The Birch and Swinnerton-Dyer Conjecture, a Computational Approach

William A. Stein

Department of Mathematics, University of Washington

E-mail address: wstein@math.washington.edu

1991 Mathematics Subject Classification. Primary 11; Secondary 11-04

Key words and phrases. abelian varieties, computation, elliptic curves, Hecke operators, modular curves, modular forms, modular symbols, Manin

symbols, number theory

Abstract.

Contents

Preface vii Chapter 1. The BSD Rank Conjecture 1

§1.1. Statement of the BSD Rank Conjecture 1 §1.2. The BSD Rank Conjecture Implies that E(ℚ) is Computable 3 §1.3. The Complex L-series L(E, s) 5 §1.4. Computing L(E, s) 8 §1.5. The p-adic L-series 12 §1.6. Computing L_{p}(E, T) 15

Chapter 2. The Birch and Swinnerton-Dyer Formula 19 §2.1. Galois Cohomology 19 §2.2. The Shafarevich-Tate Group 23 §2.3. The Birch and Swinnerton-Dyer Formula 27 §2.4. Examples: The Birch and Swinnerton-Dyer Formula 29 §2.5. The p-adic BSD Conjectural Formula 37

Chapter 3. Heegner Points and Kolyvagin’s Euler System 45 §3.1. CM Elliptic Curves 45 §3.2. Heegner Points 50 §3.3. Computing Heegner Points 50 §3.4. Kolyvagin’s Euler System 51 §3.5. The Gross-Zagier Theorem 59

Chapter 4. Computational Verification of the Conjecture 61 vi Contents

§4.1. Theorem 61 §4.2. Examples 61

Bibliography 63

Preface

This is an introductory graduate-level textbook about the Birch and Swinnerton-Dyer conjecture and modern approaches to the arithmetic of elliptic curves.

Other very relevant books: Darmon’s Rational Points on Modular Elliptic Curves.

Acknowledgements. I would like to acknowledge the partial support of NSF Grant DMS 05-55776.

Notation and Conventions.

Chapter 1

The BSD Rank Conjecture

This chapter explains the conjecture that Birch and Swinnerton-Dyer made about ranks of elliptic curves (the BSD rank conjecture).

1.1. Statement of the BSD Rank Conjecture

An excellent reference for this section is Andrew Wiles’s Clay Math Institute paper [Wil00]. The reader is also strongly encouraged to look Birch’s original paper [Bir71] to get a better sense of the excitement surrounding this conjecture, as exemplified in the following quote:

“I want to describe some computations undertaken by myself and Swinnerton-Dyer on EDSAC by which we have calculated the zeta-functions of certain elliptic curves. As a result of these computations we have found an analogue for an elliptic curve of the Tamagawa number of an algebraic group; and conjectures (due to ourselves, due to Tate, and due to others) have proliferated.”

An elliptic curve E over a field K is the projective closure of the zero locus of a nonsingular affine curve

(1.1.1)  y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6},

where a_{1}, a_{2}, a_{3}, a_{4}, a_{6} ∈ K. There is a simple algebraic condition on the a_{i} that ensures that (1.1.1) defines a nonsingular curve (see, e.g., [Sil92]).

An elliptic curve E has genus 1, and the set of points on E has a natural structure of abelian group, with identity element the one extra projective point at ∞. Again, there are simple algebraic formulas that, given two points P and Q on an elliptic curve, produce a third point P + Q on the elliptic curve. Moreover, if P and Q both have coordinates in K, then so does P + Q. The Mordell-Weil group

E(K) = { points on E with coordinates in K }

of E over K plays a central role in this book.

In the 1920s, Mordell proved that if K = ℚ, then E(ℚ) is finitely generated, and soon after Weil proved that E(K) is finitely generated for any number field K, so

(1.1.2)  E(K) ≈ ℤ^{r} ⊕ T,

where T is a finite group. Perhaps the chief invariant of an elliptic curve E over a number field K is the rank, which is the number r in (1.1.2).

Fix an elliptic curve E over ℚ. For all but finitely many prime numbers p, the equation (1.1.1) reduces modulo p to define an elliptic curve over the finite field 𝔽_{p}. The primes that must be excluded are exactly the primes that divide the discriminant Δ of (1.1.1).

As above, the set of points E(𝔽_{p}) is an abelian group. This group is finite, because it is contained in the set ℙ^{2}(𝔽_{p}) of rational points in the projective plane. Moreover, since it is the set of points on a (genus 1) curve, a theorem of Hasse implies that

|p + 1 − #E(𝔽_{p})| ≤ 2\sqrt{p}.

The error terms

a_{p} = p + 1 − #E(𝔽_{p})

play a central role in almost everything in this book. We next gather together the error terms into a single “generating function”:

L̃(E, s) = ∏_{p∤Δ}(\frac{1}{1 − a_{p}p^{−s} + p^{1−2s}} ) .

The function L̃(E, s) defines a complex analytic function on some right half plane Re(s) > \frac{3}{2}.

A deep theorem of Wiles et al. [Wil95, BCDT01], which many consider the crowning achievement of 1990s number theory, implies that L̃(E, s) can be analytically continued to an analytic function on all ℂ. This implies that L̃(E, s) has a Taylor series expansion about s = 1:

L̃(E, s) = c_{0} + c_{1}(s − 1) + c_{2}(s − 1)^{2} + ⋯

Define the analytic rank r_{an} of E to be the order of vanishing of L̃(E, s) as s = 1, so

L̃(E, s) = c_{r_{an}}(s − 1)^{r_{an}} + · · · .

1.2. The BSD Rank Conjecture Implies that E(ℚ) is Computable 3

The definitions of the analytic and Mordell-Weil ranks could not be more different – one is completely analytic and the other is purely algebraic.

Conjecture 1.1 (Birch and Swinnerton-Dyer Rank Conjecture). Let E be an elliptic curve over ℚ. Then the algebraic and analytic ranks of E are the same.

This problem is extremely difficult. The conjecture was made in the 1960s, and hundreds of people have thought about it for over 4 decades. The work of Wiles et al. on modularity in late 1999, combined with earlier work of Gross, Zagier, and Kolyvagin, and many others proves the following partial result toward the conjecture.

Theorem 1.2. Suppose E is an elliptic curve over ℚ and that r_{an} ≤ 1. Then the algebraic and analytic ranks of E are the same.

In 2000, Conjecture 1.1 was declared a million dollar millenium prize problem by the Clay Mathematics Institute, which motivated even more work, conferences, etc., on the conjecture. Since then, to the best of my knowledge, not a single new result directly about Conjecture 1.1 has been proved^{1}. The class of curves for which we know the conjecture is still the set of curves over ℚ with r_{an} ≤ 1, along with a finite set of individual curves on which further computer calculations have been performed (by Cremona, Watkins, myself, and others).

“A new idea is needed.”

– Nick Katz on BSD, at a 2001 Arizona Winter School

And another quote from Bertolini-Darmon (2001):

“The following question stands as the ultimate challenge concerning the Birch and Swinnerton-Dyer conjecture for elliptic curves over ℚ: Provide evidence for the Birch and Swinnerton-Dyer conjecture in cases where ord_{s=1} L(E, s) > 1.”

1.2. The BSD Rank Conjecture Implies that E(ℚ) is Computable

Proposition 1.3. Let E be an elliptic curve over ℚ. If Conjecture 1.1 is true, then there is an algorithm to compute the rank of E.

Proof. By naively searching for points in E(ℚ) we obtain a lower bound on r, which is closer and closer to the true rank r, the longer we run the search. At some point this lower bound will equal r, but without using further information we do not know when that will occur.

1Much interesting new work has been done on related conjectures and problems.

As explained, e.g., in [Cre97] (see also [Dok04]), we can for any k compute L^{(k)}(E, 1) to any desired precision. Such computations yield upper bounds on r_{an}. In particular, if we compute L^{(k)}(E, 1) and it is nonzero (to the precision of our computation), then r_{an} ≤ k. Eventually this method will also converge to give an upper bound on r_{an}, though again without further information we do not know when our computed upper bound on r_{an} equals to the true value of r_{an}.

Since we are assuming that Conjecture 1.1 is true, we know that r = r_{an}, hence at some point the lower bound on r computed using point searches will equal the upper bound on r_{an} computed using the L-series. At this point, by Conjecture 1.1, we know the true value of r. □

Next we show that given the rank r, the full group E(ℚ) is computable. The issue is that what we did above might have only computed a subgroup of finite index. The argument below follows [Cre97, §3.5] closely.

The naive height h(P) of a point P = (x, y) ∈ E(ℚ) is

h(P) = log(max(numer(x), denom(x))).

The Néron-Tate canonical height of P is

ĥ(P) = lim_{n→∞} \frac{h(2^{n}P)}{4^{n}}.

Note that if P has finite order then ĥ(P) = 0. Also, a standard result is that the height pairing

⟨P, Q⟩ = \frac{1}{2} (ĥ(P + Q) − ĥ(P) − ĥ(Q))

defines a nondegenerate real-valued quadratic form on E(ℚ)/_{tor} with discrete image.

Lemma 1.4. Let B > 0 be a positive real number such that

S = {P ∈ E(ℚ) : ĥ(P) ≤ B}

contains a set of generators for E(ℚ)/2E(ℚ). Then S generates E(ℚ).

Proof. Let A be the subgroup of E(ℚ)/_{tor} generated by the points in S. Suppose for the sake of contradiction that A is a proper subgroup. Then there is Q ∈ E(ℚ) \ A with ĥ(Q) minimal, since ĥ takes a discrete set of values. Since S contains generators for E(ℚ)/2E(ℚ), there is an element P ∈ S that is congruent to Q modulo 2E(ℚ), i.e., so that

Q = P + 2R,

1.3. The Complex L-series L(E, s) 5

for some R ∈ E(ℚ). We have R ∉ A (since otherwise Q would be in A), so ĥ(R) ≥ ĥ(Q) by minimality. Finally, since ĥ is quadratic and nonnegative, we have

ĥ(P) = \frac{1}{2} (ĥ(Q + P) + ĥ(Q − P) − ĥ(Q))

≥ \frac{1}{2}ĥ(2R) − ĥ(Q)

= 2ĥ(R) − ĥ(Q) ≥ ĥ(Q) > B.

(Here we use that ĥ(P) = ⟨P, P ⟩ and use properties of a bilinear form.) □

Proposition 1.5. Let E be an elliptic curve over ℚ. If Conjecture 1.1 is true, then there is an algorithm to compute E(ℚ).

Proof. By Proposition 1.3 we can compute the rank r of E(ℚ). Note that we can also trivially compute the subgroup E(ℚ)[2] of elements of order 2 in E(ℚ), since if E is given by y^{2} = x^{3} +ax+b, then this subgroup is generated by points (α, β), where α is a rational root of x^{3} + ax + b. Thus we can compute s = dim_{𝔽_{2}} E(ℚ)/2E(ℚ), since it is equal to r + dim E(ℚ)[2].

Run any search for points in E(ℚ) and use that ĥ is a nondegenerate quadratic form to find independent points P_{1}, …, P_{r} of infinite order. It is easy to check whether a point P is twice another point (just solve a relatively simple algebraic equation). Run through all subsets of the points P_{i}, and if any subset of the P_{i} sums to 2Q for some point Q ∈ E(ℚ), then we replace one of the P_{i} by Q and decrease the index of our subgroup in E(ℚ) by a factor of 2. Because E(ℚ) is a finitely generated group, after a finite number of steps (and including the 2-torsion points found above) we obtain independent points P_{1}, …, P_{s} that generate E(ℚ)/2E(ℚ).

Let C the the explicit bound of Cremona-Pricket-Siksek on the difference between the naive and canonical height (i.e., for any P ∈ E(ℚ), we have |h(P) − ĥ(P)| < C). Let

B = max{ĥ(P_{1}), …, ĥ(P_{s})}.

Then by a point search up to naive height B + C, we compute a set that contains the set S in Lemma 1.4. This set then contains generators for E(ℚ), hence we have computed E(ℚ).

□

1.3. The Complex L-series L(E, s)

In Section 1.1 we defined a function L̃(E, s), which encoded information about E(𝔽_{p}) for all but finitely many primes p. In this section we define the function L(E, s), which includes information about all primes, and the function Λ(E, s) that also includes information “at infinity”.

Let E be an elliptic curve over ℚ defined by a minimal Weierstrass equation

(1.3.1)  y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6}.

A minimal Weierstrass equation in one for which the a_{i} are all integers and the discriminant Δ ∈ ℤ is minimal amongs all discriminants of Weierstrass equations for E (again, see [Sil92] for the definition of the discriminant of a Weierstrass equation, and also for an explicit description of the allowed transformations of a Weierstrass equation).

For each prime number p ∤ Δ, the equation (1.3.1) reduces modulo p to define an elliptic E_{𝔽_{p}} over the finite field 𝔽_{p}. Let

a_{p} = p + 1 − #E(𝔽_{p}).

For each prime p | Δ, we use the following recipe to define a_{p}. If the singular curve E_{𝔽_{p}} has a cuspidal singularity, e.g., is y^{2} = x^{3}, then let a_{p} = 0. If it has a a nodal singularity, e.g., like y^{2} = x^{3} + x^{2}, let a_{p} = 1 if the slope of the tangent line at the singular point is in 𝔽_{p} and let a_{p} = −1 if the slope is not in 𝔽_{p}. Summarizing:

a_{p} = \begin{cases}0 & if the reduction is cuspidal (“additive”), \\ 1 & if the reduction is nodal and tangent line is 𝔽_{p}-rational (“split multiplicative”) \\ −1 & if the reduction is nodal and tangent line is not 𝔽_{p}-rational (“non-split multiplicative”) \end{cases}

Even in the cases when p | Δ, we still have

a_{p} = p + 1 − #E(𝔽_{p}).

When E has additive reduction, the nonsingular points form a group isomorphic to (𝔽_{p}, +), and there is one singular point, hence p + 1 points, so

a_{p} = p + 1 − (p + 1))) = 0.

When E has split multiplicative reduction, there is 1 singular point plus the number of elements of a group isomorphic to (𝔽_{p}^{∗}, ×), so 1 + (p − 1) = p points, and

a_{p} = p + 1 − p = 1.

When E has non-split multiplicative reduction, there is 1 singular point plus the number of elements of a group isomorphic (𝔽_{p^{2}}^{∗}/𝔽_{p}^{∗}, ×), i.e., p + 2 points, and

a_{p} = p + 1 − (p + 2) = −1.

The definition of the full L-function of E is then

L(E, s) = ∏_{p|Δ} \frac{1}{1 − a_{p}p^{−s}} · ∏_{p∤Δ} \frac{1}{1 − a_{p}p^{−s} + p · p^{−2s}} . = ∑_{n=1}^{∞} \frac{a_{n}}{n^{s}} .

If in addition we add in a few more analytic factors to the L-function we obtain a function Λ(E, s) that satisfies a remarkably simple functional equation. Let

Γ(z) = ∫_{0}^{∞} t^{z−1}e^{−t}dt

be the Γ-function (e.g., Γ(n) = (n − 1)!), which defines a meromorphic function on ℂ, with poles at the non-positive integers.

Theorem 1.6 (Hecke, Wiles et al.). There is a unique positive integer N = N_{E} and sign ε = ε_{E} ∈ {±1} such that the function

Λ(E, s) = N^{s/2} · (2π)^{−s} · Γ(s) · L(E, s)

extends to a complex analytic function on all ℂ that satisfies the functional equation

(1.3.2)  Λ(E, 2 − s) = ε · Λ(E, s),

for all s ∈ ℂ.

Proof. Wiles et al. prove that L(E, s) is the L-series attached to a modular form (see Section ?? below), and Hecke proved that the L-series of a modular form analytically continues and satisfies the given functional equation. □

The integer N = N_{E} is called the conductor of E and ε = ε_{E} is called the sign in the functional equation for E or the root number of E. One can prove that the primes that divide N are the same as the primes that divide Δ. Moreover, for p ≥ 5, we have that

ord_{p}(N) = \begin{cases}0, & if p ∤ Δ, \\ 1, & if E has multiplicative reduction at p, and \\ 2, & if E has additive reduction at p. \end{cases}

There is a geometric algorithm called Tate’s algorithm that computes N in all cases and ε.

Example 1.7. Consider the elliptic curve E defined by

y^{2} + y = x^{3} + 50x + 31.

The above Weierstrass equation is minimal and has discriminant

−1 · 5^{6} · 7^{2} · 11.

     sage: e = EllipticCurve('1925d'); e
     Elliptic Curve defined by y^2 + y = x^3 + 50*x + 31 over Rational Field
     sage: e.is_minimal()
     True
     sage: factor(e.discriminant())
     -1 * 5^6 * 7^2 * 11

At 5 the curve has additive reduction so a_{5} = 0. At 7 the curve has split multiplicative reduction so a_{7} = 1. At 11 the curve has nonsplit multiplicative reduction, so a_{11} = −1. Counting points for p = 2, 3, we find that

L(E, s) = \frac{1}{1^{−s}} + \frac{3}{3^{−s}} + \frac{−2}{4^{−s}} + \frac{1}{7^{−s}} + \frac{6}{9^{−s}} + \frac{−1}{11^{−s}} + \frac{−6}{12^{−s}} + ⋯

     sage: [e.ap(p) for p in primes(14)]
     [0, 3, 0, 1, -1, 4]

Corollary 1.8. Let E be an elliptic curve over ℚ, let ε ∈ {1, −1} be the sign in the functional equation (1.3.2), and let r_{E,an} = ord_{s=1} L(E, s). Then

ε = (−1)^{r_{E,an}}.

Proof. Because Γ(1) = 1, we have ord_{s=1} L(E, s) = ord_{s=1} Λ(E, s). It thus sufficies to prove the corollary with L(E, s) replaced by Λ(E, s). Note that r = r_{E,an} is the minimal integer r ≥ 0 such that Λ^{(r)}(E, 1) ≠ 0. By repeated differentiation, we see that for any integer k ≥ 0, we have

(1.3.3)  (−1)^{k}Λ^{(k)}(E, 2 − s) = ε · Λ^{(k)}(s).

Setting s = 1 and k = r, and using that Λ^{(r)}(E, 1) ≠ 0, shows that (−1)^{r} = ε, as claimed. □

Conjecture 1.9 (The Parity Conjecture). Let E be an elliptic curve over ℚ, let r_{E,an} be the analytic rank and r_{E,alg} be the algebraic rank. Then

r_{E,alg} ≡ r_{E,an} (mod 2).

Jan Nekovar has done a huge amount of work toward Conjecture 1.9; in particular, he proves it under the (as yet unproved) hypothesis that � (E) is finite (see Section 2.2 below).

1.4. Computing L(E, s)

In this section we briefly describe one way to evaluate L(E, s), for s real. See [Dok04] for a more sophisticated analysis of computing L(E, s) and its Taylor expansion for any complex number s.

1.4. Computing L(E, s) 9

Theorem 1.10 (Lavrik). We have the following rapidly-converging series expression for L(E, s), for any complex number s:

L(E, s) = N^{−s/2} · (2π)^{s} · Γ(s)^{−1} · ∑_{n=1}^{∞} a_{n} · (F_{n}(s − 1) − εF_{n}(1 − s))

where

F_{n}(t) = Γ (t + 1, \frac{2πn}{\sqrt{N}}) · (\frac{\sqrt{N}}{2πn})^{t+1} ,

and

Γ(z, α) = ∫_{α}^{∞} t^{z−1}e^{−t}dt

is the incomplete Γ-function.

Theorem 1.10 above is a special case of a more general theorem that gives rapidly converging series that allow computation of any Dirichlet series ∑ a_{n}n^{s} that meromorphically continues to the whole complex plane and satisfies an appropriate functional equation. For more details, see [Coh00, §10.3], especially Exercise 24 on page 521 of [Coh00].

1.4.1. Approximating the Rank. Fix an elliptic curve E over ℚ. The usual method to approximate the rank is to find a series that rapidly converges to L^{(r)}(E, 1) for r = 0, 1, 2, 3, …, then compute L(E, 1), L′(E, 1), L^{(2)}(E, 1), etc., until one appears to be nonzero. Note that half of the L^{(k)}(E, 1) are automatically 0 because of equation (1.3.3). For more details, see [Cre97, §2.13] and [Dok04].

In this section, we describe a slightly different method, which only uses Theorem 1.10 and the definition of the derivative.

Proposition 1.11. Write

L(E, s) = c_{r}(s − 1)^{r} + c_{r+1}(s − 1)^{r+1} + · · · .

with c_{r} ≠ 0. Then

lim_{s→1} (s − 1) · \frac{L′(E, s)}{L(E, s)} = r.

Proof. Setting L(s) = L(E, s), we have

lim_{s→1} (s − 1) · \frac{L′(s)}{L(s)} = lim_{s→1} (s − 1) · \frac{rc_{r}(s − 1)^{r−1} + (r + 1)c_{r+1}(s − 1)^{r} + ⋯}{c_{r}(s − 1)^{r} + c_{r+1}(s − 1)^{r+1} + ⋯}

= r · lim_{s→1} \frac{c_{r}(s − 1)^{r} + \frac{(r+1)}{r}c_{r+1}(s − 1)^{r+1} + ⋯}{c_{r}(s − 1)^{r} + c_{r+1}(s − 1)^{r+1} + ⋯}

= r.

□

Thus the rank r is the limit as s → 1 of a certain (smooth) function. We know this limit is an integer. But, for example, for the rank 4 curve

(1.4.1)  y^{2} + xy = x^{3} − x^{2} − 79x + 289

of conductor 234446 nobody has succeeded in proving that this integer limit is 4. (We can prove that the limit is either 2 or 4 by using the functionality equation (1.3.2) to show that the order of vanishing is even, then verifying by computation that L^{(4)}(E, 1) = 214.65233 … ≠ 0.)

Using the definition of derivative, we approximate (s−1)\frac{L′(s)}{L(s)} as follows. For |s − 1| small, we have

(s − 1)\frac{L′(s)}{L(s)} = \frac{s − 1}{L(s)} · lim_{h→0} \frac{L(s + h) − L(s)}{h}

≈ \frac{s − 1}{L(s)} · \frac{L(s + (s − 1)^{2}) − L(s)}{(s − 1)^{2}}

= \frac{L(s^{2} − s + 1) − L(s)}{(s − 1)L(s)}

In fact, we have

lim_{s→1} (s − 1) · \frac{L′(s)}{L(s)} = lim_{s→1} \frac{L(s^{2} − s + 1) − L(s)}{(s − 1)L(s)}.

We can use this formula in SAGE to “approximate” r. First we start with a curve of rank 2.

sage: e = EllipticCurve('389a'); e.rank()
2
sage: L = e.Lseries_dokchitser()
sage: def r(e,s): L1=L(s); L2=L(s^2-s+1); return (L2-L1)/((s-1)*L1)
sage: r(e,1.01)
2.00413534247395
sage: r(e,1.001)
2.00043133754756
sage: r(e,1.00001)
2.00000433133371

Next consider the curve y^{2} + xy = x^{3} − x^{2} − 79x + 289 of rank 4:

sage: e =  EllipticCurve([1, -1, 0, -79, 289])
sage: e.rank()
4
sage: L = e.Lseries_dokchitser(100)
sage: def r(e,s): L1=L(s); L2=L(s^2-s+1); return (L2-L1)/((s-1)*L1)
sage: R = RealField(100)
sage: r(e,R('1.01'))
4.0212949184444018810727106489
sage: r(e,R('1.001'))
4.0022223745190806421850637523
sage: r(e,R('1.00001'))
4.0000223250026401574120263050
sage: r(e,R('1.000001'))
4.0000022325922257758141597819

It certainly looks like lim_{s→1} r(s) = 4. We know that lim_{s→1} r(s) ∈ ℤ, and if only there were a good way to bound the error we could conclude that the limit is 4. But this has stumped people for years, and probably it is nearly impossible without a deep result that somehow interprets L′′(E, 1) in a completely different way.

1.5. The p-adic L-series

Fix^{2} an elliptic curve E defined over ℚ. We say a prime p is a prime of good ordinary reduction for E if p ∤ N_{E} and a_{p} ≢ 0 (mod p). The Hasse bound, i.e., that |a_{p}| < 2\sqrt{p} on implies that if p ≥ 5 then ordinary at p is the same as a_{p} ≠ 0.

In this section, we define for each odd prime number p of good ordinary reduction for E a p-adic L-function L_{p}(E, T). This is a p-adic analogue of the complex L-function L(E, s) about which there are similar analogue of the BSD conjecture.

1.5.1. Hensel’s lemma and the Teichmuller lift. The following standard lemma is proved by Newton iteration.

Lemma 1.12 (Hensel). If f ∈ ℤ_{p}[x] is a polynomial and β ∈ ℤ/pℤ is a multiplicity one root of \overline{f}, then there is a unique lift of β to a root of f.

For example, consider the polynomial f(x) = x^{p−1} − 1. By Fermat’s little theorem, it has p − 1 distinct roots in ℤ/pℤ, so by Lemma 1.12 there are p − 1 roots of f(x) in ℤ_{p}, i.e., all the p − 1st roots of unity are elements of ℤ_{p}. The Teichmuller lift is the map that sends any β ∈ (ℤ/pℤ)^{∗} to the unique (p − 1)st root of unity in ℤ_{p}^{∗} that reduces to it.

The Teichmuller character is the homomorphism

τ : ℤ_{p}^{∗} → ℤ_{p}^{∗}

obtained by first reducing modulo p, then sending an element to its Teichmuller lift. The 1-unit projection character is the homomorphism

⟨ • ⟩ : ℤ_{p}^{∗} → 1 + pℤ_{p}

given by

⟨x⟩ = \frac{x}{τ(x)}.

1.5.2. Modular Symbol and Measures. Let

f_{E}(z) = ∑_{n=1}^{∞} a_{n}e^{2πinz} ∈ S_{2}(Γ_{0}(N))

be the modular form associated to E, which is a holomorphic function on the extended upper half plane 𝔥 ∪ ℚ ∪ {∞}. Let

Ω_{E} = ∫_{E(ℝ)} \frac{dx}{2y + \underline{a}_{1}x + \underline{a}_{3}} ∈ ℝ

2This section is based on correspondence with Robert Pollack and Koopa Koo.

1.5. The p-adic L-series 13

be the real period associated to a minimal Weierstrass equation

y^{2} + \underline{a}_{1}xy + \underline{a}_{3}y = x^{3} + \underline{a}_{2}x^{2} + \underline{a}_{4}x + \underline{a}_{6}

for E.

The plus modular symbol map associated to the elliptic curve E is the map ℚ → ℚ given by sending r ∈ ℚ to

[r] = [r]_{E} = \frac{2πi}{Ω_{E}} (∫_{r}^{i∞} f_{E}(z)dz + ∫_{−r}^{i∞} f_{E}(z)dz) .

Question 1.13. Let E vary over all elliptic curve over ℚ and r over all rational numbers. Is the set of denominators of the rational numbers [r]_{E} bounded? Thoughts: For a given curve E, the denominators are bounded by the order of the image in E(\overline{ℚ}) of the cuspidal subgroup of J_{0}(N)(\overline{ℚ}). It is likely one can show that if a prime ℓ divides the order of the image of this subgroup, then E admits a rational ℓ-isogeny. Mazur’s theorem would then prove that the set of such ℓ is bounded, which would imply a “yes” answer to this question. Also, for any particular curve E, one can compute the cuspidal subgroup precisely, and hence bound the denominators of [r]_{E}.

Let a_{p} be the pth Fourier coefficient of E and note that the polynomial

x^{2} − a_{p}x + p ≡ x(x − a_{p}) (mod p)

has distinct roots because p is an ordinary prime. Let α be the root of x^{2} − a_{p}x + p with |α|_{p} = 1, i.e., the lift of the root a_{p} modulo p, which exists by Lemma 1.12.

Define a measure on ℤ_{p}^{∗} by

μ_{E}(a + p^{n}ℤ_{p}) = \frac{1}{α^{n}} [\frac{a}{p^{n}} ] − \frac{1}{α^{n+1}} [\frac{a}{p^{n−1}} ] .

That μ_{E} is a measure follows from the formula for the action of Hecke operators on modular symbols and that f_{E} is a Hecke eigenform. We will not prove this here^{3}.

1.5.3. The p-Adic L-function. Define the p-adic L-function as a function on characters

χ ∈ Hom(ℤ_{p}^{∗}, ℂ_{p}^{∗})

as follows. Send a character χ to

L_{p}(E, χ) = ∫_{ℤ_{p}^{∗}} χ dμ_{E}.

We will later make the integral on the right more precise, as a limit of Riemann sums (see Section 1.6).

3Add proof or good reference.

Remark 1.14. For any Dirichlet character χ : ℤ/nℤ → ℂ, let L(E, χ, s) be the entire L-function defined by the Dirichlet series

∑_{n=1}^{∞} \frac{χ(n)a_{n}}{n^{s}} .

The standard interpolation property of L_{p} is that for any primitive Dirichlet character χ of conductor p^{n} (for any n), we have^{4}

(1.5.1)  L_{p}(E, χ) = \begin{cases}p^{n} · g(χ) · L(E, χ̄, 1)/Ω_{E} & for χ ≠ 1, \\ (1 − α^{−1})^{2}L(E, 1)/Ω_{E} & if χ = 1, \end{cases}

where g(χ) is the Gauss sum:

g(χ) = ∑_{a mod p^{n}} χ(a)e^{\frac{2πia}{p^{n}}} .

Note, in particular, that L(E, 1) ≠ 0 if and only if L_{p}(E, 1) ≠ 0.

In order to obtain a Taylor series attached to L_{p}, we view L_{p} as a p-adic analytic function on the open disk

D = {u ∈ ℂ_{p} : |u − 1|_{p} < 1},

as follows. We have that γ = 1 + p is a topological generator for 1 + pℤ_{p}. For any u ∈ D, let ψ_{u} : 1 + pℤ_{p} → ℂ_{p}^{∗} be the character given by sending γ to u and extending by using the group law and continuity. Extend ψ_{u} to a character χ_{u} : ℤ_{p}^{∗} → ℂ_{p}^{∗} by letting χ_{u}(x) = ψ_{u}(⟨x⟩). Finally, overloading notation, let

L_{p}(E, u) = L_{p}(E, χ_{u}).

Theorem 1.15. The function L_{p}(E, u) is a p-adic analytic function on D with Taylor series about u = 1 in the variable T

L_{p}(E, T) ∈ ℚ_{p}[[T]].

that converges on {z ∈ ℂ_{p} : |z|_{p} < 1}. (Note that L_{p}(E, u) = L_{p}(E, u − 1).)

It is L_{p}(E, T) that we will compute explicitly.

Conjecture 1.16 (Mazur, Tate, Teitelbaum).

ord_{T} L_{p}(E, T) = rank E(ℚ).

Proposition 1.17. Conjecture 1.16 is true if ord_{T} L_{p}(E, T) ≤ 1.

4I copied this from Bertolini-Darmon, and I don’t trust it exactly yet, especially because the line from Bertolini-Darmon for χ = 1 was wrong.

1.6. Computing L_{p}(E, T) 15

Sketch of Proof. By Remark 1.14, we have ord_{T} (L_{p}(E, T)) = 0 if and only if

r_{E,an} = ord_{s=1} L(E, s) = 0.

Since the BSD rank conjecture (Conjecture 1.1) is a theorem when r_{E,an} = 0, Conjecture 1.16 is also known under the hypothesis that ord_{T} (L_{p}(E, T)) = 0.

Recall that the BSD rank conjecture is also a theorem when r_{E,an} = 1. It turns out that the same is true of Conjecture 1.16 above. If ord_{T} (L_{p}(E, T)) = 1, then a theorem of Perrin-Riou implies that a certain Heegner point has nonzero p-adic height, hence is non-torsion, so by the Gross-Zagier theorem r_{E,an} = 1. Kolyvagin’s theorem then implies that rank E(ℚ) = 1. □

Remark 1.18. Mazur, Tate, and Teitelbaum also define an analogue of L_{p}(E, T) for primes of bad multiplicative reduction and make a conjecture. A prime p is supersingular for E if a_{p} ≡ 0 (mod p); it is a theorem of Elkies [Elk87] that for any elliptic curve E there are infinitely many supersingular primes p. Perrin-Riou, Pollack, Greenberg and others have studied L_{p}(E, T) at good supersingular primes. More works needs to be done on finding a definition of L_{p}(E, T) when p is a prime of bad additive reduction for E.

Remark 1.19. A theorem of Rohrlich implies that there is some character as in (1.5.1) such that L(E, χ, 1) ≠ 0, so L_{p}(E, T) is not identically zero. Thus ord_{T} L_{p}(T) < ∞.

1.6. Computing L_{p}(E, T)

Fix notation as in Section 1.5. In particular, E is an elliptic curve over ℚ, p is an odd prime of good ordinary reduction for E, and α is the root of x^{2} − a_{p}x + p with |α|_{p} = 1.

For each integer n ≥ 1, define a polynomial

P_{n}(T) = ∑_{a=1}^{p−1} ( ∑_{j=0}^{p^{n−1}−1} μ_{E} (τ(a)(1 + p)^{j} + p^{n}ℤ_{p}) · (1 + T)^{j}) ∈ ℚ_{p}[T].

Recall that τ(a) ∈ ℤ_{p}^{∗} is the Teichmuller lift of a.

Proposition 1.20. We have that the p-adic limit of these polynomials is the p-adic L-series:

lim_{n→∞} P_{n}(T) = L_{p}(E, T).

This convergence is coefficient-by-coefficient, in the sense that if P_{n}(T) = ∑_{j} a_{n,j}T^{j} and L_{p}(E, T) = ∑_{j} a_{j}T^{j}, then

lim_{n→∞} a_{n,j} = a_{j}.

We now give a proof of this convergence and in doing so obtain an upper bound for |a_{j} − a_{n,j}|.

For any choice ζ_{r} of p^{r}-th root of unity in ℂ_{p}, let χ_{r} be the ℂ_{p}-valued character of ℤ_{p}^{×} of order p^{r} which factors through 1 + pℤ_{p} and sends 1 + p to ζ_{r}. Note that the conductor of χ_{r} is p^{r+1}.

Lemma 1.21. Let ζ_{r} be a p^{r}-th root of unity with 1 ≤ r ≤ n − 1, and let χ_{r} be the corresponding character of order p^{r+1}, as above. Then

P_{n}(ζ_{r} − 1) = ∫_{ℤ_{p}^{×}} χ_{r} dμ_{E}

In particular, note that the right hand side does not depend on n.

Proof. Writing χ = χ_{r}, we have

P_{n}(ζ_{r} − 1) = ∑_{a=1}^{p−1} ∑_{j=0}^{p^{n−1}−1} μ_{E} (τ(a)(1 + p)^{j} + p^{n}ℤ_{p}) · ζ_{r}^{j}

= ∑_{a=1}^{p−1} ∑_{j=0}^{p^{n−1}−1} μ_{E} (τ(a)(1 + p)^{j} + p^{n}ℤ_{p}) · χ ((1 + p)^{j})

= ∑_{b∈(ℤ/p^{n}ℤ)^{∗}} μ_{E} (b + p^{n}ℤ_{p}) · χ(b)

= ∫_{ℤ_{p}^{×}} χ dμ_{E}.

In the second to the last equality, we use that

(ℤ/p^{n}ℤ)^{∗} ≅ (ℤ/pℤ)^{∗} × (1 + p(ℤ/p^{n}ℤ))^{∗}

to sum over lifts of b ∈ (ℤ/p^{n}ℤ)^{∗} of the form τ(a)(1 + p)^{j}, i.e., a Teichmuller lift times a power of (1+p)^{j}. In the last equality, we use that χ has conductor p^{n}, so is constant on the residue classes modulo p^{n}, i.e., the last equality is just the Riemann sums definition of the given integral.

□
For each positive integer n, let w_{n}(T) = (1 + T)^{p^{n}} − 1.

Corollary 1.22. We have that

w_{n−1}(T) divides P_{n+1}(T) − P_{n}(T).

Proof. By Lemma 1.21, P_{n+1}(T) and P_{n}(T) agree on ζ_{j} −1 for 0 ≤ j ≤ n−1 and any choice ζ_{j} of p^{j}-th root of unity, so their difference vanishes on every root of the polynomial w_{n−1}(T) = (1 + T)^{p^{n−1}} − 1. The claimed divisibility follows, since w_{n−1}(T) has distinct roots. □

Lemma 1.23. Let f(T) = ∑_{j} b_{j}T^{j} and g(T) = ∑_{j} c_{j}T^{j} be in O[T] with O a finite extension of ℤ_{p}. If f(T) divides g(T), then

ord_{p}(c_{j}) ≥ min_{0≤i≤j} ord_{p}(b_{i}).

Proof. We have f(T)k(T) = g(T). The lemma follows by using the definition of polynomial multiplication and the non-archimedean property of ord_{p} on each coefficient of g(T). □

As above, let a_{n,j} be the jth coefficient of the polynomial P_{n}(T). Let

c_{n} = max(0, − min_{j} ord_{p}(a_{n,j}))

so that p^{c_{n}}P_{n}(T) ∈ ℤ_{p}[T], i.e., c_{n} is the smallest power of p that clears the denominator. Note that c_{n} is an integer since a_{n,j} ∈ ℚ. Probably if E[p] is irreducible then c_{n} = 0 – see Question 1.13. Also, for any j > 0, let

e_{n,j} = min_{1≤i≤j} ord_{p} \binom{p^{n}}{i}.

be the min of the valuations of the coefficients of w_{n}(T), as in Lemma 1.23.

Proposition 1.24. For all n ≥ 0, we have a_{n+1,0} = a_{n,0}, and for j > 0,

ord_{p}(a_{n+1,j} − a_{n,j}) ≥ e_{n−1,j} − max(c_{n}, c_{n+1}).

Proof. Let c = max(c_{n}, c_{n+1}). The divisibility of Corollary 1.8 implies that there is a polynomial h(T) ∈ ℤ_{p}[T] with

w_{n−1}(T) · p^{c}h(T) = p^{c}P_{n+1}(T) − p^{c}P_{n}(T)

and thus (by Gauss’ lemma) p^{c}h(T) ∈ ℤ_{p}[T] since the right hand side of the equation is integral and w_{n−1}(T) is a primitive polynomial. Applying Lemma 1.23 and renormalizing by p^{c} gives the result. □

For j fixed, e_{n−1,j} − max(c_{n+1}, c_{n}) goes to infinity as n grows since the c_{k} are uniformly bounded (they are bounded by the power of p that divides the order of the cuspidal subgroup of E). Thus, {a_{n,j}} is a Cauchy and Proposition 1.24 implies that that

ord_{p}(a_{j} − a_{n,j}) ≥ e_{n−1,j} − max(c_{n+1}, c_{n}).

Remark 1.25. Recall that presently there is not a single example where we can provably show that ord_{s=1} L(E, s) ≥ 4. Amazingly ord_{T} L_{p}(E, T) is “computable in practice” because Kato has proved, using his Euler system in K_{2}, that rank E(ℚ) ≤ ord_{T} L_{p}(E, T) by proving a divisibility predicted by Iwasawa Theory. Thus computing elements of E(ℚ) gives a provable lower bound, and approximating L_{p}(E, T) using Riemann sums gives a provable upper bound – in practice these meet.

The Birch and Swinnerton-Dyer Formula

2.1. Galois Cohomology

Galois cohomology is the basic language used for much research into algebraic aspects of the BSD conjecture. It was introduced by Lang and Tate in 1958 in [LT58]. This section contains a survey of the basic facts we will need in order to define Shafarevich-Tate groups, discuss descent, and construct Kolyvagin’s cohomology classes.

The best basic reference on Galois cohomology is chapters VII and X of Serre’s Local Fields [Ser79] or the (very similar!) article by Atiyah and Wall in Cassels-Frohlich [Cp86, Ch. IV]. See also the article by Gruenberg in [Cp86, Ch. V] for an introduction to profinite groups such as Gal(\overline{ℚ}/ℚ). Since this section is only a survey, you should read one of the above two references in detail, if you haven’t already. You might also want to read Chapter 1 of [CS00] by Coates and Sujatha, which contains an excellent summary of more advanced topics in Galois cohomology, and Serre’s book Galois Cohomology [Ser97] discusses many general advanced topics in depth. The original article [LT58] is also well worth reading.

2.1.1. Group Cohomology. If G is a multiplicative group, the group ring ℤ[G] is the ring of all finite formal sums of elements of G, with multiplication defined using distributivity and extending linearly. Let A be an additive group. We say that A is a G-module if A is equipped with a module structure over the group ring ℤ[G].

Let A^{G} be the submodule of elements of A that are fixed by G. Notice that if A → B is a homomorphism of G-modules, then restriction defines a homomorphism A^{G} → B^{G}, so A ↦ A^{G} is a functor. In fact, it is a left-exact functor:

Proposition 2.1. If 0 → A → B → C is an exact sequence of G modules, then 0 → A^{G} → B^{G} → C^{G} is also exact.

Definition 2.2 (Group Cohomology). The group cohomology H^{n}(G, A) is by definition the right derived functors of the left exact functor A → A^{G}. These are the unique, up to canonical equivalence, functors H^{n} such that

• The sequence

0 → A^{G} → B^{G} → C^{G} ⟶^{δ} H^{1}(G, A) → ⋯ → H^{n}(G, A) → H^{n}(G, B) → H^{n}(G, C) ⟶^{δ} H^{n+1}(G, A) → ⋯

is exact.

• If A is coinduced, i.e., A = Hom(ℤ[G], X) for X an abelian group,

then

H^{n}(G, A) = 0 for all n ≥ 1.

Remark 2.3. For those familiar with the Ext functor, we have

H^{n}(G, A) = Ext_{ℤ[G]}^{n}(ℤ, A).

We construct H^{n}(G, A) explicitly as follows. Consider ℤ as a G-module, equipped with the trivial G-action. Consider the following free resolution of ℤ. Let P_{i} be the free ℤ-module with basis the set of i+1 tuples (g_{0}, …, g_{i}) ∈ G^{i+1}, and with G acting on P_{i} componentwise:

s(g_{0}, …, g_{i}) = (sg_{0}, …, sg_{i}).

The homomorphism d : P_{i} → P_{i+1} is given by

d(g_{0}, …, g_{i}) = ∑_{j=0}^{i}(−1)^{j}(g_{0}, …, g_{j−1}, g_{j+1}, … g_{i}),

and P_{0} → ℤ is given by sending every element (g_{0}) to 1 ∈ ℤ.

The cohomology groups H^{i}(G, A) are then the cohomology groups of the complex K_{i} = Hom_{ℤ[G]}(P_{i}, A). We identify an element of K_{i} with a function f : G^{i+1} → A such that the condition

f(sg_{0}, …, sg_{i}) = sf(g_{0}, …, g_{i})

holds. Notice that such an f ∈ K_{i} is uniquely determined by the function (of i inputs)

φ(g_{1}, …, g_{i}) = f(1, g_{1}, g_{1}g_{2}, …, g_{1} ⋯ g_{i}).

The boundary map d : K_{i} → K_{i+1} on such functions φ ∈ K_{i} is then given explicitly by the formula

(dφ)(g_{1}, …, g_{i+1}) = g_{1}φ(g_{2}, …, g_{i+1}) + ∑_{j=1}^{i}(−1)^{j}φ(g_{2}, …, g_{j}g_{j+1}, …, g_{i+1})
+ (−1)^{i+1}φ(g_{1}, …, g_{i}).

The group of n-cocycles is the group of φ ∈ K_{n}, as above are functions of n variables such that dφ = 0. The subgroup of n-coboundaries is the image of K_{n+1} under d. Explicitly, the cohomology group H^{n}(G, A) is the quotient of the group group of n-cocycles modulo the subgroup of n-coboundaries.

When n = 1, the 1-cocycles are the maps G → A such that

φ(gg′) = gφ(g′) + φ(g),

and φ is a coboundary if there exists a ∈ A such that φ(g) = ga − a for all g ∈ G. Notice that if G acts trivially on A, then

H^{1}(G, A) = Hom(G, A).

2.1.2. The inf-res Sequence. Suppose G is a group and H is a normal subgroup of G, and A is a G-module. Then for any n ≥ 0, there are natural homomorphisms

res : H^{n}(G, A) → H^{n}(H, A)

and

inf : H^{n}(G/H, A^{H}) → H^{n}(G, A)

Require that we view n-cocycles as certain maps on the n-fold product of the group. On cocycles, the map res is obtained by simply restricting a cocycle, which is a map G^{i} → A, to a map H^{i} → A. The second map inf is obtained by precomposing a cocycle (G/H)^{i} → A^{H} with the natural map G^{i} → (G/H)^{i}.

Proposition 2.4. The inf-res sequence

0 → H^{1}(G/H, A^{H}) ⟶^{inf} H^{1}(G, A) ⟶^{res} H^{1}(H, A)

is exact.

Proof. See [Ser79, §VII.6]. □

2.1.3. Galois Cohomology. Let K be a field and L a finite Galois extension of K, so the set of field automorphisms of L that fix K equals the dimension of L viewed as a K-vector space.

For any Gal(L/K)-module A and any n ≥ 0, let

H^{n}(L/K, A) = H^{n}(Gal(L/K), A).

If M/L/K is a tower of Galois extensions of K and suppose Gal(M/K) acts on A. Then inf defines a map

(2.1.1)  H^{n}(L/K, A^{L}) → H^{n}(M/K, A).

Let K^{sep} denote a separable closure of K and suppose A is a (continuous) Gal(K^{sep}/K)-module. (Note – if K has characteristic 0, then a separable closure is the same thing as an algebraic closure.) For any subfield L ⊂ K^{sep} that contains K, let A(L) = A^{L}. Let

H^{n}(K, A) = \underrightarrow{lim}_{L/K finite Galois} H^{n}(L/K, A(L)),

where the direct limit is with respect to the maps (2.1.1). We can think of this direct limit as simply the union of all the groups, where we identify two elements if they are eventually equal under some map (2.1.1).

One can prove (see [Cp86, Ch. V]) that changing the choice of separable closure K^{sep} only changes H^{n}(K, A) by unique isomorphism, i.e., the construction is essentially independent of the choice of seperable closure.

2.2. The Shafarevich-Tate Group

In this section we discuss Galois cohomology of elliptic curves, introduce the Kummmer sequence, define the Selmer group, the Shafarevich-Tate group and dicuss descent and the Mordell-Weil theorem.

2.2.1. The Elliptic Curve Kummer Sequence. Let E be an elliptic curve over a number field K. Consider the abelian group E(\overline{ℚ}) of all points on E defined over a fixed choice \overline{ℚ} of algebraic closure of ℚ. Then A is a module over Gal(\overline{ℚ}/K), and we may consider the Galois cohomology groups

H^{n}(K, E), for n = 0, 1, 2, …

which are of great interest in the study of elliptic curves, especially for n = 0, 1.

If L is a finite Galois extension of K, then the inf-res sequence, written in terms of Galois chomology, is

0 → H^{1}(L/K, E(L)) → H^{1}(K, E) → H^{1}(L, E).

For any positive integer n consider the homomorphism

[n] : E(\overline{ℚ}) → E(\overline{ℚ}).

This is a surjective homomorphism of abelian groups, so we have an exact sequence

0 → E[n] → E ⟶^{[n]} E → 0.

The associated long exact sequence of Galois cohomology is

0 → E(K)[n] → E(K) ⟶^{[n]} E(K) → H^{1}(K, E[n]) → H^{1}(K, E) ⟶^{[n]} H^{1}(K, E) → · · · .

An interesting way to rewrite the begining part of this sequence is as

(2.2.1)  0 → E(K)/nE(K) → H^{1}(K, E[n]) → H^{1}(K, E)[n] → 0.

The sequence (2.2.1) is called the Kummer sequence associated to the elliptic curve.

2.2.2. The Global-to-Local Restriction Maps. Let ℘ be a prime ideal of the ring O_{K} of integers of the number field K, and let K_{℘} be the completion of K with respect to ℘. Thus K_{℘} is a finite extension the field ℚ_{p} of p-adic numbers.

More explicitly, if K = ℚ(α), with α a root of the irreducible polynomial f(x), then the prime ideals ℘ correspond to the irreducible factors of f(x) in ℤ_{p}[x]. The fields K_{℘} then correspond to adjoing roots of each of these irreducible factors of f(x) in ℤ_{p}[x]. Note that for most p, a generalization of Hensel’s lemma (see Section 1.5.1) asserts that we can factor f(x) by factoring f(x) modulo p and iteratively lifting the factorization.

We have a natural map Gal(\overline{ℚ}_{p}/K_{℘}) → Gal(\overline{ℚ}/K) got by restriction; implicit in this is a choice of embedding of \overline{ℚ} in \overline{ℚ}_{p} that sends K into K_{v}. We may thus view Gal(\overline{ℚ}_{p}/K_{℘}) as a subgroup of Gal(\overline{ℚ}/K).

Let A be any Gal(\overline{ℚ}/K) module. Then this restriction map induces a restriction map on Galois cohomology

res_{℘} : H^{1}(K, A) → H^{1}(K_{℘}, A).

Recall that in terms of 1-cocycles this sends a set-theoretic map (a crossedhomomorphism) f : Gal(\overline{ℚ}/K) → A to a map res_{℘}(f) : Gal(\overline{ℚ}_{p}/K_{℘}) → A.

Likewise there is a restriction map for each real Archimedian prime v, i.e., for each embedding K → ℝ we have a map

res_{v} : H^{1}(K, A) → H^{1}(ℝ, A).

Exercise 2.5. Let A = E(ℂ) be the group of points on an elliptic curve over ℝ. Prove that H^{1}(ℝ, E) = H^{1}(ℂ/ℝ, E(ℂ)) is a group of order 1 or 2.

Exercise 2.6. Prove that for any Galois moduloe A and for all primes ℘ the kernel of res_{℘} does not depend on the choice of embedding of \overline{ℚ} in \overline{ℚ}_{p}. (See [Cp86, Ch. V]).

2.2.3. The Selmer Group. Let E be an elliptic curve over a number field K. Let v be either a prime ℘ of K or a real Archimedian place (i.e., embedding K → ℝ). As in Section 2.2.1 we also obtain a local Kummer sequence

0 → E(K_{v})/nE(K_{v}) → H^{1}(K_{v}, E[n]) → H^{1}(K_{v}, E)[n] → 0.

Putting these together for all v we obtain a commutative diagram: (2.2.2)

\xymatrix{0 \ar[r] & E(K)/nE(K) \ar[r] \ar[d] & H^{1}(K, E[n]) \ar[r] \ar[d] & H^{1}(K, E)[n] \ar[r] \ar[d] & 0 \\ 0 \ar[r] & ∏_{v} E(K_{v})/nE(K_{v}) \ar[r] & ∏_{v} H^{1}(K_{v}, E[n]) \ar[r] & ∏_{v} H^{1}(K_{v}, E)[n] \ar[r] & 0.}

Definition 2.7. The n-Selmer group of an elliptic curve E over a number field K is

Sel^{(n)}(E/K) = ker (H^{1}(K, E[n]) → ∏_{v} H^{1}(K_{v}, E)[n]) .

2.2.4. The Shafarevich-Tate Group and the Mordell-Weil Theorem.

Definition 2.8 (Shafarevich-Tate Group). The Shafarevich-Tate group of an elliptic curve E over a number field K is

� (E/K) = ker (H^{1}(K, E) → ∏_{v} H^{1}(K_{v}, E)) .

For any positive integer n, we may thus add in a row to (2.2.2):

[figure: 0; E(K)/nE(K); Sel^{(n)}(E/K); � (E/K)[n]; 0; 0; E(K)/nE(K); H^{1}(K, E[n]); H^{1}(K, E)[n]; 0; 0; ∏_{v} E(K_{v})/nE(K_{v}); ∏_{v} H^{1}(K_{v}, E[n]); ∏_{v} H^{1}(K_{v}, E)[n]; 0.]

The n-descent sequence for E is the short exact sequence

(2.2.3)  0 → E(K)/nE(K) → Sel^{(n)}(E/K) → � (E/K)[n] → 0.

Theorem 2.9. For every integer n the group Sel^{(n)}(E/K) is finite.

Sketch of Proof. Let K(E[n]) denote the finite Galois extension of K obtained by adjoining to K all x and y coordinates of elements of E(\overline{ℚ}) of order dividing n. The inf-res sequence for K(E[n])/K is

(2.2.4) 0 → H^{1}(K(E[n])/K, E[n]) → H^{1}(K, E[n]) → H^{1}(K(E[n]), E[n]).

Because Gal(K(E[n])/K) and E[n] are both finite groups, the cohomology group H^{1}(K(E[n])/K, E[n]) is also finite.

Since Sel^{(n)}(E/K) ⊂ H^{1}(K, E[n]), restriction defines a map

(2.2.5)  Sel^{(n)}(E/K) → Sel^{(n)}(E/K[n]).

The kernel of (2.2.5) is finite since it is contained in the first term of (2.2.4), which is finite. It thus suffices to prove that Sel^{(n)}(E/K[n]) is finite.

But

Sel^{(n)}(E/K[n]) ⊂ H^{1}(K[n], E[n]) ≅ Hom(Gal(\overline{ℚ}/K[n]), E[n])).

So each element of Sel^{(n)}(E/K[n]) determines (and is determined by) a homomorphism Gal(\overline{ℚ}/K[n]) → (ℤ/nℤ)^{2}. That that the fixed field of such a homomorphism is a Galois extension of K[n] with Galois group contained in (ℤ/nℤ)^{2}.

To complete the proof, one uses the theory of elliptic curves over local fields to show that there is a finite set S of primes such that any such homomorphism corresponding to an element of the Selmer group corresponds to an extension of K[n] ramified only at primes in S. Then the two main theorems of algebraic number theory — that class groups are finite and unit groups are finitely generated — together imply that there are only finitely many such extensions of K[n].

□

Exercise 2.10. Prove the that E[n] is a finite Galois extension of K.

Theorem 2.11 (Mordell-Weil). The group E(ℚ) is finitely generated.

Proof. The exact sequence (2.2.3) with n = 2 and Theorem 2.9 imply that E(ℚ)/2E(ℚ) is a finite group. Recall Lemma 1.4 which asserted that if B is a positive real number such that

S = {P ∈ E(ℚ) : ĥ(P) ≤ B}

contains a set of generators for E(ℚ)/2E(ℚ), then S generates E(ℚ). Since E(ℚ)/2E(ℚ) is finite, it makes sense to define B to be the maximum of the heights of arbitrary lifts of all the elements of E(ℚ)/2E(ℚ). Then the corresponding set S generates E(ℚ). A basic fact about heights is that the set of points of bounded height is finite, i.e., S is finite, so E(ℚ) is finitely generated. □

2.2.5. Some Conjectures and Theorems about the Shafarevich-Tate Group.

Conjecture 2.12 (Shafarevich-Tate). Let E be an elliptic curve over a number field K. Then the group � (E/K) is finite.

Theorem 2.13 (Rubin). If E is a CM elliptic curve over ℚ with L(E, 1) ≠ 0, then � (E/ℚ) is finite. (He proved more than just this.)

Thus Rubin’s theorem proves that the Shafarevich-Tate group of the CM elliptic curve y^{2} + y = x^{3} − 7 of conductor 27 is finite.

Theorem 2.14 (Kolyvagin et al.). If E is an elliptic curve over ℚ with ord_{s=1} L(E, s) ≤ 1, then � (E/ℚ) is finite.

Kolyvagin’s theorem is proved in a completely different way than Rubin’s theorem. It combines the Gross-Zagier theorem, the modularity theorem that there is a map X_{0}(N) → E, a nonvanishing result about the special values L(E^{D}, 1) of quadratic twists of E, and a highly original explicit study of the structure of the images of certain points on X_{0}(N)(\overline{ℚ}) in E(\overline{ℚ}).

Theorem 2.15 (Cassels). Let E be an elliptic curve over a number field K. There is an alternating pairing on � (E/K), which is nondegenerate on the quotient of � (E/K) by its maximal divisible subgroup. Moreover, if � (E/K) is finite then #� (E/K) is a perfect square.

For an abelian group A and a prime p, let A(p) denote the subgroup of elements of p power order in A.

The following problem remains open. It helps illustrate our ignorance about Conjecture 2.12 in any cases beyond those mentioned above.

Problem 2.16. Show that there is an elliptic curve E over ℚ with rank ≥ 2 such that � (E/ℚ)(p) is finite for infinitely many primes p.

2.3. The Birch and Swinnerton-Dyer Formula

“The subject of this lecture is rather a special one. I want to describe some computations undertaken by myself and Swinnerton-Dyer on EDSAC, by which we have calculated the zeta-functions of certain elliptic curves. As a result of these computations we have found an analogue for an elliptic curve of the Tamagawa number of an algebraic group; and conjectures have proliferated. […] I would like to stress that though the associated theory is both abstract and technically complicated, the objects about which I intend to talk are usually simply defined and often machine computable; experimentally we have detected certain relations between different invariants, but we have been unable to approach proofs of these relations, which must lie very deep.”

– Bryan Birch

Conjecture 2.17 (Birch and Swinnerton-Dyer). Let E be an elliptic curve over ℚ of rank r. Then r = ord_{s=1} L(E, s) and

(2.3.1)  \frac{L^{(r)}(E, 1)}{r!} = \frac{Ω_{E} · Reg(E) · #� (E/ℚ) · ∏_{p} c_{p}}{#E(ℚ)_{tor}^{2}} .

Let

(2.3.2)  y^{2} + \underline{a}_{1}xy + \underline{a}_{3}y = x^{3} + \underline{a}_{2}x^{2} + \underline{a}_{4}x + \underline{a}_{6}

be a minimal Weierstrass equation for E.

Recall from Section 1.5.2 that the real period Ω_{E} is the integral

Ω_{E} = ∫_{E(ℝ)} \frac{dx}{2y + \underline{a}_{1}x + \underline{a}_{3}} .

See [Cre97, §3.7] for an explanation about how to use the Gauss arithmeticgeometry mean to efficiently compute Ω_{E}.

To define the regulator Reg(E) let P_{1}, …, P_{n} be a basis for E(ℚ) modulo torsion and recall the Néron-Tate canonical height pairing ⟨ , ⟩ from Section 1.2. The real number Reg(E) is the absolute value of the determinant of the n × n matrix whose (i, j) entry is ⟨P_{i}, P_{j}⟩. See [Cre97, §3.4] for a discussion of how to compute Reg(E).

We defined the group � (E/ℚ) in Section 2.2.4. In general it is not known to be finite, which led to Tate’s famous assertion that the above conjecture “relates the value of a function at a point at which it is not known to be defined^{1} to the order of a group that is not known to be finite.” The paper [GJP^{+}05] discusses methods for computing #� (E/ℚ) in practice, though no general algorithm for computing #� (E/ℚ) is known. In fact, in general even if we assume truth of the BSD rank conjecture (Conjecture 1.1) and assume that � (E/ℚ) is finite, there is still no known way to compute #� (E/ℚ), i.e., there is no analogue of Proposition 1.3. Given finiteness of � (E/ℚ) we can compute the p-part � (E/ℚ)(p) of � (E/ℚ) for any prime p, but we don’t know when to stop considering new primes p. (Note that when r_{E,an} ≤ 1, Kolyvagin’s work provides an explicit upper bound on #� (E/ℚ), so in that case � (E/ℚ) is computable.)

The Tamagawa numbers c_{p} are 1 for all primes p ∤ Δ_{E}, where Δ_{E} is the discriminant of (2.3.2). When p | Δ_{E}, the number c_{p} is a more refined measure of the structure of the E locally at p. If p is a prime of additive reduction (see Section 1.3), then one can prove that c_{p} ≤ 4. The other alternatives are that p is a prime of split or nonsplit multiplicative reduction. If p is a nonsplit prime, then

c_{p} = \begin{cases}1 & if ord_{p}(Δ) is odd \\ 2 & otherwise \end{cases}

If p is a prime of split multiplicative reduction then

c_{p} = ord_{p}(Δ)

can be arbitrarily large. The above discussion completely determines c_{p} except when p is an additive prime – see [Cre97, §3.2] for a discussion of how to compute c_{p} in general.

For those that are very familiar with elliptic curves over local fields,

c_{p} = [E(ℚ_{p}) : E^{0}(ℚ_{p})],

where E^{0}(ℚ_{p}) is the subgroup of E(ℚ_{p}) of points that have nonsingular reduction modulo p.

For those with more geometric background, we offer the following conceptual definition of c_{p}. Let E be the Néron model of E. This is the unique, up to unique isomorphism, smooth commutative (but not proper!) group scheme over ℤ that has generic fiber E and satisfies the Néron mapping property:

1When E is defined over ℚ it is now known that L(E, s) is defined overwhere.

for any smooth group scheme X over ℤ the natural map

Hom(X, E) → Hom(X_{ℚ}, E)

is an isomorphism.

In particular, note that E(ℤ) ≅ E(ℚ). For each prime p, the reduction E_{𝔽_{p}} of the Néron model modulo p is a smooth commutative group scheme over 𝔽_{p} (smoothness is a property of morphisms that is closed under base extension). Let E_{𝔽_{p}}^{0} be the identity component of the group scheme E_{𝔽_{p}}, i.e., the connected component of E_{𝔽_{p}}^{0} that contains the 0 section. The component group of E at p is the quotient group scheme

Φ_{E,p} = E_{𝔽_{p}}/E_{𝔽_{p}}^{0},

which is a finite étale group scheme over 𝔽_{p}. Finally

c_{p} = #Φ_{E,p}(𝔽_{p}).

2.4. Examples: The Birch and Swinnerton-Dyer Formula

In each example below we use SAGE to compute the conjectural order of � (E/ℚ) and find that it appears to be the square of an integer as predicted by Theorem 2.15.

2.4.1. Example: A Curve of Rank 0. Consider the elliptic curve E with Cremona label 11a, which is one the 3 curves of smallest conductor. We now compute each of the quantities in Conjecture 2.17. First we define the curve E in SAGE and compute its rank:

     sage: E = EllipticCurve('11a'); E
     Elliptic Curve defined by y^2 + y = x^3 - x^2 - 10*x - 20
     over Rational Field
     sage: E.rank()
     0

Next we compute the number L(E, 1) to double precision (as an element of the real double field RDF):

     sage: L = RDF(E.Lseries(1)); L
     0.253841860856

We next compute the real period:

     sage: Om = RDF(E.omega()); Om
     1.26920930428

To compute ∏ c_{p} we factor the discriminant of E. It turns at that only 11 divides the discriminant, and since the reduction at 11 is split multiplicative the Tamagawa number is 5 = ord_{11}(Δ_{E}).

     sage: factor(discriminant(E))
     -1 * 11^5
     sage: c11 = E.tamagawa_number(11); c11
     5

Next we compute the regulator, which is 1 since E rank 0.

     sage: Reg = RDF(E.regulator()); Reg
     1.0

The torsion subgroup has order 5.

     sage: T = E.torsion_order(); T
     5

Putting everything together in (2.3.1) and solving for the conjectural order of � (E/ℚ), we see that Conjecture 2.17 for E is equivalent to the assertion that � (E/ℚ) has order 1.

     sage: Sha_conj = L * T^2 / (Om * Reg * c11); Sha_conj
     1.0

2.4.2. Example: A Rank 0 curve with nontrivial Sha. Consider the curve E with label 681b. This curve has rank 0, and we compute the conjectural order of #� (E/ℚ) as in the previous section:

sage: E = EllipticCurve('681b'); E
Elliptic Curve defined by y^2 + x*y  = x^3 + x^2 - 1154*x - 15345
over Rational Field
sage: E.rank()
0
sage: L = RDF(E.Lseries(1)); L
1.84481520613
sage: Om = RDF(E.omega()); Om
0.81991786939

There are two primes of bad reduction this time.

sage: factor(681)
3 * 227
sage: factor(discriminant(E))
3^10 * 227^2
sage: c3 = E.tamagawa_number(3); c227 = E.tamagawa_number(227)
sage: c3, c227
(2, 2)
sage: Reg = RDF(E.regulator()); Reg
1.0
sage: T = E.torsion_order(); T
4

In this case it turns out that #� (E/ℚ) is conjecturally 9.

sage: Sha_conj = L * T^2 / (Om * Reg * c3*c227); Sha_conj
9.0

2.4.3. Example: A Curve of Rank 1. Let E be the elliptic curve with label 37a, which is the curve of rank 1 with smallest conductor. We define E and compute its rank, which is 1.

sage: E = EllipticCurve('37a'); E
Elliptic Curve defined by y^2 + y = x^3 - x over
Rational Field
sage: E.rank()

We next compute the value L′(E, 1). The corresponding function in SAGE takes a bound on the number of terms of the L-series to use, and returns an approximate to L′(E, 1) along with a bound on the error (coming from the tail end of the series).

sage: L, error = E.Lseries_deriv_at1(200); L, error
(0.305999773834879, 2.10219814818300e-90)
sage: L = RDF(L); L
0.305999773835

We compute Ω_{E} and the Tamagawa number, regulator, and torsion as above.

sage: Om = RDF(E.omega()); Om
5.98691729246
sage: factor(discriminant(E))
37
sage: c37 = 1
sage: Reg = RDF(E.regulator()); Reg
0.05111140824
sage: T = E.torsion_order(); T
1

Finally, we solve and find that the conjectural order of � (E/ℚ) is 1.

sage: Sha_conj = L * T^2 / (Om * Reg * c37); Sha_conj
1.0

2.4.4. Example: A curve of rank 2. Let E be the elliptic curve 389a of rank 2, which is the curve of rank 2 with smallest conductor.

sage: E = EllipticCurve('389a'); E
Elliptic Curve defined by y^2 + y = x^3 + x^2 - 2*x
over Rational Field
sage: E.rank()
2

Because the curve has rank 2, we use Dokchitser’s L-function package to approximate L^{(2)}(E, 1) to high precision:

sage: Lser = E.Lseries_dokchitser()
sage: L = RDF(abs(Lser.derivative(1,2))); L
1.51863300058

We compute the regulator, Tamagawa numbers, and torsion as usual:

sage: Om = RDF(E.omega()); Om
4.98042512171
sage: factor(discriminant(E))
389
sage: c389 = 1
sage: Reg = RDF(E.regulator()); Reg
0.152460177943
sage: T = E.torsion_order(); T
1

Finally we solve for the conjectural order of #� (E/ℚ).

sage: Sha_conj = (L/2) * T^2 / (Om * Reg * c389)
sage: Sha_conj
1.0

We pause to emphasize that just getting something that looks like an integer by computing

(2.4.1)  \frac{L^{(r)}(E, 1)}{r!} · #E(ℚ)_{tor}^{2}/(Ω_{E} · Reg(E) · ∏ c_{P})

is already excellent evidence for Conjecture 2.17. There is also a subtle and deep open problem here:

Open Problem 2.18. Let E be the elliptic curve 389a above. Prove that the quantity (2.4.1) is a rational number.

For curves E of analytic rank 0 it is easy to prove using modular symbols that the conjectural order of � (E/ℚ) is a rational number. For curves with analytic rank 1, this rationality follows from the very deep Gross-Zagier theorem. For curves of analytic rank ≥ 2 there is not a single example in which the conjectural order of � (E/ℚ) is known to be a rational number.

2.4.5. Example: A Rank 3 curve. The curve E with label 5077a has rank 3. This is the curve with smallest conductor and rank 3.

sage: E = EllipticCurve('5077a'); E
Elliptic Curve defined by y^2 + y = x^3 - 7*x + 6
over Rational Field
sage: E.rank()
3

We compute L(E, s) using Dokchitser’s algorithm. Note that the order of vanishing appears to be 3.

sage: E.root_number()
-1
sage: Lser = E.Lseries_dokchitser()
sage: Lser.derivative(1,1)
-5.63436295355925e-22
sage: Lser.derivative(1,2)
2.08600476044634e-21
sage: L = RDF(abs(Lser.derivative(1,3))); L
10.3910994007

That the order of vanishing is really 3 follows from the Gross-Zagier theorem, which asserts that L′(E, 1) is a nonzero multiple of the Néron-Tate canonical height of a certain point on E called a Heegner point. One can explicitly construct this point^{2} on E and find that it is torsion, hence has height 0, so L′(E, 1) = 0. That L′′(E, 1) = 0 then follows from the functional equation (see Section 1.3). Finally we compute the other BSD invariants:

sage: Om = RDF(E.omega()); Om
4.15168798309
sage: factor(discriminant(E))
5077
sage: c5077 = 1
sage: Reg = RDF(E.regulator()); Reg
0.417143558758
sage: T = E.torsion_order(); T
1

Putting everything together we see that the conjectural order of � (E/ℚ) is 1.

2This is not yet implemented in SAGE; if it were, there would be an example right here.

sage: Sha_conj = (L/6) * T^2 / (Om * Reg * c5077)
sage: Sha_conj
1.0

Note that just as was the case with the curve 389a above, we do not know that the above conjectural order of � (E/ℚ) is a rational number, since there are no know theoretical results that relate any of the three real numbers L^{(3)}(E, 1), Reg(E/ℚ), and Ω_{E/ℚ}.

2.4.6. Example: A Rank 4 curve. Let E be the curve of rank 4 with label 234446b. It is likely that this is the curve with smallest conductor and rank 4 (a big calculation of the author et al. shows that there are no rank 4 curves with smaller prime conductor).

sage: E = EllipticCurve([1, -1, 0, -79, 289]); E
Elliptic Curve defined by y^2 + x*y  = x^3 - x^2 - 79*x + 289
over Rational Field
sage: E.rank()
4

We next compute L(E, 1), L′(E, 1), L^{(2)}(E, 1), L^{(3)}(E, 1), and L^{(4)}(E, 1). All these special values look like they are 0, except for L^{(4)}(E, 1) which is about 214, hence clearly nonzero. One can prove that L(E, 1) = 0 (e.g., using denominator bounds coming from modular symbols), hence since the root number is +1, we have either r_{E,an} = 2 or r_{E,an} = 4, and of course suspect (but cannot prove yet) that r_{E,an} = 4.

sage: E.root_number()
1
sage: Lser = E.Lseries_dokchitser()
sage: Lser(1)
1.43930352980778e-18
sage: Lser.derivative(1,1)
-4.59277879927938e-24
sage: Lser.derivative(1,2)
-8.85707917856308e-22
sage: Lser.derivative(1,3)
1.01437455701212e-20
sage: L = RDF(abs(Lser.derivative(1,4))); L
214.652337502

As above, we compute the other BSD invariants of E.

sage: Om = RDF(E.omega()); Om
2.97267184726
sage: factor(discriminant(E))
2^2 * 117223
sage: c2 = 2
sage: c117223 = 1
sage: Reg = RDF(E.regulator()); Reg
1.50434488828
sage: T = E.torsion_order(); T
1

Finally, putting everything together, we see that the conjectural order of � (E/ℚ) is 1.

sage: Sha_conj = (L/24) * T^2 / (Om * Reg * c2 * c117223)
sage: Sha_conj
1.0

Again we emphasize that we do not even know that the conjectural order computed above is a rational number.

It seems almost a miracle that L^{(4)}(E, 1) = 214.65 …, Ω_{E} = 2.97 …, and Reg(E) = 1.50 … have anything to do with each other, but indeed they do:

sage: L/24, 2*Om*Reg
(8.9438473959, 8.9438473959)

That these two numbers are the same to several decimal places is a fact, independent of any conjectures.

2.5. The p-adic BSD Conjectural Formula 37

2.5. The p-adic BSD Conjectural Formula

Let E be an elliptic curve over ℚ and let p be a prime of good ordinary reduction for E.

In Chapter 1 (see Theorem 1.15) we defined a p-adic L-series

L_{p}(E, T) ∈ ℚ_{p}[[T]].

Conjecture 1.16 asserted that ord_{T} L_{p}(E, T) = rank E(ℚ). Just as is the cases for L(E, s), there is a conjectural formula for the leading coefficient of the power series L_{p}(E, T). This formula is due to Mazur, Tate, and Teitelbaum [MTT86].

First, suppose ord_{T} L_{p}(E, T) = 0, i.e., L_{p}(E, 0) ≠ 0. Recall that the interpolation property (1.5.1) for L_{p}(E, T) implies that

L_{p}(E, 0) = ε_{p} · L(E, 1)/Ω_{E},

where

(2.5.1)  ε_{p} = (1 − α^{−1})^{2},

and α ∈ ℤ_{p} is the unit root of x^{2} − a_{p}x + p = 0. Thus the usual BSD conjecture predicts that if the rank is 1, then

(2.5.2)  L_{p}(E, 0) = ε_{p} · \frac{∏_{ℓ} c_{ℓ} · #� (E/ℚ) · Reg(E)}{#E(ℚ)_{tor}^{2}}

Notice in (2.5.2) that since E(ℚ) has rank 0, we have Reg(E) = 1, so there is no issue with the left hand side being a p-adic number and the right hand side not making sense. It would be natural to try to generalize (2.5.2) to higher order of vanishing as follows. Let L_{p}^{∗}(E, 0) denote the leading coefficient of the power series L_{p}(E, T). Then

(2.5.3) L_{p}^{∗}(E, 0)“ = ”ε_{p} · \frac{∏_{ℓ} c_{ℓ} · #� (E/ℚ) · Reg(E)}{#E(ℚ)_{tor}^{2}}  (nonsense!!).

Unfortunately (2.5.2) is total nonsense when the rank is bigger than 0. The problem is that Reg(E) ∈ ℝ is a real number, whereas ε_{p} and L_{p}^{∗}(E, 0) are both p-adic numbers.

The key new idea needed to make a conjecture is to replace the realnumber regulator Reg(E) with a p-adic regulator Reg_{p}(E) ∈ ℚ_{p}. This new regulator is defined in a way analogous to the classical regulator, but where many classical complex analytic objects are replaced by p-adic analogues. Moreover, the p-adic regulator was, until recently (see [MST06]), much more difficult to compute than the classical real regulator. We will define the p-adic number Reg_{p}(E) ∈ ℚ_{p} in the next section.

Conjecture 2.19 (Mazur, Tate, and Teitelbaum). Let E be an elliptic curve over ℚ and let p be a prime of good ordinary reduction for E. Then the rank of E equals ord_{T} (L_{p}(E, T)) and

(2.5.4)  L_{p}^{∗}(E, 0) = ε_{p} · \frac{∏_{ℓ} c_{ℓ} · #� (E/ℚ) · Reg_{p}(E)}{#E(ℚ)_{tor}^{2}},

where ε_{p} is as in (2.5.1), and the p-adic regulator Reg_{p}(E) ∈ ℚ_{p} will be defined below.

Remark 2.20. There are analogous conjectures in many other cases, e.g., good supersingular, bad multiplicative, etc. See [SW07] for more details.

2.5.1. Example: A Curve of Rank 2. We only consider primes p of good ordinary reduction for a given curve E in this section. If E is an elliptic curve with analytic rank 0, then the p-adic and classical BSD conjecture are the same, so there is nothing new to illustrate. We will thus consider only curves of rank ≥ 1 in this section.

We consider the elliptic curve 446d1 of rank 2 at the prime p = 5.

     sage: E = EllipticCurve('446d1'); p = 5; E
     Elliptic Curve defined by y^2 + x*y  = x^3 - x^2 - 4*x + 4
     over Rational Field

Next we verify that the rank is 2, that p is a good ordinary prime, and that there are 10 points on E modulo p (so E is ananomolous at p, i.e., p | #E(𝔽_{p})).

     sage: E.rank()
     2
     sage: E.is_ordinary(p)
     True
     sage: E.Np(p)
     10

Next we compute the p-adic L-series of E at p. We add O(T^{7}) so that the displayed series doesn’t take several lines.

     sage: Lp  = E.padic_lseries(p)
     sage: LpT = Lp.series(4)
     sage: LpT = LpT.add_bigoh(7); LpT
     (5 + 5^2 + O(5^3))*T^2 + (2*5 + 3*5^2 + O(5^3))*T^3
               + (4*5^2 + O(5^3))*T^4 + (4*5 + O(5^2))*T^5
               + (1 + 2*5 + O(5^3))*T^6 + O(T^7)

We compute the p-adic modular form E_{2} evaluated on our elliptic curve with differential ω to precision O(p^{8}). This is the key difficult input to the computation of the p-adic regulator Reg_{p}(E).

     sage: E.padic_E2(p, prec=8)
     3*5 + 4*5^2 + 5^3 + 5^4 + 5^5 + 2*5^6 + 4*5^7 + O(5^8)

We compute the normalized p-adic regulator, normalized to the choice of 1 + p as a topological generator of 1 + p ℤ_{p}.

     sage: Regp = E.padic_regulator(p, 10)
     sage: R = Regp.parent()
     sage: kg = log(R(1+p))
     sage: reg = Regp * p^2 / log(R(1+p))^2
     sage: reg*kg^2
     2*5 + 2*5^2 + 5^4 + 4*5^5 + 2*5^7 + O(5^8)

We compute the Tamagawa numbers and torsion subgroup.

     sage: E.tamagawa_numbers()
     [2, 1]
     sage: E.torsion_order()
     1

We compute L_{p}^{∗}(E, 0), which is the leading term of the p-adic L-function. It is not a unit, so we call the prime p an irregular prime.

     sage: Lpstar = LpT[2]; Lpstar
     5 + 5^2 + O(5^3)

Finally, putting everything together we compute the conjectural p-adic order of #� (E/ℚ). In particular, we see that conjecturally #� (E/ℚ)(5) is trivial.

     sage: eps = (1-1/Lp.alpha(20))^2
     sage: Lpstar / (eps*reg*(2*1)) * (1)^2
     1 + O(5^2)

2.5.2. The p-adic Regulator. Fix an elliptic curve E defined over ℚ and a prime p of good ordinary reduction for E. In this section we define the p-adic regulator Reg_{p}(E). See [MTT86], [MST06] and [SW07] and the references listed there for a more general discussion of p-adic heights, especially for bad or supersingular primes, and for elliptic curves over number fields. See also forthcoming work of David Harvey for highly optimized computation of p-adic regulators.

The p-adic logarithm log_{p} : ℚ_{p}^{∗} → (ℚ_{p}, +) is the unique group homomorphism with log_{p}(p) = 0 that extends the homomorphism log_{p} : 1+pℤ_{p} → ℚ_{p} defined by the usual power series of log(x) about 1. Explicitly, if x ∈ ℚ_{p}^{∗}, then

log_{p}(x) = \frac{1}{p − 1} · log_{p}(u^{p−1}),

where u = p^{− ord_{p}(x)} · x is the unit part of x, and the usual series for log converges at u^{p−1}.

Example 2.21. For example, in SAGE we compute the logs of a couple of non-unit elements of ℚ_{5} as follows:

     sage: K = Qp(5,8); K
     5-adic Field with capped relative precision 8
     sage: a = K(-5^2*17); a
     3*5^2 + 5^3 + 4*5^4 + 4*5^5 + 4*5^6 + 4*5^7 + 4*5^8 + 4*5^9 + O(5^10)
     sage: u = a.unit_part()
     3 + 5 + 4*5^2 + 4*5^3 + 4*5^4 + 4*5^5 + 4*5^6 + 4*5^7 + O(5^8)
     sage: b = K(1235/5); b
     2 + 4*5 + 4*5^2 + 5^3 + O(5^8)
     sage: log(a)
     5 + 3*5^2 + 3*5^3 + 4*5^4 + 4*5^5 + 5^6 + O(5^8)
     sage: log(a*b) - log(a) - log(b)
     O(5^8)

Note that we can recover b:

     sage: c = a^b; c
     2*5^494 + 4*5^496 + 2*5^497 + 5^499 + 3*5^500 + 5^501 + O(5^502)
     sage: log(c)/log(a)
     2 + 4*5 + 4*5^2 + 5^3 + O(5^7)

Let E denote the Néron model of E over ℤ. Let P ∈ E(ℚ) be a nontorsion point that reduces to 0 ∈ E(𝔽_{p}) and to the connected component of E_{𝔽_{ℓ}} at all primes ℓ of bad reduction for E. For example, given any point Q ∈ E(ℚ) one can construct such a P by multiplying it by the least common multiple of the Tamagawa numbers of E.

Exercise 2.22. Show that any nonzero point P = (x(P), y(P)) ∈ E(ℚ) can be written uniquely in the form (a/d^{2}, b/d^{3}), where a, b, d ∈ ℤ, gcd(a, d) = gcd(b, d) = 1, and d > 0. (Hint: Use that ℤ is a unique factorization domain.)

The function d(P) assigns to P this square root d of the denominator of the x-coordinate x(P).

Example 2.23. We compute a point on a curve, and observe that the denominator of the x coordinate is a perfect square.

     sage: E = EllipticCurve('446d1')
     sage: P = 3*E.gen(0); P
     (32/49 : -510/343 : 1)

Let

(2.5.5)  x(t) = \frac{1}{t^{2}} + ⋯ ∈ ℤ_{p}((t))

be the formal power series that expresses x in terms of the local parameter t = −x/y at infinity. Similarly, let y(t) = −x(t)/t be the corresponding series for y. If we do the change of variables t = −x/y and w = −1/y, so x = t/w and y = −1/w, then the Weierstrass equation for E becomes

s = t^{3} + a_{1}st + a_{2}wt^{2} + a_{3}w^{2} + a_{4}w^{2}t + a_{6}w^{3} = F (w, t).

Repeatedly substituting this equation into itself recursively yields a power series expansion for w = −1/y in terms of t, hence for both x and y.

Remark 2.24. The formal group of E is a power series

F (t_{1}, t_{2}) ∈ R = ℤ[a_{1}, …, a_{6}][[t_{1}, t_{2}]].

defined as follows. Since x(t) and y(t) satisfy the equation of E, the points P_{1} = (x(t_{1}), y(t_{1})) and P_{2} = (x(t_{2}), y(t_{2})) are in E(R). As explained explicitly in [Sil92, §IV.1], their sum is

Q = P_{1} + P_{2} = (x(F), y(F)) ∈ E(R)

for some F = F (t_{1}, t_{2}) ∈ R.

Example 2.25. We compute the above change of variables in SAGE:

     sage: var('a1 a2 a3 a4 a6')
     sage: E = EllipticCurve([a1,a2,a3,a4,a6]); E
     Elliptic Curve defined by
          y^2 + a1*x*y + a3*y = x^3 + a2*x^2 + a4*x + a6
     over Symbolic Ring
     sage: eqn = SR(E); eqn
     (y^2 + a1*x*y + a3*y) == (x^3 + a2*x^2 + a4*x + a6)
     sage: F = eqn.lhs() - eqn.rhs(); F
     y^2 + a1*x*y + a3*y - x^3 - a2*x^2 - a4*x - a6
     sage: G = w^3*F(x=t/s, y=-1/w); G.expand()
     -t^3 - a2*w*t^2 - a4*w^2*t - a1*w*t - a6*w^3 - a3*w^2 + w

Example 2.26. We use SAGE to compute the formal power series x(t) and y(t) for the rank 1 elliptic curve 37a.

sage: E = EllipticCurve('37a'); E
Elliptic Curve defined by y^2 + y = x^3 - x over Rational Field
sage: F = E.formal_group(); F
Formal Group associated to the Elliptic Curve defined by
y^2 + y = x^3 - x over Rational Field
sage: x = F.x(prec=8); x
t^-2 - t + t^2 - t^4 + 2*t^5 - t^6 - 2*t^7 + O(t^8)
sage: y = F.y(prec=8); y
-t^-3 + 1 - t + t^3 - 2*t^4 + t^5 + 2*t^6 - 6*t^7 + O(t^8)

Notice that the power series satisfy the equation of the curve.

sage: y^2 + y == x^3 - x
True

Recall that ω_{E} = \frac{dx}{2y+\underline{a}_{1}x+\underline{a}_{3}} is the differential on a fixed choice of Weierstrass equation for E. Let

ω(t) = \frac{dx}{2y + \underline{a}_{1}x + \underline{a}_{3}} ∈ ℚ((t))dt

be the formal invariant holomorphic differential on E.

Example 2.27. Continuing the above example, we compute the formal differential on E:

sage: F.differential(prec=8)
1 + 2*t^3 - 2*t^4 + 6*t^6 - 12*t^7 + O(t^8)

We can also compute ω(t) directly from the definition:

sage: x.derivative()/(2*y+1)
1 + 2*t^3 - 2*t^4 + 6*t^6 - 12*t^7 + 6*t^8 + 20*t^9 + O(t^10)

The following theorem, which is proved in [MT91], uniquely determines a power series σ ∈ tℤ_{p}[[t]] and constant c ∈ ℤ_{p}.

Theorem 2.28 (Mazur-Tate). There is exactly one odd function σ(t) = t + ⋯ ∈ tℤ_{p}[[t]] and constant c ∈ ℤ_{p} that together satisfy the differential equation

(2.5.6)  x(t) + c = −\frac{d}{ω} (\frac{1}{σ} \frac{dσ}{ω} ) ,

where ω is the invariant differential dx/(2y + a_{1}x + a_{3}) associated with our chosen Weierstrass equation for E.

The above theorem produces a (very inefficient) algorithm to compute c and σ(t). Just view c as a formal indeterminate and compute σ(t) ∈ ℚ[c][[t]], then obtain constraints on c using that the coefficients of σ must be in ℤ_{p}. These determine c to some precision, which increases as we compute σ(t) to higher precision. Until recently this was the only known way to compute c and σ(t) – fortunately the method of [MST06] is much faster in general.

Definition 2.29 (Canonical p-adic Height). Let E be an elliptic curve over ℚ with good ordinary reduction at the odd prime p. Let log_{p}, d, and σ(t) be as above and suppose P ∈ E(ℚ) and that nP is a nonzero multiple of P such that nP reduces to the identity component of the Néron model of E at each prime of bad reduction. Then the p-adic canonical height of P is

h_{p}(P) = \frac{1}{n^{2}} · \frac{1}{p} · log_{p} (\frac{σ(P)}{d(P)}) .

Definition 2.30 (p-adic Regulator). The p-adic regulator of E is the discriminant (well defined up to sign) of the bilinear ℚ_{p}-valued pairing

(P, Q)_{p} = h_{p}(P) + h_{p}(Q) − h_{p}(P + Q).

Conjecture 2.31 (Schneider). The p-adic regulator Reg_{p}(E) is nonzero.

Theorem 2.32 (Kato, Schneider, et al.). Let E be an elliptic curve over ℚ with good ordinary reduction at the odd prime p and assume that the p-adic Galois representation ρ_{E,p} is surjective. If

ord_{T} (L_{p}(E, T)) ≤ rank E(ℚ),

then #� (E/ℚ)(p) is finite. Moreover, if Reg_{p}(E) is nonzero, then

ord_{p}(#� (E/ℚ)(p)) ≤ ord_{p} (\frac{L_{p}^{∗}(E, 0)}{∏ c_{ℓ} · Reg_{p}(E)}) .

Heegner Points and Kolyvagin’s Euler System

3.1. CM Elliptic Curves

In this section we state, and in some cases sketch proofs of, some basic facts about CM elliptic curves.

If E is an elliptic curve over a field K we let End(E/K) be the ring of all endomorphisms of E that are defined over K.

Definition 3.1 (CM Elliptic Curve). An elliptic curve E over a subfield of ℂ has complex multiplication if End(E/ℂ) ≠ ℤ.

Remark 3.2. If E is an elliptic curve over ℚ, then End(E/ℚ) = ℤ. This is true even if E has complex multiplication, in which case the complex multiplication must be defined over a bigger field than ℚ. The reason End(E/ℚ) = ℤ is because End(E/ℚ) acts faithfully on the 1-dimensional ℚvector space of invariant holomorphic differentials on E over ℚ and End(E/ℚ) is finitely generated as a ℤ-module.

A complex lattice Λ ⊂ ℂ is a subgroup abstractly isomorphic to ℤ × ℤ such that ℝΛ = ℂ. Using the Weirestrass ℘-function associated to the lattice Λ, one proves that there is a group isomorphism

ℂ/Λ ≅ E_{Λ}(ℂ),

where E_{Λ} is an elliptic curve over ℂ. Conversely, if E is any elliptic curve over ℂ, then there is a lattice Λ such that E = E_{Λ}. Explicitly, if ω_{E} is an invariant differential we may take Λ to be the lattice of all periods ∫_{γ} ω_{E} ∈ ℂ, where γ runs through the integral homology H_{1}(E(ℂ), ℤ).

Proposition 3.3. Let Λ_{1} and Λ_{2} be complex lattices. Then

Hom(ℂ/Λ_{1}, ℂ/Λ_{2}) ≅ {α ∈ ℂ : αΛ_{1} ⊂ Λ_{2}},

where the homomorphisms on the left side are as elliptic curves over ℂ. Moreover, the complex number α ∈ ℂ corresponds to the homomorphism [α] induced by multiplication by α, and the kernel of [α] is isomorphic to Λ_{2}/(αΛ_{1}).

Corollary 3.4. If α is any nonzero complex number and Λ is a lattice, then ℂ/Λ ≅ ℂ/(αΛ).

Proof. Since multiplication by α sends Λ into αΛ, Proposition 3.3 implies that α defines a homomorphism with 0 kernel, hence an isomorphism. □

Now suppose E/ℂ is a CM elliptic curve, and let Λ be a lattice such that E ≅ E_{Λ}. Then

End(E/ℂ) ≅ {α ∈ ℂ : αΛ ⊂ Λ}.

Proposition 3.5. Let E = E_{Λ} be a CM elliptic curve. Then there is a complex number ω and a quadratic imaginary field such K that

ωΛ ⊂ O_{K},

where O_{K} is the ring of integers of K. Moreover, End(E/ℂ) is an order (=subring of rank 2) of O_{K}.

Proof. Write Λ = ℤω_{1}⊕ℤω_{2}. By Corollary 3.4, we have E_{Λ} ≅ E_{ω_{1}^{−1}Λ}, so we may assume that ω_{1} = 1, i.e., that Λ = ℤ+βℤ for some β ∈ ℂ. To complete the proof, we will show that ωΛ ⊂ O_{K} for some quadratic imaginary field K and complex number ω.

By our hypothesis that E is CM there is a complex number α ∉ ℤ such that αΛ ⊂ Λ. Fixing a basis for Λ, we see that α acts on Λ via a 2 × 2 integral matrix, so satisfies a quadratic equation. Thus α is an algebraic integer of degree 2. In particular, there are integers a, b, c, d such that

α1 = a + bβ,  and  αβ = c + dβ.

Since α ∉ ℤ, the first equation above implies that β ∈ ℚ(α), so since β ∉ ℚ, ℚ(β) = ℚ(α). Note that β ∉ ℝ since Λ is a lattice with basis 1 and β, so K = ℚ(β) is a quadratic imaginary field. Thus the ring End(E/ℂ) generated by all such α is an order in the ring O_{K} of integers of an imaginary quadratic field. Finally, since β ∈ K, there is a complex number ω such that ω(ℤ + ℤβ) ⊂ O_{K}, where ω is chosen so that ωβ ∈ O_{K}. □

3.1.1. The Set of CM Elliptic Curves with Given CM.

Definition 3.6 (Fractional Ideal). A fractional ideal 𝔞 of a number field K is an O_{K}-submodule of K that is isomorphic to ℤ^{[K:ℚ]} as an abelian group. In particular, 𝔞 is nonzero.

If 𝔞 is a fractional ideal, the inverse 𝔞^{−1} of 𝔞, which is the set of x ∈ K such that x𝔞 ⊂ O_{K}, is also a fractional ideal. Moreover, 𝔞𝔞^{−1} = O_{K}.

Fix a quadratic imaginary field K. Let Ell(O_{K}) be the set of ℂ-isomorphism classes of elliptic curves E/ℂ with End(E) ≅ O_{K}. By the above results we may also view Ell(O_{K}) as the set of lattices Λ with End(E_{Λ}) ≅ O_{K}.

If 𝔞 is a fractional O_{K} ideal, then 𝔞 ⊂ K ⊂ ℂ is a lattice in ℂ. For the elliptic curve E_{𝔞} we have

End(E_{𝔞}) = O_{K},

because 𝔞 is an O_{K}-module by definition. Since rescaling a lattice produces an isomorphic elliptic curve, for any nonzero c ∈ K the fractional ideals 𝔞 and c𝔞 define the same elements of Ell(O_{K}).

The class group Cl(O_{K}) is the group of fractional ideals modulo principal fractional ideals. If 𝔞 is a fractional O_{K} ideal, denote by \overline{𝔞} its ideal class in the class group Cl(O_{K}) of K. We have a natural map

Cl(O_{K}) → Ell(O_{K}),

which sends \overline{𝔞} to E_{𝔞}.

Theorem 3.7. Fix a quadratic imaginary field K, and let Λ be a lattice in ℂ such that E_{Λ} ∈ Ell(O_{K}). Let 𝔞 and 𝔟 be nonzero fractional O_{K}-ideals. Then

(1) 𝔞Λ is a lattice in ℂ,

(2) We have End(E_{𝔞Λ}) ≅ O_{K}.

(3) We have E_{𝔞Λ} ≅ E_{𝔟Λ} if and only if \overline{𝔞} = \overline{𝔟}.

Thus there is a well-defined action of Cl(O_{K}) on Ell(O_{K}) given by

\overline{𝔞}E_{Λ} = E_{\overline{𝔞}^{−1}Λ}.

Theorem 3.8. The action of Cl(O_{K}) on Ell(O_{K}) is simply transitive.

Example 3.9. Let K = ℚ(\sqrt{−23}). Then the class number h_{K} is 3. An elliptic curve with CM by O_{K} is ℂ/(ℤ + (1 + \sqrt{−23})/2ℤ), and one can obtain the other two elements of Ell(O_{K}) by multiplying the lattice ℤ+(1+ \sqrt{−23})/2ℤ by two representative ideal classes for Cl(O_{K}).

3.1.2. Class Field Theory. Class field theory makes sense for arbitrary number fields, but for simplicity in this section and because it is all that is needed for our application to the BSD conjecture, we assume henceforth that K is a totally imaginary number field, i.e., one with no real embeddings.

Let L/K be a finite abelian extension of number fields, and let 𝔞 be any unramified prime ideal in O_{K}. Let 𝔟 be an prime of O_{L} over 𝔞 and consider the extension k_{𝔟} = O_{L}/𝔟 of the finite field k_{𝔞} = O_{K}/𝔞. There is an element \overline{σ} ∈ Gal(k_{𝔟}/k_{𝔞}) that acts via qth powering on k_{𝔟}, where q = #k_{𝔞}. A basic fact one proves in algebraic number theory is that there is an element σ ∈ Gal(L/K) that acts as \overline{σ} on O_{L}/𝔟; moreover, replacing 𝔟 by a different ideal over 𝔞 just changes σ by conjugation. Since Gal(L/K) is abelian it follows that σ is uniquely determined by 𝔞. The association 𝔞 ↦ σ = [𝔞, L/K] is called the Artin reciprocity map.

Exercise 3.10. Prove that if an unramified prime 𝔭 of K splits completely in an abelian exension L/K, then [𝔭, L/K] = 1.

Let 𝔠 be an integral ideal divisible by all primes of K that ramify in L, and let I(𝔠) be the group of fractional ideals that are coprime to 𝔠. Then the reciprocity map extends to a map

I(𝔠) → Gal(L/K) a ↦ [𝔞, L/K]

Let

P (𝔠) = {(α) : α ∈ K^{∗}, α ≡ 1 (mod 𝔠)}.

Here α ≡ 1 (mod 𝔠) means that ord_{𝔭}(α−1) ≥ ord_{p}(𝔠) for each prime divisor 𝔭 | 𝔠.

Definition 3.11 (Conductor of Extension). The conductor of an abelian extension L/K is the largest (nonzero) integral ideal 𝔠 = 𝔠_{L/K} of O_{K} such that [(α), L/K] = 1 for all α ∈ K^{∗} such that α ≡ 1 (mod 𝔠).

Proposition 3.12. The conductor of L/K exists.

If 𝔠 = 𝔠_{L/K} is the conductor of L/K then Artin reciprocity induces a group homomorphism

I(𝔠)/P (𝔠) → Gal(L/K).

Definition 3.13 (Ray Class Field). Let 𝔠 be a nonzero integral ideal of O_{K}. A ray class field associated to 𝔠 is a finite abelian extension K_{𝔠} of K such that whenever L/K is an abelian extension such that 𝔠_{L/K} | 𝔠, then L ⊂ K_{𝔠}.

Theorem 3.14 (Existence Theorem of Class Field Theory). Given any nonzero integral ideal 𝔠 of O_{K} there exists a unique ray class field K_{𝔠} associated to 𝔠, and the conductor of K_{𝔠} divides 𝔠.

Theorem 3.15 (Reciprocity Law of Class Field Theory). Let L/K be a finite abelian extension.

(1) The Artin map is a surjective homomorphism I(𝔠_{L/K}) → Gal(L/K).

(2) The kernel of the Artin map is N_{L/K}(I_{L})·P (𝔠_{L/K}), where N_{L/K}(I_{L}) is the group of norms from L to K of the fractional ideals of L.

Definition 3.16 (Hilbert Class Field). The Hilbert class field of a number field K is the maximal unramified abelian extension of K.

In particular, since the Hilbert class field is unramified over K, we have:

Theorem 3.17. Let K be a number field and let H be the Hilbert class field of K. The Artin reciprocity map induces an isomorphism

Cl(O_{K}) ⟶^{≅} Gal(H/K).

3.1.3. The Field of Definition of CM Elliptic Curves.

Theorem 3.18. Let F be an elliptic curve over ℂ with CM by O_{K}, where K is a quadratic imaginary field. Let H be the Hilbert Class Field of K.

(1) There is an elliptic curve E defined over K such that F ≅ E_{ℂ}.

(2) The Gal(H/K)-conjugates of E are representative elements for Ell(O_{K}).

(3) If σ ∈ Gal(H/K) corresponds via Artin reciprocity to \overline{𝔞} ∈ Cl(O_{K}),

then

E^{σ} = \overline{𝔞}E.

Theorem 3.18 generalizes in a natural way to the more general situation in which O_{K} is replaced by an order O_{f} = ℤ+fO_{K} ⊂ O_{K}. Then the Hilbert class field is replaced by the ray class field K_{f}, which is a finite abelian extension of H that is unramified outside f (see Definition 3.13 above). There is an elliptic curve E defined over K_{f} whose endomorphism ring is O_{f}, and the set of Gal(K_{f}/K)-conjugates of E forms a set of representatives for Ell(O_{f}). Moreover, the group I(𝔠_{L/K})/(N · P (𝔠_{L/K})) of Theorem 3.15 acts simply transitively on Ell(O_{f}), and the action of Gal(K_{f}/K) on the set of conjugates of E is consistent with the Artin reciprocity map.

3.2. Heegner Points

Let E be an elliptic curve defined over ℚ with conductor N, and fix a modular parametrization π_{E} : X_{0}(N) → E.

Let K be a quadratic imaginary field such that the primes dividing N are all unramified and split in K. For simplicity, we will also assume that K ≠ ℚ(i), ℚ(\sqrt{−3}). Let N be an integral ideal of O_{K} such that O_{K}/N ≅ ℤ/Nℤ. Then ℂ/O_{K} and ℂ/N^{−1} define two elliptic curves over ℂ, and since O_{K} ⊂ N^{−1}, there is a natural map

(3.2.1)  ℂ/O_{K} → ℂ/N^{−1}.

By Proposition 3.3 the kernel of this map is

N^{−1}/O_{K} ≅ O_{K}/N ≅ ℤ/Nℤ.

Exercise 3.19. Prove that there is an isomorphism N^{−1}/O_{K} ≅ O_{K}/N of finite abelian group.

The modular curve X_{0}(N) parametrizes isomorphism classes of pairs (F, ϕ), where ϕ is an isogeny with kernel cyclic of order N. Thus ℂ/O_{K} and the isogeny (3.2.1) define an element x_{1} ∈ X_{0}(N)(ℂ). The discussion of Section 3.1.3 along with properties of modular curves proves the following proposition.

Proposition 3.20. We have

x_{1} ∈ X_{0}(N)(H),

where H is the Hilbert class field of K.

Definition 3.21 (Heegner point). The Heegner point associated to K is

y_{K} = Tr_{H/K}(π_{E}(x_{1})) ∈ E(K).

More generally, for any integer n, let O_{n} = ℤ + nO_{K} be the order in O_{K} of index n. Then N_{n} = N ∩ O_{n} satisfies O_{n}/N_{n} ≅ ℤ/Nℤ, and the pair

(ℂ/O_{n}, ℂ/O_{n} → ℂ/N_{n}^{−1})

defines a point x_{n} ∈ X_{0}(N)(K_{n}), where K_{n} is the ray class field of conductor n over K.

Definition 3.22 (Heegner point of conductor n). The Heegner point of conductor n is

y_{n} = π_{E}(x_{n}) ∈ E(K_{n}).

3.3. Computing Heegner Points

[[This section will be my take on what’s in Cohen’s book and Watkins paper, hopefully generalized to compute Heegner points over ring class fields (?).]]

3.4. Kolyvagin’s Euler System

3.4.1. Kolyvagin’s Cohomology Classes. In this section we define Kolyvagin’s cohomology classes. Later we will explain the properties that these classes have, and eventually use them to sketch a proof of finiteness of Shafarevich-Tate groups of certain elliptic curves.

We will use, when possible, similar notation to the notation Kolyvagin uses in his papers (e.g., [Kol91]). If A is an abelian group let A/M = A/(MA). Kolyvagin writes A_{M} for the M-torsion subgroup, but we will instead write A[M] for this group.

Let E be an elliptic curve over ℚ with no constraint on the rank of E. Fix a modular parametrization π : X_{0}(N) → E, where N is the conductor of E. Let K be a quadratic imaginary field with discriminant D that satisfies the Heegner hypothesis for E, so each prime dividing N splits in K, and assume for simplicity that D ≠ −3, −4.

Let O_{K} be the ring of integer of K. Since K satisfies the Heegner hypothesis, there is an ideal N in O_{K} such that O_{K}/N is cyclic of order N. For any positive integer λ, let K_{λ} be the ray class field of K associated to the conductor λ (see Definition 3.13). Recall that K_{λ} is an abelian extension of K that is unramified outside λ, whose existence is guaranteed by class field theory. Let O_{λ} = ℤ + λO_{K} be the order in O_{K} of conductor λ, and let N_{λ} = N ∩ O_{λ}. Let

z_{λ} = [(ℂ/O_{λ}, N_{λ}^{−1}/O_{λ})] = X_{0}(N)(K_{λ})

be the Heegner point associated to λ. Also, let

y_{λ} = π(z_{λ}) ∈ E(K_{λ})

be the image of the Heegner point on the curve E.

Let R = End(E/ℂ), and let B(E) be the set of primes ℓ ≥ 3 in ℤ that do not divide the discriminant of R and are such that the image of the representation

ρ_{E,ℓ} : Gal(\overline{ℚ}/ℚ) → Aut(Tate_{ℓ}(E))

contains Aut_{R}(Tate_{ℓ}(E)), where Aut_{R}(Tate_{ℓ}(E)) is the set of automorphisms that commute with the action of R on Tate_{ℓ}(E). Note that if ℓ ≥ 5 the condition that ρ_{E,ℓ} is surjective is equivalent to the simpler condition that

\overline{ρ}_{E,ℓ} : Gal(\overline{ℚ}/ℚ) → Aut_{R}(E[ℓ])

is surjective. The set B(E) contains all but finitely many primes, by theorems of Serre [Ser72], Mazur [Maz78], and CM theory, and one can compute B(E).

     sage: E = EllipticCurve('11a')
     sage: E.non_surjective()
     [(5, '5-torsion')]
     sage: E = EllipticCurve('389a')
     sage: E.non_surjective()
     []

Fix a prime ℓ ∈ B(E). We next introduce some very useful notation. Let Λ^{1} denote the set of all primes p ∈ ℤ such that p ∤ N, p remains prime in O_{K}, and for which

n(p) = ord_{ℓ}(gcd(p + 1, a_{p})) ≥ 1.

For any positive integer r, let Λ^{r} denote the set of all products of r distinct primes in Λ^{1}; by definition Λ^{0} = {1}. Finally, let

Λ = ⋃_{r≥0} Λ^{r}.

For any r > 0 and λ ∈ Λ^{r}, let

n(λ) = min_{p|λ} n(p)

be the “worst” of all the powers of p that divide gcd(p + 1, a_{p}). If λ = 1, set n(λ) = +∞.

Fix an element λ ∈ Λ, with λ ≠ 1, and consider the ℓ-power

M = M_{λ} = ℓ^{n(λ)}.

Recall from Section 2.2.1 that we associate to the short exact sequence

0 → E[M] → E ⟶^{[M]} E → 0

an exact sequence

0 → E(K)/M → H^{1}(K, E[M]) → H^{1}(K, E)[M] → 0.

Our immediate goal is to construct an interesting cohomology class

c_{λ} ∈ H^{1}(K, E[M]).

If L/K is any Galois extension, we have (see Section 2.1.2 for most of this) an exact sequence (3.4.1)

0 → H^{1}(L/K, E[M](L)) → H^{1}(K, E[M]) → H^{1}(L, E[M])^{Gal(L/K)} → 0.

Lemma 3.23. We have E[M](K_{λ}) = 0.

Proof. For simplicity we prove the statement only in the non-CM case. The integer M is a power of a prime ℓ, so it suffices to show that E[ℓ](K_{λ}) = 0. Since ℓ ∈ B(E) the Galois representation

\overline{ρ}_{E,ℓ} : G_{ℚ} → GL_{2}(𝔽_{ℓ})

is surjective. The group GL_{2}(𝔽_{ℓ}) acts transitively on (𝔽_{ℓ})^{2}, so the G_{ℚ} orbit of any nonzero point in E[ℓ](\overline{ℚ}) is equal to the set of all nonzero points in E[ℓ](\overline{ℚ}). By class field theory, the extension K_{λ} of ℚ is Galois, so if E[ℓ](K_{λ}) is nonzero, then it is equal to E[ℓ](\overline{ℚ}). Using properties of the Weil pairing, we see that the field generated by the coordinates of the elements of E[ℓ](\overline{ℚ}) contains the cyclotomic field ℚ(ζ_{ℓ}), which is a field totally ramified at ℓ. But K ∩ ℚ(ζ_{ℓ}) = ℚ, since disc(K) ≠ −3, −4, and K_{λ} is ramified only at primes in Λ^{1} and ℓ ∉ Λ^{1}. We conclude that K_{λ} ∩ ℚ(ζ_{ℓ}) = ℚ, so we must have E[ℓ](K_{λ}) = 0. (Compare [Gro91, Lem. 4.3].) □

Thus (3.4.1) with L = K_{λ} becomes

(3.4.2)  H^{1}(K, E[M]) ⟶^{≅} H^{1}(K_{λ}, E[M])^{G_{λ}}

where G_{λ} = Gal(K_{λ}/K). Putting this together, we obtain the following commutative diagram with exact rows and columns:

\xymatrix{0 \ar[r] & (E(K_{λ})/M)^{G_{λ}} \ar[r] & H^{1}(K_{λ}, E[M])^{G_{λ}} \ar[r] & H^{1}(K_{λ}, E)[M]^{G_{λ}} \\ 0 \ar[r] & E(K)/M \ar[r] \ar@{^{(}->}[u] & H^{1}(K, E[M]) \ar[u]^{≅}_{res} \ar[r] & H^{1}(K, E)[M] \ar[r] \ar[u]^{res} & 0 \\  &  &  & H^{1}(K_{λ}/K, E)[M] \ar@{^{(}->}[u]^{inf}}

Thus to construct c_{λ} ∈ H^{1}(K, E[M]), it suffices to construct a class c′_{λ} ∈ H^{1}(K_{λ}, E[M]) that is invariant under the action of G_{λ}. We will do this by constructing an element of E(K_{λ}) and using the inclusion

(3.4.3)  E(K_{λ})/M ↪ H^{1}(K_{λ}, E[M]).

In particular, we will construct an element of the group E(K_{λ})/M that is invariant under the action of G_{λ}.

Recall that y_{λ} ∈ E(K_{λ}). Unfortunately, there is no reason that the class

[y_{λ}] ∈ E(K_{λ})/M

should be invariant under the action of G_{λ}. To deal with this problem, Kolyvagin introduced a new and original idea which we now explain.

Let H = K_{1} be the Hilbert class field of K. Write λ = p_{1} ⋯ p_{r}, and for each p = p_{i} let G_{p} = Gal(K_{p}/K) where K_{p} is the ray class field associated to p. Class field theory implies that the natural map

Gal(K_{λ}/K_{1}) ≅→ G_{p_{1}} × G_{p_{2}} × ⋯ × G_{p_{r}}

is an isomorphism. Moreover, each group G_{p_{i}} is cyclic of order p_{i} + 1. For each p = p_{i}, let σ_{p} be a fixed choice of generator of G_{p}, and let

Tr_{p} = ∑_{σ∈G_{p}} σ ∈ ℤ[G_{p}].

Finally, let D_{p} ∈ ℤ[G_{p}] be any solution of the equation

(3.4.4)  (σ_{p} − 1) · D_{p} = p + 1 − Tr_{p} .

For example, Kolyvagin always takes

D_{p} = ∑_{i=1}^{p} iσ_{p}^{i} = − ∑_{i=1}^{p+1}(σ_{p}^{i} − 1)/(σ_{p} − 1).

Notice that the choice of D_{p} is well defined up to addition of elements in ℤ Tr_{p}. Let

D_{λ} = ∏ D_{p} = D_{p_{1}} · D_{p_{2}} · · · · · D_{p_{r}} ∈ ℤ[G_{λ}].

Finally, let S be a set of coset representatives for Gal(K_{λ}/K_{1}) in G_{λ} = Gal(K_{λ}/K), and let

J_{λ} = ∑_{σ∈S} σ ∈ ℤ[G_{λ}].

Let

P_{λ} = J_{λ}D_{λ}y_{λ} ∈ E(K_{λ}).

Note that if λ = 1, then K_{λ} = K_{1}, so

P_{1} = J_{1}y_{λ} = Tr_{K_{1}/K}(y_{λ}) = y_{K} ∈ E(K).

Before proving that we can use P_{λ} to define a cohomology class in H^{1}(K, E[M]), we state two crucial facts about the structure of the Heegner points y_{λ}.

Proposition 3.24. Write λ = pλ′, and let a_{p} = a_{p}(E) = p + 1 − #E(𝔽_{p}).

(1) We have

Tr_{p}(y_{λ}) = a_{p}y_{λ′}

in E(K_{λ′}).

(2) Each prime factor ℘_{λ} of p in K_{λ} divides a unique prime ℘_{λ′} of K_{λ′}, and we have a congruence

y_{λ} ≡ Frob(℘_{λ′})(y_{λ′}) (mod ℘_{λ}).

Proof. See [Gro91, Prop. 3.7]. The proof uses a description of the action of Hecke operators on modular curves. □

Proposition 3.25. The class [P_{λ}] of P_{λ} in E(K_{λ})/M is fixed by G_{λ}.

Proof. We follow the proof of [Gro91, Prop. 3.6]. It suffices to show that [D_{λ}y_{λ}] is fixed by σ_{p} for each prime p | λ, since the σ_{p} generate Gal(K_{λ}/K_{1}), the elements of the set S of coset representatives fix the image of J_{λ}, and G_{λ} is generated by the σ_{p} and S. Thus we will prove that

(σ_{p} − 1)D_{λ}y_{λ} ∈ ME(K_{λ})

for each p | λ.

Write λ = pm. By (3.4.4), we have in ℤ[G_{λ}] that

(σ_{p} − 1)D_{λ} = (σ_{p} − 1)D_{p}D_{m} = (p + 1 − Tr_{p})D_{m},

so using Proposition 3.24 we have

(σ_{p} − 1)D_{λ}y_{λ} = (p + 1 − Tr_{p})D_{m}y_{λ}
= (p + 1)D_{m}y_{λ} − D_{m} Tr_{p}(y_{λ})
= (p + 1)D_{m}y_{λ} − a_{p}D_{m}y_{λ′}

Since p ∈ Λ^{1} and M = ℓ^{n(p)} and n(p) = min(ord_{ℓ}(p + 1), ord_{ℓ}(a_{p})), we have M | p + 1 and M | a_{p}. Thus (p + 1)D_{m}y_{λ} ∈ ME(K_{λ}) and a_{p}y_{λ′} ∈ ME(K_{λ}), which proves the proposition. □

We have now constructed an element of E(K_{λ})/M that is fixed by G_{λ}. Via (3.4.3) this defines an element c′_{λ} ∈ H^{1}(K_{λ}, E[M]). But then using (3.4.2) we obtain our sought after class c_{λ} ∈ H^{1}(K, E[M]).

We will also be interested in the image d_{λ} of c_{λ} in H^{1}(K, E)[M].

Proposition 3.26. If v is archimedean or v ∤ λ, then

res_{v}(d_{λ}) = 0.

Proof. If v is archimedean we are done, since K_{v} = ℂ is algebraically closed. Otherwise, the class d_{λ} splits over K_{λ} and K_{λ} is unramified at v, so

res_{v}(d_{λ}) ∈ H^{1}(K_{v}^{unr}/K_{v}, E).

But the latter group is isomorphic to the component group of E at v, and a theorem of Gross-Zagier implies that the Heegner point maps to the identity component. (See [Gro91, Prop. 6.2] for more details.) □

Proposition 3.27. Write λ = pm and let ℘ = pO_{K} be the unique prime ideal of K dividing p. Let v be a place of K_{m} that divides ℘. Then the order of res_{℘}(d_{λ}) is the same as the order of

[P_{m}] ∈ E(K_{℘})/ME(K_{℘}),

where K_{℘} denotes the completion of K at ℘. (Note that ℘ splits completely in K_{m}/K by class field theory, since ℘ = pO_{K} is principal and coprime to m, so P_{m} ∈ E(K_{℘}).)

Proof. See [Gro91, Prop. 6.2] for the case M = ℓ. The argument involves standard properties of Galois cohomology of elliptic curves, some diagram chasing, reduction modulo a prime, and use of formal groups. □

Next we consider a consequence of Proposition 3.27 when y_{K} is not a torsion point. Note that y_{K} nontorsion implies that y_{K} ∉ ME(K) for all but finitely many M. Moreover, the Gross-Zagier theorem implies that y_{K} is nontorsion if and only if ord_{s=1} L(E, s) ≤ 1.

Proposition 3.28. Suppose that y_{K} ∈ E(K) is not divisible by M. Then there are infinitely many p ∈ Λ^{1} such that d_{p} ∈ H^{1}(K, E)[M] is nonzero.

Proof. This follows from Proposition 3.27 with m = 1 and the Chebotarev density theorem. See e.g., [Ste02, §4.1] for a proof. □

Remark 3.29. See, e.g., [Ste02] for an application of this idea to a problem raised by Lang and Tate in [LT58].

Theorem 3.30 (Kolyvagin). Suppose E is a modular elliptic curve over ℚ and K is a quadratic imaginary field that satisfies the Heegner hypothesis for E and is such that y_{K} ∈ E(K) is nontorsion. Then E(K) has rank 1 and

#� (E/K) | b · [E(K) : ℤy_{K}]^{2},

where b is a positive integer divisible only by primes ℓ ∈ B(E) (i.e., for which the ℓ-adic representation is not as surjective as possible).

Proof. See the entire paper [Gro91]. Kolyvagin proves this theorem by bounding Sel^{(M)}(E/K) for various M using Proposition 3.28 in conjunction with a careful study of various pairings coming from Galois cohomology, the Weil pairing, Tate local daulity, etc. Since

0 → E(K)/ME(K) → Sel^{(M)}(E/K) → � (E/K),

a bound on the Selmer group translates into a bound on E(K) and � (E/K). □

After Kolyvagin proved his theorem, independently Murty-Murty, Bump-Friedberg-Hoffstein, Waldspurger, each proved that infinitely many such quadratic imaginary K always exists so long as E has analytic rank 0 or 1. Also, Taylor and Wiles proved that every E over ℚ is modular. Thus we have the following theorem:

Theorem 3.31. Suppose E is an elliptic curve over ℚ with

r_{E,an} = ord_{s=1} L(E, s) ≤ 1.

Then E(ℚ) has rank r_{E,an}, the group � (E/ℚ) is finite, and there is an explicit computable upper bound on #� (E/ℚ).

The author has computed the upper bound of the theorem for all elliptic curves with conductor up to 1000 and r_{E,an} ≤ 1.

3.4.2. Kolyvagin’s Conjectures. What about curves E with r_{E,an} ≥ 2? Suppose that E is an elliptic curve over ℚ with r_{E,an} ≥ 2. In the short paper [Kol91], Kolyvagin states an amazing structure theorems for Selmer groups assuming the following unproved conjecture, which is the appropriate generalization of the condition that P_{1} has infinite order.

Conjecture 3.32 (Kolyvagin [Kol91]). Let E be any elliptic curve over ℚ and fix a prime ℓ ∈ B(E) and a prime power M = ℓ^{n} of ℓ. Then there is at least one cohomology class c_{λ} ∈ H^{1}(K, E[M]) that is nonzero.

So far nobody has been able to show that Conjecture 3.32 is satisfied by every elliptic curve E over ℚ, though several people are currently working hard on this problem (including Vatsal and Cornut). Proposition 3.28 above implies that Conjecture 3.32 is true for elliptic curves with r_{E,an} ≤ 1.

Kolyvagin also goes on in [Kol91] to give a conjectural construction of a subgroup

V ⊂ E(K)/E(K)_{tor}

for which rank(E(ℚ)) = rank(V). Let ℓ be an arbitrary prime, i.e., so we do not necessarily assume ℓ ∈ B(E). One can construct cohomology class c_{λ} ∈ H^{1}(K, E[M]), so long as λ ∈ Λ^{n+k_{0}}, where ℓ^{k_{0}/2}E(K)[ℓ^{∞}] = 0, and K is the compositum of all class field K_{λ} for λ ∈ Λ. For any n ≥ 1, k ≥ k_{0}, and r ≥ 0, let

V_{n,k}^{r} ⊂ \underrightarrow{lim}_{m} H^{1}(K, E[ℓ^{m}])/E(K)_{tor}

be the subgroup generated by the images of the classes τ_{λ} = τ_{λ,n} ∈ H^{1}(K, E[ℓ^{n}]) where λ runs through Λ_{n+k}^{r}.

Conjecture 3.33 (Kolyvagin). Let E be any elliptic curve over ℚ. Then for all prime numbers ℓ, there exists an integer r such that for all k ≥ k_{0} there is an n such that V_{n,k}^{r} ≠ 0.

Recall that

n(p) = ord_{ℓ}(gcd(p + 1, a_{p})) ≥ 1

and

n(λ) = min_{p|λ} n(p).

Let m′(λ) be the maximal nonnegative integer such that P_{λ} ∈ ℓ^{m′(λ)}E(K_{λ}). Let m(λ) = m′(λ) if m′(λ) < n(λ), and m(λ) = ∞ otherwise. For any r ≥ 0, let

m_{r} = min{m(λ) : λ ∈ Λ^{r}},

and let f be the minimal r such that m_{r} is finite.

Proposition 3.34. We have f = 0 if and only if y_{K} has infinite order.

Let SD = ℓ^{n}S, where

S = \underrightarrow{lim}_{n} Sel^{(ℓ^{n})}(K, E[ℓ^{n}]).

If A is a ℤ[1, σ]-module and ε = (−1)^{r_{E,an}−1}. then

A^{v} = {b ∈ A : σ(b) = (−1)^{v+1}εb}

Assuming his conjectures, Kolyvagin deduces that for every prime number ℓ there exists integers k_{1} and k_{2} such that for any integer k ≥ k_{1} we have

ℓ^{k_{2}}SD^{(f+1)}[M] ⊂ V_{n,k}^{f} ⊂ SD^{(f+1)}[M].

Here the exponent of f+1 means the +1 or −1 eigenspace for the conjugation action.

Conjecture 3.35 (Kolyvagin). Let E be any elliptic curve over ℚ and ℓ any prime. There exists v ∈ {0, 1} and a subgroup

V ⊂ (E(K)/E(K)_{tors})^{(v)}

such that

1 ≤ rank(V) ≡ v (mod 2).

Let a = rank(V)−1. Then for all sufficiently large k and all n, one has that

V_{n,k}^{a} ≡ V mod ℓ^{n}(E(K)/E(K)_{tor}).

Assuming the above conjecture for all primes ℓ, the group V is uniquely determined by the congruence condition in the second part of the conjecture. Also, Kolyvagin proves that if the above conjecture is true, then the rank of E^{v}(ℚ) equals the rank of V, and that � (E^{v}/ℚ)[ℓ^{∞}] is finite. (Here E^{v} is E or its quadratic twist.)

When P_{1} has infinite order, the conjecture is true with v = 1 and V = ℤP_{1}. (I think here E has r_{E,an} = 0.)

3.5. The Gross-Zagier Theorem 59

3.5. The Gross-Zagier Theorem

Computational Verification of the Conjecture

4.1. Theorem 4.2. Examples

Bibliography

[BCDT01] C. Breuil, B. Conrad, Fred Diamond, and R. Taylor, On the modularity of elliptic curves over Q: wild 3-adic exercises, J. Amer. Math. Soc. 14 (2001), no. 4, 843–939 (electronic). MR 2002d:11058

[Bir71] B. J. Birch, Elliptic curves over Q: A progress report, 1969 Number Theory Institute (Proc. Sympos. Pure Math., Vol. XX, State Univ. New York, Stony Brook, N.Y., 1969), Amer. Math. Soc., Providence, R.I., 1971, pp. 396–400.

[Coh00] Henri Cohen, Advanced topics in computational number theory, Graduate Texts in Mathematics, vol. 193, Springer-Verlag, New York, 2000. MR MR1728313 (2000k:11144)

[Cp86] J. W. S. Cassels and A. Fröhlich (eds.), Algebraic number theory, London, Academic Press Inc. [Harcourt Brace Jovanovich Publishers], 1986, Reprint of the 1967 original.

[Cre97] J. E. Cremona, Algorithms for modular elliptic curves, second ed., Cambridge University Press, Cambridge, 1997,

http://www.maths.nott.ac.uk/personal/jec/book/.

[CS00] J. Coates and R. Sujatha, Galois cohomology of elliptic curves, Tata Institute of Fundamental Research Lectures on Mathematics, 88, Published by Narosa Publishing House, New Delhi, 2000. MR MR1759312 (2001b:11046)

[Dok04] Tim Dokchitser, Computing special values of motivic L-functions, Experiment. Math. 13 (2004), no. 2, 137–149.

[Elk87] Noam D. Elkies, The existence of infinitely many supersingular primes for every elliptic curve over Q, Invent. Math. 89 (1987), no. 3, 561–567. MR MR903384 (88i:11034)

[GJP^{+}05] G. Grigorov, A. Jorza, S. Patrikis, C. Patrascu, and W. Stein, Verification of the Birch and Swinnerton-Dyer Conjecture for Specific Elliptic Curves, (Submitted)

http://www.wstein.org/papers/bsdalg/ (2005).

[Gro91] B. H. Gross, Kolyvagin’s work on modular elliptic curves, L-functions and arithmetic (Durham, 1989), Cambridge Univ. Press, Cambridge, 1991, pp. 235–256.

[Kol91] V. A. Kolyvagin, On the structure of Selmer groups, Math. Ann. 291 (1991), no. 2, 253–259. MR 93e:11073

64 Bibliography

[LT58] S. Lang and J. Tate, Principal homogeneous spaces over abelian varieties, Amer. J. Math. 80 (1958), 659–684.

[Maz78] B. Mazur, Rational isogenies of prime degree (with an appendix by D. Goldfeld), Invent. Math. 44 (1978), no. 2, 129–162.

[MST06] Barry Mazur, William Stein, and John Tate, Computation of p-adic heights and log convergence, Doc. Math. (2006), no. Extra Vol., 577–614 (electronic). MR MR2290599

[MT91] B. Mazur and J. Tate, The p-adic sigma function, Duke Math. J. 62 (1991), no. 3, 663–688. MR 93d:11059

[MTT86] B. Mazur, J. Tate, and J. Teitelbaum, On p-adic analogues of the conjectures of Birch and Swinnerton-Dyer, Invent. Math. 84 (1986), no. 1, 1–48.

[Ser72] J-P. Serre, Propriétés galoisiennes des points d’ordre fini des courbes elliptiques, Invent. Math. 15 (1972), no. 4, 259–331.

[Ser79] , Local fields, Springer-Verlag, New York, 1979, Translated from the French by Marvin Jay Greenberg.

[Ser97] , Galois cohomology, Springer-Verlag, Berlin, 1997, Translated from the French by Patrick Ion and revised by the author.

[Sil92] J. H. Silverman, The arithmetic of elliptic curves, Springer-Verlag, New York, 1992, corrected reprint of the 1986 original.

[Ste02] W. A. Stein, There are genus one curves over Q of every odd index, J. Reine Angew. Math. 547 (2002), 139–147. MR 2003c:11059

[SW07] William Stein and Chris Wuthrich, Computations About Tate-Shafarevich Groups Uusing Iwasawa Theory, In preparation (2007).

[Wil95] A. J. Wiles, Modular elliptic curves and Fermat’s last theorem, Ann. of Math. (2) 141 (1995), no. 3, 443–551. MR 1333035 (96d:11071)

[Wil00] , The Birch and Swinnerton-Dyer Conjecture,

http://www.claymath.org/prize problems/birchsd.htm.