Elliptic Curves and the Mordell-Weil Theorem

Jake Marcinek

September 26, 2013

Abstract

This paper introduces the notion of elliptic curves with an empha-sis on elliptic curves defined over Q and their rational points. Somealgebraic number theory and algebraic geometry is developed in orderto prove the Mordell-Weil Theorem.

Contents

1 Introduction 21.1 Goals of this paper . . . . . . . . . . . . . . . . . . . . . . . . 21.2 Introduction to elliptic curves . . . . . . . . . . . . . . . . . . 3

2 Some Algebraic Geometry 52.1 Some notes on Div(C) and Pic(C) . . . . . . . . . . . . . . . . 52.2 Application to elliptic curves . . . . . . . . . . . . . . . . . . . 9

3 Some Algebraic Number Theory 11

4 Elliptic curves over C 16

5 Preliminary constructions on elliptic curves 195.1 Weil Pairing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195.2 Reduction of elliptic curves . . . . . . . . . . . . . . . . . . . . 215.3 Galois Cohomology and Kummer Theory . . . . . . . . . . . . 23

1

6 Elliptic curves over Q 276.1 Lutz-Nagell . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276.2 Mordell-Weil . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

6.2.1 Weak Mordell-Weil . . . . . . . . . . . . . . . . . . . . 296.2.2 Descent Procedure . . . . . . . . . . . . . . . . . . . . 34

1 Introduction

1.1 Goals of this paper

In Section 1, we will introduce a specific kind of plane curve called an ellilpticcurve. We define an addition on the points of such a curve making the setof points in a field into an abelian group. A brief background in algebraicgeometry is provided in Section 2 to justify and motivate the definitions ofelliptic curves and their group structure. The group structure of the ellipticcurve varies greatly depending on the field from which the coordinates of thepoints are taken. The R-points on an elliptic curve are not discussed in thispaper but it is easy to see that they form a group isomorphic to the circlegroup, S1, or two copies of the circle group, S1 × Z/2Z, depending on howmany times the curve intersects the x-axis. The C-points on an elliptic curveare discussed in Chapter 4. They form a group topologically isomorphic to atorus (see Theorem 4.12). Elliptic curves over finite fields are obviously finitegroups (as the projective plane over a finite field has finitely many points)and are used in Sections 5 and 6 to simplify computations and proofs ofresults for elliptic curves over Q. In Section 6, we conclude with the focusof this paper, the Q-points on elliptic curves. The group structure of therational points is more subtle than that of points over R, C, or finite fields.Our goal will be to explain the structure theory of this group. The discussionwill culminate with

Main Theorem (Mordell-Weil). The group of Q-points on an elliptic curvedefined over Q is finitely generated.

This generalizes to the K-points on an elliptic curve defined over K forany number field K. In order to prove this theorem, Section 3 develops somebackground in algebraic number theory and Section 5 discusses tools forsimplifying computation on elliptic curves and aspects of Galois cohomology.

2

1.2 Introduction to elliptic curves

Fix a field K and an algebraic closure K. An elliptic curve over K is anonsingular curve over K of genus 1 with a specified base point. Usingalgebraic geometry, it can be shown that any such curve can be embeddedin P2(K) as the locus of a cubic equation with only one point, the basepoint, on the line at infinity. Thus any elliptic curve is the solution set of acorresponding Weierstrass equation

Y 2Z + a1XY Z + a3Y Z2 = X3 + a2X

2Z + a4XZ2 + a6Z

3

with base point O = [0, 1, 0] and ai ∈ K. We often write the Weierstrassequation using non-homogeneous coordinates x = X/Z and y = Y/Z,

E : y2 + a1xy + a3y2 = x3 + a2x

2 + a4x+ a6 (1)

keeping in mind the extra point at infinity, O. If each ai ∈ K, then we sayE is defined over K and denote this by E/K. For any field extension L/K,we let

E(L) = O ∪ (x, y) ∈ L2|x, y satisfy the Weierstrass equation.

Suppose E/K is an elliptic curve and charK 6= 2, then through a changeof variables, we may always simplify the Weierstrass equation to the form

E : y2 = f(x) = 4x3 + b2x2 + 2b4x+ b6. (2)

Here we define two fundamental constants associated to such an elliptic curveand Weierstrass equation

Definition 1.1. The discriminant of the Weierstrass equation, ∆, and thej-invariant of the elliptic curve, j, are given by

∆ = ∆(E) = 16Disc(f) = −b22b8 − 8b3

4 − 27b26 + 9b2b4b6, (3)

j = j(E) =b2

2 − 24b4

∆. (4)

If we further assume charK 6= 2, 3, then the Weierstrass equation may befurther simplified to the form

E : y2 = f(x) = x3 + Ax+B. (5)

With a Weierstrass equation of this form, it is easy to check that

∆ = −16(4A3 + 27B2) and j = −1728(4A)3

∆. (6)

3

Proposition 1.2. Let E and E ′ be two elliptic curves defined over K.

(a) Say E/K is defined over K and is given by the Weierstrass equationin Equation (2). Then

(i) E is nonsingular if and only if ∆ = 0,

(ii) E has a node if and only if ∆ = 0, b22 − 24b4 6= 0,

(iii) E has a cusp if and only if ∆ = 0, b22 − 24b4 = 0. 1

(b) The two elliptic curves E and E ′ are isomorphic if and only if j(E) =j(E ′).

(c) Take any j0 ∈ K. Then there is an elliptic curve E ′′/K(j0) with

j(E ′′) = j0.

For a proof, see Chapter 3 of [Si09].To conclude the introduction, we describe the group law on elliptic curves.

Suppose E/K is an elliptic curve, L/K is any field extension, and P,Q ∈E(L). Let l be the unique line through P and Q.2 By the cubic nature of theelliptic curve, counting points with multiplicity, l intersects E at a uniquethird point, R ∈ P2(L). Let vR be the unique line through R and O and setP +Q to be the third intersection point of E(L) and vR.

This construction in fact gives an abelian group structure to E(L). It isclear that O + P = P + O = P for any P ∈ E(L) so O is the identity. Forinverses, it is easy to see that for any P ∈ E(L), vP ∩ E(L) = O,P,−P.Commutativity is also obvious. The only axiom that is nontrivial to check isassociativity which can be shown via heavy yet direct computation. Ratherthan working through this computation, we give another proof in Section 2(Proposition 2.16).

1Note that for a Weierstrass equation in equation (5), we have b22 − 24b4 = 0 if andonly if A = 0.

2It is worth bringing up two points here. First, O lies on a line if and only if that lineis vertical or the line at infinity. Second, if P = Q, then let l be the tangent line to E atP (with the tangent line at O being the line at infinity).

4

2 Some Algebraic Geometry

In order to discuss curves, one needs the language of algebraic geometry. LetK be some field with algebraic closure K. We say C is a curve when C isa one dimensional projective variety in Pn(K). Let K[X] = K[X1, . . . , Xn]be the polynomial ring in n variables with field of fractions K(X) of rationalfunctions (analogously for K). Let

I(C/K) = f ∈ K[X]|f(P ) = 0, ∀P ∈ C ⊂ K[X].

We say C is a curve defined over K and denote this by C/K when I(C) hasa generating set in K[X]. Next let

K[C] =K[X]

I(C/K)

be the coordinate ring of C, whose field of fractions is called the functionfield of C and is denoted K(C). Let MP ⊂ K[C] be the maximal ideal offunctions vanishing at P and K[C]P the localization at MP . A generatorof MP is called a uniformizer at P and f ∈ K(C) is called regular at P iff ∈ K[C]P . If

dimKMP/M2P = 1,

then we say C is nonsingular (or smooth) at P .

Proposition 2.1. Let P ∈ C be a nonsingular point. Then K[C]P is adiscrete valuation ring. The valuation is given by

ordP : K[C]P → N ∪ ∞, ordP (f) = supd ∈ Z|f ∈MdP.

Proof. We know dimKMP/M2P = 1 so the result comes from Lemma 3.4.

2.1 Some notes on Div(C) and Pic(C)

Fix a perfect field K with algebraic closure K and absolute Galois groupG = G(K/K). Let C/K be a smooth curve. Note that G acts on the pointsof C by the natural action on each coordinate.

Definition 2.2. A divisor on C is a finite formal sum

D =∑P∈C

nP (P ), nP ∈ Z

5

of K-points on C. The degree of a divisor D is

deg(D) =∑P∈C

nP .

The divisor group of C is the free abelian group generated by the K-pointson C and is denoted Div(C). The set of degree 0 divisors forms a subgroupand is denoted Div0(C).

There is a natural action of G on Div(C) by

σ

(∑P∈C

nP (P )

)=∑P∈C

nP (σP ).

The divisors fixed by G form a subgroup which is denoted DivK(C) and hasa subgroup of degree 0 divisors Div0

K(C).Any f ∈ K(C)× has an associated divisor

div(f) =∑P∈C

ordP (f)(P ).

Two divisors D1, D2 ∈ Div(C) are said to be linearly equivalent if

D1 −D2 = div(f)

for some f ∈ K(C)× and we write and we write D1 ∼ D2. The Picard group,

Pic(C) = Div(C)/ ∼

is the group of equivalence classes.

Proposition 2.3. Let C be a smooth curve and let f ∈ K(C)×. Then

(a) div(f) = 0 if and only if f ∈ K×.

(b) deg divf = 0.

Proof. For (a), if div(f) = 0, then f is constant (see Proposition 4.3 for theidea). The converse is clear. For (b), see [Si09, II, Prop. 3.1, p. 28] or [Ha77,II, Prop. 6.4, p. 132].

Theorem 2.4. The following sequence is exact

1→ K× → K(C)×

div−→ Div0(C)→ Pic0(C)→ 0.

6

Proof. This follows from the definitions and the above proposition.

Definition 2.5. Let C be a curve. The space of (meromorphic) differentialforms on C, denoted by ΩC , is the K-vector space generated by the symbolsof the form dx for x ∈ K(C), modulo the following relations:

1. d(x+ y) = dx+ dy for all x, y ∈ K(C).

2. d(xy) = xdy + ydx for all x, y ∈ K(C).

3. da = 0 for all a ∈ K.

Remark 2.6. Given a nonconstant map of curves φ : C1 → C2, we get anassociated function field map given by

φ : K[C2]→ K[C1]

[f ] 7→ [f φ]

which induces the map on differentials

φ∗ : ΩC2 → ΩC1∑fidxi 7→

∑(φfi)d(φxi).

Proposition 2.7. Let C be a curve, P ∈ C, t ∈ K(C) a uniformizer at P .Then

(a) For any differential ω ∈ ΩC, there is a unique g ∈ K(C) satisfyingω = gdt. We denote g by ω/dt.

(b) Let f ∈ K(C) be regular at P . Then dfdt

is regular at P .

(c) Let 0 6= ω ∈ ΩC. Then

ordP (ω) := ordP (ω/dt)

depends only on ω and P (independent of t).

(d) x, f ∈ K(C) with x(P ) = 0, p = charK. Then

ordP (fdx) = ordP (f) + ordP (x)− 1 if p = 0 or p - ordP (x)

ordP (fdx) ≥ ordP (f) + ordP (x) if p > 0 and p | ordP (x).

7

(e) Let 0 6= ω ∈ ΩC. Then ordP (ω) = 0 for all but finitely many P ∈ C.

As with divisors associated to functions, there is an analogous definitionfor divisors associated to differentials.

Definition 2.8. Suppose ω ∈ ΩC , then div(ω) =∑

P∈C ordP (ω).

Proposition 2.9. (a) ΩC is a 1-dimensional K(C)-vector space

(b) Let x ∈ K(C). Then dx is a K(C) basis for ΩC if and only if K(C)/K(x)is a finite separable extension.

(c) Let φ : C1 → C2 nonconstant, then φ is separable if and only if φ∗ :ΩC2 → ΩC1 is injective.

Remark 2.10. For all nonzero ω1, ω2 ∈ ΩC , there is some f ∈ K(C)× suchthat ω1 = fω2. Thus div(ω1) = div(f) + div(ω2).

This shows the following definition makes sense.

Definition 2.11. For any nonzero differential ω ∈ ΩC , div(ω) is called acanonical divisor and its image in Pic(C) is called the canonical divisor classon C.

Example 2.12. There are no holomorphic differentials on P1(K). Let tbe a coordinate function on P1. Then t − a is a uniformizer at a for alla ∈ K and 1/t is a uniformizer at ∞. Thus orda(dt) = orda(d(t − a)) = 0.However, ord∞(dt) = ord∞(−t2d(1/t)) = −2. Therefore div(t) = −2(∞).Then for any ω ∈ ΩC , there is some f ∈ K(C) such that ω = fdt. Thusdeg divω = deg divf + deg divdt = −2.

Definition 2.13. Suppose

D =∑P∈C

nP (P ), D′ =∑P∈C

n′P (P ) ∈ Div(C).

Then we write D ≥ D′ if nP ≥ n′P for all P ∈ C. Given some divisorD ∈ Div(C), we associate to D the set of functions

L(D) = f ∈ K(C)×|div(f) ≥ −D ∪ 0

which is clearly a K-vector space whose dimension is denoted by

l(D) = dimKL(D).

8

Theorem 2.14 (Riemann-Roch). Let C be a smooth curve and KC a canon-ical divisor on C. There is an integer g ≥ 0, called the genus of C, such thatfor every divisor D ∈ Div(C),

l(D)− l(KC −D) = degD − g + 1.

Proof. See [Ha77, IV, Thm. 1.3, p. 295].

2.2 Application to elliptic curves

Lemma 2.15. Let C be a curve of genus one and let P,Q ∈ C. Then(P ) ∼ (Q) if and only if P = Q.

Proof. Suppose (P ) ∼ (Q). Then there exists f ∈ K(C) such that

div(f) = (P )− (Q).

Then f ∈ L((Q)) which has dimension 1 as a K-vector space by the Riemann-Roch theorem. However, L((Q)) clearly contains the constant functions sof ∈ K and P = Q.

Proposition 2.16. Let E/K be an elliptic curve.

(a) For every degree 0 divisor D ∈ Div0(E) there exists a unique pointP ∈ E satisfying D ∼ (P )− (O). Define

ψ : Div0(E)→ E

to be the map sending D to its associated P .

(b) ψ is surjective.

(c) Let D1, D2 ∈ Div0(E). Then ψ(D1) = ψ(D2) if and only if D1 ∼ D2,i.e.

ψ : Pic0(E)∼−→ E

is a bijection of sets.

(d) The inverse of ψ is

κ : E∼−→ Pic0(E), P 7→ (P )− (O).

9

(e) The group law induced on E via ψ is the addition law described earlier.In particular, the addition law on elliptic curves is associative.

Proof. (a) E has genus 1 so l(D + (O)) = 1 by Riemann-Roch. Take anonzero function f ∈ L(D+ (O)) as the basis element. Since div(f) ≥−D−(O) and deg div(f) = 0, we must have div(f) = D−(O)+(P ) forsome P ∈ E. Therefore, D ∼ (P )− (O). To show uniqueness, supposeD ∼ (P )− (O) ∼ (P ′)− (O). Then (P ) ∼ D + (O) ∼ (P ′) so P = P ′

by Lemma 2.15.

(b) Suppose P ∈ E. Then ψ((P )− (O)) = P .

(c) Suppose D1, D2 ∈ Div0(E) and set Pi = ψ(Di). Then (P1) − (P2) ∼D1 − D2. Thus, if P1 = P2, then D1 ∼ D2. Conversely, if D1 ∼ D2,then P1 ∼ P2 so P1 = P2 by Lemma 2.15.

(d) This is clear.

(e) It suffices to show κ(P +Q) = κ(P ) + κ(Q) for all P,Q ∈ E. Let

L : f(X, Y, Z) = αX + βY + γZ = 0

be the line in P2(K) passing through P and Q. Let R be the uniquethird point of intersection between L and E and let

L′ : f ′(X, Y, Z) = α′X + β′Y + γ′Z = 0

be the line in P2(K) passing through R and O. Note that L′ also passesthrough P +Q by the definition of addition. Then

div(f/Z) = (P ) + (Q) + (R)− 3(O)

div(f ′/Z) = (R) + (O) + (P +Q)− 3(O).

Subtracting the two equation gives

(P +Q)− (P )− (Q) + (O) = div(f ′/Z)− div(f/Z) = div(f ′/f) ∼ 0

so κ(P +Q)− κ(P )− κ(Q) = 0.

Remark 2.17. Through the group isomorphism Pic0(E)ψ−→ E, we see the

correspondence Pic0K(E) ∼= E(K). This is because for P ∈ E, P ∈ E(K) if

and only if P is fixed by G if and only if the divisor (P )− (O) is fixed by G.

10

3 Some Algebraic Number Theory

Definition 3.1. A ring R is called a discrete valuation ring if it is a principalideal domain with a unique nonzero prime ideal, m. The residue field of Ris k = R/m.

Definition 3.2. An integral domain A is a Dedekind domain if A satisfieseither of the equivalent conditions

1. A is Noetherian, integrally closed, and has Krull dimension 1.

2. A is Noetherian and the localization Ap is a discrete valuation ring forall primes p.

Let K be the field of fractions of A. A fractional ideal of K, I, is a finitelygenerated sub-A-module of K.

Definition 3.3. A number field, K, is a finite field extension of Q. The ringof integers of K is

OK = x ∈ K|f(x) = 0 for some monic f ∈ Z[X].

Here we state a few preliminary results. See [Se79] and [Mi13] for moreon discrete valuation rings, Dedekind domains, and number fields.

Lemma 3.4. Let R be a Noetherian local domain that is not a field, let mbe its maximal ideal, and let k = R/m be its residue field. The following areequivalent:

(i) R is a discrete valuation ring.

(ii) m is principal.

(iii) dimkm/m2 = 1.

Theorem 3.5. Let A be a Dedekind domain with field of fractions K. Theset of nonzero fractional ideals, Id(A), forms a group under multiplication.In fact, Id(A) is free with the prime ideals as a generating set. In particular,Dedekind domains have unique factorization of ideals into primes.

11

Note 3.6. Throughout this section, there are instances where general resultsare presented, but only special cases of these results will be used in ourdiscussion of elliptic curves later. To shorten this background discussion,proofs will be given only for these special cases. In preparation for thesespecial cases, we now give two definitions and two well-known result.

Definition 3.7. A number field K is called a quadratic field if [K : Q] = 2.

Proposition 3.8. If [K : Q] = n, then OK is a free Z-module of rank n.

Definition 3.9. A finite field extension K/Q is called monogenic if OK =Z[ω] for some ω ∈ K.

From this, it is clear that all quadratic fields are monogenic. A strongerclassification is now given.

Proposition 3.10. Let K = Q(√d) be a quadratic field.3 By multiplying

by elements of Q×2, we may assume d ∈ Z is square free, d 6= 0, 1. Then

OK = Z[ω] where

ω =

√d if d 6≡ 1

1+√d

2if d ≡ 1

(mod 4).

The minimal polynomial of ω is

f(X) =

X2 − d if d 6≡ 1

X2 −X + 1−d4

if d ≡ 1(mod 4).

In particular,

Disc(K) = Disc(f) =

4d if d 6≡ 1

d if d ≡ 1(mod 4).

Now we return to the general theory with the following proposition.

Proposition 3.11. Let K be a number field. Then OK is a Dedekind do-main.

3Any quadratic field, K, is of the form Q(√d), d ∈ Q. This follows from Theorem 5.11

since G(K/Q) = Z/2Z is cyclic.

12

Definition 3.12. Let L/K be a degree n field extension of number fieldsand let p be a prime in OK . By Theorem 3.5,

pOL = qe11 . . . qegg

uniquely for some qi ⊂ OL prime. The qi are said to divide p or lay abovep and this is denoted by qi|p. We say L/K is unramified at qi if ei = 1 andsay unramified above p if ei = 1 for all i. Otherwise, L/K is ramified abovep. When g = 1 and e1 = n, we say L/K is totally ramified at p.

By Definition 3.2, given a prime p in a Dedekind domain A with field offractions K, Ap is a discrete valuation ring so we may make the followingdefinition.

Definition 3.13. The residue field of K with respect to p is the residue fieldof Ap. The completion of K with respect to p is the field of fractions of thecompletion of Ap with respect to the unique maximal ideal p and is denotedKp.

Proposition 3.14. Let L/K be a finite Galois extension and p ⊂ OK be aprime ideal. Then G(L/K) acts transitively on S, the set of primes q ⊂ OLabove p.

Definition 3.15. Using the setup from Proposition 3.14, for q ∈ S, thedecomposition group of q is

Dq(L/K) = Stab(q) ≤ G(L/K).

Proposition 3.16. Dq(L/K) is precisely the Galois group of the correspond-ing extension of completions. That is,

G(Lq/Kp) = Dq(L/K).

Proposition 3.17. With the same setup as above, let k (resp. l) be theresidue field of K (resp. L) with respect to p (resp. q). Via passage to thequotient, the map

ε : Dq(L/K)→ G(l/k)

is a surjection.

13

Definition 3.18. The inertia subgroup of q is

Iq(L/K) = Ker(ε)

where ε is as in the previous proposition.

Theorem 3.19. Using the previous setup, let G = G(L/K), D = Dq(L/K),and I = Iq(L/K). We have the following picture.

K

LD

LI

L

Kp

LIq

Lq

k

l

OK

OL

p

q

⊂⊂

⊂⊂

G

D

I I

D/I

Here the columns are field extensions. The Galois group of an extension fromthe first row to the fourth row is G, second to fourth is D, third to fourthis I, second to third is D/I. The third to fourth row extensions are totallyramified at q and all extensions below the fourth row are unramified at q.

Theorem 3.20. Let K be a number field and p a rational prime. Then K/Qis ramified above p if and only if p|Disc(K).

Proof. We prove the special case where K/Q is monogenic with OK = Z[ω].Let f ∈ Z[X] be the minimal polynomial for ω and suppose p is a rationalprime. Say pOK = pe11 . . . p

egg is the decomposition into a product of primes.

Let f ∈ Fp[X] be the reduction of f modulo p. Since Fp is a field, Fp[X] is

a PID. In particular, f factors uniquely into irreducibles as f = gb11 . . . gbrr .With two applications of the Chinese Remainder Theorem, we can form thefollowing sequence of isomorphisms

A :=OKpe11

× · · ·× OKpegg

∼=OK(p)∼=

Z[X]

(f, p)∼=

Fp[X]

(f)∼=

Fp[X]

(g1)b1× · · ·× Fp[X]

(gr)br:= B.

14

Now K/Q is ramified above p if and only if some ei is greater than 1 if andonly if A contains a nilpotent element if and only if B contains a nilpotentelement if and only if some bi is greater than 1 if and only if f has a multipleroot if and only if Disc(f) = 0 if and only if p|Disc(f) = Disc(K).

Theorem 3.21 (Hermite’s Theorem). Given N ∈ Z and a finite set ofrational primes S, there are only finitely many extensions over Q of degreeat most N that are unramified above all primes outside S.

Proof. We prove the special case where N = 2. For a proof of the generaltheorem, see [La94]. From Kummer Theory, we know the number fieldsof degree at most 2 are in one-to-one correspondence with Q×/Q×2

(viad ↔ Q(

√d)). From Proposition 3.10, d | Disc(Q(

√d)). From Proposition

3.20, if Q(√d)/Q is unramified above p, then p - d. Therefore, if Q(

√d) is

unramified above all primes p 6∈ S, then d = ±∏

p∈S pαp of which there are

only finitely many up to equivalence in Q×/Q×2.

We now prove another special case which will be used in our proof of theMordell-Weil Theorem in Section 6.

Theorem 3.22. Let K be a number field containing the mth roots of unity,µm. Let C be the collection of cyclic extensions of K of degree dividing mthat are unramified above all primes, p ⊂ OK, outside a finite set of primes,S. Then C is finite.

For this proof, we use an important result of algebraic number theory, thefiniteness of the ideal class group. For the purposes of this paper, we statethis result as

Theorem 3.23. There exists a finite set of ideals in OK, I1, . . . , In, suchthat for any ideal I ∈ OK, IIk is principal for some 1 ≤ k ≤ n.

We will also need

Definition 3.24. For p ⊂ OK prime, let vp be the normalized valuationdefined on Kp. Given a finite set of primes S in K, let the S-units be

K×S = x ∈ K×|vp(x) = 0, p ∈ S.

Theorem 3.25 (Dirichlet’s S-unit Theorem). For S a finite set of primes inOK, K×S is finitely generated. In particular, for any 2 ≤ m ∈ Z, K×S /K

×Sm

isfinite. (If K×S is finitely generated, then K×S

∼= T × Zr for some finite groupT and some 0 ≤ r ∈ Z. Then K×S /K

×Sm ∼= T/mT × (Z/mZ)r is finite.)

15

For proofs of these two theorems, see [La94].

Proof of Theorem 3.22. Let Cm be the collection of cyclic extensions of K ofdegree dividing m and let C be the subcollection described in the theorem.Let

S ′ = S ∪ p ⊂ OK prime|p divides Ik, for some 1 ≤ k ≤ n,a finite set of primes containing S. First, we wish to show that if L ∈ C, thenL = K( m

√a) for some a ∈ K with vp(a) = 0 for all primes p outside S ′. Fix

L ∈ C. Theorem 5.9 says,

Φ : K×/K×m → Cm, by aK×

m 7→ K( m√a)

is surjective so L = K( m√a) for some a ∈ K. Say (a) =

∏p p

ep is the uniqueprime factorization in OK . If p 6∈ S, then m|ep, say ep = map. Therefore,

(a) = (∏p∈S

pep)(∏p6∈S

pap)m.

Let I =∏

p6∈S pap . Then there is some 1 ≤ k ≤ n such that I−1Ik = (b) is

principal. Then

(abm) =∏p∈S

pepImI−mImk =∏p∈S

pepImk

and L = K( m√a) = K( m

√abm) as we were to show.

Under the Kummer theory correspondence, Φ : K×/K×m → Cm, we have

shown that C is contained in the image of the composition

K×S /K×Sm → K×/K×

m Φ−→ Cm

where the first map is the natural quotient. By Theorem 3.25, K×S /K×Sm

isfinite so C is also finite.

4 Elliptic curves over CDefinition 4.1. A lattice Λ = 〈ω1, ω2〉 ⊂ C is a rank 2 free discrete subgroupof C. A fundamental parallelogram for Λ is a set of the form

Π = α + aω1, bω2|0 ≤ a, b < 1

16

for some α ∈ C and ω1, ω2 any generators for Λ. A meromorphic function,f : C → C, is called an elliptic function relative to Λ if f(z) = f(z + λ) forall λ ∈ Λ. Denote the set of elliptic functions relative to Λ by EΛ.

Note 4.2. The fundamental parallelogram is in natural bijection with C/Λso I will sometimes abuse notation and identify the two. The elliptic functionscan be thought of as the meromorphic functions f that factor through C/Λ.

Proposition 4.3. If f ∈ EΛ has no pole, then f is constant.

Proof. By the note above,

C C/Λ

C

ff |Π

commutes. Since Π is compact, f |Π is bounded, so f is bounded. ThenLiouville’s theorem says f is constant.

Proposition 4.4. Suppose f has no poles on ∂Π. Then∑w∈Π

resw(f) = 0.

Proof. By the residue theorem,∑w∈Π

resw(f) =1

2πi

∫∂Π

fdz.

However, f takes the same values on opposite edges of ∂Π and these edgesare traversed in reverse direction so the integral is 0.

Note 4.5. Holomorphic functions only have finitely many poles in any boundedregion so there is some α such that ∂Π misses all poles.

Corollary 4.6. All nonconstant elliptic functions have at least two poles(counted with multiplicity) in Π.

Proof. Pick α so that ∂Π misses all poles. If there is exactly one pole ofmultiplicity 1 at w0 ∈ Π, then resw0(f) =

∑w∈Π resw(f) = 0 by Proposition

4.4 so f must have 0 poles in which case f is constant by 4.3.

17

Corollary 4.7. Let mi (resp. nj) be the orders of the poles (resp. zeros) off ∈ Π. Then

∑mi =

∑nj.

Proof. Let P =∑mi, N =

∑nj. By the argument principle,∫

∂Π

f ′(z)

f(z)dz = 2π(N − P ).

However, f is Λ-periodic so f ′ is Λ-periodic, and therefore so is f ′/f and wehave already shown that integrating an elliptic function over ∂Π gives 0.

Definition 4.8. The Weierstrass ℘-function is given by

℘(z,Λ) =1

z2+∑

06=λ∈Λ

1

(z − λ)2− 1

λ2.

I refer the reader to Chapter 1 of [Ko84] for proofs of the following fourpropositions and main theorem.

Proposition 4.9. The Weierstrass ℘-function, ℘(z,Λ), converges absolutelyand is uniformly convergent in any compact subset K ⊂ C\Λ.

Proposition 4.10. ℘(z,Λ) ∈ EΛ and the poles of ℘ are precisely the doublepoles at each λ ∈ Λ.

Proposition 4.11. EΛ = C(℘, ℘′), i.e. EΛ is generated as a field over C by℘ and its derivative.

Theorem 4.12. Consider the elliptic curve E : y2 = 4x3 − g2x − g3 whereg2 = 60

∑06=λ∈Λ λ

−4 and g3 = 140∑

06=λ∈Λ λ−6.

C/Λ→ E(C)

z 7→ (℘(z,Λ), ℘′(z,Λ))

is a complex analytic isomorphism. Moreover, for any elliptic curve E/C,there exists lattice Λ such that E(C) ∼= C/Λ.

This identification of any elliptic curve with the torus is very powerfuland has many corollaries such as the following two.

Corollary 4.13. Suppose E/C is an elliptic curve. Then the m-torsionsubgroup E[m] ∼= Z/mZ× Z/mZ.

18

Proof. There exists lattice Λ such that E(C) ∼= C/Λ. Then

E[m] ∼= (C/Λ)[m] ∼=1m

Λ

Λ∼= Z/mZ× Z/mZ.

Corollary 4.14. The multiplication by m map on E(C),

E(C)m−→ E(C) by P 7→ mP,

is surjective.

Proof. There exists lattice Λ such that E(C) ∼= C/Λ. The map C/Λ m−→ C/Λis clearly surjective (the kernel of the composition of surjections C m−→ C π−→C/Λ is 1

mΛ ⊃ Λ).

Remark 4.15. For an elliptic curve E/K defined over an arbitrary field K,Corollary 4.13 holds when charK - m (see [Wa08, III, Thm. 3.2, p. 79]) andCorollary 4.14 holds when K is algebraically closed (see [Si09, III, Prop. 4.2,p. 68]).

5 Preliminary constructions on elliptic curves

5.1 Weil Pairing

Let K be a number field and let E/K be an elliptic curve defined over K.By 4.13 E[m] ∼= Z/mZ × Z/mZ is a free Z/mZ-module of rank 2.4 ThusE[m] is equipped with a natural nondegenerate multilinear map, namely thedeterminant. Picking some basis T1, T2 for E[m], the determinant pairingis given by

det : E[m]× E[m]→ Z/mZ(aT1 + bT2, cT1 + dT2) 7→ ad− bc

However, this pairing is not necessarily Galois invariant. Our goal is toconstruct a pairing which is Galois invariant and we aim for this pairingto be of the form ζdet(P,Q) for some primitive mth root of unity, ζ. For thisconstruction, we will use the following result on divisors which follows directlyfrom the isomorphism in Theorem 2.16.

4In general, by Remark 4.15, this isomorphism is valid for an elliptic curve over anyfield K of characteristic not dividing m.

19

Theorem 5.1. A divisor∑

P nP (P ) ∈ Div(E) is principal if and only if∑P

nP = 0 and∑P

nPP = O.

To begin the construction, take T ∈ E[m]. By the theorem, there existsa function fT ∈ K(E) such that

div(fT ) = m(T )−m(∞).

Then take some T ′ ∈ E such that mT ′ = T . Again, by the theorem above,there exists a function gT ∈ K(E) such that

div(gT ) =∑

R∈E[m]

(T ′ +R)− (R)

since m2T ′ = ∞. It is easy to see that div(fT m) = mdiv(gT ) = div(gmT ).

Therefore, fT m = cgmT for some c ∈ K× (WLOG c = 1).Next, let S ∈ E[m]. Then

gmT (X + S) = fT (mX +mS) = fT (mX) = gmT (X)

so gT (X + S)/gT (X) ∈ µm for all X ∈ E. In particular,

E → P1

X 7→ gT (X + S)/gT (X)

is not surjective, so it must be constant. Hence, we may define the pairing

〈·, ·〉m : E[m]× E[m]→ µm

(S, T ) 7→ gT (X + S)/gT (X)

where X ∈ E is any point such that gT (X + S) and gT (X) and both definedand nonzero. This pairing is called the Weil pairing and satisfies the followingproperties.

Proposition 5.2. The Weil pairing 〈·, ·〉m is

1. bilinear. That is, 〈S1 +S2, T 〉m = 〈S1, T 〉m〈S2, T 〉m and 〈S, T1 +T2〉m =〈S, T1〉m〈S, T2〉m.

20

2. alternating. That is, 〈T, T 〉m = 1 for all T ∈ E[m]. In particular,

〈S, T 〉m = 〈T, S〉−1m .

3. nondegenerate. That is, 〈S, T 〉m = 1 for all S ∈ E[m] if and only ifT = O.

4. Galois invariant. That is, σ〈S, T 〉m = 〈σS, σT 〉m for all S, T ∈ E[m], σ ∈G(K/K).

5. compatible. That is, 〈S, T 〉mm′ = 〈m′S, T 〉m for all 0 < m,m′ ∈ Z andS ∈ E[mm′], T ∈ E[m]

From this, we can prove the following corollary.

Corollary 5.3. If E[m] ⊂ E(K), then µm ⊂ K.

Proof. Suppose E[m] ⊂ E(K). I claim there exist S, T ∈ E[m] such that〈S, T 〉m = ζ, a primitive mth root of unity. Say Im(〈·, ·〉m) = µd ≤ µm.As 〈·, ·〉m is bilinear, 1 = 〈S, T 〉dm = 〈dS, T 〉m for all S, T ∈ E[m]. By thenondegeneracy of 〈·, ·〉m, dS = O for all S ∈ E[m]. This means E[m] ⊆ E[d]so we must have d = m. Therefore, 〈S, T 〉m = ζ for some S, T ∈ E[m]. Bythe Galois invariance of 〈·, ·〉m, we see that σζ = σ〈S, T 〉m = 〈σS, σT 〉m =〈S, T 〉m = ζ for all σ ∈ G(K/K). This means ζ ∈ K so µm = 〈ζ〉 ⊂ K.

5.2 Reduction of elliptic curves

Let K be a local field, complete with respect to a discrete valuation v withring of integers R = x ∈ K|v(x) ≥ 0, maximal ideal m, uniformizer π, andresidue field k = R/m with characteristic p. We denote reduction modulo mby a tilde.

Example 5.4. There is a natural reduction map

R R/mπ

given by t 7→ t. This extends to the map of polynomial rings

R[X] R/m[X]π

given by∑aiX

i 7→∑aiX

i.

21

Example 5.5. There is also a reduction of the projective plane

P2(K) P2(k)π

which works as follows. Take some [a, b, c] ∈ P2(K). By multiplying throughby some element of R, we may “clear the denominators” and assume a, b, c ∈R. Then by dividing through by an appropriate power of π, we may assume

minv(a), v(b), v(c) = 0. (7)

Then using the natural reduction of R from Example 5.4, [a, b, c] = [a, b, c]

is well-defined since the situation a = b = c = 0 is impossible by Equation 7.

Let E/K be an elliptic curve over K. That is, E is the solution setto a Weierstrass equation f(X, Y, Z) = 0 with discriminant ∆.5 Via the

reduction of Example 5.4 f(X, Y, Z) = 0 defines another curve E/k over k

with discriminant ∆. Then E is an elliptic curve as long as ∆ 6= 0 (as longas ∆ 6∈ m). In this case, there is a natural reduction map of elliptic curves

ρ : E/K → E/k given by the projective space reduction from Example 5.5.

Theorem 5.6. Let m be a positive integer not divisible by p. When restrictedto the m-torsion points, ρ : E[m]→ E[m] is an isomorphism.

Proof. I prove the case where p 6= m = 2. This is the only case we will needto use below but a proof of the general statement can be found in [Wa08] or[Si09].

Suppose E/K is given by the Weierstrass equation E : y2 = f(x) =x3 + Ax+ B from Equation 5. After a suitable change of variables, we mayassume A,B ∈ R. Let L be the splitting field of f over K with correspondingring of integers, R′, and say the roots of f are e1, e2, e3. We will be concernedwith the reduction from L to the residue field l, ρ : E/L → E/l. ForO 6= P ∈ E, 2P = O if and only if the tangent line at P is vertical if andonly if P = (ei, 0). Therefore,

E[2] = O, (e1, 0), (e2, 0), (e3, 0).5By clearing denominators, there exists d ∈ R such that df ∈ R[X,Y, Z]. Since f is

homogeneous, f and df share the same zero set. Thus we may assume f ∈ R[X,Y, Z].

22

Similarly, f = (x − e1)(x − e2)(x − e3). Note that the ei have well-definedreduction as described in Example 5.4 since we assume A,B ∈ R ⊆ R′ whichmeans ei ∈ R′ by Gauss’ Lemma. Furthermore, the ei are distinct since thediscriminant of f is a multiple of ∆ 6= 0. Therefore,

E[2] = O, (e1, 0), (e2, 0), (e3, 0)

and ρ : E[m] → E[m], by ρ(O) = O and ρ((ei, 0)) = (ei, 0), is an isomor-phism.

5.3 Galois Cohomology and Kummer Theory

Before moving onto elliptic curves over Q, we recall some results from GaloisCohomology and Kummer Theory.

Theorem 5.7 (Hilbert’s Theorem 90). Consider a Galois extension L/Kwith corresponding Galois group G. Then H1(G,L) and H1(G,L×) are trivial.

Example 5.8. Let K be a number field, G = G(K/K), and 0 < m ∈ Z apositive integer. Start with the short exact sequence

0→ µm → K× ·m−→ K

× → 0

and use Galois cohomology to induce

0→ µm → K×·m−→ K×

δ−→ H1(G, µm)→ H1(G,K×

) = 0

the right end is trivial by Theorem 5.7. Therefore, H1(G, µm) ∼= K×/K×m

with explicit isomorphism

K×/K×m δ−→ H1(G, µm)

a 7→[σ 7→ σ m

√a

m√a

]Now we turn our focus to certain cyclic extensions and prove the following

classification.

Theorem 5.9. If µn ⊂ K is a number field, then

Φ : K×/K×n → L/K cyclic extension |[L : K]|n := Cna 7→ K( n

√a)

23

is surjective and Φ−1(L) = K(αk)|(k, [L : K]) = 1 for some α ∈ L. Inparticular,

#Φ−1(L) = ϕ([L : K]),

where ϕ is the Euler ϕ-function.

We split the proof into two parts. First we show Φ is well-defined andinvestigate Φ−1(K(α)).

Proof. For all a ∈ K, let La = K(α) be the splitting field of

Xn − a =n−1∏i=0

(X − ζ iα)

where αn = a and ζ ∈ µn is a primitive nth root of unity. The extensionLa/L is Galois since ζ ∈ K and G(La/L) is cyclic with generator [α 7→ ζα].For a, b ∈ K×, we say a ∼ b if La = Lb. Clearly, ∼ is an equivalence relation.Moreover, a ∼ abn for all a, b ∈ K× so ∼ factors to an equivalence relationon K×/K×

n. Therefore, Φ is well-defined.

By Example 5.8, K×/K×n ∼= H1(G(K/K), µn) = Hom(G(K/K), µn)

since µn ⊂ K is fixed by G(K/K). For a ∈ K×/K×n, consider the restrictionmap ρa

0 Ker(fa) G(K/K) G(La/K) 0.ρa

Now, ρa(σ) = id if and only σ( n√a) = n

√a so Ker(ρa) = Ker(δ(a)) and

La = KKer(δ(a))

by elementary Galois theory.Suppose b ∈ K×/K×n such that b ∼ a. Let

L := La = Lb and H := Ker(δ(a)) = Ker(ρa) = Ker(ρb) = Ker(δ(b)).

Let m = [L : K] = [G : H]. Then m divides n and µm is the unique subgroupof µn of m elements6. Therefore, δ(a), δ(b) : G µm are two cokernels of theinclusion H → G(K/K). However, cokernels are unique up to isomorphism,so there exists an isomorphism ha,b : µm → µm such that δ(b) = ha,b δ(a).Since δ is an isomorphism, Φ−1(La) → Aut(µm) by b 7→ ha,b is an injection.This means

#Φ−1(La) ≤ #Aut(µm) = ϕ(m).

6Cyclic groups of order n have a unique subgroup of order m for each m dividing n.

24

On the other hand, for all integers k relatively prime to m, sk + tm = 1 forsome s, t ∈ Z. Thus, αk ∈ K(α) = La while

α = (αk)s(αm)t ∈ K(αk) = Lak

so a ∼ ak. Therefore, ak|(k,m) = 1 ⊆ Φ−1(La), and in fact this is equalitysince #ak|(k,m) = 1 = ϕ(m) ≥ #Φ−1(La).

Remark 5.10. During this proof, we saw Φ : K×/K×n → Cn factors through

Hom(G(K/K), µn) as

K×/K×n

Hom(G(K/K), µn) Cnδ κn

Φ

where κn : Hom(G(K/K), µn)→ Cn by σ 7→ KKer(σ)

.

We have shown above that Φ−1(La) has exactly [La : K] elements. Thenext result says that are all the cyclic extensions are of the form La for somea ∈ K×/K×n, i.e. that Φ is surjective.

Theorem 5.11 (Kummer Theory). Suppose L/K is a cyclic extension ofdegree n and assume µn ⊆ K. Then L = K( n

√a) for some a ∈ K. Further-

more, there are at most m2 such classes a in K×/K×n

corresponding to agiven cyclic extension L.

Proof. Let G = G(L/K) = 〈σ〉 ∼= Z/nZ. Let ζ ∈ µn be a primitive nth

root of unity. Since µn ⊆ K×, the action of G on µn is trivial so the 1-cocycles (resp. 1-coboundaries), G(L/K) → µn, are the homomorphisms(resp. trivial), i.e. H1(G, µn) = Hom(G, µn). From the Example 5.8, wehave the exact sequence

. . . K× H1(G, µn) H1(G,K×

) 0

Hom(G, µn)

δ

In other words, all homomorphisms are coboundaries. In particular, theisomorphism F : G(L/K) → µn given by F (σ) = ζ is in fact also realized

25

as F (σi) = σiαα

for some α ∈ L×. Thus α has n conjugates so L = K(α).Furthermore, the minimal polynomial of α in L/K is

n−1∏i=0

(X − σiα) =n−1∏i=0

(X − ζ iα) = Xn − αn

so a = αn ∈ K.

This concludes the proof of Theorem 5.9. An immediate consequence isa finite result of the map Φ.

Corollary 5.12. The map Φ : K×/K×n → Cn is at most ϕ(n)-to-1.

Proof. By Theorem 5.9, #Φ−1(L) = ϕ([L : K]) which divides φ(m) since[L : K] divides m.

Now we look at the special case where K = Q and n = 2.

Example 5.13. Let G = G(Q/Q). Note that ±1 = µ2 ⊂ Q so G fixes µ2.By Example 5.8,

δ : Q×/Q×2 → H1(G, µ2) = Hom(G, µ2) via a 7→[σ 7→ σ

√a√a

]is an isomorphism. We want to find an explicit inverse of δ. By Theorem5.9, the map

Φ : K×/K×n → Cn via a 7→ La = Q(

√a)

is surjective and Corollary 5.12 says Φ is at most ϕ(2)-to-1. However, ϕ(2) =1 so Φ is a bijection. By Remark 5.10, Φ factors as κ2 δ so it suffices to findan inverse to Φ. By Proposition 3.10, the discriminant map Disc : C2 → Q×behaves as follows;

Disc(La) =

a if a 6≡ 1 (mod 4)

4a if a ≡ 1 (mod 4)

which are equivalent in Q×/Q×2. Thus, the triangle

Q×/Q×2 Hom(G, µ2)

C2

δ

κ2DiscΦ

26

commutes. Then the composition

Disc κ2 : Hom(G, µ2)→ Q×/Q×2

f 7→ Disc(QKer(f)),

which we will denote by Disc∗, is the inverse of δ.

6 Elliptic curves over QFor this first subsection, let E/Q be an elliptic curve defined over Q. Say E isdefined by the Weierstrass equation y2 = x3 +Ax+B. After an appropriatechange of variables, we may assume A,B ∈ Z. Let ∆ be the discriminant ofE.

6.1 Lutz-Nagell

Theorem 6.1 (Lutz-Nagell). Suppose P = (x, y) ∈ E(Q) has finite order.Then x, y ∈ Z and either y2 | ∆ or y = 0.

Proof. See Chapter 7 of [Si09] or Chapter 8 of [Wa08].

Corollary 6.2. Let E be an elliptic curve defined over Q. Then the torsionsubgroup E(Q)tors is finite.

Proof. Suppose P = (x, y) ∈ E(Q)tors. By Lutz-Nagell, y | ∆ or y = 0 sothere are only finitely many possibilities for y. Fixing y, there are at most 3solutions to the Weierstrass equation in x, thus E(Q)tors is finite.

Corollary 6.3. Let p be an odd prime not dividing ∆. Then the reductionmap ρ : E(Q)tors → E(Fp) is injective on the torsion points.

Proof. By Lutz-Nagell, all nontrivial torsion points have integer coordinatesand thus reduce to well-defined points over Fp. In particular, the only torsion

point reduced to O is O so the reduction map restricted to torsion points hastrivial kernel.

Example 6.4. We determine the torsion subgroup, E(Q)tors, of the ellipticcurve E : y2 = f(x) = x3 + 31x+ 96.

27

Note that

∆ = 4A3 + 27B2 = 4 · 313 + 27 · 962 ≡ 1 mod 3

and∆ = 4 · 313 + 27 · 962 ≡ −1 + 2 ≡ 1 mod 5.

Thus the corollary tells us that E(Q)tors embeds in E(F3) and E(F5). Bycomputing f(x) ∈ F3 for each x ∈ F3 and noting which are squares, we caneasily find every point on E(F3). The results are

E(F3) = ∞, (0, 0), (−1,−1), (−1, 1).

Thus, either E(Q) contains a nontrivial 2-torsion point or E(Q)tors is trivial.However, the 2-torsion points correspond to roots of f and the reader canquickly check that f has no roots in F5. Therefore E(Q)tors is trivial.

We conclude this subsection by stating (without proof) a theorem ofMazur classifying all possible torsion subgroups.

Theorem 6.5 (Mazur). Let E be an elliptic curve defined over Q. Then thetorsion subgroup, E(Q)tors, is either

• Z/nZ with 1 ≤ n ≤ 10 or n = 12 or

• Z/2Z⊕ Z/2nZ with 1 ≤ n ≤ 4.

6.2 Mordell-Weil

For the remainder of this section, fix some number field K and let E/K bean elliptic curve defined over K with discriminant ∆. We now come to themain theorem of this paper.

Theorem 6.6 (Mordell-Weil). E(K) is finitely generated.

The proof of this theorem will be split into two parts. We begin byproving

Theorem 6.7 (Weak Mordell-Weil). E(K)/mE(K) is finite.

Then we will continue with a descent procedure to complete the proof.

28

6.2.1 Weak Mordell-Weil

Turning our attention to Weak Mordell-Weil, we begin with a lemma.

Lemma 6.8. Suppose L/K is a finite Galois extension. If E(L)/mE(L) isfinite, then E(K)/mE(K) is finite.

Proof. Begin with the short exact sequence of G = G(L/K)-modules

0→ E(L)[m]→ E(L)m−→ mE(L)→ 0.

Through Galois cohomology, this induces the long exact sequence

0→ E(K)[m]→ E(K)m−→ E(K) ∩mE(L)

δ−→ H1(G(L/K), E(L)[m])→ . . .

and in particular

H H1(G,E(L)[m]),

whereH = E(K)∩mE(L)mE(K)

. However, G and E(L)[m] are finite so H1(G,E(L)[m])is finite so H is finite. Then

0→ H → E(K)/mE(K)→ E(L)/mE(L)

is exact, so E(K)/mE(K) is finite as it lies between two finite groups.

From this lemma, by taking L to be the Galois closure of the finite ex-tension K(E[m])/K, it suffices to prove Mordell-Weil under the assumptionE[m] ⊂ E(K).

Lemma 6.9. For any point P ∈ E(K), the field extension K(m−1P )/K isunramified above all primes p 63 m∆.

Proof. Let L = K(m−1P ), q ⊂ L a prime above p, D = Dq(L/K), andI = Iq(L/K). By Proposition (3.19), we have the following situation,

K

LD

LI

L

Kp

LIq

Lq

k

l

I I

D/I

29

where all extensions below the fourth row are unramified at q. To show L/Kis unramified above p, it suffices to show that I is trivial.

Suppose σ ∈ I. Then for any Q ∈ m−1P , ˜σQ−Q = σQ − Q = O soσQ = Q by the isomorphism in Theorem 5.6. Therefore, σ = id so I is trivialand L/K is unramified at P .

We are now ready to complete the proof of the Weak Mordell-Weil The-orem.

Proof. Let G = G(Q/Q). By Corollary 4.14, the multiplication-by-m map,

E(C)m−→ E(C)

is surjective. Note that this is a polynomial map.7 Thus any preimage ofan algebraic point is an algebraic point so m restricts to a surjection on theQ-points, E(Q)

m−→ E(Q). This gives a short exact sequence of G-modules

0→ E[m]→ E(Q)m−→ E(Q)→ 0.

Through Galois cohomology, this induces the long exact sequence

0→ E[m]→ E(K)m−→ E(K)

δ−→ H1(G,E[m])→ . . .

Since we are assuming E[m] ⊂ E(K), the action of G on E[m] is triv-ial so H1(G,E[m]) = Hom(G,E[m]). In particular, we get an injection

E(K)/mE(K)δ−→ Hom(G,E[m]) given by δ(P )(σ) = σQ − Q for any P ∈

E(K)/mE(K), σ ∈ G where Q ∈ m−1P .Take f ∈ Hom(G,E[m]). Since Ker(f) E G, Galois Theory gives an

associated fixed field L = QKer(f). Furthermore,

G(L/K) ∼= G/G(Q/L) ∼= G/Ker(f) ∼= Im(f) ≤ E[m] ∼= (Z/mZ)2

so L/K is the composite of at most two cyclic extensions of degrees dividingm. Thus the following function is well-defined

Ψ : Hom(G,E[m])→ Galois Extensions L/K|G(L/K) ≤ (Z/mZ)2f 7→ L.

7The multiplication-by-m map can be computed explicitly by following the definitionof addition on elliptic curves. The computations involve calculating intersection points ofE with certain lines which gives rise to a polynomial map.

30

Suppose Ψ(f) = Ψ(g). Then Ker(f) = Ker(g) =: H so their differencefactors through G/H.

G E[m]

G/H

f − g

πf − g

However, G/H ∼= G(L/K) ≤ (Z/mZ)2, so

Hom(G/H,E[m]) ⊆ Maps((Z/mZ)2, (Z/mZ)2)

which has order m4. Therefore, any homomorphism f : G → E[m] sharesan associated field with no more than m4 other homomorphisms. In otherwords, Ψ is at most m4-to-1. To finish the proof, it suffices to show Im(Ψδ)is finite.

Suppose P ∈ E(K)/mE(K). Then

Ker(δ(P )) = σ ∈ G(Q/K)|σQ−Q = 0,∀Q ∈ m−1P

so Ψδ(P ) = QKer(δ(P ))= K(m−1P ). Now, Ψδ(P )/K is unramified above all

primes p 63 m∆ by Lemma 6.9. Let S be the set of primes in OK containingm∆ and let C be the collection of cyclic extensions of K of degree dividing mthat are unramified above all primes p 6∈ S. Since E[m] ⊂ E(K), Corollary5.3 says µm ⊂ K so we may apply Theorem 3.22 to see that C is finite. Anyfield extension L/K ∈ Im(Ψδ) is the composite of two fields in C. This meansIm(Ψδ) is finite so E(K)/mE(K) is finite.

This completes the proof of Weak Mordell-Weil in the general case, how-ever before moving on to the descent procedure, it is worth mentioning anargument for a special case of Weak Mordell-Weil which has the advantageof being completely explicit. When m = 2, K = Q, and E[2] ⊂ E(Q), theargument may be stated more concretely as follows.

Theorem 6.10 (Weak Mordell-Weil, Special Case). Let E/Q be an ellipticcurve defined over Q such that E[2] ⊂ E(Q). Then E(Q)/2E(Q) is finite.

Proof. Suppose E/Q is given by the Weierstrass equation

y2 = f(x) = x3 + Ax+B = (x− e1)(x− e2)(x− e3).

31

After a change of variables, we may assume A,B ∈ Z (and hence ei ∈ Z).Again, set G = G(Q/Q). From the same Galois cohomology argument asbefore, we have an injection

E(Q)/2E(Q) Hom(G,E[2]).δ

Let T1 = (e1, 0), T2 = (e2, 0) be generators for E[2] as a Z/2Z-module. Thenondegeneracy of the Weil-pairing allows us to explicitly identify the target,Hom(G,E[2]), with the more familiar group, Hom(G, µ2)2.

Hom(G,E[2]) Hom(G, µ22) Hom(G, µ2)2

f [σ 7→ (〈f(σ), T1〉2, 〈f(σ), T2〉2)]

∼u

From Example 5.13, we have the isomorphism Disc∗ : Hom(G, µ2)→ Q×/Q×2.

Let πi : Hom(G, µ2)2 → Hom(G, µ2) be the ith projection map and define

(Disc∗)2 : Hom(G, µ2)2 → (Q×/Q×2)2

by (Disc∗)2 = Disc∗ π1 × Disc∗ π2. Then, by Lemma 6.11 below, thefollowing composition of injections and isomorphisms is given explicitly by

E(Q)/2E(Q)δ−→ H1(G,E[2])

u−→ Hom(G, µ2)2 (Disc∗)2

−−−−→ (Q×/Q×2)2

P = (x, y) 7→ (x− e1, x− e2), where P 6= O, T1, T2

O 7→ (1, 1)

T1 = (e1, 0) 7→ ((e2 − e1)(e3 − e1), e1 − e2)

T2 = (e2, 0) 7→ ((e2 − e1), (e1 − e2)(e3 − e2))

so it suffices to show that the image of E(Q)/mE(Q) in (Q×/Q×2)2 is finite.

Since E[2] is finite, we do this by showing that for P = (x, y) ∈ E(Q)\E[2],if some prime p divides the square-free part of x− ei, then p divides ∆.

Fix P = (x, y) ∈ E(Q)\E[2] and let x − ei = aiu2i where ui ∈ Q and

ai ∈ Z is square-free. We may also write x − ei = pkivi where vi ∈ Qand ki ∈ Z is the exact power of p dividing x − ei. Suppose p|ai for somei = 1, 2, 3. To simplify notation, assume p|a1. Then k1 is odd. If k1 < 0,

32

then k1 = k2 = k3 since ei are integers. Therefore, p3k1 is the exact power ofp dividing y2 =

∏(x − ei), which is impossible as 3k1 is odd. On the other

hand, if k1 > 0, then k2, k3 ≥ 0 as well since ei ∈ Z. If k2 = k3 = 0, then theexact power of p dividing y2 is pk1+k2+k3 = pk1 , an odd power. Thus ki > 0for some i = 2, 3 which means p|(x− ei)− (x− e1) = e1 − ei|∆.

Lemma 6.11. Let E/Q be an elliptic curve such that

E[2] = O, T1, T2, T3 ⊂ E(Q)

where Ti = (ei, 0). Suppose P ∈ E(Q) and σ ∈ G(Q/Q). Let δ(P )(σ) =σQ−Q, where Q ∈ E(Q) such that 2Q = P , as above.

(i) If P = (x, y) 6= O, Ti, then 〈δ(P )(σ), Ti〉2 = 1 if and only if σ fixes√x− ei.

(ii) If P = O, then e2(δ(P )(σ), Ti) = 1.

(iii) If P = Ti, then 〈δ(P )(σ), Ti〉2 = 1 if and only if σ fixes√(ei+1 − ei)(ei+2 − ei) (subscripts are taken mod 3).

Proof. For i = 1, 2, 3, there exists T ′i ∈ E(Q) such that 2T ′i = Ti. Using thenotation from the Weil pairing construction in Subsection 5.1, there existsfTi , gTi ∈ Q(E) such that

div(fTi) = 2(Ti)− 2(O) and div(gT ) =∑R∈E[2]

(T ′i +R)− (R).

It is not hard to see that fTi = X − ei satisfies this condition. As in theconstruction in Subsection 5.1, fTi 2 = g2

Tiand

〈σQ−Q, Ti〉2 =gTi(X + σQ−Q)

gTi(X), (8)

where X ∈ E is any point such that gTi(X + σQ−Q), gTi(X) 6= 0,∞.Note that E is defined over Q so the multiplication-by-2 map is defined

over Q. Furthermore, Ti is defined over Q, so 2−1Ti = T ′i +R|R ∈ E[2] areprecisely the Galois conjugates of T ′i . Thus div(gTi) is fixed by the G-action,so gTi can be chosen in Q(E) by [Si09, II, Ex. II.2.13].

33

(i) Suppose P = (x, y) 6= O, Ti. Then, by setting X = Q in Equation 8,

〈σQ−Q, Ti〉2 =gTi(σQ)

gTi(Q)=σ√x− ei√x− ei

is trivial if and only if σ fixes√x− ei.

(ii) Suppose P = O. Then 〈σQ − Q, Ti〉2 = 1 as 〈·, ·〉m is a bilinear formand σQ−Q = O since Q = O.

(iii) Suppose P = Ti. Then

〈δ(Ti), Ti〉2 = 〈δ(Ti+1 + Ti+2), Ti〉2 = 〈δ(Ti+1), Ti〉2〈δ(Ti+2), Ti〉2

=σ√ei+1 − ei√ei+1 − ei

σ√ei+2 − ei√ei+2 − ei

by (i). Therefore, 〈δ(Ti), Ti〉2 is trivial if and only if σ fixes√(ei+1 − ei)(ei+2 − ei).

6.2.2 Descent Procedure

In this section, we discuss the descent procedure which brings us from theWeak Mordell-Weil Theorem to the full Mordell-Weil Theorem. The generalprocess is described in the Descent Theorem below. The problem is thenreduced to finding a satisfactory “height function” on the curve.

Theorem 6.12 (Descent Theorem). Suppose A is an abelian group withsome function h : A→ R satisfying

(i) Fix Q ∈ A. There exists a constant CQ such that h(P +Q) ≤ 2h(P ) +CQ for all P ∈ A.

(ii) There exists some integer m ≥ 2 and a constant C such that h(mP ) ≥m2h(P )− C for all P ∈ A.

(iii) For any D ∈ R, the set P ∈ A | h(P ) ≤ D is finite.

If A/mA is finite, then A is finitely generated.

34

Proof. Let Q1, . . . , Qr ∈ A be coset representatives for A/mA. SupposeP ∈ A. As the cosets partition A, P − Qi1 ∈ mA for some 1 ≤ i1 ≤ r. SayP = P0 = mP1 + Qi1 . Similarly, we can recursively construct the sequenceof points Pj−1 = mPj +Qij , Pj ∈ A, ij ∈ 1, . . . , r. Then for all j,

h(Pj) ≤1

m2(h(mPj) + C) =

1

m2(h(Pj−1 −Qij) + C) by (ii)

≤ 1

m2(2h(Pj−1) + C ′ + C) by (i)

where C ′ = maxC−Q1 , . . . , C−Qr. Repeated use of this inequality gives usa formula for h(Pn) in terms of (P )

h(Pn) ≤ (2

m2)nh(P ) + (

1

m2+ . . .+

2n−1

m2n)(C ′ + C)

< (2

m2)nh(P ) +

1

m2 − 2(C ′ + C)

≤ (1

2)nh(P ) +

1

2(C ′ + C) as m ≥ 2

≤ 1 +1

m2 − 2(C ′ + C) for n large.

Then

P = mnPn +n∑j=1

mj−1Qij

so E(Q) is generated by

Q1, . . . , Qr ∪ P ∈ A | h(P ) ≤ 1 + (C ′ + C)/2

which is finite by (iii).

We now give a height function on a rational curve. There is a slightlymore complicated height function for the K-points on an elliptic curve whereK is any number field. However, this will not be discussed here (see Chapter8 of [Si09]). Let E/Q be an elliptic curve defined over Q. By the WeakMordell-Weil Theorem, E(Q)/2E(Q) is finite.

Definition 6.13. Suppose t ∈ Q and t = p/q with (p, q) = 1. The height oft is given by

H(t) = max|p|, |q|.

35

The (log) height on E(Q) is the function

hx : E(Q)→ R≤0

given by hx(0) = 0 and hx(x, y) = logH(x).

Lemma 6.14. (i) Pick P0 ∈ E(Q). There exists a constant CP0 such thath(P + P0) ≤ 2h(P ) + CP0 for all P ∈ E(Q).

(ii) There exists a constant C such that h(2P ) ≥ 4h(P ) − C for all P ∈E(Q).

(iii) For any D ∈ R, the set P ∈ E(Q) | h(P ) ≤ D is finite.

Very brief justification / Method of proof. (i). By increasing CP0 as needed,we may ignore finitely many P ∈ E(Q). In particular, assume P0 6= P andneither are the point at infinity. Use the formula for sums of distinct points

x(P + P0) =

(y1 − y0

x1 − x0

)2

− x1 − x0

which has degree 2 so we would expect h(P + P0) ≈ 2h(P ). (For a completeproof, plug in x = a/b2, y = c/d3 and similar forms for x0, y0, expand, andkeep track of gcd’s.)(ii). The main inspiration for this part is that the “doubling isogeny” is ofdegree 4. This is clear since the kernel of this isogeny (when considered overE(Q)) is E[2] which has four points. The same general approach as abovewould give a complete proof.(iii). Pick any D ∈ R. Then

P ∈ E(Q) | hx(P ) ≤ D ⊂ 0 ∪ (p/q, y) ∈ E(Q) | max|p|, |q| ≤ D

but there are at most 2D + 1 values for p and q and for each p/q there areat most 2 values for y so #P ∈ E(Q) | hx(P ) ≤ D ≤ 1 + 2(2D + 1)2.

Theorem 6.15 (Mordell-Weil). E(Q) is finitely generated.

Proof. By the Weak Mordell-Weil Theorem and Lemma (6.14), E(Q) andhx satisfy the conditions of Theorem (6.12) at m = 2 so by the DescentTheorem, E(Q) is finitely generated.

36

Acknowledgments

I would like to thank my mentor, Sean Howe, for his guidance throughoutthis project and for explaining useful ways to think about new concepts. Hissupport is greatly appreciated. I would also like to thank Peter May forconducting and including me in this REU.

References

[Ha77] Hartshorne, Robin. Algebraic Geometry. New York: Springer-Verlag,1977. Print.

[Ko84] Koblitz, Neal. Introduction to Elliptic Curves and Modular Forms.New York: Springer-Verlag, 1984. Print.

[La94] Lang, Serge. Algebraic Number Theory. New York, NY [u.a.:Springer, 1994. Print.

[Mi13] Milne, James S. “Algebraic Number Theory.” Milne’s Notes. N.p., 21Mar. 2013. Web.

[Se79] Serre, Jean-Pierre. Local Fields. New York: Springer-Verlag, 1979.Print.

[Si09] Silverman, Joseph H. The Arithmetic of Elliptic Curves. New York:Springer, 2009. Print.

[Wa08] Washington, Lawrence C. Elliptic Curves: Theory and Cryptography.Boca Raton, Fla. [u.a.: Chapman & Hall/CRC, 2008. Print.

37