Lecture 25: Elliptic Curves 1: Introduction

William Stein

Math 124 Harvard University Fall 2001

1 The Definition

Finally we come to elliptic curves, which I think are the most exciting and central easily accessibly objects in modern number theory. There are so many exciting things to tell you about elliptic curves, that the course is suddenly going to move more quickly than before.

Definition 1.1. An elliptic curve E over a field K is a plane cubic curve of the form

y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6},

where a_{1}, a_{2}, a_{3}, a_{4}, a_{6} ∈ K and

Δ = −b_{2}^{2}b_{8} − 8b_{4}^{3} − 27b_{6}^{2} + 9b_{2}b_{4}b_{6} ≠ 0,

where

b_{2} = a_{1}^{2} + 4a_{2}, b_{4} = 2a_{4} + a_{1}a_{3}, b_{6} = a_{3}^{2} + 4a_{6}.

Help! Don’t worry, when 2 and 3 are not equal to 0 in K, using completing the square and a little algebra we find a change of coordinates that transforms the above cubic equation into the form

y^{2} = x^{3} + ax + b,

and then Δ = −16(4a^{3} + 27b^{2}). We will consider only elliptic curves of the form y^{2} = x^{3} + ax + b for a while.

Hey! That’s not an ellipse! You’re right, elliptic curves are not ellipses; they are curves that first arose when 19th century mathematicians studied integral formulas for the arc lengths of ellipses.

In these lectures, I’ll give you a glimpse into two main ways in which elliptic curves feature in mathematics. On the left hand, they provide the simplest example of a class of diophantine equations that we still can’t totally solve. On the right hand, when K is a finite field (or, more sneakily, a finite ring), elliptic curves can be used as a tool for both making and breaking cryptosystems.

2 Linear and Quadratic Diophantine Equations

Consider the following question:

Let F (x, y) be an irreducible polynomial in two variables over ℚ. Find all rational numbers x_{0}, y_{0} such that F (x_{0}, y_{0}) = 0.

When F is linear, this problem is easy. The equation

F (x, y) = ax + by + c = 0

defines a line, and letting y = t, the solutions are

\{(−\frac{b}{a}t − \frac{c}{a}, t) : t ∈ ℚ\} .

When F is quadratic, the solution is not completely trivial, but it is well understood. In this case, the equation F = 0 has infinitely many rational solutions if and only if it has at least one solution. Moreover, it is easy to describe all solutions when there is one. If (x_{0}, y_{0}) is a solution and L is a non-tangent line through (x_{0}, y_{0}), then L will intersect the curve F = 0 in exactly one other point (x_{1}, x_{1}). Also x_{1}, y_{1} ∈ ℚ since a quadratic polynomial over ℚ with 1 rational root has both roots rational. Thus the rational points on F = 0 are in bijection with the slopes of lines through (x_{0}, y_{0}).

Chapter 2 of [Kato et al.] is about how to decide whether or not an F of degree 2 has a rational point. The answer is that F = 0 has a rational solution if and only if F = 0 has a solution with x_{0}, y_{0} ∈ ℝ and a solution with x_{0}, y_{0} ∈ ℚ_{p} for every “p-adic field” ℚ_{p}. This condition, though it might sound foreboding, is easy to check in practice. I encourage you to flip through chapter 2 of loc. cit.

3 Points on Elliptic Curves

Next suppose that F is an irreducible cubic polynomial. The question of whether or not F = 0 has a rational solution is still an open problem! We will not consider this problem further until we discuss the Birch and Swinnerton-Dyer conjecture.

Suppose that F = 0 has a given rational solution. Then one can change coordinates so that the question of finding the rational solutions to F = 0 is equivalent to the problem of finding all rational points on the elliptic curve

y^{2} = x^{3} + ax + b.

Recall that when F has degree 2 we can use a given rational point P on the graph of F = 0 to find all other rational points by intersecting a line through P with the graph of F = 0. The graph of y^{2} = x^{3} + ax + b looks like

[egg and curvy line] or [curvier line] Notice that if P is a point on the graph of the curve, then a line through P (usually) intersects the graph in exactly two other points. In general, these two other points usually do not have rational coordinates. However, if P and Q are rational points on the graph of y^{2} = x^{3} + ax + b and L is the line through P and Q, then the third point of intersection with the graph will have rational coordinates. Explicitly, if P = (x_{1}, y_{1}) and Q = (x_{2}, y_{2}) then the third point of intersection has coordinates^{1}

x_{3} = (\frac{y_{2} − y_{1}}{x_{2} − x_{1}} )^{2} − x_{1} − x_{2}, y_{3} = \frac{y_{2} − y_{1}}{x_{2} − x_{1}} x_{3} − \frac{y_{2}x_{1} − y_{1}x_{2}}{x_{2} − x_{1}} .

Thus, given two points on E, we can find another. Also, given a single point, we can draw the tangent line to E through that point and obtain a third point.

3.1 To Infinity!

At first glance, the above construction doesn’t work if x_{1} = x_{2}. [draw picture]. Fortunately, there is a natural sense in which the graph of E is missing one point, and when x_{1} = x_{2} this one missing point is the third point of intersection.

The graph of E that we drew above is a graph in the plan ℝ^{2}. The plane is a subset of the projective plane ℙ^{2}, which I will define in just a moment. The closure of the graph of y^{2} = x^{3} + ax + b in ℙ^{2} has exactly one extra point, which has rational coordinates, and which we denote by ∞. Formally, ℙ^{2} can be viewed as the set of triples (a, b, c) with a, b, c not all 0 modulo the equivalence relation

(a, b, c) ∼ (λa, λb, λc)

for any nonzero λ. Denote by (a : b : c) the equivalence class of (a, b, c). The closure of the graph of y^{2} = x^{3} + ax + b is the graph of y^{2}z = x^{3} + axz^{2} + bz^{3} and the extra point ∞ is (0 : 1 : 0).

Venerable Problem: Find an algorithm that, given an elliptic curve E over ℚ, outputs a complete description of the set of rational points (x_{0}, y_{0}) on E.

This problem is difficult. In fact, so far it has stumped everyone! There is a conjectural algorithm, but nobody has succeeded in proving that it is really an algorithm, in the sense that it terminates for any input curve E. Several of your profs at Harvard, including Barry Mazur, myself, and Christophe Cornut (who will teach Math 129 next semester) have spent, or will probably spend, a huge chunk of their life thinking about this problem. (Am I being overly pessimistic?)

How could one possible “describe” the set of rational points on E in the first place? In 1923, Louis Mordell proved an amazing theorem, which implies that there is a reasonable way to describe the rational points on E. To state his theorem, we introduce the “group law” on E.

1It is traditional in a course like ours for me to derive these formulas. I’m not going to, because it’s simple algebra and once you see the geometric picture it is easy to carry out. You should do this as an exercise, or read the derivation in [Kato et al.] or [Davenport].

4 The Group Law

Consider the set E(ℚ) = {∞} ∪ {(x_{0}, y_{0}) : y_{0}^{2} = x_{0}^{3} + ax_{0} + b}. There is a natural way to endow the set E(ℚ) with a group structure. Here’s how it works. First, the element ∞ ∈ E(ℚ) is the 0 element of the group. Next, suppose P and Q are elements of E(ℚ). Just like we did earlier, draw the line through P and Q and let R = (x_{3}, y_{3}) be the third point of intersection. Define P + Q = (x_{3}, −y_{3}). There are various special cases to consider, such as when P = Q or the third point of intersection is ∞, but I will let your read about them in [Kato et al.]. It is clear that this binary operation on E(ℚ) satisfies P + Q = Q + P. Also, the inverse of P = (x_{1}, y_{1}) is −P = (x_{1}, −y_{1}). The only other axiom to check in order to verify that + gives E(ℚ) an abelian group structure is the associative law. This is simple but very tedious to check using only elementary methods^{2}. Fortunately, we can coerce the computer algebra system MAGMA into verifying the associative law for us:

// The field K = Q(a,b,x0,x1,x2)
K<a,b,x0,x1,x2> := FieldOfFractions(PolynomialRing(Rationals(),5));
// The polynomial ring R = K[y0,y1,y2]
R<y0,y1,y2> := PolynomialRing(K,3);
// A maximal ideal of R.
I := ideal<R | y0^2 - (x0^3+a*x0+b), y1^2 - (x1^3+a*x1+b), y2^2-(x2^3+a*x2+b)>;
// The field L contains three distinct "generic" points on E.
L  := quo<R|I>;
E  := EllipticCurve([L| a,b]);  // The elliptic curve y^2 = x^3 + a*x + b.
P0 := E![L|x0,y0]; P1 := E![L|x1,y1]; P2 := E![L|x2,y2];
lhs := (P0 + P1) + P2;  rhs := P0 + (P1 + P2);
lhs eq rhs;
true     // yeah!

5 Mordell’s Theorem

Theorem 5.1 (Mordell). The group E(ℚ) is finitely generated.

This means that there are points P_{1}, …, P_{r} ∈ E(ℚ) such that every element of E(ℚ) is of the form n_{1}P_{1} +⋯+n_{r}P_{r} for some n_{1}, … n_{r} ∈ ℤ. I won’t prove Mordell’s theorem in this course. You can find an elementary proof of most of it in §1.3 of [Kato et al.].^{3}

Example 5.2. Consider the elliptic curve E given by y^{2} = x^{3} +x+1. Then E(ℚ) ≈ ℤ with generator (0, 1). We have 2(0, 1) = (−1/4, −9/8), 3(0, 1) = (72, 611), and 4(0, 1) = (−\frac{287}{1296}, \frac{40879}{46656}).

2The right way to prove that the associate law holds is to develop the theory of algebraic curves and define the group law in terms of divisors; this is way outside the scope of this course.

3Matt Baker is teaching a graduate course (255r) this semester, and he is just about to present a proof of Weil’s generalization of Mordell’s theorem.