. We can again form k[x, y, z] = k[X, Y, Z]/(F (X, Y, Z))—it is an integral domain, and remains so even when tensored with k^{al}—and the field k(x, y, z)_{0} ⊂ k(x, y, z). We define k(x, y, z)_{0} to be the field of meromorphic functions of C. We can no longer identify its elements with functions on C(k) \ {finite set}, because, for example, C(k) may be empty. However, we can identify its elements with functions on C(k^{al}) \ {finite set}. From another perspective, we can say that a meromorphic function φ on C(k^{al}), i.e., an element of k^{al}(x, y, z)_{0}, is defined over (or rational over) k if it lies in the subfield k(x, y, z)_{0} of k^{al}(x, y, z)_{0}.

The Galois group Γ = Gal(k^{al}/k) acts on C(k^{al}). Its orbits are finite because every P ∈ C(k^{al}) has coordinates in some finite extension of k. We deduce an action of Γ on Div(C(k^{al})): τ(∑ n_{P} [P]) = ∑ n_{p}[τP]. A divisor D is said to be defined over (or rational over) k if it is fixed by this action. Thus D is rational over k if and only if all P in each Γ-orbit have the same coefficients n_{P} in D.

For a divisor D on C rational over k, we can define L(D) to be the set of all meromorphic functions on C rational over k such that divφ+D ≥ 0 (together with 0). Then the Riemann-Roch theorem continues to hold, and there is a bijection

P ↦ [P] − [O] : C(k) → Pic^{0}(C)

where Pic^{0}(C) = (Pic^{0}(C(k^{al}))^{Γ}, i.e., it is the group of divisor classes of degree zero (over k^{al}) fixed by the action of Γ. Unfortunately, such a class need not be represented by a divisor fixed by the action of Γ.

Exercise 4.8. Find a necessary and sufficient condition for the line L : Y = cX + d to be an inflectional tangent to the affine curve C : Y^{2} = X^{3} + aX + b, i.e., to meet C at a point P with I(P, L ∩ C) = 3. Hence find a general formula for the elliptic curves in canonical form having a rational point of order 3.

5. Definition of an Elliptic Curve

Definition 5.1. Let k be a field. An elliptic curve over k can be defined, according to taste, as:

(a) A complete nonsingular curve E of genus 1 over k together with a point O ∈ E(k).

(b) A nonsingular plane projective E of degree 3 together with a point O ∈ E(k).

(c) A nonsingular plane projective curve E of the form

Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} = X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3}

The relation between these definitions is as follows. Let E be as in (c). Then E(k) contains a canonical element O = (0 : 1 : 0), and the pair (E, O) satisfies the other two definitions. This is obvious for (b), and (a) follows from the formula on p9.

Let (E, O) be as in (a). Then (see below) there is an isomorphism from E onto a curve as in (c) sending O to (0 : 1 : 0).

Let (E, O) be as in (b). Then (see below) there is a change of variables transforming E into a curve as in (c) and O into (0 : 1 : 0) (and if O is a point of inflection, the change of variables can be taken to be linear).

Plane projective cubic curves with a rational inflection point. Let (E, O) be a nonsingular cubic curve in ℙ^{2}(k). In this subsection, I assume that O is a point of inflection, and I show that:

(a) after a linear change of variables (with coefficients in k), the point O will be (0 : 1 : 0) and its tangent line will be L_{∞} : Z = 0;

(b) if (0 : 1 : 0) ∈ E(k) and the tangent line to E at (0 : 1 : 0) is L_{∞} : Z = 0, then the equation of E has the form (5.1c).

Proof of (a). Let (a : b : c) ∈ ℙ^{2}(k), and assume b ≠ 0. The map

(x : y : z) → (bx − ay : by : bz − cy)

is well-defined for all (x : y : z) ∈ ℙ^{2}(k) and sends (a : b : c) to (0 : b^{2} : 0) = (0 : 1 : 0). If b = 0, but c ≠ 0, we first interchange the y and z coordinates.

Consider a line

L : aX + bY + cZ = 0, a, b, c ∈ k, not all a, b, c zero.

Choose A = (a_{ij}) to be an invertible 3 × 3 matrix whose first two columns are orthogonal to (a, b, c), and define a change of variables

A ( \begin{matrix}X′ \\ Y′ \\ Z′ \end{matrix} ) = ( \begin{matrix}X \\ Y \\ Z \end{matrix} ) .

With respect to the variables X′, Y′, Z′, the equation of the line L becomes

0 = (a, b, c) ( \begin{matrix}X \\ Y \\ Z \end{matrix} ) = (a, b, c)A ( \begin{matrix}X′ \\ Y′ \\ Z′ \end{matrix} ) = (0, 0, d) ( \begin{matrix}X′ \\ Y′ \\ Z′ \end{matrix} ) = dZ′.

Moreover, d ≠ 0, and so we may take the equation of the line to be Z′ = 0.

This completes the proof of (a).

Proof of (b). The general cubic form is F (X, Y, Z):

c_{1}X^{3} + c_{2}X^{2}Y + c_{3}X^{2}Z + c_{4}XY^{2} + c_{5}XY Z + c_{6}XZ^{2} + c_{7}Y^{3} + c_{8}Y^{2}Z + c_{9}Y Z^{2} + c_{10}Z^{3}.

Let E be the curve F (X, Y, Z) = 0. We assume that E is nonsingular; in particular, this implies that F is absolutely irreducible.

If O = (0 : 1 : 0) lies on E, then c_{7} = 0 .

Recall that U_{1} = {(x : y : z) | y = 1}, and we identify U_{1} with 𝔸^{2} via (x : 1 : z) ↔ (x : z). The curve C ∩ U_{1} is an affine curve with equation F (X, 1, Z):

c_{1}X^{3} + c_{2}X^{2} + c_{3}X^{2}Z + c_{4}X + c_{5}XZ + c_{6}XZ^{2} + c_{8}Z + c_{9}Z^{2} + c_{10}Z^{3}.

The tangent line at (0 : 1 : 0) ↔ (0, 0) is

c_{4}X + c_{8}Z = 0.

If this is L_{∞} : Z = 0, then c_{4} = 0 . Since E is nonsingular, we must have c_{8} ≠ 0 .

According to (1.5), the intersection number

I(O, L_{∞} ∩ E) ≤ dim_{k} k[X, Z]/(Z, F (X, 1, Z)).

But

k[X, Z]/(Z, F (X, 1, Z)) ≈ k[X]/(c_{2}X^{2} + c_{1}X^{3}).

If O is a point of inflection, then I(O, L_{∞} ∩ E) ≥ 3, and so c_{2} = 0 .

On combining the boxed statements, we find that our equation has become

c_{1}X^{3} + c_{3}X^{2}Z + c_{5}XY Z + c_{6}XZ^{2} + c_{8}Y^{2}Z + c_{9}Y Z^{2} + c_{10}Z^{3}, c_{8} ≠ 0.

Moreover, c_{1} ≠ 0 because otherwise the polynomial is divisible by Z. Finally, after dividing through by c_{1} and replacing Z with \frac{Z}{−c_{8}} , we obtain an equation of the same form as that in (5.1c).

Remark 5.2 (Remedial math.). ^{7} The Hessian of a homogeneous polynomial F (X, Y, Z) is the matrix

H(X, Y, Z) = ( \begin{matrix}\frac{∂^{2}F}{∂X^{2}} & \frac{∂^{2}F}{∂X∂Y} & \frac{∂^{2}F}{∂X∂Z} \\ \frac{∂^{2}F}{∂X∂Y} & \frac{∂^{2}F}{∂Y^{2}} & \frac{∂^{2}F}{∂Y ∂Z} \\ \frac{∂^{2}F}{∂X∂Z} & \frac{∂^{2}F}{∂Y ∂Z} & \frac{∂^{2}F}{∂Z^{2}} \end{matrix} ) .

Assume char k ≠ 2. Then a nonsingular point (a : b : c) on the curve C : F = 0 is a point of inflection if and only if det H(a, b, c) = 0 ([Kn] p38). This fact can be used to find a point of inflection over k on a cubic curve (when it exists), and once one has such a point, the above procedure allows one to find an equation for the curve in the form (5.1c) (ibid. 3.1).

If F has degree d, then det H has degree 3(d − 2). Thus, an irreducible cubic curve has at least one point of inflection over k^{al}, and at most 3. Unfortunately, it may have no point of inflection with coordinates in k.

General plane projective curves. As we just noted, a plane projective cubic curve may not have a point of inflection with coordinates in k. An invertible linear change of variables will not change this (it will only multiply the Hessian by a nonzero constant). However, if the curve has some point with coordinates in k, then there is a method (due to Nagell, 1928/29) that transforms the equation by a nonlinear change of variables so that the point becomes a point of inflection, still with coordinates in k ([C2], p34).

Complete nonsingular curves of genus 1. Here we assume some algebraic geometry. Let E be a complete nonsingular curve of genus 1 over a field k and let O ∈ E(k). According to the Riemann-Roch theorem, the meromorphic functions on E having no poles except at O and having at worst a pole of order m ≥ 1 at O, form a vector space of dimension m over k, i.e., L(m[O]) has dimension m for m ≥ 1.

The constant functions lie in L([O]), and according to the Riemann-Roch theorem, there are no other. Thus 1 is a basis for L([O]).

Choose x so that {1, x} is a basis for L(2[O]).

7These are topics that were once taught in high school, but are no longer taught anywhere, well, hardly anywhere.

Choose y so that {1, x, y} is a basis for L(3[O]).

Then {1, x, y, x^{2}} is a basis for L(4[O]). (If it were linearly dependent, then x^{2} would have to be a linear combination of 1, x, y, but then it couldn’t have a quadruple pole at O.)

And {1, x, y, x^{2}, xy} is a basis for L(5[O]).

The subset {1, x, y, x^{2}, xy, x^{3}, y^{2}} of L(6[O]) contains 7 elements, and so must be linearly dependent: there exist constants a_{i} such that

a_{0}y^{2} + a_{1}xy + a_{3}y = a′_{0}x^{3} + a_{2}X^{2} + a_{4}X + a_{6}

(as regular functions on E \ {O}). Moreover, a_{0} and a′_{0} must be nonzero, because the set with either x^{3} or y^{2} omitted is linearly independent, and so, after multiplying through by a constant and making a change of variables, we can suppose both equal 1. The map P ↦ (x(P), y(P)) sends E \ {O} onto the plane affine curve

C : Y^{2} + a_{1}XY + a_{3}Y = X^{3} + a_{2}X^{2} + a_{4}X + a_{6}.

The function x has a double pole at O and no other pole, and so it has only two other zeros. Therefore, the composite

E \ {O} → C → 𝔸^{1}, P ↦ (x(P), y(P)) ↦ x(P)

has degree 2, i.e., it is 2 : 1 on points with coordinates in k^{al} (at least, if the characteristic is zero). Similarly, the composite

E \ {O} → C → 𝔸^{1}, P ↦ (x(P), y(P)) ↦ y(P)

has degree 3. The degree of E \ {O} → C divides both 2 and 3, and therefore is 1. In fact, it is an isomorphism, and it extends to an isomorphism of E onto the Zariski closure of C in ℙ^{2}, i.e., onto the curve given by an equation of the form (5.1c).

The canonical form of the equation. Thus, however we define it, an elliptic curve is isomorphic to a curve of the form

E : Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} = X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3},

and, conversely, every nonsingular such E is an elliptic curve. This is usually referred to as the canonical or Weierstrass equation of the curve, but how canonical is it? One can show that it is canonical up to a change of variables of the form:

X = u^{2}X′ + r
Y = u^{3}Y′ + su^{2}X′ + t

with u, r, s, t ∈ k and u ≠ 0.

Everything becomes simpler if we assume that chark ≠ 2, 3. A change of variables

X′ = X, Y′ = Y + \frac{a_{1}}{2} X, Z′ = Z

will eliminate the XY Z term, and a change of variables

X′ = X + \frac{a_{2}}{3} , Y′ = Y + \frac{a_{3}}{2} , Z′ = Z

will then eliminate the X^{2} and Y terms. Thus we arrive at the equation:

Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}.

Theorem 5.3. Assume char k ≠ 2, 3.

(a) The curve

E(a, b) : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ k,

is nonsingular, and hence (together with O = (0 : 1 : 0)) defines an elliptic curve over k, if and only if 4a^{3} + 27b^{2} ≠ 0.

(b) Every elliptic curve over k is isomorphic to one of the form E(a, b).

(c) Two elliptic curves E(a, b) and E(a′, b′) are isomorphic if and only if there exists a c ∈ k^{×} such a′ = c^{4}a, b′ = c^{6}b; the isomorphism is then

(x : y : z) ↦ (c^{2}x : c^{3}y : z).

Proof. (a) We proved in (1.3) that the affine curve

Y^{2} = X^{3} + aX + b

is nonsingular if and only if 4a^{3} + 27b^{2} ≠ 0. The point (0 : 1 : 0) is always nonsingular. (b) This was discussed above.

(c) The “if” is obvious. We omit the “only if” (see, for example, [S1] pp64–65).

Remark 5.4. For an elliptic curve E, define

j(E) = \frac{1728(4a^{3})}{4a^{3} + 27b^{2}}

if E ≈ E(a, b). Since the expression on the right is unchanged when (a, b) is replaced by (c^{4}a, c^{6}b), this is well-defined, and E ≈ E′ ⟹ j(E) = j(E′). Conversely, j(E) = j(E′) ⟹ E ≈ E′ when k is algebraically closed (see later), but not otherwise. For example, if c is not a square in k, then

Y^{2}Z = X^{3} + ac^{2}XZ^{2} + bc^{3}Z^{3}

has the same j invariant as E(a, b), but it is not isomorphic to it.

The group law for the canonical form. The point at ∞ is the zero for the group law. The group law is determined by:

P + Q + R = O ⟺ P, Q, R lie on a straight line;
if P = (x : y : z), then − P = (x : −y : z).

In particular, −P = P, i.e., P has order 2 if and only if y = 0. The points of order two are the points (x : 0 : 1) where x is a root of X^{3} + aX + b.

6. Reduction of an Elliptic Curve Modulo p

Consider an elliptic curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ ℚ, Δ = 4a^{3} + 27b^{2} ≠ 0.

After a change of variables we may suppose a, b ∈ ℤ, and so we may look at them modulo p to get a curve over 𝔽_{p} =_{df} ℤ/pℤ. In this section, we examine what curves we get in this fashion.

Algebraic groups of dimension 1. Let k be an arbitrary perfect field. The following is a complete list of connected algebraic curves over k having group structures defined by polynomial maps.

Elliptic curves. These are the only projective curves having a group structure defined by polynomial maps.

The additive group. The affine line 𝔸^{1} is a group under addition:

𝔸^{1}(k) = k, (x, y) ↦ x + y : k × k → k.

We sometimes write 𝔾_{a} for 𝔸^{1} endowed with this group structure.

The multiplicative group. The affine line with the origin removed is a group under multiplication:

𝔸^{1}(k) \ {(0)} = k^{×}, (x, y) ↦ xy : k^{×} × k^{×} → k^{×}.

We sometimes write 𝔾_{m} for 𝔸^{1} \ {(0)} endowed with this group structure. Note that the map x ↦ (x, x^{−1}) identifies 𝔾_{m} with the plane affine curve XY = 1.

Twisted multiplicative groups. Let a ∈ k \k^{2}, and let L = k[\sqrt{a}]. There is an algebraic group G over k such that

G(k) = {γ ∈ L^{×} | Nm_{L/k} γ = 1}.

Let α = \sqrt{a}, so that \{1, α\} is a basis for L as a k-vector space. Then Nm(x + αy) = x^{2} − ay^{2} and (x + αy)(x′ + αy′) = xx′ + ayy′ + α(xy′ + x′y). We define G to be the plane affine curve X^{2} − aY^{2} = 1, with the group structure

(x, y) × (x′, y′) = (xx′ + ayy′, xy′ + x′y).

We denote this group by 𝔾_{m}[a]. For example, when k = ℝ and a = −1, we get the circle group X^{2} + Y^{2} = 1.

Note that a change of variables transforms 𝔾_{m}[a] into 𝔾_{m}[ac^{2}], any c ≠ 0, and so, up to a change of variables, 𝔾_{m}[a] depends only on the field k[\sqrt{a}]. The equations defining 𝔾_{m}[a] still define an algebraic group when a is a square in k, say a = α^{2}, but then X^{2} − aY^{2} = (X + αY)(X − αY), and so the change of variables X′ = X + αY, Y′ = X − αY transforms the group into 𝔾_{m}. In particular, this shows that 𝔾_{m}[a] becomes isomorphic to 𝔾_{m} over k[\sqrt{a}], and so it can be thought of a “twist” of 𝔾_{m}.

Remark 6.1. Let k = 𝔽_{q}, the field with q-elements. Then 𝔾_{a}(k) has q-elements, 𝔾_{m}(k) has q − 1 elements, and 𝔾_{m}[a](k) has q + 1 elements (here a is any nonsquare in k). Only the last is not obvious. From the definition of 𝔾_{m}[a], we know there is an exact sequence

0 → 𝔾_{m}[a](𝔽_{q}) → (𝔽_{q^{2}})^{×} ⟶_{Nm} 𝔽_{q}^{×} → 0.

The second map is surjective (because a quadratic form in at least three variables over a finite field always has a nontrivial zero (Serre, Course on Arithmetic)), and so

#𝔾_{m}[a](𝔽_{q}) = (q^{2} − 1)/(q − 1) = q + 1.

We make a few remarks concerning the proofs of the above statements. We have seen that if a nonsingular projective curve has genus 1, then its has a group structure, but why is the converse true? The simplest explanation (for the case k = ℂ) comes from topology. The Lefschetz fixed point theorem^{8} says that, if M is a compact oriented manifold, then for any continuous map α : M → M,

(Δ · Γ_{α}) = ∑(−1)^{i}Trace(α|H^{i}(M, ℚ)).

Here Δ is the diagonal in M × M and Γ_{α} is the graph of α, so that (Δ · Γ_{α}) is the number of “fixed points of α counting multiplicities”. Let L(α) be the integer on the right. If M has a group structure, then the translation map τ_{a} = (x ↦ x + a), a ≠ 0, has no fixed points, and so

L(τ_{a}) = (Δ · Γ_{α}) = 0.

But a ↦ L(τ_{a}) : M → ℤ is continuous, and hence constant on each connected component. On letting a tend to zero, we find that L(τ_{0}) = 0. But τ_{0} is the identity map, and so

L(τ_{0}) = ∑(−1)^{i} Tr(id |H^{i}(M, ℚ)) = ∑(−1)^{i} dim_{ℚ} H^{i}(M, ℚ).

Thus, if M has a group structure, its Euler-Poincaré characteristic must be zero. The Euler-Poincaré characteristic of a complex curve of genus g is 1 − 2g + 1 = 2 − 2g, and so g = 1 the curve has a continuous group structure.

A similar argument works over any field. One proves directly that for the diagonal Δ in C × C,

(Δ · Δ) = 2 − 2g, (Δ · Γ_{τ_{a}}) = 0, a ≠ 0,

and then “by continuity” that (Δ · Δ) = (Δ · Γ_{τ_{a}}).

The proof that 𝔾_{a} and 𝔾_{m} are the only affine algebraic groups of dimension one can be found in most books on algebraic groups when k is algebraically closed (see for example, Borel, Linear Algebraic Groups, 10.9, who notes that the first published proof is in an article of Grothendieck). The extension to nonalgebraically closed fields is an easy exercise in Galois cohomology.

Singular cubic curves. Let E be a singular plane projective curve over a perfect field k of characteristic ≠ 2. As we noted on p8, it will have exactly one singular point S, and S will have coordinates in k. Assume E(k) contains a point O ≠ S. It is a curious fact that exactly the same definition as in the nonsingular case turns E(k) \ {S} into a group. Namely, consider the line through two nonsingular points P and Q. According to Bezout’s theorem and (1.7), it will intersect the curve in exactly one additional point R, which can’t be singular. Define P + Q to be the third point of intersection of the line through R and O with the cubic. We examine this in the three possible cases.

Cubic curves with a cusp. The plane projective curve

E : Y^{2}Z = X^{3}

has a cusp at S = (0 : 0 : 1) because the affine curve Y^{2} = X^{3} has a cusp at (0, 0). Note that S is the only point on the projective curve with Y -coordinate zero, and so E(k) \ {S} is equal to the set of points on the affine curve E ∩ {Y ≠ 0}, i.e., on the curve

E_{1} : Z = X^{3}.

8See, for example, Greenberg, Lectures on Algebraic Topology.

The line Z = αX + β intersects E_{1} at the points P_{1} = (x_{1}, z_{1}), P_{2} = (x_{2}, z_{2}), P_{3} = (x_{3}, z_{3}) with x_{1}, x_{2}, x_{3} roots of

X^{3} − αX − β.

Because the coefficient of X^{2} in this polynomial is zero, the sum x_{1} + x_{2} + x_{3} of its roots is zero. Therefore the map

P ↦ x(P) : E_{1}(k) → k

has the property that

P_{1} + P_{2} + P_{3} = 0 ⟹ x(P_{1}) + x(P_{2}) + x(P_{3}) = 0.

Since O = (0, 0), the map P ↦ −P is (x, z) ↦ (−x, −z), and so P ↦ x(P) also has the property that

x(−P) = −P.

These two properties imply that P ↦ x(P) : E_{1}(k) → k is a homomorphism. In fact, it is an isomorphism. In summary: the map P ↦ \frac{x(P)}{y(P)} : E(k) \ S → 𝔾_{a}(k) is an isomorphism.

Cubic curves with a node. The curve

Y^{2}Z = X^{3} + cX^{2}Z, c ≠ 0,

has a node at (0 : 0 : 1) because the affine curve

Y^{2} = X^{3} + cX^{2}, c ≠ 0,

has a node at (0, 0). The tangent lines at (0, 0) are given by the equation

Y^{2} − cX^{2} = 0.

If c is a square, this factors as

(Y − \sqrt{c}X)(Y + \sqrt{c}X) = 0

and we get two tangent lines. In this case the tangent lines are said to be rational (i.e., defined) over k. When endowed with its group structure, E \ {singular point} becomes isomorphic to 𝔾_{m}.

If c is not a square, so the tangent lines are not rational over k, then E \{singular point} ≈ 𝔾_{m}[c]. See [C_{2}], Chapter 9.

Criterion. We now derive a criterion for deciding which of the above cases the curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ k, Δ = 4a^{3} + 27b^{2} = 0

falls into. We assume char k ≠ 2, 3. Since the point (0 : 1 : 0) is always nonsingular, we only need to study the affine curve

E_{0} : Y^{2} = X^{3} + aX + b.

We try to find a t such that equation is

\begin{aligned}Y^{2} & = & (X − t)^{2}(X + 2t) \\ & = & X^{3} − 3t^{2}X + 2t^{3}. \end{aligned}

For this, we need to choose t so that

t^{2} = −\frac{a}{3}, t^{3} = \frac{b}{2}.

Hence t = \frac{b/2}{−a/3} = −\frac{3}{2} \frac{b}{a}. Using that Δ = 0, one checks that this works.

Now, we can rewrite the equation as

Y^{2} = 3t(X − t)^{2} + (X − t)^{3}.

This has a singularity at (t, 0), which is a cusp if 3t = 0, a node with rational tangents if 3t is a nonzero square in k, and a node with nonrational tangents if 3t is a nonzero nonsquare. Note that

−2ab = −2(−3t^{2})(2t^{3}) = (2t^{2})^{2}(3t)

and so 3t is zero or nonzero, a square or a nonsquare, according as −2ab is.

Reduction of an elliptic curve. Consider an elliptic curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ ℚ, Δ = 4a^{3} + 27b^{2} ≠ 0.

We make a change a variables X ↦ X/c^{2}, Y ↦ Y/c^{3} with c chosen so that the new a, b are integers and |Δ| is minimal—such an equation is said to be minimal. The equation

Ē : Y^{2}Z = X^{3} + āXZ^{2} + b̄Z^{3}

where ā and b̄ are the images of a and b in 𝔽_{p} is called the reduction of E modulo p. There are three cases to consider (and two subcases).

(a) Good reduction. If p ≠ 2 and p does not divide Δ, then Ē is an elliptic curve over 𝔽_{p}. For a point P = (x : y : z) on E, we can choose a representative (x, y, z) for P with x, y, z ∈ ℤ and having no common factor, and then P̄ =_{df} (x̄ : ȳ : z̄) will be a well-defined point on Ē. Since (0 : 1 : 0) reduces to (0 : 1 : 0) and lines reduce to lines, the map E(ℚ) → Ē(𝔽_{p}) is a homomorphism, and Hensel’s lemma implies that E(ℚ_{p}) → Ē(𝔽_{p}) is surjective (see 2.10). The Riemann hypothesis (see later) shows that

|#Ē(𝔽_{p}) − p − 1| ≤ 2\sqrt{p}.

(b) Cuspidal reduction. Here the reduced curve has a cusp as singularity. For p ≠ 2, 3, it occurs exactly when p|4a^{3} + 27b^{2} and p| − 2ab.

(c) Nodal reduction. Here the reduced curve has a node as singularity. For p ≠ 2, 3, it occurs exactly when p|4a^{3} + 27b^{2} and p does not divide −2ab. The tangents at the node are rational over 𝔽_{p} if and only if −2ab mod p is a square in 𝔽_{p}.

The following table summarizes our results (p ≠ 2, 3, N is the number of nonsingular points on Ē with coordinates in 𝔽_{p}).

Reduction  Δ mod p −2ab mod p  E^{ns}  N
good  ≠ 0  \overline{E}  |N − p − 1| ≤ 2\sqrt{p}
cusp  0  0  𝔾_{a}  p
node; rational tangents  0  □  𝔾_{m}  p − 1
node; nonrational tangents  0  ≠ □  𝔾_{m}[−2āb̄]  p + 1

Other names:

cuspidal = additive;

nodal with rational tangents = split multiplicative;

nodal with nonrational tangents = nonsplit multiplicative.

Semistable reduction. If E has good or nodal reduction, then the minimal equation remains minimal after replacing the ground field (here ℚ) by a larger field. This is not so for cuspidal reduction. Consider, for example, the curve

E : Y^{2}Z = X^{3} + pXZ^{2} + pZ^{3}.

After passing to a larger extension, in which p is a sixth power, say, c^{6} = p, we can make a change of variables so that the equation becomes

E : Y^{2}Z = X^{3} + c^{2}XZ^{2} + Z^{3}.

This reduces to

Y^{2}Z = X^{3} + Z^{3},

which is nonsingular. In fact, for any curve E with cuspidal reduction at p, there will exist a finite extension of the ground field such that E will have either have good or nodal reduction at the primes over p.

In summary: good and nodal reduction are not changed by a field extension (in fact, the minimal model remains minimal) but cuspidal reduction always becomes good or nodal reduction in an appropriate finite extension (and the minimal model changes). For this reason, a curve is often said to have semistable reduction at p if it has good or nodal reduction there.

Reduction modulo 2 and 3. When considering reduction at 2 or 3, one needs to consider the full equation

Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} = X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3}

because it may be possible to find an equation of this form that is “more minimal” for 2 or 3 than any of the form

Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}.

For example, it may be possible to find one of the first form that gives a nonsingular curve over 𝔽_{2}, whereas all equations of the second form become singular over 𝔽_{2} (see 1.3).

Other fields. Throughout this section, we can replace ℚ and ℤ with ℚ_{p} and ℤ_{p}, or in fact with any local field and its ring of integers. Also, we can replace ℚ and ℤ with a number field K and its ring of integers, with the caution that, for a number field K with class number ≠ 1, it may not be possible to find an equation for the elliptic curve that is minimal for all primes simultaneously.

Exercise 6.2. (a) Find examples of elliptic curves E over ℚ such that (i) Ē has a cusp S which lifts to a point in E(ℚ_{p}); (ii) Ē has a node S which lifts to a point in E(ℚ_{p}); (iii) Ē has a node S which does not lift to a point in E(ℚ_{p}). Here Ē is the reduction of the curve modulo a prime p ≠ 2, 3. The equation you give for

E should be a minimal equation of the standard form Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}.

(b) For the example you gave in (a)(i), decide whether it acquires good or nodal reduction in a finite extension of ℚ.

7. Elliptic Curves over ℚ_{p}

Notation: A nonzero rational number a can be written a = p^{m} \frac{r}{s} with r and s not divisible by p. We then set ord_{p}(a) = m. The following rule is obvious:

ord_{p}(a + b) ≥ min{ord_{p}(a), ord_{p}(b)}, with equality unless ord_{p}(a) = ord_{p}(b).

Similarly, for an a ∈ ℚ_{p}, we set ord_{p}(a) = m if a ∈ p^{m}ℤ_{p} \ p^{m+1}ℤ_{p}. The same rule holds, and the two definitions of ord_{p} agree on ℚ. In both cases, we set ord_{p}(0) = ∞. Note that ord_{p} is a homomorphism ℚ_{p}^{×} →ℤ.

Consider a curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ ℚ_{p}, 4a^{3} + 27b^{2} ≠ 0.

After a change of variables X ↦ X/c^{2}, Y ↦ Y/c^{3}, Z ↦ Z, we may suppose that a, b ∈ ℤ_{p}. As in the last section, we obtain from E a curve Ē over 𝔽_{p} and a reduction map

P ↦ P̄ : E(ℚ_{p}) → Ē(𝔽_{p}).

We shall define a filtration

E(ℚ_{p}) ⊃ E^{0}(ℚ_{p}) ⊃ E^{1}(ℚ_{p}) ⊃ ⋯ ⊃ E^{n}(ℚ_{p}) ⊃ ⋯

and identify the quotients. First, define

E^{0}(ℚ_{p}) = {P | P̄ is nonsingular}.

It is a subgroup because, as we observed on p26, a line through two nonsingular points on a cubic (or tangent to a nonsingular point), will meet the cubic again at a nonsingular point.

Write Ē^{ns} for Ē \ {any singular point}. The reduction map

P ↦ P̄ : E^{0}(ℚ_{p}) → Ē^{ns}(𝔽_{p})

is a homomorphism, and we define E^{1}(ℚ_{p}) be its kernel. Thus E^{1}(ℚ_{p}) consists of the points P that can be represented as (x : y : z) with x and z divisible by p but y not divisible by p. In particular, P ∈ E^{1}(ℚ_{p}) ⟹ y(P) ≠ 0.

Define

E^{n}(ℚ_{p}) = \{P ∈ E^{1}(ℚ_{p}) | \frac{x(P)}{y(P)} ∈ p^{n}ℤ_{p}\}.

Theorem 7.1. The filtration E(ℚ_{p}) ⊃ E^{0}(ℚ_{p}) ⊃ E^{1}(ℚ_{p}) ⊃ ⋯ ⊃ E^{n}(ℚ_{p}) ⊃ ⋯ has the following properties:

(a) the quotient E(ℚ_{p})/E^{0}(ℚ_{p}) is finite;

(b) the map P ↦ P̄ defines an isomorphism E^{0}(ℚ_{p})/E^{1}(ℚ_{p}) → Ē(𝔽_{p});

(c) for n ≥ 1, E^{n}(ℚ_{p}) is a subgroup of E(ℚ_{p}), and the map P ↦ p^{−n} \frac{x(P)}{y(P)} mod p is an isomorphism E^{n}(ℚ_{p})/E^{n+1}(ℚ_{p}) → 𝔽_{p};

(d) the filtration is exhaustive, i.e., ∩_{n}E^{n}(ℚ_{p}) = {0}.

Proof. (a) We prove that E(ℚ_{p}) has a natural topology with respect to which it is compact and E^{0}(ℚ_{p}) is an open subgroup. Since E(ℚ_{p}) is a union of the cosets of E^{0}(ℚ_{p}), it will follow that there can only be finitely many of them.

Endow ℚ_{p}×ℚ_{p}×ℚ_{p} with the product topology, ℚ_{p}^{3}\{(0, 0, 0)} with the subspace topology, and ℙ^{2}(ℚ_{p}) with the quotient topology via ℚ_{p}^{3} \ {(0, 0, 0)} → ℙ^{2}(ℚ_{p}). Then ℙ^{2}(ℚ_{p}) is the union of the images of the sets ℤ_{p}^{×} × ℤ_{p} × ℤ_{p}, ℤ_{p} × ℤ_{p}^{×} × ℤ_{p}, ℤ_{p} × ℤ_{p} × ℤ_{p}^{×}, each of which is compact and open. Therefore ℙ^{2}(ℚ_{p}) is compact. Its subset E(ℚ_{p}) is closed, because it is the zero set of a polynomial. Relative to this topology on ℙ^{2}(ℚ_{p}) two points that are close will have the same reduction modulo p. Therefore E^{0}(ℚ_{p}) is the intersection of E(ℚ_{p}) with an open subset of ℙ^{2}(ℚ_{p}).

(b) Hensel’s lemma implies that the reduction map E^{0}(ℚ_{p}) → Ē(𝔽_{p}) is surjective, and we defined E^{1}(ℚ_{p}) to be its kernel.

(c) We assume (inductively) that E^{n}(ℚ_{p}) is a subgroup of E(ℚ_{p}). If P = (x : y : 1) lies in E^{1}(ℚ_{p}), then y ∉ ℤ_{p}. Set x = p^{−m}x_{0} and y = p^{−m′}y_{0} with x_{0} and y_{0} units in ℤ_{p}. Then

p^{−2m′}y_{0}^{2} = p^{−3m}x_{0}^{3} + ap^{−m}x_{0} + b.

On taking ord_{p} of the two sides, we find that −2m′ = −3m. Since m′ and m are integers, this implies that there is an integer n such m = 2n and m′ = 3n; in fact, n = ord_{p}(\frac{x}{y}).

The above discussion shows that if P = (x : y : z) ∈ E^{n}(ℚ_{p}) \ E^{n+1}(ℚ_{p}), n ≥ 1, then

\{ \begin{matrix}ord_{p}(x) & = & ord_{p}(z) − 2n \\ ord_{p}(y) & = & ord_{p}(z) − 3n. \end{matrix}

Hence P can be expressed P = (p^{n}x_{0} : y_{0} : p^{3n}z_{0}) with ord_{p}(y_{0}) = 0 and x_{0}, z_{0} ∈ ℤ_{p}. In fact, this is true for all P ∈ E^{n}(ℚ_{p}). Since P lies on E,

p^{3n}y_{0}^{2}z_{0} = p^{3n}x_{0}^{3} + ap^{7n}x_{0}z_{0}^{2} + bp^{9n}z_{0}^{3},

and so P_{0} =_{df} (x̄_{0} : ȳ_{0} : z̄_{0}) lies on the curve

E_{0} : Y^{2}Z = X^{3}.

As ȳ_{0} ≠ 0, P_{0} is not the singular point of E_{0}. From the description of the group laws in terms of chords and tangents, we see that the map

P ↦ P_{0} : E^{n}(ℚ_{p}) → E_{0}(𝔽_{p})

is a homomorphism. Its kernel is E^{n+1}(ℚ_{p}), which is therefore a subgroup, and it follows from Hensel’s lemma that its image is the set of nonsingular points of E_{0}(𝔽_{p}). We know (see p27) that Q ↦ \frac{x(Q)}{y(Q)} is an isomorphism E_{0}(𝔽_{p}) \ \{singularity\} → 𝔽_{p}. The composite

P ↦ P_{0} ↦ \frac{x(P_{0})}{y(P_{0})} is P ↦ \frac{p^{−n}x(P)}{y(P)} mod p.

(d) If P ∈ ∩E^{n}(ℚ_{p}), then x(P) = 0, y(P) ≠ 0. This implies that either z(P) = 0 or Y^{2} = bZ^{2}, but the second equation would contradict P ∈ E^{1}(ℚ_{p}). Hence z(P) = 0 and P = (0 : 1 : 0).

Remark 7.2. In the above, ℚ_{p} can be replaced with any local field.

Remark 7.3. It is possible to say much more about the structure of E(ℚ_{p}). A oneparameter commutative formal group over a (commutative) ring R is a power series F (X, Y) ∈ R[[X, Y]] satisfying the following conditions:

(a) F (X, Y) = X + Y + terms of degree ≥ 2;

(b) F (X, F (Y, Z)) = F (F (X, Y), Z);

(c) F (X, Y) = F (Y, X);

(d) there is a unique power series i(T) ∈ R[[T]] such that F (T, i(T)) = 0.

(e) F (X, 0) = X and F (0, Y) = Y.

In fact, (a) and (b) imply (d) and (e). If F is such a formal group over ℤ_{p}, then the series F (a, b) converges for a, b ∈ pℤ_{p}, and so F makes pℤ_{p} into a group. One can show ([S1] Chapter IV) that an elliptic curve E over ℚ_{p} defines a formal group F over ℤ_{p}, and that there are power series x(T) and y(T) such that t ↦ (x(t) : y(t) : 1) is an isomorphism of pℤ_{p} (endowed with the group structure provided by F) onto E^{1}(ℚ_{p}). This is useful because it allows us to derive results about elliptic curves from results about formal groups, which are generally easier to prove.

An algorithm to compute intersection numbers. For f(X, Y), g(X, Y) ∈ k[X, Y], set I(f, g) = I(origin, {f = 0} ∩ {g = 0}). We explain how to compute I(f, g) using only the following properties of the symbol: I(X, Y) = 1; I(f, g) = I(g, f); I(f, gh) = I(f, g) + I(f, h); I(f, g + hf) = I(f, g) for all h; I(f, g) = 0 if g(0, 0) ≠ 0. Regard f(X, Y) and g(X, Y) as elements of k[X][Y]. The theory of resultants allows us to construct polynomials a(X, Y) and b(X, Y) such that af + bg = r(X) with r(X) ∈ k[X] and deg_{Y} (b) < deg_{Y} (f), deg_{Y} (a) < deg_{Y} (g). Now

I(f, g) = I(f, bg) − I(f, b) = I(f, r) − I(f, b).

Continue in this fashion until Y is eliminated from one of the polynomials, say, from g, so that g = g(X) ∈ k[X]. Write g(X) = X^{m}g_{0}(X) where g_{0}(0) ≠ 0. Then

I(f, g) = mI(f, X).

After subtracting a multiple of X from f(X, Y), we can assume that it is a polynomial in Y. Write f(Y) = Y^{n}f_{0}(Y) where f_{0}(0) ≠ 0. Then

I(f, X) = n.

This algorithm is practical on a computer, but if the polynomials are monic when regarded as polynomials in Y, the following method is faster. If deg_{Y} (g) ≥ deg_{Y} (f), we can divide f into g (as polynomials in Y) and obtain

g = fh + r, deg_{Y} r < deg_{Y} f or r = 0.

Moreover,

I(f, g) = I(f, r).

Continue in this fashion until one of the polynomials has degree 1 in Y, and apply the following lemma.

Lemma 7.4. If f(0) = 0, then I(Y − f(X), g(X, Y)) = m where X^{m} is the power of X dividing g(X, f(X)).

Proof. We divide Y − f(X) into g(X, Y) (as polynomials in Y) to obtain

g(X, Y) = (Y − f(X))h(X, Y) + g(X, f(X)),

from which it follows that

I(Y − f(X), g(X, Y)) = I(Y − f(X), g(X, f(X)) = mI(Y − f(X), X).

Finally, since we are assuming f(0) = 0, f(X) = Xh(X), and so

I(Y − f(X), X) = I(Y, X) = 1.

8. Torsion Points

Throughout this section, E will be the elliptic curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ ℤ, Δ = 4a^{3} + 27b^{2} ≠ 0,

except that in second half of the section, we allow a, b ∈ ℤ_{p}.

Theorem 8.1 (Lutz-Nagell). If P = (x : y : 1) ∈ E(ℚ)_{tors}, then x, y ∈ ℤ and either y = 0 or y|Δ.

Remark 8.2. (a) The theorem provides an algorithm for finding all the torsion points on E: for each pair (x, y) ∈ ℤ with y = 0 or y|Δ, check to see whether (x : y : 1) is on E and whether it is a torsion point. It is not essential, but it helps, if the equation of E is chosen so that Δ is minimal among those with integer coefficients.

(b) The converse of the theorem is not true: a point P = (x : y : 1) ∈ E(ℚ) can satisfy the conditions in the theorem without being a torsion point.

(c) The theorem can often be used to prove that a point P ∈ E(ℚ) is of infinite order: compute multiples nP of P until you arrive at one whose coordinates are not integers, or better, just compute the x-coordinates of 2P, 4P, 8P, using the duplication formula (see the end of this section).

The theorem will follow from the next two results: the first says that if P and 2P have integer coordinates (when we set z = 1), then either y = 0 or y|Δ; the second implies that torsion points (hence also their multiples) have integer coordinates.

Lemma 8.3. Let P = (x_{1} : y_{1} : 1) ∈ E(ℚ). If P and 2P have integer coordinates (when we set z = 1), then either y_{1} = 0 or y_{1}|Δ.

Proof. Assume y_{1} ≠ 0, and set 2P = (x_{2} : y_{2} : 1). Then 2P is the second point of intersection of the tangent at P to the affine curve

Y^{2} = f(X), f(X) = X^{3} + aX + b.

The tangent line at P is

Y = αX + β, where α = (\frac{dY}{dX} )_{P} = \frac{f′(x_{1})}{2y_{1}}.

To find where this line intersects the affine curve, substitute for Y in the equation of the curve to obtain:

(αX + β)^{2} = X^{3} + aX + b.

Thus the X-coordinates of the points of intersection are the roots of the cubic:

X^{3} + aX + b − (αX + β)^{2} = X^{3} − α^{2}X^{2} + · · · .

But we know that the X-coordinates of these points are x_{1}, x_{1}, x_{2}, and so

x_{1} + x_{1} + x_{2} = α^{2}.

Since x_{1} and x_{2} are integers, so also are α^{2} and α = \frac{f′(x_{1})}{2y_{1}}. Thus y_{1}|f′(x_{1}), and directly from the equation y_{1}^{2} = f(x_{1}) we see that y_{1}|f(x_{1}). Hence y_{1} divides both f(x_{1}) and f′(x_{1}). The theory of resultants (see [C_{2}], Chapter on Remedial Mathematics) shows that

Δ = r(X)f(X) + s(X)f′(X), r(X), s(X) ∈ ℤ[X],

and so this implies that y_{1}|Δ. [In our case, r(X) = −27(X^{3} + aX − b) and s(X) = (3X^{2} + 4a)(3X^{2} + a).]

Proposition 8.4. The group E^{1}(ℚ_{p}) is torsion-free.

Before proving the proposition, we derive some consequences.

Corollary 8.5. If P = (x : y : 1) ∈ E(ℚ_{p})_{tors}, then x, y ∈ ℤ_{p}.

Proof. Recall that P̄ is obtained from P by choosing primitive coordinates (x : y : z) for P (i.e., coordinates such that x, y, z ∈ ℤ_{p} but not all of x, y, z ∈ pℤ_{p}), and setting P̄ = (x̄ : ȳ : z̄), and that E^{1}(ℚ_{p}) = {P ∈ E(ℚ_{p}) | P̄ = (0 : 1 : 0)}. If P = (x : y : 1) with x or y not in ℤ_{p}, then any primitive coordinates (x′ : y′ : z′) for P will have z′ ∈ pℤ_{p}. Hence z(P̄) = 0, which implies P̄ = (0 : 1 : 0), and so P ∈ E^{1}(ℚ_{p}). We have proved (the contrapositive of) the statement:

if P = (x : y : 1) ∉ E^{1}(ℚ_{p}), then x, y ∈ ℤ_{p}.

The proposition shows that if P is a nonzero torsion point, then P ∉ E^{1}(ℚ_{p}).

Corollary 8.6. If P = (x : y : 1) ∈ E(ℚ)_{tors}, then x, y ∈ ℤ.

Proof. This follows from the previous corollary, because if a rational number r is not an integer, then ord_{p}(r) < 0 for some p, and so r ∉ ℤ_{p}.

Corollary 8.7. If E has good reduction at p (i.e., p ≠ 2 and p does not divide Δ), then the reduction map

E(ℚ)_{tors} → Ē(𝔽_{p})

is injective.

Proof. Because E has good reduction, E^{0}(ℚ_{p}) = E(ℚ_{p}). The reduction map E(ℚ_{p}) → Ē(ℚ_{p}) has kernel E^{1}(ℚ_{p}), which intersects E(ℚ)_{tors} in {O}.

Remark 8.8. This puts a very serious restriction on the size of E(ℚ)_{tors}. For example, if E has good reduction at 5, then, according to the Riemann hypotheses, Ē will have at most 5 + 1 + 2\sqrt{5} points with coordinates in 𝔽_{5}, and so E will have at most 10 torsion points with coordinates in ℚ.

We now prove Proposition 8.4. In one case this follows directly from the results of Section 7. Let P ∈ E^{1}(ℚ_{p}) be a torsion point of order m not divisible by p. If P ≠ 0, then^{9} P ∈ E^{n}(ℚ_{p}) \ E^{n+1}(ℚ_{p}) for some n. But we have an isomorphism (of abelian groups)

P ↦ p^{−n} \frac{x(P)}{y(P)} : E^{n}(ℚ_{p})/E^{n+1}(ℚ_{p}) ⟶^{≈} ℤ/pℤ

(Theorem 7.1c). By assumption, the image of P under this map is nonzero, which implies that m times the image will also be nonzero. This contradicts the fact that mP = 0.

To prove the general case, where p may divide the order of P, we have to analyze the filtration more carefully.

For P ∈ E^{1}(ℚ_{p}), we have y(P) ≠ 0, which suggests that we look at the affine curve E ∩ {(x : y : z} | y ≠ 0}:

E_{1} : Z = X^{3} + aXZ^{2} + bZ^{3}.

9“\” is “setminus”, so this means P ∈ E^{n}(ℚ_{p}), P ∉ E^{n+1}(ℚ_{p}).

A point P = (x : y : z) on E has coordinates x′(P) =_{df} \frac{x(P)}{y(P)}, z′(P) =_{df} \frac{z(P)}{y(P)} on E_{1}. For example, O = (0 : 1 : 0) becomes the origin on E_{1}, and so P ↦ −P becomes reflection in the origin (x′, z′) ↦ (−x′, −z′). Just as on E, P + Q + R = 0 if and only if P, Q, R lie on a line.

In terms of our new picture,

E^{n}(ℚ_{p}) = {P ∈ E^{1}(ℚ_{p}) | x′(P) ∈ p^{n}ℤ_{p}}.

Thus the E^{n}(ℚ_{p})’s form a fundamental system of neighbourhoods of the origin in E_{1}(ℚ_{p}). The key lemma is following:

Lemma 8.9. Let P_{1}, P_{2}, P_{3} ∈ E(ℚ_{p}) be such that P_{1} + P_{2} + P_{3} = O. If P_{1}, P_{2} ∈ E^{n}(ℚ_{p}), then P_{3} ∈ E^{n}(ℚ_{p}), and

x′(P_{1}) + x′(P_{2}) + x′(P_{3}) ∈ p^{5n}ℤ_{p}.

Before proving the lemma, we explain why it implies the proposition. For P ∈ E^{n}(ℚ_{p}), let x̄(P) = x′(P) mod p^{5n}ℤ_{p}. The lemma shows that the map

P ↦ x̄(P) : E^{n}(ℚ_{p}) → p^{n}ℤ_{p}/p^{5n}ℤ_{p}

has the property:

P_{1} + P_{2} + P_{3} = 0 ⟹ x̄(P_{1}) + x̄(P_{2}) + x̄(P_{3}) = 0.

Since x̄(−P) = −x̄(P), it is therefore a homomorphism of abelian groups. Suppose that P ∈ E^{1}(ℚ_{p}) has order m divisible by p. Then Q =_{df} \frac{m}{p}P will also lie in E^{1}(ℚ_{p}) and will have order p. Since Q ≠ 0, for some n, Q ∈ E^{n}(ℚ_{p}) \ E^{n+1}(ℚ_{p}). Then x̄(Q) ∈ p^{n}ℤ_{p} \ p^{n+1}ℤ_{p} mod p^{5n}ℤ_{p} , and so

x̄(pQ) = px̄(Q) ∈ p^{n+1}ℤ_{p} \ p^{n+2}ℤ_{p} mod p^{5n}ℤ_{p}.

This contradicts the fact that pQ = 0.

We now prove the lemma. We saw in Section 7 that if P = (x : y : 1) ∈ E^{n}(ℚ_{p})\E^{n+1}(ℚ_{p}), then ord_{p}(x) = −2n, ord_{p}(y) = −3n. In terms of homogeneous coordinates P = (x : y : z), this means that

P ∈ E^{n}(ℚ_{p}) \ E^{n+1}(ℚ_{p}) ⟹ \{ \begin{matrix}ord_{p} \frac{x(P)}{z(P)} & = & −2n \\ ord_{p} \frac{y(P)}{z(P)} & = & −3n \end{matrix} ⟹ \{ \begin{matrix}ord_{p} \frac{x(P)}{y(P)} & = & n \\ ord_{p} \frac{z(P)}{y(P)} & = & 3n \end{matrix} .

Thus

P ∈ E^{n}(ℚ_{p}) ⟹ x′(P) ∈ p^{n}ℤ_{p}, z′(P) ∈ p^{3n}ℤ_{p}.

Let P_{i} = (x′_{i}, z′_{i}), i = 1, 2, 3. The line through P_{1}, P_{2} (assumed distinct) is Z = αX +β where

α = \frac{z′_{2} − z′_{1}}{x′_{2} − x′_{1}} = … = \frac{x′_{2}^{2} + x′_{1}x′_{2} + x′_{1}^{2} + az′_{2}^{2}}{1 − ax′_{1}(z′_{2} + z′_{1}) − b(z′_{2}^{2} + z′_{1}z_{2} + z′_{1}^{2})} ∈ p^{2n}ℤ_{p}.

Moreover

β = z′_{1} − αx′_{1} ∈ p^{3n}ℤ_{p}.

On substituting αX + β for Z in the equation for E_{1}, we obtain the equation

αX + β = X^{3} + aX(αX + β)^{2} + b(αX + β)^{3}.

We know that the solutions of this equation are x′_{1}, x′_{2}, x′_{3}, and so

x′_{1} + x′_{2} + x′_{3} = \frac{2aαβ + 3bα^{2}β}{1 + aα^{2} + bα^{3}} ∈ p^{5n}ℤ_{p}.

The proof when P_{1} = P_{2} is similar. For full details, including the elementary calculation omitted for α, see [ST] p50–54.

Remark 8.10. When ℚ is replaced by a number field K, the above argument may fail to show that torsion elements of E(K) have coordinates that are algebraic integers (when z is taken to be 1). Let π be a prime element in K_{v}. The same argument as above shows that there is an isomorphism

E^{n}(K_{v})/E^{5n}(K_{v}) → π^{n}O_{v}/π^{5n}O_{v}.

However, if p is a high power of π (i.e., the extension K/ℚ is highly ramified v) and n is small, this no longer excludes the possibility that E^{n}(K_{v}) may contain an element of order p.

Formulas. We give formulas for the addition and doubling of points on the curve

E : Y^{2} = X^{3} + aX + b, a, b ∈ k Δ = 4a^{3} + 27b^{2} ≠ 0.

As above, the strategy for deriving the formulas is to first find the x-coordinate of the point sought by using that the sum of the roots of a polynomial f(X) is −(coefficient of X^{deg f−1}).

Addition formula. Let P = (x, y) be the sum of P_{1} = (x_{1}, y_{1}) and P_{2} = (x_{2}, y_{2}). If P_{2} = −P_{1}, then P = O, and if P_{1} = P_{2}, we can apply the duplication formula. Otherwise, x_{1} ≠ x_{2}, and (x, y) is determined by the following formulas:

x(x_{1} − x_{2})^{2} = x_{1}x_{2}^{2} + x_{1}^{2}x_{2} − 2y_{1}y_{2} + a(x_{1} + x_{2}) + 2b

and

y(x_{1} − x_{2})^{3} = W_{2}y_{2} − W_{1}y_{1}

where

W_{1} = 3x_{1}x_{2}^{2} + x_{2}^{3} + a(x_{1} + 3x_{2}) + 4b
W_{2} = 3x_{1}^{2}x_{2} + x_{1}^{3} + a(3x_{1} + x_{2}) + 4b.

Duplication formula. Let P = (x, y) and 2P = (x_{2}, y_{2}). If y = 0, then 2P = 0. Otherwise y ≠ 0, and (x_{2}, y_{2}) is determined by the following formulas:

x_{2} = \frac{(3x^{2} + a)^{2} − 8xy^{2}}{4y^{2}} = \frac{x^{4} − 2ax^{2} − 8bx + a^{2}}{4(x^{3} + ax + b)}
y_{2} = \frac{x^{6} + 5ax^{4} + 20bx^{3} − 5a^{2}x^{2} − 4abx − a^{3} − 8b^{2}}{(2y)^{3}} .

Exercise 8.11. For four of the following elliptic curves (including at least one of the last four), compute the torsion subgroups of E(ℚ). (Include only enough details to convince the grader that you really did work it out.)

Y^{2} = X^{3} + 2
Y^{2} = X^{3} + X
Y^{2} = X^{3} + 4
Y^{2} = X^{3} + 4X
Y^{2} + Y = X^{3} − X^{2}
Y^{2} = X^{3} + 1
Y^{2} − XY + 2Y = X^{3} + 2X^{2}
Y^{2} + 7XY − 6Y = X^{3} − 6X^{2}
Y^{2} + 3XY + 6Y = X^{3} + 6X^{2}
Y^{2} − 7XY − 36Y = X^{3} − 18X^{2}
Y^{2} + 43XY − 210Y = X^{3} − 210X^{2}
Y^{2} = X^{3} − X
Y^{2} = X^{3} + 5X^{2} + 4X
Y^{2} + 5XY − 6Y = X^{3} − 3X^{2}
Y^{2} = X^{3} + 337X^{2} + 20736X

Solution to Exercise 4.8. No vertical line is an inflectional tangent, and so we may assume c ≠ 0. The line L : Y = cX + d intersects the curve at the points whose X-coordinates satisfy

(cX + d)^{2} = X^{3} + aX + b.

By Bezout’s theorem, L be an inflectional tangent to E if and only if it meets the projective curve in a single point. This will be so if and only if

X^{3} − c^{2}X^{2} + (a − 2cd)X + b − d^{2}

has a triple root (which will automatically lie in ℚ). Hence there must exist an r ∈ ℚ such that

−3r = −c^{2}, 3r^{2} = a − 2cd, −r^{3} = b − d^{2}.

When we use the first equation to eliminate r from the remaining two, we find that

a = 2cd + \frac{c^{4}}{3} , b = d^{2} − \frac{c^{6}}{27}.

Conversely, if these equations hold, then r = c^{2}/3 is a triple root of the above polynomial, and so L is an inflectional tangent.

Note that 3P = 0 if and only if 2P = −P, i.e., if and only if the tangent line at P is an inflectional tangent. Only the line L_{∞} : Z = 0 is an inflectional tangent at O. Thus E will have a rational point of order 3 if and only if a, b can be expressed as above in terms of two rational numbers c, d. Therefore the general form of an elliptic curve having a rational point of order 3 is

Y^{2}Z = X^{3} + (2cd + \frac{c^{4}}{3} )X + (d^{2} − \frac{c^{6}}{27}), 4(2cd + \frac{c^{4}}{3} )^{3} + 27(d^{2} − \frac{c^{6}}{27}) ≠ 0.

9. Néron Models

Consider an elliptic curve over ℚ_{p}

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ ℚ_{p}, Δ = 4a^{3} + 27b^{2} ≠ 0.

After making a change of variables X ↦ X/c^{2}, Y ↦ Y/c^{3}, Z ↦ Z, we can suppose that a, b ∈ ℤ_{p} and ord_{p}(Δ) is minimal. We can think of E as defining a curve over ℤ_{p}, which will be the best “model” of E over ℤ_{p} among plane projective curves when p ≠ 2, 3. However, when p = 2 or 3 we may be able to get a better model of E over ℤ_{p} by allowing a more complicated equation. Moreover, Néron showed that if we allow our models to be curves over ℤ_{p} that are not embeddable in ℙ^{2}, then we obtain models that are better in some senses than any plane model. I’ll attempt to explain what these Néron models are in this section. Unfortunately, this is a difficult topic, which requires the theory of schemes for a satisfactory explanation^{10} and so I’ll have to be very superficial. The only good treatment of Néron models is in Chapter IV of [S2].

Weierstrass minimal models. As we noted in (1.3), a curve of the form

Y^{2} = X^{3} + aX + b

is always singular in characteristic 2. However, the curve

Y^{2} + Y = X^{3} − X^{2} − 10X − 20

has good reduction at 2 (and, in fact, at all primes except 11). In general we should allow equations for E of the form

E : Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} = X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3},

and changes of variables of the form

X = u^{2}X′ + r
Y = u^{3}Y′ + su^{2}X′ + t

with u, r, s, t ∈ ℚ_{p} and u ≠ 0. One can attach to such a curve a discriminant Δ(a_{1}, a_{2}, a_{3}, a_{4}a_{5}), which is a complicated polynomial in the a_{i}’s, and which is zero if and only if E is singular. Moreover, one can choose a change of variables which makes the a_{i} ∈ ℤ_{p} and is such that ord_{p}(Δ) is minimal. The equation (or rather the curve it defines over ℤ_{p}) is called the Weierstrass minimal model of E. If p ≠ 2, 3, this agrees with the model defined in the first paragraph above.

The work of Kodaira. Before considering Néron models, we look at an analogous situation, which was a precursor.

Consider an equation

Y^{2}Z = X^{3} + a(T)XZ^{2} + b(T)Z^{3}, a(T), b(T) ∈ ℂ[T], Δ(T) = 4a(T)^{3} + 27b(T)^{2} ≠ 0.

We can view this in three different ways:

(a) as defining an elliptic curve E over the field ℂ(T);

(b) as defining a surface S in 𝔸^{1}(ℂ) × ℙ^{2}(ℂ);

(c) as defining a family of (possibly degenerate) elliptic curves E(T) parametrized by T.

10Néron himself didn’t use schemes, but rather invented his own private version of algebraic geometry over discrete valuation rings, which makes his papers almost unreadable.

By (c) we mean the following: for each t_{0} ∈ ℂ we have a curve

E(t_{0}) : Y^{2}Z = X^{3} + a(t_{0})XZ^{2} + b(t_{0})Z^{3}, a(t_{0}), b(t_{0}) ∈ ℂ,

with discriminate Δ(t_{0}). This is nonsingular, and hence an elliptic curve, if and only if Δ(t_{0}) ≠ 0. Otherwise, it will have a singularity, and we view it as a degenerate elliptic curve. Note that the projection map 𝔸^{1}(ℂ) × ℙ^{2}(ℂ) → 𝔸^{1}(ℂ) induces a map S → 𝔸^{1}(ℂ) whose fibres are the curves E(t). We can view S as a “model” of E over ℂ[T] (or over 𝔸^{1}(ℂ)). We should choose the equation of E so that Δ(T) has minimum degree and there are as few singular fibres as possible.

For the sake of simplicity, we now drop the Z, and consider the equation

Y^{2} = X^{3} + a(T)X + b(T), a(T), b(T) ∈ ℂ[T],

—strictly, we should work with the family of projective curves.

Let P = (x, y, t) ∈ S(ℂ), and let f(X, Y, T) = X^{3} + a(T)X + b(T) − Y^{2}. Then P is singular on E(t) if and only if it satisfies the following equations:

\begin{aligned}\frac{∂f}{∂Y} & = & −2Y = 0 \\ \frac{∂f}{∂X} & = & 3X^{2} + a(T) = 0. \end{aligned}

It is singular in S if on addition it satisfies the equation

\frac{∂f}{∂T} = a′(T)X + b′(T) = 0.

Thus, if P is singular in S, then it is singular in its fibre E(t), but the converse is need not be true.

Example 9.1. (a) Consider the equation

Y^{2} = X^{3} − T.

The origin is singular (in fact, it is a cusp) when regarded as a point on E(0) : Y^{2} = X^{3}, but not when regarded as a point on S : Y^{2} = X^{3} − T. In fact, the tangent plane to S at the origin is the X, Y -plane, T = 0.

(b) Consider the equation

Y^{2} = X^{3} − T^{2}.

In this case, the origin is singular when regarded as a point on E(0) and when regarded as a point on S.

(c) Consider the equation

Y^{2} = (X − 1 + T)(X − 1 − T)(X + 2)
= X^{3} − (3 + T^{2})X + 2 − 2T^{2}.

The discriminant is

Δ(T) = −324T^{2} + 72T^{4} − 4T^{6}.

The curve E(0) is

Y^{2} = X^{3} − 3X + 2 = (X − 1)^{2}(X + 2),

which has a node at (1, 0). Replace X − 1 in the original equation with X in order to translate (1, 0, 0) to the origin. The equation becomes

Y^{2} = (X + T)(X − T)(X + 3)
= (X^{2} − T^{2})(X + 3)
= X^{3} + 3X^{2} − T^{2}X − 3T^{2}.

This has surface has a singularity at the origin (because the equation has no linear term).

Kodaira showed (Collected Works [51], [52], 1960) that, by blowing up points, and blowing down curves, etc., it is possible to obtain from the surface

S : Y^{2}Z = X^{3} + a(T)XZ^{2} + b(T)Z^{3}, a(T), b(T) ∈ ℂ[T], Δ[T] ≠ 0

a new surface S′ endowed with a map S′ → 𝔸^{1} having the following properties:

(a) S′ is nonsingular;

(b) S′ regarded as a curve over ℂ(T) is equal to S regarded as a curve over ℂ(T) (for the experts, the maps S → 𝔸^{1} and S′ → 𝔸^{1} have the same generic fibres);

(c) the fibres E′(t_{0}) of S′ over 𝔸^{1}(ℂ) are all projective curves; moreover E′(t_{0}) = E(t_{0}) if the points of E(t_{0}) are nonsingular when regarded as points on S (for example, if E(t_{0}) itself is nonsingular);

(d) S′ has a certain minimality property: if S′′ is a second surface with the above properties, then any regular map S′ → S′′ is an isomorphism.

Moreover, Kodaira showed that S is unique, and he classified the possible fibres of S′ → 𝔸^{1}.

“Blowing up” a point P in a variety V leaves the variety unchanged except that it replaces the point P with the projective space of lines through the origin in the tangent space T gt_{P} (V) to V at P. A curve C in V, when regarded as a point in the blown-up variety, meets the projective space at the point corresponding to the tangent line to the curve. Even when V ⊂ ℙ^{m}, the blown-up variety doesn’t have a natural embedding into a projective space.

Example 9.2. To illustrate the phenomenon of “blowing up”, consider the map

σ : k^{2} → k^{2}, (x, y) ↦ (x, xy).

Its image omits only the points on the Y -axis where Y ≠ 0. A point in the image is the image of a unique point in k^{2} except for (0, 0), which is the image of the whole of the Y -axis. Thus the map is one-to-one, except that the Y -axis has been “blown down” to a point.

The line

C : Y = αX

has inverse image equal to the union of the Y -axis and the line Y = α. The curve

Y^{2} = X^{3} + αX^{2}

has as inverse image the union of the Y -axis and a nonsingular curve that meets the Y -axis at the points (0, ±\sqrt{α}), i.e., at the same points that its tangents do.

In the above map, (0, 0) in 𝔸^{2}(k) was blown up to an affine line. In a true blowing-up, it would be replaced by a projective line, and the description of the map would be more complicated.

The complete Néron model. Néron proved an analogue of Kodaira’s result for elliptic curves over ℚ_{p}. To explain his result, we need to talk about schemes. For the nonexperts, a scheme E over ℤ_{p} is simply the object defined by a collection of polynomial equations with coefficents in ℤ_{p}. The object defined by the same equations regarded as having coefficients in ℚ_{p} is a variety E over ℚ_{p} called the generic fibre of E/ℤ_{p}, and the object defined by the equations with the coefficients reduced modulo p is a variety Ē over 𝔽_{p} called the special fibre of E/ℤ_{p}. For example, if E is the scheme defined by the equation

Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} = X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3}, a_{i} ∈ ℤ_{p},

then E is the elliptic curve over ℚ_{p} defined by the same equation, and Ē is the elliptic curve over 𝔽_{p}

Y^{2}Z + ā_{1}XY Z + ā_{3}Y Z^{2} = X^{3} + ā_{2}X^{2}Z + ā_{4}XZ^{2} + ā_{6}Z^{3}, ā_{i} ∈ 𝔽_{p}.

Given an elliptic curve E/ℚ_{p}, Néron constructs a scheme E over ℤ_{p} having the following properties:

(a) E is a regular scheme; this means that all the local rings associated with E are regular local rings (for a variety over an algebraically closed field, this condition is equivalent to the variety being nonsingular);

(b) the generic fibre of E is the original curve E;

(c) E is proper over ℤ_{p}; this simply means that both E and Ē are complete curves (this is a compactness condition: affine curves aren’t complete; projective curves are).

(d) E has a certain minimality property sufficient to determine it uniquely: if E′ is a second scheme over ℤ_{p} having the properties (a), (b), (c), then any regular map E → E′ is an isomorphism.

Moreover, Néron classified the possible special fibres, and obtained essentially the same list as Kodaira.

The complete Néron model has some defects: unlike the Weierstrass minimal model, not every point in E(ℚ_{p}) need extend to a point in E(ℤ_{p}); it doesn’t have a group structure; it’s special fibre Ē may be singular. All three defects are eliminated by simply removing all singular points and multiple curves in the special fibre. One then obtains the smooth Néron minimal model, which however has the defect that it not complete.

Given an elliptic curve E over ℚ_{p} with now have three models over ℤ_{p}:

(a) E^{w}, the Weierstrass minimal model of E;

(b) E, the complete Néron minimal model of E;

(c) E′, the smooth Néron minimal model of E.

They are related as follows: to get E′ from E remove all multiple curves and singular points; when we remove from E′ all connected components of the special fibre except that containing O, we obtain the Weierstrass model with the singular point in the closed fibre removed.

Example 9.3. We describe three of the possible eleven different types of models. Some of the statements below are only valid when p ≠ 2, 3. We describe the special fibre over 𝔽_{p}^{al} rather than 𝔽_{p}. For example, in (b), over 𝔽_{p} the zero component of G may be a twisted 𝔾_{m}, and not all n points in the quotient G/G^{0} need have coordinates in 𝔽_{p}.

(a) For an elliptic curve E with good reduction, all three models are the same.

(b) For an elliptic curve E which has nodal reduction, and ord_{p}(Δ) = n, the special fibres for the three models are: (a) a cubic curve with a node; (b) n curves, each of genus 0, each intersecting exactly two other of the curves; (c) an algebraic group G such that the connected component G^{0} of G containing zero is 𝔾_{m}, and such that G/G^{0} is a cyclic group of order n.

[[Diagram omitted]]

(c) For an elliptic curve E which has cuspidal reduction and ord_{p}(Δ) = 5, the special fibres for the three models are: (a) a cubic curve with a cusp; (b) five curves of genus 0, one with multiplicity 2, intersecting as below; (b) an algebraic group G whose zero component is 𝔾_{a} and such that G/G^{0} is a group of order 4 killed by 2.

[[Diagram omitted.]]

Finally, the mysterious quotient E(ℚ_{p})/E^{0}(ℚ_{p}) is equal to G(𝔽_{p})/G^{0}(𝔽_{p}) where G is the special fibre of the smooth Néron model and G^{0} is its zero component. In the above three examples, it is (a) the trivial group; (b) a subgroup of a cyclic group of order n (and equal to a cyclic group of order n if E has split nodal reduction); (c) a subgroup of (ℤ/2ℤ)^{2}.

Summary. [[The top three E’s are Ē’s]]

Minimal Model Weierstrass complete Néron smooth Néron
Plane curve  Yes  Not always  Not always
Regular?  Not always Yes  Yes
\overline{E} complete?  Yes  Yes  Not always
\overline{E} nonsingular? Not always Not always  Yes
\overline{E} a group?  Not always Not always  Yes
E(ℤ_{p}) = E(ℚ_{p})? Yes  Not always  Yes

Tate has given an algorithm for determining the Néron model of an elliptic curve.

10. Elliptic Curves over the Complex Numbers

In this section, we review some of the theory of elliptic curves over ℂ.

Lattices and bases. A lattice in ℂ is the subgroup generated by two complex numbers linearly independent over ℝ: thus

Λ = ℤω_{1} + ℤω_{2}.

Since neither ω_{1} nor ω_{2} is a real multiple of the other, we can order them so that ℑ(ω_{1}/ω_{2}) > 0. If {ω′_{1}, ω′_{2}} is a second pair of elements of Λ, then

ω′_{1} = aω_{1} + bω_{2}, ω′_{2} = cω_{1} + dω_{2}, a, b, c, d ∈ ℤ,

that is,

( \begin{matrix}ω′_{1} \\ ω′_{2} \end{matrix} ) = A ( \begin{matrix}ω_{1} \\ ω_{2} \end{matrix} ) ,

with A a 2 × 2 matrix with integer coefficients. The pair (ω′_{1}, ω′_{2}) will be a basis for Λ if and only if A has determinant ±1, and ℑ(ω′_{1}/ω′_{2}) > 0 if and only if det A > 0. Therefore, if we let SL_{2}(ℤ) be the group of matrices with integer coefficients and determinant 1, then SL_{2}(ℤ) acts transitively on the set of bases (ω_{1}, ω_{2}) for Λ for which ℑ(ω_{1}/ω_{2}) > 0. We have proved the following statement:

Proposition 10.1. Let M be the set of pairs of complex numbers (ω_{1}, ω_{2}) such that ℑ(ω_{1}/ω_{2}) > 0, and let L be the set of lattices in ℂ. Then the map (ω_{1}, ω_{2}) ↦ ℤω_{1} + ℤω_{2} induces a bijection

SL_{2}(ℤ)\M → L.

Here SL_{2}(ℤ)\M means the set of orbits in M for the action

( \begin{matrix}a & b \\ c & d \end{matrix} ) ( \begin{matrix}ω_{1} \\ ω_{2} \end{matrix} ) = ( \begin{matrix}aω_{1} + bω_{2} \\ cω_{1} + dω_{2} \end{matrix} )

Let ℍ be the complex upper half-plane:

ℍ = {z ∈ ℂ | ℑ(z) > 0}.

Let z ∈ ℂ^{×} act on M by the rule z(ω_{1}, ω_{2}) = (zω_{1}, zω_{2}) and on L by the rule zΛ = {zλ | λ ∈ Λ}. The map (ω_{1}, ω_{2}) ↦ ω_{1}/ω_{2} induces a bijection M/ℂ^{×} → ℍ. The action of SL_{2}(ℤ) on M corresponds to the action

( \begin{matrix}a & b \\ c & d \end{matrix} ) τ = \frac{aτ + b}{cτ + d}

on ℍ. We have bijections

\begin{matrix}L/ℂ^{×} & ⟷ & SL_{2}(ℤ)\M/ℂ^{×} & ⟷ & SL_{2}(ℤ)\ℍ. \\ ℤτ + ℤ & & (τ, 1) & & τ \end{matrix}

For a lattice Λ, the interior of any parallelogram with vertices z_{0}, z_{0}+ω_{1}, z_{0}+ω_{2}, z_{0}+ω_{1}+ω_{2}, where {ω_{1}, ω_{2}} is a basis for Λ, is called a fundamental domain or period parallelogram D for Λ. We usually choose D to contain 0.

Quotients of ℂ by lattices. . Let Λ be a lattice in ℂ. Topologically the quotient ℂ/Λ ≈ ℝ^{2}/ℤ^{2}, which is a one-holed torus (the surface of a donut).

Write π : ℂ → ℂ/Λ for the quotient map. Then ℂ/Λ can be given the structure of a Riemann surface (i.e., complex manifold of dimension 1) such that a function φ : U → ℂ on an open subset U of ℂ/Λ is holomorphic (resp. meromorphic) if and only if the composite φ ∘ π : π^{−1}(U) → ℂ is holomorphic (resp. meromorphic) in the usual sense. It is the unique structure for which π is a local isomorphism of Riemann surfaces.

We shall see that, although any two quotients ℂ/Λ, ℂ/Λ′ are homeomorphic, they will be isomorphic as Riemann surfaces only if Λ′ = zΛ for some z ∈ ℂ.

Doubly periodic functions. Let Λ be a lattice in ℂ. According to the above discussion, a meromorphic function on ℂ/Λ is simply a meromorphic function f(z) on ℂ such that

f(z + ω) = f(z) for all ω ∈ Λ.

This condition is equivalent to

f(z + ω_{1}) = f(z), f(z + ω_{2}) = f(z)

for {ω_{1}, ω_{2}} a basis for Λ. Such a meromorphic function on ℂ is said to be doubly periodic for Λ.

Proposition 10.2. Let f(z) be a doubly periodic function for Λ, not identically zero, and let D be a fundamental domain for Λ such that f has no zeros or poles on the boundary of D. Then (a) ∑_{P ∈D} Res_{P} (f) = 0;

(b) ∑_{P ∈D} ord_{P} (f) = 0;

(c) ∑_{P ∈D} ord_{P} (f) · P ≡ 0 mod Λ.

The first sum is over the points in D where f has a pole, and the other sums are over the points where it has a zero or pole (and ord_{P} (f) is the order of the zero or the negative of the order of the pole). Each sum is finite.

Proof. According to the residue theorem,

∫_{Γ} f(z)dz = 2πi( ∑_{P ∈D} Res_{P} (f)),

where Γ is the boundary of D. Because f is periodic, the integrals of it over opposite sides of D cancel, and so the integral is zero. This gives (a). For (b) one applies the residue theorem to f′/f, noting that this is again doubly periodic and that Res_{P} (f′/f) = ord_{P} (f). For (c) one applies the residue theorem to z · f′(z)/f(z). This is no longer doubly periodic, but the integral of it around Γ lies in Λ.

Corollary 10.3. A nonconstant doubly periodic function has at least two poles.

Proof. A holomorphic doubly periodic function is bounded on the closure of any fundamental domain (by compactness), and hence on the entire plane (by periodicity). It is constant by Liouville’s theorem. It is impossible for a doubly periodic function to have a single simple pole in a period parallelogram, because by (a) of proposition the residue at the pole would have to be zero there, which contradicts the fact that it has a simple pole there.

The holomorphic maps ℂ/Λ → ℂ/Λ′. Let Λ and Λ′ be lattices in ℂ. The map π : ℂ → ℂ/Λ realizes ℂ as the universal covering space of ℂ/Λ. Since the same is true of π′ : ℂ → ℂ/Λ′, a continous map φ : ℂ/Λ → ℂ/Λ′ such that φ(0) = 0 will lift uniquely to a continuous map φ̃ : ℂ → ℂ such that φ̃(0) = 0:

ℂ \underrightarrow{_{φ}} ℂ
↓  ↓
ℂ/Λ ⟶^{φ} ℂ/Λ′

(see, for example, Greenberg, Lectures on Algebraic Topology, 5.1, 6.4). The map φ will be holomorphic (i.e., a morphism of Riemann surfaces) if and only if φ̃ is holomorphic. [Nonexperts can take this as a definition of a holomorphic map φ : ℂ/Λ → ℂ/Λ′.]

Proposition 10.4. Let Λ and Λ′ be lattices in ℂ. A complex number α such that αΛ ⊂ Λ′ defines a holomorphic map

[z] ↦ [αz] : ℂ/Λ → ℂ/Λ′

sending 0 to 0, and every holomorphic map ℂ/Λ → ℂ/Λ′ is of this form (for a unique α).

Proof. It is obvious that α defines a holomorphic map ℂ/Λ → ℂ/Λ′. Conversely, let φ : ℂ/Λ → ℂ/Λ′ be a holomorphic map such that φ(0) = 0, and let φ̃ be its unique lifting to a holomorphic map ℂ → ℂ sending 0 to 0. For any ω ∈ Λ, z ↦ φ̃(z + ω) − φ̃(z) takes values in Λ′ ⊂ ℂ. But a continuous map from a connected set to a set with the discrete topology is constant, and so the derivative of this function is zero:

φ̃′(z + ω) = φ̃′(z).

Therefore φ̃′(z) is doubly periodic. As it is holomorphic, it must be constant, say φ̃′(z) = α for all z. On integrating, we find that φ̃(z) = αz + β, and β = φ̃(0) = 0.

Corollary 10.5. The Riemann surfaces ℂ/Λ and ℂ/Λ′ are isomorphic if and only if Λ′ = αΛ for some α ∈ ℂ^{×}.

Proof. This is obvious from the proposition.

The proposition shows that^{11}

Hom(ℂ/Λ, ℂ/Λ′) ≅ {α ∈ ℂ | αΛ ⊂ Λ′},

and the corollary shows that there is a one-to-one correspondence

{ℂ/Λ}/≈ ⟷^{1:1} L/ℂ^{×}.

The Weierstrass ℘ function. Let Λ be a lattice in ℂ. We don’t yet know any nonconstant doubly periodic functions^{12} for Λ. When G is a finite group acting on a set S, then it is easy to construct functions invariant under the action of G : take f to be any function f : S → ℂ, and define

F (s) = ∑_{g∈G} f(gs);

then F (g′s) = ∑_{g∈G} f(g′gs) = F (s), and so F is invariant (and all invariant functions are of this form, obviously). When G is not finite, one has to verify that the series converges—in fact, in order to be able to change the order of summation, one needs absolute convergence. Moreover, when S is a Riemann surface and f is holomorphic, to ensure that F is holomorphic, one needs that the series converges absolutely uniformly on compact sets.

Now let φ(z) be a holomorphic function ℂ and write

Φ(z) = ∑_{ω∈Λ} φ(z + ω).

Assume that as |z| → ∞, φ(z) → 0 so fast that the series for Φ(z) is absolutely convergent for all z for which none of the terms in the series has a pole. Then Φ(z) is doubly periodic with respect to Λ; for replacing z by z + ω_{0} for some ω_{0} ∈ Λ merely rearranges the terms in the sum. This is the most obvious way to construct doubly periodic functions; similar methods can be used to construct functions on other quotients of domains.

To prove the absolute uniform convergence on compact subsets of such series, the following test is useful.

Lemma 10.6. Let D be a bounded open subset of the complex plane and let c > 1 be constant. Suppose that ψ(z, ω), ω ∈ Λ, is a function that is meromorphic in z for each ω and which satisfies the condition: there are constants A and B such that

|ψ(z, mω_{1} + nω_{2})| < B(m^{2} + n^{2})^{−c}

whenever m^{2} + n^{2} > A. Then the series ∑_{ω∈Λ} ψ(z, ω), with finitely many terms which have poles in D deleted, is uniformly absolutely convergent in D.

11I use X ≈ Y to mean that X and Y are isomorphic, and X ≅ Y to mean that they are isomorphic by a canonical (or given) isomorphism.

12For a lattice Λ in ℂ^{n}, n > 1, there frequently won’t be any nonconstant holomorphic functions on ℂ^{n}/Λ.

Proof. That only finitely many terms can have poles in D follows from the condition. To prove the lemma it suffices to show that, given any ε > 0, there is an integer N such that S < ε for every finite sum S = ∑ |ψ(z, mω_{1} + nω_{2})| in which all the terms are distinct and each one of them has m^{2} + n^{2} ≥ 2N^{2}. Now S consists of eight subsums, a typical member of which consists of the terms for which m ≥ n ≥ 0. (There is some overlap between these sums, but that is harmless.) In this subsum we have m ≥ N and ψ < Bm^{−2c}, assuming as we may that 2N^{2} > A; and there are at most m + 1 possible values of n for a given m. Thus

S ≤ ∑_{m=N}^{∞} B m^{−2c}(m + 1) < B_{1}N^{2−2c}

for a suitable constant B_{1}, and this proves the lemma.

We know from Corollary 10.3 that the simplest possible nonconstant doubly periodic function is one with a double pole at each point of Λ and no other poles. Suppose f(z) is such a function. Then f(z) − f(−z) is a doubly periodic function with no poles except perhaps simple ones at the points of Λ. Hence it must be constant, and since it is an odd function it must vanish. Thus f(z) is even, and we can make it unique by imposing the normalization condition f(z) = z^{−2} + O(z^{2}) near z = 0—it turns out to be convenient to force the constant term in this expansion to vanish rather than to assign the zeros of f(z). There is such an f(z)—indeed it is the Weierstrass function ℘(z)—but we can’t define it by the method at the start of this subsection because if φ(z) = z^{−2}, the series Φ(z) is not absolutely convergent. However, if φ(z) = −2z^{−3}, we can apply this method, and it gives ℘′, the derivative of the Weierstrass ℘-function. Define

℘′(z; Λ) = ℘′(z; ω_{1}, ω_{2}) = ∑_{ω∈Λ} \frac{−2}{(z − ω)^{−3}}

and

℘(z) = \frac{1}{z^{2}} + ∑_{ω∈Λ,ω≠0} (\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} ) .

They are both meromorphic doubly periodic functions on ℂ, and ℘′ = \frac{d℘}{dz}.

Eisenstein series. Let Λ be a lattice in ℂ, and consider the sum

∑_{ω∈Λ, ω≠0} \frac{1}{ω^{n}} .

The map ω ↦ −ω : Λ → Λ has order 2, and its only fixed point is 0. Therefore Λ \ {0} is a disjoint union of its orbits, and it follows that the sum is zero if n is odd. We write

G_{k}(Λ) = ∑_{ω∈Λ, ω≠0} \frac{1}{ω^{2k}} ,

and we let G_{k}(τ) = G_{k}(ℤτ + ℤ), τ ∈ ℍ.

Proposition 10.7. For all integers k ≥ 2, G_{k}(τ) converges to a holomorphic function on ℍ.

Proof. Apply Lemma 10.6.

The functions G_{k}(Λ) and G_{k}(τ) and are called Eisenstein series. Note that G_{k}(cΛ) = c^{−2k}G_{k}(Λ) for c ∈ ℂ^{×}.

The field of doubly periodic functions. Let Λ be a lattice in ℂ. The doubly periodic functions for Λ form a field, which the next two propositions determine.

Proposition 10.8. There is the following relation between ℘ and ℘′:

℘′(z)^{2} = 4℘(z)^{3} − g_{2}℘(z) − g_{3}

where g_{2} = 60G_{2}(Λ) and g_{3} = 140G_{3}(Λ).

Proof. We compute the Laurent expansion of ℘(z) near 0. Recall (from Math 115) that for |t| < 1,

\frac{1}{1 − t} = 1 + t + t^{2} + · · · .

On differentiating this, we find that

\frac{1}{(1 − t)^{2}} = ∑_{n≥1} nt^{n−1} = ∑_{n≥0}(n + 1)t^{n}.

Hence, for |z| < |ω|,

\frac{1}{(z − ω)^{2}} − \frac{1}{ω^{2}} = \frac{1}{ω^{2}} (\frac{1}{(1 − \frac{z}{ω} )^{2}} − 1) = ∑_{n≥1}(n + 1)\frac{z^{n}}{ω^{n+2}} .

On putting this into the definition of ℘(z) and changing the order of summation, we find that for |z| < |ω|

℘(z) = \frac{1}{z^{2}} + ∑_{n≥1} ∑_{ω≠0}(n + 1)\frac{z^{n}}{ω^{n+2}}

= \frac{1}{z^{2}} + ∑_{k≥1}(2k + 1)G_{k+1}(Λ)z^{2k}

= \frac{1}{z^{2}} + 3G_{2}z^{2} + 5G_{3}z^{4} + · · · .

This last expression contains enough terms to show that the Laurent expansion of

℘′(z)^{2} − 4℘(z)^{3} + 60Gs_{2}(Λ)℘(z) + 140G_{3}(Λ)

has no nonzero term in z^{n} with n ≤ 0. Therefore this function is holomorphic at 0 and takes the value 0 there. Since it is doubly periodic and has no other poles in a suitable fundamental domain containing 0, we see that it is constant, and in fact zero.

Proposition 10.9. The doubly periodic functions for Λ are precisely the rational functions of ℘(z) and ℘′(z), i.e., if f is doubly periodic, then there exist F (X, Y), G(X, Y) ∈ ℂ[X, Y], G ≠ 0, such that f(z) = F (℘(z), ℘′(z))/G(℘(z), ℘′(z)).

Proof. Omitted.

Proposition 10.8 shows that (X, Y) ↦ (℘(z), ℘′(z)) defines a homomorphism

ℂ[x, y] =_{df} ℂ[X, Y]/(Y^{2} − 4X^{3} + g_{2}X + g_{3}) → ℂ[℘, ℘′],

where ℂ[℘, ℘′] is the ℂ-algebra of meromorphic functions on ℂ generated by ℘ and ℘′. I claim^{13} that the map is an isomorphism. For this, we have to show that a polynomial g(X, Y) ∈ ℂ[X, Y] for which g(℘, ℘′) = 0 is divisible by f(X, Y) =_{df} Y^{2} − X^{3} + g_{2}X + g_{3}. The theory of resultants (see the end of this section) shows that for any polynomial g(X, Y), there exist polynomials a(X, Y) and b(X, Y) such that

13Those who know some commutative algebra will be able to give a simpler proof.

a(X, Y)f(X, Y) + b(X, Y)g(X, Y) = R(X) ∈ ℂ[X]

with deg_{Y} (b(X, Y)) < deg_{Y} (f(X, Y)). Hence if g(℘, ℘′) = 0, then R(℘) = 0, but it is easy to see that ℘ is transcendental over ℂ (for example, it has infinitely many poles). Therefore R = 0, and so f(X, Y) divides b(X, Y)g(X, Y). Any polynomial with the form of f(X, Y) is irreducible, and so f(X, Y) divides either b(X, Y) or g(X, Y). Because of the degrees, it can’t divide b, and so it must divide g.

The isomorphism ℂ[x, y] → ℂ[℘, ℘′] induces an isomorphism of the fields of fractions

ℂ(x, y) → ℂ(℘, ℘′).

Proposition 10.9 shows that ℂ(℘, ℘′) is the field of all double periodic functions for Λ.

The elliptic curve E(Λ). Let Λ be a lattice in ℂ.

Lemma 10.10. The polynomial f(X) = 4X^{3} − g_{2}(Λ)X − g_{3}(Λ) has distinct roots.

Proof. The function ℘′(z) is odd and doubly periodic, and so

℘′(\frac{ω_{1}}{2} ) = −℘′(−\frac{ω_{1}}{2} ), = ℘′(−\frac{ω_{1}}{2} ).

Hence ℘′(z) has a zero at ω_{1}/2, and so Propositiion 10.8 shows that ℘(ω_{1}/2) is a root of f(X). The same argument shows that ℘(ω_{2}/2) and ℘((ω_{1} + ω_{2})/2) are also roots. It remains to prove that these three numbers are distinct.

The function ℘(z) − ℘(ω_{1}/2) has a zero at ω_{1}/2, which must be a double zero because its derivative is also 0 there. Since ℘(z) − ℘(ω_{1}/2) has only one (double) pole in a fundamental domain D containing 0, Proposition 10.2 shows that ω_{1}/2 is the only zero of ℘(z) − ℘(ω_{1}/2) in D, i.e., that ℘(z) takes the value ℘(ω_{1}/2) only at z = ω_{1}/2 within D. In particular, ℘(ω_{1}/2) is not equal to ℘(ω_{2}/2) or ℘((ω_{1} + ω_{2})/2).

From the lemma, we see that

E(Λ) : Y^{2}Z = 4X^{3} − g_{2}(Λ)XZ^{2} − g_{3}(Λ)Z^{3}

is an elliptic curve. Recall that c^{4}g_{2}(cΛ) = g_{2}(Λ) and c^{6}g_{3}(cΛ) = g_{3}(Λ) for any c ∈ ℂ^{×}, and so cΛ defines essentially the same elliptic curve as Λ.

Proposition 10.11. The map

{z ↦ (℘(z) : ℘′(z) : 1) \atop 0 ↦ (0 : 1 : 0)} : ℂ/Λ → E(Λ)

is an isomorphism of Riemann surfaces.

Proof. It is certainly a well-defined map. The function ℘(z) is 2 : 1 in a period parallelogram containing 0, except at the points \frac{ω_{1}}{2} , \frac{ω_{2}}{2} , \frac{ω_{1}+ω_{2}}{2} , where it is one-to-one. Since the function (x : y : 1) ↦ x : E(Λ) \ {O} → ℂ has the same property, and both maps have image the whole of ℂ, this shows that the map in z ↦ (℘(z) : ℘′(z) : 1) is one-to-one. Finally, one can verify that it induces isomorphisms on the tangent spaces.

The addition formula. Consider ℘(z +z′). It is a doubly periodic function of z, and therefore it is a rational function of ℘ and ℘′. The next result exhibits the rational function.

Proposition 10.12. The following formula holds:

℘(z + z′) = \frac{1}{4} \{\frac{℘′(z) − ℘′(z′)}{℘(z) − ℘(z′)}\}^{2} − ℘(z) − ℘(z′).

Proof. Let f(z) denote the difference between the left and the right sides. Its only possible poles (in D) are at 0, or ±z′, and by examining the Laurent expansion of f(z) near these points one sees that it has no pole at 0 or z, and at worst a simple pole at z′. Since it is doubly periodic, it must be constant, and since f(0) = 0, it must be identically zero.

Corollary 10.13. The map z ↦ (℘(z) : ℘′(z) : 1) : ℂ/Λ → E(Λ) is a homomorphism of groups.

Proof. The above formula agrees with the formula for the x-coordinate of the sum of two points on E(Λ). [Let Y = mX +c be the line through the points P = (x, y) and P′ = (x′, y′) on the curve Y^{2} = 4X^{3} − g_{2}X − g_{3}. Then the x, x′, and x(P + P′) are the roots of the polynomial

(mX + c)^{2} − 4X^{3} + g_{2}X + g_{3},

and so

x(P + P′) + x + x′ = m^{2} = (\frac{y − y′}{x − x′} )^{2} .]

Classification of elliptic curves over ℂ.

Theorem 10.14. Every elliptic curve E over ℂ is of the form E(Λ) for some lattice Λ.

Proof. This follows from the next two lemmas.

Lemma 10.15. Two elliptic curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ k

and

E : Y^{2}Z = X^{3} + a′XZ^{2} + b′Z^{3}, a′, b′ ∈ k

over an algebraically closed field k of characteristic ≠ 2, 3 are isomorphic if and only if j(E) = j(E′).

Proof. According to Theorem 5.3, E and E′ are isomorphic if and only if there exists a c ∈ k^{×} such that a′ = c^{4}a and b′ = c^{6}b. Since j(E) = \frac{1728(4a^{3})}{4a^{3}+27b^{2}}, it is clear that E ≈ E′ ⟹ j(E) = j(E′). Conversely, suppose j(E) = j(E′). Note first that

a = 0 ⟺ j(E) = 0 ⟺ j(E′) = 0 ⟹ a′ = 0.

Hence we may suppose that a and a′ are both nonzero. After replacing (a, b) with (c^{4}a, c^{6}b) where c = \sqrt[4]{\frac{a′}{a}} we will have that a = a′. Now j(E) = j(E′) ⟹ b = ±b′. A minus sign can be removed by a change of variables with c = \sqrt{−1}.

For any lattice Λ in ℂ, the curve

E(Λ) : Y^{2}Z = 4X^{3} − g_{2}(Λ)XZ^{2} − g_{3}Z^{3}

has discriminant Δ(Λ) = g_{2}(Λ)^{3} − 27g_{3}(Λ)^{2} and j-invariant

j(Λ) = \frac{1728g_{2}(Λ)^{3}}{g_{2}(Λ)^{3} − 27g_{3}(Λ)^{2}} .

For c ∈ ℂ^{×}, g_{2}(cΛ) = c^{−4}g_{2}(Λ) and g_{3}(cΛ) = c^{−6}g_{3}(Λ), and so the isomorphism class of E(Λ) depends only on Λ up to scaling. Define

j(τ) = j(ℤτ + ℤ).

Then, for any ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ SL_{2}(ℤ),

j(\frac{aτ + b}{cτ + d}) = j(τ).

Hence j defines a function on the quotient space SL_{2}(ℤ)\ℍ.

Lemma 10.16. The function j defines an isomorphism SL_{2}(ℤ)\ℍ → ℂ.

Proof. We omit the proof (and hope to return to it later).

Summary. For any subfield k of ℂ, we have the diagram:

{Elliptic curves/ℂ}/≈ ⟷^{1:1} L/ℂ^{×} ⟷^{1:1} SL_{2}(ℤ)\ℍ ⟶_{≈}^{j} ℂ
↑  ↑
{Elliptic curves/k}/≈  ⟶^{j}  k

The bottom map is surjective, because for any j ≠ 0, 1728, the curve

Y^{2}Z = X^{3} − \frac{27}{4} \frac{j}{j − 1728}XZ^{2} − \frac{27}{4} \frac{j}{j − 1728}

has j-invariant j. The left hand vertical map and the bottom map are injective if k is algebraically closed.

Aside 10.17. The above picture can be made a little more precise. Consider the isomorphism

z ↦ (℘(z) : ℘′(z) : 1) : ℂ/Λ → E(ℂ).

Since x = ℘(z) and y = ℘′(z),

\frac{dx}{y} = \frac{℘′(z)dz}{℘′(z)} = dz.

Thus the differential dz on ℂ maps to the differential \frac{dx}{y} on E(ℂ). Conversely, from a holomorphic differential ω on E(ℂ) we can obtain an realization of E as a quotient ℂ/Λ as follows. For P ∈ E(ℂ), consider φ(P) = ∫_{O}^{P} ω ∈ ℂ. This is a not well defined because it depends on the choice of a path from O to P. However, if we choose a ℤ-basis (γ_{1}, γ_{2}) for H_{1}(E(ℂ), ℤ), and set ω_{1} = ∫_{γ_{1}} ω, ω_{2} = ∫_{γ_{2}} ω, then Λ = ℤω_{1} + ℤω_{2} is a lattice in ℂ, and P ↦ φ(P) is an isomorphism E(ℂ) → ℂ/Λ. In this way, we obtain a natural one-to-one correspondence between L and the set of isomorphism classes of pairs (E, ω) consisting of an elliptic curve E over ℂ and a holmorphic differential ω on E.

Torsion points. Frequently, I write X_{n} = {x ∈ X | nx = 0}. For an elliptic curve E over ℂ, from E(ℂ) = ℂ/Λ we see that

E(ℂ)_{n} = \frac{1}{n}Λ/Λ = \{\frac{a}{n}ω_{1} + \frac{b}{n}ω_{2} | a, b ∈ ℤ\}/ℤω_{1} + ℤω_{2}.

This is a free ℤ/nℤ-module of rank 2. Because of this description over ℂ, torsion points on elliptic curves are often called division points.

Theorem 10.18. For any elliptic curve E over an algebraically closed field k of characteristic zero, E(k)_{n} is a free ℤ/nℤ-module of rank 2.

Proof. There will exist an algebraically closed subfield k_{0} of finite transcendance degree over ℚ such that E arises from a curve E_{0} over k_{0}. Now k_{0} can be embedded into ℂ, and so we can apply the next lemma (twice).

Lemma 10.19. Let E be an elliptic curve over an algebraically closed field k, and let Ω be an algebraically closed field containing k. Then the map E(k) → E(Ω) induces an isomorphism on the torsion subgroups.

Proof. Let E be the curve Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}. There are inductively defined universal polynomials ψ_{m}(X, Y) ∈ ℤ[X, Y] (depending on a, b), such that for any point P = (x : y : 1) of E, mP = (Xψ_{m}^{4} − ψ_{m−1}ψ_{m}^{2}ψ_{m+1} : \frac{1}{2}ψ_{2m} : ψ_{m}^{4}). See for example [C_{2}] p133. Therefore P ∈ E(k)_{m} if and only if ψ_{m}(x, y) = 0. Thus this lemma follows from the next.

Lemma 10.20. Let k ⊂ Ω be algebraically closed fields. If F (X, Y), G(X, Y) ∈ k[X, Y] have no common factor, then any common solution to the equations

\{ \begin{matrix}F (X, Y) & = & 0 \\ G(X, Y) & = & 0 \end{matrix}

with coordinates in Ω in fact has coordinates in k.

Proof. From the theory of resultants, we know that there exist polynomials a(X, Y), b(X, Y), and R(X) with coefficients in k such that

a(X, Y)F (X, Y) + b(X, Y)G(X, Y) = R(X)

and R(x_{0}) = 0 if and only if F (x_{0}, Y) and G(x_{0}, Y) have a common zero. In other words, the roots of R are the x-coordinates of the common zeros of F (X, Y) and G(X, Y). Since R(X) is a polynomial in one variable, its roots all lie in k. Moreover, for a given x_{0} ∈ k, all the common roots of F (x_{0}, Y) and G(x_{0}, Y) lie in k.

Remark 10.21. (a) Theorem 10.18 holds for elliptic curves over algebraically closed fields of characteristic p ≠ 0 if (and only if) n is not divisible by p.

(b) In contrast to E(ℚ^{al}), the torsion subgroup of E(ℚ) is quite small. It was conjectured by Beppo Levi at the International Congress in 1906 and proved by Mazur in 1975 that the E(ℚ)_{tors} is isomorphic to one of the following groups:

\begin{matrix}ℤ/mℤ & for & m = 1, 2, …, 10, 12; \\ ℤ/2ℤ × ℤ/mℤ & for & m = 2, 4, 6, 8. \end{matrix}

The 15 curves in Exercise 8.11 exhibit all possible torsion subgroups (in order). The fact that E(ℚ)_{tors} is so much smaller than E(ℚ^{al})_{tors} shows that the image of the Galois group in the automorphism group of E(ℚ^{al})_{tors} is large.

Endomorphisms. A field K of finite degree over ℚ is called an algebraic number field. Each α ∈ K satisfies an equation,

α^{m} + a_{1}α^{m−1} + ⋯ + a_{m} = 0, a_{i} ∈ ℚ.

If it satisfies such an equation with the a_{i} ∈ ℤ, then α is said to be an (algebraic) integer of K. The algebraic integers form a subring O_{K} of K, which is a free ℤ-module of rank [K : ℚ]. (Experts in commutative algebra will recognize O_{K} as being the integral closure of ℤ in K.) For example, if K = ℚ[\sqrt{d}] with d ∈ ℤ and square-free, then

O_{K} = \{ \begin{matrix}ℤ1 + ℤ\sqrt{d} & d ≢ 1 mod 4 \\ ℤ1 + ℤ\frac{1+\sqrt{d}}{2} & d ≡ 1 mod 4. \end{matrix}

Proposition 10.22. Let Λ = ℤω_{1} + ℤω_{2} be a lattice in ℂ with τ = ω_{1}/ω_{2} ∈ ℍ. The ring End(ℂ/Λ) = ℤ unless [ℚ[τ] : ℚ] = 2, in which case R = End(ℂ/Λ) is a subring of ℚ[τ] of rank 2 as a ℤ-module.

Proof. Let Λ = ℤω_{1} + ℤω_{2} with τ =_{df} ω_{1}/ω_{2} ∈ ℍ, and suppose that there exists an α ∈ ℂ, α ∉ ℤ, such that αΛ ⊂ Λ. Then

αω_{1} = aω_{1} + bω_{2}
αω_{2} = cω_{1} + dω_{2},

with a, b, c, d ∈ ℤ. On dividing through by ω_{2} we obtain the equations

ατ = aτ + b
α = cτ + d.

As α ∉ ℤ, c ≠ 0.

On eliminating α from between the two equations, we find that

cτ^{2} + (d − a)τ + b = 0.

Therefore ℚ[τ] is of degree 2 over ℚ.

On eliminating τ from between the two equations, we find that

α^{2} − (a + d)α + bc = 0.

Therefore α is integral over ℤ, and hence is contained in the ring of integers of ℚ[τ].

Example 10.23. (a) Consider E : Y^{2}Z = X^{3} + aXZ^{2}. Then (x : y : z) ↦ (−x : iy : z) is an endomorphism of E of order 4, and so End(E) = ℤ[i]. Note that E has j-invariant 1728.

(b) Consider E : Y^{2}Z = X^{3} + bZ^{3}, and let ρ = e^{2πi/3}. Then (x : y : z) ↦ (ρx : y : z) is an endomorphism of E of order 3 of E. In this case, E has j-invariant is 0.

Aside 10.24. (For the experts.) Recall that a complex number α is said to be algebraic if it is algebraic over ℚ, and is otherwise said to be transcendental. There is a general philosophy that a transcendental meromorphic function f should take transcendental values at the algebraic points in ℂ, except at some “special” points, where it has interesting “special values”. We illustrate this for two functions.

(a) Define e(z) = e^{2πiz}. If z is algebraic but not rational, then e(z) is transcendental. [More generally, if α and β are algebraic, α ≠ 0, 1, and β is irrational, then α^{β} is transcendental— Hilbert stated this as the seventh of his famous problems, and Gelfond and Schneider proved^{14} it in 1934. It implies our statement because e(z) = (e^{πi})^{2z}.]

On the other hand, if z ∈ ℚ, then e(z) is algebraic—in fact, it is a root of 1, and so ℚ[e(z)] is a finite extension of ℚ with abelian Galois group (see Math 594). It is a famous theorem (the Kronecker-Weber theorem) that every such extension of ℚ is contained in ℚ[e(\frac{1}{m})] for some m (see Math 776).

Let τ ∈ ℍ be algebraic. If τ generates a quadratic extension of ℚ, then j(τ) is algebraic, and otherwise j(τ) is transcendental (the second statement was proved by Siegel in 1949).

In fact, when [ℚ[τ] : ℚ] = 2, one can say much more. Assume that ℤ[τ] is the ring of integers in K =_{df} ℚ[τ]. Then j(τ) is an algebraic integer, and

[ℚ[j(τ)] : ℚ] = [K[j(τ)] : K] = h_{K}

where h_{K} is the class number of K. Moreover, K[j(τ)] is the Hilbert class field of K (the largest unramified abelian extension of K).

Appendix: Resultants. Let f(X) = s_{0}X^{m} + s_{1}X^{m−1} + ⋯ + s_{m} and g(X) = t_{0}X^{n} + t_{1}X^{n−1} + ⋯ + t_{n} be polynomials with coefficients in a field k. The resultant Res(f, g) of f and g is defined to be the determinant

| \begin{matrix}s_{0} & s_{1} & … & s_{m} \\ & s_{0} & … & & s_{m} \\ & & … & & & … \\ t_{0} & t_{1} & … & t_{n} \\ & t_{0} & … & & t_{n} \\ & & … & & & … \end{matrix} |

There are n rows of s’s and m rows of t’s, so that the matrix is (m + n) × (m + n); all blank spaces are to be filled with zeros. The resultant is a polynomial in the coefficients of f and g.

Proposition 10.25. The resultant Res(f, g) = 0 if and only if

(i) both s_{0} and t_{0} are zero; or (ii) the two polyomials have a common root in k^{al}.

Proof. If (i) holds, then the first column of the determinant is zero, and so certainly Res(f, g) = 0. Suppose that α is a common root of f and g, so that there exist polynomials f_{1} and g_{1} in k^{al}[X] of degrees m − 1 and n − 1 respectively such that

f(X) = (X − α)f_{1}(X), g(X) = (X − α)g_{1}(X).

From these equations we find that

f(X)g_{1}(X) − g(X)f_{1}(X) = 0. (∗)

14At about the time he stated his problems (1900), Hilbert gave a lecture in which he said that he expected the Riemann hypothesis to be proved within his lifetime, that Fermat’s last theorem would be proved within the lifetimes of the youngest members of his audience, but that no one in the audience would see his seventh problem proved. He was close with Fermat’s last problem.

On equating the coefficients of X^{m+n−1}, …, X, 1 in (*) to zero, we find that the coefficients of f_{1} and g_{1} are the solutions of a system of m + n linear equations in m + n unknowns. The matrix of coefficients of the system is the transpose of the matrix

( \begin{matrix}s_{0} & s_{1} & … & s_{m} \\ & s_{0} & … & & s_{m} \\ & & … & & & … \\ t_{0} & t_{1} & … & t_{n} \\ & t_{0} & … & & t_{n} \\ & & … & & & … \end{matrix} )

The existence of the solution shows that this matrix has determinant zero, which implies that Res(f, g) = 0.

Conversely, suppose that Res(f, g) = 0 but neither s_{0} nor t_{0} is zero. Because the above matrix has determinant zero, we can solve the linear equations to find polynomials f_{1} and g_{1} satisfying (*). If α is a root of f, then it must also be a root of f_{1} or g. If the former, cancel X − α from the left hand side of (*) and continue. As deg f_{1} < deg f, we eventually find a root of f that is not a root of f_{1}, and so must be a root of g.

Let c_{1}, …, c_{m+n} be the columns of the above matrix. Then

( X^{m−1}f(X) ; X^{m−2}f ; ⋮ ; f(X) ; X^{n−1}g(X) ; ⋮ ; g(X) ) = X^{m+n−1}c_{0} + ⋯ + 1c_{m+n},

and so

Res(f, g) =_{df} det(c_{0}, …, c_{m+n}) = det(c_{0}, ⋯, c_{m+n−1}, c)

where c is the vector on the left of the above equation. On expanding out this last determinant, we find that

Res(f, g) = a(X)f(X) + b(X)g(X)

where a(X) and b(X) are polynomials of degrees ≤ n − 1 and ≤ m − 1 respectively.

Remark 10.26. If the f(X) and g(X) have coefficients in an integral domain R, for example, ℤ or k[Y], then Res(f, g) ∈ R, and the polynomials a(X) and b(X) have coefficients in R.

For a monic polynomial f(X) = X^{m} + ⋯ + s_{m}, the resultant of f(X) and f′(X) is called the discriminant of f (apart possibly for a minus sign).

The resultant of homogeneous polynomials F (X, Y) = s_{0}X^{m} + s_{1}X^{m−1}Y + ⋯ + s_{m}Y^{m} and G(X, Y) = t_{0}X^{n} + t_{1}X^{n−1}Y + ⋯ + t_{n}Y^{n} is defined as for inhomogeneous polynomials.

Proposition 10.27. The resultant Res(F, G) = 0 if and only if F and G have a nontrivial zero in ℙ^{1}(k^{al}).

Proof. The nontrivial zeros of F (X, Y) in ℙ^{1}(k^{al}) are of the form:

(i) (a : 1) with a a root of F (X, 1), or

(ii) (1 : 0) in the case that s_{0} = 0.

Since a similar statement is true for G(X, Y), this proposition is a restatement of the previous proposition.

Clearly, the statement is more pleasant in the homogeneous case.

Maple can find the resultant of two polynomials in one variable: for example, entering “resultant((x + a)^{5}, (x + b)^{5}, x)” gives the answer (−a + b)^{25}. Explanation: the polynomials have a common root if and only if a = b, and this can happen in 25 ways.

Aside 10.28. There is a geometric interpretation of the last proposition. Take k to be algebraically closed, and regard the coefficients of F and G as indeterminants. Let V be the subset of 𝔸^{m+n+2} × ℙ^{1} where both F (s_{0}, …, s_{m}; X, Y) and G(t_{0}, …, t_{n}; X, Y) vanish. The proposition says that the projection of V on 𝔸^{m+n+2} is the set where Res(F, G), regarded as a polynomial in the s_{i} and t_{i}, vanishes. In other words, the proposition tells us that the projection of the particular Zariski-closed set V is the Zariski-closed set defined by the resultant of F and G.

Elimination theory does this in general. Given polynomials P_{i}(T_{1}, …, T_{m}; X_{0}, …, X_{n}), homogeneous in the X_{i}, it provides an algorithm for finding polynomials R_{j}(T_{1}, …, T_{n}) such that the P_{i}(a_{1}, …, a_{m}; X_{0}, …, X_{n}) have a common zero if and only if R_{j}(a_{1}, …, a_{n}) = 0 for all j. See, for example, Cox et al, Ideals, Varieties, and Algorithms, p388.

Exercise 10.29. (a) Prove that, for all z_{1}, z_{2},

| \begin{matrix}℘(z_{1}) & ℘′(z_{1}) & 1 \\ ℘(z_{2}) & ℘′(z_{2}) & 1 \\ ℘(z_{1} + z_{2}) & −℘′(z_{1} + z_{2}) & 1 \end{matrix} | = 0.

(b) Compute sufficiently many initial terms for the Laurent expansions of ℘′(z), ℘′(z)^{2}, etc., to verify the equation in Proposition 10.8.

11. The Mordell-Weil Theorem: Statement and Strategy

We state the Mordell-Weil (or finite basis) theorem, and outline the strategy for proving it.

Theorem 11.1 (Mordell-Weil). For any elliptic curve E over a number field K, E(K) is finitely generated.

The theorem was proved by Mordell (1922) when K = ℚ, and for all number fields by Weil in his thesis (1928). Weil in fact proved a much more general result, namely, he showed that for any nonsingular projective curve C over a number field K, the group Pic^{0}(C) is finitely generated. As we noted in (4.7), for an elliptic curve C(K) = Pic^{0}(C). The theorem was proved for all abelian varieties over number fields by Taniyama in 1954.

The first step in proving the theorem is to prove a weaker result:

Theorem 11.2 (Weak Mordell-Weil Theorem). For any elliptic curve E over a number field K and any integer n, E(K)/nE(K) is finite.

Clearly, for an abelian group M,

M finitely generated ⟹ M/nM finite for all n > 1,

but the converse statement is false. For example, ℚ regarded as a group under addition has the property that ℚ = nℚ and so ℚ/nℚ = 0, but the elements of any finitely generated subgroup of ℚ will have bounded denominators, and ℚ is not finitely generated.

We assume now that E(ℚ)/2E(ℚ) is finite, and sketch how one deduces that E(ℚ) is finitely generated. Recall that the height of a point P ∈ ℙ^{2}(ℚ) is H(P) = max(|a|, |b|, |c|) where P = (a : b : c) and a, b, c have been chosen to be integers with no common factor. For points P and Q on an elliptic curve E, not necessarily distinct, we shall relate H(P + Q) to H(P) and H(Q).

Let P_{1}, …, P_{s} ∈ E(ℚ) be a set of representatives for the elements of E(ℚ)/2E(ℚ). Then any Q ∈ E(ℚ) can be written

Q = P_{i} + 2Q′

for some i and for some Q′ ∈ E(ℚ). We shall show that, H(Q′) < H(Q), at least provided H(Q) is greater than some fixed constant H_{0}. If H(Q′) > H_{0}, we can repeat the argument for Q′, etc., to obtain

Q = P_{i} + 2Q′ = P_{i} + 2(P_{i′} + 2Q′′) = · · · .

Let Q_{1}, …, Q_{t} be the set of points in E(ℚ) with height < H_{0}. Then the above equation exhibits Q as a linear combination of P_{i}’s plus a Q_{j}, and so the P_{i}’s and Q_{j}’s generate E(ℚ).

Remark 11.3. The argument in the last paragraph is called “proof by descent”. Fermat is generally credited with originating this method in his proof of Fermat’s last theorem for the exponent 4 (which was short enough to fit in the margin). However, in some sense it goes back to the Greeks. Consider the proof that Y^{2} = 2X^{2} has no solution in integers. Define the height of a pair (m, n) of integers to be max(|m|, |n|). One proves that if (m, n) is one solution to the equation, then there exists another of smaller height, which leads to a contradiction.

12. Group cohomology

In proving the weak Mordell-Weil theorem, and also later in the study of the Tate-Shafarevich group, we shall use a little of the theory of the cohomology of groups.

Cohomology of finite groups. Let G be a finite group. A G-module is an abelian group M together with an action of G, i.e., a map G × M → M such that

(a) σ(m + m′) = σm + σm′ for all σ ∈ G, m, m′ ∈ M;

(b) (στ)(m) = σ(τm) for all σ, τ ∈ G, m ∈ M;

(c) 1m = m for all m ∈ M.

Thus, to give an action of G on M is the same as to give a homomorphism G → Aut(M) (automorphisms of M as an abelian group).

Example 12.1. Let L be a finite Galois extension of a field K with Galois group G, and let E be an elliptic curve over K. Then L, L^{×}, and E(L) are all G-modules.

Let M be a G-module. We define

H^{0}(G, M) = M^{G} = {m ∈ M | σm = m, all σ ∈ G}.

For the G-modules in (12.1),

H^{0}(G, L) = K, H^{0}(G, L^{×}) = K^{×}, and H^{0}(G, E(L)) = E(K).

A crossed homomorphism is a map f : G → M such that

f(στ) = f(σ) + σf(τ).

Note that the condition implies that f(1) = f(1 · 1) = f(1) + f(1), and so f(1) = 0. For any m ∈ M, we obtain a crossed homomorphism by putting

f(σ) = σm − m, all σ ∈ G.

Such a crossed homomorphism is said to be principal. The sum of two crossed homomorphisms is again a crossed homomorphism, and the sum of two principal crossed homomorphisms is again principal. Thus we can define

H^{1}(G, M) = \frac{\{crossed homomorphisms\}}{\{principal crossed homomorphisms\}}.

There are also cohomology groups H^{n}(G, M) for n > 1, but we won’t need them.

Example 12.2. If G acts trivially on M, i.e., σm = m for all σ ∈ G and m ∈ M, then a crossed homomorphism is simply a homomorphism, and every principal crossed homomorphism is zero. Hence H^{1}(G, M) = Hom(G, M).

Proposition 12.3. Let L be a finite Galois extension of K with group G; then H^{1}(G, L^{×}) = 0, i.e., every crossed homomorphism G → L^{×} is principal.

Proof. Let f be a crossed homomorphism G → L^{×}. In multiplicative notation, this means,

f(στ) = f(σ) · σ(f(τ)), σ, τ ∈ G,

and we have to find a γ ∈ L^{×} such that f(σ) = σγ/γ for all σ ∈ G. Because the f(τ) are nonzero, Dedekind’s theorem on the independence of characters (see Math 594) implies that

∑ f(τ)τ : L → L

is not the zero map, i.e., that there exists an α ∈ L such that

β = ∑_{τ∈G} f(τ)τα ≠ 0.

But then, for σ ∈ G,

σβ = ∑_{τ∈G} σ(f(τ)) · στ(α) = ∑_{τ∈G} f(σ)^{−1} · f(στ) · στ(α) = f(σ)^{−1} ∑_{τ∈G} f(στ)στ(α) = f(σ)^{−1}β,

which shows that f(σ) = β/σβ = σ(β^{−1})/β^{−1}.

Proposition 12.4. For any exact sequence of G-modules

0 → M → N → P → 0,

there is a canonical exact sequence

0 → H^{0}(G, M) → H^{0}(G, N) → H^{0}(G, P) ⟶^{δ} H^{1}(G, M) → H^{1}(G, N) → H^{1}(G, P)

Proof. The map δ is defined as follows. Let p ∈ P^{G}. There exists an n ∈ N mapping to p, and σn − n ∈ M for all σ ∈ G. The map σ ↦ σn − n : G → M is a crossed homomorphism, whose class we define to be δ(p). Another n′ mapping to p gives rise to a crossed homomorphism differing from the first by a principal crossed homomorphism, and so δ(p) is well-defined. The rest of the proof is routine.

Let H be a subgroup of G. The restriction map f ↦ f|H defines a homomorphism Res : H^{1}(G, M) → H^{1}(H, M).

Proposition 12.5. If G has order m, then m kills H^{1}(G, M).

Proof. In general, if H is a subgroup of G of index m, then there exists a homomorphism Cor : H^{i}(H, M) → H^{i}(G, M) such that the composite Res ∘ Cor is multiplication by m. The proposition is proved by taking H = 1.

Remark 12.6. Let H be a normal subgroup of a group G, and let M be a G-module. Then M^{H} is a G/H-module, and a crossed homomorphism f : G/H → M^{H} defines a crossed homomorphism G → M by composition:

G ⋯ → M
↓  ∪
G/H ⟶^{f} M^{H}.

In this way we obtain an “inflation” homomorphism

Inf : H^{1}(G/H, M^{H}) → H^{1}(G, M),

and one verifies easily that the sequence

0 → H^{1}(G/H, M^{H}) ⟶^{Inf} H^{1}(G, M) ⟶^{Res} H^{1}(H, M)

is exact.

Cohomology of infinite Galois groups. Let k be a perfect field, and let k^{al} be an algebraic closure of k. The automorphisms of k^{al} fixing the elements of k form a group G, which when endowed with the topology for which the open subgroups are those fixing some finite extension of k, is called the Galois group of k^{al} over k. The group G is compact, and so any open subgroup of G is of finite index. Infinite Galois theory says that the intermediate fields K, k ⊂ K ⊂ k^{al}, are in natural one-to-one correspondence with the closed subgroups of G. Under the correspondence intermediate fields of finite degree over k correspond to open subgroups of G.

A G-module M is said to be discrete if the map G × M → M is continuous when M is given the discrete topology and G is given its natural topology. This is equivalent to requiring that

M = ∪_{H}M^{H}, H open in G,

i.e., to requiring that every element of M is fixed by the subgroup of G fixing some finite extension of k. For example, M = k^{al}, M = k^{al×}, and M = E(k^{al}) are all discrete G-modules because

k^{al} = ∪K, k^{al} = ∪K^{×}, and E(k^{al}) = ∪E(K)

where, in each case, the union runs over the finite extensions K of k contained in k^{al}.

For an infinite Galois group G, we define H^{1}(G, M) to be the group of continuous crossed homomorphisms f : G → M modulo the subgroup of principal crossed homomorphisms. With this definition

H^{1}(G, M) = \underrightarrow{lim}_{H}H^{1}(G/H, M^{H})

where H runs through the open normal subgroups of G. Explicitly, this means that:

(a) H^{1}(G, M) is the union of the images of the inflation maps Inf : H^{1}(G/H, M^{H}) → H^{1}(G, M), H an open normal subgroup of G;

(b) an element γ ∈ H^{1}(G/H, M^{H}) maps to zero in H^{1}(G, M) if and only if it maps to zero H^{1}(G/H′, M^{H′}) for some open normal subgroup H′ of G contained in H.

In particular, the group H^{1}(G, M) is torsion.

Example 12.7. (a) Proposition 12.3 shows that

H^{1}(G, k^{al×}) = \underrightarrow{lim}_{H}H^{1}(Gal(K/k), K^{×}) = 0.

(b) For a field L, let μ_{n}(L) = {ζ ∈ L^{×} | ζ^{n} = 1}. From the exact sequence

1 → μ_{n}(k^{al}) → k^{al×} ⟶^{n} k^{al×} → 1

we obtain an exact sequence of cohomology groups

1 → μ_{n}(k) → k^{×} ⟶^{n} k^{×} → H^{1}(G, μ_{n}(k^{al}) → 1,

and hence a canonical isomorphism H^{1}(G, μ_{n}(k^{al})) ⟶^{≈} k^{×}/k^{×n}. Note that for k = ℚ, ℚ^{×}/ℚ^{×n} is infinite if n > 1. For example, the numbers

(−1)^{ε(∞)} ∏_{p prime} p^{ε(p)},

where ε(p) = 0 or 1 and all but finitely many are zero, form a set of representatives for the elements of ℚ^{×}/ℚ^{×2}, which is therefore an infinite-dimensional vector space over 𝔽_{2}.

(c) If G acts trivially on M, then H^{1}(G, M) is the set of continuous homomorphisms G → M. This set can be identified with the set of pairs (K, α) consisting of a finite Galois extension K of k contained in k^{al} and an injective homomorphism α : Gal(K/k) → M.

For an elliptic curve E over k, we abbreviate H^{i}(Gal(k^{al}/k), E(k^{al})) to H^{i}(k, E).

Now consider an elliptic curve E over ℚ. Let ℚ^{al} be the algebraic closure of ℚ in ℂ, and choose an algebraic closure ℚ_{p}^{al} for ℚ_{p}. The embedding ℚ ↪ ℚ_{p} extends to an embedding ℚ^{al} ↪ ℚ_{p}^{al},

\begin{matrix}ℚ^{al} & ↪ & ℚ_{p}^{al} \\ ↑ & & ↑ \\ ℚ & ↪ & ℚ_{p}. \end{matrix}

The action of Gal(ℚ_{p}^{al}/ℚ_{p}) on ℚ^{al} ⊂ ℚ_{p}^{al} defines an inclusion

Gal(ℚ_{p}^{al}/ℚ_{p}) ↪ Gal(ℚ^{al}/ℚ).

Hence any crossed homomorphism

Gal(ℚ^{al}/ℚ) → E(ℚ^{al})

induces (by composition) a crossed homomorphism

Gal(ℚ_{p}^{al}/ℚ) → E(ℚ_{p}^{al}).

In this way, we obtain a homomorphism

H^{1}(ℚ, E) → H^{1}(ℚ_{p}, E)

that (slightly surprisingly) is independent of the choice of the embedding ℚ^{al} ↪ ℚ_{p}^{al}. A similar remark applies to the cohomology groups of μ_{n} and E_{n}. Later we’ll give a more natural interpretation of these “localization” homomorphisms.

13. The Selmer and Tate-Shafarevich groups

Lemma 13.1. For any elliptic curve E over an algebraically closed field k and any integer n, the map n : E(k) → E(k) is surjective.

Proof. The simplest proof uses algebraic geometry. The map of varieties n : E → E has finite fibres (because E(k)_{n} is finite and it is a homomorphism) and has Zariski-closed image (because E is complete) of dimension one (because its fibres have dimension 0). Hence it is surjective as a morphism of algebraic varieties.

Alternatively, let P = (x : y : 1) ∈ E(k). To find a point Q = (x′ : y′ : 1) such that nQ = P one has to solve a pair of polynomial equations in the variables X, Y. In characteristic zero, these equations can’t be inconsistent, because n : E(ℂ) → E(ℂ) is surjective, and so, by the Hilbert Nullstellensatz, they have a solution in k. In characteristic p one has to work a little harder.

From the lemma we obtain an exact sequence

0 → E_{n}(ℚ^{al}) → E(ℚ^{al}) ⟶^{n} E(ℚ^{al}) → 0

and a cohomology sequence

0 → E_{n}(ℚ) → E(ℚ) ⟶^{n} E(ℚ) → H^{1}(ℚ, E_{n}) → H^{1}(ℚ, E) ⟶^{n} H^{1}(ℚ, E),

from which we extract the sequence

0 → E(ℚ)/nE(ℚ) → H^{1}(ℚ, E_{n}) → H^{1}(ℚ, E)_{n} → 0.

Here, as usual, H^{1}(ℚ, E)_{n} is the group of elements in H^{1}(ℚ, E)_{n} killed by n. If H^{1}(ℚ, E_{n}) were finite, then we could deduce that E(ℚ)/nE(ℚ) is finite, but unfortunately, it isn’t. Instead, we proceed as follows. When we consider E as an elliptic curve over ℚ_{p} we obtain a similar exact sequence, and there is a commutative diagram:

0 → E(ℚ)/nE(ℚ) → H^{1}(ℚ, E_{n}) → H^{1}(ℚ, E)_{n} → 0
↓ ↓ ↓
0 → E(ℚ_{p})/nE(ℚ_{p}) → H^{1}(ℚ_{p}, E_{n}) → H^{1}(ℚ_{p}, E)_{n} → 0.

We want replace H^{1}(ℚ, E_{n}) by a subset that contains the image of E(ℚ)/nE(ℚ) but which we’ll be able to prove finite. We do this as follows: if γ ∈ H^{1}(ℚ, E_{n}) comes from an element of E(ℚ), then certainly its image γ_{p} in H^{1}(ℚ_{p}, E_{n}) comes from an element of E(ℚ_{p}). This suggests defining^{15}

S^{(n)}(E/ℚ) = {γ ∈ H^{1}(ℚ, E_{n}) | ∀p, γ_{p} comes from E(ℚ_{p})}
= Ker(H^{1}(ℚ, E_{n}) → ∏_{p} H^{1}(ℚ_{p}, E)).

15In the definitions of both the Selmer and Tate-Shafarevich groups, we should require that the elements become zero also in H^{1}(ℝ, E). We ignore this for the present.

The group S^{(n)}(E/ℚ) is called the Selmer group. In the same spirit, we define^{16} the Tate-Shafarevich group to be

TS(E/ℚ) = Ker(H^{1}(ℚ, E) → ∏_{p} H^{1}(ℚ_{p}, E)).

It is a torsion group. Later we shall give a geometric interpretation of TS(E/ℚ) which shows that it provides a measure of the failure of the Hasse principle for curves of genus 1. One can similarly define Selmer and Tate-Shafarevich groups for elliptic curves over number fields.

The next lemma is as trivial to prove as it is useful.

Lemma 13.2. From any pair of maps of abelian groups (or modules etc.)

A ⟶^{α} B ⟶^{β} C

there is an exact sequence

0 → Ker(α) → Ker(β ∘ α) ⟶^{α} Ker(β) → Coker(α) → Coker(β ∘ α) → Coker(β) → 0.

When we apply the lemma to the maps

H^{1}(ℚ, E_{n}) → H^{1}(ℚ, E)_{n} → ∏_{p} H^{1}(ℚ_{p}, E)_{n},

we obtain the fundamental exact sequence

0 → E(ℚ)/nE(ℚ) → S^{(n)}(E/ℚ) → TS(E/ℚ)_{n} → 0.

We shall prove E(ℚ)/nE(ℚ) to be finite by showing that S^{(n)}(E/ℚ) is finite.

14. The Finiteness of the Selmer Group

Theorem 14.1. For any elliptic curve E over a number field L and any integer n, the Selmer group S^{(n)}(E/L) is finite (and, in fact, computable).

Lemma 14.2. Let E be an elliptic curve over ℚ_{p} with good reduction, and let n be an integer not divisible by p. A point P ∈ E(ℚ_{p}) is of the form nQ for some Q ∈ E(ℚ_{p}) if and only if P̄ ∈ E(𝔽_{p}) is of the form nQ̄ for some Q̄ ∈ E(𝔽_{p}).

Proof. Clearly P = nQ ⟹ P̄ = nQ̄. For the converse, we make use of the filtration defined in Section 7:

E(ℚ_{p}) ⊃ E^{1}(ℚ_{p}) ⊃ ⋯ ⊃ E^{n}(ℚ_{p}) ⊃ E^{n+1}(ℚ_{p}) ⊃ ⋯,
E(ℚ_{p})/E^{1}(ℚ_{p}) ≅ Ē(𝔽_{p}), E^{n}(ℚ_{p})/E^{n+1}(ℚ_{p}) ≅ 𝔽_{p}.

By hypothesis there exists a Q_{0} ∈ E(ℚ_{p}) such that

nQ_{0} ≡ P mod E^{1}(ℚ_{p}).

Consider P − nQ_{0} ∈ E^{1}(ℚ_{p}). Because E^{1}(ℚ_{p})/E^{2}(ℚ_{p}) ≈ 𝔽_{p} and p doesn’t divide n, multiplication by n is an isomorphism on E^{1}(ℚ_{p})/E^{2}(ℚ_{p}). Therefore there exists a Q_{1} ∈ E^{1}(ℚ_{p}) such that

P − nQ_{0} = nQ_{1} mod E^{2}(ℚ_{p}).

16The name, I believe, is due to Cassels, who certainly knows the alphabet. Recently, it has become fashionable to reverse the order of the names. In the absence of an argument for doing this, I prefer to follow Cassels. In the original, the initial Russian letter of Shafarevich was used for TS.

Continuing in this fashion, we find a sequence Q_{0}, Q_{1}, … of points in E(ℚ_{p}) such that

Q_{i} ∈ E^{i}(ℚ_{p}), P − n ∑_{i=0}^{m} Q_{i} ∈ E^{m+1}(ℚ_{p}).

The first condition implies that ∑ Q_{i} converges to a point in E(ℚ_{p}) (recall that E(ℚ_{p}) is compact), and the second condition implies that its limit Q has the property that P = nQ.

We now need a result from algebraic number theory.

Lemma 14.3. For any finite extension k of 𝔽_{p}, there exists an extension K of ℚ_{p} with the following properties:

(a) [K : ℚ_{p}] = [k : 𝔽_{p}];

(b) the integral closure R of ℤ_{p} in K is a principal ideal domain with p as its only prime element (up to associates), and R/pR = k.

Proof. Omitted.

The field K in the lemma is unique (up to a unique isomorphism inducing the identity map on the residue fields). It is called the unramified extension of ℚ_{p} with residue field k.

Because R is a principal ideal domain with p as its only prime element and K is the field of fractions of R, every element α in K can be written uniquely in the form up^{m} with u ∈ R^{×}. Define ord_{p}(α) = m. Then ord_{p} is a homomorphism K^{×} → ℤ extending ord_{p} : ℚ^{×} → ℤ.

Remark 14.4. Let K ⊃ R → k be as in the lemma. Then pR is the unique maximal ideal of R, and Hensel’s lemma (Theorem 2.8) holds for R, and so all the roots of X^{q} − X in k lift to R. Therefore, K contains the splitting field of X^{q} − X, and, in fact, is equal to it.

The theory in Section 7 holds, word for word, with ℚ_{p} replaced by an unramified extension^{17} K, except that now

E(K)/E^{1}(K) ≅ Ē(k), E^{n}(K)/E^{n+1}(K) ≅ k.

Therefore, Lemma 14.2 is also valid with ℚ_{p} replaced by K.

Consider an elliptic curve E over ℚ_{p} and an n satisfying the hypotheses of Lemma 14.2. Let P ∈ E(ℚ_{p}). According to Lemma 14.2, P = nQ for some Q with coordinates in a field K ⊃ ℚ_{p}, which we may choose to be of finite degree over ℚ_{p}, and which (the generalization of) (14.2) allows us to take to be unramified over ℚ_{p}. We have proved:

Lemma 14.5. Let E and n satisfy the hypotheses of Lemma 14.2, and let P ∈ E(ℚ_{p}). Then there exists a finite unramified extension K of ℚ_{p} such that P ∈ nE(K).

Proposition 14.6. Let E be an elliptic curve over ℚ, and let T be the set of primes dividing 2nΔ. For any γ ∈ S^{(n)}(ℚ) and any p ∉ T, there exists a finite unramified extension K of ℚ_{p} such that γ maps to zero in H^{1}(K, E_{n}).

17In fact, it holds even for a ramified extension.

Proof. From the definition of the Selmer group, we know that there exists a P ∈ E(ℚ_{p}) mapping to γ_{p} ∈ H^{1}(ℚ_{p}, E_{n}). Since p does not divide 2Δ, E has good reduction at p, and so there is an unramified extension K of ℚ_{p} such that P ∈ nE(K). Now the following diagram shows that γ maps to zero in H^{1}(K, E_{n}):

E(ℚ) ⟶^{n} E(ℚ) → H^{1}(ℚ, E_{n})
↓ ↓ ↓
E(ℚ_{p}) ⟶^{n} E(ℚ_{p}) → H^{1}(ℚ_{p}, E_{n})
↓ ↓ ↓
E(K) ⟶^{n} E(K) → H^{1}(K, E_{n}).

Proof of the finiteness of the Selmer group in a special case. We prove that S^{(2)}(E/ℚ) is finite in the case that the points of order 2 on E have coordinates in ℚ. This condition means that the equation for E has the form:

Y^{2}Z = (X − αZ)(X − βZ)(X − γZ), α, β, γ ∈ ℚ.

It implies that

E_{2}(ℚ^{al}) = E_{2}(ℚ) ≈ (ℤ/2ℤ)^{2} = (μ_{2})^{2},

all with the trivial action of Gal(ℚ^{al}/ℚ), and so

H^{1}(ℚ, E_{2}) ≈ H^{1}(ℚ, μ_{2})^{2} = (ℚ^{×}/ℚ^{×2})^{2}.

Let γ ∈ S^{(2)}(E/ℚ) ⊂ H^{1}(ℚ, E_{2}). For any prime p_{0} not dividing 2Δ, there exists a finite unramified extension K of ℚ_{p_{0}} such that γ maps to zero under the vertical arrows:

H^{1}(ℚ, E_{2}) ≈ (ℚ^{×}/ℚ^{×2})^{2}
↓  ↓
H^{1}(K, E_{2}) ≈ (K^{×}/K^{×2})^{2}.

Suppose

γ ↔ ((−1)^{ε(∞)} ∏ p^{ε(p)}, (−1)^{ε′(∞)} ∏ p^{ε′(p)}), 0 ≤ ε(p), ε′(p) ≤ 1.

Now

ord_{p_{0}} ((−1)^{ε(∞)} ∏ p^{ε(p)}) = ε(p_{0}),

and so if (−1)^{ε(∞)} ∏ p^{ε(p)} is a square in K, then ε(p_{0}) = 0. Therefore the only p that can occur in the factorizations are those dividing 2Δ. This allows only finitely many possibilities for γ.

Remark 14.7. It is possible to prove that E(ℚ)/2E(ℚ) is finite in this case without mentioning cohomology groups. Consider an elliptic curve

Y^{2}Z = (X − αZ)(X − βZ)(X − γZ), α, β, γ ∈ ℤ.

Define φ_{α} : E(ℚ)/2E(ℚ) → ℚ^{×}/ℚ^{×2} by

φ_{α}((x : y : z)) = \{ \begin{matrix}(x/z − α)ℚ^{×2} & z ≠ 0, x ≠ αz; \\ (α − β)(α − γ)ℚ^{×} & z ≠ 0, x = αz \\ ℚ^{×} & (x : y : z) = (0 : 1 : 0). \end{matrix}

One can prove directly that φ_{α} is a homomorphism, that the kernel of (φ_{α}, φ_{β}) : E(ℚ) → (ℚ^{×}/ℚ^{×2})^{2} is 2E(ℚ), and that φ_{α}(P) and φ_{β}(P) are represented by ± a product of primes dividing 2Δ (see [Kn] pp85–91).

Proof of the finiteness of the Selmer group in the general case. In the above proof we made use of the following facts:

(a) ℚ contains a primitive square root of 1;

(b) E(ℚ)_{2} = E(ℚ^{al})_{2};

(c) for any finite set T of prime numbers, the kernel of

r ↦ (ord_{p}(r) mod 2) : ℚ^{×}/ℚ^{×2} → ⨁_{p∉T} ℤ/2ℤ

is finite.

For some finite extension L of ℚ, L will contain a primitive nth root of 1 and E(L) will contain all the points of order n on E(ℚ^{al}). The next lemma shows that, in order to prove that S^{(n)}(E/ℚ) is finite, it suffices to prove that S^{(n)}(E/L) is finite.

Lemma 14.8. For any finite Galois extension L of ℚ and any n, the kernel of

S^{(n)}(E/ℚ) → S^{(n)}(E/L)

is finite.

Proof. Since S^{(n)}(E/ℚ) and S^{(n)}(E/L) are subgroups of H^{1}(ℚ, E_{n}) and H^{1}(L, E_{n}) respectively, it suffices to prove that the kernel of

H^{1}(ℚ, E_{n}) → H^{1}(L, E_{n})

is finite. But (cf. 12.6), this kernel is H^{1}(Gal(L/ℚ), E_{n}(L)), which is finite because both Gal(L/ℚ) and E_{n}(L) are finite.

It remains to consider (c). The proof of its analogue for L requires the three fundamental theorems in any course on algebraic number theory. We review their statements.

Review of algebraic number theory. In the following, L is a finite extension of ℚ and R is the ring of all algebraic integers in L (see p53).

Every element of R is a product of irreducible (i.e., “unfactorable”) elements, but this factorization may not be unique. For example, in ℤ[\sqrt{−5}] we have

6 = 2 · 3 = (1 + \sqrt{−5})(1 − \sqrt{−5})

and 2, 3, 1+\sqrt{−5}, 1−\sqrt{−5} are irreducible with no two associates. The idea of Kummer and Dedekind to remedy this problem was to enlarge the set of numbers with “ideal numbers”, now called ideals, to recover unique factorization. For ideals 𝔞 and 𝔟, define

𝔞𝔟 = {∑ a_{i}b_{i} | a_{i} ∈ 𝔞, b_{i} ∈ 𝔟}.

It is again is an ideal.

Theorem 14.9 (Dedekind). Every ideal in R can be written uniquely as a product of prime ideals.

For example, in ℤ[\sqrt{−5}],

(6) = (2, 1 + \sqrt{−5})(2, 1 − \sqrt{−5})(3, 1 + \sqrt{−5})(3, 1 − \sqrt{−5}).

For an element a ∈ R and a prime ideal 𝔭 in R, let ord_{𝔭}(a) be the exponent of 𝔭 in the unique factorization of the ideal (a), so that

(a) = ∏_{𝔭}𝔭^{ord_{𝔭}(a)}.

For x = \frac{a}{b} ∈ L, define ord_{𝔭}(x) = ord_{𝔭}(a) − ord_{𝔭}(b). The ideal class group C of R is defined to be the cokernel of the homomorphism

L^{×} → ⨁_{𝔭⊂R,𝔭 prime} ℤ → C → 0
x ↦ (ord_{𝔭}(x)).

It is 0 if and only if R is a principal ideal domain, and so C can be regarded as giving a measure of the failure of unique factorization of elements in R.

Theorem 14.10 (Finiteness of the class number). The ideal class group C is finite.

We next need to understand the group U of units in R. For R = ℤ, U = {±1}, but already for R = ℤ[\sqrt{2}], U is infinite because \sqrt{2} + 1 is a unit in ℤ[\sqrt{2}]. One can show that

ℤ[\sqrt{2}]^{×} = \{±(1 + \sqrt{2})^{n} | n ∈ ℤ\} ≈ ℤ/2ℤ ⊕ ℤ.

Theorem 14.11 (Dedekind unit theorem). The group U of units of R is finitely generated.

In fact, the full theorem gives a formula for the rank of U.

As in any commutative ring, a is a unit in R if and only if (a) = R. In our case, this is equivalent to saying that ord_{𝔭}(a) = 0 for all prime ideals 𝔭, and so we have an exact sequence

0 → U → L^{×} → ⊕_{𝔭}ℤ → C → 0

with U finitely generated and C finite.

The fundamental theorems of algebraic number theory show, more generally, that, when T is a finite set of prime ideals in L, the groups U_{T} and C_{T} defined by the exactness of

0 → U_{T} → L^{×} ⟶^{a↦(ord_{𝔭}(a))} ⊕_{𝔭∉T}ℤ → C_{T} → 0

are, respectively, finitely generated and finite.

Completion of the proof of the finiteness of the Selmer group.

Lemma 14.12. Let N be the kernel of

a ↦ (ord_{𝔭}(a) mod n) : Ker(L^{×}/L^{×n}) → ⊕_{𝔭∉T}ℤ/nℤ).

Then there is an exact sequence

0 → U_{T} /U_{T}^{n} → N → (C_{T})_{n}

Proof. Let α ∈ N. Then n|ord_{𝔭}(α) for all 𝔭 ∉ T, and so we can map α to the class c of (\frac{ord_{𝔭}(α)}{n}) in C_{T}. Clearly nc = 0, and any element of C_{T} killed by n arises in this way. If c = 0, then there exists a β ∈ L^{×} such that ord_{𝔭}(β) = ord_{𝔭}(α)/n for all 𝔭. Now α/β^{n} lies in U_{T}, and is well-defined up to an element of U_{T}^{n}.

Now the argument used in the special case shows that S^{(n)}(E/L) is finite.

Remark 14.13. The above proof of the finiteness of the Selmer group is taken from my book, Etale Cohomology, p133. It is simpler than the standard proof (see [S1] p190–196) which unnecessarily “translate[s] the putative finiteness of E(K)/mE(K) into a statement about certain field extensions of K.”

15. Heights

Let P = (a_{0} : …: a_{n}) ∈ ℙ^{n}(ℚ). We shall say that (a_{0} : …: a_{n}) is a primitive representative for P if

a_{i} ∈ ℤ, gcd(a_{0}, …, a_{n}) = 1.

The height H(P) of P is then defined to be

H(P) = max_{j} |a_{i}|.

Here | ∗ | is the usual absolute value. The logarithmic height h(P) of P is defined to be log H(P).

Heights on ℙ^{1}. Let F (X, Y) and G(X, Y) be homogeneous polynomials of degree m in ℚ[X, Y], and let V (ℚ) be the set of their common zeros. Then F and G define a map

φ : ℙ^{1}(ℚ) \ V (ℚ) → ℙ^{1}(ℚ), (x : y) ↦ (F (x, y) : G(x, y)).

Proposition 15.1. If F (X, Y) and G(X, Y) have no common zero in ℙ^{1}(ℚ^{al}), then there exists a constant B such that

|h(φ(P)) − mh(P)| ≤ B, all P ∈ ℙ^{1}(ℚ).

Proof. We may suppose that F and G have integer coefficients. Let (a : b) be a primitive representative for P. Then, for a monomial H(X, Y) = cX^{i}Y^{m−i}, |H(a, b)| ≤ |c| max(|a|^{m}, |b|^{m}), and so

|F (a, b)|, |G(a, b)| ≤ C (max(|a|, |b|)^{m}

with

C = (m + 1) max(|coeff. of F or G|).

Now

H(φ(P)) ≤ max(|F (a, b)|, |G(a, b)|) ≤ C(max(|a|, |b|)^{m} = C · H(P)^{m}.

On taking logs, we obtain the inequality

h(φ(P)) ≤ mh(P) + log C.

The problem with proving a reverse inequality is that F (a, b) and G(a, b) may have a large common factor, and so the first inequality in the second last equation may be strict. We use the hypothesis that F and G have no common zero in ℚ^{al} to limit this problem.

Let R be the resultant of F and G—the hypothesis says that R ≠ 0. Consider Y^{−m}F (X, Y) = F (\frac{X}{Y} , 1) and Y^{−m}G(X, Y) = G(\frac{X}{Y} , 1). When regarded as polynomials in the single variable \frac{X}{Y}, F (\frac{X}{Y} , 1) and G(\frac{X}{Y} , 1) have the same resultant as F (X, Y) and G(X, Y), and so (see p55), there are polynomials U(\frac{X}{Y}), V (\frac{X}{Y}) ∈ ℤ[\frac{X}{Y}] of degree m − 1 such that

U(\frac{X}{Y})F (\frac{X}{Y} , 1) + V (\frac{X}{Y})G(\frac{X}{Y} , 1) = R.

On multiplying through by Y^{2m−1} and renaming Y^{m−1}U(\frac{X}{Y}) as U(X, Y) and Y^{m−1}V (\frac{X}{Y}) as V (X, Y), we obtain the equation

U(X, Y)F (X, Y) + V (X, Y)G(X, Y) = RY^{2m−1}.

Similarly, there are homogenous polynomials U′(X, Y) and V′(X, Y) of degree m − 1 such that

U′(X, Y)F (X, Y) + V′(X, Y)G(X, Y) = RX^{2m−1}.

Substitute (a, b) for (X, Y) to obtain the equations

U(a, b)F (a, b) + V (a, b)G(a, b) = Rb^{2m−1},
U′(a, b)F (a, b) + V′(a, b)G(a, b) = Ra^{2m−1}.

From these equations we see that

gcd(F (a, b), G(a, b)) divides gcd(Ra^{2m−1}, Rb^{2m−1}) = R.

Moreover, as in the first part of the proof, there is a C > 0 such that

U(a, b), U′(a, b), V (a, b), V′(a, b) ≤ C (max |a|, |b|)^{m−1} .

Therefore

2C (max |a|, |b|)^{m−1} (max |F (a, b)|, |G(a, b)|) ≥ |R||a|^{2m−1}, |R||b|^{2m−1}.

Together with gcd(F (a, b), G(a, b))|R, these inequalities imply that

H(φ(P)) ≥ \frac{1}{|R|} max(|F (a, b)|, |G(a, b)|) ≥ \frac{1}{2C} H(P)^{m}.

On taking logs, we obtain the inequality

h(φ(P)) ≥ mh(P) − log 2C.

There is a well-defined map (special case of the Veronese map)

(a : b), (c : d) ↦ (ac : ad + bc : bd) : ℙ^{1} × ℙ^{1} → ℙ^{2}.

Let R be the image of (P, Q).

Lemma 15.2.

\frac{1}{2} ≤ \frac{H(R)}{H(P)H(Q)} ≤ 2.

Proof. Choose (a : b) and (c : d) to be primitive representatives of P and Q. Then

H(R) ≤ max(|ac|, |ad + bc|, |bd|) ≤ 2 max(|a|, |b|) max(|c|, |d|) = 2H(P)H(Q).

If a prime p divides both ac and bd, then either it divides a and d but not b or c, or the other way round. In either case, it doesn’t divide ad + bc, and so (ac : ad + bc : bd) is a primitive representative for R. It remains to show that

max(|ac|, |ad + bc|, |bd|) ≥ \frac{1}{2} (max(|a|, |b|) (max |c||d|) ,

but this is an elementary exercise.

Heights on E. Let E be the elliptic curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ ℚ, Δ = 4a^{3} + 27b^{2} ≠ 0.

For P ∈ E(ℚ), define

H(P) = \{ \begin{matrix}H((x(P) : z(P))) & if z(P) ≠ 0 \\ 0 & if P = (0 : 1 : 0). \end{matrix}

and

h(P) = log H(P).

Other definitions of h are possible, but they differ by bounded amounts, and therefore lead to the same canonical height (see below).

Lemma 15.3. For any constant B, the set of P ∈ E(ℚ) such that h(P) < B is finite.

Proof. Certainly, for any constant B, {P ∈ ℙ^{1}(ℚ) | H(P) ≤ B} is finite. But for every point (x_{0} : z_{0}) ∈ ℙ^{1}(ℚ), there are at most two points (x_{0} : y : z_{0}) ∈ E(ℚ), and so {P ∈ E(ℚ) | H(P) ≤ B} is finite.

Proposition 15.4. There exists a constant A such that

|h(2P) − 4h(P)| ≤ A.

Proof. Let P = (x : y : z) and 2P = (x_{2} : y_{2} : z_{2}). According to the duplication formula (p37),

(x_{2} : z_{2}) = (F (x, z) : G(x, z))

where F (X, Z) and G(X, Z) are polynomials of degree 4 such that

\begin{aligned}F (X, 1) & = & (3X^{2} + a)^{2} − 8X(X^{3} + ax + b) \\ G(X, 1) & = & 4(X^{3} + aX + b). \end{aligned}

Since X^{3} + aX + b and its derivative 3X^{2} + b have no common root, neither do F (X, 1) and G(X, 1), and so Proposition 15.1 shows that

|h(2P) − 4h(P)| ≤ A

for some constant A.

Theorem 15.5. There exists a unique function ĥ : E(ℚ) → ℝ satisfying the conditions (a) and (b):

(a) ĥ(P) − h(P) is bounded;

(b) ĥ(2P) = 4ĥ(P).

In fact,

ĥ(P) = lim_{n→∞} \frac{h(2^{n}P)}{4^{n}}

and it has the following additional properties:

(c) for any C ≥ 0, the set {P ∈ E(ℚ) | ĥ(P) ≤ C} is finite;

(d) ĥ(P) ≥ 0, with equality if and only if P has finite order.

Proof. We first prove uniqueness. If h′ satisfies (a) with bound B, then

|h′(2^{n}P) − h(2^{n}P)| ≤ B.

If in addition it satisfies (b), then

|h′(P) − \frac{h(2^{n}P)}{4^{n}} | ≤ \frac{B}{4^{n}} ,

and so h(2^{n}P)/4^{n} converges to h′(P).

To prove the existence, we first verify that h(2^{n}P)/4^{n} is a Cauchy sequence. From Proposition 15.4, we know that there exists a constant A such that

|h(2P) − 4h(P)| ≤ A

for all P. For N ≥ M ≥ 0 and P_{0} ∈ E(ℚ),

|\frac{h(2^{N}P_{0})}{4^{N}} − \frac{h(2^{M}P_{0})}{4^{M}} | = | ∑_{n=M}^{N−1} (\frac{h(2^{n+1}P_{0})}{4^{n+1}} − \frac{h(2^{n}P_{0})}{4^{n}})|
≤ ∑_{n=M}^{N−1} \frac{1}{4^{n+1}} |h(2^{n+1}P_{0}) − 4h(2^{n}P_{0})|
≤ ∑_{n=M}^{N−1} \frac{1}{4^{n+1}} A
≤ \frac{A}{4^{M+1}} (1 + \frac{1}{4} + \frac{1}{4^{2}} + ⋯)
= \frac{A}{3 · 4^{M}} .

This shows that the sequence h(2^{n}P)/4^{n} is Cauchy, and we define ĥ(P) to be its limit. Because H(P) is an integer ≥ 1, h(P) ≥ 0 and ĥ(P) ≥ 0.

When M = 0 the displayed equation becomes

|\frac{h(2^{N}P)}{4^{N}} − h(P)| ≤ \frac{A}{3},

and on letting N → ∞ we obtain (a).

For (b), note that

ĥ(2P) = lim_{n→∞} \frac{h(2^{n+1}P)}{4^{n}} = 4 · lim_{n→∞} \frac{h(2^{n+1}P)}{4^{n+1}} = 4 · ĥ(P).

The set of P for which ĥ(P) ≤ C is finite, because h has this property and the difference ĥ(P) − h(P) is bounded.

If P is torsion, then {2^{n}P | n ≥ 0} is finite, so ĥ is bounded on it, by D say, and ĥ(P) = ĥ(2^{n}P)/4^{n} ≤ D/4^{n} for all n. On the other hand, if P has infinite order, then {2^{n}P | n ≥ 0} is infinite and ĥ is unbounded on it. Hence ĥ(2^{n}P) > 1 for some n, and so ĥ(P) > 4^{−n} > 0.

The function ĥ is called^{18} the canonical, or Néron-Tate, height. If was defined independently by Tate using the above method, and by Néron using a much more elaborate method which, however, gives more information about ĥ.

Let f : M → K be a function from an abelian group M into a field K of characteristic ≠ 2. Such an f is called a quadratic form if f(2x) = 4f(x) and

B(x, y) =_{df} f(x + y) − f(x) − f(y)

is bi-additive. Then B is symmetric, and it is the only symmetric bi-additive form B : M × M → K such that f(x) = \frac{1}{2}B(x, x). We shall need the following criterion:

Lemma 15.6. A function f : M → K from an abelian group into a field K of characteristic ≠ 2 is a quadratic form if and only if it satisfies the parallelogram^{19} law:

f(x + y) + f(x − y) = 2f(x) + 2f(y) all x, y ∈ M.

Proof. On taking x = y = 0 in the parallelogram law, we find that f(0) = 0, on taking x = y we find that f(2x) = 4f(x), and on taking x = 0 we find that f(−y) = f(y). By symmetry, it remains to show that B(x + y, z) = B(x, z) + B(y, z), i.e., that

f(x + y + z) − f(x + y) − f(x + z) − f(y + z) + f(x) + f(y) + f(z) = 0.

Now four applications of the parallelogram law show that:

f(x + y + z) + f(x + y − z) − 2f(x + y) − 2f(z) = 0
f(x − y + z) + f(x + y − z) − 2f(x) − 2f(y − z) = 0
f(x − y + z) + f(x + y + z) − 2f(x + z) − 2f(y) = 0
2f(y + z) + 2f(y − z) − 4f(y) − 4f(z) = 0.

The alternating sum of these equations is the required equation.

Proposition 15.7. The height function ĥ : E(ℚ) → ℝ is a quadratic form.

We have to prove the parallelogram law.

Lemma 15.8. There exists a constant C such that

H(P_{1} + P_{2})H(P_{1} − P_{2}) ≤ C · H(P_{1})^{2}H(P_{2})^{2}

for all P_{1}, P_{2} ∈ E(ℚ).

Proof. Let P_{1} + P_{2} = P_{3} and P_{1} − P_{2} = P_{4}, and let P_{i} = (x_{i} : y_{i} : z_{i}). Then

(x_{3}x_{4} : x_{3}z_{4} + x_{4}z_{3} : z_{3}z_{4}) = (W_{0} : W_{1} : W_{2})

where (see p37)

W_{0} = (X_{2}Z_{1} − X_{1}Z_{2})^{2}
W_{1} = 2(X_{1}X_{2} + aZ_{1}Z_{2})(X_{1}Z_{2} + X_{2}Z_{1}) + 4bZ_{1}^{4}Z_{2}^{4}
W_{2} = X_{1}^{2}X_{2}^{2} − 2aX_{1}X_{2}Z_{1}Z_{2} − 4b(X_{1}Z_{1}Z_{2}^{2} + X_{2}Z_{1}^{2}Z_{2}) + a^{2}Z_{1}^{2}Z_{2}^{2}.

It follows that

H(W_{0} : W_{1} : W_{2}) ≤ CH(P_{1})^{2}H(P_{2})^{2}.

18Unfortunately, there are different definitions of the “canonical” height, which differ by a constant factor.

19In elementary linear algebra, the parallelogram law says that, for vectors u and v in ℝ^{n}, ∥u + v∥^{2} + ∥u − v∥^{2} = 2∥u∥^{2} + 2∥v∥^{2}.

According to Lemma 15.2,

H(W_{0} : W_{1} : W_{2}) ≥ \frac{1}{2}H(P_{3})H(P_{4}).

Lemma 15.9. The canonical height function ĥ : E(ℚ) → ℝ satisfies the parallelogram law:

ĥ(P + Q) + ĥ(P − Q) = 2ĥ(P) + 2ĥ(Q).

Proof. On taking logs in the previous lemma, we find that

h(P + Q) + h(P − Q) ≤ 2h(P) + 2h(Q) + B.

On replacing P and Q with 2^{n}P and 2^{n}Q, dividing through by 4^{n}, and letting n → ∞, we obtain the inequality

ĥ(P + Q) + ĥ(P − Q) ≤ 2ĥ(P) + 2ĥ(Q).

Putting P′ = P + Q and Q′ = P − Q in this gives the reverse inequality:

ĥ(P′) + ĥ(Q′) ≤ 2ĥ (\frac{P′ + Q′}{2} ) + 2ĥ (\frac{P′ − Q′}{2} ) = \frac{1}{2}ĥ(P′ + Q′) + \frac{1}{2}ĥ(P′ − Q′).

Aside 15.10 (For the experts). Let K be a number field. For each prime v of K, let | · |_{v} be the normalized valuation, for which the product formula holds:

∏_{v} |a|_{v} = 1, a ∈ K^{×}.

Define the height of a point P = (a_{0} : a_{1} : …: a_{n}) ∈ ℙ^{n}(K) to be

H(P) = ∏_{v} max_{i}(|a_{i}|_{v}).

Because of the product formula, H(P) doesn’t depend on the choice of (a_{0} : …: a_{n}) representing P. When K = ℚ, we can choose the a_{i} to be integers with no common factor, which makes max_{i} |a_{i}|_{p} = 1 for all p, and leaves H(P) = max_{i} |a_{i}|_{∞}.

With this definition, all the above results extend to elliptic curves over number fields.

16. Completion of the Proof of the Mordell-Weil Theorem, and Further Remarks

Let P_{1}, …, P_{s} be a set of representatives for E(ℚ)/2E(ℚ). For any Q ∈ E(ℚ) there exists an i such that Q ± P_{i} ∈ 2E(ℚ) for both choices of signs. According to the parallelogram law,

h(Q ± P_{i}) ≤ h(Q) + h(P_{i})

for (at least) one choice of signs. For that choice, let Q ± P_{i} = 2Q′. Then

4h(Q′) = h(Q ± P_{i}) ≤ h(Q) + h(P_{i}) ≤ h(Q) + C

where C = max h(P_{i}). Hence h(Q′) < \frac{1}{2}h(Q) provided h(Q) > C. Now the argument sketched in Section 11 shows that E(ℚ) is generated by P_{1}, …, P_{s} and the Q with h(Q) ≤ C.

The Problem of Computing the Rank of E(ℚ). According to André Weil, one of the two oldest outstanding problems in mathematics is that of determining the group E(ℚ). We know that E(ℚ) is finitely generated, say E(ℚ) ≈ E(ℚ)_{tors} ⊕ ℤ^{r}, and the problem is to find an algorithm for determining r, or better, for finding a set of generators for E(ℚ)/E(ℚ)_{tors}. Since we know how to compute E(ℚ)_{tors}, this amounts to being able to find a basis for E(ℚ)/2E(ℚ). We can regard S^{(2)}(E/ℚ) as giving a computable upper bound for r, with TS(E/ℚ)_{2} as the error. The problem is to determine the image of E(ℚ) in S^{(2)}(ℚ).

Consider the following commutative diagram:

0 → E(ℚ)/2E(ℚ) → S^{(2)}(E/ℚ) → TS(E/ℚ)_{2} → 0
↑ ↑ ↑ 2
0 → E(ℚ)/4E(ℚ) → S^{(4)}(E/ℚ) → TS(E/ℚ)_{4} → 0
↑  ↑  ↑ 2
⋮  ⋮  ⋮
↑  ↑  ↑ 2
0 → E(ℚ)/2^{n}E(ℚ) → S^{(2^{n})}(E/ℚ) → TS(E/ℚ)_{2^{n}} → 0.

Define S^{(2,n)}(E/ℚ) to be the image of S^{(2^{n})}(E/ℚ) in S^{(2)}(E/ℚ).

Proposition 16.1. The group

E(ℚ)/2E(ℚ) ⊂ ∩_{n}S^{(2,n)}(E/ℚ),

and is equal to it if and only if TS(E/ℚ) contains no nonzero element divisible by all powers of 2, in which case S^{(2,n)}(E/ℚ) is constant for sufficiently large n.

Proof. Clearly the image of E(ℚ)/2^{n}E(ℚ) in S^{(2)}(E/ℚ) is independent of n, and is contained in S^{(2,n)}(E/ℚ) for all n. Conversely, let γ ∈ ∩S^{(2,n)}(E/ℚ). By definition, there is, for each n, an element γ_{n} ∈ S^{(2^{n})} mapping γ. Let δ_{n} be the image of γ_{n} in TS(E/ℚ)_{2^{n}}. Then 2^{n−1}δ_{n} = δ_{1} for all n, and so δ_{1} is divisible by all powers of 2. If TS(E/ℚ) contains no such element other than zero, then γ is in the image of E(ℚ)/2E(ℚ). It is not difficult to show that, in this case, the 2-primary component of TS(E/ℚ) is finite (using that TS(E/ℚ)_{2} is finite), and the map S^{(2^{n+1})}(ℚ) → S^{(2^{n})}(ℚ) is onto if TS(E/ℚ)_{2^{n}} = 0.

This gives a strategy for computing r. Calculate S^{(2)}, and then leave your computer running overnight searching for points in E(ℚ). If the subgroup T (1) of E(ℚ) generated by the points the computer has found maps onto S^{(2)} we have found r, and even a set of generators for E(ℚ). If not, calculate S^{(2^{2})}, and have the computer run overnight again finding a bigger group T (2) ⊂ E(ℚ). If the image of T (2) in S^{(2)} is S^{(2,2)}, then we have found r. If not, we compute S^{(2^{3})} . . ..

Nightmare possibility: The Tate-Shafarevich group contains a nonzero element divisible by all powers of 2, in which case the calculation goes on for all eternity. This would happen, for example, if TS(E/ℚ) contains a copy of ℚ/ℤ.

Conjecture 16.2. The Tate-Shafarevich group is always finite.

When the conjecture is true, then the above argument shows that we have an algorithm for computing E(ℚ).

Until the work of Rubin and Kolyvagin about 1987, the Tate-Shafarevich group was not known to be finite for a single elliptic curve over a number field, and the conjecture is still far from being proved in that case. For an elliptic curve E over a function field K in one variable over a finite field k, I proved that TS(E/K) is finite when j(E) ∈ k in my thesis (1967). Later (1975) I showed that the curve

E(j) : Y^{2}Z = X^{3} − \frac{27}{4} \frac{j}{j − 1728}XZ^{2} − \frac{27}{4} \frac{j}{j − 1728}Z^{3}

over the field K = 𝔽_{p}(j) has finite Tate-Shafarevich group. Not much more is known now.

The Néron-Tate Pairing. We saw in Section 15, that there is a canonical ℤ-bilinear pairing

B : E(ℚ) × E(ℚ) → ℝ, B(x, y) = ĥ(x + y) − ĥ(x) − ĥ(y).

This pairing extends uniquely to an ℝ-bilinear pairing

B : E(ℚ) ⊗ ℝ × E(ℚ) ⊗ ℝ → ℝ.

If we choose a ℤ-basis e_{1}, …, e_{r} for E(ℚ)/E(ℚ)_{tors}, then E(ℚ) ⊗ ℝ has ℝ-basis (e_{1} ⊗ 1, …, e_{r} ⊗ 1) with respect to which B has matrix

(B(e_{i}, e_{j}))

Theorem 16.3. The bilinear pairing

E(ℚ) ⊗ ℝ × E(ℚ) ⊗ ℝ → ℝ

defined by ĥ is positive definite (and, in particular, nondegenerate).

This follows from what we have proved already, plus the following result from linear algebra. By a lattice in a real vector space, I mean a ℤ-submodule generated by a basis for V (sometimes this called a full, or complete, lattice).

Lemma 16.4. Let q : V → ℝ be a quadratic form on a finite-dimensional real vector space V. If there exists a lattice Λ in V such that

(a) q(P) = 0, P ∈ Λ, ⟹ P = 0,

(b) for every constant C, the set {P ∈ Λ | q(P) ≤ C} is finite,

then q is positive definite on V.

Proof. According to Sylvester’s theorem (see Math 593), there exists a basis for V relative to which q takes the form

q(x) = x_{1}^{2} + ⋯ + x_{s}^{2} − x_{s+1}^{2} − ⋯ − x_{t}^{2}, t ≤ dim V.

Use the basis to identify V with ℝ^{n}. Let λ be the length of the shortest vector in Λ, i.e.,

λ = inf{q(P) | P ∈ Λ, P ≠ 0}.

From (b) we know that λ > 0. Consider the set

B(δ) = \{(x_{i}) | x_{1}^{2} + ⋯ + x_{s}^{2} ≤ \frac{λ}{2}, x_{s+1}^{2} + ⋯ + x_{t}^{2} ≤ δ\}.

The length (using q) of any vector in B(δ) is ≤ λ/2, and so B(δ) ∩ Λ = {0}, but the volume of B(δ) can be made arbitrarily large by taking δ large, and so this violates the following theorem of Minkowski.

Theorem 16.5 (Minkowski). Let Λ be a lattice in ℝ^{n} with fundamental parallelopiped D_{0}, and let B be a subset of ℝ^{n} that is compact, convex, and symmetric in the origin. If

Vol(B) ≥ 2^{n} Vol(D)

then B contains a point of Λ other than the origin.

Proof. We first show that a measurable set S in ℝ^{n} with Vol(S) > Vol(D_{0}) contains distinct points α, β such that α − β ∈ Λ. Clearly

Vol(S) = ∑ Vol(S ∩ D)

where the sum is over all the translates of D by elements of Λ. The fundamental parallelopiped D_{0} will contain a unique translate (by an element of Λ) of each set S ∩ D. Since Vol(S) > Vol(D_{0}), at least two of these sets will overlap, and so there exist elements α, β ∈ S such that

α − λ = β − λ′, some λ ≠ λ′ ∈ Λ.

Then α − β = λ − λ′ ∈ Λ \ {0}.

We apply this to \frac{1}{2}B =_{df} \{\frac{x}{2} | x ∈ B\}. It has volume \frac{1}{2^{n}} Vol(B) > Vol(D_{0}), and so there exist α, β ∈ B, α ≠ β, such that α/2 − β/2 ∈ Λ. Because B is symmetric about the origin, −β ∈ B, and because it is convex, (α + (−β))/2 ∈ B.

Remark 16.6. Systems consisting of a real vector space V, a lattice Λ in V, and a positivedefinite quadratic form q on V are of great interest in mathematics. By Sylvester’s theorem, we can choose a basis for V that identifies (V, q) with (ℝ^{n}, X_{1}^{2} + ⋯ + X_{n}^{2}). Finding a dense sphere (lattice) packing in ℝ^{n} amounts to finding a lattice Λ such that

\frac{∥shortest vector∥^{n}}{Vol(fundamental parallelopiped)}

is large. Many lattices, for example, the Leech lattice, have very interesting automorphism groups. See Conway and Sloane, Sphere Packings, Lattices and Groups.

From an elliptic curve E over ℚ, one obtains such a system, namely, V = E(ℚ) ⊗ ℝ, Λ = E(ℚ)/E(ℚ)_{tors}, q = ĥ. As far as I know, they aren’t interesting—at present no elliptic curve is known with rank(E(ℚ)) > 19. However, for elliptic curves over function fields in one variable over a finite field, Elkies, Shioda, Dummigan, and others have shown that one gets (infinite families of) very interesting lattices.

Computing the rank. Computing the rank r of E(ℚ) can be difficult (perhaps impossible), but occasionally it is straightforward. In order to avoid the problem of having to work with a number field L other than ℚ, we assume that the elliptic curve has all its points of order 2 rational over ℚ:

E : Y^{2}Z = (X − αZ)(X − βZ)(X − γZ), α, β, γ distinct integers.

The discriminant of (X − α)(X − β)(X − γ) is

Δ = (α − β)^{2}(β − γ)^{2}(γ − α)^{2}.

Proposition 16.7. The rank r of E(ℚ) satisfies the inequality

r ≤ 2 × #{p | p divides 2Δ}.

Proof. Since E(ℚ) ≈ T ⊕ ℤ^{r}, T = E(ℚ)_{tors}, we have E(ℚ)/2E(ℚ) ≈ T/2T ⊕ (ℤ/2ℤ)^{r}. Because T is finite, the kernel and cokernel of T ⟶^{2} T have the same order, and so T/2T ≈ (ℤ/2ℤ)^{2}. Theorem provides us with an injection E(ℚ)/2E(ℚ) ↪ (ℚ^{×}/ℚ^{×2})^{2}, and the image is contained in the product of the subgroups of ℚ^{×}/ℚ^{×2} generated by −1 and the primes where E has bad reduction, namely, those dividing 2Δ.

It is possible to improve this estimate. Let T_{1} be the set of prime numbers dividing Δ for which the reduction is nodal, and let T_{2} be the set of prime numbers dividing Δ for which the reduction is cuspidal. Thus T_{1} comprises the prime numbers modulo which two of the roots of

(X − α)(X − β)(X − γ)

coincide, and T_{2} comprises those modulo which all three coincide. Let t_{1} and t_{2} respectively be the numbers of elements of T_{1} and T_{2}.

Proposition 16.8. The rank r of E(ℚ) satisfies r ≤ t_{1} + 2t_{2} − 1.

Proof. Define φ_{α} : E(ℚ)/2E(ℚ) → ℚ^{×}/ℚ^{×2} as in (14.7):

φ_{α}((x : y : z)) = \{ \begin{matrix}(\frac{x}{z} − α)ℚ^{×2} & z ≠ 0, x ≠ αz; \\ (α − β)(α − γ)ℚ^{×} & z ≠ 0, x = αz \\ ℚ^{×} & (x : y : z) = (0 : 1 : 0). \end{matrix}

Define φ_{β} similarly—the map

P ↦ (φ_{α}(P), φ_{β}(P)) : E(ℚ)/2E(ℚ) → (ℚ^{×}/ℚ^{×2})^{2}

is injective. For each prime p, let φ_{p}(P) be the element of (ℤ/2ℤ)^{2} whose components are

ord_{p}(φ_{α}(P)) mod 2, and ord_{p}(φ_{β}(P)) mod 2

and let φ_{∞}(P) be the element of {±}^{2} whose components are

sign(φ_{α}(P)), and sign(φ_{β}(P)).

The proposition is proved by showing:

(a) if p does not divide Δ, then φ_{p}(P) = 0 for all P;

(b) if p ∈ T_{1}, then φ_{p}(P) is contained in the diagonal of 𝔽_{2}^{2} for all P;

(c) when α, β, γ are ordered so that α < β < γ, φ_{∞}(P) equals (+, +) or (+, −).

Except for p = 2, (a) was proved in the paragraph preceding (14.7).

We prove (b) in the case α ≡ β mod p and P = (x : y : 1), x ≠ α, β, γ. Let

a = ord_{p}(x − α), b = ord_{p}(x − β), c = ord_{p}(x − γ).

Because

(x − α)(x − β)(x − γ)

is a square, a + b + c ≡ 0 mod 2.

If a < 0, then (because α ∈ ℤ) p^{−a} occurs as a factor of the denominator of x (in its lowest terms), and it follows that b = a = c. Since a + b + c ≡ 0 mod 2, this implies that a ≡ b ≡ c ≡ 0 mod 2, and so φ_{p}(P) = 0. The same argument applies if b < 0 or c < 0.

If a > 0, then p divides the numerator of x − α. Because p doesn’t divide (α − γ), it doesn’t divide (α − γ) + (x − α) = (x − γ), and so c = 0. Now a + b ≡ 0 mod 2 implies that φ_{p}(P) lies in the diagonal of 𝔽_{2}^{2}. A similar argument applies if b > 0 or c > 0.

The remaining cases of (b) are proved similarly.

We prove (c). Let P = (x : y : 1), x ≠ α, β, γ. We may suppose that α < β < γ, so that (x − α) > (x − β) > (x − γ). Then φ_{∞}(P) = (+, +), (+, −), or (−, −). However, because

(x − α)(x − β)(x − γ)

is a square in ℚ, the pair (−, −) is impossible. The cases x = α etc. are equally easy.

Example 16.9. The curve

E : Y^{2}Z = X^{3} − XZ^{2}

is of the above form with (α, β, γ) = (−1, 0, 1). The only bad prime is 2, and here the reduction is nodal. Therefore r = 0, and E has no point of infinite order:

E(ℚ) ≈ (ℤ/2ℤ)^{2}.

Exercise 16.10. Hand in one of the following two problems (those who know the quadratic reciprocity law should do (2)).

(1) Show that E(ℚ) is finite if E has equation

Y^{2}Z = X^{3} − 4XZ^{2}.

Hint: Let P be a point of infinite order in E(ℚ), and show that, after possibly replacing P with P + Q where 2Q = 0, φ_{2}(P) is zero. Then show that φ_{∞}(P) = (+, +)—contradiction.

(2) Let E be the elliptic curve

Y^{2}Z = X^{3} − p^{2}XZ^{2}

where p is an odd prime. Show that the rank r of E(ℚ) satisfies:

r ≤ 2  if p ≡ 1 mod 8
r = 0  if p ≡ 3 mod 8
r ≤ 1  otherwise.

Hint: Let P be a point of infinite order in E(ℚ), and show that, after possibly replacing P with P + Q where 2Q = 0, φ_{p}(P) is zero.

Note: These are fairly standard examples. You should do them without looking them up in a book.

17. Geometric Interpretation of the Cohomology Groups; Jacobians

For simplicity throughout this section we take k to be a perfect field, for example, a field of characteristic zero or a finite field. Everything still holds when k is not perfect except that then the algebraic closure k^{al} of k must be replaced with its separable algebraic closure (the union of all subfields of k^{al} finite and separable over k).

For any elliptic curve E over a field k, we have an exact sequence of cohomology groups:

0 → E(k)/nE(k) → H^{1}(k, E_{n}) → H^{1}(k, E)_{n} → 0.

Here H^{1}(k, E_{n}) and H^{1}(k, E) are defined to be the groups of crossed homomorphisms from Gal(k^{al}/k) to E(k^{al})_{n} and E(k^{al}) respectively, modulo the principal crossed homomorphisms. In this section, we shall give a geometric interpretation of these groups, and hence also of the Selmer and Tate-Shafarevich groups. We shall attach to any curve W of genus 1 over k, possibly without a point with coordinates in k, an elliptic curve E, called its Jacobian. The Tate-Shafarevich group of an elliptic curve E classifies the curves of genus 1 over k for which the Hasse principle fails, i.e., such that the curve has a point in ℚ_{p} for all p and in ℝ, but which doesn’t have a point in ℚ.

In general, H^{1}(k,?) classifies objects over k that become isomorphic over k^{al} to a fixed object with automorphism group ?. We shall see several examples of this.

Principal homogeneous spaces (of sets). Let A be an abelian group. A right A-set

(w, a) ↦ w + a : W × A → W

is called a principal homogeneous space for A if W ≠ ∅ and the map

(w, a) ↦ (w, w + a) : W × A → W × W

is bijective, i.e., if for every pair w_{1}, w_{2} ∈ W, there is a unique a ∈ A such that w_{1} + a = w_{2}.

Example 17.1. (a) Addition A × A → A makes A into a principal homogeneous space for A, called the trivial principal homogeneous space.

(b) An affine space (for example, the universe according to Newton) is (by definition) a principal homogeneous space for a vector space—essentially, it is a vector space without a preferred origin.

A morphism φ : W → W′ of principal homogeneous spaces is simply a map A-sets.

Proposition 17.2. Let W and W′ be principal homogeneous spaces for A.

(a) For any points w_{0} ∈ W, w′_{0} ∈ W′, there exists a unique morphism φ : W → W′ sending w_{0} to w′_{0}.

(b) Every morphism W → W′ is an isomorphism (i.e., has an inverse that is also a morphism).

Proof. (a) Uniqueness: Any w ∈ W can be written uniquely in the form w = w_{0} + a, a ∈ A, and then φ(w) = w′_{0} + a. Existence: This formula defines a morphism.

(b) If φ maps w_{0} to w′_{0}, then the unique morphism W′ → W sending w′_{0} to w_{0} is an inverse to φ.

Corollary 17.3. (a) Let W be a principal homogeneous space over A. For any point w_{0} ∈ W, there is a unique morphism A → W (of principal homogeneous spaces) sending 0 to w_{0}.

(b) An a ∈ A defines an automorphism w ↦ w + a of W, and every automorphism of W is of this form for a unique a ∈ A.

Hence

Aut(W) = A;

—for any abelian group A, we have defined a class of objects having A as their groups of automorphisms.

Principal homogeneous spaces (of curves). Let E be an elliptic curve over a field k. A principal homogeneous space for E is a curve W over k together with a right action of E given by a regular ^{20} map

(w, P) ↦ w + P : W × E → W

such that

(w, P) ↦ (w, w + P) : W × E → W × W

is an isomorphism of algebraic varieties. The conditions imply that, for any field K ⊃ k, W (K) is either empty or is a principal homogeneous space for the group E(K) (in the sense of the previous subsection). A morphism of principal homogeneous spaces for E is a regular map φ : W → W′ such that

W × E → W
↓  ↓
W′ × E → W′

commutes. Much of the theory in the previous subsection extends to principal homogeneous spaces for elliptic curves:

Addition E × E → E makes E into a principal homogeneous space for E—any principal homogeneous space isomorphic to this principal homogeneous space is said to be trivial.

Let W and W′ be principal homogeneous spaces for E. For any field K ⊃ k and any points w_{0} ∈ W (K), w′_{0} ∈ W′(K), there exists a unique morphism φ : W → W′ over K sending w_{0} to w′_{0}, and φ is automatically an isomorphism of principal homogeneous spaces over K.

Let W be a principal homogeneous space for E. For any point w_{0} ∈ W (k), there is a unique homomorphism E → W (of principal homogeneous spaces) sending 0 to w_{0}. Thus W is trivial if and only if W (k) ≠ ∅. Since W will have a point with coordinates in some finite extension K of k (this follows from the Hilbert Nullstellensatz), it becomes trivial over such a K.

A point P ∈ E(K) defines an automorphism w ↦ w + P of W, and every automorphism of W over K is of this form for a unique P ∈ E(K).

The classification of principal homogeneous spaces. Let W be a principal homogeneous space for E, and choose a point w_{0} ∈ W (k^{al}). For any σ ∈ Gal(k^{al}/k), σw_{0} ∈ W (k^{al}), and so can be expressed σw_{0} = w_{0} + f(σ) for a unique f(σ) ∈ E(k^{al}). Note that

(στ)w_{0} = σ(τw_{0}) = σ(w_{0} + f(τ)) = σw_{0} + σf(τ) = w_{0} + f(σ) + σf(τ),

and so

f(στ) = f(σ) + σf(τ).

Thus f is a crossed homomorphism Gal(k^{al}/k) → E(k^{al}). Because w_{0} has coordinates in a finite extension of k, f is continuous. A second point w_{1} ∈ W (k^{al}) will define a second crossed homomorphism f_{1}, but w_{1} = w_{0} + P for some P ∈ E(ℚ^{al}), and so

σw_{1} = σ(w_{0} + P) = σw_{0} + σP = w_{0} + f(σ) + σP = w_{1} + f(σ) + σP − P.

Hence

f_{1}(σ) = f(σ) + σP − P,

20That is, one defined by polynomials.

i.e., f and f′ differ by a principal crossed homomorphism, and so we have attached a welldefined cohomology class to W.

If the cohomology class is zero, then f(σ) = σP − P for some P ∈ E(k^{al}), and

σ(w_{0} − P) = σw_{0} − σP = w_{0} + σP − P − σP = w_{0} − P.

This implies that w_{0} − P ∈ W (k), and so W is a trivial principal homogeneous space.

Theorem 17.4. The map W ↦ [f] defines a one-to-one correspondence

{Principal homogeneous spaces for E}/≈ ⟷^{1:1} H^{1}(k, E).

Proof. Let φ : W → W′ be an isomorphism of principal homogeneous spaces for E (over k), and let w_{0} ∈ W (k^{al}). One checks immediately that (W, w_{0}) and (W′, φ(w_{0})) define the same crossed homomorphism, and hence the map

{Principal homogeneous spaces for E}/≈ ⟶ H^{1}(k, E)

is well-defined. If W and W′ define the same cohomology class, we can choose w_{0} and w′_{0} so that (W, w_{0}) and (W′, w′_{0}) define the same crossed homomorphism. There is a unique regular map φ : W → W′ over k^{al} sending w_{0} to w′_{0}. Let w ∈ W (k^{al}), and write w = w_{0} + P. Then

φ(σw) = φ(σ(w_{0}+P)) = φ(σw_{0}+σP) = φ(w_{0}+f(σ)+σP) = w′_{0}+f(σ)+σP = σw′_{0}+σP = σφ(w),

which implies that the map φ is defined over k (i.e., it is defined by polynomials with coordinates in k rather than k^{al}). Hence the map is one-to-one. We discuss the surjectivity in the next subsubsection.

Defining algebraic curves over subfields of algebraically closed fields. Two plane affine curves C_{1} and C_{2} over k may become isomorphic over k^{al} without being isomorphic over k. The simplest example is the pair of curves

X^{2} + Y^{2} = 1, X^{2} + Y^{2} = −1,

which are not isomorphic over ℝ (one has no real points) but which become isomorphic over ℂ.

From an affine curve C over k, we obtain an affine curve C′ over k^{al} together with an action of Gal(k^{al}/k) on C(k^{al}).

Proposition 17.5. The functor sending a plane affine curve C over k to C′ endowed with the action of Gal(k^{al}/k) on C′(k^{al}) is fully faithful, i.e., to give a regular map C_{1} → C_{2} of curves over k is the same as to give a regular map C′_{1} → C′_{2} commuting with the Galois actions.

We explain the statement. Suppose C_{1} and C_{2} are defined by the polynomials F_{1}(X, Y), F_{2}(X, Y) ∈ k[X, Y]. The curves C′_{1} and C′_{2} are defined by the same polynomials now regarded as elements of k^{al}[X, Y].

By definition, a regular map φ : C_{1} → C_{2} is of the form

(x, y) ↦ (G(x, y), H(x, y)), G(x, y), H(x, y) ∈ k[C_{1}] =_{df} k[X, Y]/(F_{1}(X, Y)).

A regular map φ : C′_{1} → C′_{2} is of the form

(x, y) ↦ (G(x, y), H(x, y)), G(x, y), H(x, y) ∈ k^{al}[C′_{1}] =_{df} k^{al}[X, Y]/(F_{1}(X, Y)).

To say that φ commutes with the Galois actions means that, for all P ∈ C′_{1}(k^{al}) and all σ ∈ Gal(k^{al}/k), φ(σP) = σφ(P), i.e., σ ∘ φ ∘ σ^{−1} = φ. But σ ∘ φ ∘ σ^{−1} is defined by ^{σ}G,^{σ}H where ^{σ}G and ^{σ}H are obtained from G and H by applying σ to their coefficients. Therefore, if σ ∘ φ ∘ σ^{−1} = φ for all σ, then G, H ∈ k^{al}[C′_{1}]^{Gal(k^{al}/k)} = k[C_{1}].

It follows from the proposition that if a curve C′ endowed with an action of the Galois group on C′(k^{al}) arises from a curve C over k, then C is unique (up to a unique isomorphism). We can ask: when does such a pair (C′, action) arise from a curve C over k? A necessary and sufficient condition is the following:

(a) the orbits of Gal(k^{al}/k) acting on C′(k^{al}) are finite; and

(b) denote the given action of σ ∈ Gal(k^{al}/k) on P ∈ C′(k^{al}) by σ ∗ P; let ^{σ}C′ be the curve obtained from C′ by applying σ to the coefficients of the polynomial defining C′, and let P ↦ σP : C′(k^{al}) → ^{σ}C′(k^{al}) be the map (x, y) → (σx, σy); then the map σ ∗ P ↦ σP : C′(k^{al}) →^{σ} C′(k^{al}) should be regular.

Similar remarks apply to plane projective curves.

Geometric Interpretation of H^{1}(ℚ, E_{n}). We now give a geometric interpretation of H^{1}(k, E_{n}). An n-covering is a pair (W, α) consisting of a principal homogeneous space W for E and a regular map α : W → E (defined over k) with the property: for some w_{1} ∈ W (k^{al}), α(w_{1} + P) = nP for all P ∈ E(k^{al}). A morphism (W, α) → (W′, α′) (automatically an isomorphism) of n-coverings is a morphism φ : W → W′ of principal homogeneous spaces such that α = α′ ∘ φ.

For σ ∈ Gal(k^{al}/k), write σw_{1} = w_{1} + f(σ), f(σ) ∈ E(k^{al}). As before, f(στ) = f(σ) + σf(τ). The equation σα(w_{1}) = α(σw_{1}) implies that nf(σ) = 0, and so f is a crossed homomorphism with values in E_{n}(k^{al}). The element w_{1} ∈ W (k^{al}) is uniquely determined by the property “α(w_{1} + P) = nP for all P ” up to replacement by w_{1} + Q, Q ∈ E_{n}(k^{al}). It follows easily that the class of f in H^{1}(k, E_{n}) is independent of the choice of w_{1}.

Theorem 17.6. The map (W, α) ↦ [f] defines a bijection

{n-coverings}/≈ ⟷^{1:1} H^{1}(k, E_{n}).

Proof. The proof is similar to that of Theorem 17.4.

Geometric Interpretation of the Exact Sequence. We now give a geometric description of the exact sequence:

0 → E(k)/nE(k) → H^{1}(k, E_{n}) → H^{1}(k, E)_{n} → 0.

If γ ∈ H^{1}(k, E_{n}) corresponds to the n-covering (W, α), then the image of γ in H^{1}(k, E) corresponds to W. If W is trivial, so that there exists a w_{0} ∈ W (k), then γ is the image of the point α(w_{0}) ∈ E(k). If w′_{0} also ∈ W (k), then w′_{0} = w_{0} + P for some P ∈ E(k), and α(w′_{0}) = α(w_{0}) + nP, and so α(w_{0}) is well-defined as an element of E(k)/nE(k).

Twists of Elliptic Curves. In this subsection we study the following problem: given an elliptic curve E_{0} over k, find all elliptic curves E over k that become isomorphic to E_{0} over k^{al}. Such a curve E is often called a “twist” of E_{0}. Remember than an elliptic curve E over k has a distinguished point O ∈ E(k). Throughout, I assume that the characteristic of k is ≠ 2, 3.

Example 17.7. Consider an elliptic curve

E_{1} : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ k, Δ = 4a^{3} + 27b^{2} ≠ 0

over k. For any d ∈ k^{×},

E_{d} : dY^{2}Z = X^{3} + aXZ^{2} + bZ^{3},

is an elliptic curve over k that becomes isomorphic to E_{1} over k^{al}. Indeed, after making the change of variables dZ ↔ Z, the equation becomes

Y^{2}Z = X^{3} + \frac{a}{d^{2}} XZ^{2} + \frac{b}{d^{3}} Z^{3},

and so E_{d} becomes isomorphic to E_{1} over any field in which d is a square.

We first compute Aut(E, 0), the group of automorphisms of E fixing the zero element. According to Theorem 5.3, two elliptic curves

E(a, b) : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ k, Δ(a, b) ≠ 0
E(a′, b′) : Y^{2}Z = X^{3} + a′XZ^{2} + b′Z^{3}, a′, b′ ∈ k, Δ(a′, b′) ≠ 0

are isomorphic if and only if there exists a c ∈ k^{×} such that a′ = c^{4}a, b′ = c^{6}b, in which case the isomorphisms are of the form

(x : y : z) ↦ (c^{2}x : c^{3}y : z).

Since these maps not only send O to O′, but also map straight lines in ℙ^{2} to straight lines, they are homomorphisms. We apply this to the case: (a′, b′) = (a, b).

Case ab ≠ 0: Here we seek c ∈ k^{×} such that c^{4} = 1 = c^{6}. These equations imply that c = ±1, and so the only automorphism of (E, O) other than the identity map is

(x : y : z) ↦ (x : −y : z).

Case a = 0: Here c can be any 6th root ζ of 1 in k, and the automorphisms of (E, O) are the maps

(x : y : z) ↦ (ζ^{2i}x : ζ^{3i}y : z).

Case b = 0: Here c can be any 4th root ζ of 1 in k, and the automorphisms of (E, O) are the maps

(x : y : z) ↦ (ζ^{2i}x : ζ^{3i}y : z).

Proposition 17.8. The automorphism group of (E, O) is ≈ {±1} unless j(E) = 0 or 1728, in which cases it is ≈ μ_{6}(k) or ≈ μ_{4}(k) respectively.

Remark 17.9. (a) Notice that the proposition is consistent with Proposition 10.22, which says that (over ℂ), End(E) is isomorphic to ℤ or to a subring of the ring of integers in a field ℚ[\sqrt{−d}]. The only units in such rings are roots of 1, and only ℚ[\sqrt{−1}] and ℚ[\sqrt{−3}] contain roots of 1 other than ±1.

(b) When we allow k to have characteristic 2 or 3, then it is still true that Aut(E, O) = {±1} when j(E) ≠ 0, 1728, but when j = 0 or 1728 the group of automorphisms of (E, O) can have as many as 24 elements.

Fix an elliptic curve E_{0} over k, and let E be an elliptic curve over k that becomes isomorphic to E_{0} over k^{al}. Choose an isomorphism φ : E_{0} → E over k^{al}. For any σ ∈ Gal(k^{al}/k), we obtain a second isomorphism σφ =_{df} σ ∘ φ ∘ σ^{−1} : E_{0} → E over k^{al}. For example, if φ is (x : y : z) ↦ (c^{2}x : c^{3}y : z), then σφ is (x : y : z) ↦ ((σc)^{2}x : (σc)^{3}y : z). The two isomorphisms φ, σφ : E_{0} → E (over k^{al}) differ by an automorphism of E_{0} over k^{al}:

σφ = φ ∘ α(σ), α(σ) ∈ Aut_{k^{al}}(E_{0}, O).

Note that

(στ)φ = σ(τφ) = σ(φ ∘ α(τ)) = φ ∘ α(σ) ∘ σα(τ),

and so α is a crossed homomorphism Gal(k^{al}/k) → Aut_{k^{al}}(E_{0}, O). Choosing a different isomorphism φ replaces α(σ) by its composite with a principal crossed homomorphism.

Theorem 17.10. The map E ↦ [α] defines a one-to-one correspondence

{elliptic curves over k, isomorphic to E_{0} over k^{al}}/≈ ⟷^{1:1} H^{1}(Gal(k^{al}/k), Aut_{k^{al}}(E_{0})).

Proof. The proof is similar to that of Theorem 17.4.

Corollary 17.11. If j(E_{0}) ≠ 0, 1728, then the list of twists of E_{0} in Example 17.7 is complete.

Proof. In this case, Aut_{k^{al}}(E, O) = μ_{2}, and so, according to Example 12.7, H^{1}(Gal(k^{al}/k), μ_{2}) = k^{×}/k^{×2}. Under the correspondence in the theorem, E_{d} ↔ d mod k^{×2}.

Remark 17.12. The same arguments can be used to obtain the description of the twisted multiplicative groups on p25. The only endomorphisms of 𝔾_{m} = 𝔸^{1} \ {0} are the maps t ↦ t^{m}, some fixed m ∈ ℤ. Hence End(𝔾_{m}) = ℤ and Aut(𝔾_{m}) = (End(𝔾_{m}))^{×} = {±1}. The twisted forms of 𝔾_{m} are classified by H^{1}(k, {±1}) = H^{1}(k, μ_{2}) = k^{×}/k^{×2}. The twisted multiplicative group corresponding to a ∈ k^{×}/k^{×2} is 𝔾_{m}[a].

Remark 17.13. Let Aut(E) be the group of all automorphisms of E, not necessarily preserving O. The map Q ↦ t_{Q}, where t_{Q} is the translation P ↦ P + Q, identifies E(k) with a subgroup of Aut(E). I claim that Aut(E) is a semi-direct product,

Aut(E) = E(k) ⋊ Aut(E, O),

that is, that

(a) E(k) is a normal subgroup of Aut(E);

(b) E(k) ∩ Aut(E, O) = {0};

(c) Aut(E) = E(k) · Aut(E, O).

Let Q ∈ E(k) and let α ∈ Aut(E, O). As we noted above, α is a homomorphism, and so, for any P ∈ E,

(α ∘ t_{Q} ∘ α^{−1})(P) = α(α^{−1}(P) + Q) = P + α(Q) = t_{α(Q)}(P).

Therefore α ∘ t_{Q} ∘ α^{−1} = t_{α(Q)}, which implies (a). Assertion (b) is obvious. For (c), let γ ∈ Aut(E), and let γ(0) = Q; then γ = t_{Q} ∘ (t_{−Q} ∘ γ), and t_{−Q} ∘ γ ∈ Aut(E, O).

Curves of genus 1. Let W be a principal homogeneous space for an elliptic curve E over k. Then W becomes isomorphic to E over k^{al}, and so W is projective, nonsingular, and of genus 1 (at least over k^{al}, which implies that it is also over k). The next theorem shows that, conversely, every projective nonsingular curve W of genus 1 over k occurs as a principal homogeneous space for some elliptic curve over k.

Theorem 17.14. Let W be a nonsingular projective curve over k of genus 1. Then there exists an elliptic curve E_{0} over k such that W is a principal homogeneous space for E_{0}. Moreover, E_{0} is unique up to an isomorphism (over k).

Proof. (Sketch). By assumption, there exists an isomorphism φ : W → E from W to an elliptic curve E over k^{al}, which we may suppose to be in our standard form

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ k, Δ = 4a^{3} + 27b^{2} ≠ 0.

Let σ ∈ Gal(k^{al}/k). Then σφ is an isomorphism σW → σE. Here σW and σE are obtained from W and E by applying σ to the coefficients of the polynomials defining them (so E = E(σa, σb)). But W is defined by polynomials with coefficients in k, and so σW = W. Therefore E ≈ W ≈ σE, and j(E) = j(σE) = σj(E). Since this is true for all σ ∈ Gal(k^{al}/k), we have that j(E) ∈ k. Now (see bottom of p51) there is a curve E_{0} over k with j(E_{0}) = j(E). In fact, there will be many such curves over k, and so we have to make sure we have the correct one.

Choose an isomorphism φ : E_{0} → W over k^{al}, and for σ ∈ Gal(k^{al}/k), let σφ = φ ∘ α(σ) where α(σ) ∈ Aut_{k^{al}}(E_{0}). Then σ ↦ α(σ) is a crossed homomorphism into Aut_{k^{al}}(E_{0}), and hence defines a class [α] in H^{1}(k, Aut_{k^{al}}(E_{0})). According to (17.13) there is an exact sequence

1 → E_{0}(k^{al}) → Aut_{k^{al}}(E_{0}) → Aut_{k^{al}}(E_{0}, O) → 1.

If [α] lies in the subgroup H^{1}(k, E_{0}) of H^{1}(k, Aut_{k^{al}}(E_{0})), then W is a principal homogeneous space for E_{0}. If not, then we use the image of [α] in H^{1}(k, Aut_{k^{al}}(E_{0})) to twist E_{0} to obtain a second curve E_{1} over k with the same j-invariant. Now one can check that the class of the crossed homomorphism [α] lies in H^{1}(k, E_{1}), and so W is a principal homogeneous space for E_{1}.

The curve E_{0} given by the theorem is called the Jacobian of W. It is characterized by having the following property: there is an isomorphism φ : E_{0} → W over k^{al} such that, for all σ ∈ Gal(k^{al}/k), there exists a point Q_{σ} ∈ E_{0}(k^{al}) such that

(σφ)(P) = φ(P + Q_{σ}), all P ∈ E(k^{al}).

Remark 17.15. In the above proof we spoke of a crossed homomorphism into Aut_{k^{al}}(E_{0}), which need not be an abelian group. However, one can still define H^{1}(G, M) when M is nonabelian as follows. Write M multiplicatively. As in the abelian case, a crossed homomorphism is a map f : G → M such that f(στ) = f(σ)·σf(τ). Call two crossed homomorphisms f and g equivalent if there exists an m ∈ M such that g(σ) = m^{−1} · f(σ) · σm, and let H^{1}(G, M) be the set of equivalence classes of crossed homomorphisms. It is a set with a distinguished element, namely, the map σ ↦ 1.

Exercise 17.16. Find the Jacobian of the curve

W : aX^{3} + bX^{3} + cY^{3} = 0, a, b, c ∈ ℚ^{×}.

[First, by a change of variables over ℚ^{al}, obtain an isomorphism W ≈ E where E is an elliptic curve over ℚ^{al} in standard form. Second, write down an elliptic curve E_{0} over ℚ in standard form that becomes isomorphic to E over ℚ. Third, modify E_{0} if necessary so that it has the property characterizing the Jacobian.]

The classification of elliptic curves over ℚ (summary). Let (E, O) be an elliptic curve over ℚ. We attach to it the invariant j(E) ∈ ℚ. Every element of ℚ occurs as the j-invariant of an elliptic curve over ℚ, and two elliptic curves over ℚ have the same j-invariant if and only if they become isomorphic over ℚ^{al}. See (10.15) et seq..

Fix a j ∈ ℚ, and consider the elliptic curves (E, O) over ℚ with j(E) = j. The isomorphism classes of such curves are in one-to-one correspondence with the elements of H^{1}(ℚ, Aut(E, O)). For example, if j ≠ 0, 1728, then Aut(E, O) = μ_{2}, H^{1}(ℚ, Aut(E, O)) = ℚ^{×}/ℚ^{×2}, and the curve corresponding to d ∈ ℚ^{×} is the curve E_{d} of Example 17.7.

Fix an elliptic curve (E, O) over ℚ, and consider the curves of genus 1 over ℚ having E as their Jacobian. Such a curve has the structure of a principal homogeneous space for E, and every principal homogeneous space for E has E as its Jacobian. The principal homogeneous spaces for E are classified by the group H^{1}(ℚ, E), which is a very large group.

Every curve of genus 1 over ℚ occurs as the Jacobian of an elliptic curve over ℚ, and hence as a principal homogeneous space.

Consider the exact sequence of torsion groups

0 → TS(E/ℚ) → H^{1}(ℚ, E) → ⊕_{p,∞}H^{1}(ℚ_{p}, E) → C → 0.

Endow each group with the discrete topology. Cassels has shown that the Pontryagin dual of this sequence has the form

0 ← TS(E/ℚ) ← Θ ← ∏_{p,∞} H^{1}(ℚ_{p}, E) ← Ê(ℚ) ← 0,

where Ê(ℚ) is the completion of E(ℚ) for the topology for which the subgroups of finite index form a fundamental system of neighbourhoods of 0, provided that TS(E/ℚ) is finite.

Exercise 17.17. Find the Jacobian of the curve

W : aX^{3} + bY^{3} + cZ^{3} = 0, a, b, c ∈ ℚ^{×}.

[Hint: The curve E : X^{3} + Y^{3} + dZ^{3} = 0, d ∈ ℚ^{×}, has the point O : (1 : −1 : 0)—the pair (E, O) is an elliptic curve over ℚ. It can be put in standard form by the change of variables X = X′ + Y′, Y = X′ − Y′.]

18. The Tate-Shafarevich Group; Failure Of The Hasse Principle

We discuss a family of curves whose the Tate-Shafarevich groups are nonzero, and which therefore give examples of elliptic curves for which the Hasse principle fails. Full details on what follows can be found in [S1], pp309–318.

Proposition 18.1. If p ≡ 1 mod 8, then the 2-Selmer group S^{(2)}(E/ℚ) of the elliptic curve

E : Y^{2}Z = X^{3} + pXZ^{2}

is isomorphic to (ℤ/2ℤ)^{3}.

The family of curves in the statement is similar to that in Exercise 16.10(2), but since only one of the points of order 2 on E have coordinates in ℚ, we don’t have a simple description of H^{1}(ℚ, E_{2}). Of course, one can pass to ℚ[\sqrt{p}], but it is easier to proceed as follows. One shows that there is a second curve E′ and homomorphisms

E ⟶^{ϕ} E′ ⟶^{ψ} E

whose composite is multiplication by 2 and such that the kernel of ϕ is the subgroup of E generated by P = (0 : 0 : 1). From the study of the cohomology sequences of

0 →<P> → E(ℚ^{al}) ⟶^{ϕ} E′(ℚ^{al}) → 0

and

0 → Ker ψ → E′(ℚ^{al}) ⟶^{ψ} E(ℚ^{al}) → 0

one can draw information about E(ℚ)/2E(ℚ), S^{(2)}(E/ℚ), TS(E/ℚ)_{2}. For example, Lemma 13.2 applied to the maps

E(ℚ) ⟶^{ϕ} E′(ℚ) ⟶^{ψ} E(ℚ)

shows that there is an exact sequence:

E(ℚ)/ϕ(E(ℚ)) → E(ℚ)/2E(ℚ) → E(ℚ)/ψ(E(ℚ)) → 0.

Since E(ℚ)_{2} ≈ ℤ/2ℤ,

rank(E(ℚ)) + dim_{𝔽_{2}} TS(E/ℚ)_{2} = dim_{𝔽_{2}} S^{(2)}(E/ℚ) − 1.

Thus r = 0, 1, or 2, but r = 1 is conjecturally ruled out: Cassels has shown that TS(E/ℚ) carries a nondegenerate alternating form if it is finite, and the existence of such a form implies that dim_{𝔽_{2}}(TS(E/ℚ)) is even. ^{21}

Proposition 18.2. Let E be as in ( 18.1). If 2 is not a fourth power modulo p, then rank(E(ℚ)) = 0 and TS(E/ℚ)_{2} ≈ (ℤ/2ℤ)^{2}.

Remark 18.3. It is, of course, easy (for a computer) to check for any particular prime whether 2 is a fourth power modulo p, but Gauss found a more efficient test.

From Math 593, we know that the ring of Gaussian integers, ℤ[i], is a principal ideal domain. An odd prime p either remains prime in ℤ[i] or it factors p = (A + iB)(A − iB). In the first case, ℤ[i]/pℤ[i] is an field extension of 𝔽_{p} of degree 2. Therefore p remains prime if and only if 𝔽_{p} doesn’t contain a primitive 4th root of 1. Because 𝔽_{p}^{×} is cyclic, it contains an element of order 4 if and only if 4 divides its order. Therefore the second case occurs if and only if 4|p − 1. We conclude that a prime p ≡ 1 mod 4 can be expressed p = A^{2} + B^{2}, A, B ∈ ℤ.

Gauss showed that for a prime p ≡ 1 mod 8, 2 is a 4th power modulo p if and only if 8|AB. Therefore, p satisfies the hypotheses of the proposition if p is

17 = 1^{2} + 4^{2}, 41 = 5^{2} + 4^{2}, 97 = 9^{2} + 4^{2}, 193 = 7^{2} + 12^{2}...

The proof of this, which is quite elementary, can be found in [S1], p318. Number theorists will wish to prove that there are infinitely many such primes p (and find their density).

21Recall from Math 593 that a vector space carrying a nondegenerate skew-symmetric form has even dimension, provided the field is of characteristic ≠ 2. When the form is assumed to be alternating, i.e., ψ(x, x) = 0 for all x, then the condition on the characteristic is unnecessary.

It is very difficult to show directly that the rank of an elliptic curve is smaller than the bound given by the Selmer group. Instead, in this case, one exhibits 3 nontrivial elements of TS(E/ℚ)_{2}. They are:

Y^{2} = 4pX^{4} − 1, ±Y^{2} = 2pX^{4} − 2.

One can (no doubt) check directly that these three curves are principal homogeneous spaces for E : Y^{2}Z = X^{3} + pZ^{3}, but it can be more easily seen from the proof of Proposition 18.1 ([S1] 6.2b).

Remark 18.4. We should explain what we mean by these curves. Consider, more generally, the curve

C : Y^{2} = aX^{4} + bX^{3} + cX^{2} + dX + e

where the polynomial on the right has no repeated roots. Assume that the characteristic is ≠ 2, 3. Then this is a nonsingular affine curve, but its projective closure

C′ : Y^{2}Z^{2} = aX^{4} + bX^{3}Z + cX^{2}Z^{2} + dXZ^{3} + eZ^{4}

is singular: on setting Y = 1, we obtain the equation

Z^{2} = homogeneous polynomial of degree 4,

which is visibly singular at (0, 0). Recall (p9) that the genus of a plane projective curve of degree d is

g = \frac{(d − 1)(d − 2)}{2} − ∑_{P singular} δ_{P} .

For P = (0, 0), δ_{P} = 2, and so the genus of C′ is 3−2 = 1. When one “blows up” the singular point, one obtains a nonsingular curve and a regular map C′′ → C′ that is an isomorphism except over the singular point. It is really C′′ that one means when one writes C.

We shall prove that the curve

C : Y^{2} = 2 − 2pX^{4}

has no points in ℚ, but has points in ℝ and ℚ_{p} for all p. For this we shall need to use the quadratic reciprocity law. For an integer a not divisible by the prime p, the Legendre symbol (\frac{a}{p}) = +1 or −1 according as a is, or is not, a square modulo p.

Theorem 18.5 (Quadratic reciprocity law). For odd primes p, q,

(\frac{p}{q}) (\frac{q}{p}) = (−1)^{\frac{p−1}{2} \frac{q−1}{2}} .

Moreover,

(\frac{2}{p}) = (−1)^{\frac{p^{2}−1}{8}} .

Proof. The theorem surely has more published proofs than any other in mathematics. The first proofs were found by Gauss. Most introductory books on number theory contain a proof.

Proof. We now prove that

C : Y^{2} = 2 − 2pX^{4}

has no points with coordinates in ℚ. Suppose (x, y) is a point on the curve. Let x = r/t with r and t integers having no common factor. Then

y^{2} = \frac{2t^{4} − 2pr^{4}}{t^{4}} .

The numerator and denominator on the right again have no common factor, and so y = 2s/t^{2} for some integer s with

2s^{2} = t^{4} − pr^{4}.

Let q be an odd prime dividing s. Then t^{4} ≡ pr^{4} mod q, and so (\frac{p}{q}) = 1. According to the

quadratic reciprocity law, this implies that (\frac{q}{p}) = 1. From the quadratic reciprocity law,

(\frac{2}{p}) = 1, and so all prime factors of s are squares modulo p. Hence s^{2} is a 4th power modulo p. The equation

2s^{2} ≡ t^{4} mod p

now shows that 2 is a 4th power modulo p, which contradicts our hypothesis.

We should also make sure that there is no point lurking at infinity. The projective closure of C is

C′ : Y^{2}Z^{2} = 2Z^{4} − 2pX^{4},

and we have just shown that C′ has no rational point with Z = 1. For Z = 0, the equation becomes

2Z^{4} − 2pX^{4} = 0

which clearly has no rational solution. Since the nonsingular version C′′ of C′ maps to C′, it can’t have a rational point either.

The curve C obviously has points in ℝ. In order to prove that C has a point in ℚ_{q} it suffices (by Hensel’s lemma) to show that the reduction C̄ of C modulo the prime q has a nonsingular point with coordinates in 𝔽_{q}. For q ≠ 2, p, the (affine) curve C has good reduction at q, and the results of the next section will show that it has a point with coordinates in 𝔽_{p} (at least for q not too small). Therefore, C automatically has a point with coordinates in ℚ_{q} except for q = 2, p, and perhaps a few additional small primes. The verification for these fields can safely be left to the reader (or the reader’s computer).

19. Elliptic Curves Over Finite Fields

As usual, 𝔽_{p} is the field ℤ/pℤ with p elements, 𝔽 is a fixed algebraic closure of 𝔽_{p}, and 𝔽_{p^{n}} is the (unique) subfield of 𝔽 with p^{n} elements. The elements of 𝔽_{p^{n}} are the roots of X^{p^{n}} −X, and 𝔽_{p^{m}} ⊂ 𝔽_{p^{n}} if and only if m|n (see Math 594).

The Frobenius map; curves of genus 1 over 𝔽_{p}. Let C be a plane projective curve over 𝔽_{p}, so that C is defined by an equation

F (X, Y, Z) = ∑_{i+j+k=d} a_{ijk}X^{i}Y^{j}Z^{k}, a_{ijk} ∈ 𝔽_{p}.

If P = (x : y : z), x, y, z ∈ 𝔽, lies on C, then

∑_{i+j+k=d} a_{ijk}x^{i}y^{j}z^{k} = 0.

On raising this equation to the pth power, remembering that we are in characteristic p and that a^{p} = a for all a ∈ 𝔽_{p}, we obtain the equation

∑_{i+j+k=d} a_{ijk}x^{ip}y^{jp}z^{kp} = 0,

which says that (x^{p} : y^{p} : z^{p}) also lies on C. We therefore obtain a map (x : y : z) ↦ (x^{p} : y^{p} : z^{p}) : C → C, which, being defined by polynomials, is regular. It is called the Frobenius map.

Proposition 19.1. For any elliptic curve E over 𝔽_{p}, H^{1}(𝔽_{p}, E) = 0. Therefore, every principal homogeneous space for E is trivial.

Proof. Let Γ be the Galois group of 𝔽 over 𝔽_{p}. We have to show that every continuous crossed homomorphism f : Γ → E(𝔽) is principal.

We first determine the structure of Γ. The map a ↦ a^{p} is an automorphism of 𝔽, which we call the Frobenius automorphism, and denote σ. As we noted above, for each n ≥ 1, 𝔽_{p} has a unique extension of degree n contained in 𝔽, namely, 𝔽_{p^{n}}. Moreover, 𝔽_{p^{n}}, being the splitting field of X^{p^{n}} − X, is Galois over 𝔽_{p}, and Gal(𝔽_{p^{n}}/𝔽_{p}) is generated by σ|𝔽_{p^{n}}. Therefore, by infinite Galois theory, for each n ≥ 1, Γ has a unique open subgroup Γ_{n} of index n, and Γ/Γ_{n} is generated by σΓ_{n}. It follows that σ has infinite order, and that Γ is the closure of the subgroup generated by σ—we say that σ generates Γ as a topological group. Note that for P = (x : y : z) ∈ E(𝔽), and φ : E → E the Frobenius map,

φ(P) = (x^{p} : y^{p} : z^{p}) = (σx : σy : σz) = σP.

Now consider a crossed homomorphism f : Γ → E(𝔽). The map P ↦ φ(P) − P is a nonconstant regular map E → E; it therefore induces a surjective^{22} map E(𝔽) → E(𝔽). In particular, there exists a P ∈ E(𝔽) such that φ(P)−P = f(σ), i.e., such that f(σ) = σP −P. Then

f(σ^{2}) = f(σ) + σf(σ) = σP − P + σ^{2}P − σP = σ^{2}P − P,
⋯
f(σ^{n}) = f(σ) + σf(σ^{n−1}) = σP − P + σ(σ^{n−1}P − P) = σ^{n}P − P.

Therefore f and the principal crossed homomorphism τ ↦ τP − P agree on σ^{n} for all n. Because both crossed homomorphisms are continuous, this implies that they agree on the whole of Γ.

22Any nonconstant regular map φ : C → C′ from a connected projective curve to an irreducible curve is surjective as a map of algebraic curves (this implies that C(k^{al}) → C′(k^{al}) is surjective, but not necessarily that C(k) → C′(k) is surjective): because C is projective the image of φ is Zariski-closed; because C′ is connected, its only proper Zariski-closed subsets are finite; therefore, φ(C) ≠ C′ ⟹ φ(C) is finite ⟹ φ(C) = a single point (because C is connected) ⟹ φ is constant.

Corollary 19.2. A nonsingular projective curve C of genus 1 over 𝔽_{p} has a point with coordinates in 𝔽_{p}.

Proof. According to (17.14), the curve C is a principal homogeneous space for its Jacobian E, and according to the Proposition, it is a trivial principal homogeneous space, i.e., C(𝔽_{p}) ≠ 0.

I next want to prove the Riemann hypothesis for an elliptic curve, namely, that if N is the number of points on the elliptic curve E with coordinates in 𝔽_{p}, then |N − p − 1| ≤ 2\sqrt{p}. However, first I’ll explain why this statement is called the Riemann hypothesis, which involves reviewing some of the formalism of zeta functions.

Zeta functions of number fields. First recall that the original (Riemann’s) Riemann zeta function is

ζ(s) = ∏_{p prime} \frac{1}{1 − p^{−s}} = ∑_{n≥1} n^{−s}, s complex, ℜ(s) > 1.

The second equality is an expression of unique factorization:

ζ(s) = ∏_{p} \frac{1}{1 − p^{−s}} = ∏_{p} (1 + p^{−s} + (p^{−s})^{2} + (p^{−s})^{3} + ⋯);

on multiplying out this product, we obtain a sum of terms

(p_{1}^{−s})^{r_{1}}(p_{2}^{−s})^{r_{2}} ⋯ (p_{t}^{−s})^{r_{t}} = (p_{1}^{r_{1}} ⋯ p_{t}^{r_{t}})^{−s}.

Both the sum and the product converge for ℜ(s) > 1, and so ζ(s) is holomorphic and nonzero for ℜ(s) > 1. In fact, ζ(s) extends to a meromorphic function on the whole complex plane with a simple pole at s = 0. Moreover, the function ξ(s) = π^{− \frac{s}{2}} Γ(\frac{s}{2})ζ(s) satisfies the functional equation ξ(s) = ξ(1−s), has simple poles at s = 0, 1, and is otherwise holomorphic. Since Γ(s) has poles at s = 0, −1, −2, −3, …, this forces ζ to be zero at s = −2n, n > 0, n ∈ ℤ. These are called the trivial zeros of the zeta function.

Conjecture 19.3 (Riemann hypothesis). The nontrivial zeros of ζ(s) lie on the line ℜ(s) = \frac{1}{2}.

This is perhaps the most famous problem remaining in mathematics.

Dedekind extended Riemann’s definition by attaching a zeta function ζ_{K}(s) to any number field K. He defined

ζ_{K}(s) = ∏_{𝔭} \frac{1}{1 − ℕ(𝔭)^{−s}} = ∑_{𝔞}ℕ(𝔞)^{−s}, s complex, ℜ(s) > 1.

The first product is over the nonzero prime ideals in K, and the second is over all ideals in O_{K}. The numerical norm ℕ𝔞 of an ideal 𝔞 is the order of the quotient ring O_{K}/𝔞. The proof of the second equality uses that every nonzero ideal 𝔞 has a unique factorization 𝔞 = ∏ 𝔭_{i}^{r_{i}} into a product of powers of prime ideals, and that ℕ(𝔞) = ∏ ℕ(𝔭_{i})^{r_{i}}. Note that for K = ℚ, this definition gives back ζ(s). The function ζ_{K}(s) extends to a meromorphic function on the whole complex plane with a simple pole at s = 1. Moreover, a certain multiple ξ_{K}(s) of it satisfies a functional equation ξ_{K}(s) = ξ_{K}(1 − s). It is conjectured that ζ_{K}(s) has its nontrivial zeros on the line ℜ(s) = \frac{1}{2}.

Zeta functions of affine curves over finite fields. Consider a plane affine curve

C : f(X, Y) = 0

over the field 𝔽_{p}. In analogy with the above definition, we set

ζ(C, s) = ∏_{𝔭} \frac{1}{1 − ℕ𝔭^{−s}} , ℜ(s) > 1,

where 𝔭 runs over the nonzero prime ideals in 𝔽_{p}[C] =_{df} 𝔽_{p}[X, Y]/(f(X, Y)) = 𝔽_{p}[x, y]. For any nonzero prime ideal 𝔭 of 𝔽_{p}[C], the quotient 𝔽_{p}[C]/𝔭 is finite, and so we can again define ℕ𝔭 to be its order.

Because 𝔽_{p}[C]/𝔭 is finite and an integral domain, it is a field (and 𝔭 is maximal). We define deg 𝔭 to be the degree of 𝔽_{p}[C]/𝔭 over 𝔽_{p}, so that ℕ𝔭 = p^{deg 𝔭}. This allows us to make a change of variables in the zeta function: when we define

Z(C, T) = ∏_{𝔭} \frac{1}{1 − T^{deg 𝔭}},

then

ζ(C, s) = Z(C, p^{−s}).

Here Z is a capital zeta. The product ∏ \frac{1}{1−T^{deg 𝔭}} converges for all small T, but generally we simply regard it as a formal power series

Z(C, T) = ∏_{𝔭}(1 + T^{deg 𝔭} + T^{2 deg 𝔭} + T^{3 deg 𝔭} + ⋯) ∈ ℤ[[T]].

In the following, I will often make use of the fact that many of the identities in Math 115 involving power series are valid for power series over any ring. For example, we can define log(1 + t) to be the power series

log(1 + t) = t − \frac{t^{2}}{2} + \frac{t^{3}}{3} − \frac{t^{4}}{4} + \frac{t^{5}}{5} − ⋯,

and then

log \frac{1}{1 − t} = − log(1 − t) = t + \frac{t^{2}}{2} + \frac{t^{3}}{3} + \frac{t^{4}}{4} + · · · .

Computation of the zeta function of 𝔸^{1}. To fit it into the above scheme, we can regard 𝔸^{1} as the curve Y = 0, and so

𝔽_{p}[𝔸^{1}] = 𝔽_{p}[X, Y]/(Y) = 𝔽_{p}[X].

The nonzero (prime) ideals on 𝔽_{p}[X] are in one-to-one correspondence with the monic (irreducible) polynomials f(X) ∈ 𝔽_{p}[X], and so

Z(𝔸^{1}, T) = ∏_{f monic irreducible} \frac{1}{1 − T^{deg f}} .

Take the log of both sides,

log Z(𝔸^{1}, T) = − ∑_{f} log(1 − T^{deg f}),

and then the derivatives

\frac{Z′(T)}{Z(T)} = ∑_{f} \frac{deg f · T^{deg f−1}}{1 − T^{deg f}}
= ∑_{n≥0,f} deg f · T^{(n+1) deg f−1}.

In this power series, the coefficient of T^{m−1} is ∑ deg f, where f runs over all monic irreducible polynomials f ∈ 𝔽_{p}[T] of degree dividing m. Note that deg f|m if and only if all of the roots of f lie in 𝔽_{p^{m}}, and that, conversely, every element of 𝔽_{p^{m}} is the root of a polynomial of degree dividing m. Therefore, the coefficient of T^{m−1} is p^{m}, and we have

\frac{Z′(T)}{Z(T)} = ∑ p^{m}T^{m−1}.

On integrating, we find that

log Z(𝔸^{1}, T) = ∑ \frac{p^{m}T^{m}}{m} = log \frac{1}{1 − pT} .

We have shown:

Proposition 19.4. The zeta function of 𝔸^{1} has the property that

log Z(𝔸^{1}, T) = ∑ \frac{#𝔸^{1}(𝔽_{p^{m}})T^{m}}{m}

and so

Z(𝔸^{1}, T) = \frac{1}{1 − pT} .

Expression of Z(C, T) in terms of the points of C. Let C be an affine curve over 𝔽_{p}. As for 𝔸^{1},

\frac{Z′(C, T)}{Z(C, T)} = ∑_{𝔭} \frac{deg 𝔭 · T^{deg 𝔭−1}}{1 − T^{deg 𝔭}}
= ∑_{n≥0,𝔭} deg 𝔭 · T^{(n+1) deg 𝔭}/T.

In this power series, the coefficient of T^{m−1} is ∑ deg 𝔭 where 𝔭 runs over the prime ideals of k[C] such that deg 𝔭 divides m. But deg 𝔭 =_{df} [𝔽_{p}[C]/𝔭 : 𝔽_{p}], and so the condition deg 𝔭|m means that there is a homomorphism 𝔽_{p}[C]/𝔭 ↪ 𝔽_{p^{m}}—there will in fact be exactly deg 𝔭 such homomorphisms (because 𝔽_{p}[C]/𝔭 is separable over 𝔽_{p}). Conversely, any homomorphism 𝔽_{p}[C] → 𝔽_{p^{m}} factors through 𝔽_{p}[C]/𝔭 for some prime ideal with deg 𝔭|m. Therefore, the coefficient of T^{m−1} in the above power series is the number of homomorphisms (of 𝔽_{p}- algebras)

𝔽_{p}[C] → 𝔽_{p^{m}}.

But 𝔽_{p}[C] = 𝔽_{p}[X, Y]/(f(X, Y)), and so a homomorphism 𝔽_{p}[C] → 𝔽_{p^{m}} is determined by the images a, b of X, Y, and conversely the homomorphism P (X, Y) ↦ P (a, b) : 𝔽_{p}[X, Y] → 𝔽_{p^{m}} determined by a pair a, b ∈ 𝔽_{p^{m}} factors through 𝔽_{p}[X, Y]/(f(X, Y)) if and only if f(a, b) = 0. Therefore there is a natural one-to-one correspondence

{homomorphisms 𝔽_{p}[C] → 𝔽_{p^{m}}} ↔^{1:1} C(𝔽_{p^{m}}).

We have proved:

ELLIPTIC CURVES 91

Proposition 19.5. The zeta function of an affine curve C has the property that

log Z(C, T) = ∑ N_{m} \frac{T^{m}}{m} , N_{m} = #C(𝔽_{p^{m}}).

In other words,

Z(C, T) = exp( ∑_{m≥1} N_{m} \frac{T^{m}}{m}),

where

exp T = 1 + T + \frac{T^{2}}{2!} + ⋯ + \frac{T^{n}}{n!} + · · · .

Zeta functions of plane projective curves. For a plane projective curve C (in fact, an arbitrary curve) over 𝔽_{p} one usually defines Z(C, T) to be the power series such that

log Z(C, T) = ∑ N_{m}(C)\frac{T^{m}}{m} , N_{m}(C) = #C(𝔽_{p^{m}}),

and then one defines

ζ(C, s) = Z(C, p^{−s}).

If C = C_{0} ∪ C_{1}, then

N_{m}(C) = N_{m}(C_{0}) + N_{m}(C_{1}) − N_{m}(C_{0} ∩ C_{1}),

and so

ζ(C, s) = \frac{ζ(C_{0}, s)ζ(C_{1}, s)}{ζ(C_{0} ∩ C_{1}, s)}.

Thus, ζ(C, s) can also be expressed as a product of terms \frac{1}{1−ℕ𝔭^{−s}}.

For example,

N_{m}(ℙ^{1}) = N_{m}(𝔸^{1}) + 1, for all m,

and so

log Z(ℙ^{1}, T) = log Z(𝔸^{1}, T) + log \frac{1}{1 − T} .

Therefore

Z(ℙ^{1}, T) = \frac{1}{1 − T} Z(𝔸^{1}, T) = \frac{1}{(1 − T)(1 − pT)}.

Similarly, for E an elliptic curve over 𝔽_{p} and E^{aff} the affine curve E ∩ {Z ≠ 0},

Z(E, T) = \frac{1}{1 − T} Z(E^{aff}, T).

The rationality of the zeta function of an elliptic curve.

Theorem 19.6. Let E be an elliptic curve over 𝔽_{p}. Then

Z(E, T) = \frac{1 + (N_{1} − p − 1)T + pT^{2}}{(1 − T)(1 − pT)} , N_{1} = N_{1}(E).

Remark 19.7. (a) Factor

1 + (N_{1} − p − 1)T + pT^{2} = (1 − αT)(1 − βT),

so that α, β are algebraic integers such that

N_{1} − p − 1 = −α − β, αβ = p.

Then

log Z(E, T) = log \frac{(1 − αT)(1 − βT)}{(1 − T)(1 − pT)} = ∑(1 + p^{m} − α^{m} − β^{m})\frac{T^{m}}{m} ,

and so

N_{m}(E) = 1 + p^{m} − α^{m} − β^{m}.

Thus, if one knows N_{1}, one can find α and β, and the whole of the sequence

N_{1}(E), N_{2}(E), N_{3}(E), ….

(b) With the notation in (a),

ζ(E, s) = \frac{(1 − αp^{−s})(1 − βp^{−s})}{(1 − p^{−s})(1 − p^{1−s})}.

It has simple poles at s = 0 and s = 1, and zeros where p^{s} = α and p^{s} = β. Write s = σ + it. Then |p^{s}| = p^{σ}, and the zeros of ζ(E, s) have real part \frac{1}{2} if and only if α and β have absolute value p^{\frac{1}{2}} .

By definition α and β are the roots of a polynomial

1 + bT + pT^{2}, b = N_{1} − p − 1.

If b^{2} − 4p ≤ 0, then α and β are complex conjugates. Since their product is p, this implies that they each have absolute value p^{\frac{1}{2}} . Conversely, if |α| = p^{\frac{1}{2}} = |β|, then

|N_{1} − p − 1| = |α + β| ≤ 2\sqrt{p}.

Thus, granted Theorem 19.6, the Riemann hypothesis for E is equivalent to the statement

|N_{1} − p − 1| ≤ 2\sqrt{p}.

Exercise 19.8. (a) Prove that the zeta function of an elliptic curve E over 𝔽_{p} satisfies the functional equation

ζ(E, s) = ζ(E, 1 − s).

(b) Compute the zeta functions for the curve

E : Y^{2}Z + Y Z^{2} = X^{3} − X^{2}Z

over the fields 𝔽_{2}, 𝔽_{3}, 𝔽_{5}, 𝔽_{7}, and verify the Riemann hypothesis in each case. How many points does the curve have over the field with 625 elements?

I outline some of the ideas that go into the proof of the theorem. First consider Z(𝔸^{1}, T) again. By definition

Z(𝔸^{1}, T) = ∏_{f} \frac{1}{1 − T^{deg f}}
= ∏_{f}(1 + T^{deg f} + T^{2 deg f} + T^{3 deg f} + ⋯),

where the product is over the monic irreducible polynomials in 𝔽_{p}[X]. On multiplying out we obtain a formal power series that is a sum of terms of the form

T^{r_{1} deg f_{1}} ⋯ T^{r_{t} deg f_{t}}.

The coefficient of T^{m} is the number sequences (r_{1}, f_{1}), …, (r_{t}, f_{t}) such that ∑ r_{i} deg f_{i} = m. Because unique factorization holds in 𝔽_{p}[X], we can identify such a sequence with a monic polynomial ∏ f_{i}^{r_{i}} of degree m. Therefore, the coefficient of T^{m} is the number of monic polynomials in 𝔽_{p}[X] of degree m. This is p^{m}, and so

Z(𝔸^{1}, T) = ∑ p^{m}T^{m} = \frac{1}{1 − pT} .

Hence (again),

Z(ℙ^{1}, T) = \frac{1}{1 − T} Z(𝔸^{1}, T) = \frac{1}{(1 − T)(1 − pT)}.

Now consider an elliptic curve E over 𝔽_{p}. Here

Z(E, T) = \frac{1}{1 − T} Z(E^{aff}, T)
= \frac{1}{1 − T} ∏_{𝔭} \frac{1}{1 − T^{deg 𝔭}},

where the 𝔭 run through the prime ideals of

𝔽_{p}[E^{aff}] = 𝔽_{p}[X, Y]/(Y^{2} − X^{3} − aX − b).

On multiplying the product out and applying the Riemann-Roch theorem (see below), we find that

Z(E, T) = ∑ d_{m}T^{m}

where d_{0} = 1 and d_{m} = N_{1} \frac{p^{m}−1}{p−1}. Therefore,

Z(T) = 1 + ∑_{m>0} N_{1} \frac{p^{m} − 1}{p − 1}T^{m}

= \frac{N_{1}}{p − 1} (\frac{1}{1 − pT} − \frac{1}{1 − T} ) + 1
= \frac{N_{1}}{p − 1} (\frac{(p − 1)T}{(1 − pT)(1 − T)}) + 1
= \frac{1 + (N_{1} − p − 1)T + pT^{2}}{(1 − T)(1 − pT)} .

Application of the Riemann-Roch theorem. In this subsection, we explain how the Riemann-Roch theorem leads to the above formula for d_{m}. Consider an elliptic curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ k, Δ ≠ 0,

over a field k. Write E^{aff} for the affine curve

Y^{2} = X^{3} + aX + b.

A divisor on E is a finite sum

D = ∑ r_{i}𝔭_{i}

with r_{i} ∈ ℤ and 𝔭_{i} either a nonzero prime ideal in k[E^{aff}] or another symbol 𝔭_{∞} (the “prime divisor corresponding to the point at infinity”). A divisor D = ∑ r_{i}𝔭_{i} is positive if r_{i} ≥ 0 for all i. The degree of 𝔭 is the degree of the field extension [k[C^{aff}]/𝔭 : k] if 𝔭 ≠ 𝔭_{∞}, and is 1 if 𝔭 = 𝔭_{∞}. We extend the definition to all divisors by linearity:

deg D = ∑ r_{i} deg 𝔭_{i}.

The ring k[E^{aff}] is a Dedekind domain, and so, for each prime ideal 𝔭, the localization k[E^{aff}]_{𝔭} is a principal ideal domain with a single prime element (up to associates). Therefore, corresponding to such a prime ideal, we obtain a valuation ord_{𝔭} : k(E)^{×} → ℤ—if f ∈ k[E^{aff}],

(f) = ∏ 𝔭^{ord_{𝔭}(f)}. Similarly, there is a valuation ord_{𝔭_{∞}} : k(E)^{×} → ℤ measuring the order of the zero or pole of f at infinity. The divisor of an f ∈ k(E)^{×} is

(f) = ∑ ord_{𝔭}(f)𝔭.

For a divisor D, define

L(D) = {f ∈ k(E)^{×} | (f) + D ≥ 0} ∪ {0}.

Theorem 19.9 (Riemann-Roch). For any divisor D, L(D) is a finite-dimensional vector space over k, and if deg D ≥ 1, then

dim L(D) = deg D.

We need to restate this slightly. Fix D_{0}, and consider the set P (D_{0}) of all divisors D such that

(a) D ≥ 0,

(b) D ∼ D_{0}, i.e., D = D_{0} + (f) for some f ∈ k(E)^{×}.

Then

f ↦ D_{0} + (f) : L(D_{0}) \ {0} → P (D_{0})

is surjective, and two functions have the same image if and only if one is a constant multiple of the other. We therefore have a bijection

(L(D_{0}) \ {0})/k^{×} → P (D_{0}).

In the case that k = 𝔽_{q} and deg D_{0} = m ≥ 1, the Riemann-Roch theorem implies that P (D_{0}) has

\frac{q^{m} − 1}{q − 1}

elements.

Remark 19.10. The map sending (a, b) in E^{aff}(k) to the ideal 𝔭_{a,b} =_{df} (x−a, y−b) ⊂ k[E^{aff}] (ideal of all regular functions on E^{aff} zero at (a, b)) is a one-to-one correspondence

E^{aff}(k) ↔^{1:1} {nonzero prime ideals in k[E^{aff}] of degree 1}.

When k is algebraically closed, all prime ideals in k[E^{aff}] have degree 1, and the definitions and statements above agree with those in Section 4.

We need two more facts. The degree of a principal divisor (f) is zero, and so the degree map factors through the quotient group Pic(E) = Div(E)/{(f) | f ∈ k(E)^{×}}. Moreover

PicE ⟶^{deg} ℤ

is surjective, because 𝔭_{∞} ↦ 1. Define

Pic^{m}E = {𝔡 ∈ Pic(E) | deg 𝔡 = m}.

Then

(a) the map E(k) → Pic^{0}(E),

\{ \begin{matrix}(a : b : 1) & ↦ & 𝔭_{a,b} \\ (0 : 1 : 0) & ↦ & 𝔭_{∞} \end{matrix}

is an isomorphism of abelian groups (cf. 4.7; this again follows from the Riemann-Roch theorem);

(b) the map Pic^{0}(E) → Pic^{m}(E), 𝔡 ↦ 𝔡 + m𝔭_{∞}, is a bijection (this is obvious from the definition of Pic^{m}(E)).

We are now able to derive the formula for d_{m}, m ≥ 1. With the above terminology, the coefficient d_{m} of T^{m} is the set of positive divisors on E of degree m. In the discussion following the Riemann-Roch theorem, we saw that each class in Pic^{m}(E) has \frac{p^{m}−1}{p−1} elements, and there are

#Pic^{m}(E) =^{(b)} #Pic^{0}(E) =^{(a)} #E(𝔽_{p}) = N_{1}

such classes. Therefore, altogether, there are

N_{1} \frac{p^{m} − 1}{p − 1}

positive divisors of degree m.

Proof of the Riemann hypothesis for elliptic curves. Let

b = N_{1} − p − 1.

We have to show that

b^{2} − 4p ≤ 0.

I’ll only sketch the proof. The details of what follows can be found in [C2], Sections 24, 25, and most other books on elliptic curves.

Fix an algebraically closed field k. Consider a nonconstant regular map

φ : C → C′

from one irreducible affine curve C to a second (defined over k). Then φ being regular means that it defines a homomorphism

f ↦ f ∘ φ : k[C′] → k[C]

from the k-algebra of regular functions on C′ to the k-algebra of regular functions on C. This map is injective, and so defines map on the fields of fractions

k(C′) → k(C),

which realizes k(C) as a finite extension of k(C′). The degree of φ is defined to be the degree of this extension.

Important fact: If k(C) is separable over k(C′), then φ^{−1}(P) has deg φ points for all but finitely many P ∈ C(k), i.e., if deg φ = d, then φ is “generically” d : 1.

Example 19.11. Consider the map (x, y) ↦ x : E^{aff}(k) → 𝔸^{1}(k), where E^{aff} is the curve

E^{aff} : Y^{2} = X^{3} + aX + b.

The map on the rings of regular functions is

X ↦ x : k[X] → k[x, y] =_{df} k[X, Y]/(Y^{2} − X^{3} − aX − b).

Clearly k(x, y) = k(x)[\sqrt{x^{3} + ax + b}], and so the map has degree 2. If characteristic k≠ 2, then the field extension is separable, and the map is 2 : 1 except over the roots of X^{3}+aX +b.

A nonconstant map φ : E → E′ of elliptic curves such that φ(0) = 0 is called an isogeny. An isogeny is automatically a homomorphism, and so its fibres φ^{−1}(P) all have the same cardinality, which will be deg φ if k(E) is separable over k(E′).

We need two facts about degrees of isogenies:

(a) deg(φ ∘ ψ) = deg(φ) · deg(ψ);

(b) deg(φ + ψ) + deg(φ − ψ) = 2 deg(φ) + 2 deg(ψ).

The first statement is simply

[k(E) : k(E′′)] = [k(E) : k(E′)][k(E′) : k(E′′)]

(see Math 594), and the second has a proof that is similar to the proof of the parallelogram law for the height function.

The second statement implies that deg : End(E) → ℤ is quadratic (see 15.6), i.e., that

deg(mφ + nψ) = am^{2} + bmn + cn^{2}, all m, n ∈ ℤ,

for certain integers a, b, c depending on φ and ψ. In fact, on taking (m, n) = (1, 0) or (0, 1), we see that a = deg φ and c = deg ψ. Now deg(mφ + nψ) ≥ 0 for all m, n. Hence

ar^{2} + br + c ≥ 0

for all r ∈ ℚ. From high school algebra, this implies that

b^{2} − 4ac ≤ 0.

We apply this with φ the Frobenius map E → E and ψ the identity map id_{E}. From the picture

k(x, y) ⟶^{(x,y)↦(x^{p},y^{p})} k(x, y)
|2  |2
k(X) ⟶^{X↦X^{p}} k(X)

we see that

deg φ = [k(x, y) : k(x^{p}, y^{p})] = [k(X) : k(X^{p})] = p,

and clearly deg id_{E} = 1. Therefore

b^{2} − 4p ≤ 0

where b is such that

deg(φ − id_{E}) = deg φ − b + deg id_{E} = p − b + 1.

But the kernel of φ − id is the set of P ∈ E(k) such that φ(P) = P, i.e., such that (x^{p} : y^{p} : z^{p}) = (x : y : z), i.e., such that P ∈ E(𝔽_{p}). Therefore (assuming separability),

deg(φ − id) = N_{1},

and so

−b = N_{1} − p − 1.

The above inequality becomes

(N_{1} − p − 1)^{2} ≤ 4p,

as required.

A Brief History of Zeta. The story begins, as do most stories in number theory, with Gauss.

Gauss 1801. Consider the elliptic curve

E : X^{3} + Y^{3} + Z^{3} = 0

over 𝔽_{p}, p ≠ 3.

If p ≢ 1 mod 3, then 3 doesn’t divide the order of 𝔽_{p}^{×}, and so a ↦ a^{3} is a bijection 𝔽_{p}^{×} → 𝔽_{p}^{×}. It follows that (x : y : z) ↦ (x^{3} : y^{3} : z^{3}) is a bijection from E(𝔽_{p}) onto L(𝔽_{p}) where L is the line

L : X + Y + Z = 0.

Therefore

#E(𝔽_{p}) = #L(𝔽_{p}) = p + 1.

If p ≡ 1 mod 3, then 4p = A^{2} + 27B^{2} where A and B are integers, uniquely determined up to sign. Fix the sign of A by requiring that A ≡ 1 mod 3. Then Gauss showed that

#E(𝔽_{p}) = p + 1 + A.

Therefore,

|#E(𝔽_{p}) − p − 1| = |A| = |4p − 27B^{2}|^{\frac{1}{2}} ≤ 2p^{\frac{1}{2}} ,

and so the Riemann hypothesis holds for E over 𝔽_{p}, all p ≠ 3. For details, see Silverman and Tate, pp110–119.

This result is typical for elliptic curves with complex multiplication.

Emil Artin 1924. In his thesis, Artin defined the zeta function of a curve of the form

C : Y^{2} = f(X).

Here 𝔽_{p}(C) = 𝔽_{p}(X)[\sqrt{f}], and so 𝔽_{p}(C) is analogous to a quadratic extension of ℚ. He proved that it is a rational function of p^{−s} and satisfies a functional equation, and he checked the Riemann hypothesis, at least for a few curves.

F.K. Schmidt 1925–1930. For a nonsingular projective curve C over 𝔽_{p}, define

ζ(C, s) = Z(C, p^{−s}), Z(C, T) = ∑_{m≥1} N_{m} \frac{T^{m}}{m} , N_{m} = #C(𝔽_{p^{m}}).

Using the Riemann-Roch theorem, Schmidt showed (as in the above proof for elliptic curves) that

Z(C, T) = \frac{P (T)}{(1 − T)(1 − pT)}, P (T) = 1 + ⋯ ∈ ℤ[T], deg P (T) = 2g.

Moreover,

Z(\frac{1}{pT}) = p^{1−g}T^{2−2g}Z(T),

and so

ζ(1 − s) = p^{1−g}(p^{2−2g})^{−s}ζ(s).

Write

P (T) = ∏(1 − α_{j}T).

Then the formulas show that

N_{m} = 1 + p^{m} − ∑ α_{j}^{m}.

Thus, once one knows α_{1}, …, α_{2g}, then one knows N_{m} for all m. However, unlike the elliptic curve case, N_{1} doesn’t determine the α_{j}’s—one needs to know several of the N_{m}’s.

Hasse 1933/34. Hasse proved that the Riemann hypothesis is true for elliptic curves.

Weil 1940–1948. In 1940, Weil announced a proof of the Riemann hypothesis for all curves, i.e., that |α_{i}| = \sqrt{p} for 1 ≤ i ≤ 2g where α_{i} is above. His proof assumed the existence of a theory of algebraic geometry over arbitrary fields, including the theory of Jacobian and Abelian varieties, which at the time was known only over ℂ. He spent most of the 1940’s developing the algebraic geometry he needed, and gave a detailed proof in a book published in 1948.

Weil 1949/1954. Weil studied zeta functions of some special algebraic varieties, and stated his famous “Weil conjectures”.

For a nonsingular projective variety V of any dimension over 𝔽_{p}, one can define (as for curves)

ζ(V, s) = Z(V, p^{−s}), Z(V, T) = ∑_{m≥1} N_{m} \frac{T^{m}}{m} , N_{m} = #V (𝔽_{p^{m}}).

Weil conjectured that Z(V, T) is a rational function of T, that a “Riemann hypothesis” holds for ζ(V, s), and that ζ(V, s) satisfies a functional equation—see below for exact statements. He even hinted that one might be able to prove the rationality by developing a cohomology theory for algebraic varieties over arbitrary fields, analogous to that provided by algebraic topology over ℂ, and for which a Lefschetz fixed point formula. At the time, this seemed an outlandish idea.

Dwork 1960. Dwork gave an “elementary” proof that Z(V, T) is a rational function of T.

Grothendieck et al 1963/64. Grothendieck defined étale cohomology and, with the help of M. Artin and Verdier, developed it sufficiently to prove that Z(V, T) is rational and satisfies a functional equation. The rationality follows from a “Lefschetz fixed point formula”, and the functional equation from “Poincaré duality” theorem.

Deligne 1973. Deligne used étale cohomology to prove the remaining Weil conjecture, namely, the Riemann hypothesis. For this, he received the Fields medal.

In summary, the results of Grothendieck, Artin, Verdier, and Deligne show that, for a nonsingular projective variety V over 𝔽_{p},

Z(V, T) = \frac{P_{1}(T)P_{3}(T) ⋯ P_{2d−1}(T)}{(1 − T)P_{2}(T)P_{4}(T) ⋯ P_{2d−2}(T)(1 − p^{d}T)}

where d = dim V and P_{i}(T) ∈ ℤ[T]. Moreover

Z(V, \frac{1}{p^{d}T}) = ±T^{χ}p^{dχ/2}Z(V, T)

where χ is the self-intersection number of the diagonal in V × V. Finally (Riemann hypothesis):

P_{i}(T) = ∏(1 − α_{ij}T), |α_{ij}| = p^{i/2}.

This last statement says that ζ(V, s) has its zeros on the lines

ℜ(s) = \frac{1}{2}, \frac{3}{2}, …, \frac{2d − 1}{2}

and its poles on the lines

ℜ(s) = 0, 1, 2, …, d.

Exercise 19.12. (a) Let E be the elliptic curve

E : Y^{2}Z = X^{3} − 4X^{2}Z + 16Z^{3}.

Compute N_{p} =_{df} #E(𝔽_{p}) for all primes 3 ≤ p ≤ 13 (more if you use a computer). (b) Let F (q) be the (formal) power series given by the infinite product

F (q) = q ∏_{n=1}^{∞}(1 − q^{n})^{2}(1 − q^{11n})^{2} = q − 2q^{2} − q^{3} + 2q^{4} + · · · .

Calculate the coefficient M_{n} of q^{n} in F (q) for n ≤ 13 (more if you use a computer).

(c) For each prime p, compute the sum M_{p} + N_{p}. Formulate a conjecture as to what M_{p} + N_{p} should be in general.

(d) Prove your conjecture. [This is probably very difficult, perhaps even impossible, using only the information covered in the course.]

[[Your conjecture is, or, at least, should be a special case of a theorem of Eichler and Shimura. Wiles’s big result is that the theorem of Eichler and Shimura applies to virtually all elliptic curves over ℚ.]]

20. The Conjecture of Birch and Swinnerton-Dyer

Introduction. We return to the problem of computing the rank of E(ℚ). Our purely algebraic approach provides only an upper bound for the rank, via the Selmer group, and the difference between the upper bound and the actual rank is measured by the mysterious Tate-Shafarevich group. It is very difficult to decide whether an element of S^{(2)}(E/ℚ) comes from an element of infinite order, or survives to give a nontrivial element of TS(E/ℚ)—in fact, there is no (proven) algorithm for doing this. Clearly, it would be helpful to have another approach.

One idea is that perhaps the rank E(ℚ) should be related to the orders of the groups Ē(𝔽_{p}). For any good prime p, there is a reduction map

E(ℚ) → Ē(𝔽_{p})

but, in general, this will be far from injective or surjective. For example, if E(ℚ) is infinite, then so also is the kernel, and if E(ℚ) is finite (and hence has order ≤ 18) then it will fail to be surjective for all large p (because #Ē(𝔽_{p}) ≥ p + 1 − 2\sqrt{p}).

Let E be an elliptic curve over ℚ. For each prime p where E has good reduction, I write (in contradiction to the notations of the last section)

N_{p} = #Ē(𝔽_{p})

where Ē denotes the reduction of E over 𝔽_{p}.

In the late fifties, Birch and Swinnerton-Dyer had the idea that if E(ℚ) is large then this should force the N_{p}’s to be “large”. Since they had access to one of the few computers then in existence, they were able to test this experimentally. For P a large number (large, depending on the speed of your computer), let

f(P) = ∏_{p≤P} \frac{N_{p}}{p} .

Recall that N_{p} is approximately p. Their calculations led them to the following conjecture.

Conjecture 20.1. For each elliptic curve E over ℚ, there exists a constant C such that

lim_{P →∞} f(P) = C log(P)^{r}

where r = rank(E(ℚ)).

We write the conjecture more succinctly as

f(P) ∼ C log(P)^{r} as P → ∞.

Note the remarkable nature of this conjecture: it predicts that one can determine the rank of E(ℚ) from the sequence of numbers N_{p}. Moreover, together with an estimate for the error term, it will provide an algorithm for finding r.

Birch and Swinnerton-Dyer were, in practice, able to predict r from this conjecture with fairly consistent success, but they found that f(P) oscillates vigorously as P increases, and that there seemed to be little hope of finding C with an error of less than say 10%. Instead, they re-expressed their conjecture in terms of the zeta function of E.

The zeta function of a variety over ℚ. Let V be a nonsingular projective variety over ℚ. Such a variety is the zero set of a collection of homogeneous polynomials

F (X_{0}, …, X_{n}) ∈ ℚ[X_{0}, …, X_{n}].

Scale each such polynomial so that its coefficients lie in ℤ but have no common factor, and let F̄(X_{0}, …, X_{n}) ∈ 𝔽_{p}[X_{0}, …, X_{n}] be the reduction of the scaled polynomial modulo p. If the polynomials F̄ define a nonsingular variety V_{p} over 𝔽_{p}, then we say V has good reduction at p, or that p is good for V. All but finitely many primes will be good for a given variety.

For each good prime p we have a zeta function

ζ(V_{p}, s) = Z(V_{p}, p^{−s}), log Z(V_{p}, T) = ∑ #V_{p}(𝔽_{p^{m}})\frac{T^{m}}{m} ,

and we define

ζ(V, s) = ∏_{p} ζ(V_{p}, s).

Because the Riemann hypothesis holds for V_{p}, the product converges for ℜ(s) > d + 1, d = dim V (cf. the explanation below for the L-series of an elliptic curve).

Let P t be the point over ℚ, i.e., P t = 𝔸^{0} = ℙ^{0}. For this variety, all primes are good, and

log Z(P t_{p}, T) = ∑ 1\frac{T^{m}}{m} = log \frac{1}{1 − T} .

Therefore

ζ(P t, s) = ∏_{p} \frac{1}{1 − p^{−s}}

which is just the Riemann zeta function—already an interesting function.

Let V = ℙ^{n}. Again all primes are good, and

#ℙ^{n}(𝔽_{q}) = \frac{q^{n+1} − 1}{q − 1} = 1 + q + ⋯ + q^{n}, q = p^{m},

from which it follows that

ζ(ℙ^{n}, s) = ζ(s)ζ(s − 1) ⋯ ζ(s − n)

with ζ(s) the Riemann zeta function.

Conjecture 20.2 (Hasse-Weil). For any nonsingular projective variety V over ℚ, ζ(V, s) can be analytically continued to a meromorphic function on the whole complex plane, and satisfies a functional equation relating ζ(V, s) with ζ(V, d+1−s), d = dim V (and, of course, it is expected to satisfy a Riemann hypothesis, but let’s not concern ourselves with that).

The conjecture is widely believed to be true, but it is known in only a few cases (and the parenthetical statement is not known for any variety, not even a point). Note that the above calculations prove it for V = ℙ^{n}.

The zeta function of an elliptic curve over ℚ. Let E be an elliptic curve over ℚ, and let S be the set of primes where E has bad reduction. According to the above definition

ζ(E, s) = ∏_{p∉S} \frac{1 + (N_{p} − p − 1)p^{−s} + p^{1−2s}}{(1 − p^{−s})(1 − p^{1−s})}

= \frac{ζ_{S}(s)ζ_{S}(s − 1)}{L_{S}(s)}

where ζ_{S}(s) is Riemann’s zeta function except that the factors corresponding to the primes in S have been omitted, and

L_{S}(E, s) = ∏_{p∉S} \frac{1}{1 + (N_{p} − p − 1)p^{−s} + p^{1−2s}} .

Write

1 + (N_{p} − p − 1)T + pT^{2} = (1 − α_{p}T)(1 − β_{p}T),

so that

L_{S}(E, s) = ∏_{p} \frac{1}{1 − α_{p}p^{−s}} \frac{1}{1 − β_{p}p^{−s}} .

As we noted on p 92, the product ∏_{p} \frac{1}{1−p^{−s}} converges for ℜ(s) > 1, and so

∏_{p} \frac{1}{1 − p^{\frac{1}{2}} p^{−s}}

converges for ℜ(s) > \frac{3}{2}. Because |α_{p}| = p^{\frac{1}{2}} = |β_{p}|, a similar estimate shows that L_{S}(E, s) converges for ℜ(s) > \frac{3}{2}.

We want to add factors to L_{S}(E, s) for the bad primes. Define

L_{p}(T) = \{ \begin{matrix}1 − a_{p}T + pT^{2}, & a_{p} = p + 1 − N_{p}, p good \\ 1 − T, & if E has split multiplicative reduction \\ 1 + T, & if E has non-split multiplicative reduction \\ 1, & if E has additive reduction. \end{matrix}

In the four cases

L_{p}(p^{−1}) = \frac{N_{p}}{p} , \frac{p − 1}{p}, \frac{p + 1}{p}, \frac{p}{p}.

Thus in each case, L_{p}(p^{−1}) = \frac{#E^{ns}(𝔽_{p})}{p}, where E^{ns} is the nonsingular part of the reduction of the elliptic curve modulo p (see the table on p29). Define

L(E, s) = ∏_{p} \frac{1}{L_{p}(p^{−s})},

where the product is now over all prime numbers. The conductor N_{E/ℚ} of E is defined to be ∏_{p bad} p^{f_{p}} where

f_{p} = \{ \begin{matrix}f_{p} = 1 & if E has multiplicative reduction at p \\ f_{p} ≥ 2 & if E has additive reduction at p, and equals 2 if p ≠ 2, 3. \end{matrix}

A formula of Ogg (proved by painful, case by case, checking) states that

f_{p} = ord_{p}(Δ) + 1 − m_{p}

where m_{p} is the number of irreducible components on the Néron model (not counting multiplicities) and Δ is the discriminant of the minimum equation of E

Y^{2} + a_{1}XY + a_{3}Y = X^{3} + a_{2}X^{2} + a_{4}X + a_{6.}

See Section 22 below.

Define Λ(E, s) = N_{E/ℚ}^{s/2}(2π)^{−s}Γ(s)L(E, s). The following is a more precise version of the Hasse-Weil conjecture for the case of an elliptic curve.

Conjecture 20.3. The function Λ(E, s) can be analytically continued to a meromorphic function on the whole of ℂ, and it satisfies a functional equation

Λ(E, s) = wΛ(E, 2 − s), w = ±1.

There is even a recipe for what w should be.

For curves with complex multiplication, i.e., such that End(E) ≠ ℤ, the conjecture was proved by Deuring 1951/55. This case occurs for exactly 9 values of the j-invariant. The key point is that there is always a “formula” for N_{p} similar to that proved by Gauss for the curve X^{3} + Y^{3} + Z^{3} = 0 (see p101) which allows one to identify the L-series of E with an L-series previously defined by Hecke and for which one knows analytic continuation and a functional equation.

A much more important result, which we’ll spend most of the rest of the term discussing, is the following. Let

Γ_{0}(N) = \{( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ SL_{2}(ℤ)| c ≡ 0 mod N\} .

Then Γ_{0}(N) acts on the complex upper half-plane, and the quotient Γ_{0}(N)\ℍ has the structure of a Riemann surface. An elliptic curve E over ℚ is said to be modular if there is a nonconstant map of Riemann surfaces

Γ_{0}(N)\ℍ → E(ℂ)

for some N. Eichler and Shimura (in the fifties and sixties) proved a slightly weaker form of Conjecture 20.3 for modular elliptic curves.

Recall that a curve is said to have semistable reduction at p if it has good reduction at p or multiplicative reduction at p, i.e., if the reduced curve doesn’t have a cusp.

Wiles (with the help of Richard Taylor) proved that an elliptic curve with semistable reduction at all p is modular, and Diamond extended Wiles’s results to elliptic curves having semistable reduction at 3 and 5.

Remark 20.4. (a) Deuring’s result is valid for elliptic curves with complex multiplication over any number field. The results of Eichler, Shimura, Wiles, et al. are valid only for elliptic curves over ℚ. Even today, little is known about the L-series of elliptic curves over number fields other than ℚ.

(b) Both results prove much more than the simple statement of Conjecture 20.3—they succeed in identifying the function Λ(E, s).

Statement of the Conjecture of Birch and Swinnerton-Dyer. Let E be an elliptic curve over ℚ. Let

Y^{2} + a_{1}XY + a_{3}Y = X^{3} + a_{2}X^{2} + a_{4}X + a_{6}

be a minimum equation for E over ℚ (see Section 22 below), and let

ω = \frac{dx}{2y + a_{1}x + a_{3}} .

Recall that there is a canonical pairing

<, >: E(ℚ) × E(ℚ) → ℝ, < P, Q >= ĥ(P + Q) − ĥ(P) − ĥ(Q).

We define the discriminant of <, > to be the determinant of the r × r matrix whose i, jth entry is < P_{i}, P_{j} > where P_{1}, …, P_{r} is a basis for E(ℚ) modulo torsion:

disc <, >= det(< P_{i}, P_{j} >).

It is independent of the choice of the basis {P_{i}}.

Conjecture 20.5 (Birch and Swinnerton-Dyer). For any elliptic curve E over ℚ,

L(E, s) ∼ (Ω ∏_{p bad} c_{p}) \frac{[TS(E/ℚ)] disc <, >}{[E(ℚ)_{tors}]^{2}}(s − 1)^{r} as s → 1,

where [∗] = order of ∗ (elsewhere written #∗); Ω = ∫_{E(ℝ)} |ω|; c_{p} = (E(ℚ_{p}) : E^{0}(ℚ_{p})).

Remark 20.6. (a) As we discuss in Section 22, for a modular elliptic curve, all terms in the conjecture are computable except for the Tate-Shafarevich group, and, in fact, can be computed by Pari.

(b) Formally, L_{p}(1) = ∏ \frac{p}{N_{p}} , and so the conjecture has an air of compatibility with Conjecture 20.1. I don’t know what (if any) is the precise mathematical relation between the two conjectures.

(c) Let P_{1}, …, P_{r} be linearly independent elements of E(ℚ). Then

\frac{det(< P_{i}, P_{j} >)}{(E(ℚ) : ∑ ℤP_{i})^{2}}

is independent of the choice of P_{1}, …, P_{r}, and equals

\frac{disc <, >}{[E(ℚ)_{tors}]^{2}}

when they form a basis.

(d) The integral ∫_{E(ℚ_{p})} |ω| makes sense, and, in fact equals (E(ℚ_{p}) : E^{1}(ℚ_{p}))/p. The explanation for the formula is that (see 7.3) there is a bijection E^{1}(ℚ_{p}) ↔ pℤ_{p} under which ω corresponds to the Haar measure on ℤ_{p} for which ℤ_{p} has measure 1 and (therefore) pℤ_{p} has measure 1/(ℤ_{p} : pℤ_{p}) = 1/p. Hence,

∫_{E(ℚ_{p})} |ω| = (E(ℚ_{p}) : E^{1}(ℚ_{p})) ∫_{E^{1}(ℚ_{p})} = |ω| = \frac{(E(ℚ_{p}) : E^{1}(ℚ_{p}))}{p} = \frac{c_{p}N_{p}}{p} .

For any finite set S of prime numbers including all those for which E has bad reduction, define

L_{S}^{∗}(s) = ( ∏_{p∈S∪\{∞\}} ∫_{E(ℚ_{p})} |ω|)^{−1} ∏_{p∉S} \frac{1}{L_{p}(p^{−s})}.

In this, ℚ_{p} = ℝ when p = ∞. When p is good,

L_{p}(p^{−1}) = \frac{N_{p}}{p} = (∫_{E(ℚ_{p})} |ω|) ,

and so the behaviour of L_{S}(s) near s is independent^{23} of S satisfying the condition, and the conjecture of Birch and Swinnerton-Dyer can be stated as:

L_{S}^{∗}(E, s) ∼ \frac{[TS(E/ℚ)] disc <, >}{[E(ℚ)_{tors}]^{2}}(s − 1)^{r} as s → 1.

This is how Birch and Swinnerton-Dyer stated their conjecture.

What’s known about the conjecture of B-S/D. Birch and Swinnerton-Dyer, Stephens, and many others, have computed all the terms in the conjecture except TS for several thousand curves. The predicted value of [TS] turns out to be a square, and, when computed, the 2 and 3 primary components have the correct order.

Cassels proved that [TS] is a square if finite. Thus, if [TS_{p}] has order not equal to a square for some p, then TS is infinite.

Let E and E′ be two elliptic curves over ℚ, and suppose there is an isogeny E → E′. Most of the terms in Conjecture 20.5 differ for the two curves, but nevertheless Cassels was able to show that if the conjecture if true for one curve, then it is true for the other, i.e., that the conjecture is compatible with isogenies.

These results of Cassels were interesting applications of Galois cohomology.

For certain elliptic curves over function fields, the conjecture was proved in 1967 (see the next section).

Thus, by the mid-seventies, the little progress had been made toward proving the conjecture over ℚ. The Tate-Shafarevich group was not known to be finite for a single curve. In 1974, Tate said:

This remarkable conjecture relates the behaviour of a function L at a point where it is not at present known to be defined to the order of a group TS which is not known to be finite.

Coates and Wiles (1977): If E has complex multiplication, and E(ℚ) is infinite, then L(E, 1) = 0.

Birch: For a modular elliptic curve E/ℚ and a complex quadratic extension K of ℚ, he defined a “Heegner point” P_{K} ∈ E(K), and suggested that it should often be of infinite order.

Gross-Zagier (1983): Proved the formula

ĥ(P_{K}) = (nonzero)L′(E/K, 1).

Thus P_{K} has infinite order if and only if L′(E/K, 1) ≠ 0.

23More precisely, lim_{s→1} L_{S}(s)/L_{S′}(s) = 1 for any two such sets S, S′.

Let K = ℚ[\sqrt{D}], D < 0, be a complex quadratic extension of ℚ. If E is the curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3},

define E^{K} to be the curve

E^{K} : DY^{2}Z = X^{3} + aXZ^{2} + bZ^{3}

—thus E^{K} becomes isomorphic to E over K. There is an elementary formula:

L(E/K, s) = L(E/ℚ, s) · L(E^{K}, s).

Bump-Friedberg-Hoffstein (1989): Showed that, given a modular elliptic curve E over ℚ, there exists a complex quadratic field K such that L′(E^{K}, 1) ≠ 0 (and hence the formula of Gross and Zagier proves that P_{K} has infinite order if L(E/ℚ, 1) ≠ 0).

Kolyvagin (1988): For a modular elliptic curve E/ℚ, if P_{K} has infinite order for some complex quadratic extension K of ℚ, then E(ℚ) and TS(E/ℚ) are both finite.

On combining these results, we find that L(E/ℚ, 1) ≠ 0 ⟹ E(ℚ) and TS(E/ℚ) are finite.

In fact, Kolyvagin proves much more. For example, he shows that [TS(E/ℚ)] divides its conjectured order. To complete the proof of the conjecture of Birch and Swinnerton-Dyer, it suffices to check the its p-primary component has the correct order for a finite set of primes.

Roughly speaking, this is what was known by 1990.

21. Elliptic Curves and Sphere Packings

The conjecture of Birch and Swinnerton-Dyer is expected to hold, not just for elliptic curves over ℚ, but also for elliptic curves over number fields and over certain function fields. In the second case, the full conjecture has been proved in some important cases, and Elkies and Shioda have shown that it can be used to recover (at least in dimensions ≤ 1000) most of the known lattices that give very dense sphere packings, and in certain dimensions, for example, 33, 54, 64, 80,..., to discover new denser sphere packings.

Let q be a power of the prime p, and let 𝔽_{q}(T) be the field of fractions of 𝔽_{q}[T]. The height of a point P of ℙ^{1}(𝔽_{q}(T)) can be defined as for a point of ℙ^{1}(ℚ): represent the point as (f(T) : g(T)) where f and g have been chosen to lie in 𝔽_{q}[T] and be relatively prime, and define

H(P) = max(𝔽_{q}[T] : (f)), (𝔽_{q}[T] : (g)) = max q^{deg f}, q^{deg g}.

The logarithmic height is

h(P) = log q · max{deg f, deg g}

If p ≠ 2, 3, an elliptic curve E over 𝔽_{q}(T) can be written

Y^{2}Z = X^{3} + a(T)X^{2}Z + b(T)Z^{3}, a, b ∈ 𝔽_{q}[T], Δ(T) = 4a^{3} + 27b^{2} ≠ 0.

For each monic irreducible polynomial p(T) in 𝔽_{q}[T], we have a homomorphism a ↦ ā : 𝔽_{q}[T] → 𝔽_{q}[T]/(p(T)), and so we obtain a curve

Ē : Y^{2}Z = X^{3} + āX^{2}Z + b̄Z^{3}, ā, b̄ ∈ 𝔽_{q}[T]/(p(T)),

over the field 𝔽_{q}[T]/(p(T)). All the terms that go into the conjecture of Birch and Swinnerton-Dyer in the number field case can be defined here.

More generally, let K be a finite extension of 𝔽_{q}(T). There will exist a nonsingular projective curve C such that 𝔽_{q}(T) = 𝔽_{q}(C). As we discussed on p102,

Z(C, T) = \frac{∏_{i=1}^{2g}(1 − ω_{i}T)}{(1 − T)(1 − qT)}, |ω_{i}| = q^{\frac{1}{2}} , g = genus(C).

Now consider a constant elliptic curve E over K, i.e., a curve defined by an equation

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}

with the a, b ∈ 𝔽_{q} ⊂ K. Let

Z(E, T) = \frac{(1 − α_{1}T)(1 − α_{2}T)}{(1 − T)(1 − qT)},

|α_{1}| = q^{\frac{1}{2}} = |α_{2}|.

Proposition 21.1. For a constant elliptic curve E over K = 𝔽_{q}(C) (as above), the conjecture of Birch and Swinnerton-Dyer is equivalent to the following statements:

(a) the rank of E(K) is equal to the number of pairs (i, j) such that α_{i} = ω_{j};

(b) [TS(E/K)] disc <, >= q^{g} ∏_{α_{i}≠ω_{j}}(1 − \frac{ω_{j}}{α_{i}}).

Proof. Elementary, but omitted.

Theorem 21.2. In the situation of the proposition, the conjecture of Birch and Swinnerton-Dyer is true.

Proof. Tate (1966) proved statement (a) of the Proposition, and I proved statement (b) in my thesis (1967).

In fact, the conjecture of Birch and Swinnerton-Dyer is true under the weaker hypothesis that j(E) ∈ 𝔽_{q} (Milne 1975), for example, for all curves of the form

Y^{2}Z = X^{3} + bZ^{3}, b ∈ K.

Sphere packings. ^{24} As we noted in (16.6) pairs consisting of a free ℤ-module of finite rank L and a positive definite quadratic form q on V =_{df} L⊗ℝ are of great interest. By Sylvester’s theorem, we can choose a basis for V that identifies (V, q) with (ℝ^{n}, X_{1}^{2} + ⋯ + X_{n}^{2}). The bilinear form associated with q is

<x, y>= q(x + y) − q(x) − q(y).

Given such a pair (L, q), the numbers one needs to compute are

(a) the rank r of L;

(b) the square of the length of the shortest vector

m(L) = inf_{v∈L,v≠0} <v, v>;

(c) the discriminant of L,

disc L = det(<e_{i}, e_{j}>)

where e_{1}, …, e_{r} is a basis for L.

24The best reference for this is Oesteré’s Bourbaki talk (Astérisque, 189/190, 1990). There are some uncorrected misprints in the next two pages.

The discriminant is independent of the choice of a basis for L. Let

γ(L) = m(L)/ disc(L)^{\frac{1}{r}} .

The volume a fundamental parallelopiped for L is \sqrt{disc L}. The sphere packing associated with L is formed of spheres of radius \frac{1}{2} \sqrt{m(L)}, and therefore its density is

d(L) = 2^{−r}b_{r}γ(L)^{\frac{r}{2}}

where b_{r} = π^{r/2}/Γ(\frac{r+2}{2}) is the volume of the r-dimensional unit ball. To maximize d(L), we need to maximise γ(L).

Let E be a constant elliptic curve over a field 𝔽_{q}(C) as above, and let L = E(ℚ)/E(ℚ)_{tors} with the quadratic form q = 2ĥ. If we know the ω_{i} and α_{j}, part (a) of Theorem 21.2 gives r, and part (b) gives an upper bound for disc L:

disc <, >= q^{g} ∏_{α_{i}≠ω_{j}}(1 − \frac{ω_{j}}{α_{i}})/[TS] ≤ q^{g} ∏_{α_{i}≠ω_{j}}(1 − \frac{ω_{j}}{α_{i}}).

Finally, an easy, but nonelementary argument, shows that

m(L) ≥ 2[C(k)]/[E(k)]

for all finite k ⊃ 𝔽_{q} (and [∗] = Card(∗)). The point is that an element P of E(K) defines a map u : C → E, and ĥ(P) is related to the degree of u. Thus, we get a lower bound for m(L) in terms of the ω_{i} and α_{j}.

Example. Consider the curve

C : X^{q+1} + Y^{q+1} + Z^{q+1} = 0

over 𝔽_{q^{2}} (note, not over 𝔽_{q}).

Lemma 21.3.

(a) The curve C is nonsingular, of genus g = \frac{q(q−1)}{2}.

(b) #C(𝔽_{q^{2}}) = q^{3} + 1.

(c) Z(C, T) = \frac{(1+qT)^{q(q−1)}}{(1−T)(1−q^{2}T)}.

Proof. (a) The partial derivatives of the defining equation are X^{q}, Y^{q}, Z^{q}, and these have no common zero in ℙ^{2}. Therefore, the curve is nonsingular, and so the formula on p9 shows that it has genus q(q − 1)/2.

(b) The group 𝔽_{q^{2}}^{×} is cyclic of order q^{2} − 1 = (q + 1)(q − 1), and 𝔽_{q}^{×} is its subgroup of order q − 1. Therefore, as x runs through 𝔽_{q^{2}}, x^{q+1} takes the value 0 once, and each value in 𝔽_{q}^{×} q + 1 times. A similar remark applies to y^{q+1} and z^{q+1}. We can scale each solution of X^{q+1} + Y^{q+1} + Z^{q+1} = 0 so that x = 0 or 1.

Case 1: x = 1, 1 + y^{q+1} ≠ 0. There are q^{2} − q − 1 possibilities for y, and then q + 1 possibilities for z. Hence (q^{2} − q − 1)(q + 1) = q^{3} − 2q − 1 solutions.

Case 2: x = 1, 1 + y^{q+1} = 0. There are q + 1 possiblities for y and one for z. Hence q + 1 solutions.

Case 3: x = 0. We can take y = 1, and then there are q + 1 possibilities for z.

In sum, there are q^{3} + 1 solutions.

(c) We know that

#C(𝔽_{q}) = 1 + q^{2} − ∑_{i=1}^{2g} ω_{i}.

Therefore ∑_{i=1}^{2g} ω_{i} = q^{2} − q^{3} = −2gq. Because |ω_{i}| = q, this forces ω_{i} = −q.

For all q, it is known that there is an elliptic curve E over 𝔽_{q^{2}}, such that E(𝔽_{q^{2}}) has q^{2} + 2q + 1 elements (the maximum allowed by the Riemann hypothesis). For such a curve

Z(E, T) = \frac{(1 + qT)^{2}}{(1 − T)(1 − q^{2}T)}.

Proposition 21.4. Let L = E(K)/E(K)_{tors} with E and K = 𝔽_{q}(C) as above. Then:

(a) The rank r of L is 2q(q − 1);

(b) m(L) ≥ 2(q − 1);

(c) [TS(E/K)] disc(L) = q^{q(q−1)};

(d) γ(L) ≥ 2(q − 1)/\sqrt{q}.

Proof. (a) Since all α_{i} and ω_{j} equal −q, if follows from (21.2a) that the rank is 2 × 2g = 2q(q − 1).

(b) We have

m(L) ≥ \frac{[C(𝔽_{q^{2}})]}{[E(𝔽_{q^{2}})]} = \frac{q^{3} + 1}{(q^{2} + 1)^{2}} > q − 2.

(c) This is a special case of (21.2), taking count that our field is 𝔽_{q^{2}} (not 𝔽_{q}) and g = q(q − 1)/2.

(d) Follows immediately from the preceding.

Remark 21.5. (a) Gross and Dummigan have obtained information on the Tate-Shafarevich group in the above, and a closely related, situation. For example, TS(E/K) is zero if q = p or p^{2}, and has cardinality at least p^{p^{3}(p−1)^{3}/2} if q = p^{3}.

(b) For q = 2, L is isomorphic to the lattice denoted D_{4}, for q = 3, to the Coxeter-Todd lattice K_{12}, and for q = 3 it is similar to the Leech lattice.

The best description of the work of Elkies and Shioda on the application of elliptic curves to sphere packings is Oesterlé’s Séminaire Bourbaki talk, 1989/90, no. 727 (published in Asterisque).

Exercise 21.6. Consider E : Y^{2}Z + Y Z^{2} = X^{3}.

(a) Show that E is a nonsingular curve over 𝔽_{2}.

(b) Compute #E(𝔽_{4}), 𝔽_{4} being the field with 4 elements.

(c) Let K be the field of fractions of the integral domain 𝔽_{4}[X, Y]/(X^{5} + Y^{5} + 1), and let L = E(K)/E(K)_{tors} considered as a lattice in V = L ⊗ ℝ endowed with the height pairing. Compute the rank of L, m(L), and γ(L).

[[This exercise is becomes more interesting when X^{5} + Y^{5} + 1 is replaced by X^{3} + Y^{3} + 1.]]

Solution to Exercise 16.10. There are detailed solutions in Knapp, p110–114. Consider the curve Y^{2} = X^{3} − 4X, and take α = −2, β = 0, γ = 2. Suppose P is a point of infinite order on E—we may assume P ∉ 2E(ℚ). The images of the 2-torsion points (−2, 0), (0, 0), (2, 0) under φ_{2} are (1, 1), (1, 0), and (0, 1). Since these fill out all possible nonzero values of φ_{2}, after possibly replacing a point P of infinite order by P + Q, 2Q = 0, φ_{2}(P) will be (0, 0). If φ_{∞}(P) ≠ 0 (i.e., φ_{∞}(P) ≠ (+, +)) then φ_{∞}(P) = (+, −), which means that

x + 2 = □, x = −□, x − 2 = −□

where P = (x : y : 1) and □ denotes a square. Subtracting the first two equations gives 2 = □ + □. If these squares have even denominators, one finds that

0 ≡ □ + □ mod 8

with both squares odd integers, which is impossible. Thus the squares x + 2 and x have odd denominators. Hence

2 = x − (x − 2) = −□ + □

where the first square (hence also the second) has odd denominator. On clearing denominators, one finds that

2m^{2} ≡ −□ + □ mod 8

with m odd and all terms integers. This is impossible. Hence φ_{∞}(P) = 0, and so P ∈ 2E(ℚ)—contradiction.

22. Algorithms for Elliptic Curves

The general Weierstrass equation of an elliptic curve E over a field k is

Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} = X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3}.

One attaches to the curve the following quantities:

b_{2} = a_{1}^{2} + 4a_{2}  c_{4} = b_{2}^{2} − 24b_{4}
b_{4} = a_{1}a_{3} + 2a_{4}  c_{6} = −b_{2}^{3} + 36b_{2}b_{4} − 216b_{6}
b_{6} = a_{3}^{2} + 4a_{6}  [Silverman (1st printing) p46
b_{8} = b_{2}a_{6} − a_{1}a_{3}a_{4} + a_{2}a_{3}^{2} − a_{4}^{2}  has c_{6} = +b_{2}^{3} + ⋯]
Δ = −b_{2}^{2}b_{8} − 8b_{4}^{3} − 27b_{6}^{2} + 9b_{2}b_{4}b_{6} j = c_{4}^{3}/Δ.

The curve is nonsingular if and only if Δ ≠ 0. The differential ω = \frac{dx}{2y+a_{1}x+a_{3}} is invariant under translation. A Weierstrass equation for an elliptic curve E is unique up to a coordinate transformation of the form

x = u^{2}x′ + r y = u^{3}y′ + su^{2}x′ + t , u, r, s, t ∈ k, u ≠ 0.

The quantities Δ, j, ω transform according to the rules:

u^{12}Δ′ = Δ, j′ = j, ω′ = uω.

Two curves become isomorphic over the algebraic closure of k if and only if they have the same j-invariant. When k has characteristic ≠ 2, 3, the terms involving a_{1}, a_{3}, a_{2} can be eliminated from the Weierstrass equation, and the above equations become those of (5.3).

A minimum Weierstrass equation for an elliptic curve E over ℚ is an equation of the above form with the a_{i} ∈ ℤ and Δ minimal. It is unique up to a coordinate transformation of the above form with r, s, t, u ∈ ℤ and u ∈ ℤ^{×} = {±1}.

There is an algorithm (due to Tate) for computing the minimum Weierstrass equation, discriminant, conductor, j-invariant, the fibres of its Néron model, etc. of an elliptic curve over ℚ, which has been implemented in computer programs, for example, in the program Pari, which is specifically designed for calculations in algebraic number theory (including elliptic curves). In the following, I explain how to use Pari as a supercalculator. You can also program it, but for that you will have to read the manual.

To start Pari on the Suns, type: gp (why, I don’t know).^{25} An elliptic curve is specified by giving a vector e=[a1,a2,a3,a4,a6] smallinitell(e) Computes the 13-component vector

[a_{1}, a_{2}, a_{3}, a_{4}, a_{5}, b_{1}, b_{4}, b_{6}, b_{8}, c_{4}, c_{6}, Δ, j]

addell(e,z1,z2) Computes the sum of the points z1=[x1,y2] and z2=[x2,y2].

In the following operations, e is usually required to be the output of smallinitell. globalred(e) Computes the vector [N,v] where N is the conductor of the curve and

v=[u,r,s,t] is the coordinate transformation giving the Weierstrass minimum model with a_{1} = 0 or 1, a_{2} = 0, 1, −1, and a_{3} = 0, 1. Such a model is unique.

chell(e,v) Changes e to e′, where e′ is the 13-component vector corresponding to the curve obtained by the change of coordinates v=[u,r,s,t].

Some of the remaining functions require the curve e to be in minimal Weierstrass form. anell(e,k) Computes the first k of the a_{n}’s for the curve (the coefficients of n^{−s} in the

Dirichlet series, e.g., for a good p, N_{p} = p + 1 − a_{p}).

apell(e,p) Computes a_{p}. hell(e,z) Computes the Néron-Tate canonical height of the point z on e. localred(e,p) Computes the type of the reduction at p using Kodaira’s notation ([S1,

p359]. It produces [f,n,...] where f is the exponent of p in the conductor of e, n = 1 means good reduction (type I_{0}), n = 2, 3, 4 means reduction of type II,III,IV, n = 4 + ν means type I_{ν}, and −1, −2 etc. mean I^{∗} II^{∗} etc..

lseriesell(e,s,N,A) Computes the L-series of e at s. Here N is ± the conductor depending on the sign of the functional equation (i.e., the w), and A is a cutoff point for the integral, which must be close to 1 for best speed (see the reference below).

pointell(e,z) Computes the coordinates [x,y] where x = ℘(z) and y = ℘′(z) (I think). powell(e,n,z) Computes n times the point z on e. To quit, type \q (supporting my conjecture that no two programs written by Unixphiles

terminate with the same command).

EXAMPLE: gp ? e=[0,-4,0,0,16] Defines the elliptic curve Y^{2} = X^{3} − 4X^{2} + 16 (see Exercise

19.12).

%1=[0,-4,0,0,16]
?  smallinitell(e)
%2=[0,-4,0,0,16,-16,0,64,-256,256,-9728,-45056,-4096/11] For  example,

Δ = −45056.

?  globalred(%2)

%3=[11, [2,0,0,4],1] Computes the minimum conductor and the change of coordinates required to give the minimal equation.

25Maybe Go Pari?

  ?  chell(%2,[2,0,0,4])
  %4=[0,-1,1,0,0,-4,0,1,-1,16,-152,-11,-4096/11]

Computes the minimal Weierstrass equation for E, Y^{2} + Y = X^{3} − X^{2}, which now has discriminant −11 but (of course) the same j-invariant.

  ?  anell(%4,13)
  %5=[1,-2,-1,2,1,2,-2,0,-2,-2,1,-2,4] In particular,

a_{p} =_{df} p + 1 − N_{p} = −1, 1, −2, 1, 4 for p = 3, 5, 7, 11, 13.

  ?  localred(%4,2)

%6 = [0,1,...] So E now has good reduction at 2.

  ?  localred(%4,11)

%6 = [1,5,...] So E has bad reduction at 11, with conductor 11^{1} (hence the singularity is a node), and the Kodaira type of the special fibre of the Néron model is I_{1}.

Pari is available (free!) by anonymous ftp from math.ucla.edu—it runs on PC’s and Macs. Henri Cohen, the main author of Pari, has also written the best book on computational algebraic number theory “A Course in Computational Algebraic Number Theory”, which explains most of the algorithms incorporated into Pari.

23. The Riemann Surfaces X_{0}(N)

We wish to understand the L-series of an elliptic curve E over ℚ, i.e., we wish to understand the sequence of numbers

N_{2}, N_{3}, N_{5}, N_{7}, …, N_{p}, … N_{p} = #E(𝔽_{p}).

There is no direct way of doing this. Instead, we shall see how the study of modular curves and modular forms leads to functions that are candidates for being the L-series of an elliptic curve over ℚ, and then we shall see how Wiles showed that the L-series of (almost all) elliptic curves over ℚ do arise from modular forms.

The notion of a Riemann surface. Let X be a connected Hausdorff topological space. A coordinate neighbourhood for X is a pair (U, z) with U an open subset of X and z a homeomorphism of U onto an open subset of the complex plane ℂ. Two coordinate neighbourhoods (U_{1}, z_{1}) and (U_{2}, z_{2}) are compatible if the function

z_{1} ∘ z_{2}^{−1} : z_{2}(U_{1} ∩ U_{2}) → z_{1}(U_{1} ∩ U_{2})

is holomorphic with nowhere vanishing derivative. A family of coordinate neighbourhoods (U_{i}, z_{i})_{i∈I} is a coordinate covering if X = ∪U_{i} and (U_{i}, z_{i}) is compatible with (U_{j}, z_{j}) for all pairs (i, j) ∈ I × I. Two coordinate coverings are said to be equivalent if the their union is also a coordinate covering. This defines an equivalence relation on the set of coordinate coverings, and we call an equivalence class a complex structure on X. A Hausdorff topological space X together with a complex structure is a Riemann surface.

Let U = (U_{i}, z_{i}) be a coordinate covering of X. A function f : U → ℂ on an open subset U of X is said to be holomorphic relative to U if f ∘ z_{i}^{−1} : z_{i}(U ∩ U_{i}) → ℂ is holomorphic for all i ∈ I. If f is holomorphic relative to one coordinate covering, then it is holomorphic relative to every equivalent covering, and so it will be said to be holomorphic for the complex structure on X.

Recall that a meromorphic function on an open subset U of ℂ is a holomorphic function f on U − Ξ for some discrete subset Ξ ⊂ U that has at worst a pole at each point of Ξ, i.e., such that for each a ∈ Ξ, there exists an m such that (z − a)^{m}f(z) is holomorphic in some neighbourhood of a. A meromorphic function on an open subset of a Riemann surface is defined similarly.

A map f : X → X′ from one Riemann surface to a second is holomorphic if g ∘ f is holomorphic whenever g is a holomorphic function on an open subset of X′. For this, it suffices to check that for every point P in X, there are coordinate neighbourhoods (U, z) of P and (U′, z′) of f(P) such that z′ ∘f ∘z^{−1} : z(U) → z′(U′) is holomorphic. An isomorphism of Riemann surfaces is a bijective holomorphic map whose inverse is also holomorphic.

Example 23.1. Any open subset of ℂ is a Riemann surface with a single coordinate neighbourhood—U itself with the identity function z.

Example 23.2. Let X be the unit sphere

S_{2} : X^{2} + Y^{2} + Z^{2} = 1

in ℝ^{3}, and let P be the north pole (0, 0, 1). Stereographic projection from P is a map

(x, y, z) ↦ \frac{x + iy}{1 − z} : X − P → ℂ.

Take this to be a coordinate neighbourhood for X. Stereographic projection from the south pole S gives a second coordinate neighbourhood. These two coordinate neighbourhoods define a complex structure on X, and X together with the complex structure is called the Riemann sphere.

Example 23.3. Let X = ℝ^{2}/ℤ^{2}. For any τ ∈ ℍ, the homeomorphism

(x, y) ↦ xτ + y : ℝ^{2}/ℤ^{2} → ℂ/ℤτ + ℤ

defines a complex structure on X. The Riemann surfaces corresponding to τ and τ′ are isomorphic if and only j(τ) = j(τ′) (see Section 10). In particular, this shows that there are uncountably many nonisomorphic complex structures on the topological space X.

Quotients of Riemann surfaces by group actions. We shall need to define Riemann surfaces as the quotients of other (simpler) Riemann surfaces by group actions. This can be quite complicated. The following examples will help.

Example 23.4. Let n ∈ ℤ act on ℂ by z ↦ z + n. Topologically ℂ/ℤ is a cylinder. We can give it a complex structure as follows: let π : ℂ → ℂ/ℤ be the quotient map; for any P ∈ ℂ/ℤ and Q ∈ f^{−1}(P) we can find open neighbourhoods U of P and V of Q such that π : U → V is a homeomorphism; take any such pair (U, π^{−1} : U → V) to be a coordinate function.

For any open U ⊂ ℂ/ℤ, a function f : U → ℂ is holomorphic for this complex structure if and only if f ∘ π is holomorphic. Thus the holomorphic functions f on U ⊂ ℂ/ℤ can be identified with the holomorphic functions g on π^{−1}(U) invariant under ℤ, i.e., such that g(z + 1) = g(z).

For example, q(z) = e^{2πiz} defines a holomorphic function on ℂ/ℤ. In fact, it gives an isomorphism ℂ/ℤ → ℂ^{×} whose in inverse ℂ^{×} → ℂ/ℤ is (by definition) (2πi)^{−1} · log.

Example 23.5. Let D be the open unit disk {z | |z| < 1}, and let Δ be a finite group acting on D. The Schwarz lemma implies that Aut(D) = {z ∈ ℂ | |z| = 1} ≈ ℝ/ℤ, and it follows that Δ is a finite cyclic group. Let z ↦ ζz be its generator and suppose that ζ has order m, i.e., ζ^{m} = 1. Then z^{m} is invariant under Δ, and so defines a function on Δ\D, which in fact is a homeomorphism Δ\D → D, and therefore defines a complex structure on Δ\D.

Let π : D → Δ\D be the quotient map. Then f ↦ f ∘π identifies the space of holomorphic functions on U ⊂ Δ\D with the space of holomorphic functions on π^{−1}(U) such that f(ζz) = f(z), i.e., which are of the form f(z) = h(z^{m}) with h holomorphic. Note that if π(Q) = P, then ord_{P} (f) = \frac{1}{m}ord_{Q}(f ∘ π).

Let Γ be a group acting on a Riemann surface X. A fundamental domain for Γ is a connected open subset D of X such that

(a) no two points of D lie in the same orbit of Γ;

(b) the closure D̄ of D contains at least one element from each orbit.

For example,

D = {z ∈ ℂ | 0 < ℜ(z) < 1}

is a fundamental domain for ℤ acting on ℂ (as in 23.4), and

D_{0} = {z ∈ D | 0 < arg z < π/n}

is a fundamental domain for ℤ/nℤ acting on the unit disk (as in 23.5).

The Riemann surfaces X(Γ). Let Γ be a subgroup of finite index in SL_{2}(ℤ). We want to define the structure of a Riemann surface on the quotient Γ\ℍ. This we can do, but the resulting surface will not be compact. Instead, we need to form a quotient Γ\ℍ^{∗} where ℍ^{∗} properly contains ℍ.

The action of SL_{2}(ℤ) on the upper half plane. Recall that SL_{2}(ℤ) acts on ℍ = {z | ℑ(z) > 0} according to

( \begin{matrix}a & b \\ c & d \end{matrix} ) z = \frac{az + b}{cz + d}.

Note that −I = ( \begin{matrix}−1 & 0 \\ 0 & −1 \end{matrix} ) acts trivially on ℍ, and so the action factors through

PSL_{2}(ℤ) = SL_{2}(ℤ)/{±I}.

Let

S = ( \begin{matrix}0 & −1 \\ 1 & 0 \end{matrix} ), so Sz = \frac{−1}{z},

and

T = ( \begin{matrix}1 & 1 \\ 0 & 1 \end{matrix} ), so T z = z + 1.

Then

S^{2} = 1, (ST)^{3} = 1 in PSL_{2}(ℤ).

Proposition 23.6. Let

D = \{z ∈ ℍ | |z| > 1, −\frac{1}{2} < ℜ(z) < \frac{1}{2}\} .

(a) D is a fundamental domain for SL_{2}(ℤ); moreover, two elements z and z′ of D̄ are in

the same orbit if and only if (i) ℜ(z) = ±\frac{1}{2} and z′ = z ± 1 (so z′ = T z or z = T z′); (ii) |z| = 1 and z′ = −1/z (= Sz).

(b) For z ∈ D̄, the stabilizer of z is ≠ {±I} if and only if z = i, in which case the stabilizer is <S>, or ρ = e^{2πi/6}, in which case the stabilizer is <T S>, or ρ^{2}, in which case it is <ST>.

(c) The group PSL_{2}(ℤ) is generated by S and T.

Proof. Let Γ′ =< S, T >. One first shows that Γ′D̄ = ℍ, from which (a) and (b) follow easily. For (c), let γ ∈ SL_{2}(ℤ), and choose a point z_{0} in D. There exists a γ′ in Γ′ such that γz_{0} = γ′z_{0}, and it follows from (b) that γ′γ^{−1} = ±I. For the details, see (Serre, Course on Arithmetic, VII.1.2).

Remark 23.7. Let Γ be a subgroup of finite index in SL_{2}(ℤ), and write

SL_{2}(ℤ) = Γγ_{1} ∪ … ∪ Γγ_{m} (disjoint union).

Then D′ = ∪γ_{i}D satisfies the conditions to be a fundamental domain for Γ, except that it won’t be connected. However, it is possible to choose the γ_{i} so that the closure of D′ is connected, in which case the interior of the closure will be a fundamental domain. for Γ.

The extended upper half plane. The elements of SL_{2}(ℤ) act on ℙ^{1}(ℂ) by projective linear transformations,

( \begin{matrix}a & b \\ c & d \end{matrix} ) (z_{1} : z_{2}) = (az_{1} + bz_{2} : cz_{1} + dz_{2}).

Identify ℍ, ℚ, and {∞} with subsets of ℙ^{1}(ℂ) according to

\begin{matrix}z & ↔ & (z : 1) & z ∈ ℍ \\ r & ↔ & (r : 1) & r ∈ ℚ \\ ∞ & ↔ & (1 : 0) \end{matrix} .

The action of SL_{2}(ℤ) stabilizes ℍ^{∗} =_{df} ℍ ∪ ℚ ∪ {∞}. For example, for z ∈ ℍ,

( \begin{matrix}a & b \\ c & d \end{matrix} ) (z : 1) = (az + b : cz + d) = (\frac{az + b}{cz + d} : 1)

as usual, and for r ∈ ℚ,

( \begin{matrix}a & b \\ c & d \end{matrix} ) (r : 1) = (ar + b : cr + d) = \{ \begin{matrix}(\frac{ar+b}{cr+d} : 1) & r ≠ −\frac{d}{c} \\ ∞ & r = −\frac{d}{c} \end{matrix} ,

and, finally,

( \begin{matrix}a & b \\ c & d \end{matrix} ) ∞ = (a : c) = \{ \begin{matrix}(\frac{a}{c} : 1) & c ≠ 0, \\ ∞ & c = 0 \end{matrix} .

Thus in passing from ℍ to ℍ^{∗}, we have added one additional SL_{2}(ℤ) orbit. The points in ℍ^{∗} not in ℍ are often called the cusps.

We make ℍ^{∗} into a topological space as follows: the topology on ℍ is that inherited from ℂ; the sets

{z | ℑ(z) > M}, M > 0

form a fundamental system of neighbourhoods of ∞; the sets

{z | |z − (a + ir)| < r} ∪ {a}

form a fundamental system of neighbourhoods of a ∈ ℚ. One shows that ℍ^{∗} is Hausdorff, and that the action of SL_{2}(ℤ) is continuous.

The topology on Γ\ℍ^{∗}. Recall that if π : X → Y is a surjective map and X is a topological space, then the quotient topology on Y is that for which a set U is open if and only of π^{−1}(U) is open. In general the quotient of a Hausdorff space by a group action will not be Hausdorff, even if the orbits are closed—one needs that distinct orbits have disjoint open neighbourhoods.

Let Γ be a subgroup of finite index in SL_{2}(ℤ). One can show that such a Γ acts properly discontinuously on ℍ, i.e., that for any pair of points x, y ∈ ℍ, there exist neighbourhoods U of x and V of y such that

{γ ∈ Γ | γU ∩ V ≠ ∅}

is finite. In particular, this implies that the stabilizer of any point in ℍ is finite (which we knew anyway).

Proposition 23.8. (a) For any compact sets A and B of ℍ, {γ ∈ Γ | γA ∩ B ≠ ∅} is

finite.

(b) Any z ∈ ℍ has a neighbourhood U such that

γU ∩ U ≠ ∅

only if γz = z.

(c) For any points x, y of ℍ not in the same Γ-orbit, there exist neighbourhoods U of x and V of y such that γU ∩ V = ∅ for all γ ∈ Γ

Proof. (a) This follows easily from the fact that Γ acts properly discontinuously.

(b) Let V be compact neighbourhood of z. From (a) we know that there is only a finite set {γ_{1}, …, γ_{n}} of Γ such that V ∩ γ_{i}V ≠ ∅. Let γ_{1}, …, γ_{s} be the γ_{i}’s fixing z, and for each i > s, choose disjoint neighbourhoods V_{i} of z and W_{i} of γ_{i}z, and set

U = V ∩ (∩_{i>s}V_{i} ∩ γ_{i}^{−1}W_{i}).

For i > s, γ_{i}U ⊂ W_{i}, which is disjoint from V_{i}, which contains U.

(c) Choose compact neighbourhoods A of x and B of y, and let γ_{1}, …, γ_{n} be the elements of Γ such that γ_{i}A ∩ B ≠ ∅. We know γ_{i}x ≠ y, and so we can find disjoint neighbourhoods U_{i} and V_{i} of γ_{i}x and y. Take

U = A ∩ γ_{1}^{−1}U_{1} ∩ … ∩ γ_{n}^{−1}U_{n}, V = B ∩ V_{1} ∩ … ∩ V_{n}.

Corollary 23.9. The space Γ\ℍ is Hausdorff.

Proof. Let x and y be points of ℍ not in the same Γ-orbit, and choose neighbourhoods U and V of x and y as in (c) of the last proposition. Then ΓU and ΓV are disjoint neighbourhoods of Γx and Γy.

In fact, Γ\ℍ^{∗} will be Hausdorff, and compact.

The complex structure on Γ_{0}(N)\ℍ^{∗}. The subgroups of SL_{2}(ℤ) that we shall be especially interested in are

Γ_{0}(N) = \{( \begin{matrix}a & b \\ c & d \end{matrix} )| c ≡ 0 mod N\} .

We let Γ_{0}(1) = SL_{2}(ℤ).

For z_{0} ∈ ℍ, choose a neighbourhood V of z_{0} such that

γV ∩ V ≠ ∅ ⟹ γz_{0} = z_{0},

and let U = π(V)—it is open because π^{−1}U = ∪γV is open.

If the stabilizer of z_{0} in Γ_{0}(N) is ±I, then π : V → U is a homeomorphism, with inverse φ say, and we require (U, φ) to be a coordinate neighbourhood.

If the stabilizer of z_{0} in Γ_{0}(N) is ≠ {±I}, then it is a cyclic group of order 2m with m = 2 or 3 (and its stabilizer in Γ_{0}(N)/{±I} has order 2 or 3)—see (23.6b). The fractional linear transformation

λ : ℍ → D, z ↦ \frac{z − z_{0}}{z − z̄_{0}} ,

carries z_{0} to 0 in the unit disk D. There is a well-defined map φ : U → ℂ such that φ(π(z)) = λ(z)^{n}, and we require (U, φ) to be a coordinate neighbourhood (cf. Example 23.5).

Next consider z_{0} = ∞. Choose V to be the neighbourhood {z | ℑ(z) > 2} of ∞, and let U = π(V). If

z ∈ V ∩ γV, γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ Γ_{0}(N),

then

2 ≤ ℑ(γz) = \frac{ℑ(z)}{|cz + d|^{2}} ≤ \frac{1}{|c|^{2}ℑ(z)} ≤ \frac{1}{2|c|^{2}}

and so c = 0. Therefore

γ = ± ( \begin{matrix}1 & m \\ 0 & 1 \end{matrix} ) ,

and so there is a well-defined map φ : U → ℂ such that φ(π(z)) = e^{2πiz}, and we require (U, φ) to be a coordinate neighbourhood (cf. Example 23.4).

For z_{0} ∈ ℚ, we choose a β ∈ SL_{2}(ℤ) such that β(z_{0}) = ∞, and proceed similarly.

Proposition 23.10. The coordinate neighbourhoods defined above are compatible, and therefore define on Γ_{0}(N)\ℍ^{∗} the structure of a Riemann surface.

Proof. Omitted.

Write X_{0}(N) for the Riemann surface Γ_{0}(N)\ℍ^{∗}, and Y_{0}(N) for its open subsurface Γ_{0}(N)\ℍ.

The genus of X_{0}(N). The genus of a Riemann surface can be computed by “triangulating” it, and using the formula

2 − 2g = V − E + F

where V is the number of vertices, E is the number of edges, and F is the number of faces. This, presumably, is the original definition of the genus. For example, the sphere may be triangulated by projecting out from a regular tetrahedron. Then V = 4, E = 6, and F = 4, so that g = 0 as expected.

Proposition 23.11. The Riemann surface X_{0}(1) has genus zero.

Proof. One gets a fake triangulation of the sphere by taking taking as vertices three points on the equator, and the upper and lower hemispheres as the faces. This gives the correct genus

2 = 3 − 3 + 2

but it violates the usual definition of a triangulation, which requires that any two triangles intersect in a single side, a single vertex, or not at all. It can be made into a valid triangulation by adding the north pole as a vertex, and joining it to the three vertices on the equator.

One gets a fake triangulation of X_{0}(1) by taking the three vertices ρ, i, and ∞ and the obvious curves joining them (two on the boundary of D and one the nimaginary axis from i to ∞). It can be turned into a valid triangulation by adding a fourth point not on any of these curves, and joining it to ρ, i, and ∞.

For a finite mapping π : Y → X of compact Riemann surfaces, the Hurwitz genus formula relates the two genuses:

2g_{Y} − 2 = (2g_{X} − 2)m + ∑_{Q∈Y} (e_{Q} − 1).

Here m is the degree of the mapping, so that π^{−1}(P) has m elements except for finitely many P, and e_{Q} is the ramification index, so that e_{Q} = 1 unless at least two sheets come together at Q above π(Q) in which case it is the number of such sheets.

For example, if E is the elliptic curve

E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, a, b ∈ ℂ, Δ ≠ 0,

and π is the map

∞ ↦ ∞, (x : y : z) ↦ (x : z) : E(ℂ) → ℙ^{1}(ℂ)

then m = 2 and e_{Q} = 1 except for Q = ∞ or one of the points of order 2 on E, in which case e_{Q} = 2. This is consistent with E(ℂ) having genus 1 and ℙ^{1}(ℂ) (the Riemann sphere) having genus 0.

The Hurwitz genus formula can be proved without too much difficulty by triangulating Y in such a way that the ramification points are vertices and such that the triangulation of Y lies over a triangulation of X.

Now one can compute the genus of X_{0}(N) by studying the quotient map X_{0}(N) → X_{0}(1). The only (possible) ramification points are those Γ_{0}(1)-equivalent to one of i, ρ, or ∞.

Explicit formulas can be found in Shimura, Arithmetic Theory of Automorphic Functions, pp23-25. For example, one finds that, for p a prime > 3,

genus(X_{0}(p)) = \{ \begin{matrix}n − 1 & if p = 12n + 1 \\ n & if p = 12n + 5, 12n + 7 \\ n + 1 & if p = 12n + 11. \end{matrix}

Moreover,

g = 0 if N = 1, …, 10, 12, 13, 16, 18, 25;
g = 1 if N = 11, 14, 15, 17, 19, 20, 21, 24, 27, 32, 36, 49
g = 2 if N = 22, 23, 26, 28, 29, 31, 37, 50.

Exercise 23.12. (a) For a prime p, show that the natural action of Γ_{0}(p) on ℙ^{1}(ℚ) has only two orbits, represented by 0 and ∞ = (1 : 0). Deduce that X_{0}(p) \ Y_{0}(p) has exactly two elements.

(b) Define Δ(z) = Δ(ℤz + ℤ) (see p51), so that Δ is a basis for the ℂ-vector space of cusp forms of weight 12 for Γ_{0}(1). Define Δ_{11}(z) = Δ(11z), and show that it is a cusp form of weight 12 for Γ_{0}(11). Deduce that Δ · Δ_{11} is a cusp form of weight 24 for Γ_{0}(11).

(c) Assume Jacobi’s formula:

Δ(z) = (2π)^{12}q ∏_{n=1}^{∞}(1 − q^{n})^{24},

(q = e^{2πiz}), and that S_{2}(Γ_{0}(11)) has dimension 1. Show that

F (z) = q ∏_{n=1}^{∞}(1 − q^{n})^{2}(1 − q^{11n})^{2},

is a cusp form of weight 2 for Γ_{0}(11). [Hint: Let f be a nonzero element of S_{2}(Γ_{0}(11)), and let g = Δ · Δ_{11}. Show that f^{12}/g is holomorphic on ℍ^{∗} and invariant under Γ_{0}(1), and is therefore constant (because the only holomorphic functions on a compact Riemann surface are the constant functions). The only real difficulty is in handling the cusp 0, since I have more-or-less ignored cusps other than ∞.]

24. X_{0}(N) as an Algebraic Curve over ℚ

In the last section, we defined compact Riemann surfaces X_{0}(N). A general theorem states that any compact Riemann surface X can be identified with the set of complex points of a unique nonsingular projective algebraic curve^{26} C over ℂ. However, in general C can’t be defined over ℚ (or even ℚ^{al})—consider for example a Riemann surface ℂ/Λ whose j-invariant is transcendental—and when C can be defined over ℚ, in general, it can’t be defined in any canonical way—consider an elliptic curve E over ℂ with j(E) ∈ ℚ.

In this section, we’ll see that X_{0}(N) has the remarkable property that it is the set of complex points of a canonical curve over ℚ.

26The inconsistency between “surface” and “curve” is due to the analysts inability to count.

Modular functions. For a connected compact Riemann surface X, the meromorphic functions on X form a field of transcendence degree 1 over ℂ.

For a subgroup Γ of finite index in SL_{2}(ℤ), the meromorphic functions on Γ\ℍ^{∗} are called the modular functions for Γ. If π : ℍ → Γ\ℍ^{∗} is the quotient map, then g ↦ π ∘ g identifies the modular functions for Γ with the functions f on ℍ such that

(a) f is meromorphic on ℍ;

(b) for any γ ∈ Γ, f(γz) = f(z);

(c) f is meromorphic at the cusps (i.e., at the points of ℍ^{∗} \ ℍ).

The meromorphic functions on X_{0}(1). Let S be the Riemann sphere S = ℂ ∪ {∞} (better, S = ℙ^{1}(ℂ) = 𝔸^{1}(ℂ) ∪ {(1 : 0)}. The meromorphic functions on S are the rational functions of z, and the automorphisms of S are the fractional-linear transformations,

z ↦ \frac{az + b}{cz + d}, a, b, c, d ∈ ℂ, ad − bc ≠ 0.

In fact, Aut(S) = PGL_{2}(ℂ) =_{df} GL_{2}(ℂ)/ℂ^{×}. Moreover, given two sets {P_{1}, P_{2}, P_{3}} and {Q_{1}, Q_{2}, Q_{3}} of distinct points on S, there is a unique fractional-linear transformation sending each P_{i} to Q_{i}. (The proof of the last statement is an easy exercise in linear algebra: given two sets {L_{1}, L_{2}, L_{3}} and {M_{1}, M_{2}, M_{3}} of distinct lines through the origin in ℂ^{2}, there is a linear transformation carrying each L_{i} to M_{i}, and the linear transformation is unique up to multiplication by a nonzero constant.)

We use ∞, i, and ρ to denote also the images of these points on X_{0}(1).

Proposition 24.1. There exists a unique meromorphic function J on X_{0}(1) that is holomorphic except at ∞, where it has a simple pole, and takes the values

J(i) = 1, J(ρ) = 0.

Moreover, the meromorphic functions on X_{0}(1) are the rational functions of J.

Proof. We saw in the last section that X_{0}(1) is isomorphic (as a Riemann surface) to the Riemann sphere S. Let f : X_{0}(1) → S be an isomorphism, and let P, Q, R be the images of ρ, i, ∞. There is a unique fractional-linear transformation L sending P, Q, R to 0, 1, ∞, and the composite L ∘ f has the required properties. If J′ is a second such function, then the composite J′ ∘ J^{−1} is an automorphism of S fixing 0, 1, ∞, and so is the identity map. Under this isomorphism, the function z on S corresponds to the function J on X_{0}(1).

In minor disagreement with the notation in Section 10, I write

G_{2k}(Λ) = ∑_{ω∈Λ,ω≠0} \frac{1}{ω^{2k}} ,

for a lattice Λ ⊂ ℂ, and

G_{2k}(z) = G_{2k}(ℤz + ℤ), g_{4}(z) = 60G_{4}(z), g_{6}(z) = 140G_{6}(z), z ∈ ℍ.

Then (℘, ℘′) maps ℂ/ℤz + ℤ onto the elliptic curve

Y^{2}Z = 4X^{3} − g_{4}(z)XZ^{2} − g_{6}(z)Z^{3}, Δ = g_{4}(z)^{3} − 27g_{6}(z)^{2} ≠ 0,

whose j-invariant is

j(z) = \frac{1728g_{4}(z)^{3}}{Δ} .

From their definitions, it is clear that G_{2k}(z), Δ(z), and j(z) are invariant under T : z ↦ z+1, and so can be expressed in terms of the variable q = e^{2πiz}. In Serre, Cours d’Arithmétique, VII, one can find the following expansions:

G_{2k}(z) = 2ζ(2k) + \frac{2(2πi)^{2k}}{(2k − 1)!} ∑_{n=1}^{∞} σ_{2k−1}(n)q^{n}, σ_{k}(n) = ∑_{d|n} d^{k},
Δ = (2π)^{12}(q − 24q^{2} + 252q^{3} − 1472q^{4} + ⋯),
j = \frac{1}{q} + 744 + 196884q + 21493760q^{2} + ∑_{n=3}^{∞} c(n)q^{n}, c(n) ∈ ℤ.

The proof of the formula for G_{2k}(z) is elementary, and the others follow from it together with elementary results on ζ(2k). The factor 1728 was traditionally included in the formula for j so that it has residue 1 at infinity.

The function j is invariant under SL_{2}(ℤ), because j(z) depends only on the lattice ℤz +ℤ. Moreover:

j(ρ) = 0, because ℂ/ℤρ + ℤ has complex multiplication by ρ^{2} = \sqrt[3]{1}, and therefore is of the form Y^{2} = X^{3} + b, which has j-invariant 0. j(i) = 1728, because ℂ/ℤi + ℤ has complex multiplication by i, and therefore is of the form Y^{2} = X^{3} + aX.

Consequently j = 1728J, and the field of meromorphic functions on X_{0}(N) is ℂ(j).

The meromorphic functions on X_{0}(N). Define j_{N} to be the function on ℍ such that j_{N}(z) = j(Nz). For γ ∈ Γ_{0}(1), one is tempted to say

j_{N}(γz) = j(Nγz) = j(γNz) = j(Nz) = j_{N}(z),

but, this is false in general, because Nγz ≠ γNz. However, it is true that j_{N}(γz) = j_{N}(z) if

γ ∈ Γ_{0}(N). In fact, let γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ Γ_{0}(N), so that c = Nc′ with c′ ∈ ℤ. Then

j_{N}(γz) = j(\frac{Naz + Nb}{cz + d}) = j(\frac{a(Nz) + Nb}{c′(Nz) + d}) = j(γ′Nz)

where γ′ = ( \begin{matrix}a & Nb \\ c′ & b \end{matrix} ) ∈ Γ_{0}(1), so

j(γ′Nz) = j(Nz) = j_{N}(z).

Thus, we see that j_{N} is invariant under Γ_{0}(N), and therefore defines a meromorphic function on X_{0}(N).

Theorem 24.2. The field of meromorphic functions on X_{0}(N) is ℂ(j, j_{N}).

Proof. The curve X_{0}(N) is a covering of X_{0}(1) of degree m = (Γ_{0}(1) : Γ_{0}(N)). The general theory implies that the field of meromorphic functions on X_{0}(N) has degree m over ℂ(j), but we shall prove this again. Let {γ_{1} = 1, ..., γ_{m}} be a set of representatives for the right cosets of Γ_{0}(N) in Γ_{0}(1), so that,

Γ_{0}(1) = ⋃_{i=1}^{m} Γ_{0}(N)γ_{i} (disjoint union).

For any γ ∈ Γ_{0}(1), {γ_{1}γ, ..., γ_{m}γ} is also a set of representatives for the right cosets of Γ_{0}(N) in Γ_{0}(1)—the family (Γ_{0}(N)γ_{i}γ) is just a permutation of the family (Γ_{0}(N)γ_{i}).

If f(z) is a modular function for Γ_{0}(N), then f(γ_{i}z) depends only on the coset Γ_{0}(N)γ_{i}. Hence the functions {f(γ_{i}γz)} are a permutation of the functions {f(γ_{i}z)}, and any symmetric polynomial in the f(γ_{i}z) is invariant under Γ_{0}(1); since such a polynomial obviously satisfies the other conditions, it is a modular function for Γ_{0}(1), and hence a rational function of j. Therefore f(z) satisfies a polynomial of degree m with coefficients in ℂ(j), namely, ∏(Y − f(γ_{i}z)). Since this holds for every meromorphic function on X_{0}(N), we see that the field of such functions has degree at most m over ℂ(j).

Next I claim that all the f(γ_{i}z) are conjugate to f(z) over ℂ(j): for let F (j, Y) be the minimum polynomial of f(z) over ℂ(j), so that F (j, Y) is monic and irreducible when regarded as a polynomial in Y with coefficients in ℂ(j); on replacing z with γ_{i}z and remembering that j(γ_{i}z) = j(z), we find that F (j(z), f(γ_{i}z)) = 0, which proves the claim.

If we can show that the functions j(Nγ_{i}z) are distinct, then it will follow that the minimum polynomial of j_{N} over ℂ(j) has degree m, and that the field of meromorphic functions on X_{0}(N) has degree m over ℂ(j), and is generated by j_{N}.

Suppose j(Nγ_{i}z) = j(Nγ_{j}z) for some i ≠ j. Recall that j defines an isomorphism Γ_{0}(1)\ℍ^{∗} → S (Riemann sphere), and so

j(Nγ_{i}z) = j(Nγ_{j}z)all z ⟹ ∃γ ∈ Γ_{0}(1) such that Nγ_{i}z = γNγ_{j}z all z,

and this implies that

( \begin{matrix}N & 0 \\ 0 & 1 \end{matrix} ) γ_{i} = ±γ ( \begin{matrix}N & 0 \\ 0 & 1 \end{matrix} ) γ_{j}.

Hence γ_{i}γ_{j}^{−1} ∈ Γ_{0}(1) ∩ ( \begin{matrix}N & 0 \\ 0 & 1 \end{matrix} )^{−1} Γ_{0}(1) ( \begin{matrix}N & 0 \\ 0 & 1 \end{matrix} ) = Γ_{0}(N), which contradicts the fact

that γ_{i} and γ_{j} lie in different cosets.

We saw in the proof that the minimum polynomial of j_{N} over ℂ(j) is

F (j, Y) = ∏_{i=1}^{m}(Y − j(Nγ_{i}z)).

The symmetric polynomials in the j(Nγ_{i}z) are holomorphic on ℍ. As they are rational functions of j(z), they must in fact be polynomials in j(z), and so F_{N}(j, Y) ∈ ℂ[j, Y] (rather than ℂ(j)[Y]).

On replacing j with the variable X, we obtain a polynomial F_{N}(X, Y) ∈ ℂ[X, Y],

F_{N}(X, Y) = ∑ c_{r,s}X^{r}Y^{s}, c_{r,s} ∈ ℂ, c_{0,m} = 1.

I claim that F_{N}(X, Y) is the unique polynomial of degree ≤ m in Y, with c_{0,m} = 1, such that

F_{N}(j, j_{N}) = 0.

In fact, F_{N}(X, Y) generates the ideal in ℂ[X, Y] of all polynomials G(X, Y) such that G(j, j_{N}) = 0, from which the claim follows.

Proposition 24.3. The polynomial F_{N}(X, Y) has coefficients in ℚ.

Proof. We know that

j(z) = q^{−1} + ∑_{n=0}^{∞} c(n)q^{n}, c(n) ∈ ℤ.

When we substitute this into the equation

F (j(z), j(Nz)) = 0,

and equate coefficients of powers of q, we obtain a set of linear equations for the c_{r,s} with coefficients in ℚ, and when we adjoin the equation

c_{0,m} = 1,

then the system determines the c_{r,s} uniquely. Because the system of linear equations has a solution in ℂ, it also has a solution in ℚ (look at ranks of matrices); because the solution is unique, the solution in ℂ must in fact lie in ℚ. Therefore c_{r,s} ∈ ℚ.

The polynomial F_{N}(X, Y) was introduced by Kronecker more than 100 years ago. It is known to be symmetric in X and Y. For N = 2, it is

X^{3} + Y^{3} − X^{2}Y^{2} + 1488XY (X + Y) − 162000(X^{2} + Y^{2})+
40773375XY + 8748000000(X + Y) − 157464000000000.

It was computed for N = 3, 5, 7 by Smith (1878), Berwick (1916), and Herrmann (1974). At this point the humans gave up, and left it to MACSYMA to compute F_{11} (1984). This last computation took about 20 hours on a VAX-780, and the result is a polynomial with coefficients up to 10^{60} that takes 5 pages to write out. It is important to know that the polynomial exists; fortunately, it is not important to know what it is.

The curve X_{0}(N) over ℚ. Let C_{N} be the affine curve over ℚ with equation F_{N}(X, Y) = 0, and let C̄_{N} be the projective curve defined by F_{N} made homogeneous. Then z ↦ (j(z), j(Nz)) is a map X_{0}(N) \ Ξ → C_{N}(ℂ), where Ξ is the set where j or j_{N} has a pole. This map extends uniquely to a map X_{0}(N) → C̄_{N}(ℂ), which is an isomorphism except over the singular points of C̄_{N}, and the pair (X_{0}(N), X_{0}(N) → C̄_{N}(ℂ)) is uniquely determined by C̄_{N} (up to a unique isomorphism): it is the canonical “desingularization” of C̄_{N} over ℂ.

Now consider C̄_{N} over ℚ. There is a canonical desingularization X → C̄_{N} over ℚ, i.e., a projective nonsingular curve X over ℚ, and a regular map X → C̄_{N} that is an isomorphism except over the singular points of C̄_{N}, and the pair (X, X → C̄_{N}) is uniquely determined by C̄_{N} (up to unique isomorphism). When we pass to the ℂ-points, we see that (X(ℂ), X(ℂ) → C̄_{N}(ℂ)) has the property characterizing (X_{0}(N), X_{0}(N) → C̄_{N}(ℂ)), and so there is a unique isomorphism of Riemann surfaces X_{0}(N) → X(ℂ) compatible with the maps to C̄_{N}(ℂ).

In summary, we have a well-defined curve X over ℚ, a regular map γ : X → C̄_{N} over ℚ, and an isomorphism X_{0}(N) → X(ℂ) whose composite with γ(ℂ) is (outside a finite set) z ↦ (j(z), j(Nz)).

In future, we’ll often use X_{0}(N) to denote the curve X over ℚ—it should be clear from the context whether we mean the curve over ℚ or the Riemann surface. The affine curve X_{0}(N) \ {cusps} ⊂ X_{0}(N) is denoted Y_{0}(N); thus Y_{0}(N)(ℂ) = Γ_{0}(1)\ℍ.

Remark 24.4. It is known that the curve F_{N}(X, Y) = 0 is highly singular, because, in the absence of singularities, the formula on p9 would predict much too high a genus.

The points on the curve X_{0}(N). Since we can’t write down an equation for X_{0}(N) as a projective curve over ℚ, we would at least like to know what its points are in any field containing ℚ. This we can do.

We first look at the complex points of X_{0}(N), i.e., at the Riemann surface X_{0}(N). Consider the diagram:

{(E, S)}/≈ ↔ {(Λ, S)}/ℂ^{×} ↔ Γ_{0}(N)\M/ℂ^{×} ↔ Γ_{0}(N)\ℍ
↓  ↓  ↓  ↓
{E}/≈ ↔  L/ℂ^{×}  ↔ Γ_{0}(1)\M/ℂ^{×} ↔ Γ_{0}(1)\ℍ

The bottom row combines maps in Section 10. All the symbols ↔ are natural bijections.

Recall that M is the subset of ℂ×ℂ of pairs (ω_{1}, ω_{2}) such that ℑ(ω_{1}/ω_{2}) > 0 (so M/ℂ^{×} ⊂ ℙ^{1}(ℂ)), and that the bijection M/ℂ → ℍ sends (ω_{1}, ω_{2}) to ω_{1}/ω_{2}. The rest of the right hand square is now obvious.

Recall that the L is the set of lattices in ℂ, and that the lattices defined by two pairs in M are equal if and only if the pairs lie in the same Γ_{0}(1)-orbit. Thus in passing from an element of M to its Γ_{0}(1)-orbit we are forgetting the basis and remembering only the lattice. In passing from an element of M to its Γ_{0}(N)-orbit, we remember a little of the basis, for suppose

( \begin{matrix}ω′_{1} \\ ω′_{2} \end{matrix} ) = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ( \begin{matrix}ω_{1} \\ ω_{2} \end{matrix} ) , ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ Γ_{0}(N).

Then

ω′_{1} = aω_{1} + bω_{2}
ω′_{2} = cω_{1} + dω_{2} ≡ dω_{2} mod NΛ.

Hence

\frac{1}{N} ω′_{2} ≡ \frac{d}{N} ω_{2} mod Λ.

Note that because ( \begin{matrix}a & b \\ c & d \end{matrix} ) has determinant 1, gcd(d, N) = 1, and so \frac{1}{N} ω′_{2} and \frac{1}{N} ω_{2} generate

the same cyclic subgroup S of order N in ℂ/Λ. We see that the map

(ω_{1}, ω_{2}) ↦ (Λ(ω_{1}, ω_{2}), <\frac{1}{N} ω_{2}>)

defines a bijection from Γ_{0}(N)\M to the set of pairs consisting of a lattice Λ in ℂ and a cyclic subgroup S of ℂ/Λ of order N. Now (Λ, S) ↦ (ℂ/Λ, S) defines a one-to-one correspondence between this last set and the set of isomorphism classes of pairs (E, S) consisting of an elliptic curve over ℂ and a cyclic subgroup S of E(ℂ) of order N. An isomorphism (E, S) → (E′, S′) is an isomorphism E → E′ carrying S into S′.

Note that E/S = ℂ/Λ(ω_{1}, \frac{1}{N} ω_{2}) ↔ N \frac{ω_{1}}{ω_{2}} , and so, if j(E) = j(z), then j(E/S) = j(Nz). Now, for any field k ⊃ ℚ, define E_{0}(N)(k) to be the set of isomorphism classes of pairs E

consisting of an elliptic curve E over k and a cyclic subgroup S ⊂ E(k^{al}) of order N stable under Gal(k^{al}/k)—thus the subgroup S is defined over k, but not necessarily its elements. The above remarks show that there is a canonical bijection

E_{0}(N)(ℂ)/≈→ Y_{0}(N)

whose composite with the map Y_{0}(N) → C_{N}(ℂ) is (E, S) ↦ (j(E), j(E/S)). Here Y_{0}(N) denotes the Riemann surface Γ_{0}(N)\ℍ.

Theorem 24.5. For any field k ⊃ ℚ, there is a map

E_{0}(N)(k) → Y_{0}(N)(k),

functorial in k, such that

(a) the composite E_{0}(N)(k) → Y_{0}(N)(k) → C_{N}(k) is (E, S) ↦ (j(E), j(E/S));

(b) for all k, E_{0}(N)(k)/≈ → Y_{0}(N)(k) is surjective, and for all algebraically closed k it is bijective.

The map being functorial in k means that for every homomorphism σ : k → k′ of fields, the diagram

E_{0}(N)(k′) → Y_{0}(N)(k′)
↑ σ  ↑ σ
E_{0}(N)(k) → Y_{0}(N)(k)

commutes. In particular, E_{0}(N)(k^{al}) → Y_{0}(N)(k^{al}) commutes with the actions of Gal(k^{al}/k). Since Y_{0}(N)(k^{al})^{Gal(k^{al}/k)} = Y_{0}(N)(k), this implies that

Y_{0}(N)(k) = (E_{0}(N)(k^{al})/≈)^{Gal(k^{al}/k)}

for any field k ⊃ ℚ.

This description of the points can be extended to X_{0}(N) by adding to E_{0}(N) certain “degenerate” elliptic curves.

Variants. For our applications to elliptic curves, we shall only need to use the quotients of ℍ^{∗} by the subgroups Γ_{0}(N), but quotients by other subgroups are also of interest. For example, let

Γ_{1}(N) = \{( \begin{matrix}a & b \\ c & d \end{matrix} )| a ≡ 1 ≡ d mod N, c ≡ 0 mod N\} .

The quotient X_{1}(N) = Γ_{1}(N)\ℍ^{∗} again defines a curve, also denoted X_{1}(N), over ℚ, and there is a theorem similar to (24.5) but with E_{1}(N)(k) the set of pairs (E, P) consisting of an elliptic curve E over k and a point P ∈ E(k) of order N.

In this case, the map

E_{1}(N)(k)/≈ → Y_{1}(N)(k)

is a bijection whenever 4|N. The curve X_{1}(N) has genus 0 exactly for N = 1, 2, …, 10, 12. Since X_{1}(N) has a point with coordinates in ℚ for each of these N (there does exist an elliptic curve over ℚ with a point of that order), X_{1}(N) ≈ ℙ^{1}, and so X_{1}(N) has infinitely many rational points. Therefore, for N = 1, 2, …, 10, 12, there are infinitely many elliptic curves over ℚ with a point of order N (rational over ℚ). Mazur showed, that for all other N, Y_{0}(N) is empty, and so these are the only possible orders for a point on an elliptic curve over ℚ (Conjecture of Beppo Levi).

25. Modular Forms

It is difficult to construct functions on ℍ invariant under a subgroup Γ of SL_{2}(ℤ) of finite index. One strategy is to construct functions, not invariant under Γ, but transforming in a certain fixed manner. Two functions transforming in the same manner will be invariant under Γ. This idea suggests the notion of a modular form.

Definition of a modular form.

Definition 25.1. Let Γ be a subgroup of finite index in SL_{2}(ℤ). A modular form for Γ of weight^{27} 2k is a function f : ℍ → ℂ such that

(a) f is holomorphic on ℍ;

(b) for any γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ Γ, f(γz) = (cz + d)^{2k}f(z);

(c) f is holomorphic at the cusps.

Recall that the cusps are the points in ℍ^{∗} not in ℍ. Since Γ is of finite index in SL_{2}(ℤ),

T^{h} = ( \begin{matrix}1 & h \\ 0 & 1 \end{matrix} ) is in Γ for some integer h > 0, which we may take to be as small as possible.

Then condition (b) implies that f(T^{h}z) = f(z), i.e., that f(z + h) = f(z), and so

f(z) = f^{∗}(q), q = e^{2πiz/h},

and f^{∗} is a function on a neighbourhood of 0 ∈ ℂ, with 0 removed. To say that f is holomorphic at ∞ means that f^{∗} is holomorphic at 0, and so

f(z) = ∑_{n≥0} c(n)q^{n}, q = e^{2πiz/h}.

For a cusp r ≠ ∞, choose a γ ∈ SL_{2}(ℤ) such that γ(∞) = r, and then the requirement is that f ∘ γ be holomorphic at ∞. It suffices to check the condition for only one cusp in each Γ-orbit.

A modular form is called a cusp form if it is zero at the cusps. For example, for the cusp ∞ this means that

f(z) = ∑_{n≥1} c(n)q^{n}, q = e^{2πiz/h}.

Remark 25.2. Note that, for γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ SL_{2}(ℤ),

dγz = d\frac{az + b}{cz + d} = \frac{a(cz + d) − c(az + b)}{(cz + d)^{2}}dz = (cz + d)^{−2}dz.

Thus condition (25.1b) says that f(z)(dz)^{k} is invariant under the action of Γ.

Write M_{2k}(Γ) for the vector space of modular forms of weight 2k, and S_{2k}(Γ) for the subspace^{28} of cusp forms. A modular form of weight 0 is a holomorphic modular function (i.e., a holomorphic function on the compact Riemann surface X(Γ)), and is therefore constant: M_{0}(Γ) = ℂ. The product of modular forms of weight 2k and 2k′ is a modular form of weight 2(k +k′), which is a cusp form if one of the two forms is a cusp form. Therefore ⊕_{k≥0}M_{2k}(Γ) is a graded ℂ-algebra.

Proposition 25.3. Let π be the quotient map ℍ^{∗} → Γ_{0}(N)\ℍ^{∗}, and for any holomorphic differential ω on Γ_{0}(N)\ℍ^{∗}, set π^{∗}ω = fdz. Then ω ↦ f is an isomorphism from the space of holomorphic differentials on Γ_{0}(N)\ℍ^{∗} to S_{2}(Γ_{0}(N)).

27k and −k are also used.

28The S is for “Spitzenform”, the German name for cusp form. The French call them “forme parabolique”.

Proof. The only surprise is that f is necessarily a cusp form rather than just a modular form. I explain what happens at ∞. Recall (p122) that there is a neighbourhood U of ∞ in Γ_{0}(N)\ℍ^{∗} and an isomorphism q : U → D (some disk) such that q ∘ π = e^{2πiz}. Consider the differential g(q)dq on U. Its inverse image on ℍ is

g(e^{2πiz})d(e^{2πiz}) = 2πi · g(e^{2πiz}) · e^{2πiz}dz = 2πifdz

where f(z) = g(e^{2πiz}) · e^{2πiz}. If g is holomorphic at 0, then g(q) = ∑_{n≥0} c(n)q^{n}, and so the q-expansion of f is q ∑_{n≥0} c(n)q^{n}, which is zero at ∞.

Corollary 25.4. The ℂ-vector space S_{2}(Γ_{0}(N)) has dimension equal to the genus of X_{0}(N).

Proof. It is part of the theory surrounding the Riemann-Roch theorem that the holomorphic differential forms on a compact Riemann surface form a vector space equal to the genus of the surface.

Hence, there are explicit formulas for the dimension of S_{2}(Γ_{0}(N))—see p123. For example, it is zero for N ≤ 10, and has dimension 1 for N = 11. In fact, the Riemann-Roch theorem gives formulas for the dimension of S_{2k}(Γ_{0}(N)) for all N.

The modular forms for Γ_{0}(1). In this section, we find the ℂ-algebra ⊕_{k≥0}M_{2k}(Γ_{0}(1)).

We first explain a method of constructing functions satisfying (25.1b). As before, let L be the set of lattices in ℂ, and let F : L → ℂ be a function such that

F (λΛ) = λ^{−2k}F (Λ), λ ∈ ℂ, Λ ∈ L.

Then

ω_{2}^{2k}F (Λ(ω_{1}, ω_{2}))

depends only on the ratio ω_{1} : ω_{2}, and so there is a function f(z) defined on ℍ such that

ω_{2}^{2k}F (Λ(ω_{1}, ω_{2})) = f(ω_{1}/ω_{2}), whenever ℑ(ω_{1}/ω_{2}) > 0.

For γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ SL_{2}(ℤ), Λ(aω_{1} + bω_{2}, cω_{1} + dω_{2}) = Λ(ω_{1}, ω_{2}) and so

f(\frac{az + b}{cz + d}) = (cz + d)^{−2k}F (Λ(z, 1)) = (cz + d)^{−2k}f(z).

When we apply this remark to the Eisenstein series

G_{2k}(Λ) = ∑_{ω∈Λ,ω≠0} \frac{1}{ω^{2k}} ,

we find that the function G_{2k}(z) =_{df} G_{2k}(Λ(z, 1)) satisfies (25.1b). In fact:

Proposition 25.5. For all k > 1, G_{2k}(z) is a modular form of weight 2k for Γ_{0}(1), and Δ is a cusp form of weight 12.

Proof. We know that G_{2k}(z) is holomorphic on ℍ, and the formula on p125 shows that it is holomorphic at ∞, which is the only cusp for Γ_{0}(1) (up to Γ_{0}(1)-equivalence). The statement for Δ is obvious from its definition Δ = g_{4}(z)^{3} − 27g_{4}(z)^{2}, and its q-expansion (p125).

Theorem 25.6. The ℂ-algebra ⊕_{k≥0}M_{2k}(Γ_{0}(1)) is generated by G_{4} and G_{6}, and G_{4} and G_{6} are algebraically independent over ℂ. Therefore

ℂ[G_{4}, G_{6}] ⟶^{≈} ⊕_{k≥0}M_{2k}(Γ_{0}(1)), ℂ[G_{4}, G_{6}] ≈ ℂ[X, Y]

(isomorphisms of graded ℂ-algebras if X and Y are given weights 4 and 6 respectively). Moreover,

f ↦ f · Δ : M_{2k−12}(Γ_{0}(1)) → S_{2k}(Γ_{0}(1))

is a bijection.

Proof. Straightforward—see Serre, Cours..., VII.3.2.

Therefore, for k ≥ 0,

dim M_{2k}(Γ_{0}(N)) = \{ \begin{matrix}[k/6] & if k ≡ 1 mod 6 \\ [k/6] + 1 & otherwise. \end{matrix}

Here [x] is the largest integer ≤ x.

Theorem 25.7 (Jacobi). There is the following formula:

Δ = (2π)^{12}q ∏_{n=1}^{∞}(1 − q^{n})^{24}, q = e^{2πiz}.

Proof. Let

F (z) = q ∏_{n=1}^{∞}(1 − q^{n})^{24}.

From the theorem, we know that the space of cusp forms of weight 12 has dimension 1, and therefore if we can show that F (z) is such a form, then we’ll know it is a multiple of Δ, and it will be follow from the formula on p125 that the multiple is (2π)^{12}.

Because SL_{2}(ℤ)/\{±I\} is generated by T = ( \begin{matrix}1 & 1 \\ 0 & 1 \end{matrix} ) and S = ( \begin{matrix}0 & −1 \\ 1 & 0 \end{matrix} ), to verify the

conditions in (25.1), it suffices to verify that F transforms correctly under T and S. For T this is obvious from the way we have defined F, and for S it amounts to checking that

F (−\frac{1}{z}) = z^{12}F (z).

This is trickier than it looks, but there are short (2 page) elementary proofs—see for example, Serre, ibid., VII.4.4.

26. Modular Forms and the L-series of Elliptic Curves

In this section, I’ll discuss how the L-series classify the elliptic curves over ℚ up to isogeny, and then I’ll explain how the work of Hecke, Petersson, and Atkin-Lehner leads to a list of candidates for the L-series of such curves, and hence suggests a classification of the isogeny classes.

Dirichlet Series. A Dirichlet series is a series of the form

f(s) = ∑_{n≥1} a(n)n^{−s}, a(n) ∈ ℂ, s ∈ ℂ.

The simplest example of such a series is, of course, the Riemann zeta function ∑_{n≥1} n^{−s}. If there exist positive constants A and b such that | ∑_{n≤x} a(n)| ≤ Ax^{b} for all large x, then the series for f(s) converges to an analytic function on the half-plane ℜ(s) > b.

It is important to note that the function f(s) determines the a(n)’s, i.e., if ∑ a(n)n^{−s} and ∑ b(n)n^{−s} are equal as functions of s on some half-plane, then a(n) = b(n) for all n. In fact, by means of the Mellin transform and its inverse (see 26.4 below), f determines, and is determined by, a function g(q) convergent on some disk about 0, and g(q) = ∑ a(n)q^{n}.

We shall be especially interested in Dirichlet series that are equal to Euler products, i.e., those that can be expressed as

f(s) = ∏_{p} \frac{1}{1 − P_{p}(p^{−s})}

where each P_{p} is a polynomial.

Dirichlet series arise in two essentially different ways: from analysis and from geometry and number theory. One of big problems mathematics is to show that the second set of Dirichlet series is a subset of the first, and to identify the subset. This is a major theme in Langlands’s philosophy, and the rest of the course will be concerned with explaining how Wiles was able to identify the L-series of (almost all) elliptic curves over ℚ with certain L-series attached to modular forms.

The L-series of an elliptic curve. Recall that for an elliptic curve E over ℚ, we define

L(E, s) = ∏_{p good} \frac{1}{1 − a_{p}p^{−s} + p^{1−s}} · ∏_{p bad} \frac{1}{1 − a_{p}p^{−s}}

where

a_{p} = \{ \begin{matrix}p + 1 − N_{p} & p good; \\ 1 & p split nodal; \\ −1 & p nonsplit nodal; \\ 0 & p cuspidal. \end{matrix}

Recall also that the conductor N = N_{E/ℚ} of ℚ is ∏_{p} p^{f_{p}} where f_{p} = 0 if E has good reduction at p, f_{p} = 1 if E has nodal reduction at p, and f_{p} ≥ 2 otherwise (and = 2 unless p = 2, 3).

On expanding out the product (cf. below), we obtain a Dirichlet series

L(E, s) = ∑ a_{n}n^{−s}.

This series has, among others, the following properties:

(a) (Rationality) Its coefficients a_{n} lie in ℚ.

(b) (Euler product) It can be expressed as an “Euler product”; in fact, that’s how it is defined.

(c) (Functional equation) Conjecturally it can be extended analytically to a meromorphic function on the whole complex plane that satisfies the functional equation

Λ(E, s) = wΛ(E, 2 − s), w = ±1,

where Λ(E, s) = N_{E/ℚ}^{s/2}(2π)^{−s}Γ(s)L(E, s).

L-series and isogeny classes. Recall that two elliptic curves E and E′ are said to be isogenous if there is a nonconstant regular map from one to the other. By composing the map with a translation, we will then get a map sending 0 to 0, in which case it will also be a homomorphism for the group structures on E and E′. A nonconstant map φ : E → E′ such that φ(0) = 0 is called an isogeny.

Lemma 26.1. Isogeny is an equivalence relation.

Proof. The identity map is an isogeny, so it is reflexive, and the composite of two isogenies is an isogeny, so it is transitive. Let φ : E → E′ be an isogeny, and let S be its kernel. Since S is finite, it will be contained in E_{n} for some n, and there are isogenies

E → E/S → E/E_{n}
∥ ∥ ∥
E → E′ → E

—the isomorphism E → E/E_{n} is induced by multiplication by n in

0 → E_{n} → E ⟶^{n} E → 0.

Here I’m assuming facts about elliptic curves and their quotients by finite subgroups ([S1] III.4).

An isogeny E → E′ induces a homomorphism E(ℚ) → E′(ℚ) which, in general, will be neither injective nor surjective. The ranks of E(ℚ) and E′(ℚ) will be the same, but their torsion subgroups will in general be different. Surprisingly, isogenous curves over a finite field do have the same number of points.

Theorem 26.2. Let E and E′ be elliptic curves over ℚ. If E and E′ are isogenous, then N_{p}(E) = N_{p}(E′) for all good p. Conversely, if N_{p}(E) = N_{p}(E′) for sufficiently many good p, then E is isogenous to E′.

Proof. The fact that allows us to show that N_{p}(E) = N_{p}(E′) when E and E′ are isogenous is that N_{p}(E) is the degree of a map E → E, in fact, it is the degree of φ − 1 where φ is the Frobenius map (see p101). An isogeny α : E → E′ induces and isogeny α_{p} : E_{p} → E′_{p} on the reductions of the curves modulo p, which commutes with the Frobenius map: if α(x : y : z) = (P (x, y, z) : Q(x : y : z), R(x : y : z), P, Q, R ∈ 𝔽_{p}[X, Y, Z], then

αφ(x : y : z) = (P (x^{p}, y^{p}, z^{p}), …)

whereas

φα(x : y : z) = (P (x, y, z)^{p}, …),

which the characteristic p binomial theorem shows to be equal. Because the diagram

E ⟶^{φ−1} E
↓ α  ↓ α
E′ ⟶^{φ−1} E′

commutes, we see that

deg α · deg(φ − 1) = deg(φ − 1) · deg α,

so,

deg α · N_{p}(E) = N_{p}(E′) · deg α,

and we can cancel deg α.

The converse is much more difficult. It was conjectured by Tate about 1963, and proved under various hypotheses by Serre. It was proved in general by Faltings in his paper on Mordell’s conjecture (1983).

Faltings’s result gives an effective procedure for deciding whether two elliptic curves over ℚ are isogenous: there is a constant P such that if N_{p}(E) = N_{p}(E′) for all good p ≤ P, then E and E′ are isogenous. Unfortunately, P is impossibly large, but, in practice, if your computer fails to find a p with N_{p}(E) ≠ N_{p}(E′) in a few minutes you can be very confident that the curves are isogenous.

It is not quite obvious, but it follows from the theory of Néron models, that isogenous elliptic curves have the same type of reduction at every prime. Therefore, isogenous curves have exactly the same L-series and the same conductor. Because the L-series is determined by, and determines the N_{p}, we have the following corollary.

Corollary 26.3. Two elliptic curves E and E′ are isogenous if and if L(E, s) = L(E′, s).

We therefore have a one-to-one correspondence between

{isogeny classes of elliptic curves over ℚ} ↔ {certain L-series}

In the remainder of this section we shall identify (using only complex analysis) the L-series arising from elliptic curves over ℚ (in fact, we’ll identify the L-series of the elliptic curves with a fixed conductor).

Since we shall be classifying elliptic curves only up to isogeny, it is worth noting that a theorem of Shafarevich implies there are only finitely many isomorphism classes of elliptic curves over ℚ with a given conductor, hence only finitely many in each isogeny class—see [S1], IX.6.

The L-series of a modular form. Let f be a modular form of weight 2k for Γ_{0}(N). By definition, it is invariant under z ↦ z + 1 and is zero at the cusp ∞, and so can be expressed

f(s) = ∑_{n≥1} c(n)q^{n}, q = e^{2πiz}, c(n) ∈ ℂ.

The L-series of f is the Dirichlet series

L(f, s) = ∑ c(n)n^{−s}, s ∈ ℂ.

A rather rough estimate shows that |c(n)| ≤ Cn^{k} for some constant C, and so this Dirichlet series is convergent for ℜ(s) > k + 1.

Remark 26.4. Let f be cusp form. The Mellin transform of f (more accurately, of the function y ↦ f(iy) : ℝ_{>0} → ℂ) is defined to be

g(s) = ∫_{0}^{∞} f(iy)y^{s} \frac{dy}{y} .

Ignoring (as usual) questions of convergence, we find that

g(s) = ∫_{0}^{∞} ∑_{n=1}^{∞} c_{n}e^{−2πny}y^{s} \frac{dy}{y}
= ∑_{n=1}^{∞} c_{n} ∫_{0}^{∞} e^{−t}(2πn)^{−s}t^{s} \frac{dt}{t} (t = 2πny)
= (2π)^{−s}Γ(s) ∑_{n=1}^{∞} c(n)n^{−s}
= (2π)^{−s}Γ(s)L(f, s).

For the experts, the Mellin transform is the version of the Fourier transform appropriate for the multiplicative group ℝ_{>0}.

Modular forms whose L-series have a functional equations. Let α_{N} = ( \begin{matrix}0 & −1 \\ N & 0 \end{matrix} ).

Then

α_{N} ( \begin{matrix}a & b \\ c & d \end{matrix} ) α_{N}^{−1} = ( \begin{matrix}0 & −1 \\ N & 0 \end{matrix} ) ( \begin{matrix}a & b \\ c & d \end{matrix} ) ( \begin{matrix}0 & 1/N \\ −1 & 0 \end{matrix} ) = ( \begin{matrix}d & −c/N \\ −Nb & a \end{matrix} ) ,

and so conjugation by α_{N} preserves Γ_{0}(N). Define

(w_{N}f)(z) = (\sqrt{N}z)^{2k}f(−1/z).

Then w_{N} preserves S_{2k}(Γ_{0}(N)) and has order 2, w_{N}^{2} = 1. Therefore the eigenvalues of w_{N} are ±1 (or perhaps just +1), and S_{2k}(Γ_{0}(N)) is a direct sum of the corresponding eigenspaces S_{2k} = S_{2k}^{+1} ⊕ S_{2k}^{−1}.

Theorem 26.5 (Hecke). Let f ∈ S_{2k}(Γ_{0}(N)) be a cusp form in the ε-eigenspace, ε = 1 or −1. Then f extends analytically to a holomorphic function on the whole complex plane, and satisfies the functional equation

Λ(f, s) = ε(−1)^{k}Λ(f, k − s),

where

Λ(f, s) = N^{s/2}(2π)^{−s}Γ(s)L(f, s).

Proof. We omit the proof—it involves only fairly straightforward analysis (see Knapp, p270).

Thus we see that, for k = 2, L(f, s) has exactly the functional equation we hope for the L(E, s).

Modular forms whose L-functions are Euler products. Write

q ∏_{1}^{∞}(1 − q^{n})^{24} = ∑ τ(n)q^{n}.

The function n ↦ τ(n) is called the Ramanujan τ-function. Ramanujan conjectured that it had the following properties:

(a) |τ(p)| ≤ 2p^{11/2};

(b) \{ \begin{matrix}τ(mn) & = & τ(m)τ(n) if gcd(m, n) = 1; \\ τ(p) · τ(p^{n}) & = & τ(p^{n+1}) + p^{11}τ(p^{n−1}) if p is prime and n ≥ 1. \end{matrix}

Conjecture (a) was proved by Deligne: he first showed that τ(p) = α + β where α and β occur as the reciprocal roots of a “P_{11}(T)” (see p103), and so (a) became a consequence of his proof of the Riemann hypothesis.

Conjecture (b) was proved by Mordell in 1917 in a paper in which he introduced the first examples of Hecke operators. Consider a modular form f of weight 2k for Γ_{0}(N) (e.g., Δ = (2π)^{12}q ∏(1 − q^{n})^{24}, which is a modular form of weight 12 for Γ_{0}(1)), and write

L(f, s) = ∑_{n≥0} c(n)n^{−s}.

Proposition 26.6. The Dirichlet series L(f, s) has an Euler product expansion of the form

L(f, s) = ∏_{p|N} \frac{1}{1 − c(p)p^{−s}} ∏_{gcd(p,N)=1} \frac{1}{1 − c(p)p^{−s} + p^{2k−1−s}}

if (and only if)

(∗) \{ \begin{matrix}c(mn) & = & c(m)c(n) if gcd(m, n) = 1; \\ c(p) · c(p^{r}) & = & c(p^{r+1}) + p^{2k−1}c(p^{r−1}), r ≥ 1, if p does not divide N; \\ c(p^{r}) & = & c(p)^{r}, r ≥ 1, if p|N. \end{matrix}

Proof. For a prime p not dividing N, define

L_{p}(s) = ∑ c(p^{m})p^{−ms} = 1 + c(p)p^{−s} + c(p^{2})(p^{−s})^{2} + · · · .

By inspection, the coefficient of (p^{−s})^{r} in the product

(1 − c(p)p^{−s} + p^{2k−1}p^{−s})L_{p}(s)

is

1  for r = 0
0  for r = 1
⋯
c(p^{r+1}) − c(p)c(p^{r}) + p^{2k−1}c(p^{r−1}) for r + 1.

Therefore

L_{p}(s) = \frac{1}{1 − c(p)p^{−s} + p^{2k−1−s}}

if and only if the second equation in (*) holds.

Similarly,

L_{p}(s) =_{df} ∑ c(p^{r})p^{−rs} = \frac{1}{1 − c(p)p^{−s}}

if and only if the third equation in (*) holds.

If n ∈ ℕ factors as n = ∏ p_{i}^{r_{i}}, then the coefficient of (p^{−s})^{n} in ∏ L_{p}(s) is ∏ c(p_{i}^{r_{i}}), which equals c(n) if (*) holds.

Remark 26.7. The proposition says that L(f, s) is equal to an Euler product of the above form if and only if n ↦ c(n) is weakly multiplicative and if the c(p^{m}) satisfy a suitable recurrence relation. Note that (∗), together with the normalization c(1) = 1, shows that the c(n) are determined by the c(p) for p prime.

Hecke defined linear maps

T (n) : S_{2k}(Γ_{0}(N)) → S_{2k}(Γ_{0}(N)), n ≥ 1,

and proved the following theorems.

Theorem 26.8. The maps T (n) have the having the following properties:

(a) T (mn) = T (m)T (n) if gcd(m, n) = 1;

(b) T (p) · T (p^{r}) = T (p^{r+1}) + p^{2k−1}T (p^{r−1}) if p doesn’t divide N;

(c) T (p^{r}) = T (p)^{r}, r ≥ 1, p|N;

(d) all T (n) commute.

Theorem 26.9. Let f be a cusp form of weight 2k for Γ_{0}(N) that is simultaneously an eigenvector for all T (n), say T (n)f = λ(n)f, and let

f(z) = ∑_{n=1}^{∞} c(n)q^{n}, q = e^{2πiz}.

Then

c(n) = λ(n)c(1).

Note that c(1) ≠ 0, because otherwise c(n) = 0 for all n, and so f = 0.

Corollary 26.10. Let f be as in Theorem 26.9, and normalize f so that c(1) = 1. Then

L(f, s) = ∏_{p|N} \frac{1}{1 − c(p)p^{−s}} ∏_{gcd(p,N)=1} \frac{1}{1 − c(p)p^{−s} + p^{2k−1−s}}

Example 26.11. Since S_{12}(Γ_{0}(1)) has dimension 1, Δ must be an eigenform for all T (n), which implies (b) of Ramanujan’s conjecture.

Definition of the Hecke operators. I first explain the definition of the Hecke operators for the full group Γ_{0}(1) = SL_{2}(ℤ).

Recall that we have canonical bijections

L/ℂ^{×} ↔ Γ_{0}(1)\M/ℂ^{×} ↔ Γ_{0}(1)\ℍ.

Moreover, the equation

f(z) = F (Λ(z, 1))

defines a one-to-one correspondence between

(a) functions F : L → ℂ such that F (λΛ) = λ^{−2k}F (Λ), λ ∈ ℂ^{×};

(b) functions f : ℍ → ℂ such that f(γz) = (cz + d)^{2k}f(z), γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ).

We’ll work first with L.

Let D be the free abelian group generated by the Λ ∈ L; thus an element of D is a finite sum

∑ n_{Λ}[Λ], n_{Λ} ∈ ℤ, Λ ∈ L,

and two such sums ∑ n_{Λ}[Λ] and ∑ n′_{Λ}[Λ] are equal if and only if n_{Λ} = n′_{Λ} for all Λ.

For n ≥ 1, define

T (n) : D → D, T (n) = ∑_{(Λ:Λ′)=n}[Λ′]

and

R(n) : D → D, R(n) = [nΛ].

Proposition 26.12. (a) T (mn) = T (m) ∘ T (n) if gcd(m, n) = 1; (b) T (p^{r}) ∘ T (p) = T (p^{r+1}) + pR(p) ∘ T (p^{r−1}).

Proof. (a) For a lattice Λ,

T (mn)[Λ] = ∑[Λ′′] sum over Λ′′, (Λ : Λ′′) = mn),
T (m) ∘ T (n)[Λ] = ∑[Λ′′] (sum over pairs (Λ′, Λ′′) with (Λ : Λ′) = n, (Λ′ : Λ′′) = m).

But if Λ′′ is a lattice of index mn, then Λ/Λ′′ is an abelian group of order mn with gcd(m, n) = 1, and so has a unique subgroup of order m. The inverse image of this subgroup in Λ will be the unique lattice Λ′ ⊃ Λ′′ such that (Λ′ : Λ′′) = m. Thus the two sums are the same.

(b) For a lattice Λ,

T (p^{r}) ∘ T (p)[Λ] = ∑[Λ′′] (sum over pairs (Λ′, Λ′′) with (Λ : Λ′) = p, (Λ′ : Λ′′) = p^{r}),
T (p^{r+1})[Λ] = ∑[Λ′′] (sum of Λ′′ with (Λ : Λ′′) = p^{r+1});
pR(p) ∘ T (p^{n−1})[Λ] = p · ∑ R(p)[Λ′] (sum over Λ′ with (Λ : Λ′) = p^{r−1})
= p · ∑[Λ′′] (sum over Λ′′ ⊂ pΛ with (pΛ : Λ′′) = p^{r−1}).

Each of these is a sum of lattices Λ′′ of index p^{r+1} in Λ. Fix such a lattice Λ′′, and let a be the number of times that [Λ′′] occurs in the first sum, and b the number of times it occurs in the third sum. It occurs exactly once in the second sum, and so we have to prove that

a = 1 + pb.

There are two cases to consider.

The lattice Λ′′ is not contained in pΛ. In this case, b = 0, and a is the number of lattices Λ′ such that (Λ : Λ′) = p and Λ′ ⊃ Λ′′. Such lattices are in one-to-one correspondence with the subgroups of Λ/pΛ of index p containing the image Λ̄′′ of Λ′′ in Λ/pΛ. But (Λ : pΛ) = p^{2} and Λ/pΛ ≠ Λ̄′′ ≠ 0, and so there is only one such subgroup, namely Λ̄′′ itself. Therefore there is only one possible Λ′, namely pΛ + Λ′′, and so a = 1.

The lattice Λ′′ ⊃ pΛ. Here b = 1. Every lattice Λ′ of index p in Λ contains pΛ, hence also Λ′′, and the number of such Λ′’s is the number of lines through the origin in Λ/pΛ ≈ 𝔽_{p}^{2}, i.e., the number of points in ℙ^{1}(𝔽_{p}), which is p + 1 as required.

Corollary 26.13. For any m and n,

T (m) ∘ T (n) = ∑ d · R(d) ∘ T (mn/d^{2})

(sum is over the positive divisors d of gcd(m, n)).

Proof. Prove by induction on s that

T (p^{r})T (p^{s}) = ∑_{i≤r,s} p^{i} · R(p^{i}) ∘ T (p^{r+s−2i}),

and then apply (a) of the theorem.

Corollary 26.14. Let H be the ℤ-subalgebra of End(D) generated by T (p) and R(p) for p prime; then H is commutative, and it contains T (n) for all n.

Proof. Obvious from the theorem.

Let F be a function L → ℂ. We can extend F by linearity to a function F : D → ℂ,

F (∑ n_{Λ}[Λ]) = ∑ n_{Λ}F (Λ).

For any linear map T : D → D, we define T · F to be the function L → ℂ such that T · F (Λ) = F (T Λ). For example,

(T (n) · F)(Λ) = ∑_{(Λ:Λ′)=n} F (Λ′),

and if F (λΛ) = λ^{−2k}F (Λ), then

R(n) · F = n^{−2k}F.

Proposition 26.15. If F : L → ℂ has the property that F (λΛ) = λ^{−2k}F (Λ) for all λ, Λ, then so also does T (n) · F, and

(a) T (mn) · F = T (m) · T (n) · F if gcd(m, n) = 1;

(b) T (p) · T (p^{r}) · F = T (p^{r+1}) · F + p^{1−2k}T (p^{r−1}) · F if p doesn’t divide N;

(c) T (p^{r}) · F = T (p)^{r} · F, r ≥ 1, p|N.

Now let f(z) be a modular form of weight 2k, and let F be the associated function on L. We define T (n) · f to be the function on ℍ associated with n^{2k−1} · T (n) · F. Thus

(T (n) · f)(z) = n^{2k−1}(T (n) · F)(Λ(z, 1)).

Theorem 26.8 in the case N = 1 follows easily from the Proposition. To prove Theorem 26.9 we need an explicit description of the lattices of index n in a fixed lattice.

Write M_{2}(ℤ) for the ring of 2 × 2 matrices with coefficients in ℤ.

Lemma 26.16. For any A ∈ M_{2}(ℤ), there exists a U ∈ M_{2}(ℤ)^{×} such that

UA = ( \begin{matrix}a & b \\ 0 & d \end{matrix} ) , ad = n, a ≥ 1, 0 ≤ b < d.

Moreover, the integers a, b, d are uniquely determined.

Proof. Let A = ( \begin{matrix}a & b \\ c & d \end{matrix} ), and suppose ra+sc = a′ where a′ = gcd(a, c). Then gcd(r, s) = 1,

and so there exist e, f such that re + sf = 1. Now

( \begin{matrix}r & s \\ −f & e \end{matrix} ) ( \begin{matrix}a & b \\ c & d \end{matrix} ) = ( \begin{matrix}a′ & b′ \\ c′ & d′ \end{matrix} )

and det ( \begin{matrix}r & s \\ −f & e \end{matrix} ) = 1. Now apply the appropriate elementary row operations. For the

uniqueness, note that multiplication by such a U doesn’t change the greatest common divisor of the entries in any column, and so a is uniquely determined. Now d is uniquely determined by the equation ad = n, and b is obviously uniquely determined modulo d.

For the lattice Λ(z, 1), the sublattices of index n are exactly the lattices Λ(az +b, d) where (a, b, d) runs through the triples in the lemma. Therefore

(T (n) · f)(z) = n^{2k−1} ∑_{a,b,d} d^{−2k}f(\frac{az + b}{d})

where the sum is over the same triples. On substituting this into the q-expansion

f = ∑_{m≥1} c(m)q^{m}

one finds (after a little work) that

T (n) · f = c(n)q + · · · .

Therefore, if T (n) · f = λ(n)f, then

λ(n)c(1) = c(n).

This proves Theorem 26.9 in the case N = 1.

When N ≠ 1, the theory of the Hecke operators is much the same, only a little more complicated. For example, instead of L, one must work with the set of pairs (Λ, S) where Λ ∈ L and S is a cyclic subgroup of order N in ℂ/Λ. This is no problem for the T (n)’s with gcd(n, N) = 1, but the T (p)’s with p|N have to be treated differently.

Thus the problem of finding cusp forms f whose L-series have Euler products becomes a problem of finding simultaneous eigenforms for the linear map T (n) : S_{2k}(Γ_{0}(N)) → S_{2k}(Γ_{0}(N)). Hecke had trouble doing this because he didn’t know some linear algebra, which we now review.

Linear algebra: the spectral theorem. Recall that a Hermitian form on a vector space V is a mapping <, >: V × V → ℂ such that <v, w>= \overline{<w, v>} and <, > is linear in one variable and conjugate-linear in the second. Such a form is said to be positive-definite if <v, v>> 0 whenever v ≠ 0. A linear map α : V → V is Hermitian or self-adjoint relative to <, > if

<αv, w>=<v, αw>, all v, w.

Theorem 26.17 (Spectral Theorem). Let V be a finite-dimensional complex vector space with a positive-definite Hermitian form <, >.

(a) Any self-adjoint linear map α : V → V is diagonalizable, i.e., V is a direct sum of eigenspaces for α.

(b) Let α_{1}, α_{2}, … be a sequence of commuting self-adjoint linear maps V → V; then V has a basis of vectors that are eigenvectors for all α_{i}.

Proof. (a) Because ℂ is algebraically closed, α has an eigenvector e_{1}. Let V_{1} be (ℂe_{1})^{⊥}. Then V_{1} is stable under α, and so contains an eigenvector e_{2}. Let V_{2} = (ℂe_{1} ⊕ ℂe_{2})^{⊥} etc.

(b) Now suppose V = ⊕V (λ_{i}) where the λ_{i} are the distinct eigenvalues of α_{1}. Because α_{2} commutes with α_{1}, it stabilizes each V (λ_{i}), and so each V (λ_{i}) can be decomposed into a direct sum of eigenspaces for α_{2}. Continuing in this fashion, we arrive at a decomposition V = ⊕V_{j} such that each α_{i} acts as a scalar on each V_{j}. Choose bases for each V_{j}, and take their union.

This suggests that we should look for a Hermitian form on S_{2k}(Γ_{0}(N)) for which the T (n)’s are self-adjoint.

The Petersson inner product. As Poincaré pointed out, the unit disk forms a model for hyperbolic geometry^{29}: if one defines a “line” to be a segment of a circle orthogonal to the circumference of the disk, angles to be the usual angles, and distances in terms of cross-ratios, one obtains a geometry that satisfies all the axioms for Euclidean geometry except that given a point P and a line ℓ, there exist more than one line through P not meeting ℓ. The map z ↦ \frac{z−i}{z+i} sends the upper-half plane onto the unit disk, and, being fractional-linear, maps circles and lines to circles and lines (collectively, not separately) and preserves angles. Therefore the upper half-plane is also a model for hyperbolic geometry. The group PSL_{2}(ℝ) =_{df} SL_{2}(ℝ)/{±I} is the group of transformations preserving distances and orientation, and therefore plays the same role as the group of orientation preserving affine transformations of the Euclidean plane. The next proposition shows that the measure μ(U) = ∫∫_{U} \frac{dxdy}{y^{2}} plays the same role as the measure ∫∫_{U} dxdy on sets in the Euclidean plane— it is invariant under transformations in PGL_{2}(ℝ).

Proposition 26.18. Define μ(U) = ∫∫_{U} \frac{dxdy}{y^{2}}; then μ(γU) = μ(U) for all γ ∈ SL_{2}(ℝ).

Proof. If γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ), then

\frac{dγ}{dz} = \frac{1}{(cz + d)^{2}} , ℑ(γz) = \frac{ℑ(z)}{|cz + d|^{2}} .

The next lemma shows that

γ^{∗}(dxdy) = \frac{dxdy}{|cz + d|^{4}} (z = x + iy),

and so \frac{dxdy}{y^{2}}, y = ℑ(z), is invariant under γ.

Lemma 26.19. For any holomorphic function w(z), the map z ↦ w(z) multiplies areas by |w′(z)|^{2}.

Proof. Write w(z) = u(x, y) + iv(x, y), so that z ↦ w(z) is the map

(x, y) ↦ (u(x, y), v(x, y)),

whose Jacobian is

| \begin{matrix}u_{x} & v_{x} \\ u_{y} & v_{y} \end{matrix} | = u_{x}v_{y} − v_{x}u_{y}.

On the otherhand, w′(z) = u_{x} + iv_{x}, so that

|w′(z)|^{2} = u_{x}^{2} + v_{x}^{2}.

The Cauchy-Riemann equations state that u_{x} = v_{y} and v_{x} = −u_{y}, and so the two expressions agree.

29Apparently Bolyai showed that it is possible to square the circle in hyperbolic geometry. A recent popular (shoddy) book on Fermat’s Last Theorem contains the following mystifying statement (in italics):

If no one believes that it is possible to square the circle despite Bolyai’s proof, why should we believe Wiles’s proof of Fermat’s last theorem, which also uses hyperbolic geometry.

If f, g are modular forms of weight 2k for Γ_{0}(N), then

f(z) · \overline{g(z)}y^{2k}

is invariant under SL_{2}(ℝ), which suggests defining

<f, g>= ∫∫_{D} fḡy^{2k} \frac{dxdy}{y^{2}}

for D a fundamental domain for Γ_{0}(N)—the above discussion shows that (assuming the integral converges) <f, g> will be independent of the choice of D.

Theorem 26.20 (Petersson). The above integral converges provided at least one of f or g is a cusp form. It therefore defines a positive-definite Hermitian form on the vector space S_{2k}(Γ_{0}(N)) of cusp forms. The Hecke operators T (n) are self-adjoint for all n relatively prime to N.

Proof. Fairly straightforward calculus—see Knapp, p280.

On putting the theorems of Hecke and Petersson together, we find that there exists a decomposition

S_{2k}(Γ_{0}(N)) = ⊕V_{i}

of S_{2k} into a direct sum of orthogonal subspaces V_{i}, each of which is a simultaneous eigenspace for all T (n) with gcd(n, N) = 1. The T (p) for p|N stabilize each V_{i} and commute, and so there does exist at least one f in each V_{i} that is also an eigenform for the T (p) with p|N. If we scale f so that f = q + ∑_{n≥2} c(n)q^{n}, then

L(f, s) = ∏_{p} \frac{1}{1 − c(p)p^{−s} + p^{2k−1−2s}} ∏_{p|N} \frac{1}{1 − c_{p}p^{−s}}

where the first product is over the primes not dividing N, and the second is over those dividing N.

The operator w_{N} is self-adjoint for the Petersson product, and does commute with the T (n)’s with gcd(n, N) = 1, and so each V_{i} decomposes into orthogonal eigenspaces

V_{i} = V_{i}^{+1} ⊕ V_{i}^{−1}

for w_{N}. Unfortunately, w_{N} doesn’t commute with the T (p)’s, p|N, and so the decompostion is not necessarily stable under these T (p)’s. Thus, the results above do not imply that there is a single f that is simultaneously an eigenvector for w_{N} (and hence has a functional equation) and for all T (n) (and hence is equal to an Euler product).

New forms: the theorem of Atkin and Lehner. The problem left by the last subsection has a simple remedy. If M|N, then Γ_{0}(M) ⊃ Γ_{0}(N), and so S_{2k}(Γ_{0}(M)) ⊂ S_{2k}(Γ_{0}(N)). Recall that the N turns up in the functional equation for L(f, s), and so it is not surprising that we run into trouble when we mix f’s of “level” N with f’s that are really of level M|N, M < N.

The way out of the problem is to define a cusp form that it in some subspace S_{2k}(Γ_{0}(M)), M|N, M < N, to be old. The old forms form a subspace S_{2k}^{old}(Γ_{0}(N)) of S_{2k}(Γ_{0}(N)), and the orthogonal complement S_{2k}^{new}(Γ_{0}(N)) is called the space of new forms. It is stable under all the operators T (n) and w_{N}, and so S_{2k}^{new} decomposes into a direct sum of orthogonal subspaces W_{i},

S_{2k}^{new}(Γ_{0}(N)) = ⊕W_{i}

each of which is a simultaneous eigenspace for all T (n) with gcd(n, N) = 1. The T (p) for p|N and w_{N} stabilize each W_{i}.

Theorem 26.21 (Atkin-Lehner (1970)). The spaces W_{i} in the above decomposition all have dimension 1.

It follows that each W_{i} is also an eigenspace for w_{N} and T (p), p|N. Each W_{i} contains (exactly) one cusp form f whose q-expansion is of the form q + ∑_{n≥2} c(n)q^{n}. For this form, L(f, s) is equal to an Euler product, and Λ(f, s) satisfies a functional equation

Λ(f, s) = εΛ(f, 2 − s)

where ε = ±1 is the eigenvalue of w_{N} acting on W_{i}. If the c(n) ∈ ℤ, then Λ(f, s) is a candidate for being the L-function of an elliptic curve E over ℚ.

Exercise 26.22. Let α, β, γ be integers, relatively prime in pairs, such that

α^{ℓ} + β^{ℓ} = γ^{ℓ},

where ℓ is a prime ≠ 2, 3, and consider the elliptic curve

E : Y^{2}Z = X(X − α^{ℓ}Z)(X − γ^{ℓ}Z).

(a) Show that E has discriminant Δ = 16α^{2ℓ}β^{2ℓ}γ^{2ℓ}.

(b) Show that if p does not divide αβγ, then E has good reduction at p.

(c) Show that if p is an odd prime dividing αβγ, then E has at worst nodal reduction at p.

(d) Show that (the minimal equation for) E has at worst nodal reduction at 2. [[After possibly re-ordering α, β, γ, we may suppose, first that γ is even, and then that α^{ℓ} ≡ 1 mod 4. Make the change of variables x = 4X, y = 8Y + 4X, and verify that the resulting equation has integer coefficients.]]

(b),(c),(d) show that the conductor N of E divides ∏_{p|αβγ} p, and hence is much smaller than Δ. This is enough to show that E doesn’t exist, but the enthusiasts may wish to verify that N = ∏_{p|αβγ} p. [Hint: First show that if p doesn’t divide c_{4}, then the equation is minimal at p.]

27. Statement of the Main Theorems

Recall that to an elliptic curve E over ℚ, we have attached an L-series L(E, s) = ∑ a_{n}n^{−s} that has coefficients a_{n} ∈ ℤ, can be expressed as an Euler product, and (conjecturally) satisfies a functional equation (involving N_{E/ℚ}, the conductor on E). Moreover, isogenous elliptic curves have the same L-series. We therefore have a map

E ↦ L(E, s) : {elliptic curves/ℚ}/∼ → {Dirichlet series}.

An important theorem of Faltings (1983) shows that the map is injective: two elliptic curves are isogenous if they have the same L-function.

On the other hand, the theory of Hecke and Petersson, together with the theorem of Atkin and Lehner, shows that the subspace S_{2}^{new}(Γ_{0}(N)) ⊂ S_{2}(Γ_{0}(N)) of new forms decomposes into a direct sum

S_{2}^{new}(Γ_{0}(N)) = ⊕W_{i}

of one-dimensional subspaces W_{i} that are simultaneous eigenspaces for all the T (n)’s with gcd(n, N) = 1. Because they have dimension 1, each W_{i} is also an eigenspace for w_{N} and for the T (p) with p|N. An element of one of the subspaces W_{i}, i.e., a simultaneous eigenforms in S_{2}^{new}(Γ_{0}(N)), is traditionally called a newform, and I’ll adopt this terminology.

In each W_{i} there is exactly one form f_{i} = ∑ c(n)q^{n} with c(1) = 1 (said to be normalized). Because f_{i} is an eigenform for all the Hecke operators, it has an Euler product, and because it is an eigenform for w_{N}, it satisfies a functional equation. If the c(n)’s are^{30} in ℤ, then L(f_{i}, s) is a candidate for being the L-function of an elliptic curve over ℚ.

Conjecture 27.1. The following sets are equal:

{L(E, s) | E an elliptic curve over ℚ with conductor N}

{L(f, s) | f a normalized newform for Γ_{0}(N), i.e., f = f_{i} some i}.

The following theorem of Eichler and Shimura (and others) (1954/1958/...) shows that the second set is contained in the first.

Theorem 27.2 (Eichler-Shimura). Let f = ∑ c(n)q^{n} be a normalized newform for Γ_{0}(N). If all c(n) ∈ ℤ, then there exists an elliptic curve E_{f} of conductor N such that L(E_{f}, s) = L(f, s).

The early forms of the theorem were less precise—in particular, they predate the work of Atkin and Lehner in which newforms were defined.

The theorem of Eichler-Shimura has two parts: given f, construct the curve E_{f} (up to isogeny); having constructed E_{f}, prove that L(E_{f}, s) = L(f, s). I’ll discuss the two parts in Sections 28 and 29.

After the theorem of Eichler-Shimura, to prove Conjecture 27.1, it remains to show that every elliptic curve E arises from a modular form f—such an elliptic curve is said to be modular.

In a set of problems circulated (in Japanese) to the members of a conference in 1955, Taniyama asked (in rather vague form) whether every elliptic curve was modular. In the ensuing years, this question was apparently discussed by various people, including Shimura, who however published nothing about it.

One can ask whether every Dirichlet L-series L(s) = ∑ a_{n}n^{−s}, a_{n} ∈ ℤ, equal to an Euler product (of the same type as L(E, s)), and satisfying a functional equation (of the same type as L(E, s)) must automatically be of the form L(f, s). This is not so, but Weil (1967) proved something only a little weaker. Let χ : (ℤ/nℤ)^{×} → ℂ^{×}, gcd(n, N) = 1, be a homomorphism, and extend χ to a map ℤ → ℂ by setting χ(m) = χ(m mod n) if m and n are relatively prime and = 0 otherwise. Define

L_{χ}(s) = ∑ χ(n)a_{n}n^{−s}, Λ_{χ}(s) = (\frac{m}{2π} )^{−s} Γ(s)L_{χ}(s).

Weil showed that if all the functions Λ_{χ}(s) satisfy a functional equation relating Λ_{χ}(s) and Λ_{χ}(2k − s) (and some other mild conditions), then L(s) = L(f, s) for some cusp form f of weight 2k for Γ_{0}(N). Weil also stated Conjecture 27.1 (as an exercise!)—this was its first appearance in print.

30In the next section, we shall see that the c(n)’s automatically lie in some finite extension of ℚ, and that if they lie in ℚ then they lie in ℤ

Weil’s result showed that if L(E, s) and its twists satisfy a functional equation of the correct form, then E is modular. Since the Hasse-Weil conjecture was widely believed, Weil’s paper (for the first time) gave a strong reason for believing Conjecture 27.1, i.e., it made (27.1) into a conjecture rather than a question. Also, for the first time it related the level N of f to the conductor of E, and so made it possible to test the conjecture numerically: list all the f’s for Γ_{0}(N), list all isogeny classes of elliptic curves over ℚ with conductor N, and see whether they match. A small industry grew up to do just that.

For several years, the conjecture was referred to as Weil’s conjecture. Then, after Taniyama’s question was rediscovered, it was called the Taniyama-Weil conjecture. Finally, after Lang adopted it as one of his pet projects^{31}, it became unsafe to call it anything other than the Shimura-Taniyama conjecture—see Lang’s scurrilous article in the Notices of the AMS, November 1995, pp 1301–1307.

In a lecture in 1985, Frey suggested that the curve in Exercise 26.22, defined by a counterexample to Fermats’ Last Theorem, should not be modular. This encouraged Serre to rethink some old conjectures of his, and formulate two conjectures, one of which implies that Frey’s curve is indeed not modular. In 1986, Ribet proved sufficient of Serre’s conjectures to be able to show that Frey’s curve can’t be modular. I’ll discuss this work in Section 31.

Thus, at this stage (1986) it was known that Conjecture 27.1 for semistable elliptic curves over ℚ implies Fermat’s Last Theorem, which inspired Wiles to attempt to prove Conjecture 27.1. After a premature announcement in 1993, Wiles proved in 1994 (with the help of R. Taylor) that all semistable elliptic curves over ℚ are modular. Recall that semistable just means that the curve doesn’t have cuspidal reduction at any prime. Diamond improved the theorem so that it now says that an elliptic curve E over ℚ is modular provided it doesn’t have additive reduction at 3 or 5. In other words, the image of the map

f ↦ E_{f} : {f} → {E over ℚ}/∼

contains (at least) all E’s with at worst nodal reduction at 3 and 5. Needless to say, efforts are being made to remove this last condition. I’ll discuss the strategy of Wiles’s proof in Section 30.

28. How to get an Elliptic Curve from a Cusp Form

Not long after Newton and Leibniz invented calculus, mathematicians discovered that they couldn’t evaluate integrals of the form

∫ \frac{dx}{\sqrt{f(x)}}

where f(x) ∈ ℝ[x] is a cubic polynomial without a repeated factor. In fact, such an integral can’t be evaluated in terms of elementary functions. Thus, they were forced to treat them as new functions and to study their properties. For example, Euler showed that

31To the great benefit of the Xerox Co., as Weil put it—I once made some of the points in the above paragraph to Lang and received a 40 page response.

∫_{a}^{t_{1}} \frac{dx}{\sqrt{f(x)}} + ∫_{a}^{t_{2}} \frac{dx}{\sqrt{f(x)}} = ∫_{a}^{t_{3}} \frac{dx}{\sqrt{f(x)}}

where t_{3} is a rational function of t_{1}, t_{2}. The explanation for this lies with elliptic curves.

Consider the elliptic curve Y^{2} = f(X) over ℝ, and the differential one-form ω = \frac{1}{y}dx+0dy on ℝ^{2}. According to Math 215, to integrate ω over a segment of the elliptic curve, we should parametrize the curve. We assume that the segment γ(a, t) of the elliptic curve over [a, t] can be smoothly parametrized by x. Thus the segment is

x ↦ (x, \sqrt{f(x)}), x ∈ [a, t].

Then, again according to Math 215,

∫_{γ(a,t)} \frac{dx}{y} = ∫_{a}^{t} \frac{dx}{\sqrt{f(x)}}.

Thus, the elliptic integral can be regarded as an integral over a segment of an elliptic curve.

A key point, which we’ll discuss later, is that the restriction of ω to E is translation invariant, i.e., if t_{Q} denotes the map P ↦ P + Q on E, then t_{Q}^{∗}ω = ω (on E). Hence

∫_{γ(a,t)} ω = ∫_{γ(a+x(Q),t+x(Q))} ω

for any Q ∈ E(ℝ) (here x(Q) is the x-coordinate of Q). Now Euler’s theorem becomes the statement

∫_{γ(a,t_{1})} ω + ∫_{γ(a,t_{2})} = ∫_{γ(a,t_{1})} ω + ∫_{γ(t_{1},t_{3})} ω = ∫_{γ(a,t_{3})} ω

where t_{3} is determined by

(t_{2}, \sqrt{f(t_{2})}) − (a, \sqrt{f(a)}) + (t_{1}, \sqrt{f(t_{1})}) = (t_{3}, \sqrt{f(t_{3})})

(difference and sum for the group structure on E(ℝ)).

Thus the study of elliptic integrals leads to the study of elliptic curves. Jacobi and Abel showed that the study of more complicated integrals leads to other interesting varieties.

Differentials on Riemann surfaces. A differential one-form on an open subset of ℂ is simply an expression ω = fdz, with f a meromorphic function. Given a smooth curve γ

t ↦ z(t) : [a, b] → ℂ, [a, b] = {t ∈ ℝ | a ≤ t ≤ b},

we can form the integral

∫_{γ} ω = ∫_{a}^{b} f(z(t)) · z′(t) · dt ∈ ℂ.

Now consider a compact Riemann surface X. If ω is a differential one-form on X and (U_{i}, z_{i}) is a coordinate neighbourhood for X, then ω|U_{i} = f_{i}(z_{i})dz_{i}. If (U_{j}, z_{j}) is a second coordinate neighbourhood, so that z_{j} = w(z_{i}) on U_{i} ∩ U_{j}, then

f_{i}(z_{i})dz_{i} = f_{j}(w(z_{i}))w′(z_{i})dz_{i}

on U_{i} ∩ U_{j}. Thus, to give a differential one-form on X is to give differential one-forms f_{i}dz_{i} on each U_{i}, satisfying the above equation on the overlaps. For any (real) curve γ : I → X and differential one-form ω on X, the integral ∫_{γ} ω makes sense.

A differential one-form is holomorphic if it is represented on the coordinated neighbourhoods by forms fdz with f holomorphic.

It is an important fact (already noted) that the holomorphic differential one-forms on a Riemann surface of genus g form a complex vector space Ω^{1}(X) of dimension g.

For example, the Riemann sphere has genus 0 and so should have no nonzero holomorphic differential one-forms. Note that dz is holomorphic on ℂ = S \ {north pole}, but that z = 1/z′ on S \ \{poles\}, and so dz = −\frac{1}{z^{′2}} dz′, which has a pole at the north pole. Hence dz does not extend to a holomorphic differential one-form on the whole of S.

An elliptic curve has genus 1, and so the holomorphic differential one-forms on it form a vector space of dimension 1. It is generated by ω = \frac{dx}{2y} (more accurately, the restriction of \frac{1}{2y}dx + 0dy to E(ℂ) ⊂ ℂ^{2}). Here I’m assuming that E has equation

Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3}, Δ ≠ 0.

Note that, on E^{aff},

2ydy = (3x^{2} + a)dx,

and so

\frac{dx}{2y} = \frac{dy}{3x^{2} + a}

where both are defined. Thus it is holomorphic on E^{aff}, and one can check that it also holomorphic at the point at infinity.

For any Q ∈ E(ℂ), t_{Q}^{∗}ω is also holomorphic, and so t_{Q}^{∗}ω = cω for some c ∈ ℂ. Now Q ↦ c : E(ℂ) → ℂ is a holomorphic function on ℂ, and all such functions are constant (see 10.3). Since the function takes the value 1 when Q = 0, it is 1 for all Q, and so ω is invariant under translation. Alternatively, one can simply note that the inverse image of ω under the map

(x, y) = (℘(z), ℘′(z)), ℂ \ Λ → E^{aff}(ℂ)

is

\frac{d℘(z)}{2℘′(z)} = \frac{dz}{2} ,

which is clearly translation invariant on ℂ—d(z + c) = dz.

The Jacobian variety of a Riemann surface. Consider an elliptic curve over E and a nonzero holomorphic differential one-form ω. We choose a point P_{0} ∈ E(ℂ) and try to define a map

P ↦ ∫_{P_{0}}^{P} ω : E(ℂ) → ℂ.

This is not well-defined because the value of the integral depends on the path we choose from P_{0} to P —nonhomotopic paths may give different answers. However, if we choose a basis {γ_{1}, γ_{2}} for H_{1}(E(ℂ), ℤ)(= π_{1}(E(ℂ), P_{0})), then the integral is well-defined modulo the lattice Λ in ℂ generated by

∫_{γ_{1}} ω, ∫_{γ_{2}} ω.

In this way, we obtain an isomorphism

P ↦ ∫_{P_{0}}^{P} ω : E(ℂ) → ℂ/Λ.

Note that this construction is inverse to that in Section 10.

Jacobi and Abel made a similar construction for any compact Riemann surface X. Suppose X has genus g, and let ω_{1}, …, ω_{g} be a basis for the vector space Ω^{1}(X) of holomorphic oneforms on X. Choose a point P_{0} ∈ X. Then there is a smallest lattice Λ in ℂ^{g} such that the map

P ↦ (∫_{P_{0}}^{P} ω_{1}, …, ∫_{P_{0}}^{P} ω_{g}) : X → ℂ^{g}/Λ

is well-defined. By a lattice in ℂ^{g}, I mean the free ℤ-submodule of rank 2g generated by a basis for ℂ^{g} regarded as a real vector space (strictly, this is a full lattice). The quotient ℂ^{g}/Λ is a complex manifold, called the Jacobian variety Jac(X) of X, which can be considered to be a higher-dimensional analogue of ℂ/Λ. Note that it is a commutative group.

We can make the definition of Jac(X) more canonical. Let Ω^{1}(X)^{∨} be the dual of Ω^{1}(X) as a complex vector space. For any γ ∈ H_{1}(X, ℤ),

ω ↦ ∫_{γ} ω

is an element of Ω^{1}(X)^{∨}, and in this way we obtain an injective homomorphism

H_{1}(X, ℤ) ↪ Ω^{1}(X)^{∨},

which (one can prove) identifies H_{1}(X, ℤ) with a lattice in Ω^{1}(X)^{∨}. Define

Jac(X) = Ω^{1}(X)^{∨}/H_{1}(X, ℤ).

When we fix a P_{0} ∈ X, any P ∈ X defines an element

ω ↦ ∫_{P_{0}}^{P} ω mod H_{1}(X, ℤ)

of Jac(X), and so we get a map X → Jac(X). The choice of a different P_{0} gives a map that differs from the first only by a translation.

Construction of the elliptic curve over ℂ. We apply the above theory to the Riemann surface X_{0}(N). Let π be the map π : ℍ → X_{0}(N) (not quite onto). For any ω ∈ Ω^{1}(X), π^{∗}ω = fdz where f ∈ S_{2}(X_{0}(N)), and the map ω ↦ f is a bijection

Ω^{1}(X) → S_{2}(X_{0}(N))

(see 25.3). The Hecke operator T (n) acts on S_{2}(X_{0}(N)), and hence on Ω^{1}(X) and its dual.

Proposition 28.1. There is a canonical action of T (n) on H_{1}(X_{0}(N), ℤ), which is compatible with the map H_{1}(X_{0}(N), ℤ) → Ω^{1}(X_{0}(N))^{∨}. In other words, the action of T (n) on Ω^{1}(X)^{∨} stabilizes its sublattice H_{1}(X_{0}(N), ℤ), and therefore induces an action on the quotient Jac(X_{0}(N)).

Proof. One can give an explicit set of generators for H_{1}(X_{0}(N), ℤ), explicitly describe an action of T (n) on them, and then explicitly verify that this action is compatible with the map H_{1}(X_{0}(N), ℤ) → Ω^{1}(X_{0}(N))^{∨}. Alternatively, as we discuss in the next section, there are more geometric reasons why the T (n) should act on Jac(X).

Remark 28.2. From the action of T (n) on H_{1}(X, ℤ) ≈ ℤ^{2g} we get a characteristic polynomial P (Y) ∈ ℤ[Y] of degree 2g. What is its relation to the characteristic polynomial Q(Y) ∈ ℂ[Y] of T (n) acting on Ω^{1}(X)^{∨} ≈ ℂ^{g}? The obvious guess is that P (Y) = Q(Y)\overline{Q(Y)}. The proof that this is so is an exercise in linear algebra. See the next section.

Now let f = ∑ c(n)q^{n} be a normalized newform for Γ_{0}(N) with c(n) ∈ ℤ. The map

α ↦ α(f) : Ω^{1}(X_{0}(N))^{∨} → ℂ

identifies ℂ with the largest quotient of Ω^{1}(X)^{∨} on which each T (n) acts as multiplication by c(n). The image of H_{1}(X_{0}(N), ℤ) is a lattice Λ_{f}, and we set E_{f} = ℂ/Λ_{f}—it is an elliptic curve over ℂ. Note that we have constructed maps

X_{0}(N) → Jac(X_{0}(N)) → E_{f}.

The inverse image of the differential on E_{f} represented by dz is the differential on X_{0}(N) represented by fdz.

Construction of the elliptic curve over ℚ. We briefly explain why the above construction in fact gives an elliptic curve over ℚ. There will be a few more details in the next section.

For a compact Riemann surface X, we defined

Jac(X) = Ω^{1}(X)^{∨}/H_{1}(X, ℤ) ≈ ℂ^{g}/Λ, g = genusX.

This is a complex manifold, but as in the case of an elliptic curve, it is possible to construct enough functions on it to embed it into projective space, and so realize it as a projective algebraic variety.

Now suppose X is a nonsingular projective curve over an field k. Weil showed (as part of the work mentioned on p102) that it is possible to attach to X a projective algebraic variety Jac(X) over k, which, in the case k = ℂ becomes the variety defined in the last paragraph. There is again a map X → Jac(X), well-defined up to translation by the choice of a point P_{0} ∈ X(k). The variety Jac(X) is an abelian variety, i.e., not only is it projective, but it also has a group structure. (An abelian variety of dimension 1 is an elliptic curve.)

In particular, there is such a variety attached to the curve X_{0}(N) defined in Section 24. Moreover (see the next section), the Hecke operators T (n) define endomorphisms of Jac(X_{0}(N)). Because it has an abelian group structure, any integer m defines an endomorphism of Jac(X_{0}(N)), and we define E_{f} to be the largest “quotient” of Jac(X_{0}(N)) on which T (n) and c(n) agree for all n relatively prime to N. One can prove that this operation of “passing to the quotient” commutes with change of the ground field, and so in this way we obtain an elliptic curve over ℚ that becomes equal over ℂ to the curve defined in the last subsection. On composing X_{0}(N) → Jac(X_{0}(N)) with Jac(X_{0}(N)) → E_{f} we obtain a map X_{0}(N) → E_{f}. In summary:

Theorem 28.3. Let f = ∑ c(n)q^{n} be a newform in S_{2}(Γ_{0}(N)), normalized to have c(1) = 1, and assume that all c(n) ∈ ℤ. Then there exists an elliptic curve E_{f} and a map α : X_{0}(N) → E_{f} with the following properties:

(a) α factors uniquely through Jac(X_{0}(N)),

X_{0}(N) → Jac(X_{0}(N)) → E_{f},

and the second map realizes E_{f} as the largest quotient of Jac(X_{0}(N)) on which the endomorphisms T (n) and c(n) of Jac(X_{0}(N)) agree.

(b) The inverse image of an invariant differential ω on E_{f} under ℍ → X_{0}(N) → E_{f} is a nonzero rational multiple of fdz.

29. Why the L-Series of E Agrees with the L-Series of f

In this section we sketch a proof of the identity of Eichler and Shimura relating the Hecke correspondence T (p) to the Frobenius map, and hence the L-series of E_{f} to that of f.

The ring of correspondences of a curve. Let X and X′ be projective nonsingular curves over a field k which, for simplicity, we take to be algebraically closed.

A correspondence T between X and X′, written T : X ⊢ X′, is a pair of finite surjective regular maps

X ⟵^{α} Y ⟶^{β} X′.

It can be thought of as a many-valued map X → X′ sending a point P ∈ X(k) to the set {β(Q_{i})} where the Q_{i} run through the elements of α^{−1}(P) (the Q_{i} need not be distinct). Better, define Div(X) to be the free abelian group on the set of points of X; thus an element of Div(X) is a finite formal sum

D = ∑ n_{P} P, n_{P} ∈ ℤ, P ∈ X(k).

A correspondence T then defines a map

Div(X) → Div(X′), P ↦ ∑ β(Q_{i}).

(notations as above). This map multiplies the degree of a divisor by deg(α). It therefore sends the divisors of degree zero on X into the divisors of degree zero on X′, and one can show that it sends principal divisors to principal divisors. Hence it defines a map T : J(X) → J(X′) where

J(X) =_{df} Div^{0}(X)/{principal divisors}.

We define the ring of correspondences A(X) on X to be the subring of End(J(X)) generated by the maps defined by correspondences.

If T is the correspondence

X ⟵^{β} Y ⟶^{α} X,

then the transpose T^{tr} of T is the correspondence

X ⟵^{α} Y ⟶^{β} X.

A morphism α : X → X′ can be thought of as a correspondence

X ← Γ → X′

where Γ ⊂ X × X′ is the graph of α and the maps are the projections. The transpose of a morphism α is the many valued map P ↦ α^{−1}(P).

Remark 29.1. Let U and U′ be the curves obtained from X and X′ by removing a finite number of points. Then, it follows from the theory of algebraic curves, that a regular map α : U → U′ extends uniquely to a regular map ᾱ : X → X′: take ᾱ to be the regular map whose graph is the Zariski closure of the graph of α. On applying this remark twice, we see that a correspondence U ⊢ U′ extends uniquely to a correspondence X ⊢ X′.

Remark 29.2. Let

X ⟵^{α} Y ⟶^{β} X′.

be a correspondence T : X ⊢ X′. For any regular function f on X′, we define T (f) to be the regular function P ↦ ∑ f(βQ_{i}) on X (notation as above). Similarly, T will define a homomorphism Ω^{1}(X′) → Ω^{1}(X).

The Hecke correspondence. For p ∤ N, the Hecke correspondence T (p) : Y_{0}(N) → Y_{0}(N) is defined to be

Y_{0}(N) ⟵^{α} Y_{0}(pN) ⟶^{β} Y_{0}(N)

where α is the obvious projection map and β is the map induced by z ↦ pz : ℍ → ℍ.

On points, it has the following description. Recall that a point of Y_{0}(pN) is represented by a pair (E, S) where E is an elliptic curve and S is a cyclic subgroup of E of order pN. Because p ∤ N, any such subgroup decomposes uniquely into subgroups of order N and p, S = S_{N} × S_{p}. The map α sends the point represented by (E, S) to the point represented by (E, S_{N}), and β sends it to the point represented by (E/S_{p}, S/S_{p}). Since E_{p} has p + 1 cyclic subgroups, the correspondence is 1 : p + 1.

The unique extension of T (p) to a correspondence X_{0}(N) → X_{0}(N) acts on Ω^{1}(X_{0}(N)) = S_{2}(X_{0}(N)) as the Hecke correspondence defined in Section 26. This description of T (p), p ∤ N, makes sense, and is defined on, the curve X_{0}(N) over ℚ. Similar remarks apply^{32} to the T (p) for p|N.

The Frobenius map. Let C be a curve defined over the algebraic closure 𝔽 of 𝔽_{p}. If C is defined by equations

∑ a_{i_{0}i_{1}···}X_{0}^{i_{0}}X_{1}^{i_{1}} ⋯ = 0,

then C^{(p)} is defined by equations

∑ a_{i_{0}i_{1}···}^{p}X_{0}^{i_{0}}X_{1}^{i_{1}} ⋯ = 0,

and the Frobenius map φ_{p} : C → C^{(p)} sends the point (b_{0} : b_{1} : b_{2} : …) to (b_{0}^{p} : b_{1}^{p} : b_{2}^{p} : …). If C is defined over 𝔽_{p}, then C = C^{(p)} and φ_{p} is the Frobenious map defined earlier.

Recall that a nonconstant morphism α : C → C′ of curves defines an inclusion α^{∗} : k(C′) ↪ k(C) of function fields, and that the degree of α is defined to be [k(C) : α^{∗}k(C′)]. The map α is said to be separable or purely inseparable according as k(C) is a separable of purely inseparable extension of α^{∗}k(C′). If the separable degree of k(C) over α^{∗}k(C′) is m, then the map C(k^{al}) → C′(k^{al}) is m : 1, except over the finite set where it is ramified.

Proposition 29.3. The Frobenius map φ_{p} : C → C^{(p)} is purely inseparable of degree p, and any purely inseparable map φ : C → C′ of degree p (of complete nonsingular curves) factors as

C ⟶^{φ_{p}} C^{(p)} ⟶^{≈} C′.

Proof. For C = ℙ^{1}, this is obvious, and the general case follows because 𝔽(C) is a separable extension of 𝔽(T). See [S1, II.2.12] for the details.

Brief review of the points of order p on elliptic curves. Let E be an elliptic curve over an algebraically closed field k. The map p : E → E (multiplication by p) is of degree p^{2}. If k has characteristic zero, then the map is separable, which implies that its kernel has order p^{2}. If k has characteristic p, the map is never separable: either it is purely inseparable (and so E has no points of order p) or its separable and inseparable degrees are p (and so E has p points of order dividing p). The first case occurs for only finitely many values of j.

32These T (p)’s are sometimes denoted U(p).

The Eichler-Shimura relation. The curve X_{0}(N) and the Hecke correspondence T (p) are defined over ℚ. For almost all primes p ∤ N, X_{0}(N) will reduce to a nonsingular curve X̃_{0}(N).^{33} For such a prime p, the correspondence T (p) defines a correspondence T̃(p) on X̃_{0}(N).

Theorem 29.4. For a prime p where X_{0}(N) has good reduction,

T̃(p) = φ_{p} + φ_{p}^{tr}.

(Equality in the ring A(X̃_{0}(N)) of correspondences on X̃_{0}(N) over the algebraic closure 𝔽 of 𝔽_{p}.)

Proof. We sketch a proof that they agree as many-valued maps on an open subset of X̃_{0}(N).

Over ℚ_{p}^{al} we have the following description of T (p) (see above): a point P on Y_{0}(N) is represented by a homomorphism of elliptic curves α : E → E′ with cyclic kernel of order N; let S_{0}, …, S_{p} be the subgroups of order p in E; then T_{p}(P) = {Q_{0}, …, Q_{p}} where Q_{i} is represented by E/S_{i} → E′/α(S_{i}).

Consider a point P̃ on X̃_{0}(N) with coordinates in 𝔽—by Hensel’s lemma it will lift to a point on X_{0}(N) with coordinates in ℚ_{p}^{al}. Ignoring a finite number of points of X̃_{0}(N), we can suppose P̃ ∈ Ỹ_{0}(N) and hence is represented by a map α̃ : Ẽ → Ẽ′ where α : E → E′ has cyclic kernel of order N. By ignoring a further finite number of points, we may suppose that Ẽ has p points of order dividing p.

Let α : E → E′ be a lifting of α̃ to ℚ_{p}^{al}. The reduction map E_{p}(ℚ_{p}^{al}) → 𝔼̃_{p}(𝔽_{p}^{al}) has a kernel of order p. Number the subgroups of order p in E so that S_{0} is the kernel of this map. Then each S_{i}, i ≠ 0, maps to a subgroup of order p in Ẽ.

The map p : Ẽ → Ẽ has factorizations

Ẽ ⟶^{φ} Ẽ/S_{i} ⟶^{ψ} Ẽ, i = 0, 1, …, p.

When i = 0, φ is a purely inseparable map of degree p (it is the reduction of the map E → E/S_{0}—it therefore has degree p and has zero kernel), and so ψ must be separable of degree p (we are assuming Ẽ has p points of order dividing p). Proposition 29.3 shows that there is an isomorphism Ẽ^{(p)} → Ẽ/S_{0}. Similarly Ẽ′^{(p)} ≈ Ẽ′/S_{0}. Therefore Q_{0} is represented by Ẽ^{(p)} → Ẽ^{′(p)}, which also represents φ_{p}(P).

When i ≠ 0, φ is separable (its kernel is the reduction of S_{i}), and so ψ is purely inseparable. Therefore Ẽ ≈ Ẽ_{i}^{(p)}, and similarly Ẽ′ ≈ Ẽ′_{i}^{(p)}, where Ẽ_{i}/Ẽ/S_{i} and Ẽ′_{i} = Ẽ′/S_{i}. It follows that {Q_{1}, …, Q_{p}} = φ_{p}^{−1}(P) = φ_{p}^{tr}(P).

The zeta function of an elliptic curve revisited. We begin with an elementary result from linear algebra.

Proposition 29.5. Let Λ be a free ℤ-module of finite rank, and let α : Λ → Λ be a ℤ-linear map with nonzero determinant. Then the kernel of the map

α̃ : (Λ ⊗ ℚ)/Λ → (Λ ⊗ ℚ)/Λ

defined by α has order | det(α)|.

33In fact, it is known that X_{0}(N) has good reduction for all primes p ∤ N, but this is hard to prove. It is easy to see that X_{0}(N) does not have good reduction at primes dividing N.

Proof. Consider the commutative diagram:

0 ⟶ Λ ⟶ Λ ⊗ ℚ ⟶ (Λ ⊗ ℚ)/Λ ⟶ 0
↓^{α}  ↓^{α⊗1}  ↓_{α}
0 ⟶ Λ ⟶ Λ ⊗ ℚ ⟶ (Λ ⊗ ℚ)/Λ ⟶ 0.

Because det(α) ≠ 0, the middle vertical map is an isomorphism. Therefore the snake lemma gives an isomorphism

Ker(α̃) → Coker(α),

and it is easy to see that Coker(α) is finite with order equal to | det(α)|.

We apply this to an elliptic curve E over ℂ. Then E(ℂ) = ℂ/Λ for some lattice Λ, and E(ℂ)_{tors} = ℚΛ/Λ where

ℚΛ = {rλ | r ∈ ℚ, λ ∈ Λ} = {z ∈ ℂ | mz ∈ Λ some m ∈ ℤ} = ℚ ⊗ Λ.

The degree of an endomorphism α of E is the order its kernel in E(ℂ)_{tors}, and so we find that deg(α) is the determinant of α acting on Λ. We shall need a generalization of this to other fields.

Let E be an elliptic curve over an algebraically closed field k, and let ℓ be a prime not equal to the characteristic of k. Then E(k)_{ℓ^{n}} ≈ (ℤ/ℓ^{n}ℤ)^{2}. The Tate module T_{ℓ}E of E is defined to be

T_{ℓ}E = \underleftarrow{lim} E(k)_{ℓ^{n}}.

Thus, it is a free ℤ_{ℓ}-module of rank 2 such that T_{ℓ}E/ℓ^{n}T_{ℓ}E = E(k)_{ℓ^{n}} for all n. For example, if k = ℂ and E(ℂ) = ℂ/Λ, then

E(ℂ)_{ℓ^{n}} = \frac{1}{ℓ^{n}} Λ/Λ = Λ/ℓ^{n}Λ = Λ ⊗ (ℤ/ℓ^{n}ℤ),

and so

T_{ℓ}E = Λ ⊗ ℤ_{ℓ}.

More canonically,

T_{ℓ}E = H_{1}(E, ℤ) ⊗ ℤ_{ℓ}.

Proposition 29.6. Let E and ℓ be as above. For an endomorphism α of E,

det(α|T_{ℓ}E) = deg α.

Proof. When k = ℂ, then the statement follows from the above discussion. For k of characteristic zero, it follows from the case k = ℂ. For k of characteristic p ≠ 0, see [S1].

When Λ is a free module over some ring R and α : Λ → Λ is R-linear, Tr(α|Λ) denotes the trace (sum of diagonal terms) of the matrix of α relative to some basis for Λ—it is independent of the choice of basis.

Corollary 29.7. Let E be an elliptic curve over 𝔽_{p}. Then the trace of

Tr(φ_{p}|T_{ℓ}E) = a_{p} =_{df} p + 1 − N_{p}.

Proof. For any 2 × 2 matrix A, det(A − I_{2}) = det A − Tr A + 1. On applying this to the matrix of φ_{p} acting on T_{ℓ}E, and using the proposition, we find that

deg(φ_{p} − 1) = deg(φ_{p}) − Tr(φ_{p}|T_{ℓ}E) + 1.

As we noted in Section 19, deg(φ_{p} − 1) = N_{p} and deg(φ_{p}) = p.

As we noted above, a correspondence T : X ⊢ X defines a map J(X) → J(X). When E is an elliptic curve, E(k) = J(E), and so T acts on E(k), and hence also on T_{ℓ}(E).

Corollary 29.8. Let E be an elliptic curve over 𝔽_{p}. Then

Tr(φ_{p}^{tr}|T_{ℓ}E) = Tr(φ_{p}|T_{ℓ}E).

Proof. Because φ_{p} has degree p, φ_{p} ∘ φ_{p}^{tr} = p. Therefore, if α, β are the eigenvalues of φ_{p}, so that in particular αβ = deg φ = p, then

Tr(φ_{p}^{tr}|T_{ℓ}E) = p/α + p/β = β + α.

The action of the Hecke operators on H_{1}(E, ℤ). Again, we first need an elementary result from linear algebra.

Let V be a real vector space and suppose that we are given the structure of a complex vector space on V. This means that we are given an ℝ-linear map J : V → V such that J^{2} = −1. The map J extends by linearity to V ⊗_{ℝ} ℂ, and V ⊗_{ℝ} ℂ splits as a direct sum

V ⊗_{ℝ} ℂ = 𝕍^{+} ⊕ 𝕍^{−},

with V^{±} the ±1 eigenspaces of J.

Proposition 29.9. (a) The map

V ⟶^{v↦v⊗1} V ⊗_{ℝ} ℂ ⟶^{project} 𝕍^{+}

is an isomorphism of complex vector spaces.

(b) Denote by w ↦ w̄ the map v ⊗ z ↦ v ⊗ z̄ : V ⊗_{ℝ} ℂ → V ⊗_{ℝ} ℂ; this is an ℝ-linear involution of V ⊗_{ℝ} ℂ interchanging V^{+} and V^{−}.

Proof. Easy exercise.

Corollary 29.10. Let α be an endomorphism of V which is ℂ-linear. Write A for the matrix of α regarded as an ℝ-linear endomorphism of V, and A_{1} for the matrix of α as a ℂ-linear endomorphism of V. Then

A ∼ A_{1} ⊕ Ā_{1}.

(By this I mean that the matrix A is equivalent to the matrix ( \begin{matrix}A_{1} & 0 \\ 0 & Ā_{1} \end{matrix} ).)

Proof. Follows immediately from the above Proposition. [In the case that V has dimension 2, we can identify V (as a real or complex vector space) with ℂ. For the map “multiplication by α = a + ib” the statement becomes,

( \begin{matrix}a & −b \\ b & a \end{matrix} ) ∼ ( \begin{matrix}a + ib & 0 \\ 0 & a − ib \end{matrix} ) ,

which is obviously true because the two matrices are semisimple and have the same trace and determinant.]

Corollary 29.11. For any p ∤ N,

Tr(T (p) | H_{1}(X_{0}(N), ℤ)) = Tr(T (p) | Ω^{1}(X_{0}(N))) + \overline{Tr(T (p) | Ω^{1}(X_{0}(N)))}.

Proof. To say that H_{1}(X_{0}(N), ℤ) is a lattice in Ω^{1}(X_{0}(N))^{∨} means that

H_{1}(X_{0}(N), ℤ) ⊗_{ℤ} ℝ = Ω^{1}(X_{0}(N))^{∨}

(as real vector spaces). Clearly

Tr(T (p) | H_{1}(X_{0}(N), ℤ)) = Tr(T (p) | H_{1}(X_{0}(N), ℤ) ⊗_{ℤ} ℝ),

and so we can apply the preceding corollary.

The proof that c(p) = a_{p}.

Theorem 29.12. Consider an f = ∑ c(n)q^{n} and a map X_{0}(N) → E, as in (28.3). For all p ∤ N,

c(p) = a_{p} =_{df} p + 1 − N_{p}(E).

Proof. We assume first that X_{0}(N) has genus 1, and so we may take the map to be an isomorphism: E = X_{0}(N). Let p be a prime not dividing N. Then E has good reduction at p, and for any ℓ ≠ p, the reduction map T_{ℓ}E → T_{ℓ}Ẽ is an isomorphism. The Eichler-Shimura relation states that

T̃(p) = φ_{p} + φ_{p}^{tr}.

On taking traces on T_{ℓ}Ẽ, we find (using 29.7, 29.8, 29.11) that

2c(p) = a_{p} + a_{p}.

The proof of the general case is very similar except that, at various places in the argument, an elliptic curve has to be replace either by a curve or the Jacobian variety of a curve. Ultimately, one uses that T_{ℓ}E is the largest quotient of T_{ℓ}Jac(X_{0}(N)) on which T (p) acts as multiplication by c(p) for all p ∤ N (perhaps after tensoring with ℚ_{ℓ}).

Aside 29.13. Let X be a Riemann surface. The map [P]−[P_{0}] ↦ ∫_{P_{0}}^{P} ω extends by linearity to map Div^{0}(X) → Jac(X). The famous theorem of Abel-Jacobi says that this induces an isomorphism J(X) → Jac(X). The Jacobian variety Jac(X) of a curve X over a field k (constructed in general by Weil) has the property that Jac(X)(k) = J(X), at least when J(k) ≠ ∅. For more on Jacobian and Abelian varieties, see my articles in “Arithmetic Geometry” (Eds. Cornell, G., and Silverman, J.).

Reference: The best reference for the material in Sections 23–29 is Knapp’s book.

30. Wiles’s Proof Somebody with an average or even good mathematical background might feel that all he ends up with after reading […]’s paper is what he suspected before anyway: The proof of Fermat’s Last Theorem is indeed very complicated. (M. Flach)

In this section, I explain the strategy of Wiles’s proof of the Taniyama conjecture for semistable elliptic curves over ℚ (i.e., curves with at worst nodal reduction).

Recall, that if S denotes the sphere, then π =_{df} π_{1}(S \ {P_{1}, …, P_{s}}, O) is generated by loops γ_{1}, …, γ_{s} around each of the points P_{1}, …, P_{s}, and that π classifies the coverings of S unramified except over P_{1}, …, P_{s}.

Something similar is true for ℚ. Let K be a finite extension of ℚ, and let O_{K} be the ring of integers in K. In O_{K}, the ideal pO_{K} factors into a product of powers of prime ideals: pO_{K} = ∏ 𝔭^{e_{𝔭}}. The prime p is said to be unramified in K if no e_{𝔭} > 1.

Now assume K/ℚ is Galois with Galois group G. Let p be unramified in K and choose a prime ideal 𝔭 dividing pO_{K} (so that 𝔭 ∩ ℤ = (p)). Let G(𝔭) be the subgroup of G of σ such that σ𝔭 = 𝔭. One shows that the action of G(𝔭) on O_{K}/𝔭 = k(𝔭) defines an isomorphism G(𝔭) → Gal(k(𝔭)/𝔽_{p}). The element F_{𝔭} ∈ G(𝔭) ⊂ G mapping to the Frobenius element x ↦ x^{p} in Gal(k(𝔭)/𝔽_{p}) is called the Frobenius element at 𝔭. Thus F_{𝔭} ∈ G is characterised by the conditions:

\{ \begin{matrix}F_{𝔭}𝔭 & = & 𝔭, \\ F_{𝔭}x & ≡ & x^{p} mod 𝔭, for all x ∈ O_{K}. \end{matrix}

If 𝔭′ also divides pO_{K}, then there exists a σ ∈ G such that σ𝔭 = 𝔭′, and so F_{𝔭′} = σF_{𝔭}σ^{−1}. Therefore, the conjugacy class of F_{𝔭} depends on p—I’ll often write F_{p} for any one of the F_{𝔭}. It is known that the F_{𝔭} (varying p) generate G.

The above discussion extends to infinite extensions. Fix a finite nonempty set S of prime numbers, and let K_{S} be the union of all K ⊂ ℂ that are of finite degree over ℚ and unramified outside S—it is an infinite Galois extension of ℚ. For each p ∈ S, there is an element F_{p} ∈ Gal(K_{S}/ℚ), well-defined up to conjugation, called the Frobenius element at p.

Proposition 30.1. Let E be an elliptic curve over ℚ. Let ℓ be a prime, and let

S = {p | E has bad reduction at p} ∪ {ℓ}.

Then all points of order ℓ^{n} on E have coordinates in K_{S}, i.e., E(K_{S})_{ℓ^{n}} = E(ℚ^{al})_{ℓ^{n}} for all n.

Proof. See [S1, VII.4.1].

Example 30.2. The smallest field containing the coordinates of the points of order 2 on the curve E : Y^{2}Z = X^{3} + aXZ^{2} + bZ^{3} is the splitting field of X^{3} + aX + b. Those who know a little algebraic number theory will recognize that this field is unramified at the primes not dividing the discriminant Δ of X^{3} + aX + b, i.e., at the primes where E has good reduction (ignoring 2)

The Galois group G_{S} acts on E(K_{S})_{ℓ^{n}} for all n. Recall from p156 that T_{ℓ}E is the free ℤ_{ℓ}-module of rank 2 such that

T_{ℓ}E/ℓ^{n}T_{ℓ}E = E(K_{S})_{ℓ^{n}} = E(ℚ^{al})_{ℓ^{n}}

for all n. The action of G_{S} on the quotients defines a continuous action of G_{S} on T_{ℓ}E, i.e., a continuous homomorphism (also referred to as a representation)

ρ_{ℓ} : G_{S} → Aut(T_{ℓ}E) ≈ GL_{2}(ℤ_{ℓ}).

Proposition 30.3. Let E, ℓ, S be as in the previous proposition. For all p ∉ S,

Tr(ρ_{ℓ}(F_{p}) | T_{ℓ}E) = a_{p} =_{df} p + 1 − N_{p}(E).

Proof. Because p ∉ S, E has good reduction to an elliptic curve E_{p} over 𝔽_{p}, and the reduction map P ↦ P̄ induces an isomorphism T_{ℓ}E → T_{ℓ}E_{p}. [For an elliptic curve E over a nonalgebraically closed field k, T_{ℓ}E = \underleftarrow{lim} E(k^{al})_{ℓ^{n}}.] By definition F_{p} maps to the Frobenius element in Gal(𝔽/𝔽_{p}), and the two have the same action on T_{ℓ}E. Therefore the proposition follows from (29.7).

Definition 30.4. A continuous homomorphism ρ : G_{S} → GL_{2}(ℤ_{ℓ}) is said to be modular if Tr(ρ(F_{p})) ∈ ℤ for all p ∉ S and there exists a cusp form f = ∑ c(n)q^{n} in S_{2k}(Γ_{0}(N)) for some k and N such that

Tr(ρ(F_{p})) = c(p)

for all p ∉ S.

Thus, in order to prove that E is modular one must prove that ρ_{ℓ} : G_{S} → Aut(T_{ℓ}E) is modular for some ℓ. Note that then ρ_{ℓ} will be modular for all ℓ.

Similarly, one says that a continuous homomorphism ρ : G_{S} → GL_{2}(𝔽_{ℓ}) is modular if there exists a cusp form f = ∑ c(n)q^{n} in S_{2k}(Γ_{0}(N)) for some k and N such that

Tr(ρ(F_{p})) ≡ c(p) mod ℓ

for all p ∉ S. There is the following remarkable conjecture.

Conjecture 30.5 (Serre). Every odd irreducible representation ρ : G_{S} → GL_{2}(𝔽_{ℓ}) is modular.

“Odd” means that det ρ(c) = −1, where c is complex conjugation. “Irreducible” means that there is no one-dimensional subspace of 𝔽_{ℓ}^{2} stable under the action of G_{S}. The Weil pairing [S1,III.8] shows that ⋀^{2} E_{ℓ} = μ_{ℓ} (the group of ℓ-roots of 1 in ℚ^{al}). Since cζ = ζ^{−1}, this shows that the representation of G_{S} on E_{ℓ} is odd. It need not be irreducible, for example, if E has a point of order ℓ with coordinates in ℚ.

As we shall discuss in the next section, Serre in fact gave a recipe for defining the level N and weight 2k of modular form.

There is much numerical evidence supporting Serre’s conjecture, but few theorems. The most important of these is the following.

Theorem 30.6 (Langlands, Tunnell). If ρ : G_{S} → GL_{2}(𝔽_{3}) is odd and irreducible, then it is modular.

Note that GL_{2}(𝔽_{3}) has order 8 · 6 = 48. The action of PGL_{2}(𝔽_{3}) on the projective plane over 𝔽_{3} identifies it with S_{4}, and so GL_{2}(𝔽_{3}) is a double cover S̃_{4} of S_{4}.

The theorem of Langlands and Tunnell in fact concerned representations G_{S} → GL_{2}(ℂ). In the last century, Klein classified the finite subgroups of GL_{2}(ℂ): their images in PGL_{2}(ℂ) are cyclic, dihedral, A_{4}, S_{4}, or A_{5}. Langlands constructed candidates for the modular forms, and verified they had the correct property in the A_{4} case. Tunnell verified this in the S_{4} case, and, since GL_{2}(𝔽_{3}) embeds into GL_{2}(ℂ), this verifies Serre’s conjecture for 𝔽_{3}.

Fix a representation ρ_{0} : G_{S} → GL_{2}(𝔽_{ℓ}). In future, R will always denote a complete local Noetherian ring with residue field 𝔽_{ℓ}, for example, 𝔽_{ℓ}, ℤ_{ℓ}, or ℤ_{ℓ}[[X]]. Two homomorphism ρ_{1}, ρ_{2} : G_{S} → GL_{2}(R) will be said to be strictly equivalent if

ρ_{1} = Mρ_{2}M^{−1}, M ∈ Ker(GL_{2}(R) → GL_{2}(k)).

A deformation of ρ_{0} is a strict equivalence class of homomorphisms ρ : G_{S} → GL_{2}(R) whose composite with GL_{2}(R) → GL_{2}(𝔽_{p}) is ρ_{0}.

Let ∗ be a set of conditions on representations ρ : G_{S} → GL(R). Mazur showed, for certain ∗, that there is a universal ∗-deformation of ρ_{0}, i.e., a ring R̃ and a deformation ρ̃: G_{S} → GL_{2}(R̃) satisfying ∗ such that for any other deformation ρ : G_{S} → GL_{2}(R), there

is a unique homomorphism R̃ → R such that the composite G_{S} \underrightarrow{_{ρ}} GL_{2}(R̃) ⟶ GL_{2}(R) is ρ.

Now assume ρ_{0} is modular. Work of Hida and others show that, for certain ∗, there exists a deformation ρ_{𝕋} : G_{S} → GL_{2}(𝕋) that is universal for modular deformations satisfying ∗.

Because ρ̃ is universal for all ∗-representations, there exists a unique homomorphism δ : R̃ → 𝕋 carrying ρ̃ into ρ_{𝕋}. It is onto, and it is injective if and only if every ∗-representation is modular.

It is now possible to explain Wiles’s strategy. First, state conditions ∗ as strong as possible but which are satisfied by the representation of G_{S} on T_{ℓ}E for E a semistable elliptic curve over ℚ. Fixing a modular ρ_{0} we get a homomorphism δ : R̃ → 𝕋.

Theorem 30.7 (Wiles). The homomorphism δ : R̃ → 𝕋 is an isomorphism (and so every ∗-representation lifting ρ_{0} is modular).

Now let E be an elliptic curve over ℚ, and assume initially that the representation of G_{S} on E_{3} is irreducible. By the Theorem of Langlands and Tunnell, the representation ρ_{0} : G_{S} → Aut(E(K_{S})_{3}) is modular, and by Wiles’s theorem, every ∗-representation is modular. In particular, ρ_{3} : G_{S} → Aut(T_{3}E) is modular, which implies that E is modular.

What if the representation of G_{S} on E(K_{S})_{3} is not irreducible, for example, if E(ℚ) contains a point of order three. It is not hard to show that the representations of G_{S} on E(K_{S})_{3} and E(K_{S})_{5} can’t both be reducible, because otherwise either E or a curve isogenous to E will have rational points of order 3 and 5, hence a point 15, which is impossible. Unfortunately, there is no Langlands-Tunnell theorem for 5. Instead, Wiles uses the following elegant argument.

He shows that there is a semistable elliptic curve E′ over ℚ such that:

(a) E′(K_{S})_{3} is irreducible;

(b) E′(K_{S})_{5} ≈ E(K_{S})_{5} as G_{S}-modules.

Because of (a), the preceding argument applies to E′ and shows it to be modular. Hence the representation ρ_{5} : G_{S} → Aut(T_{5}E′) is modular, and so also is ρ_{0} : G_{S} → Aut(E′(K_{S})_{5}) ≈ Aut(E(K_{S})_{5}). Now, Wiles can apply his original argument with 3 replaced by 5.

31. Fermat, At Last

Fix a prime number ℓ, and let E be an elliptic curve over ℚ. For a prime p it is possible to decide whether or not E has good reduction at p purely by considering the action of G = Gal(ℚ^{al}/ℚ) on the modules E(ℚ^{al})_{ℓ^{n}}, for all n ≥ 1.

Let M be a finite abelian group, and let ρ : G → Aut(M) be a continuous homomorphism (discrete topology on Aut(M)). The kernel H of ρ is an open subgroup of G, and therefore its fixed field ℚ^{alH} is a finite extension of ℚ. We say that ρ is unramified at p if p is unramified in ℚ^{alH}. With this terminology, we can now state a converse to Proposition 30.1.

Theorem 31.1. Let ℓ be a prime. The elliptic curve E has good reduction at p if and only if the representation of G on E(ℚ^{al})_{ℓ^{n}} is unramified for all n.

The proof makes use of the theory of Néron models.

There is a similar criterion for p = ℓ.

Theorem 31.2. Let ℓ be a prime. The elliptic curve E has good reduction at ℓ if and only if the representation of G on E_{ℓ^{n}} is flat for all n.

For the experts, the representation of G on E(ℚ^{al})_{ℓ^{n}} is flat if there is a finite flat group scheme H over ℤ_{ℓ} such that H(ℚ_{ℓ}^{al}) ≈ E(ℚ_{ℓ}^{al})_{ℓ^{n}} as G-modules. Some authors say “finite” or “crystalline” instead of flat.

These criteria show that it is possible to detect whether E has bad reduction at p, and hence whether p divides the conductor of E, from knowing how G acts on E(ℚ^{al})_{ℓ^{n}} for all n—it may not be possible to detect bad reduction simply by looking at E(ℚ^{al})_{ℓ} for example.

Recall that Serre conjectured that every odd irreducible representation ρ : G → GL_{2}(𝔽_{ℓ}) is modular, i.e., that there exists an f = ∑ c(n)q^{n} ∈ S_{2k}(Γ_{0}(N)), some k and N, such that

Tr(ρ(F_{p})) = c(n) mod ℓ

whenever ρ is unramified at p.

Conjecture 31.3 (Refined Serre conjecture). Every odd irreducible representation ρ : G → GL_{2}(𝔽_{ℓ}) is modular for a specific k and N. For example, a prime p ≠ ℓ divides N if and only if ρ is ramified at p, and ℓ divides N if and only if ρ is not flat.

Theorem 31.4 (Ribet and others). If ρ : G → GL_{2}(𝔽_{ℓ}) is modular, then it is possible to choose the cusp form to have the weight 2k and level N predicted by Serre.

This proof is difficult.

Now let E be the curve defined in (26.22) corresponding to a solution to X^{ℓ}+Y^{ℓ} = Z^{ℓ}, ℓ > 3. It is not hard to verify, using nontrivial facts about elliptic curves, that the representation ρ_{0} of G on E(ℚ^{al})_{ℓ} is irreducible. Moreover, that it unramified for p ≠ 2, ℓ, and that it is flat for p = ℓ. The last statement follows from the facts that E has at worst nodal reduction at p, and if it does have bad reduction at p, then p^{ℓ}|Δ.

Now

E modular ⟹ ρ_{0} modular ⟹^{Ribet} ρ_{0} modular for a cusp form of weight 2, level 2.

But X_{0}(N) has genus 0, and so there is no such cusp form. Wiles’s theorem proves that E doesn’t exist.

Of the growing number of sources attempting to explain Wiles’s theorem, I’ll cite just three.

Ribet: Bull AMS, 32.4, 375–402. This is reliable, easy to read, and contains a great list of references.

Murty, Kumar (Ed.). Seminar on Fermat’s last theorem, Canadian Math. Soc.. This was mostly written before Wiles found the correct proof, but nevertheless gives much of the background required for the proof.

Darmon, Diamond, Taylor. Fermat’s Last Theorem. Contains the most thorough introduction to the proof. A preliminary version was published in: Current Developments in Mathematics, 1995.

Bibliography

[C1] Cassels, J.W.S., Diophantine equations with special reference to elliptic curves, J. London Math. Soc. 41 (1966), 193–291. This survey article was the first modern account of the arithmetic theory of elliptic curves.

[C2] Cassels, J.W.S., Lectures on Elliptic Curves, LMS, Student Texts 24, 1991. Gives a concise elementary treatment of the basics.

[Cr] Cremona, J.E., Algorithms for Modular Curves, Cambridge, 1992.

How to compute almost everything of interest connected with elliptic curves, together with big tables of results.

[F] Fulton, W., Algebraic Curves, Benjamin, 1969.

Contains the background from algebraic geometry needed for elliptic curves.

[H] Husemoller, D., Elliptic Curves, Springer, 1987.

The beginning is quite elementary, but it becomes rapidly more advanced (and sketchy).

[Kn] Knapp, A.W., Elliptic Curves.

The first five chapters give a very readable and elementary account of the basics on elliptic curves. The remaining chapters study the L-series of a curve, and explain the relation to modular forms—this is more difficult, but is very important, for example, in the work of Wiles.

[K1] Koblitz, N., Introduction to Elliptic Curves and Modular Forms, Springer, 1984. More modular forms than elliptic curves, but it explains the relation to the classical

problem of “congruent numbers”.

[K2] Koblitz, N., A Course in Number Theory and Cryptography, Springer, 2nd edn, 1987. The last chapter explains how elliptic curves are used to give an algorithm for factorizing

integers that has advantages over all others.

[S1] Silverman, J.H., The Arithmetic of Elliptic Curves, Springer, 1986.

This well-written book and its sequel(s) are the basic references for the subject.

[S2] Silverman, J.H., Advanced Topics in the Arithmetic of Elliptic Curves, Springer, 1994.

[ST] Silverman, J.H., and Tate, J., Rational Points on Elliptic Curves, Springer, 1992. The first half of the book is a slight revision of the notes from Tate’s famous 1961 Haverford

lectures, which give a very elementary introduction to the subject.

158 J.S. MILNE

[T] Tate, J., The arithmetic of elliptic curves, Inv. Math. 23 (1974), 179–206. The notes of Tate’s talks at the 1972 summer meeting of the AMS. They are an excellent

survey of what was known and conjectured at the time. (Tate’s Haverford lectures, his course in fall 1967 at Harvard, and this article have strongly influenced subsequent accounts.)

THE END