Introduction to Elliptic Curves and Modular Forms (Graduate Texts in Mathematics 97)

Neal Koblitz Introduction to Elliptic Curves and Modular Forms Springer-Veriag New York Berlin Heidelberg Tokyo- Ne...

Author: Neal Koblitz

231 downloads 1376 Views 11MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

Neal Koblitz

Introduction to Elliptic Curves and Modular Forms

Springer-Veriag New York Berlin Heidelberg Tokyo-

Neal Koblitz Department of Mathematics University of Washington Seattle, WA 98195 U.S.A.

Editorial Board P. R. Halmos

F. W. Gehring

C. C. Moore

Managing Editor Indiana University Department of Mathematics Bloomington, Indiana 47405 U.S.A.

University of Michigan Department of Mathematics Ann Arbor, Michigan 48109 U.S.A.

University of California Department of Mathematics Berkeley, California 94720 U.S.A.

AMS Subject Classifications: 10-01, 10D12, 10H08, 10H10, 12-01, 14H45 Library of Congress Cataloging in Publication Data Koblitz, Neal Introduction to elliptic curves and modular forms. (Graduate texts in mathematics; 97) Bibliography: p. Includes index. L Curves, Elliptic. 2. Forms, Modular. 3. Numbers. Theory of. I. Title. II. Series. 84.10517 516.3'5 QA567.1(63 1984 With 24 Illustrations

©

1984 by Springer-Verlag New York Inc. All rights reserved. No part of this book may be translated or reproduced in any form without written permission from Springer-Verlag, 175 Fifth Avenue, New York, New York 10010, U.S.A. Typeset by Asco Trade Typesetting Ltd., Hong Kong. Printed and bound by R. R. Donnelley & Sons, Harrisonburg, Virginia. Printed in the United States of America. 987654321 ISBN 0-387-96029-5 Springer-Verlag New York Berlin Heidelberg Tokyo ISBN 3-540-96029-5 Springer-Verlag Berlin Heidelberg New York Tokyo

Preface

This textbook covers the basic properties of elliptic curves and modular forms, with emphasis on certain connections with number theory. The ancient "congruent number problem" is the central motivating example for most of the book. My purpose is to make the subject accessible to those who find it hard to read more advanced or more algebraically oriented treatments. At the sanie time I want to introduce topics which are at the forefront of current research. Down-to-earth examples are given in the text and exercises, with the aim of making the material readable and interesting to mathematicians in fields far removed from the subject of the book. With numerous exercises (and answers) included, the textbook is also intended for graduate students who have completed the standard first-year courses in real and complex analysis and algebra. Such students would learn applications of techniques from those courses, thereby solidifying their understanding of some basic tools used throughout mathematics. Graduate students wanting to work in number theory or algebraic geometry would get a motivational, example-oriented introduction. In addition, advanced undergraduates could use the book for independent study projects, senior theses, , and seminar work. This book grew out of lecture notes for a course I gave at the University of Washington in 1981-1982, and from a series of lectures at the Hanoi Mathematical Institute in April, 1983. I would like to thank the auditors of both courses for their interest and suggestions. My special gratitude is due to Gary Nelson for his thorough reading of the manuscript and his detailed comments and corrections. I would also like to thank Professors J. Buhler, B. Mazur, B. H. Gross, and Huynh Mui for their interest, advice and encouragement.

vi

Preface

The frontispiece was drawn by Professor A. T. Fomenko of Moscow State University to illustrate the theme of this book. It depicts the family of elliptic curves (tori) that arises in the congruent number problem. The'elliptic curve corresponding to a natural number n has branch points at 0, co, n and —n. In the drawing we see how the elliptic curves interlock and deform as the branch points + n go to infinity. Note: References are given in the form [Author year]; in case of multiple

works by the same author in the same year, we use a, b, ... after the date to indicate the order in which they are listed in the Bibliography.

Seattle, Washington

NEAL KOBLITZ

Contents

CHAPTER I

From Congruent Numbers to Elliptic Curves 1. 2. 3. 4. 5. 6. 7. 8. 9.

Congruent numbers A certain cubic equation Elliptic curves Doubly periodic functions The field of elliptic functions Elliptic curves in Weierstrass form The addition law Points of finite order Points over finite fields, and the congruent number problem

I 3 6 9 14 18 22 29 36 43

CHAPTER II

The Hasse—Weil L-Function of an Elliptic Curve

51

1. 2. 3. 4. 5. 6.

51 56 64 70 79 90

The congruence zeta-function The zeta-function of En Varying the prime p The prototype: the Riemann zeta-function The Hasse—Weil L-function and its functional equation The critical value

CHAPTER III

Modular forms 1. SL 2(7L) and its congruence subgroups 2. Modular forms for SL 2(Z)

98 98 108

viii 3. Modular forms for congruence subgroups 4. Transformation formula for the theta-function 5. The modular interpretation, and Hecke operators

Contents

124 147 153

CHAPTER IV

Modular Forms of Half Integer Weight

176

1. 2. 3. 4.

177

Definitions and examples Eisenstein series of half integer weight for r0(4) Hecke operators on forms of half integer weight The theorems of Shim ura, Waldspurger, Tunnel!, and the congruent number problem

185 202

212

Answers, Hints, and References for Selected Exercises

223

Bibliography

240

Index

245

CHAPTER .J

From Congruent Numbers to Elliptic Curves

The theory of elliptic curves and modular forms is one subject where the most diverse branches of mathematics come together: complex analysis, algebraic geometry, representation theory, number theory. While our point of view will be number theoretic, we shall find ourselves using the type of techniques that one learns in basic courses in complex variables, real variables, and algebra. A well-known feature of number theory is the abundance of conjectures and theorems whose statements are accessible to high school students but whose proofs either are unknown or, in some cases, are the culmination of decades of research using some of the most powerful tools of twentieth century mathematics. We shall motivate our choice of topics by one such theorem: an elegant characterization of so-called "congruent numbers" that was recently proved by J. Tunnell [Tunnel! 1983]. A few of the proofs of necessary results go beyond our scope, but many of the ingredients in the proof of Tunnell's theorem will be developed in complete detail. Tunnell's theorem gives an almost complete answer to an ancient problem: find a simple test to determine whether or not a given integer n is the area of some right triangle all of whose sides are rational numbers. A natural number n is called "congruent" if there exists a right triangle with all three sides rational and area n. For example, 6 is' the area of the 3-4-5 right triangle, and so is a congruent number. Right triangles whose sides are integers X, Y, Z (a "Pythagorean triple") were studied in ancient Greece by Pythagoras, Euclid, Diophantus, and others. Their central discovery was that there is an easy way to generate all such triangles. Namely, take any two positive integers a and h with a > h, draw the line in the uv-plane through the point ( 1, 0) with slope bla. Let (u, y) be the second point of intersection of this line with the unit circle (see Fig. I.1). It is not hard to show that

1.

2

From Congruent Numbers to Elliptic Curves

%

Figure IA

u=

a2 — b 2 a2 + b2'

2ab v = 2 + b2. a

Then the integers X = a 2 b 2 , Y = 2ab, Z = a2 + b 2 are the sides of a right triangle; the fact that X 2 + /72 = Z 2 follows because u2 + y2 = 1. By letting a and b range through all positive integers with a > b, one gets all possible Pythagorean triples (see Problem 1 below). Although the problem of studying numbers n which occur as areas of rational right triangles was of interest to the Greeks in special cases, it seems that the congruent number problem was first discussed systematically by Arab scholars of the tenth century. (For a detailed history of the problem of determining which numbers are "congruent", see [L. E. Dickson 1952, Ch. XVI] ; see also [Guy 1981, Section D27].) The Arab investigators preferred to rephrase the problem in the following equivalent form : given n, can one find a rational number x such that x2 ± n and x2 — n are both squares of rational numbers? (The equivalence of these two forms of the congruent number problem was known to the Greeks and to the Arabs; for a proof of this elementary fact, see Proposition 1 below.) Since that time, some well-known mathematicians have devoted considerable energy to special cases of the congruent number problem. For example, Euler was the first to show that n =7 is a congruent number. Fermat showed that n=1 is not; this result is essentially equivalent to Fermat's Last Theorem for the exponent 4 (i.e., the fact that r + y4 = z4 has no nontrivial integer solutions). It eventually became known that the numbers 1, 2, 3, 4 are not congruent numbers, but 5, 6, 7 are. However, it looked hopeless to find a straightforward criterion to tell whether or not a given n is congruent. A major advance in the twentieth century was to place this problem in the context of the arithmetic theory of elliptic curves. It was in this context that Tunnell was able to prove his remarkable theorem. —

§1. Congruent numbers

3

Here is part of what Tunnell's theorem says (the full statement will be given later):

Theorem (Tunnel». Let n be an odd squarefree natural number. Consider the

two conditions: (A) n is congruent; (B) the number of triples of integers (x, y, z) satisfying 2x2 + y 2 + 8z2 = n is equal to twice the number of triples satisfying 2x 2 + y 2 + 32z 2 z-----. n. Then (A) implies (B); and, iJ. a weak form of the so-called Birch–SwinnertonDyer conjecture is true, then (B) also implies (A). The central concepts in the proof of Tunnell's theorem the Hasse–Weil L-function of an elliptic curve, the Birch–Swinnerton-Dyer conjecture, modular forms of half integer weight—will be discussed in later chapters. Our concern in this chapter will be to establish the connection between congruent numbers and a certain family of elliptic curves, in the process giving the definition and some basic properties of elliptic curves.

§1. Congruent numbers Let us first make a more general definition of a congruent number. A positive rational number r e 0 is called a "congruent number" if it is the area of some right triangle with rational sides. Suppose r is congruent, and X, Y, Z e CI are the sides of a triangle with area r. For any nonzero r Ea we can find some SE Qa such that s'r is a squarefree integer. But the triangle with sides sX, sY, sZ has area s2r. Thus, without loss of generality we may assume that r = n is a squarefree natural number. Expressed in group language, we can say that whether or not a number r in the multiplicative group 0 + of positive rational numbers has the congruent property depends only on its coset modulo. the subgroup (0 + ) 2 consisting of the squares of rational numbers; and each coset in 0 + /(0 + ) 2 contains a unique squarefree natural number r = n. In what follows, when speaking of congruent numbers, we shall always assume that the number is a squarefree positive integer. Notice that the definition of a congruent number does not require the sides of the triangle to be integral, only rational. While n = 6 is the smallest possible area of a right triangle with integer sides, one can find right triangles with rational sides having area n = 5. The right triangle with sides l. 6i, 6-.) is such a triangle (see Fig. 1.2). It turns out that n = 5 is the smallest congruent number (recall that we are using "congruent number" to mean "congruent squarefree natural number"). There is a simple algorithm using Pythagorean triples (see the problems below) that will eventually list all congruent numbers. Unfortunately, given

4

1.

From Congruent Numbers to Elliptic Curves

■Pm..... ■••••=11■

6-23 Figure 1.2

n, one cannot tell how long one must wait to get n if it is congruent; thus, if n has not appeared we do not know whether this means that n is not a congruent number or that we have simply not waited long enough. From a practical point of view, the beauty of Tunnell's theorem is that his condition (B) can be easily and rapidly verified by an effective algorithm. Thus, his theorem almost settles the congruent number problem, i.e., the problem of finding a verifiable criterion for whether a given n is congruent. We must say "almost settles" because in one direction the criterion is only known to work in all cases if one assumes a conjecture about elliptic curves. Now suppose that X, Y, Z are the sides of a right triangle with area n. This means: X 2 + Y2 = Z 2, and -1-XY = n. Thus, algebraically speaking, the condition that n be a congruent number says that these two equations have a simultaneous solution X, Y, ZE Q. In the proposition that follows, we derive an alternate condition for n to be a congruent number. In listing triangles with sides X, Y, Z, we shall not want to list X, Y, Z and Y, X, Z separately. So for now let us fix the ordering by requiring that X < Y < Z (Z is the hypotenuse).

Proposition 1. Let n be a fixed squarefree positive integer. Let X, Y, Z, x always denote rational numbers, with X < Y < Z. There is a one-to-one correspondence between right triangles with legs X and Y, hypotenuse Z, and area n; and numbers x for which x, x + n, and x n are each the square of a rational number. The correspondence is:

x = (Z/2) 2

X, I;

x

X. =

+n

\Ix

n,

‘Ix + n + \lx n,

In particular, n is a congruent number if and only if there exists x such that x, x + n, and x n are squares of rational numbers.

First suppose that X, Y, Z is a triple with the desired properties: X 2 ± y2 = Z 2 , 1XY = n. If we add or subtract four times the second equation from the first, we obtain: (X + Y) 2 = Z 2 ± 4n. If we then divide both sides by four, we see that x = (Z/2) 2 has the property that the numbers x + n are the squares of (X + 37)/2. Conversely, given x with the desired properties, it is easy to see that the three positive rational numbers X < Y < Z given by the formulas in the proposition satisfy: XY = 2n, and X2 + Y 2 = 4x = Z 2 . Finally, to establish the one-to-one correspondence, it only remains PROOF.

5

§1. Congruent numbers

to verify that no two distinct triples X, Y, Z can lead to the same x. We leave 0 this to the reader (see the problems below). PROBLEMS

I. Recall that a Pythagorean triple is a solution (X, Y, Z) in positive integers to the equation X 2 + Y 2 == Z 2 . It is called "primitive" if X, Y, Z have no common factor. Suppose that a > b are two relatively prime positive integers, not both odd. Show that X z--- a2 b2, Y = 2ab, Z =-- a2 + b$2 form a primitive Pythagorean triple, and that all primitive Pythagorean triples are obtained in this way. —

2. Use Problem 1 to write a flowchart for an algorithm that lists all squarefree congruent numbers (of course, not in increasing order). List the first twelve distinct congruent numbers your algorithm gives. Note that there is no way of knowing when a given congruent number n will appear in the list. For example, 101 is a congruent number, but the first Pythagorean triple which leads to an area 3-2 101 involves twenty-two-digit numbers (see [Guy 1981, p. 106]). One hundred fifty-seven is even worse (see Fig. 1.3). One cannot use this algorithm to establish that some n is not a congruent number. Technically, it is not a real algorithm, only a "semialgorithm". 3. (a) Show that if I were a congruent number, then the equation x4 y4 =.-- u2 would have an integer solution with u odd. (b) Prove that 1 is not a congruent number. (Note: A consequence is Fermat's Last Theorem for the exponent 4.) —

4. Finish the proof of Proposition 1 by showing that no two triples X, Y, Z can lead to the same x. 5. (a) Find xe(Cr) 2 such that x + 5(D -F. )2 • (b) Find xe(Cr) 2 such that x + 6e(O+) 2 . 224403517704336969924557513090674863160948472041 8912332268928859588025535178967163570016480830

6803298487826435051217540 411340519227716149383203

411340519227716149383203 21666555693714761309610

Figure 1.3. The Simplest Rational Right Triangle with Area 157 (computed by D. Zagier).

1.

6

From Congruent Numbers to Elliptic Curves

(c) Find two values x E (0 + ) 2 such that x + 210 E (0 + )2 . At the end of this chapter we shall prove that if there is one such x, then there are infinitely many. Equivalently (by Proposition 1), if there exists one right triangle with rational sides and area n, then there exist infinitely many. 6. (a) Show that condition (B) in Tunnell's theorem is equivalent to the condition that the number of ways n can be written in the form 2x 2 + y 2 + 8z2 with x, y, z integers and z odd, be equal to the number of ways n can be written in this form with z even. (b) Write a flowchart for an algorithm that tests condition (B) in Tunnell's theorem for a given n. 7. (a) Prove that condition (B) in Tunnell's theorem always holds if n is congruent to 5 or 7 modulo 8. (b) Check condition (B) for all squarefree nE.7. 1 or 3 (mod 8) until you find such an n for which condition (B) holds. (c) By Tunnell's theorem, the number you found in part (b) should be the smallest congruent number congruent to 1 or 3 modulo 8. Use the algorithm in Problem 2 to find a right triangle with rational sides and area equal to the number you found in part (b).

§2. A certain cubic equation In this section we find yet another equivalent characterization of congruent numbers. In the proof of Proposition 1 in the last section, we arrived at the equations ((X + Y)/2) 2 = (Z/2) 2 + n whenever X, Y, Z are the sides of a triangle with area n. If we multiply together these two equations, we obtain ((X 2 - Y 2)/4) 2 = (Z/2)4 — n2 . This shows that the equation 0 n2 = y2 has a rational solution, namely, u = Z/2 and v = (X 2 - Y 2)/4. We next multiply through by u2 to obtain u6 n 2u2 = (uv) 2 . If we set x = u2 = (Z/2) 2 (this is the same X as in Proposition 1) and further set y = uv = (X 2 — Y 2)Z/8, then we have a pair of rational numbers (x, y) satisfying the cubic equation: y 2 = x 3 _ n 2x. —

—

Thus, given a right triangle with rational sides X, Y, Z and area n, we obtain a point (x, y) in the xy-plane having rational coordinates and lying on the curve y2 = x3 — n2 x . Conversely, can we say that any point (x, y) with x, y e Q which lies on the cubic curve must necessarily come from such a right triangle? Obviously not, because in the first place the x-coordinate X = /4 2 = (742) 2 must lie in (0 + ) 2 if the point (x, y) can be obtained as in the last paragraph. In the second place, we can see that the x-coordinate of such a point must have its denominator divisible by 2. To see this, notice that the triangle X, Y, Z can be obtained starting with a primitive Pythagorean triple X', Y', Z' corresponding to a right triangle with integral sides X', Y', Z' and area s2n, and then dividing the sides by s to get X, Y, Z. But in a primitive

7

§2. A certain cubic equation

Pythagorean triple X' and Y' have different parity, and Z' is odd. We conclude that (1) x = (Z 12) 2 = (Z72s) 2 has denominator divisible by 2 and (2) the power of 2 dividing the denominator of Z is equal to the power of 2 dividing the denominator of one of the other two sides, while a strictly lower power of 2 divides the denominator of the third side. (For example, in the triangle in Fig. 1.2 with area 5, the hypotenuse and the shorter side have a 2 in the denominator, while the other leg does not.) We conclude that a necessary condition for the point (x, y) with rational coordinates on the curve y 2 =.-x 3 — n 2x to come from a right triangle is that x be a square and that its denominator be divisible by 2. For example, when n = 31, the point (41 2 /7 2 , 29520/7 3) on the curve y2 = x 3 — 31 2x does not come from a triangle, even though its x-coordinate is a square. We next prove that these two conditions are sufficient for a point on the curve to come from a triangle.

Proposition 2. Let (x, y) be a point with rational coordinates on the curve

y 2 = X.3 -4- n2x. Suppose that x satisfies the two conditions: (0 it is the square of a rational number and (ii) its denominator is even. Then there exists a right triangle with rational sides and arean which corresponds to x under the correspondence in Proposition 1. PROOF. Let u x e CD + . We work backwards through the sequence of steps at the beginning of this section. That is, set y = ylu, so that y 2 = y 2lx= .x 2 _ n 2 , i .e., v 2 ± n 2 = x2. Now let t be the denominator of u, i.e., the smallest positive integer such that tueZ. By assumption, t is even. Notice that the denominators of y2 and x2 are the same (because n is an integer, and y2 + n 2 = x2), and this denominator is t 4 Thus, t2y, t2n, 1 2x is a primitive Pythagorean triple, with 1 2n even. By Problem 1 of §1, there exist integers a and b such that: t2n = 2ab, 1 2 v = a 2 ..._ b2 , t 2x = a2 + b2. Then the right triangle with sides 2a11,2b1t, 2u has area 2ablt2 =---- n, as desired. The image of this triangle X = 2a/t, Y = 2b/t, Z = 2u under the correspondence in Proposition 1 is x = (Z/2) 2 2--- u2 . This proves Proposition 2. a •

We shall later prove another characterization of the points P = (x, y) on the curve y2 = x 3 — n2x which correspond to rational right triangles of area n. Namely, they are the points P = (x, y) which are "twice" a rational point P' = (x', y'). That is, P' + P' -7-- P, where " + " is an addition law for points on our curve, which we shall defin.e later. PROBLEMS ,

I. Find a simple linear change of variables that gives a one-to-one correspondence between points on ny2 = x3 + ax2 + bx + c and points on y2 =-- x 3 + anx 2 + bn2 x + cn3 . For example, an alternate form of the equation y2 = x3 -- n 2 x is the equation ny2 = x3 x. —

2. Another correspondence between rational right iriangles X, Y, Z with area 1-X Y = n and rational solutions to 372 = x' — tex can be constructed as follows.

t. From Congruent Numbers to Elliptic Curves

8

Figure 1.4 (a) Parametrize all right triangles by letting the point u = X/Z, y = YIZ on the unit circle correspond to the slope t of the line joining (— 1, 0) to this point (see Fig. 1.4). Show that

u=

(b) (c) (d)

(e)

1

1 + 1 21

v=

2s 1 + 1 2.

(Note: This is the usual way to parametrize a conic. 1f t = alb is rational, then the point (u, y) corresponds to the Pythagorean triple constructed by the method at the beginning of the chapter.) 1f we want the triangle X, Y, Z to have area n, express nIZ 2 in terms of t. Show that the point x = —nt, y = n2 (1 + t 2)IZ is on the curve y2 = x3 — n2 x. Express (x, y) in terms of X, Y, Z. Conversely, show that any point (x, y) on the curve y2 x3 — n2 x with y 0 0 comes from a triangle, except that to get points with positive x, we must allow triangles with negative X and Y (but positive area IX Y = n), and to get points with negative y we must allow negative Z (see Fig. 1.5). Later in this chapter we shall show the connection between this correspondence and the one given in the text above. Find the points on y2 = x3 — 36x coming from the 3-4-5 right triangle and all equivalent triangles (4-3-5, — 3)—(— 4)-5, etc.).

3. Generalize the congruent number prOblem as follows. Fix an angle 0 not necessarily 90°. But suppose that A = cos 0 and B = sin 0 are both rational. Let n be a squarefree natural number. One can then ask whether n is the area of any triangle with rational sides one of whose angles is O. (a) Show that the answer to this question is equivalent to a question about rational solutions to a certain cubic equation (whose coefficients depend on 0 as well as n). (b) Suppose that the line joining the point ( — 1, 0) to the point (A, B) on the unit circle has slope 1. Show that the cubic in part (a) is equivalent (by a linear change of variables) to the cubic ny2 = x(x À.)(x (1/.1)). The classical congruent number problem is, of course, the case 2= 1.

9

§3. Elliptic curves

Figure 1.5

§3. Elliptic curves The locus of points P = (x, y) satisfying y2 ----= x' — n2x is a special case of what's called an "elliptic curve". More generally, let K be any field, and let f(x)e K[x] be a cubic polynomial with coefficients in K which has distinct roots (perhaps in some extension of K). We shall suppose that K does not have characteristic 2. Then the solutions to the equation

(3.1) Y2 = f(x), where x and y are in some extension K' of K, are called the K' -points of the elliptic curve defined by (3.1). We have just been dealing with the example K = K' = Q, _fix) = x3 — n2 x. Note that this example y2 = x3 — n' x satisfies the condition for an elliptic curve over any field K of characteristic p, as long as p does not divide 2n, since the three roots 0, +n off(x) = x 3 — n2 x are then distinct. In general, if xo , yo e K' are the coordinates of a point on a curve C defined by an equation F(x, y) = 0, we say that C is "smooth" at (xo , yo) if the two partial derivatives OFfax and aF/ay are not both zero at (xo , ye). This is the definition regardless of the ground fi eld (the partial derivative of a polynomial F(x, y) is defined by the usual formula, which makes sense over any field). If K' is the field III of real numbers, this agrees with the usual condition for C to have a tangent line. In the case F(x, y) = y 2 — fix), the partial derivatives are 2yo and —f ' (x0). Since K' is not a field of characteristic 2, these vanish simultaneously if and only if yo = 0 and xo is a multiple root of fix). Thus, the curve has a non-smooth point if and only if j(x) has a multiple root. It is for this reason that we assumed distinct roots in the definition of an elliptic curve: an elliptie.curve is smooth at all of its points.

10

1. From Congruent Numbers to Elliptic Curves

In addition to the points (x, y) on an elliptic curve (3.1), there is a very important "point at infinity" that we would like to consider as being on the curve, much as in complex variable theory in addition to the points on the complex plane one throws in a point at infinity, thereby forming the "Riemann sphere". To do this precisely, we now introduce projective coordinates. By the "total degree" of a monomial xiyi we mean i + j. By the "total degree" of a polynomial Rx, y) we mean the maximum total degree of the monomials that occur with nonzero coefficients. If F(x, y) has total degree n, we de fi ne the corresponding homogeneous polynomial P(x, y, z) of three variables to be what you get by multiplying each monomial xi yi in F(x, y) to bring its total degree in the variables x, y, z up to n; in other by words,

Ax, y, z)

zz

± In our example F(x, y) = 3,2 — (x 3 — x), we have P(x, y, z) = y 2 z n2 xz 2 . Notice that F(x, y) = P(x, y, 1). - oefficients in a field K, and we are Suppose that our polynomials have C interested in triples x, y, Z G K such that Ax, y, z) = O. Notice that: (1) for any 2e K, P(Ax, Ay, Az) = AnP(x, y, z) (n = total degree of F); (2) for any nonzero i. K, P(2x, ) y, Az) = 0 if and only if P(x, y, z) = O. In particular, for z 0 we have F.(x, y, z) = 0 if and only if F(xlz, yiz) = O. Because of (2), it is natural to look at equivalence classes of triples x, y, z c K, where we say that two triples (x, y, z) and (x', y', z') are equivalent if there exists a nonzero Ae K such that (x', y', z') = A(x, y, z). We omit the trivial triple (0, 0, 0), and then we define the "projective plane Pi" to be the set of all equivalence classes of nonirivial triples. No normal person likes to think in terms of "equivalence classes", and fortunately there are more visual ways to think of the projective plane. Suppose that K is the field fl of real numbers. Then the triples (x, y, z) in an equivalence class all correspond to points in three-dimensional Euclidean space lying on a line through the origin. Thus, P oi can be thought of geometrically as the set of lines through the origin in three-dimensional space. Another way to visualize P oi is to place a plane at a distance from the origin in three-dimensional space, for example, take the plane parallel to the xy-plane and at a distance 1 from it, i.e., the plane with equation z = 1. All lines through the origin, except for those lying in the xy-plane, have a unique point of intersection with this plane. That is, every equivalence class of triples (x, y, z) with nonzero z-coordinate has a unique triple of the form (x, y, 1). So we think of such equivalence classes as points in the ordinary xy-plane. The remaining triples, those of the form (x, y, 0), make up the "line at infinity". The line at infinity, in turn, can be visualized as an ordinary line (say,

§3. Elliptic curves

11

the line y = I in the xy-plane) consisting of the equivalence classes with nonzero y-coordinate and hence containing a unique triple of the form (x, 1, 0), together with a single "point at infinity" (I, 0, 0). That is, we define the projective line Plc over a fi eld K to be the set of equivalence classes of pairs (x, y) with (x, y) ,s, ( ) x, 4). Then Pi-can be thought of as an ordinary plane (x, y, 1) together with a projective line at infinity, which, in turn, consists of an ordinary line (x, I, 0) together with its point at infinity (1, 0, 0). More generally, n-dimensional projective space [PI is defined using equivalence classes of (n + 1)-tuples, and ' can be visualized as the usual space of n-tuples (x 1 , . . . , xn, 1) together With a P' at infinity. But we shall only have need of Pic and P. Given a homogeneous polynomial P(x, y, z) with coefficients in K. we can look at the solution set consisting of points (x, y, z) in Pk (actually, equivalence classes of (x, y, z)) for which i(x, y, z) = O. The points of this solution set where z 0 0 are the points (x, y, 1) for which P(x, y, 1) = F(x, y) = O. The remaining points are on the line at infinity. The solution set of f(x, y, z) = 0 is called the "projective completion" of the curve F(x, y) = O. From now on, when we speak of a "line", a "conic section'', an "elliptic curve", etc., we shall usually be working in a projective plane Pi, in which case these terms will always denote the projective completion of the usual curve in the xy-plane. For example, the line y = 117X + h will really mean the solution set to y = mx + bz in Pk ; and the elliptic curve y 2 =--- x 3 — n 2 x will now mean the solution set to y 2 z = x 3 - 17 2 X2: 2 in P. Let us look more closely at our favorite example : F(x, y) = y 2 — .v 3 + 11 2 X , P(x, y, z) = y 2 z — x 3 + n2 xz 2 . The points at infinity on this elliptic curve are the equivalence classes (x, y, 0) such that 0 = P(x, y, 0) = — x 3 . i.e., X -=-- O. There is only one such equivalence class (0, 1, 0). Intuitively, if we take .K = 0'1, we can think of the curve y2 -L---- x 3 — n2 x heading off in an increasingly vertical direction as it approaches-the line at infinity (see Fig. 1.6). The points on the line at infinity correspond to the lines through the origin in the xy-plane, i.e., there is one for every possible slope yix of such a line. As we move far out along our elliptic curve, we approach slope y/x = co, corresponding to the single point (0, 1, 0) on the line at infinity. Notice that any elliptic curve y2 =f(x) similarly contains exactly one point at infinity (0, 1, 0). All of the usual concepts of calculus on curves F(x, y) = 0 in the xy-plane carry over to the corresponding projective curve Ax, y, z) = O. Such notions as the tangent line at a point, points of inflection, smooth and singular points all depend only upon what is happening in a neighborhood of the point in question. And any Point in PŒI has a large neighborhood which looks like an ordinary plane. More precisely, if we are interested in a point with nonzero z-coordinate, we can work in the usual xy-plane, where the curve has equation F(x, y) = P(x, y, 1) = 0. If we want to examine a point on the line z = 0, however, we put the triple in either the form (x, 1, 0) or (1, y, 0). In the former case, we think of it as a point on the curve F(x , 1, z) = 0

12

L From Congruent Numbers to Elliptic Curves

Figure 1.6

in the xz-plane; and in the latter case as a point on the curve F(1, y, z) = 0 in the yz-plane. For example, near the point at infinity (0, 1, 0) on the elliptic curve n2 xz' = O. )72 z x 3 ± n2 xz' , all points have the form (x, 1, z) with z The latter equation, in fact, gives us all points on the elliptic curve except for the three points (0, 0, 1), +n, 0, 1) having zero y-coordinate (these are the three "points at infinity" if we think in terms of xz-coordinates). PROBLEMS

Az) y, z] satisfies F(Ax, I . Prove that if k is an infinite field and F(x, y, Z)E F(x, y, z) for all 2, x, y, ZE K, then F is homogeneous, i.e., each monomial has total degree n. Give a counterexample if K is finite. 2. By a "line" in P we mean either the projective completion of a line in the xy-plane or the line at infinity. Show that a line in Pi has equation of the form ax + by + cz = 0, with a, b, ce K not all zero; and that two such equations determine the same line if and only if the two triples (a, b, e) differ by a multiple. Construct a 1-to -i correspondence between lines in a copy of Pi with coordinates (x, y, z) and points in another copy of Pi with coordinates (a, b, c) and between points in the xyz-projective plane and lines in the abc-projective plane, such that a bunch of points are on the same line in the first projective plane if and only if the lines that correspond to them in the second projective plane all meet in the same point. The xyz-projective plane and the abc-projective plane are called the "duals" of each other.

13

§3. Elliptic curves 3. How many points at infinity are on a parabola in N? an ellipse? a hyperbola?

4. Prove that any two nondegenerate conic sections in Pf, are equivalent to one another by some linear change of variables.

5. (a) If "(x, y, z)E K[X, y, z] is homogeneous of degree n, show that

a

afr- a

X - + y — + z— = 'Ir. az ax ay (b) If K has characteristic zero, show that a point (x, y, z)EP ii is a non-smooth point on the curve C: f(x, y, z) = 0 if and only if the triple (5i-70x, OPIey, aPlaz)is (0, 0, 0) at our particular (x, y, z). Give a counterexample if char K 0 O. In what follows, suppose that char K = 0, e.g., K = R. (c) Show that the tangent line to C at a smooth point (xo , y o , z o) has equation ax + by + cz = 0, where

(xo , yo , :0)

ay 1(x0 , yo . z o ) of-

,

(d) Prove that the condition that (x, y, z) be a smooth point on C does not depend upon the choice of coordinates, i.e., it does not change if we shift to x'y'z' coordinates, where (x' y' z') = (x y z)A with A an invertible 3 x 3 matrix. For example, if more than one of the coordinates are nonzero, it makes no difference which we choose to regard as the "z-coordinate", i.e., whether we look at C in the xy-plane, the xz-plane, or the yz-plane. (e) Prove that the condition that a given line I be tangent to C at a smooth point (x, y, z) does not depend upon the choice of coordinates. -

6. (a) Let P1 = (x 1 , Yi , z 1 ) and P2 = (X2 1 y2, z2) be two distinct points in Pi. Show that the line joining P1 and P2 can be given in parametrized form as sP, + tP2 , i.e., {(sx, + tx 2 , sy i + 1y2 , sz i + tz2)Is, t E K 1. Check that this linear map takes Pk (with coordinates s, t) bijectively onto the line P1 P2 in P. What part of the line do you get by taking s = 1 and letting t vary? (b) Suppose that K = R or C. If the curve F(x, y) = 0 in the xy-plane is smooth at pi = (x i , Yi) with nonvertical tangent line, then we can expand the implicit function y = f(x) in a Taylor series about x = x l . The linear term gives the tangent line. If we subtract off the linear term, we obtain f(x) — yi — f' (x 1 )(x — x 1 ) = a,,,(x — x1 )" + • • • , where a„, 0 0, m ..>. 2. m iscalled the "order of tangency". We say that (x / , Yi) is a point of in fl ection ifm > 2, i.e.,.f" (x 1 ) = O. (In the case K = [R, note that we are not requiring a change in concavity with this definition, e.g., y = x4 has a point of inflection at x = O.) Let P, = (x i , y 1 , z 1 ), z 1 # 0, and let / = P1 P2 be tangent to the curve F(x, y) = f(x, y, 1) at the smooth point P1 • Let P2 = (x2, y2 , z2). Show that in is the lowest power of f that occurs in P(x i + tx 2 , y 1 + ty 2 , z, + tz 2)e KN. (c) Show that m does not change if we make a linear change of variables in PZ . For example, suppose that Yi and z 1 are both nonzero, and we use the xz-plane instead of the xy-plane in parts (a) and (b). 7. Show that the line at infinity (with equation z =-- 0) is tangent to the elliptic curve y2 =f(x) at (0, 1, 0), and that the point (0, 1, 0) is a point of inflection on the curve.

14

1. From Congruent Numbers to Elliptic Curves

§4. Doubly periodic functions Let L be a lattice in the complex plane, by which we mean the set of all integral linear combinations of two given complex numbers w 1 and co 2 , where w 1 and w 2 do not lie on the same line through the origin. For example, if w i = i and w 2 = I, we get the lattice of Gaussian integers fini + n1m,, ne Z}. It will turn out that the example of the lattice of Gaussian integers is intimately related to the elliptic curves y2 = x3 — n2 x that come from the congruent number problem. The fundamental parallelogram for oh , w2 is defined as

= {aw l + 170) 2 10

a

1,O b

Since oh , (11 2 form a basis for C over R, any number x e C can be written in the form x = aw l + bw 2 for some a, bE R. Then x can be written as the sum of an element in the lattice L = { niw l + nw2 } and an element in II, and in only one way unless a or b happens to be an integer, i.e., the element of H happens to lie on the boundary an. We shall always take w 1 , w 2 in clockwise order; that is, we shall assume that o 1 /w 2 has positive imaginary part. Notice that the choice of w 1 , w 2 giving the lattice L is not unique. For example, (di = w 1 + w2 and w2 give the same lattice. More generally, we can obtain new bases al , ol2 for the lattice L by applying a matrix with integer entries and determinant I (see Problem l below). For a given lattice L, a meromorphic function on C is said to be an elliptic function relative to L iff(z + I) =J(z) for all I e L. Notice that it suffices to check this property for I = wi and / = w 2 . In other words, an elliptic function is periodic with two periods oh and co2 . Such a function is determined by its values on the fundamental parallelogram 11 ; and its values on opposite points of the boundary of H are the same, i.e., f(aco l + w2) = f(aw i ), f(w i + bw2) f(bw 2). Thus, we can think of an elliptic function f(z) as a function on the set ri with opposite sides glued together. This set (more precisely, "complex manifold") is known as a "torus". It looks like a donut. Doubly periodic functions on the complex numbers are directly analogous to singly periodic functions on the real numbers. A function f(x) on R which satisfies f(x nw) = f(x) is determined by its values on the interval [0, a]. Its values at 0 and w are the same, so it can be thought of as a function on the interval [0, co] with the endpoints glued together. The "real manifold" obtained by gluing the endpoints is simply a circle (see Fig. 1.7). Returning now to elliptic functions for a lattice L, we let ej denote the set of such functions. We imn) ,2(1 1v see that L is a subfield of the field of all meromorphic functions. • sum, difference, product, or quotient of two elliptic functions is elliptic. In addition, the subfield 6/, is closed under differentiation. We now prove a sequence of propositions giving some very special properties which any elliptic function must have. The condition that a meromorphic function be doubly periodic turns out to be much more

15

§4. Doubly periodic functions

o Figure 1.7

restrictive than the analogous condition in the real case. The set of realanalytic periodic functions with given period is much "larger" than the set 67i, of elliptic functions for a given period lattice L. Proposition 1 A function f(z)eeL , L = { rmo,. + no) 2 }, which has no pole in the fundamental parallelogram H must be a constant. PROOF. Since I-1 is compact, any such function must be bounded on H, say by a constant M. But then i f(z)i < M for all z, since the values of f(z) are determined by the values on fl. By Liouville's theorem, a meromorphic 0 function which is bounded on all of C must be a constant. Proposition 4. With the same notation as above, let a + H denote the translate

of ri by the complex number a, i.e., {a + zlze II}. Suppose that f(z)E 6, has no poles on the boundary C of a --I- IL Then the sum of the residues off(z) in a + fl is zero. PROOF.

By the residue theorem, this sum is equal to

1 — f f(z)dz. 21ri c But the integral over opposite sides cancel, since the values off(z) at corresponding points are the same, while dz has opposite signs, because the path of integration is in opposite directions on opposite sides (see Fig. 1.8). Thus, the integral is zero, and so the sum of residues is zero. o Notice that, since a meromorphic function can only have finitely many poles in a bounded region, it is always possible to choose an a such that the boundary of a + ri misses the poles of f(z). Also note that Proposition 4 immediately implies that a nonconstant f(z) e must have at least two poles (or a multiple pole), since if it had a single simple pole, then the sum of residues would not be zero.

e,

1.

16

From Congruent Numbers to Elliptic Curves

+

w2

Figure 1.8 Proposition 5. Under the conditions of Proposition 4, suppose that f(z) has no zeros or poles on the boundary of a + H. Let {m i} be the orders of the various m i = I rip zeros in a + n, and let {n i} be the orders of the various poles. Then

PROOF. Apply Proposition 4 to the elliptic function f ' (z)/f(z). Recall that the logarithmic derivative f ' (z)If(z) has a pole precisely where f(z) has a zero or pole, such a pole is simple, and the residue there is equal to the order of zero or pole of the original f(z) (negative if a pole). (Recall the argument: If + • •• , and so f (z) f(z) f(z) = c „i (z a)tm + • • - , then f ' (z) = cdn(z — = m(z ay' + • .) Thus, the sum of the residues off (z)lf(z) is I'm ni = O. We now define what will turn out to be a key example of an elliptic function relative to the lattice L = {nuo i + no)2 }. This function is called the Weierstrass p-function. It is denoted p(z; L) or (z; (0 1 , 0) 2) 1 or simply go(z) if the lattice is fixed throughout the discussion. We set

1 (z) = go(z; L) raz2

(4.1)

Proposition 6. The sum in (4.1) converges absolutely and uniformly for z in any compact subset of C — L. PROOF. The sum in question is taken over a two-dimensional lattice. The proof of convergence will be rather routine if we keep in mind a onedimensional analog. If instead of L we take the integers Z, and instead of reciprocal squares we take reciprocals, we obtain a real function f(x) = + E 1 17 + f, where the sum is over nonzero /€ Z. To prove absolute and uniform convergence in any compact subset of Z, first write the summand as x/(/(x — , and then use a comparison test, showing that the series in question basically has the same behavior as l. More precisely, use the following lemma: if Ili is a convergent sum of positive terms (all our sums being over nonzero /€ Z), and if Eff (x) has the property that 1 i(x)/b,1 approaches a finite limit as I + co, uniformly for x in some set, then the sum Ef(x) converges absolutely and uniformly for x in that set. The details

17

§4. Doubly periodic functions

are easy to fill in. (By the way, our particular example off(x) can be shown to be the function it cot nx; just take the logarithmic derivative of both sides of the infinite product for the sine function: sin nx t---- irx11 1 (1 —

.x21n 2).) The proof of Proposition 6 proceeds in the same way. First write the summand over a common denominator:

1 (z _

1 _ 2z — z 2// 02 /2 - (z _ 02/ •

Then show absolute and uniform convergence by comparison with 1/I', where the sum is taken over all nonzero /EL. More precisely, Proposition 6 will follow from the following two lemmas.

Lemma 1. If E bi is a convergent sum of positive terms, where the sum is taken over all nonzero elements in the lattice L, and if E f(z) has the property that I fi(z)11, 1 1 approaches a finite limit as ill --* co, uniformly for z in some subset of C, then the sum E J;(z) converges absolutely and uniformly for z in that set. Lemma

2. E Ili' converges if s> 2.

The proof of Lemma 1 is routine, and will be omitted. We give a sketch of the proof of Lemma 2. We split the sum into sums over / satisfying n — 1 1. o This concludes the proof of Proposition 6. Proposition

7. p (z) e 6L , and its only pole is a double pole at each lattice point.

PROOF. The same argument as in the proof of Proposition 6 shows that for any fixed /E L, the function ga(z) — (z — 0 -2 is continuous at z = I. Thus, so(z) is a meromorphic function with a double pole at all lattice points and no other poles. Next, note that i(z) = so (— z), because the right side of (4.1) remains unchanged if z is replaced by —z and / is replaced by —1; but summing over 1EL is the same as summing over —le L. To prove double periodicity, we look at the 'derivative. Differentiating (4.1) term-by-term, we obtain:

so'(z) = —2

E

1

IEL (Z - 1)

Now ia'(z) is obviously doubly periodic, since replacing z by z + 1 0 for some fixed /0 e L merely rearranges the terms in the sum. Thus, p`(z) E ei To prove that p(z)E61, it suffices to show that sg(z + co i ) — v(z) = 0 for i .---- 1, 2. We prove this for i = 1; the identical argument applies to i = 2. •

1.

18

From Congruent Numbers to Elliptic Curves

Since the derivative of the function p(z + w i ) — p(z) is 0'(z + co1) — p'(z) = 0, we must have p(z + co l ) — p(z) = C for some constant C. But substituting z z--- —1w 1 and using the fact that p(z) is an even function, we o conclude that C =--- p (j- w l ) — 0( —1(.0 1 ) =--- O. This concludes the proof. Notice that the double periodicity of gg (z) was not immediately obvious from the definition (4.1). Since 0(z) has exactly one double pole in a fundamental domain of the form a + 11, by Proposition 5 it has exactly two zeros there (or one double zero). The same is true of any elliptic function of the form 0(z) — u, where u is a constant. It is not hard to show (see the problems below) that p(z) takes every value u e C L) {co} exactly twice on the torus (i.e., a fundamental parallelogram with opposite sides glued together), counting multiplicity (which means the order of zero of p(z) — u); and that the values assumed with multiplicity two are co, e l d=ef p (co 1 1 2) , e2 ra. p (c o 2 / 2) , land e3 cref p((co l + co2)/2). Namely, p(z) has a double pole at 0, while the other three points are the zeros of p/(z).

§5. The field of elliptic functions Proposition 7 gives us a concrete example of an elliptic function. Just as sin x and cos x play a basic role in the theory of periodic functions on R, because of Fourier expansion, similarly the functions p(z) and p'(z) 'play a fundamental role in the study of elliptic functions. But unlike in the real case, we do not even need infinite series to express an arbitrary elliptic function in terms of these two basic ones. Proposition 8. SL = C(sg, 0), i.e., any elliptic function for L is a rational expression in p(z; L) and p'(z; L). More precisely, given f(z)E6L , there exist two rational functions g(X), h(X) such that f(z) = g(p(z)) +

PROOF. Iff(z) is an elliptic function for L, then so are the two even functions f(z) + f(—z)

2

. an d

f(z) — f(—z)

20'(z)

.

Since f(z) is equal to the first of these functions plus go' (z) times the second, to prove Proposition 8 it suffices to prove

Proposition 9. The subfield eL4- e.,, of even elliptic functions for L is generated by p(z), i.e., 61L+ = C(p). PROOF. The idea of the proof is to cook up a function which has the same zeros and poles as f(z) using only functions of the form p(z) — u with u a

constant.

19

§5. The field of elliptic functions

/* 0

il

Figure 1.9

The ratio off(z) to such a function is an elliptic function with no poles, and so must be a constant, by Proposition 3. We first list the zeros and poles off(z). But we must do this Let f(z) carefully, in a special way. Let 1-1 1 be a fundamental parallelogram with two sides removed: IT = {aw l + bco 2 10 a < 1, 0 b < } . Then every point in C differs by a lattice element from exactly one point in IT; that is, IV is a set of coset representatives for the additive group of complex numbers modulo the subgroup L. We will list zeros and poles in 1-1', omitting 0 from our list (even if it happens to be a zero or pole of f(z)). Each zero or pole will be listed as many times as its multiplicity. However, only "half" will be listed; that is, they will be arranged in pairs, with only one taken from each pair. We now give the details. We describe the method of listing zeros ; the method of listing poles is exactly analogous. First suppose that a e IT, a O 0, is a zero of f(z) which is not half of a lattice point, i.e., a o 0 1 12, (.0212, or (co + w 2)/2. Let a* e IT be the point "symmetric" to a, i.e., a* = co, + co 2 a if a is in the interior of If, while a* = (o a or a* = 2 a if a is on one of the two sides (see Fig. 1.9). If is a zero of order m, we claim that the symmetric point a* is also a zero of order m. This follows from the double periodicity and the evenness of f(z). Namely, we have f(a* — z) = f(— a — z) by double periodicity, and this is equal to f(a + z) becausef(z) is an even function. Thus, iff(a + z) = am zni + higher terms, it follows that f(a* + z) = an,( z)m + higher terms, i.e., a* is a zero of order m. Now suppose that a e iv is a zero of f(z) which is half of a lattice point; for example, suppose that a = w 1 /2. In this case we claim that the order of zero m is even. If f(a + z) = f(co:, + z) = ani zin + higher terms, then w z) = f(— + z) =Mc°, + z) by double periodicity and evenness. Thus, ainzm + higher terms = am ( z)m + higher terms, and so m is even. We are now ready to list the zeros and poles of f(z). Let lai l be a list of the zeros off(z) in IT which are not half-lattice points, each taken as many times as the multiplicity of zero there, but only one taken from each pair of symmetrical zeros a, a * ; in addition, if one of the three nonzero half-lattice points in rr is a zero of f(z), include it in the,list half as many times as its multiplicity. Let { bj } be a list of the nonzero poles of f(z) in IT, counted in —

—

—

—

—

—

the same way as the zeros (i.e., "only half" of them appear).

1.

20

From Congruent Numbers to Elliptic Curves

Since all of the ai and bi are nonzero, the values 0 (a) and 0 (bi) are finite, and it makes sense to define the elliptic function g (z) .=

n . (0(z) fa (ad) Iii(so(z) — —

We claim that g(z) has the same zeros and poles as f(z) (counting multiplicity), from which it will follow that f(z) = c - g(z) for some constant c. Since g(z) is a rational function of go (z), this will complete the proof. To prove this claim, we first examine nonzero points in HI. Since 0 is the only pole in the numerator or denominator of g(z), it follows that the so (a1), while the nonzero zeros of g(z) must come from the zeros of go (z) 0(9. But we nonzero poles of g(z) must come from the zeros of go (z) know (see problems below) that p(z) u (for constant u) has a double zero at z = u if u is a half-lattice point, and otherwise has a pair of simple zeros at u and the symmetric point u*. These are the only zeros of ga(z) u in H'. By our construction of the ai and bj, we see that g(z) and f(z) have the same order of zero or pole everywhere in ru, with the possible exception of the point 0. So it merely remains to show that they have the same order of zero or pole at O. But this will follow automatically by Proposition 5. Namely, choose a so that no lattice point and no zero or pole off(z) or g(z) is on the boundary of a + Il. Then a + H will contain precisely one lattice point 1. We know that f(z) and g(z) have the same orders of zeros and poles everywhere in a + H with the possible exception of 1. Let mf denote the order of zero off(z) at 1 (mf is negative if there is a pole), and let mg denote the analogous order for g(z). Then —

—

—

—

mf + (total of orders of zeros off )

—

(total of orders of poles off )

= mg + (total of orders of zeros of g)

—

(total of orders of poles of g).

Since the corresponding terms in parentheses on both sides of the equality are equal, we conclude that mf = mg . Thus, Proposition 5 tells us that when we know that two elliptic functions have the same order of zero or pole everywhere but possibly at one point in the fundamental parallelogram, then that one point is carried along automatically. This concludes the proof of Proposition 9. 0 The proof of Propositions 8 and 9 was constructive, i.e., it gives us a prescription for expressing a given elliptic function in terms of p(z) once we know its zeros and poles. Without doing any more work, for example, we can immediately conclude that:

(1) the even elliptic function 0' (z) 2 is a cubic polynomial in p (z) (because p'(z) has a triple pole at 0 and three simple zeros, hence there are three ai 's and no bj's); (2) the even elliptic function p (NO (for any fixed positive integer N) is a rational function in p(z).

21

§5. The field of elliptic functions

Both of these facts will play a fundamental role in what follows. The first tells us that the Weierstrass 0-function satisfies a differential equation of a very special type. This equation will give the connection with elliptic curves. The second fact is the starting point for studying points of finite order on elliptic curves. Both facts will be given a more precise form, and the connection with elliptic curves will be developed, in the sections that follow.

PROBLEMS 1. Prove that the lattice L = fatco i + mo 2 1 and the lattice L' = {raw', + n(o'-, are the same if and only if there is a 2 x 2 matrix A with integer entries and determinant + 1 such that co' = Act) (where co denotes the column vector with entries co l , 0) 2 ). If the pairsco l , t0 2 and oli , co'2 are each listed in clockwise order, show that det A =--

+1

.

2. Let C/L denote the quotient of the additive group of complex numbers by the subgroup L = {two,. + nco2 }. Then CIL is in one-to-one correspondence with the fundamental parallelogram El with opposite sides glued together. (a) Let C be the circle group (the unit circle in the complex plane). Give a continuous group isomorphism from C/L to the product of C with itself. (I)) How many points of order N or a divisor of N are there in the group CIL? (c) Show that the set of subgroups of prime order p in CIL is in one-to-one correspondence with the points of Onp (where Fi, = ZIpZ). How many are there?

3. Let s = 2, 3, 4, .. . . Fix a positive integer N, and let f: Z x Z ---* C be any function of period N, i.e., f(m + N, n) = ftm, n) and f(m, n + N) = f(m, n). Suppose that f(0, 0) = O. If s = 2, further suppose that EMI, n) = 0, where the sum is over 0 < m, n < N. Define a function f(m, n)

Om 1 + n(02)s (a) Prove that this sum converges absolutely if s> 2 and conditionally if s = 2 .,,,€z

(in the latter case, take the sum over m and n in nondecreasing order of Imco l + (b) Express Fs(co 1 , to 2) in terms of the values of (z; w 1 , (o-,) or a suitable derivative evaluated at values of z e 11 for which Nz € L (see Problem 2(b)).

4. Show that for any fixed u, the elliptic function p(z) — u has exactly two zeros (or a single double zero). Use the fact that p' (z) is odd to show that the zeros of 0 '(z) are precisely co 1 /2, (1)2/2, and (co l + 0) 2)/2, and that the values e l = 0(0 1 /2), e 2 = 0(°2/2), e3 = p((ca l + (.0 2 )/2) are the values of u for which p (z) — u has a double zero. Why do you know that e 1 ,e2 ,e3 are distinct? Thus, the Weierstrass 0-function gives a two-to-one map from the torus (the fundamental parallelogram fl with opposite sides glued together) to the Riemann sphere C k.) lac } except over the four "branch points" e l , e2 , e3 , co, each of which has a single preimage in C/L.

5. Using the proof of Proposition 9, without doing any computations, what can you say about how the second derivative 0 "(z) can be expressed in terms of p(z)?

1.

22

From Congruent Numbers to Elliptic Curves

§6. Elliptic curves in Weierstrass form As remarked at the end of the last section, from the proof of Proposition 9 we can immediately conclude that the square of go' (z) is equal to a cubic polynomial in go (z). More precisely, we know that p`(z) 2 has a double zero at co 1 /2, w 2 /2, and (w 1 + co2)12 (see Problem 4 of §5). Hence, these three numbers are the a i 's, and we have

= C(P(z) — 0 (w1/ 2))(k) (z) — 0 (0)2/2))(0(z) — Sto U 0) 1 + (0 2)/2))

= C(p(z) — e 1 )(0(z) — e 2)(p(z)— e 3), where C is some constant. It is easy to find C by comparing the coefficients of the lowest power of z in the Laurent expansion at the origin. Recall that p (z) — z -2 is continuous at the origin, as is o' (z) + 2z 3 . Thus, the leading term on the left is (-2z 3) 2 = 4z -6 , while on the right it is C(z 2) 3 =I Cz'. We conclude that C z----- 4. That is, p(z) satisfies the differential equation '(z ) 2

= f(p(z)),

where f(x) = 4(x — e i )(x — e 2)(x — e 3) E C[x]. (6.1)

Notice that the cubic polynomial f has distinct roots (see Problem 4 of §5). We now give another independent derivation of the differential equation for p(z) which uses only Proposition 3 from §4. Suppose that we can find a cubic polynomial fix) = ax3 + bx2 + cx + d such that the Laurent expansion at 0 of the elliptic function f(p(z)) agrees with the Laurent expansion of p'(z) 2 through the negative powers ofz. Then the difference pl(z) 2 —f(so(z)) would be an elliptic function with no pole at zero, or in fact anywhere else (since 0 (z) and ga'(z) have a pole only at zero). By Proposition 3, this difference is a constant; and if we suitably choose d, the constant term in f(x), we can make this constant zero. To carry out this plan, we must expand p(z) and p'(z) 2 near the origin. Since both are even functions, only even powers of z will appear. Let c be the minimum absolute value of nonzero lattice points 1. We shall take r < 1, and assume that z is in the disc of radius rc about the origin. For each nonzero leL, we expand the term corresponding to 1 in the definition (4.1) of p(z). We do this by differentiating the geometric series 1/(1 — x) = I + x + x2 + - - • and then substituting z11 for x:

z 1 z2 z3 =1-1-2-1-3-1-4—+ / /2 /3 (1 — z//)2

.

• •

If we now subtract 1 from both sides, divide both sides by / 2 , and then substitute in (4.1), we obtain

0 (z) = --i + L

/EL.

1* 0

7 k-

Z

E 2-:-., + 3 — + 4-- + L

• • • +

2

(k — i) b ik +...

23

§6. Elliptic curves in Weierstrass form

We claim that this double series is absolutely convergent for 1z1 < re, in which case the following reversal of the order of summation will be justified :

1 (z) = + 3G4 z 2 + 5G6 z4 + 7G8 z6 +

(6.2)

• • •

where for k> 2 we denote Gk = Gk(L) = Gk(C0i, (92) ci-ff

E r-k = E

/EL

t()

(6.3)

m.n

e 2 (MC° I -F MO 2 )k not both 0

(notice that the Gk are zero for odd k, since the term for I cancels the term for —/; as we expect, only even powers of z occur in the expansion (6.2)). To check the claim of absolute convergence of the double series, we write the sum of the absolute values of the terms in the inner sum in the form (recall: izi < di!):

( 3 4 21z1.I11 -3 . I + — r + 2

5 — r3 + 2

< )

2izi (1 — r) 2 1/1 3 '

and then use Lemma 2 from the proof of Proposition 6. We now use (6.2) to compute the first few terms in the expansions of (z), p ( 2) 2 , (z) 3 to' (z), and p'(z) 2 , as follows: go '(z) =

—

6G4Z

20G6Z 3 42G8Z5

---

'(z) 2 = — 24G4 12 — 80G6 + (36G1 168G8

): 2

(6.4) +•••

( 6.5)

(z) 2 = + 6G4 + 10G6 z 2 + ... •

(6.6)

(z) 3 = z--g + 9G4 -z-2-1+ 15G6 + (21G8 + 27 GI)z 2 + • • •

(6.7)

Recall that we are interested in finding coefficients a, b, c, d of a cubic f(x) = ax3 + bx2 + cx + d such that

pi(z) 2 = a (z) 3 + b p (z) 2. + c (z) + and we saw that it suffices to show that both sides agree in their expansion through the constant term. If we multiply equation (6.7) by a, equation (6.6) by b, equation (6.2) by c, and then add them all to the constant d, and finally equate the coefficients of z- 6 3 z -4 3 Z and the constant terni to the corresponding coefficients in (6.5), we obtain successively:

a = 4; Thus, c

b = 0;

—24G4 = 4(9G4 ) + c;

—80G6 = 4(1 5G(,) + d.

60G4 , d = —140G6 . It is traditional to denote

24

I.

From Congruent Numbers to Elliptic Curves

g2 = g2(1-) cr-ff 60G4 ------- 60

lE L 1* 0

- 140G6 = 140 g 3 = g3 (L) i--5

(6.8)

:eL

1*0

We have thereby derived a second form for the differential equation (6.1):

p'(z) 2 = f(p(z)),

where f(x) ----=- 4x 3 — g 2 x — g3 e C [x]. (6.9)

Notice that if we were to continue comparing coefficients of higher powers ofz in the expansion of both sides of (6.9), we would obtain relations between the various GI, (see Problems 4-5 below). The differential equation (6.9) has an elegant and basic geometric interpretation. Suppose that we take the function from the torus CIL (i.e., the fundamental parallelogram H with opposite sides glued) to PF defined by zi—+

(,(z), p'(z), 1)

for

z

o O;

01-0(0, 1, 0).

(6.10)

The image of any nonzero point z of CI L is a point in the xy-plane (with complex coordinates) whose x- and y-coordinates satisfy the relationship y2 = f(x) because of (6.9). Here f(x)eC[x] is a cubic polynomial with distinct roots. Thus, every point z in CIL, maps to a point on the elliptic curve y2 = f(x) in Pt It is not hard to see that this map is a one-to-one correspondence between CIL and the elliptic curve (including its point at infinity). Namely, every x-value except for the roots of f(x) (and infinity) has precisely two z's such that 0 (z) = x (see Problem 4 of §5). The y-coordinates y = Oz) coming from these two z's are the two square roots off(x) = f(p(z)). If, however, x happens to be a root of fix), then there is only one z value such that p(z) = x, and the corresponding y-coordinate is y = sg'(z) = 0, so that again we are getting the solutions to y2 =fix) for our given x. Moreover, the map from C/L, to our elliptic curve inti:q is analytic, meaning that near any point of C1L it can be given by a triple of analytic functions. Near non-lattice points of C the map is given by z --+ (0(4 ga'(z), 1); and near lattice points the map is given by z 1---9 (0(z)1 0/(z), 1, 11 p'(z)), which is a triple of analytic functions near L. We have proved the following proposition. Proposition 10. The map (6.10) is an analytic one-to-one correspondence

between CI L and the elliptic curve y 2 =--- 4x3 — g2 (L)x — g 3 (L) in P. One might be interested in how the inverse map from the elliptic curve to CIL, can be constructed. This can be done by taking path integrals of dxly = (4x3 — g 2 x — g 3) -112dx from a fixed starting point to a variable endpoint. The resulting integral depends on the path, but only changes by

25

§6. Elliptic curves in Weierstrass form

e1

e2

C3

00

Figure 1.10

a "period", i.e., a lattice element, if we change the path. We hence obtain a well-defined map to CIL. See the exercises below for more details. We conclude this section with a few words about an algebraic picture that is closely connected with the geometric setting of our elliptic curve. Recall from Proposition 8 that any elliptic function (meromorphic function on the torus C/L) is a rational expression in ka(z) and p'(z). Under our one-to-one correspondence in Proposition 10, such a function is carried over to a rational expression in x and y on the elliptic curve in the xy-plane (actually, in Pb. Thus, the field C(x, y) of rational functions on the xy-plane, when we restrict its elements to the elliptic curve y 2 = fix), and then "pull back" to the torus C/L, by substituting x = 0 (z), y = so`(z), give us precisely the elliptic functions ej • Since the restriction of y2 is the same as the restriction of f(x), the field of functions obtained by restricting the rational functions in C(x, y) to the elliptic curve is the following quadratic extension of C(x): C(x)[y]l(y 2 — (4x 3 — g 2 x — g 3)). Algebraically speaking, we form the quotient ring of C(x)[y] by the principal ideal corresponding to the equation y2 7--- f(x). Geometrically, projection onto the x-coordinate gives us Fig. I.10. Two points on the elliptic curve map to one point on the projective line, except at four points (the point at infinity and the three points where y = 0), where the two "branches" are "pinched" together. In algebraic geometry, one lets the field F = C(x) correspond to the complex line P,, and the field K = C(x, y)/ y 2 — (4x 3 — g 2 x — g 3) correspond to the elliptic curve in P. The rings A = C[x] and B = C[x, AI y 2 — f(x) are the "rings of integers" in these fields. The maximal ideals in A are of the form (x a)A; they are in one to one corrèspondence with a E C. A maximal ideal in B is of the form (x — a)B + (y — b)B (where b is a square root off(a)), and it corresponds to the point (a, b) on the elliptic curve. —

-

-

K D B (x — a)B + (y — b)B

FA

(x — a)B + (y + b)B ; ; (x — a)A

(b = \Ii (a))

1. From Congruent Numbers to Elliptic Curves

26

The maximal ideal (x — a)A, when "lifted up" to the ring B, is no longer prime. That is, the ideal (x — a)B factors into the product of the two ideals:

(x — a)B = ((x — a)B + (y — b)B)((x — a)B + (y + b)B). The maximal ideal corresponding to the point a on the x-line splits into two maximal ideals corresponding to two points on the elliptic curve. If it so happens that b = 0, i.e., a is a root off(x), then both of the ideals are the same, i.e., (x — a)B is the square of the ideal ((x — a)B + yB). In that case we say that the ideal (x — a)A "ramifies" in B. This happens at values a of the x-coordinate which come from only one point (a, 0) on the elliptic curve. Thus, the above algebraic diagram of fields, rings and ideals is an exact mirror of the preceding geometric diagram. We shall not go further than these ad hoc comments, since we shall not be using algebra geometric techniques in which follows. For a systematic introduction to algebraic geometry, see the textbooks by Shafarevich, Mumford, or Hartshorne. PROBLEMS

I. (a) Let L ---7-- Z[i] be the lattice of Gaussian integers. Show that g 3 (L) = 0 but that g 2 (L) is a nonzero real number. 1 + 0), be the lattice of integers in the qua-(b) Let L = Z [co], where co -= dratic imaginary field 0(\/— 3). Show that g2 (L) = 0 but that g 3 (L) is a nonzero real number. (c) For any nonzero complex number c, let cL denote the lattice obtained by multiplying all lattice elements by c. Show that g2 (eL) = c- 4 g 2 (4, and g 3(cL) = (—

c --- 6g 3 (4 .

(d) Prove that any elliptic curve y 2 = 4x3 — g2 x — g 3 with either g 2 or g 3 equal to zero, is of the form y 2 =-. 4x 3 — g2 (L)x — g 3 (L) for some lattice L. It can be shown that any elliptic curve is of that form for some lattice L. See, for example, [Whittaker & Watson 1958, §21.73]; also, we shall prove this much later as a corollary in our treatment of modular forms. 2. Recall that the discriminant of a polynomial f(x) = ao x" + al x" + • • • + an = ao (x — e i ))x — e 2). - -(x — e„) is ag-1 1-1 1 ,i(ei — ei)2 . It is nonzero if and only if the roots are distinct. Since it is a symmetric homogeneous polynomial of degree n(n — 1) in the es, it can be written as a polynomial in the elementary symmetric polynomials in the es, which are ( — Ojai/a° . Moreover, each monomial tertn rl i (adao)mi has total "weight" m 1 + 2m 2 + • • • + rum, equal to n(n — 1). Applying this tof(x) = 4x 3 — g 2 x — g 3 , we see that the discriminant is equal to a polynomial in g 2 , g 3 of weight six, i.e., it must be of the form ag3 + fig. Find a and fl by computing 42 (e 1 — e 2)2(e 1 — e 3 ) 2(e 2 — e3) 2 directly in the case g 2 = 4, g3 = 0 and the case g 2 = 0, g 3 = 4. 3. Since the even elliptic function p"(z) has a quadruple pole at zero and no other pole, you know in advance that it is equal to a quadratic polynomial in p (z). Find this polynomial in two ways: (a) comparing coefficients of powers of z; (b) differentiating p'2 = 40 3 — g2 p — g 3 . Check that your answers agree.

77

§6. Elliptic curves in Weierstrass form 4. Use either the equation for 0' 2 or the equation for 0" to prove that G8 =

4G1..

5. Prove by induction that all Gk's can be expressed as polynomials in G4 and G6 with rational coefficients, i.e., GkEO[G4, G6]. We shall later derive this fact again when we study modular forms (of which the Gk turn out to be examples). 6. Let co l = it be purely imaginary, and let co 2 = 7r. Show that as t approaches infinity . Gk (it, n) approaches 2n -k ((k), where C(s) is the Riemann zeta-function. Suppose we know that “2) = n 2/6, ;(4) = m 4/90, C(6) = e/945. Use Problem 4 to find (8). Use Problem 5 to show that n -k ((k)e 0 for all positive even inEegers k. 7. Find the limit of g2 and g3 for the lattice L .--- {mil + mr} as / --- co. 8. Show that v = csc 2 z satisfies the differential equation v' 2 = 4v 2 (v — I), and that the function V

=

2 CSC Z

— 's1

satisfies the differential equation v' 2 = 4y 3 — iv — A- What is the discriminant of the polynomial on the right? Now start with the infinite product formula for sin(nz), replace z by zin, and take the logarithmic derivative and then the derivative once again to obtain an infinite sum for csc 2 z. Then prove that .

lim p(z; it, 7r) = csc2 z — i.

i-oGo

9. The purpose of this problem is to review the function

z = log y for v complex,

in the process providing a "dry run" for the problems that follow. (a) For v in a simply connected region of the complex plane that does not include the origin, define a function z of v by:

z=

i

f u di1 —, 1

where the path from I to v is chosen arbitrarily, except that the same choice is made for all points in the region. (In other words, fix any path from I to vo , and then to go to other v's use a path from vo to y that stays in the region.) Call this function z = log v. Show that if a different path is chosen, the function changes by a constant value in the "lattice" L =--- {2/rim} ; and that any lattice element can be added to the function by a suitable change of path. (L is actually only a lattice in the imaginary axis illi, not a lattice in C.) (b) Express dzidv and dvldz in terms of v. (c) If the function y = e2 is defined by the usual series, use part (b) to show that ez is the inverse function of z = log v. (d) Show that the map ez gives a one-to-one correspondence between C/L, and C — {0}. Under this one-to-one correspondence, the additive group law in C/L becomes what group law in C — {O}? W. Let L be a fixed lattice, set g2 ;----- g2 (L), g 3 = g3 (L), so(z) = so(z; L). Let u = 1(z) be a function on a connected open region R c C which satisfies the differential equation u'' = 4u 3 g 2 u g 3 . Prove that u = ko(z + a) for some constant a. —

—

11. Let L = {mco 1 + mo 2 } be a fixed lattice, and set g2 = g2 (L), g 3 = g3 (L), 6.)(:) = go(z; L). Let R 1 be an unbounded simply connected open region in the complex plane which does not contain the roots e l , e2 , e 3 of the cubic 4x 3 g 2 x — g3. —

28

I. From Congruent Numbers to Elliptic Curves

1.- - (- - 4.-° e2

(4212

Figure 1.11

For UER,, define a function z = g(u) by co

z = g (u) =

di

ju \14t 3 — g 2 t — g 3

,

where a fixed branch of the square root is chosen as t varies in R 1 . Note that the integral converges and is independent of the path in R, from u to oo, since R, is simply connected. The function z = g(u) can be analytically continued by letting R2 be a simply connected region in C — {e 1 , e2 , e3 ) which overlaps with R 1 . If ue R2, then choose u, eR, n R2, and set z :.---- g(u) = g(u1 ) + Jut,' (4t 3 — g2 t — g3) -112 dt. This definition clearly does not depend on our choice of u, E R 1 n R2 or our path from u to u, in R2. Continuing in this way, we obtain an analytic function which is multivalued, because our sequence of regions R I , R2, R3, . . . can wind around e l , e2 , or e3 . (a) Express (dz./4) 2 and (duidz) 2 in terms of u. (b) Show that u = p(z). In particular, when we wind around e l , e2 , or e 3 the value of z can only change by something in L. Thus, z = g (u) is well defined as an element in CIL for uE C — {e l , e2 , e3 } . The function z = g(u) then extends by continuity to e 1 , e2 , e3 . (c) Let Cl be the path in the complex u-plane from e2 to co that is traced by u =-• 0 (2) as z goes from w2/2 to 0 along the side of ri (see Fig. I.11). Show that Sci (4t 3 g 2 t g 3)- wdt::---- w 2/2 for a suitable branch of the square root. (d) Let C2 be the path that goes from co to e2 along C1 , winds once around e2 , and then returns along C, to co. Take the same branch of the square root as —

—

—

in part (c), and show that lc, (4j 3 — g 2 t — g 3) -1/2dt = co2 . (e) Describe how the function z = g(u) can be made to give all preimages of u under a =--

12. (a) Prove that all of the roots e l , e2 , e3 of 4x3 — g2 x — g3 are real if and only if g2 and g 3 are real and A = g3 — 27gi > O. (b) Suppose that the conditions in part (a) are met, and we order the ei so that e2 > e3 > e l . Show that we can choose the periods of L to be given by

L. e

1 to1 = i 2

I

dt

V g 3 + g2 t — 43

and

1 2 (D2 = fe 2

di 114/. 3 — g 2 /

— g3

?

where we take the positive branch of the square root, and integrate along the real axis. (c) With these assumptions about the location of the e • on the real axis, describe how to change the path of integration and the branch of the square root in

§7. The addition

29

law

Problem 11 so as to get the other values of z for which u = p(:), namely + z rnco + nw2 . 13. Suppose that g2 = 4n2, g 3 = O. Take e 1 , e 2 , e3 so that e2 > e 3 > e 1 . What are C 1 , e2 , e 3 in this case? Show that N I = kû2 , i.e., the lattice L is the Gaussian integer lattice expanded by a factor of w2 . Show that as z travels along the straight line from w 1 /2 to w 1 /2 (02 the point (x, y) = (0(z), p'(z)) moves around the real points of the elliptic curve y2 = 4(x 3 n 2x) between —n and 0; and as : travels along the straight line from 0 to w2 the point (x, = (p(z), o'(z)) travels through all the real points of this elliptic curve which are to the right of (n, 0). Think of the "open" appearance of the latter path to be an optical illusion: the two ends are really "tied together" at the point at infinity (0, 1, 0). 14. (a) Show that

JO \/i(1

1 n—-)

n 135

inch

t) =

222

(I)) Under the conditions of Problem 12, with e2 > e3 > e 1 , set ). = e3

e2

el

E(0. I).

Derive the formula:

1 \/e 2 —

ri e 1 J0

dt t(1

1)(1 — ;d)

(c) Derive the formula w 2 = n(e 2 e i ) -112F(A), where 1 3 5 ( \ -12 ?lit F(2) = 2- -2- • • • n n= 0 [

The function F(À) is called a "hypergeometric series". (d) Show that the hypergeometric series in part (c) satisfies the differential equa— 11)F" (A) + (1 — 2),)Ft (A) — = O. tion:

§7. The addition law In the last section we showed how the Weierstrass 0-function gives a correspondence between the points of ICJ, and the points on the elliptic g 3 (L) in Pt We have an obvious addition curve y2 = f(x) = 4x 3 g2 (L)x law for points in CIL, obtained from ordinary addition of complex numbers by dividing by the additive subgroup L. i.e., ordinary addition "modulo L". This is the two-dimensional analog of "addition modulo one" in the group

R/Z. We can use the correspondence between C1L and the elliptic curve to carry over the addition law to the points on the elliptic curve. That is, to add two points P i (x i , Yi) and P2 = (-)C21 y2), by definition what we do is go back to the z-plane, find z and z 2 such that PI = (p(z 1 ), 0/(:, )) and P2 =-- (P ( : 1 z2), + : 2 )). This P2 = (P(Z2), 0/(Z2)), and then set P i is just a case of the general principle: whenever we have a one-to-one correspondence between elements of a commutative group and elements of some

1. From

30

Congruent Numbers to Elliptic Curves'

,

a +wi +w2

Figure 1.12

other set, we can use this correspondence to define a commutative group law on that other set. But the remarkable thing about the addition law we obtain in this way is that (1) there is a simple geometric interpretation of "adding" the points on the elliptic curve, and (2) the coordinates of P1 + P2 can be expressed directly in terms of X 1 , x2 , Yi' y2 by rather simple rational functions. The purpose of this section is to show how this is done. We first prove a general lemma about elliptic functions.

Lemma. Let f(z)ee L . Let H =_-- {aco i ± bco2 10 .... a, b .... 1} be a fundamental parallelogram for the lattice L, and choose a so that f(z) has no zeros or poles on the boundary of a + H. Let lai l be the zeros off(z) in a ± II, each repeated as many times as its multiplicity, and let Ibil be the poles, each occurring as many times as its multiplicity. Then Za i —Ebi E L. PROOF. Recall that the function f(z)/f(z) has poles at the zeros and poles off(z), and its expansion near a zero a of order m is mgz — a) + • • - (and

near a pole b of order —m the expansion is —m/(z — b) + • • • ). Then the function zf(z)lf(z) has the same poles, but, writing z = a 1--(z a), we see that the expansion starts out am/(z — a). We conclude that E ai — E bi is the sum of the residues of zf(z)lf(z) inside a + II. Let C be the boundary of a + H. By the residue theorem, -

E ai — E bi = 2—n i c

f(z)

—

d

We first take the integral/ over the pair of opposite sides from a to a + w2 and from a + co l to a + co l + co 2 (see Fig. 1.12). This part is equal to

Œ+(01+(»2 I 0'14-'4)2 z f (z) dz f(z) bri a

-. 1 ( rœ+(02 I = -

CO 1

)

fOE+0),

Z f(z) dz

f(z)

2ni j a

2 -1- (0 2

2ni ,

f(Z) z _f(z) dz I

a

f (2,\ f(z)

1

fœ-f(92

dz.

(z

+

(01) 11(z)

f(z)

dz)

31

§7. The addition law

Now make the change of variables u = f(z), so that f'(z)dzIf(z) ---- du/u. Let Ci be the closed path from f(a) to f(Œ + 62) 7--- f(a) traced by u = f(z) as z goes from a to a + co2 . Then I du .r+C4)2 f(Z) d.Z = 2 n i ci II ' 2iti a f(z) and this is some integer n, namely the number of times_ the closed path C1 winds around the origin (counterclockwise). Thus, we obtain — co l n for this part of our original integral. In the same way, we find that the integral over the remaining two sides of C is equal to — co2 m for some integer in. Thus, o Z ai — Ebi = —nw i — mco 2 e L, as desired. This proves the lemma. 1

We are now ready to derive the geometrical procedure for adding two points on the elliptic curve y2 =f(x) = x3 — g 2 (L)x — g 3 (L). For z in CI L, let Pz be the corresponding point P, = (so(z), so'(z), 1), Po = (0, 1, 0) on the elliptic curve. Suppose we want to add Pz , = (x1 , Yi) to Pz2 = (x2, y 2) to obtain the sum Pz.,, z ,= (x3 , y 3). We would like to know how to go from the two points to their sum directly, without tracing the points back to the

z-plane. We first treat some special cases. The additive identity is, of course, the image of z = O. Let 0 denote the point at infinity (0, I, 0), i.e., the additive identity of our group of points. The addition is trivial if one of the points Pz, have the same is 0, i.e., if z i or z 2 is zero. Next, suppose that P x-coordinate but are not the same point. This means that x2 z--- x 1 , Y2 = — .Y1 In this case z 2 = —z 1 , because only "symmetric" values of z (values wh'cii are the negatives of each other modulo the lattice L) can have the same Pz, = P0 = 0, i.e., the two points are additive so-value. In this case, P inverse to one another. Speaking geometrically, we say that two points of the curve which are on the same vertical line have sum 0. We further note that in the special situation of a point PZ i = PZ2 on the x-axis, we have y2 = — Yi = 0, and it is easy to check that we still have Pz + P 2 2P. = O. We have proved: 1 2 1 Proposition 11. The additive inverse of (x, y) is (x, —y).

piven two points Pi = Pz , = (x i , y 1 ) and P2 = Pz2 = (X2 1 y 2) on the elliptic curve y2 = 4x 3 — g2 x — g 3 (neither the point at infinity 0), there is a line 1= Pi P2 joining them. If Pi = P2 1 we take 1 to be the tangent line to the elliptic curve at P1 . If / is a vertical line, then we saw that P i + P2 = O. Suppose that / is not a vertical line, and we want to find Pi + P2 = P3 = (x 3 , y 3). Our basic claim is that — P3 = (x 3 , —y 3) is the third point of intersection of the elliptic curve with J. Write the equation of 1 = P1 P2 in the form y = mx + b. A point (x, y) on 1 is on the elliptic curve if and only if (mx + bY = f(x) = 4x 3 —_g2 x — g3 , that is, if and only if x is a ro- I. the cubic f(x) — (mx + b) 2 . This cubic

32

1. From Congruent Numbers to Elliptic Curves

has three roots, each of which gives a point of intersection. If x is a double root or triple root, then / intersects the curve with multiplicity two or three at the point (x, y) (see Problem 6 of §I.3). In any case, the total number of points of intersection (counting multiplicity) is three. Notice that vertical lines also intersect the curve in three points, including the point at infinity O; and the line at infinity has a triple intersection at 0 (see Problem 7 of §I.3). Thus, any line in N intersects the curve in three points. This is a special case of Bezout's Theorem. Let P(x, y, z) and 6 (x, y, z) be homogeneous polynomials of degree m and n, respectively, over an algebraically closed field K. Suppose that P and 6 have no common polynomial factor. Then the curves in Pi defined by F and 6 have mn points of intersection, counting multiplicities.

For a more detailed discussion of multiplicity of intersection and a proof of Bezout's theorem, see, for example, Walker's book an algebraic curves [Walker 1978]. In our case F(x, y, z) = y2z — 4x 3 + g2 xz 2 + g3 z 3 and 6-(x, y, z) = y — mx — bz. Proposition 12. If P1 + P2 = P3, then — P3 is the third point of intersection of I = P1 P2 with the elliptic curve. If P1 = P2 , then by P1 P2 we mean the

tangent line at P1 . We have already treated the case when P1 or P2 is the point at infinity 0, and when P2 =--- œ P1 . So suppose that I = PI P2 has the form y = mx + b. Let P1 = Pz1 , P2 = Pz 2 . To say that a point Pz = (p(z), pi (z)) is on / means PROOF.

that pY(z) = ma(z) + b. The elliptic function 0 1(z) — m(z) — b has three poles and hence three zeros in CIL. Both z 1 and z2 are zeros. According to the lemma proved above, the sum of the three zeros and three poles is equal to zero modulo the lattice L. But the three poles are all at zero (where so'(z) has a triple pole); thus, the third zero is — (z, + z2) modulo the lattice. Hence, the third point of intersection of / with the curve is P---(z 1 +z2) -= as claimed. The argument in the last paragraph is rigorous only if the three points of intersection of 1 with the elliptic curve are distinct, in which case a zero of 0 '(z) — mg(z) — b corresponds, exactly to a point of intersection P. Otherwise, we must show that a double or triple zero of the elliptic function always corresponds to a double or triple intersection, respectively, of I with the curve. That is, we must show that the two meanings of the term "multiplicity" agree: multiplicity of zero of the elliptic function of the variable z, and multiplicity of intersection in the xy-plane. Let z 1 , z 2 , —z 3 be the three zeros of so'(z) - - mp(z)— h, listed as many times as their multiplicity. Note that none of these three points is the negative of another one, since / is not a vertical line. Since — z, , —z2 , z3 are the three

33

§7. The addition law

1 P1 + P2

Figure 1.13

zeros of so' (z) + mo(z) + b, it follows that ±z 1 , ±z 2 , +z 3 are the six 1) f(0(z)) (mso(z) + b) 2 = 44(0(z) zeros of 0 1(2)2 — (z) + (0(z) x 2)(s (z) — x3), where x l , x2 , x 3 are the root off(x) (mx + b) 2 . If, say, (z 1 ) = x1 , then the multiplicity of x 1 depends upon the number of +z2 , ±z 3 which equal +z 1 . But this is precisely the number of z 2 , which equal z 1 . Hence "multiplicity" has the same meaning in both cases. This concludes the proof of Proposition 12. Proposition 12 gives us Fig. 1.13, which illustrates the group of real points on the elliptic curve y 2 = x3 — x. To add two points Pi and P2, we draw the line joining them, find the third point of intersection of that line with the curve, and then take the symmetric point on the other side of the x-axis. It would have been possible to define the group law in this geometrical manner in the first place, and prove directly that the axioms of an abelian group are satisfied. The hardest part would have been the associative law, which would have necessitated a deeper investigation of intersections of curves. In turns out that there is some flexibility in defining the group law. For example, any one of the eight points of inflection besides the point at infinity could equally well have been Chosen as the identity. For details of this alternate approach, see [Walker 1978 ]. Qne disadvantage of our approach using 0 (z) is that a priori it only applies to elliptic curves of the form y2 = 4x 3 g2 (L)x — g 3 (L) or curves that can be transformed to that form by a linear change of variables. (Note that the geometrical description of the group law will still give an abelian group law ' after a linear change of variables.) In actual fact, as was mentioned earlier and will be' proved later, any elliptic curve over the complex numbers can be transfoirmed to the Weierstrass form for some lattice L. We already know

1.

34

From Congruent Numbers to Elliptic Curves

that our favorite example y2 = x 3 — n 2 x corresponds to a multiple of the Gaussian integer lattice. In the exercises for this section and the next, we shall allow ourselves to use the fact that the group law works for any elliptic curve. It is not hard to translate this geometrical prôcedure into formulas expressing the coordinates (x 3 , y3) of the sum of P1 = (x 1 , y) and P2 = (x2 , y2) in terms of x, , x2 , yi , y2 and the coefficients of the equation of the elliptic curve. Although, strictly speaking, our derivation was for elliptic curves in the form y2 =f(x) = 4x3 g2 (L)x g 3 (L) for some lattice L, the procedure gives an abelian group law for any elliptic curve y2 = f(x), as remarked above. So let us take f(x) = ax 3 + bx2 4- ex ± deC[x] to be any cubic with distinct roots. In what follows, we shall assume that neither P, nor P2 is the point at infinity 0, and that P1 0 —P2 . Then the line through P1 and P2 (the tangent line at P1 if P, = P2) can be written in the form y = mx + (3, where m (y2 — y1 )/(x 2 — x 1 ) if P1 0 P2 and m = dy/c/x1 (x1 , y1 if P, = P2. In the latter case we can express m in terms of x 1 and Yi by implicitly differentiating = f(x); we find that m =f(x 1 )/2y 1 . In both cases the y-intercept is

f3 = y i — mx 1 . Then x3 , the x-coordinate of the sum, is the third root of the cubic , two of whose roots are x l , x2 . Since the sum of the three f(x) (mx + roots is equal to minusihe coefficient of x2 divided by the leading coefficient, we have: x, + x2 + x 3 = —(b m 2)/a, and hence:

\2 X 3 = -X i - X2 - -b

a

x3

+ aV I (Y22 — x i ) '

—b + 1 (f1(x1) ) 2 , a a 2y i

if P, 0 P2 ;

(7.1)

i f P1 = P2*

(7.2)

The y-coordinate y3 is the negative of the value y = mx 3 + fi, i.e., Y3 = - Y1+ M(xl

(7.3)

x3),

where x3 is given by (7.1) and (7.2), and

m = (Y2 — Yi)/(x2 — xi) if Pi m -f (x1)/2y1 if P1 '

P2;

(7.4)

P2.

If our elliptic curve is in Weierstrass form y 2 = 4x3 g2 x g 3 , then we have a = 4, b =-- 0, and f(x 1 ) = 124 g2 in the addition formulas (7.1)—(7.4). In principle, we could have simply defined the group law by means of these 'formulas, and then verified algebraically that the axioms of a commutative group are satisfied. The hardest axiom to verify would be associativity. Tedious as this procedure would be, it would h le key advantage over

§7. The addition law

35

either the complex-analytic procedure (using ga(z)) or the geometrical procedure. Namely, we would never have to use the fact that our, field K over which the elliptic curve is defined is the complex numbers, or even that it has characteristic zero. That is, We would find that our formulas, which make sense over any field K of characteristic not equal to 2, give an abelian group law. That is, if y2 =----f(x) = ax3 + bx2 + cx + d G K[x] is the equation of an elliptic curve over K, and if we define f CO = 3ax2 + 2bx + c, then any two points having coordinates in some extension of K can be added using the formulas (7.1)—(7.4). We shall make use of this fact in what follows, even though, strictly speaking, we have not gone through the tedious purely algebraic verification of the group laws. PROBLEMS

1. Let L c R be the additive subgroup fmcol of multiples of a fixed nonzero real number w. Then the function zi—qcos(274w), sin(2740)) gives a one-to-one analytic map of RI L onto the curve x2 + y 2 = I in the real xy-plane. Show that ordinary addition in R/L, carries over to a rational (actually polynomial) law for "adding" two points (x l , yi ) and (x 2 , y2) on the unit circle; that is, the coordinates of the "sum" are polynomials in x 1 , x2 , yi , y2 . Thus, the rational addition law on an elliptic curve can be thought of as a generalization of the formulas for the sine and cosine of the sum of two angles. 2. (a) Simplify the expression for the x-coordinate of 2P in the case of the elliptic curve y2 = x3 — n2x. (b) Let X, Y, Z be a rational right triangle with area n. Let P be the corresponding point on the curve y2 = x 3 — n2x constructed in the text in §1.2. Let Q be the point constructed in Problem 2 of §I.2. Show that P =-- 2Q. (c) Prove that, if P is a point not of order 2 with rational coordinates on the curve y 2 = x' — 12 2x, then the x-coordinate of 2P is the square of a rational number having even denominator. For example, the point Q ::--: ((4117)2 , 720. 4l/7 3 ) on the curve y2 = x3 — 31 2x is not equal to twice a point P having rational coordinates. (In this problem, recall: n is always squarefree.) 3. Describe geometrically: (a) the four points of order two on an elliptic curve ; (b) the nine points of order three; (c) how to find the twelve points of order four which are not of order two; (d) what the associative law of addition says about a certain configuration of lines joining points on the elliptic curve (draw a picture). 4. (a) How many points of inflection are there on an elliptic curve besides the point at infinity? Notice that they occur in symmetric pairs. Find an equation for their x-coordinates. (b) In the case of the elliptic curve 'y2 = x' — n 2x find an explicit formula for these x-coordinates. Show that they are never rational (for any n). 5. Given a point Q on an elliptic curve, how many points Pare there such that 2P = Q? Describe geometrically how to find them.

6. Show that if K is any, subfield of C containing g 2 and g 3 , then the points on the elliptic curve y2 = 4x 3 — g 2 x — g 3 whose coordiriates - are in K form a subgroup

I. From Congruent Numbers to Elliptic Curves

36

of the group of all points. More generally, show that this is true for the elliptic , curve y2 = f(x) iff(x) e K[x].

7. Consider the subgroup of all points on y2 = x 3 — n2 x with real coordinates. How many points in this subgroup are of order 2? 3? 4? Describe geometrically where these points are located. 8. Same as Problem 7 for the elliptic curve y2 = x3 — a, a e R.

9. If y2 = f(x) is an elliptic curve in which f(x) has real coefficients, show that the group of points with real coordinates is isomorphic to (a) R/Z if f(x) has only one real root; (b) R/Z x Z/21 iff(x) has three real roots. 10. Letting a approach zero in Problem 8, show that for the curve y2 = x3 the same geometric procedure for finding P1 + P2 as for elliptic curves makes the smooth points of the curve (i.e., P * (0, 0), but including the point at infinity) into an abelian group. Show that the map which takes P = (x, y) to xly (and takes the point at infinity to zero) gives an isomorphism with the additive group of complex numbers. This is called "additive degeneracy" of an elliptic curve. One way to think of this is to imagine both co l and co2 approaching infinity (in different directions). Then g 2 and g3 both approach zero, so the equation of the corresponding elliptic curve approaches y2 = 4x 3 . Meanwhile, the additive group C1L, where L = {m(0 1 + nco2 }, approaches the additive *group C, i.e., the fundamental parallelogram becomes all of C. 11. Let a —* 0 in the elliptic curve y2 ----- (x2 ___ a)(x + 1). Show that for the curve y2 = x 2 (x + 1) the same geometric procedure for fi nding P1 + P2 as for elliptic curves makes the smooth points of the curve into an abelian group. Show that the map which takes P----- (x, y) to (y— x)/(y + x) (and takes the point at infinity to 1) gives an isomorphism with the multiplicative group C* of nonzero complex numbers. This is called "multiplicative degeneracy" of an elliptic curve. Draw the graph of the real points of y 2 = x2 (x + 1), and show where the various sections go under the isomorphism with C*. One way to think of multiplicative degeneracy is to make the linear change of variables yf—>iy, x F-4 —x — -1- , so that the equation becomes y2 = 4x 3 — lx — (compare with Problem 8 of §1.6). So we are dealing with the limit as t approaches infinity of the group C/{mit + tut}, i.e., with the vertical strip Ci{rin} (rather, a cylinder, since opposite sides are glued together), and this is isomorphic to C* under the map zi—*e 2'.

§8. Points of finite order In any group, there is a basic distinction between elements of finite order and elements of infinite order. In an abelian group, the set of elements of finite order form a subgroup, called the "torsion subgroup". in the case of the group of points in P, on the elliptic curve )72 =f(x), we immediately see that a point Pz = (x, y) has finite order if and only if Nz e I, for some N, i.e., if and only if z is a rational linear combination of co l and co2 . in that case, the least such N (which is the leas t common denominator of the coefficients of oi / and co2) is the exact order of P. Under the isomorphism

§8. Points of finite order

37

from ER/Z x R/Z to the elliptic curve given by (a, b) i—' P it is the image of Q/Z -x Q/Z which is the torsion subgroup of the elliptic curve. This situation is the two-dimensional analog of the circle group, whose torsion subgroup is precisely the group of all roots of unity, i.e., all e 2 " for ze OIL Just as the cyclotomic fields—the field extensions of 0 generated by the roots of unity—are central to algebraic number theory, we would expect that the fields obtained by adjoining the coordinates of points P = (x, y) of order N on an elliptic curve should have interesting _special properties. We shall soon see that these coordinates are algebraic (if the coefficients off(x) are). This analogy between cyclotomic fields and fields formed from points of finite order on elliptic curves is actually much deeper than one might have guessed. In fact, a major area of research in algebraic number theory today consists in finding and proving analogs for such fields of the rich results one has for cyclotomic fields. Let N be a fixed positive integer. Let f(x) --= ax3 bx 2 + ex + d = a(x — e 1 )(x e 2)(x — e 3) be a cubic polynomial with coefficients in a field K of characteristic 0 2 and with distinct roots (perhaps in some extension of K). We are interested in describing the coordinates of the points of order N (i.e., exact order a divisor of N) on the elliptic curve y 2 =f(x), where these coordinates may lie in an extension of K. If N =--- 2, the points of order N are the point at infinity 0 and (es , 0), i = 1, 2, 3. Now suppose that N> 2. If N is odd, by a "nontrivial" point of 'order N we mean a point P 0 such that NP = O. If N is even, by a "nontrivial" point of order N we mean a point P such that NP = 0 but 2P 0 O. Proposition 13. Let K' be any field extension of K (not necessarily algebraic). and let a: K' aK' be any field isomorphism which leaves fixed all elements of K. Let P ePic, be a point of exact order N on the elliptic curve y 2 =J(x) where f(x) e K[x]. Then aP has exact order N (where for P = (x, y, :) E P we denote o-P d=ef (ax, ay, az)_e 53,20.

It follows from the addition formulas that o-P, o-P, + P2 ), and hence N(aP) = a(NP) = a0 = 0 (since G(O, I, 0) --= (0, 1, 0)). Hence cr P has order N. It must have exact order N, since if N'o-P = 0, we would have cr(N'P) = 0 = (0, 1, 0), and hence N' P = O. This proves the proposition. o PROOF.

Proposition 14. In the situation of Proposition 13, with K a subfield of C, let KN c C denote the field obtained by adjoining to K the x-, and y-coordinates

of all points of order N. Let K denote the field obtained by adjoining just their x-coordinates. Then both KN and KI;41" are finite galois extensions of K. In each case KN and K, we are adjoining a finite set of complex numbers which are permuted by any automorphism of C which fixes K. This immediately implies the proposition. PROOF.

As an example, if N = 2, then K 2 = K-21- is the splitting field off(x) over K.

1.

38

From Congruent Numbers to Elliptic Curves

Recall that the group of points of order N on an elliptic curve in Pt is isomorphic to VI NZ) x (/N). Because any Gre Gal(KN/K) respects addition of points, i.e., c(Pi + P2) = o- P1 + o-P2 , it follows that each a gives an invertible linear map of (ZI N .2) 2 to itself. If R is any commutative ring, we let GL(R) denote the group (under matrix multiplication) of all n x n invertible matrices with entries in R. Here invertibility of a matrix A is equivalent to det A E R*, where R* is the multiplicative group of invertible elements of the ring. For example:

(1) GL i (R) ::----: R* ; (2) G L 2 (11 NZ) = {C: Na, b, c, de ZINZ, ad — bc E (7 iNZ) * }.

/

It is easy to construct a natural one-to-one correspondence between invertible linear maps Rn -4 R" and elements of GL(R). There is no difference with the more familiar case when R is a field. In our situation of points of order N on an elliptic curve, we have seen that Gal(KNIK) is isomorphic to a subgroup of the group of all invertible linear maps (Z/NZ) 2 --* (Z/NZ) 2 . Thus, any a- e Gal(KN/K) corresponds to a matrix (ca bd ) e G L 2 (11 NZ). The matrix entries can be found by writing (71)(0 1/N = Paco i / N + cco 2 / N5

aPw2lN

= Plm 1 /N+dco2 /N•

Notice that this is a direct generalization of the situation with the N-th cyclotomic field ON cfe--f 0(YT). Recall that Gal(ON/Q),rzd, (ZINZ)* = GL i (ZI NZ), with the element a which corresponds to ci determined by a(e 2N) ..„....„ eznia/N . But one difference in our two-dimensional case of division points on elliptic curves is that, in general, Gal(KN/K) --3 GL 2 (ZIN1) is only an injection, not an isomorphism. In the case K c C, say K -----= 0(g2 , g3 ), where y 2 = f(x) = 4x 3 — g2 x — g3 is in Weierstrass form, we shall now use the p-function to determine the polynomial whose roots are the x-coordinates of the points of order N. That is, Kz- will be the splitting field of such a polynomial. We first construct an elliptic function fN (z) whose zeros are precisely the nonzero values of z such that Pz is a point of order N. We follow the prescription in the proof of Proposition 9 of §1.5. If u E CIL, is a point of order N, then so is the symmetric point —u (which we denoted u* when we were ' thinking in terms of points in a fundamental parallelogram). We consider two cases:

(1) N is odd. Then the points u and —u are always distinct modulo L. In other words, u cannot be w 1 /2, w 2/2 or (o) i + w2)/2 if u has odd order N. We define

Mz) := N H(0 (z) — g o(u)),

(8.1)

39

§8. Points of finite order

where the product is taken over nonzero ue C/L such that Nu e L. with one u taken from each pair u, —u. Thenfv (z) = FN (p(z)), where FN (x)E C[X] is a polynomial of degree (N 2 — 1)/2. The even elliptic function fN (z) has N 2 — I simple zeros and a single pole at 0 of order N 2 — 1. Its leading term at z = 0 is Niz N2 '. (ii) N is even. Now let u range over u e CI L such that Nu e L but u is not of order 2; i.e., u 0 0, o.) 1 /2, (.0 2 /2, (co l + w2)/2. De fi ne fiv (z) by the product in (8.1). Then IN (z) = FN (p(z)), where FN (x)EC[x] is a polynomial of degree (N 2 — 4)/2. The even elliptic function fN (z) has N 2 — 4 simple zeros and a single pole at 0 of order N 2 — 4. Its leading term at -: = 0 is

. N Iz N2'. 4 . If N is odd, the function L (z) has the property that frAz . ) 2

_ N2

n

(o(z)- o(0).

OucCIL,NuEL

If N is even, then the function fN (z)z.-10/(z)/N (z) has die property that

fN(z) 2 = 1-0 / (z) 2fN(z) 2 UE

=N2

n

1-1 C/L,Nue

((z)

-

o(u))

L, 2uit L

( 0 (z)- 0 (4)).

0*ti EC/L.,NueL

We see that a point (x, y) = (0(z), OM has odd order N if and only if FN (x) = O. It has even order N if and only if either y = 0 (i.e., it is a point of order 2) or else FN (x) = O. Because of Propositions 13 and 14, we know that any automorphism of C fixing K = 0(g2 , g3) permutes the roots of FN. Hence, the coefficients of FN are in K = CP(g2 , g3). If we started with an elliptic curve not in Weierstrass form, say y2 = f(x) = ax 3 + bx ‘ 2 + cx + d, and if we wanted to avoid using the 0-function, then we could repeatedly apply the addition formulas (7.1)—(7.4) to compute the rational function of x and y which is the x-coordinate of NP, where P = (x, y). We would simplify algebraically as we go, making use of the relation y2 =fix), and would end up with an expression in the denominator which vanishes if and only if NP is the point at infinity, i.e., if and only if P has order N (recall: "order N" means "exact order N or a divisor of N"). What type of an expression would we have to get in the denominator of the x-coordinate of NP? Suppose, for example, that N is odd. Then this denominator would be an expression in Iqx, y] (with y occurring at most to the first power), where K = 13(a, b, c, d), which vanishes if and only if x is one of the (N 2 — 1)/2 values of x-cOordinates of nontrivial points of order N. Thus, the expression must be a polynomial in x alone with (N 2 — 1)/2 roots. Similarly, we find that when N is even, this, denominator has the form

40

1.

From Congruent Numbers to Elliptic Curves

y • (polynomial in x alone), where the polynomial in' K[x] has (N 2 — 4)/2

roots. It is important to note that the algebraic procedure described in the last two paragraphs applies for any elliptic curve y 2 = f(x) over any field K of characteristic 0 2, not only over subfields of the complex numbers. Thus, for any K we end up with an expression in the denominator of the xcoordinate of NP that vanishes for at most N 2 — I values of (x, y). For a general fi eld K, however, we do not necessarily get exactly N 2 — I nontrivial points of order N. Of course, if K is not algebraically closed, the coordinates of points of order N may lie only in some extension of K. Moreover, if K has characteristic p, then there might be fewer points of order N for another reason: the leading coefficient of the expression in the denominator vanishes modulo p, and so the degree of that polynomial drops. We shall soon see examples where there are fewer than N 2 points of order N even if we allow coordinates in 101g c'. This discussion has led to the following proposition. Proposition 15. Let y 2 = f(x) be an elliptic curve over any field K of characteristic not equal to 2. Then there are at most N 2 points of order N over any extension K' of K.

Now let us turn our attention briefly to the case of K a finite field, in order to illustrate one application of Proposition 15. We shall later return to elliptic curves over finite fields in more detail. Since there are only finitely many points in IFI (namely, q2 + q I: I), there are certainly only finitely many Fg-points on an ellipticcurve y2 ---= fix), where f(x) e Fg [x]. So the group of Fg-points is a finite abelian group. By the "type" of a finite abelian group, we mean its expression as a product of cyclic groups of prime power order. We list the orders of all of the cyclic groups that appear in the form: 2Œ2, 2112, 22, . . . , 3'3, 3/33, 3Y3, . . . , 5'5, 5fl5, • . . . But Proposition 15 implies that only certain types can occur in the case of the group of Fg-points on y2 :----- f(x). Namely, for each prime I there are at most two l-th power components /Œi, Pi, since otherwise we would have more than 12 points of order I. And of course /Œt1 must equal the power of / dividing the order of the group. As an example of how this works, let us consider the elliptic curve y2 =-x3 — n 2 x over K = Fq (the finite field of q = pf elements), where we must assume that p does . not divide 2n. In the case when qT_-_- 3 (mod 4), it is particularly easy to count the number of Fg-points. -

Proposition 16. Let q = pf , p,1/2n. Suppose that q -.E..- 3 (mod 4). Then there are q + I Fg-points on the elliptic curve y 2 = x3 — n 2 x. PROOF. First, there are four points of order 2: the point at infinity, (0, 0),

and ( +n, 0). We now count all pairs (x, y) where x 0 0, n, -'-n. We arrange

41

§8. Points of finite order

these q — 3 x's in pairs {x, —x}. Since f(x) = x 3 — n 2 x is an odd function, and —1 is not a square in Fg (here's where we use the assumption that q -a:. 3 (mod 4)), it follows that exactly one of the two elements f(x) and j( — x) = —f(x) is a square in Fg . (Recall: In the multiplicative group of a finite field, the squares are a subgroup of index 2, and so the product of two nonsquares is a square, while the product of a square and a nonsquare is a nonsquare.) Whichever of the pair x, —x gives a square, we obtain exactly two points (x, ±Vf(x)) or else (— x, ±,jf(—x)). Thus, the (q — 3)/2 pairs give us q — 3 points. Along with the four points of order two, we have q ± 1 Fg o points in all, as claimed. Notice that when q=-=:-_ 3 (mod 4), the number of Fg-points on the elliptic - -- I (mod 4). curve y 2 = x 3 — I2 2 x does not depend on n. This is not true if q a • As an example, Proposition 16 tells us that for q := 7 3 there are 344 = 23 • 43 points. Since there are four points of order two, the type of the group of 1F343 -points on y 2 .7.--- x 3 — n2 x must be (2, 2 2 , 43). As a more interesting example, let q =p = 107. Then there are 108 = 22 - 3 3 points. The group is either of type (2, 2, 3 3) or of type (2, 2, 3, 3 2 ). To resolve the question, we must determine whether there are 3,or 9 points of order three. (There must be nontrivial points of order 3, since 3 divides the order of the group.) Recall the equation for the x-coordinates of points of order three (see Problem 4 of §7): —3x 4 + 6n2 x2 + n4 = 0, i.e., x = +n-N/1 + 2.1-j/3. Then the corresponding y-coordinates are found by taking ÷ Vf(x). We want to know how many of these points have both coordinates in F107 , rather than an extension of F 107 . We could compute explicitly, using .1-- = + 18 in F107 , so that x =--- + V13, +,/— 11, etc. But even before doing those computations, we can see that not all 9 points have coordinates in F107. This is because, if (x, y) is in F107, then ( —x, .\/— ly) is another point of order three, and its coordinates are not in 1Fi07 . Thus, there are only 3 points of order three, and the type of the group is (2, 2, 3 3). Notice that if K is any field of characteristic 3, then the group of K-points has no nontrivial point of order three, because — 3x 4 + 6n2 x 2 + 124 = 114 0 O. This is an example of the "dropping degree" phenomenon mentioned above. It turns out that the same is true for any p -IF= 3 (mod 4), namely, there are no points of order p over a field of characteristic p in that case. This is related to the fact that such p remain prime in the ring of Gaussian integers 1[i], a ring which is intimately related to our particular elliptic curve (see Problem _13 of §6). But we will not go further into that now. PROBLEMS

1. For the elliptic curve y2 = 4x3 — of p(z) when N= 2.

g2x — g 3 ,

express

go(Nz)

as a rational function ,

2. Let fN (z) be the elliptic functions defined above. Express f3 (z) as a polynomial in _sv(z).

42

1. From Congruent Numbers to Elliptic Curves

3. Set fi (z) = 1. Prove that for N = 2, 3, 4, ... we have: c.•

go (N z) z--- 0(z) — fly - 1 (z)fN + i (z)IfN(z) 2 .

4. In the notation of Proposition 14, suppose that CEGal(KN/K) fixes all x-coordinates of points of order N. That is, al K;,-iF =--- identity. Show that the image of a in GL 2 (7LIN7L) is +1. Conclude that Ga1(KN/K4 ) = { +1} n G, where G is the image of Gal(KN/K) in GL 2 (7LIN I). What is the analogous situation for cyclotomic fields? 5. Let L = {m o i ± nco2 } , and let E be the elliptic -curve y2 ---- 4x 3 — g2 (L)x — g 3 (L). Notice that E does not change if we replace the basis {co l , co 2 } of L by another basis {coil , co'2 }. However, the group isomorphism C/L,,Pz-'s ER/Z x R/Z changes, and so does the isomorphism from the points of order N on E to ZINZ x ZINZ. For example, the point (0 (co;IN), p'(co'l lN)), rather than (0 (co i l N), p'(co l IN)), corresponds to ( 1 , 0) eZINZ x ZI N Z. What effect does the change of basis from coi to co'i have on the image of Gal(KN/K) in GL 2 (ZINZ)? 6. Show that the group GL 2 (ZI2Z) is isomorphic to S3 1 the group of permutations of {1, 2, 3). For each of the following elliptic curves, describe the image in GL 2 (Z12Z) of the galois group over 0 of the field generated by the coordinates of the points of order 2. (n not a perfect square) (a) y2 = x3 — nx (b) y2 = x 3 — n2 x (n not a perfect cube) (c) y 2 = x3 — n (d) y2 = x3 — n3 . 7. (a) How many elements are in GL2 (Z/3Z)? (13) Describe the field extension K3 of K = 0 generated by the coordinates of all points of order 3 on the elliptic curve y2 = x3 — n 2x. (c) Find [K3 : 0]. What subgroup of GL2 (Z/3z) is isomorphic to Gal(K3/Q)?

(d) Give a simple example of an element in GL 2 (7L/3Z) that is not in the image of Gal(K3/10); in other words, find a pair of elements z i = (m i co l + n 1 co2)/3, z 2 =- (ni2 co 1 + n2 co2)/3 which generate all (mco l + nco 2)13 but such that Pzi , Pz, cannot be obtained from Pco1 13, Pco213 by applying an automorphism to the 'coordinates of the latter pair of points.

8. In Problem 13 of §1.15, we saw that the lattice corresponding to the curve y2 = x 3 — n 2x is the lattice L of Gaussian integers expanded by a factor co2 e R: L = {mico 2 + nco 2 } = c02 Z[i]. (a) Show that the map zi-÷ iz gives an analytic automorphism of the additive group C/L; and, more generally, for any Gaussian integer a -I- biEZ[i] we have a corresponding analytic endomorphism of Cii, induced by z I-4 (a ± bi)z. (b) Notice that if b = 0, this is the map zi--+z + z + • • • + z (a times) which gives Oa : P 1—* aP on the elliptic curve. By looking at the definition of 0 (z), pi (z), show that the map zi---* iz gives the automorphism Oi : (x, y)i—*(— x, iy) on the elliptic curve. This is an example of what's called "complex multiplication". Show that Oi o4 = ck_ i , and in fact the map a + NI—) Oa+bi is an injection of the ring Z[i] into the ring of endomorphisms of the group of points on the elliptic curve. (c) If L is a lattice in C and if there exists a complex number a = a + bi, b 0 0, such that ŒL OE L, show that a is a quAdratic imaginary algebraic integer, and that L. contains a sublattice of fini-e ya of the form c0 2 Z [a].

,3 k

§9. Points over finite fields, and the congruent number problem

43

9. Each of the following points has finite order N on the given elliptic curve. In each case, find its order. (a) P = (0, 4) on y2 = 4x 3 + 16 (b) P = (2, 8) on y2 = 4x 3 + lbx (c) P = (2, 3) on y 2 = x 3 + 1 (d) P = (3, 8) on y 2 = x 3 — 43x + 166 (e) P = (3, 12) on y 2 = — 14x 2 + 81x,

(f) P (0 , 0) 6n y 2 + y = x 3 x2 (g) P = (1, 0) on + xy + y =

x2 — 3x + 3.

§9. Points over finite fields, and the congruent

number problem We have mainly been interested in elliptic curves E over 0, particularly the elliptic curve y2 = X 3 — n2 x, which we shall denote E. But if K is any field whose characteristic p does not divide 2n, the same equation (where we consider n modulo p) is an elliptic curve over K. We shall let En (K) denote the set of points on the curve with coordinates in K. Thus, Proposition 16 in the last section can be stated: If q 3 (mod 4), then # En(Fq) = q + 1. The elliptic curve En considered as being defined over Fr,, is called the "reduction" modulo p, and we say that En has "good reduction" if p does not divide 2n, i.e., if y2 = x3 — n 2 x gives an elliptic curve over [Fly More generally, if y 2 = f(x) is an elliptic curve E defined over an algebraic number field, and if p is a prime ideal of the number field which does not divide the denominators of the coefficients off(x) or the discriminant off(x), then by reduction modulo p we obtain an elliptic curve defined over the (finite) residue field of p. At first glance, it may seem that the elliptic curves over finite fields— which lead only to finite abelian groups—are not a serious business, and that reduction modulo p is a frivolous game that will not help us in our original objective of studying Q-points on y2 = x 3 — n2 x. However, this is far from the case. Often information from the various reductions modulo p can be pieced together to yield information about the 0-points. This is usually a subtle and difficult procedure, replete with conjectures and unsolved problems. However, there is one result of this type which is simple enough to give right now. Namely, we shall use reduction modulo p for various primes p to determine the torsion subgroup of En(Q), the group of G-points on y2 =x3 — n 2 x. In any abelian group, the elements of finite order form a subgroup, called the "torsion subgroup". For example, the group E(C) of complex points on an elliptic curve is isomorphic to CIL, which for any lattice L is isomorphic to R/Z x R/Z (see Problem 2 of §I.5). Its torsion subgroup x R/Z, i.e., in CIL it corresponds to the subgroup 0/7L x 0/Z c consists of all rational linear combinations of cb i and co 2 . A basic theorem of Morde" -tPtr,s that the group E(0) of 0-points on an

44

I.

From Congruent Numbers to Elliptic Curves

elliptic curve E defined over 0 is a finitely generated abelian 'group. This means that (1) the torsion subgroup E(Q)tors is finite, and (2) E(Q) is iso) and a finite number of copies of morphic to the direct sum of E (Q 'tors Z: E(0) E(0),tors 0 1r. The nonnegative integer r is called the "rank" of E(0). It is greater than zero if and only if E has infinitely many 0-points. Mordell's theorem is also true, by the way, if 0 is replaced by any algebraic number field. This generalization, proved by Andre Weil, is known as the Mordell—Weil theorem. We shall not need this theorem for our purposes, even in the form proved by Mordell. For a proof, the reader is referred to Husemuller's forthcoming book on elliptic curves or else to [Lang 1978b]. We shall now prove that the only rational points of finite order on En are the four points of order 2: 0 (the point at infinity), (0, 0), (+n, 0). Proposition 17. #E„(1111) tors ,

= 4.

homomorphism from En (Q) i „„ to E(IF) which is injective for most p. That will imply that the order of En(0) -,tors divides the order of E(F) for such p. But no number greater than 4 could divide all such numbers #E„(Fp), because we at least know that #E(F) runs through all integers of the form p + 1 for p a prime congruent to 3 modulo 4 (see Proposition 16). We begin the proof of Proposition 17 by constructing the homomorphism from the group of 0-points on E to the group of F,,-points. More generally, we simply construct a map from PL to 1131p . In what follows, we shall always choose a triple (x, y, z) for a point in PZ in such a way that x, y, and z are integers with no common factors Up to multiplication by +1, there is a unique such triple in the equivalence class. For any fixed prime p, we define the image 13 of P = (x, y, z) e PZ , to be the point /5 = (.",f, y, 2 c , where the the bar denotes reduction of an integer modulo p. Note that is is identically zero triple, because p does not divide all three integers x, y, z. Also note that we could have replaced the triple (x, y, z) by any multiple by an integer prime to p without affecting P. - It is easy to see that if P = (x, y, z) happens to be in E(0), i.e., if y 2 z = x 3 — 122 xz' , then 15 is in E(ll). Moreover, the image of Pi + P2 under this map is 131 + P2, because it makes no difference whether we use the addition formulas (7.1)—(7.4) to find the sum and then reduce mod p, or whether we first reduce mod p and then use the addition formulas. In other words, our map is a homomorphism from En(0) to En (Fp), for any prime p not dividing 2n. We now determine when this map is not injective, i.e., when two points = (x i , Yi' z 1 ) and P2 = (X 2 , y2 , z 2) in PL have the same image 151 - = in inp . PROOF. The idea of the proof is to construct a group

)

Lemma. P --1 -152 if and only if the cross-product of P1 and P2 (considered as

vectors in R3) is divisible by p, i.e., if and only if p divides y i z 2 — y 2z 1 , x 2 z — x i z 2 , and x l y 2 x2y1.

45

§9. Points over finite fields, and the congruent number problem

PROOF OF LEMMA.

First suppose thatp divides the cross-product. We consider

two cases: •

(i) p divides x 1 . Then -p divides x 2 z 1 and x 2 y 1 , and therefore divides x„ because it cannot divide x l , Yi and z 1 . Suppose, for example, that p (an analogous argument will apply ifp, iz t ). Then P2 = y, Y2 , Y 12) 1;. Y1Y2, Y2 z 1) = Yi 9 Z 1) = Pi (where we have used the fact that p divides y1 2 2 — y2 z 1 ). (ii) p does not divide x 1 . Then P2 = (î 1 X 21 -5c- 1 Y2 Ï2 9 g-2 Y1 9 x221) =

y Y1 y 1) = P1 •

Conversely, suppose that P1 = P2 . Without loss of generality, suppose that plx i (an analogous argument will apply if Oh or pil'z i ). Then, since 121 11 Y2 , 1 - 2) = = P2 = (12, Y2 f2), we also have 1,4' x 2 . Hence, 132 = P1 = (-V211 5c-7 2 Y. 71 y Y2 i1 ). Since the first coordinates are the same, these two points can be equal only if the second and third coordinates are equal, i.e., ifp divides x i y2 — x 2 y 1 and x 1 z2 — x2 z 1 . Finally, we must show that p divides y 1 z 2 y2 z 1 . If both Yi and z i are divisible by p, then this is trivial. Otherwise, the conclusion will follow by repeating the above argument with x i , x2 replaced by Yi , y2 or by z i , z 2 . This concludes the proof of the lemma. We are now ready-to prove Proposition 17. Suppose that the proposition is false, i.e., that En (0) contains a point of finite order greater than 2. Then either it contains an element of odd order, or else the group of points of order 4 (or a divisor of 4) contains either 8 or 16 elements. In either case we have a subgroup S = {P1 , P2 1 Pm } En (0) tors where ni = #S is either 8 or else an odd number. Let us write all of the points Pi , I =-- 1, . . . , ni, in the form in the lemma: Pi = (xi , yi , zi). For each pair of points Pi , Pi , consider the cross-product vector (yi zi — yjzi , xjzi x i zj, x•yj xjyi)E ER 3 . Since Pi and Pi are distinct points, as vectors in ff;1 3 they are not proportional, and so their cross-product is not the zero vector. Let nu be the greatest common divisor of the coordinates of this cross-product. According to the lemma, the points Pi and Pi have the same image F = Pi in E(F) if and only if p divides nii . Thus, if p is a prime of good reduction which is greater than all of the nu, it follows that all images are distinct, i.e., the map reduction modulop gives an injection of S in En(Fp). , But this means_that for all but finitely many p the number ni must divide # En(Fp), because the image of S is a subgroup of order m. Then for 'all but finitely many primes congruent to 3 modulo 4, by Proposition 16 we must have p — 1 (mod m). But this contradicts Dirichlet's theorem on primes in an arithmetic progression. Namely, if m = 8 this would mean that there are only finitely many primes of the form 8k + 3. If m is odd, it would mean that there are only finitely many primes of the form 4mk + 3 (if 3 m), and that there are only finitely many primes of the form 12k + 7 if 31m. In ail cases, Dirichlet's theorem tells us that there are infinitely many primes of the given type. This concludes the proa of Proposition 17. .

.

1

,

4

46

1.

From Congruent Numbers to Elliptic Curves

Notice how the technique of reduction modulo p (more precisely,/ the use of Proposition 16 for infinitely many primes p) led to a rather painless proof of a strong fact : There are no "non-obvious" rational points of finite order on E. As we shall soon see, this fact is useful for the congruent number problem. But a far more interesting and difficult question is the existence of points of infinite order, i.e., whether the rank r of En(Q) is nonzero. As we shall see in a moment, that question is actually equivalent to the question of whether or not n is a congruent number. So- it is natural to ask whether mod p information can somehow be put together to yield information about the rank of an elliptic curve. This subtle question will lead us in later chapters to consideration of the BirchSwinnerton—Dyer conjecture for elliptic curves. , For further general motivational discussion of elliptic curves over finite fields, see [Koblitz 1982], We now prove the promised corollary of Proposition 17. Proposition 18. n is a congruent number if and only if En (Q) has nonzero

rank r. PROOF. First suppose that n is a congruent number. At the beginning of §2, we saw that the existence of a right triangle with rational sides and area n leads to a rational point on En whose x-coordinate lies in (Q + ) 2 . Since the x-coordinates of the three nontrivial points of order 2 are 0, +n, this means that there must be a rational point not of order 2. By Proposition 17, such a point has infinite order, i.e., r > 1. Conversely, suppose that P is a point of infinite order. By Problem 2(c) of §I.7, the x-coordinate of the point 2P is the square of a rational number having even denominator. Now by Proposition 2 in §I.2, the point 2P corresponds to a right triangle with rational sides and area n (under the o correspondence in Proposition 1). This proves Proposition 18. Notice the role of Proposition 17 in the proof of Proposition 18. It tells us that the only way to get nontrivial rational points of the form 2P is from points of infinite order. Let 2E„(0) denote the subgroup of En (0) consisting of the doubles of rational points. Then Proposition 17 is equivalent to the assertion that 2E„(0) is a torsion-free abelian group, i.e., it is isomorphic to a certain number of copies (namely, r) of Z. The set 2E„(0) — 0 (0 denotes the point at infinity) is empty if and only if r = O. We saw that points in the set 2E„(0) — 0 lead to right triangles with rational sides and area n under the correspondence in Proposition 1. It is 'natural to ask whether all points meeting the conditions in Proposition 2, i.e., corresponding to triangles, are doubles of points. We now prove that the answer is yes. At the same time, we give another verification of Proposition 18 (not relying on the homework problem 2(c) of §I.7). Proposition 19. There is a one-to-one correspondence between right triangles

with rational sides X < Y < Z and

n, and pairs of points (x, ±y) E

47

IV, Points over fi nite fields, and the congruent number problem

2E„(0) — O. The correspondence is: (x, X, Y, Zi—* (Z 214, + (Y 2 — X 2).Z/8). In light of Proposition 1 of §I.1, Proposition 19 is an immediate consequence of the following general characterization of the doubles of points on elliptic curves. Proposition 20. Let E be the elliptic curve y 2 = (x — e i )(x — e 2)(x — e s) with e l , e2 , e3 e O. Let P= (xo , yo)e E(Q) — O. Then Pe 2E(Q) — 0 if and only if xo — e l , .v„ — e 2 , xo — e 3 are all squares of rational numbers.

We first note that, without loss of generality, we may assume that xo = O. To see this, make the change of variables x' = x — x o . By simply translating the geometrical picture for adding points, we see that the point P' --7--- (0, yo ) on the curve E' with equation y2 = (x — e'l )(x — e'2)(x — where e; = ei — xo , is in 2E/(0) — 0 if and only if our original P were in 2E(G) — O. And trivially, the xo — ei are all squares if and only if the (0 — e;) are. So it suffices to prove the proposition with xo = O. Next, note that if there exists +2 E E(Q) such that 2Q = P, then there are exactly four such points Q, Q i , Q 2 , Q 3 eat)) with 2Q i = P. To obtain Qi , simply add to Q the point of order two (e t , 0)e E(0) (see Problem 5 in §I.7). Choose a point Q= (x, y) such that 2Q = P = (0, yo). We want to find conditions for the coordinates of one such Q (and hence all four) to be rational. Now a point Q on the elliptic curve satisfies 2Q = P if and only if the tangent line to the curve at Q passes through —P= (0, -Yo). That is, the four possible points Q are obtained geometrically by drawing the four distinct lines emanating from —P which are tangent to the curve. We readily verify that the coordinates (x, y) are rational if and only if the slope of the line from —P to Q is rational. The "only if" is immediate. Conversely, if this slope in is rational, then the x-coordinate of Q, which is the double root of the cubic (mx — yo) 2 = (x — e ,)(x — e 2 )(x — e s), must also be rational. (Explicitly ; x = (e l + e2 + e3 + m2)/2.) In this case the y-coordinate of Q is also rational: y = nix — y o . Thus, we want to know when one (and hence all four) slopes of lines from —P which are tangent to E are rational. A number m e C is the slope of a line from --'--P which is tangent to E if and only if the following equation has a double root: PROOF.

(mx — yo) 2 = (x — e l )(x — e2)(x — e 3) = x 3 4- ax 2 + bx + e,

(9.1)

with

a =--- —e l — e 2 — e 3 , ,

w)

'last equality c=

b= e1 e 2 + e1 e 3 + e 2 e 31

C = —e l e 2 e 3 = yg,

(9.2)

A comes from the fact that (0, y„ ) is on the curve

1.

48

From Congruent Numbers to Elliptic Curves

y 2 = x3 + ax2 + bx + e. Now if we simplify (9.1) and factor out x, our condition becomes: the following quadratic equation has a double root:

x2 + (a — m 2)x + (b + 2my0 ) = O. This is equivalent to saying that its discriminant must vanish, i.e.,

(a _ m 2) 2 _ 4(b + 2myo) =-- 0.

(9.3)

Thus, our task is to determine when one (and hence all four) roots of this quartic polynomial in m are rational. We want to find a condition in terms of the ei's (namely, our claim is that an equivalent condition is: —e€0 2). In (9.3), the a and b are symmetric polynomials in the es , but the yo is not. However, yo is a symmetric polynomial in the .\Ies . That is, we introduce fi satisfying J 2 = —e s . There are two possible choices for fi , unless es .= O. Choose the f in any of the possible ways, subject to the condition that yo = fi f2f3 . If all of the es are nonzero, this means that the sign off, and f2 are arbitrary, and then the sign off3 is chosen so that yo and fi f2f3 are the same square root of —e 1 e2 e3 . If, say, e 3 = 0, then either choice can be made for the sign off, , f2 , and of course f3 = O. In all cases there are four possible choices of the fi's consistent with the requirement that yo =fif2/3. . Once we fix one such choice f1 , f2 , f3 , we can list the four choices as follows (here we're supposing that e l and e2 are nonzero):

fi,f2,f3;

fi, --f2, -fi;

-fi,f2, -f3;

-fi,'-f2,f3- (9.4)

The advantage of going from the ei's to thef's is that now the coefficients of our equation (9.3) are symmetric functions off, , f2 , L. More precisely, if we set s i =J +f2 4-f3 , sl =fif2 +fi f3 + /2' f3 , s 3 = fi f2 f3 , the elementary symmetric functions, then

a =f12 +./.22 + f32

= s 2 — i2s;

b = 2f22 ± L2f32 +f221-32 j = 4— 2s 1 s3 ; f1 yo = S 3 . Thus, equation (9.3) becomes

0 = (m 2 — s? + 2s 2) 2 — 4(4 — 2s rs- 3 + 2ms3 ) = (m 2 ___. 4 ) 2 ± 4s 2(m2 _ s ?\ ) _ 8s3 (rn — s 1 ).

(9.5)

We see at a glance that the polynomial in (9.5) is divisible by m — s l , i.e., in = s 1 =f1 +f2 +f3 is a root. Since we could have made three other choices for the signs of the _I's , the other roots must correspond to these choices, i.e., the four solutions of equation (9.3) are:

mi "1

=1; +12 +f31

3 = —fi +f2 -f3,

m2 = fi - f2 - f3, m4 = -fi - f2 +f3-

(9.6)

49

§9. Points over finite fields, and the congruent number problem

We want to know whether the four values in (9.6) are rational. Clearly. If all of the fi are rational, then so are the m i . Conversely, suppose the m i are rational. Then fi = (m 1 + m2)/2, f2 = (m 1 + m3 )/2, and .f3 ,-------. (m i ± m4)/2 are rational. The conclusion of this string of equivalent conditions is: the coordinates (x, y) of a point Q for which 2Q = P are rational if and only if the f = \I ei are rational. This proves Proposition 20. El —

Finally, we note that Proposition 20 holds with G replaced by any field K not of characteristic 2. Essentially the same proof applies. (We need only take care to use algebraic rather than geometric arguments, for example, when reducing to the case P = (0, ye).) PROBLEMS

1. Prove that forf odd, any Fp -point of order 3 on the elliptic curve En : y 2 = x'

n 2x is actually an 1F-point; prove that there are at most three such points if p m- 3 (mod 4); and find a fairly good sufficient condition on p and f which ensures nine Fpj--points of order 3. —

2. For each of the following values of q, find the order and type of the group of Fg-points on the elliptic curve El : y2 = ,c3 — x. In all cases, find the type directly, if necessary checking how many points have order 3 or 4. Don't "peek" at the later problems. (a) All odd primes from 3 to 23.

(b) 9 (c) 27 (d) 71 (e) 1 1 3 . 3. Find the type of the group of Fp-points on the elliptic curve E5: y 2 = x3 25x for all odd primes p of good reduction up to 23. , 4. Prove that for a e CV the equation y 2 = x3 a determines an elliptic curve over any field K whose characteristic p does not divide 6 or the numerator or denominator of a; and that it has q + 1 Fg-points if q ,. 2 (mod 3). —

—

-

-

5. Prove that there are exactly 3 Fg-points of order 3 on the elliptic curve in Problem 4 if q . 2 (mod 3). -

-

6. For all odd primes p from 5 to 23, find the order and type of the group of Fp-points on the elliptic curve y2 = x3 — 1. 7. Prove that the torsion subgroup of the group of 0-points on the elliptic curve y2 = x3 — a has order at most 6, and that its order is equal to: (a) 6 if a = b6 for some be Q; (b) 2 if a = c3 for some c e Q with c not of the form --b 2 ; (c) 3 if either a = --d2 for some de a with d not of the form b 3, or if a = 4321) 6 for some beQ; _ (d) I otherwise. —

/

8. Show that the correspondence constructed in Problem 2 of §I.2 gives a one-to-one correspondence between - right triangles as in Proposition 19 and pairs + P of

50

L From Congruent Numbers to Elliptic Curvesnon-identity elements of the quotient group En(C)/E,(0)'torsion, which is isomorphic to 2E„(0) under the Map PH-• 2P. See Problem 2(b) of §I.7./

In the problems below, we illustrate how more information can be obtained using two additional tools: (1) the complex multiplication automorphism (x, y)t—*(— x, \I — ly) of the group of K-points of the elliptic curve y 2 = x3 — n 2 x if K contains a square root of — 1 ; (2) the action of Gal(Kalgc l/K) on the coordinates of the Ka lgcl-points. 9. Suppose that q=_::-. 3 (mod 4), and I is an odd prime. Prove that: (a) there are at most I Fg-points of order I on the elliptic curve y 2 = x3 — n2 x, and there are at most eight Fg-points of order 4; (b) the group of Fg-poinfs is the product of a group of order 2 and a cyclic group of order (q + 1) 1 2. 10. Suppose that q -a- 2 (mod 3), 2 4' AT, 34'N. Prove that there are at most N Fg-points of order Non the elliptic curve y2 = x3 — a.

1 1 . Suppose that q -=.-- 1 (mod 4), and I a 3 (mod 4) is a prime not equal to p. Let (/OE, /fl) be the 1-part of thetype of the group of Fg-points on the elliptic Curve y2 = x3 n 2x. Prove that a = 13. If ! = 2, prove that a = /3 or a = 13 + 1. —

12. The group of K-points on an elliptic curve is analogous to the multiplicative group K*. In Problem 11 of §1.7, we saw that for K = C, as a --* 0 the elliptic curve y2 =

(x2

a)(x. + 1) "becomes" the multiplicative group C. Now let K be the finite field Fq . In this problem we work with K*, and in the next problem we work with the group of K-points on an elliptic curve. Let 1 be a prime not equal to p, and , suppose that Fg contains all 1-th roots of 1, i.e., q =p 1 --=- 1 (mod /). —

(a) Show that the splitting field of x i — a, where a e Fq , has degree either 1 or I over Fq . (b) Show that the subfield of Fga igc l generated by all /m+1 th roots of 1 is IFt, where M' < M. (c) (For readers who know about badic numbers.) Construct an isomorphism between the additive group Z i of /-adic integers and the galois group over Fq of the field extension generated by all / th power division points (i.e., / th power roots of unity). -

-

-

13. Now let E be an elliptic curve defined over Fq . Suppose that there are / 2 Fg-points of order I. (a) Let A be an Fepoint, and let Fe be the extension of Fq generated by the coordinates of a solution a to the equation la = A (i.e., Fe is the smallest extension of Fq containing such an a). Show that there are / 2 Fe-points ai such that

lai = A. (b) Fix an Fe-point a such that la = A. Prove that the map al—*or(a) — a gives an imbedding of Gal(Fe/Fg) into the group of points of order ion E. (c) Show that r = 1 or L (d) What is the field extension of IF, generated by all points of order 1", M = 1, 2, . . . ? What is its galois group?

CHAPTER II

The Hasse—Weil L-Function of an Elliptic Curve

At the end of the last chapter, we used reduction modulo p to find some useful information about the ellipik, ,urves En : 372 =-- x' — n 2 x and the congruent number problem. We considered En as a curve over the prime field Fp where ' pi'2n; used the easily proved equality # E(1F) = p + 1 when p =--:. 3 (mod 4); and, by making use of infinitely many such p, were able to conclude that the only rational points of finite order on En are the four obvious points of order two. This then reduced the congruent number problem to the determination of whether r, the rank of En (Q), is zero or greater than zero. Determining r is much more difficult than finding the torsion group. Some progress can be made using the number of Fg-points. But the progress does not come cheaply. First of all, we will derive a formula for # En (Fq) for any prime power q = pr. Next, we will combine these numbers N. = Nr.p -= #En (Fp r) into a function which is analogous to the Riemann zeta-function (but more complicated). The behavior of this complex-analytic function near the point 1 is intimately related to the group of rational points. Before introducing this complex-analytic function, which is defined using all of the N,. p, we introduce a much simpler function, called the "congruence zeta-function'', which is built up from the Nr ----= N,.,p for a fixed prime p.

§1. The congruence zeta-function Given any sequence N„ r = 1, 2, 3, .. . , we define the corresponding "zetafunction" by the formal power series

Z(T) (1 exp ,.( ic /V T: r ), -7 ,

r=1

where

c°

li

k

exp(u) j=ef E0 k1 . k

(1. I)

52

,

11. The Hasse—Weil L-Function of an Elliptic Curve

At first glance, it might seem simpler to define Z(71) as IN.?"' ; however, the above definition has crucial properties which make it the most useful one (see the problems below). Let K be a field. Let A"K' denote the set of m-tuples of elements of K. By an "affine algebraic variety in in-dimensional space over K" we mean a system of polynomial equations of the form fj(x i , . . . , x„,) = 0, where •i E K[X 1 , . . . , Xm ]. For example, a conic section is a system of two equations

fi (x, y, z) = x 2 + y2 — z 2 = 0;

f2 (x, y, z) = ax + by + cz -I- d =--- 0

in 3-dimensional space over R. If L is any field extension of K, the "L-points" T for which all of the polyof the variety are the m-tuples (x i , . . . , x.) nomials fi vanish. By a "projective variety in ,n-dimensional space over K" we mean a system ' of homogeneous polynomial equations4(x 0 , x i , . . . , xm) in m + I variables. If L is a field extension of K, the "L-points" of the projective variety are the points in PT (i.e., equivalence classes of in + 1-tuples (xo , . .. , x„,), where (x0 , ... , x„,) -- (),x 0 , .. . , /7,X,n), ). E L*) at which all of the fi vanish. For example, in the last chapter we studied the Fq-points of the elliptic curve defined in PF by the single equation f(x, y, z) = y 2z — x 3 + 112xz 2 = O. (Note: Here .Xio = z, x i = x, x2 = y are variables for a projective variety in Pi, while in the last paragraph x i = x, x 2 = y, x 3 = z were variables for an affine variety in Q.) If we have a projective variety, by setting xo = 1 in the f., we obtain an a ffi ne variety whose L-points correspond to the m + 1-tuples with nonzero first coordinate. The remaining L-points of the projective variety will be the projective variety in Pr' obtained by setting xo = 0 in all of the equations and considering the equivalence classes of m-tuples (x 1 , . . . , x„,) which satisfy the resulting equations. For example, the elliptic curve with equation y 227 — x 3 + igxz 2 consists of the affine points—the solutions of y2 = x 3 — n 2x—and the points (x, y) of PI, for which —x 3 = 0, i.e., the single point (0, 1) on the line at infinity ..-.• = O. Let V be an affine or projective variety defined over Fq . For any field K m Fq , we let V(K) denote the set of K-points of V. By the "congruence zeta-function of V over Fi" we mean the zeta-function corresponding to the sequence N. = # V(FF qr). That is, we define co Z( V/Fq ; T) ,Fa exp (E # V(Fqr) TrI) . (1.2) r=1

Of course, iv,. is finite, in fact, less than the total number of points in A;', , (in the affine case) or PT, (in the projective case). We shall be especially interested in the situation when V is an elliptic curve defined over Fq . This is a special case of a smooth projective plane curve. A projective plane curve defined over a field K is a projective variety given in Pi by one homogeneous equation f(x, y, z) = O. Such a curve is said to be "smooth" if there is no Kaig d-point at which all partial derivatives

53

§1. The Congruence zeta-function i

vanish. This agrees with the usual definition when K = C ("has a tangent line at every point"). , It turns out that the congruence zeta-function of any elliptic curve E ( defined over Fq has the form 4 ; T)—

1— 2aE T ± qT2 Z(EIF

(1— T)(1 — qT)

(1.3)

where only the integer 2aE depends on E. We shall soon prove this in the case of the elliptic curve En : y2 = x3 — n2x. Let a be a reciprocal root of the numerator; then 1_— 2aE T + qT2 = (1 — ŒT)(1 — IT). If one takes the logarithmic derivative of b6th sides of (1.3) and uses the definition (1,1), one easily finds (see problems below) that the equality (1.3) is equivalent to the following formula for N,. = #E(EFq r);

, Nr = qr + 1 _ a r _ (q /0 r . )

As a special case of (1.4) we have

N1 = #E(F q ) = q + 1 — a — --qa- = q + 1 — 2aE . Thus, if we know that Z(EfiF q ; T) must have the form (1.3), then we can determine aE merely by counting the number of Fg-points. This will give us Z(ElFq ; T), the value of a, and all of the values N,. = # E(Fq r) by (1.4). In other words, in the case of an elliptic curve, the number of Fg-points determines the number of Fe-points for all r. This is an important property of elliptic curves defined over finite fi elds. We shall prove it in the special case y2 = x 3 — n 2x. It will also turn out that a is a quadratic imaginary algebraic integer whose complex absolute value is \f-.4. In the case y2 = x3 — rgx, it will turn out that a is a square root of —q if q F.:- 3 (mod 4), and is of the form a + bi, a, be Z, a' + b2 = q, if q -m-- 1 (mod 4). This situation is a special case of a much more general fact concerning smooth projective algebraic varieties over fi nite fields. The general result was conjectured by Andre Weil in [Weil 19491 and the last and most difficult part was proved by Pierre Deligne in 1973. (For a survey of Deligne's proof, see [Katz 19764.) We shall not discuss it, except to state what it says in the case of a smooth projective curve (one-dimensional variety):

(0 Z(VI1F q ; T) is a rational function of T (this is true for any variety without the smoothness assumption) which for a smooth curve has the form P(T)I(1 — T)(1 — qT). Here P(T) has coefficients in 1 and constant term 1 (equivalently, its reciprocal roots are algebraic integers). (ii) If V was obtained by reducing modulo p a variety P defined over 0, then deg P = 2g is twice the genus ("Betti number") of the complex analytic manifold P. Intuitively, g is the "number of handles" in the corresponding Riemann surface. An elliptic curve has g = 1, and the , Riemann surface in Fig. II.1 has g =3.

11.

54

The Hasse—Weil L-Function of an Elliptic Curve'

Figure III

(iii) If a is a reciprocal root of the numerator, then so is (Va. (iv) All reciprocal roots of the numerator have complex absolute value

14.

One reason for the elegance of the Weil conjectures is the intriguing indirect connection between the "physical" properties of a curve (e.g., its number of handles as a Riemann surface when considered over C) and the number theoretic properties (its number of points when considered over Fe). Roughly speaking, it says that the more complicated the curve is (the higher its genus), the more N,'s you need to know before the remaining cities can be determined. In the simplest interesting case, that of elliptic curves, where g ----= I, all of the N,.'s are determined once you know N1 .

PROBLEMS

1. Show that if N„ = Nr* + Nr*** and Z(T), Z*(T), Z**(T) are the corresponding zeta functions, then Z(T) = Z*(T). Z**(T); and if N,. = Nr* — N r**, then Z(T) -7---Z*(T)1Z**(T). -

2. Show that if there exists a fixed set a i , . . . , as , Pi , • • • , N. = ji"; + - • • + fir arl — • • — 4, then

A such that for all r we have

—

Z(T)=

(1 — Œ1T)(1 — a2T)- • •(1 — as T) . (1 — fi' 1 T)(1 — 13 2 T)- (1 AT) —

—

3. Prove that if N, < CA' for some constants C and A, then the power series Z(T) converges in the open disc of radius 1/A in the complex plane. 1, r even; 4. Show that if Nr =t_ , then Z(T) is not a rational function; but if N, = 0 r odd, r even; then Z(T) is rational. In the latter case, interpret N, as the number r odd, of Fr-solutions of some equation.

1.2:

5. The Bernoulli polynomials .13„(x)e Q [x] have the properties: (i) deg Br = r; (ii) for all M, Br (M)— 14(0) = r( 1'-1 + 2 1 + • - . + (M Dr- '). Now for fixed M let N,_ 1 = .-(B,.(M) — B r(0)). Find the corresponding Z(T). (Cultural note: Bi (x) = x — 4, B2 (X) = X2 - X ± *, etc.; they are uniquely determined by properties (i) and (ii) along with the normalization requirement that S ) Br (x)dx =-- 0 for r .>:.1. One way to define them is by equating terms in the relation: te"Ret — 1) = Ecr°,0B,(x)trIr!.) —

55

§1. The congruence zeta function -

6. Suppose that / is a prime, q is a power of another prime p, q # 1 (mod /), q # 1 (mod / 2 ). (a) For fixed M, let N,. = # {dye Fgrix im = 11. Find the corresponding Z(T). (b) Now let N,. = # tx e Fgrixim = 1 for some M}. Find the corresponding zetafunction. Is it rational? 7. A special case of an affine or projective variety V is the entire space, corresponding to the empty set of equations. Let A'; denote in-dimensional affine space (the usual space of m-tuples of numbers in the field K), and let P'; denote projective space, as usual. (a) What is Z(A T /F.? ; T)? k = in, in — 1, (b) Find Z(PT /Fgq ; T) by writing In as a disjoint union of ... , 0, and using Problem 1. (c) Also find Z(P T IfFq ; T) by counting equivalence classes of (in + 1)-tuples, q answers agree. and check that your

M‘ ,

8. Show that, if V is a variety in ATq or P 7q, then Z(V IFq ; T) converges for I Ti < q- ni. 9. If one wants to prove that Z(V1F q ; T)eZHTE with constant term 1 for any affine or projective variety V, show that it suffices to prove this when V is any affine variety. Then show that it suffices to prove this when V is given by a single equation. Show that the rationality assertion Z(VIF q ; T)EQ(T) can also be reduced to the case of an affine variety V defined by a single equation. A variety defined by a single equation is called a "hypersurface". 10. Find the zeta-function of the curve y 2 = x 3 — n 2x in QV if pi2n, i.e., p is not a q prime of good reduction. 11. Find the zeta function of the hypersurface 'inAt defined by x 1 x 2 — x 3 x4 = O. q -

gn r.

12. Let Nr be the number of lines in Find its zeta function. (it is possible to view the set of k-dimensional subspace: in In as a variety, called the grassmannian ; in our case k = 1, m = 3.) -

13. Using the form (1.3) for the zeta-function of an elliptic curve, where the numerator has reciprocal root a, show that N,. is equal to the norm of 1 — Œ. Now, in the situation of Problem 13 of §1.9, suppose that E has / 2 Fg-points of order /, and no Fg-points of exact order 1 2 . Prove that the field extension of Fg generated by the coordinates of the points of order 114+1 is Fqt". (Note the close analogy with the multiplicative group F.:, with q E.--- 1 (mod 1) but q # I (mod / 2), where the field generated by all / m+i -th roots of unity is Fe.) 14. Let V be an affine algebraic variety defined over K by equations fi(x l , . . . , x) = O. By the coordinate ring R(V) we mean the quotient ring of K[x,, . . . , x„,] by the ideal generated by all of the fi . Let P ---4-- (al , . . . , am ) be a Ka'gc l-point on V. Let L = K(a l , . . . , a,n) be the finite extension of K generated by the coordinates of P. L is called the residue field of P, and its degree over K is called the residue degree. (a) Show that the map xi t--ai is well-defined on R(V), and extends to a homomorphism whose kernel is a maximal ideal m(P) in R(V). (It is not hard to prove that every maximal ideal of R(V) arises in this way.) 'how that m(P')= m(P) if and only if there is an isomorphism from L to L'

56

11. The Hasse—Weil L-Function of an Elliptic Curve (the residue fields of P and P', respectively) which takes ai to a;. Thus, the maximal ideal m(P) corresponds to d different Ka ig c i-points P on V, where d --7-- {R(V)Im(P): K] is the residue degree of any of the points P.

15. In the situation of Problem 14, let K = IF,i • For a given Ka fg c l -point P, the residue field is Fei for some d. Then P contributes I to each N,. for which r is a multiple of d. That is, the contribution of P to the exponent in the definition of the zetafunction is Eic,"1 1 T" lkd. Then Z( VifF, ; T) is exp of the sum of all contributions from the different Ka igc l-points P. Group together all points corresponding to a given maximal ideal, and express Z(VIE .,7 ; T) as the product over all maximal ideals m of (1 — Vegm)' . Then show that the zeta-function belongs to 1 + TUT]]. (Cultural note: If we make the change of variables T = q-s, and define Norm(m) to be the number of elements in the residue field, i.e., Norm(m) = gdegm , then we have Z(V IfF q ; sq-s)= ri.(1 — Norm(m)) -1 , which is closely analogous to the Euler product for the Dedekind zeta-function of a number field: C K (s) = n vo — Norm(p)r', in which the product is over all nonzero prime ideals of the ring of integers in the field K. In a number ring, a nonzero prime ideal is the same as a maximal ideal.) 16. Prove that if Z( V/F.7 ; T)eG(T), then the numerator and denominator are in 1 + TZ[T] (equivalently, the a's and /J's in Problem 2 are algebraic integers).

§2. The zeta-function of En We now return to our elliptic curve E„, which is the curve y2 = x3 — n2 x, where n is a squarefree positive integer. More precisely, En is the projective completion of this curve, i.e., we also include the point at infinity. En is an elliptic curve over any fi eld K whose characteristic does not divide 2n, and, as we have seen, it is sometimes useful to take K =--- f,,, or more generally K = Fq . The purpose of this section is to express the number of Fg-points "on En in terms of "Jacobi sums". To do this, we first transform the equation of En to a "diagonal form". We say that a hypersurface f(x i , . .. , x) = 0 in A';‘' is "diagonal" if each monomial in f involves at most one of the variables, and each variable occurs in at most one monomial. For example, the "Fermat curve" x" + yd = 1 is diagonal. It turns out that diagonal hypersurfaces lend themselves to easy computation of the N,. (much in the same way that multiple integrals are much easier to evaluate when the variables separate). We shall not treat the general case, but only the one we need to evaluate N,. ---.-- #En (Fgr). (For a general treatment of diagonal hypersurfaces, see [Weil 1949] or [Ireland and Rosen 1982, Chapter II].) We first show a relation between points on E„: y2 = .X 3 — n 2x and points on the curve EL : u 2 = y4 + 4n 2 . As usual, we suppose that p,t2n. First suppose that (u, y) is on E. Then it is easy to check that the point (x, y) = (1-(u + y 2); -1-y(u + y 2)) is on E. Conversely, if (x, y) is on En and its x-coordinate is nonzero, then we check that the point (u, y) = (2x — y2/x2 , y/x) is_on E.

57

§2. The zeta-function of En

Moreover, these two maps are inverse to one another. In other words, we have a one-to-one correspondence between points on E,Ç and points on En — 1 (O , 0)1. Let N' be the number of Fg-solutions (u, y) to u2 = c4 + 4n2 . Then the points on our elliptic curve consist of (0, 0), the point at infinity, and the N' points corresponding to the pairs (u, y). In other words, N 1 = #E„(Fq) is equal to N' + 2. So it remains to compute N'. The advantage of the equation u 2 = t24 ± 4n 2 is that it is diagonal. The basic ingredients in determining the number of points on a diagonal hypersurface are the Gauss and Jacobi sums over finite fi elds. We shall now define them and give their elementary properties. Let 1//: Fq -+ C* be a nontrivial additive character, i.e., a nontrivial homomorphism from the additive group of the finite field to the multiplicative group of complex numbers. (Since 1F,1 is finite, the image must consist of roots of unity.) In what follows, we shall always define iIi(x) = .1.1. x, where = e 2 ", and Tr is the trace from Fq to Fp . Since the tracp is a nontrivial additive map, and its image is Fp = LW, we obtain in this way a nontrivial additive character. Now let x: F: -.- C* be any multiplicative character, i.e., a group homomorphism from the multiplicative group of the finite field to the multiplicative group of nonzero complex numbers. In what follows, the additive character 0 will be fixed, as defined above, but x can vary. We define the Gauss sum (depending on the variable x) by the formula

g(X) =

E x(x)kk(x) xe Fq

(where we agree to take x(0) = 0 for all x, even the trivial multiplicative character). We define the Jacobi sum (depending on two variable multiplicative characters) by the formula

x1(x)x2(1-x). xe Fq

The proofs of the following elementary properties of Gauss and Jacobi sums are straightforward, and will be left as exercises. (Here x„i, denotes the trivial character, which takes all nonzero elements of Fg to 1; xl Xi , and X2 denote nontrivial characters; and j? denotes the complex conjugate (also called "inverse") character of x, whose value at x is the complex conjugate of X(4)

( 1) g(Xtriv) = — 1; J(xtriv , xtriv ) ------ q — 2; J(Xtriv,

Ax, k) = — A— 1);

Ax1, x2) := Ax2, xi);

x) = — 1;

(2) g(X) ' g(Z) = X( — 1 )q; WWI = /-4; (3) AX17 X2) = g(X1)9(X2)/9((1 X2) if X2 0 We now proceed to the computation of the number N' of u, y E Fq satisfying u2 = t,' + 4n 2 .--The key observation in computing N' is that for any a 0 0 _ in Fq and any m dividing q — 1, the number of solutions xE Fq to the equation xm = a is given by:

58

II.

The Hasse—Weil L-Function of an Elliptic Curve

(2.1)

x(a), xm= i

where the sum is over all multiplicative characters whose m-th power is the trivial character. Namely, both sides of (2.1) equal m if a is an m-th power in Fl and equal 0 otherwise; the detailed proof will be left as a problem below. By Proposition 16 of the last chapter, we know that N1 .--= q + 1 if qa---- 3 (mod 4). In what follows, we shall suppose that q F.---- 1 (mod 4). In counting the pairs (u, y), we count separately the pairs where either u or y is zero. Thus, we write

N' = # lu e Fq iu2 = 4n2 } ± # {ye Fq10 = y'' +4n 2 }

(2.2)

+ # u, v e EF:iu 2 = y4 + 4n 2 }. {

The first term in (2.2) is obviously 2 (recall that we are assuming that p 42n). We use (2.1) to evaluate the second term. Let x4 be one of the characters of IF: having exact order 4, i.e., x4 (g) = i for some generator g of the cyclic group O. Then, by (2.1), the second term in (2.2) equals 4

E x4(- 4n 2) = 2+ 2

(2.3)

4 (-4n 2)

i=1

(where we use the fact that —4n 2 is a square in P ) . Finally, we evaluate the third term in (2.2). Let x2 denote the nontrivial character of order 2 (i.e., x2 = xi). Using (2.1) again, we can write the third term in (2.2) as

E E Aooa - 4n2). /4 2 = a} • # {v4 = b} = E # { aEF*q a-4n 2 00 j1,2,3,4 a,bEiF q* ,

a=b+4n 2

k=1,2

Note that since xi(0) = 0, we can drop the condition a — 4n 2 o 0 on the right. We now make the change of variable x = al4n2 in the first summation on the right. As a result, after we reverse the order of summation, the right side becomes

x.4(-4n 2 ) E x'(x)x-4(l - x) =

E

j=1,2,3,4 k=1,2

x€F*(1

E x4(-4n 2)./(A5

xi).

j =1,2,3,4

k=1,2

Finally, bringing together the three terms in (2.2) and using property (1) of Jacobi sums when A or x.,1 is trivial or they are conjugate to one another, we obtain:

N' = 4 + 2x4 (-4n 2) + E x!,(-4n2)J(x2, z4) + q — 2 + 3 • (— 1) j=1, 3 +

2x4 (-4n 2) . ( —1)

(2.4)

= q — 1 -I- x4( —4 n 2 )(J(X21 X4) ± AX29 Z4)) • In the problems we show that x4( — 4) = 1. Hence, x 4 ( -4n 2) = Z2 ( 1 ). Thus, if we set Œ=

Œn. q

(-17-f -- 7,-.2 ( 1 '

(2.5)

59

§2. The zeta-function of E„

we conclude that Ni = #En( q)

(2.6)

q +lŒ — Z.

Notice that a is an algebraic integer in 0(i), since the values of x2 and x4 in the definition of Ax2 , x4) are all ± 1, +i. We now pin down the Gaussian integer a = a + bi, at least in the case when q = p is a prime congruent to I mod 4 or q = p2, is the square of a prime congruent to 3 mod 4. By property (3)relating Jacobi to Gauss sums, we have

cx = X2(n)g(X2)g(X4)/g(Z4), and hence, by property (2), we have i ce = a2 ± b 2 = q. In the two cases q=p 1 (mod 4) and q = p 2 , p 3 (mod 4), there are very few possibilities for such an a. Namely, in the former case there are eight choices of the form +a + bi, +b + ai;and in the latter case there are the four possibilities +p, +pi. The following lemma enables us to determine which it is.

Lemma 1. Let q 1 (mod 4), and let h and z4 be characters of Pq of exact order 2 and 4, respectively. Then 1 J(x 2 , x4) is divisible by 2 2i in the ring Z[i]. We first relate ./(x2 , x4) to ./(x4 , X4) by expressing both in terms of Gauss sums. By property (3), we have: Ax 2 , X4) = AX4, X4)g(X2) 2/g(X4)g(i4) = X4( 1)J(1 4 , 7.4) by property (2). Next, we write PROOF.

AX4, X4) = >

=

± 2 E1 x4(x)x4(1

x), where E' is a sum over (q — 3)/2 elements, one from each pair x, 1 4(x)4(1

x, with the pair ( P +2 1) , (P +2 1) omitted. Notice that x4 (x) is a power of i, and so is congruent to 1 modulo 1 i in [i] ; thus, 2z4 (x)x4 (1 x) 2(mod 2 ± 2i). As a result, working modulo 2 + 2i, we have ./(x4 , X4) .2=-. q — 3 + XL2P+2 1)) 1 (mod 4)). Returning to J(x 2 , x4), we obtain: 2 + X4(4) ( since q I +

Ax2,

(mod

X4) = I + x4( — 1)Ax4 , ;(4) FEI + x4( —4) + 2 x4( — 1)

2 + 2i).

Since 4( -4) = 1, as mentioned above (and proved in the problems below), and since 2(1 + x4( — 1 )) = 0 or 4, it follows that I + Ax 2 , z4) is divisible by 2 + 2i, as claimed. We now have the basic ingredients to prove a formula for Z(EnIFp ; T).

Theorem. Let En be the elliptic curve y 2 = x3 n2x defined over Fp , where p41 2n. -then Z(E nIEFp ; where elemt

1 — 2aT pT 2 (1 — aT)(1 = (1 p79 ) = (1 +.•.

c7cT) —

pT) 5

(2.7)

e a; a = ifp Er.- 3 (mod 4); and tfp 1 (mod 4), then a is an 1 1 of norm p which is congruent to ( 17,-) modulo 2 + 2 1.

60

Ii. The Hasse—Weil L-Function of an Elliptic Curve

Before proving the theorem, we note that in the case p 1-.-. 1 (mod 4) it says we choose cx = a + bi with a odd (and b even), where the sign of a is determined by the congruence condition modulo 2 + 2i. There are two possible choices a + bi and a — bi; and of course the formula (2.7) does not change if we replace a by its conjugate. In order to obtain Z(En/Fr ; T), we must let the power of p vary, and determine Nr -7---- #E„(Fpr) for p..--a.- 1 (mod 4) and N2 r = # En(Fq r) for p m 3 (mod 4), g = p2 (since we know that IV,. == pr + 1 for odd r in that case). So we fix g equal to p in the first case and equal to p2 in the second case (in either case g1-7-.--_. 1 (mod 4)), and we replace g by gr throughout the work we did earlier to find a formula for #E,,(Fq), q a-- 1 (mod 4). Because the r is varying, we need a notation to indicate which x2 and x4 we are talking about, i.e., to indicate for which finite field they are multiplicative characters. Let x2 , 1 = x2 denote the unique nontrivial character of Fq* of order 2, and let x4, i =--- x4 denote a fixed character of Fq* of exact order 4 (there are two, the other one being y4). Then by composing x2 or x4 with the norm from Fqr to Fq , we obtain a character of Pq`r of exact order 2 or 4, respectively. We denote these characters x2, and x4„. For example, if g is a generator of IF: such that x4 (g) = i, and if g,. is a generator of Wq*,- whose +q+ •••;1-qr - 1 = g, then we have x 4„(gr) = i. If IN, denotes norm is g, i.e. , ( gr )1 the norm from Fee to Fq , we can write our definitions: PROOF.

= X4 0 NI-, X2,r = X20 N r . With these definitions, using (2.5) and (2.6), we can write: X4,r

# En(Fqr) = qr + 1 — where

an, q r

(2.8)

an, q r — ain,q r,

(2.9)

( = — X2, r 1) g (X2 ' r)g(X41r) -

We now use a basic relationship, called the Hasse—Davenport relation, for Gauss sums over extensions of finite fields. The Hasse—Davenport formula Is

:

—g(° NO ---= ( — 900) r -

(2.10)

The proof of this fact will be given in a series of exercises below. Applying (2.10) to the three Gauss sums in (2.9), and observing that x 2 ,(n) = X2(n) = X2(n) r, we copclude the following basic relationship:

an, q r :=7-

ant. , q .

(2.11)

The theorem now follows quickly. First suppose p..-€:- 1 (mod 4), in which case g --= p. Then x 2 (n) is the Legendre symbol Cp. Using (2.5) and Lemma 1, we find that cx --= an, p is a Gaussian integer of norm p which is congruent to CD modulo 2 + 2i; and, by (2.9) and (2.11),

61

§2. The zeta-function of En

Nr = pr + I — ar dr. This proves the the,orem when p 1 (mod 4) (see Problem 2 of §11.1). Now suppose thatp 3 (mod 4), q = p 2 . Then x2 ( 12 ) = 1, since all elements of Fp are squares in [Fp2. Then Lemma_ I tells us that am is a Gaussian integer of norm q which is congruent to I mod 2 + 2i. Of the four Gaussian integers j = 0, 1, 2, 3, having norm q, only am = p satisfies the congruence condition. Then, by (2.6) and (2.11), we conclude that for r even we have —

Nr = #E„(Fq,12) = pr + 1 —

_py /2

Since Nr = pr + 1 for odd r, we have for any r:

= Pr

± - \/-13)r (-

This completes the proof of the theorem. We conclude this section by calling attention to the role Lemma 1 has played in pinning down the reciprocal roots a and Fie in (2.7). The congruence condition in Lemma I will again be needed when we start working with the Hasse—Weil L-function of the elliptic curve En , which combines the a's for different primes p. In that context, Lemma 1 is a special case of a general fact about how Jacobi sums vary as we vary, the prime p. The general case is treated in [Weil 1952 ]. PROBLEMS 1. Prove properties (1)-(3) of Gauss and Jacobi sums that were given in the text. 2. Let G be a finite group, and let Ô denote the group of characters x (i.e., of homo' morphisms X: G -0 t*). Recall that for any nontrivial x e 6, EaEG Z(g)= O. Notice that any fixed g e G gives a character g: xi--4x(g) on the group 6, and also on any subgroup S c Ô. Apply these general considerations to the case when G = IF: and S is the subgroup of characters x such that xm =1. In that way prove the relation (2.1) in the text.

3. Let q 1 (mod 4), and let x4 have exact order 4. Show that x4 (4) and x4( - I) are both equal to 1 if q E: 1 (mod 8) and equal to - 1 if q 5 (mod 8). Conclude that X4( -4) = 1 in all cases. 4. Show that g(x 2)2 = (-1)( ' 2q. It is somewhat harder to determine which square root to take to get g(x2) (see [Borevich and Shafarevich 1966, pp. 349-353]). Compute g(x2) when q = 3, 5, 7, 9. 5. For q 1 (mod 4), again let h be the nontrivial quadratic character, and let x, and 2- 4 be the two characters of exact order 4, Compute J(72, Z-4) and 4/(z 2 „ 2- 4) directly from the definition when q = 5, 9, 13, 17. 6. Show that if x2 is the nontrivial quadratic character of IF: and x is any nontrivial character, then J(x2 , x) = x(4)J(x, x).

7. Let x3 and X3 be the two characters of IF: of order 3, where q 1 (mod 3). Compute ../(x3 , x3) and J(23 , Z3) directly from the definition when q = 7, 13.

\

62

H. The Hasse—Weil L-Function of an Elliptic Curve

8. (a) Notice that we proved that the number N,. of Fqr-points on En is independent of n if r is even. Show this directly. (b) Also notice that N,. does not change if n is multiplied by an integer which is a square in F. This is for the same reason that we could, without loss of generality, reduce to squarefree n when considering 0-points. Namely, if K is any field not of characteristic 2 and if in, tie K*, construct a simple correspondence between En(K) and En„,2(10. 9. This problem concerns a more general definition of Gauss sums, examples of which will occur later in the chapter. Let R be the ring of integers in a number field K, and let I be a nonzero ideal of R. Then RII is a finite ring. Let tif : R11 -4 C* be an additive character which is nontrivial on any additive subgroup of RII of the form J11 for any strictly larger ideal j = I (including the "improper ideal" J = R, which will be the only such J if I is a prime ideal). Define the norm NI — # (R/1). Let x : (R1I)* ---) C* be any multiplicative character'. Take x(x)= 0 for x ER11 not prime to I. Define g(x) = g(x, III) = E x(x)0(x), where the summation is over def

RII. (a) Prove that Zx(x)ip(ax) 7.--- x7-(a)g(, tp) for any a e (RII)*. In parts(b) and (c-) we suppose that x is "primitive" modulo I. By definition, this means that, for any strictly larger ideal J = I, x is nontrivial on the subgroup of (RII)* consisting of elements congruent to 1 modulo J. (b) If x is primitive, show that the formula in part (a) holds for all a E RII. (c) For x primitive, prove that g(x, Og ( ? , Ifr) = x(- l)1, and ig(x, 1//)! = Some examples of the characters and Gauss sums in this problem are: (1) if I is a prime ideal with residue field Fq , then property (2) of Gauss sums in the text is a special case of part (c); (2) if R = Z and I is the ideal (N), then x is an ordinary Dirichlet character. NI= N, we often take t/i(x) = e27N1 and "primitive" means that the value of x(x) for xe (ZINZ)* does not depend only on its residue modulo some proper divisor of N; (3) later in the chapter we will encounter examples where XE

R =Z[i].

Problems 10-17 will lead to a proof of the Hasse—Davenport relation. 10. Let S be the set of all monic polynomials in Fq [x], and let S 1" denote the subset of all irreducible monic polynomials. Subscripts will indicate degree. By writing xqr — x = H2 ,(x - a), prove that xq r —x=rif, where the product is over all fin sr for all qd dividing r. 11. Let 0 be a nontrivial additive character and x a multiplicative character of N. If f€ S is written in the form f(x) =x=d _ e 1 x d —1 4_ . . . .4_ (...... rd) ed , define a map 2: S --+ C by 2( f) = x(cd)qi (c i ). (If f= 1 is the constant function in So , then define 2(I) = I.) Prove that 2(f1 f2) = 2(1 1 )2(1 2 ) for fi ,j E S. 12. Prove that the Gauss sum can be written g(x) = EfES I 2 (f). 13. Suppose that oceFqr satisfies monic irreducible polynomial fESP, where dlr. Then show that 2(f )'M = x r (a). Iiir (a), where the subscripts here indicate the characters of Fqr obtained by composing with the norm from Fqr to Fq (in the case of a multiplicative character) or with the trace from Fqr to Fq (in the case of an additive character). 14. Prove that g (x r) = —E dir E,R sjr ir dit(fyi d.

63-

§2. The zeta-function of En

15. Prove the power series identity ERs ,l(f)Pleg 1 -z---

n„ s irr(l — ).(f)Tdeg 1)1.

16. Show that if d> 1, then IfEsd 2(f) = O. 17. Taking the logarithmic derivative of both sides in Problem 15, prove that ( _ or- 1 g (x)r = E E cbt(f)rld 1 dlr. f € sirdr

and conclude the proof of the Hasse—Davenport relation.

18. (a) Show that the ideal (2) in Z[i] is the square of the prime ideal (1 + i); and that any element a e Z[i] not in (1 + i) has a unique associate iia which is congruent to 1 modulo (1 + i) 3 = (2 + 2i). (b) Show that the ideal (3) in l[ad, co = (— I + V — 3)/2, is the square of the prime ideal (J-3); and that any element a e Z[w] not in (I— 3) has a unique associate ( — (..o)ja which is congruent to 1 modulo 3. 19. - Consider the elliptic curve y2 = x3 — a, a e O. Recall from Problem 4 of §I.9 that it has g + 1 points if g .1.---._- 2 (mod 3). So suppose that q 71-7- 1 (mod 3). Let x 2 be the nontrivial quadratic character of iFq*, and let x 3 be either of the nontrivial characters of Fg* of order 3. Prove that the number of Fg-points on the elliptic curve is equal to

q + 1 + X2( -- a)(X3(a)AX2, X3) + X3(a)J(X29 X3)). 20. Let g r-,- 1 (mod 3), and let x3 be a nontrivial character of F: of order 3. (a) Prove that q./(x 3 , x 3) = (b) Prove that ./(x 3 , x 3) -=- —1 (mod 3) in Z[w], where (.0 = (— 1 + 0)/2. (c) Show that Ax3, X3) = p if g = p 2 , p m 2 (mod 3). (d) Suppose that g := p.7.-_ 1 (mod 3). Choose a + bco so that p = la + bcol2 = a2 — ab + b 2 . Show that exactly one of the two ideals (a + bco), (a + bCo) (without loss of generality, suppose the first one) has the property that

x 3 (x) .--i-: x( P' v3 (mod a + bw)

for all

x e Fp .

(e) Let g = p m 1 (mod 3), and choose a + bco as in part (d). Show that —./(x 3 , x 3 ) is the unique element generating the ideal (a + bw) which is congruent to I modulo 3.

21. Let N,. be the number of Fv-points on the elliptic curve y 2 = x 3 — a, where a E Fp*, p 0 2, 3. (a) If p m 1 (mod 3), let x2 and x3 be nontrivial characters of Fp* of order 2 and 3, respectively, and set a = — X2( — a)X3(4CI)J (X3, X3). Prove that N,. = Pr + I — (b) If p L-7 2 (mod 3), let x2 and x3 be nontrivial characters of Fp of order 2 and 3, respectively. First prove that x2 and x 3 are both trivial on elements of Fp*. Now set a = ij). Prove that N. = p r + 1 — a' — . (c) Conclude that in both cases the zeta-function is (1 — 2c T + pT2)1(1 — T)(1 — pT), where c = 0 if pa.-._-- 2 (mod 3), and c = —x 2 (—a)Re(x 3 (4c)J(x 3 , x 3 )) if p=_ 1 (mod 3).

22, Let C c Pi be the curve y2 + ay = x3, a e K (i.e., P(x, y, z) = y 2z + ayz 2 — x3). (a) Find conditions on the characteristic of K and on a e K which are equivalent ' to C being smooth at all of its Ka 1g cl -points.

11. The Hasse-Weil L-Function

64

of an Elliptic Curve

(b) Let K = 11 2r. Show that for r odd, # C(F2r) = 2r + 1 (this is independent of a). . (c) Let K =.- IF4r, aEK, a O. Let ;( 3 be a nontrivial character of K* of order 3, and let 2-6 be the other one. Derive the formula: # C(F4r) =-- 4r + 1 ± i3(a)J(3, X3) + X3(a)J(3, Y3). (d) In the situation of part (c), show that Ax 3 , )( 3) = ( — 1y_'2' then find a formula for Z(C/F 2 ; T) when a = 1. (e) Now let K = 0, a --=-- 1. Find a linear change of variables (with coefficients in 0) which transforms C to the elliptic curve y 2 = x 3 + 16. ;

23. Let N„ be the number of Fpr-points on the elliptic curve En y2 = x3 — n2x, where :

p,t2n. (a) Show that if p a 3 (mod 4), then Nr is independent of n; it equals pr + 1 if r is odd ; and it equals (p'I 2 — (— l)') if r is even. . (b) Now let p.--_.-: 1 (mod 4). In Problem 8 above, we saw that N„ is independent of n if r is even, and if r is odd it depends only on whether n is a quadratic residue or nonresidue modulo p. For odd r, let Nrres and N:r denote the N, for n a residue and for n a nonresidue, respectively. Show that N2r is a multiple of the least common multiple of N,`" and Nrnr. (c) For p ..= 5, make a table of Nrres and Nrnr for r = 1, 3, 5, 7 and a table of N, for r = 2, 4, 6, 8, 10, 12, 14. In each case, determine the type of the abelian group E,s(Fpr). (See Problems 9 and 11 in §1.9.) (d) For p .= 13, make a table of Nr"s and Nr" for r = 1, 3, 5 and a table of Nr for r =-- 2, 4, 6, 8, 10; and in each case, find the type of E n (Fpr).

§3. Varying the prime p In this section we look at the elliptic curve En : y2 = x3 — n 2 x and its zetafunction Z(E,TIFp ; T) as p varies. We shall later want to combine these zeta-functions for the various p into a single function, called the Hasse—Weil L-series of the elliptic curve. It is the Hasse—Weil L-function that is intimately related to the group of 0-points on E. _ The denominator of Z(EIFp ; T) is always (1 — T)(1 — pT). Only the numerator depends on p. If pi 2n, in which case En is not even an elliptic curve, the numerator is simply 1 (see Problem 10 in §II.1). Otherwise, the numerator is a quadratic polynomial in T of the form (1 — ŒT)(1 — bin When we later define the Hasse—Weil L-series of En , we shall take this quadratic polynomial and replace T by p - s (s is a new complex variable). The resulting expression (1 — Œp)(1 — p - s) is called the "Euler factor at p", by analogy with thé term in the Euler product expansion of the Riemann zeta-function : .

def

n=1

.FI prunes

I

p

1 — rs

(where Re s > 1).

(3.1)

In this section we shall study how this "Euler factor" depends on p. This

65

§3. Varying the prime p

dependence will turn out to be described by a certain character xn' of ,Z[i] (see Problem 9 of the last section). For the duration of this section we shall let P denote prime ideals of the --= 3 Gaussian integer ring Z[i]. There are two types: (1),, P = (p) for p=_ (mod 4); (2) P = (a + bi) for a2 + 1) 2 = p I (mod 4). In the latter case we have PP = (p), and we say that p "splits" in Z[i]. (There is also the special case P = (1 + i), which "ramifies", i.e., P 2 = (2)) The degree of a prime P dividing (p) is defined to be the degree of the field extension 7L[i]/P of Fp ; it is 2 in the first case and 1 ifp splits. We can then rephrase the theorem in the last section as follows. Proposition 1.

(1 — 7)(1 — pT)Z(E nliFp ; T) =

fi 0 - (ŒpT)deg P),

(3.2)

Pi(p)

where the product is over the (one or two) prime ideals of l[i] dividing (p), and where ap = if if P = (p) and ap = a + biif p splits, where a + hi is the unique generator of P which is congruent to (1-,) modulo 2 + 2i. We take ap = 0 if PI (2n). We now define a map 2„ on Z[i] which will be multiplicative and will satisfy in(x) = ap for any generator x of P = (x). This multiplicative map is of the form 2„(x) = xx n'(x), where xn'(x) has value 0, ± I, or ±i. First of all, we define x(x) = 0 if x has a common factor with 2n. Next, for n = 1 we define x'i (x) to equal ii, where ii is the unique power of i such that iix 7--..L..--- 1 (mod 2 + 20. Here x is assumed prime to 2, and hence an element of (Z[i]/(2 + 2i))*, which has four elements represented by the powers of i. Finally, for other n and for xel[i] prime to 2, we define x(x) = where Nx = x • 5c- is a positive odd integer, and GO is the Legendre symbol (which extends from prime modulus (i-,-) to arbitrary positive odd modulus by requiring that (4 2 ) = (k)(k)). To summarize, we have defined:

=

1

xx;i(x);

where for x prime to 2

ii

for x prime to 2n; nx) xi (x) (Ni

0

with1-ix .-_7-2. 1

(3.3)

otherwise;

(mod 2 + 21).

(3.4)

Suppose that x generates a prime ideal P = (x) nt dividing 2n. If P = (p) with p.. --z- 3 (mod 4), then (&) = (-pT) li = 1, and in(x) = iix = —p. That is, in takes any of the four possible generators of P to 4. If x is any of the four possible generators of a prime P of norm p ..E -. 1 (mod 4), then in(x) = AV» --.-. (7,) (mod 2 + 21), i.e., 2,i (x) is the unique generator oti; which is congrUent to CD modulo 2 + 2 1. We have thus shown:

66

IL The Hasse—Weil L-Function of an Elliptic Curve

Proposition 2. The map 2„ defined in (3.3)—(3.4) is the unique multiplicative map on Z[i] which coincides with cx';',eg' on any generator of a prime ideal P. Notice that is a character on CZ [0/(2 + 20)*. It takes any x to the using the root of unity in the class 1 /x. The general Li' is obtained from Legendre symbol, with the variable x appearing on the bottom. We now use quadratic reciprocity to bring the variable x up on top, thereby showing that x„' is a character. At this point recall Problem 9 of the last section, in particular, the definition of a "primitive" character on a number ring. Proposition 3. The map x„' defined in (3.3)—(3.4) is a primitive multiplicative character modulo (2 + 2i)n for odd n and modulo 2n for even n. Suppose x is prime to 2n. Let n = 2E1 • • • 4, where the /i are distinct odd prime numbers, and e = 0 or L Note that Nx is a product of odd prime powers, where the primes p l , , p, occurring to odd powers are all congruent to 1 (mod 4). First, it is easy to see that PROOF.

I. if 1%lx ==.- 1 (mod 8);

2 (

Nx) = I — 1

(3.5)

if Nx ==-- 5 (mod 8).

Next, we compute that (Nnx) = (N21x)E

I

pk

= 2 E 1
Nx

j,k lj

by quadratic reciprocity, since Pk a 1 (mod 4). Since Nx is equal to an odd square factor times the product of the Pk , we conclude that

x(x) =

(x

)

(

2 )6 Nx

cl

(N,x)

= xti

(

2 yx), (N Nx

no

(3.6)

where n o = n if n is odd, n o = n/2 if n is even. We now prove the proposition in the case n odd. The proof for n even is very similar, and will be left as an exercise below. We must first show that x(x) depends only on what x is modulo (2 + 2i)n. -Suppose that x' = x (2 + 200. Since x' x (mod 2 + 20, we clearly have )(1 (x) = ;CI (x) . Next, we have Nx (x (2 ± 200) (5es+ (2 — 204) x • = Nx

(mod n),

and hence the Legendre symbols are also equal. (This would not have been clear until we used quadratic reciprocity to bring Nx to the top, obtaining (V) in (3.6).) To show primitivity, we must show that there is no proper divisor of (2 + 2i)n such that x,' (x) depends only on what x is modulo that proper divisor. Thus, if xp,' were not primitive mod (2 + 2i)n, there would exist a prime ideal Q dividing (2 + 2i)n such that x(x) depends only on x modulo

67

§3. Varying the prime p /

the ideal ((2 + 20n)/Q. In particular, x(x) 0 — 1 for all x---=- 1 mod ((2 + 20.7)1Q. We consider three cases, and show that each leads to a contradiction.

(i) Q = (1 ± 0, i.e., xn"(x) 0 — 1 for all x = 1 + 20, 13e7L[i]. But since Nx -_-_- 1 (mod n), we have x(x) = x'i (x) = x'i (1 + 2fl), and this value is — 1 if, for example, # = i. (ii) Q = (a ± bi) with (a + bi)(a b0= I a 1 (mod 4), 1ln. Then we are supposing that 4(x) 0 — I for all x of the form 1 + fl(2 + 20n(a bi)II, where /3E1[4 Let /I = lc(1 — i), where k is an arbitrary integer, i.e., X = 1 + 4kn(a bi)II. Then x'i (x) = I, and Nx a 1 + 8aknf I (mod n ) . Hence, x(x) = ( 1+ 8laknll ) Since MO is prime to I, it follows that 1 + Sakni I runs through all residues modulo / as k varies. In particular, there is a value of k for which 1 + 8aknf I is a quadratic nonresidue, i.e., 4(x) = — 1, a contradiction. (iii) Q --7-- (I) with I =7---- 3 (mod 4). Then we are supposing that x,i' (x) 0 — I for x -_-_-_- I (mod (2 + 20n//). Since x a- I (mod 2 + 2i), we have x', (x) = 1, and so x,i'(x) = (V) = ("), since Nx EF-. 1 (mod n/1). Now since (2 + 201211 is prime to 1, it follows by the Chinese remainder theorem that x of the form I + /3(2 + 20n11 runs through all residues of Z [i] modulo Q. If we consider x modulo Q, i.e., as an element in the field l[i]/Q -4' IF1 2, then the norm map x F—) Nx = x. .)? is simply the norm map from F12 to Fi . And the latter map is surjective (for instance, a generator g 2 of FA goes to a generator g = g". of Fr). Hence, there are x of the required form for which 4(x) = (,) = —1. This concludes the proof of the D proposition. —

—

—

x.

-

For the remainder of this chapter, we shall let n' denote the conductor of , i.e., a generator of the largest ideal such that x„/(x) depends only on x modulo that ideal. By Proposition 3, we may choose

f (2 + 2i)n, n odd ; n' = n even. 2n,

1

(3.7)

Whenever one studies transformation formulas for functions involving characters, as we shall do in the sections that follow, the Gauss sum of the character is almost certain to make an appearance. In preparation for our later derivation of the functional equation for the Hasse—Weil L-series of Eri , we now find a formula for the Gauss sum of the character x„' : (7L[i]In')*1— C* (whose image consists of powers of i). We define our additive character on l[i]In' by the rule:

iii (x) -- e 2ni Re(xIni)

.

(3.8)

It is easy to check that Iii is a nontrivial additive character of Z[i]In' which satisfies the condition in Problem 9 of the last section, namely, it is nontrivial on the multiples of any proper divisor of n'.

68

ii. The Hasse—Weil L-Function of an Elliptic Curve

Proposition 4.

—2) n, , n odd; xeZ[0/11 1

2ni Re(xini) = / xn(x)e

) in, n = 2n0 even. n0

(3.9)

—1

To show that g()(1 ) = 2 + 2i and 0)(2) = 4i is a short computation that will be left as an exercise (Problem 2 below). Let m be a positive squarefree odd number. Let (wi) denoteithe character x () on (Z[i]lm)*. Then by (3.6) we have PROOF.

for n odd;

for n = 2n0 even.

= X /2 ' (no)

(3.10)

We define the Gauss sum for the character (-F,) as follows:

g

m

= def

E

(NX) e 2iti Re(x/m)

(3.11)

xEZ[ijim

We can obtain an alternate form for g (( ,70) if we replace x by 2x. (Note that 2x runs through (I [i]lm)* as x runs through (1 [i]im)*.) Since 1%1(2x) = 4Nlx, we have ( --iP-`) = (v). Writing Re(2x/m) as Tr x, where Tr x denotes x 5e, we have ,-

g (W)

x

(Nn.:C) e (27rifm) Tr x

(3.12)

Proposition 4 will follow as an immediate consequence of the following lemmas, whia will be proved below. Lemma 1.

g0Q=

(i-ilgetiog 0), no

Lemma 2. If m

n odd;

g(x'2 )g (E)) , n = 2n 0 even. no

mirn2 , then g ( ITID = g ((?-1-1)) g (

Lemma 3. If p is an odd prime,

((-Ti

ihen g (0) = p.

1. First suppose that n is odd. Write x in the form x (2 + 20x 1 + nx 2 , where x 1 runs through a set of representatives of Z[i] modulo n and x2 runs through a set of representatives of Z[i] modulo 2 + 2i. By the Chinese remainder theorem, x then runs through a set of PROOF OF LEMMA

69

§3. Varying the prime p

representatives of Z[i] modulo (2 + 2i)n. By (3.10), we have x(x) = By (3.4), we have x(n) = (ii'). Also, 1J ((2 + 2i)x 1 ) = 2 ` ). Meanwhile, in the additive EiNx i , and so the second term becomes (4-L character we have Re(x/d) = Re(x i in + x 2/(2 ± 2i)). Hence, in the definition (3.9) Of g() we have (NX•) i et/ Re(x l /n)+2/rt Re(x 2 /(24-21)) ,

E

x,ezEilin ( —ni )G3.1) x,Ezum2+20

xti (x2)

-

-

n

.

,

and the double sum on the right separates out into g(;(1 )g(()). The proof for even n is very similar, where we write x = 4x 1 + no x z . 0 The details will be left as an exercise. PROOF OF LEMMA 2. The proof is quite similar to that of Lemma 1. In the definition (3.11) we write x = x i m 2 + x2m 1 , where xi runs through a set of --- miNx i (mod m 1 ) and representatives of Z NMI» f = 1, 2. Since 1%,x?-__ n4 Nx2 (mod m2), we have

)(Nx 1 )( Nx2 m . (Nx) = (N x) (Nx ) —

2 ) mi j in2 rnt In Since also Re(x/m) = Re(x i im i ) + Re(x 2/m2) the sum in (3.11) separates out into a product over x 1 which is equal to g(6,--0) and a product over x,

which is equal to

o

0( ))

4). Let p = 13- #, where fi = a + bi. In (3.11), we write x = x 1 13 + x2P, where x 1 and x2 each run through 0, 1, 2, . . . , p — 1 (note that these numbers are representatives of ZUM and also of Z[i]ii3). Again, since /3 and -# are relatively prime, the Chinese remainder theorem tells us that x will run over Z[i]/p. We have Nx = (x 1 13 + x2 -#) (x 1 # + x 2 fl) a-- 2x 1 x2 Re $2 (mod p). But Re 13 2 = a 2 — PROOF OF LEMMA 3. We first consider the case pE---_ 1 (mod

b2

Za 2 (mod p), since p = a2 + b2 . Thus, since Re x = x,a + x2 a, we have

by (3.11)

=

ax 1 ax 2 e (27tilimax,+ax,) • E P , x,,x,ezipi

The double sum separates out into the square of a single sum over x 1 E 7L/pi. If we then replace ax, by x, we obtain , _...

rix1p) 0 e2I

2

( E

XGF

P

P

9

which we know equals p by property (2) of Gauss sums for finite fields (see §II.2; also see Problem 4 of §II.2). . Finally, suppose that pE.--..- 3 (mod 4). Then (p) is a prime ideal of 44 and ZUNI), is the field of p 2 elements. In that case, g((-0) in (3.12) is the Gauss sum for the multiplic a tive and additive characters of Fp2 obtained

11. The

70

Hasse—Weil L- Function Oran Elliptic Curve

from the multiplicative character (f) and additive character erP of Fp using the norm and the trace. In other words, we are in the situation of the Hasse-Davenport relation (2.10), which tells us that g(( 0)) is the square of the Gauss sum ExEF ( )e2 ". Again using Problem 4 of §I1.2 (this time with q = p F--- 3 (mod 4)), we conclude that g(()) = p. This completes the proof of the lemmas, and hence of Proposition 4. El -

-

-

In Proposition 4, the term (-72) for n odd, () for n even, is equal to + 1 if n:-.7=- 1, 2, 3 (mod 8) and is equal to - 1 if n -L-=... 5, 6, 7 (mod 8). This sign will turn out to play a crucial role in the functional equation for the HasseWeil L-series for E. It is called the "root number". If it equals - 1, then conjecturally it follows that n must be a congruent number. But there is no known direct reason why any squarefree n congruent to 5, 6, or 7 modulo 8 should be the area of a rational right triangle. PROBLEMS

1. Using (3.6), prove Proposition 3 for n = 2n0 even. 2. Verify the formula in Proposition 4 for n = 1, 2 by a direct computation. 3. Prove Lemma 1 for even n. 4. Give another proof of Lemma 3 directly from the definition of g(Q).

§4. The prototype: the Riemann zeta-function For Re s > I, the Riemann zeta-function is defined by the convergent infinite sum of reciprocal s-th powers, or alternatively by the product of "Euler factors" 1/(1 - if') with the product over all primes p (see (3.1)). In this section we give a proof of analytic continuation and the functional equation for the Riemann zeta-function “s). The proof has all of the essential elements that will later be needed to prove analogous facts about the Hasse-Weil L-function of E. We start by recalling some basic tools for working with real- and complexvalued functions. First, we summarize the properties of the gamma-function (for the proofs and further details, see, for example, [Whittaker and Watson 1958, Chapter XII], or [Artin 1964]). The gamma-function r(s) interpolates n! in the sense that f(n) = (n 1)!. It can be defined for se C with Re s > 0 by the integral -

co

di e - tt s— . t j'0

(4.1)

r(s + I) = sF(s),

(4.2)

F (s)

It satisfies the relation

; 21

§4. The prototype: the Riemann zeta-function

which enables one to continue f(s) analytically onto all of the complex s-plane, except that it has simple poles at s =--- 0, — 1, —2, —3, . . . . The gamma-function also satisfies the relations

\ 7r f(s)r( I — si — sin(is)

(4.3)

and s) r, ( + 1 ) , ...... jr2 i -sr(s). r

(

(4.4)

2 2

Finally, using (4.2) and (4.3), one easily sees that the reciprocal of the gammafunction is an entire function of s. The gamma-function (4.1) is a special case of a construction known as the "Mellin transform". Given a function . f(t) on the positive real axis, its Mellin transform is the function g(s) defined by the formula co . dt f (OP— (4.5) g(s)----t

fo

for values of s for which the integral converges. Thus, f(s) is the Mellin transform of e t. Notice that for any constant c> 0, the Mellin transform of e- " is cf (s): dt e-"ts— = cf (s), t

(4.6) f

:

as we see after a simple change of variables. We shall often have occasion to use (4.6). Another tool we shall need is the Fourier transform. Let 99 be the vector space of infinitely differentiable functionsf: 1R 1-0 C which decrease at infinity faster than any negative power function, i.e., 1 xrf(x) --) 0 as x 4 + co for all N. An example of such a function is f(x) = e 2. For any fe 9' we define its Fourier transform f by: -

e -21rix)f(x)dx.

(4.7)

It is not hard to show that the integral converges for all y, and je , 9P. The following properties of the Fourier transform are also easy to verify: (1) If a e R and g(x) = f(x + a), then "(y) = e2 76aY1(y). (2) If a e IR and g(x) = e2 'i"f(x), then 4 (y) = Ay — a). (3) If b> 0 and g(x) = f(bx), then 4(y) = -T.,. f(y1b). For example, to check (3), we compute

4 y) = (

I

00

00

e'f(bx)dx =--_co

dx == I 2, a., e-2/ri(x/b)37f(x)_. —July). ' b b _00

IL

72

The Hasse—Weil L-Function of an Elliptic Curve

Proposition 5. If fix) = C. "2, then f

=f

PROOF. Differentiating under the integral sign, we have

d

' e -27rixyxe -nx2dx. e-27ilx-vf(x)dx = —276 11°9 ff CO = — I dy _ co co

Integrating by parts gives ft( y)

nx2

2 1 —27zi e-2nixy 2n e "

irixY 2niy e -2‘'

—2n

dx

GO

= — 2ny

Y.f(x)dx = —2nyl(y).

e -2

-co

Thus,fsatisfies the differential equation t(y)/f(y) = —27ry; this clearly has solutionf(y) = Ce - "2 , where C is obtained by setting y = 0: 00

e"- "2 dx = 1

C = f(0) =

- co (Recall the evaluation of the latter integral: e "2 dx f a) e - nY 2dy =

C2

J

f_co Jo

Thus,f(y) = e

012

—cc

e -"2 2nr dr =

■•■••• ■■•■■••■••

e - n(x 2 ÷Y2)dxdy

jo

e' du = 1.)

2 , as claimed.

0

Proposition 6 (Poisson Summation Formula). If g e Y, then

E

M=

On) = CO

E

(4.8)

j(m).

M = fl)

Define h(x) = E._ co g(x k). The function h(x) is periodic with period I, and has Fourier series h(x) = E:= _ co cm e2', where co I 1 i = f OE) g(x)e -2 'dx, g(x + k)e-2n"dx Cm = h (x)e -2 'in'xdx = 0 k= Jo where we interchanged summation and integration, and made a change of variables (replacing x + k by x) to obtain the last equality. But the last expression is simply 4(m). Now the left side of (4.8) is NO), by definition; and the right side is also NO), as we see by substituting x = 0 in the Fourier series for h(x) and using the fact that cm = (in). PROOF.

f

co f

i—.

We now define the theta-function : cc

E

e -nin

2

for

t > 0.

(4.9)

73

§4. The prototype: the Riemann zeta-function

Proposition 7. The theta-function satisfies the functional equation 1 0(t) = — r7 0(1/t).

(4.10)

NI I PROOF. We apply Poisson summation to g(x) = e'tx 2 for fixed t> O. We write g(x) =f(fix) with f(x) -----; C nX2 . By Proposition 5 and property (3) of the Fourier transform (with b = \fi) we have 4(y) ---= t - ' 12 e - "21t. Then the left side of (4.8) is 0(1), and the right side is r 112 0(1/t). This proves the proposition. D' We sometimes want to consider 0(t) for complex t, where we assume that Re t> 0 in the definition (4.9). The functional equation (4.10) still holds for complex t, by the principle of analytic continuation of identities. That is, both sides of (4.10) are analytic functions of t on the right half-plane. Since they agree on the positive real axis, they must be equal everywhere for Re t > O. Proposition 8. As t approaches zero from above, we

have (4.11)

10(t) — t -1/2 1< e -clt

for some positive constant C. PROOF. By (4.10) and (4.9), the left side is equal to 21'12 Z_ i e - "2/r. Suppose t is small enough so that .fi > 4e -liz and also e'lti' < 1. Then IOW — 1 -1/21 < le iit(e -70 + e -470 + ...)< le-Or -1 Ni +1+ 71 ± ..13- 4_ . .. ) = -

Thus, we can take C = n — 1.

a

We now relate 0(t) to the Riemann zeta-function. Roughly speaking, (:(s) is the Mellin transform of 0(0. The functional equation for 0 (t ) then leads us to the functional equation for C(s), and at the same time gives analytic continuation of as). We now show how this works. Theorem. The Riemann zeta-function C(s) defined by (3.1)for Re s> 1 extends analytically onto the whole complex s-plane, except for a simple pole at s = 1with residue 1. Let A (s) ci7-f 7r - s12 1-' (0 as).

(4.12)

Then A(s) is invariant under replacing s by 1 — s:

A(s) = A(1 — s). That is, C(s) satisfies the functional equation

,

74

II.

The Hasse—Weil L-Function of an Elliptic Curve

_ ir ---( 1—s)12 -

1--

(

1 — s)

(4.13)

( l -- s) .

2

1

—

Basically, what we want to do is consider the Mellin transform ro° 0(t)ts(1). However, for large t the theta-function is asymptotic to 1 (since all except the n = 0 term in (4.9) decrease rapidly); and for t near 0 it looks like ry2 , by Proposition 8. Hence, we must introduce correction terms if we want convergence at both ends. In addition, we replace s by f (otherwise, we would end up with 42s)). So we define PROOF.

0(s) cit

-f

f ts 12 (0(t)

- 1) —t + f 1. t s12

0(

(4.14)

—

o In the first integral, the expression 0(t) - 1 = 2 E, e -- "2' approaches i

zero rapidly at infinity. So the integral converges, and can be evaluated term by term, for any s. Similarly, Proposition 8 implies that the second integral converges for any s. In any case, since 0(t) is bounded by a constant times ry2 in the interval (0, 1], if we take s with Re s> 1 we can evaluate the second integral as dt '' t di Ç ' ts/ 20(i)— ‘3 1 " I...,.

I

1 12

1 ts120(t) dt

- 10

tt \'t J Thus, for s in the half-plane Re s> 1, we obtain:

f 03 2 •-) dt 4) (s) =-. 2 E e- 7"1 'PI` ±

1 I1 di + 2 E /: i sl.._

CO

=2

s-1.

CC)

t

n=1 1

2

t

0

dt ± ;1-2 Ec° fc° e —nn 2 t t s12— t

n=1

0

- 2 /2 e " tt s

dt t

2 s

— 1)

2

1 — s•

Using (4.6) with c replaced by nn 2 and s replaced by '.-5-- we have:

2' 1 1 s .1 - 0(s) = i (n112)— s121— ____ + + 22 s 1-s n=1 :„____ n -s12 r

(....$) ((s) ± 1 + 2''

s

1

1-s

(4.15)

,

where always here Re s> 1. Now 0(s) is an entire function of s, since the integrals in (4.13) converge so well for any s, as we saw. Thus, (4.14) shows us that there is a meromorphic function of s on the whole complex plane, namely Tr

.s/2

(1

I' (42) 2

0(s)

1 s

1 1 - s)

,

which is equal to (s) for Re s> 1. Moreover, since 7r"2, 1ir(1), and Cs) are all entire functions, it follows that the only possible poles are at s = 0 and at s = 1. But near s = 0 we can replace sr(f) in the denominator by 2(1)F(i) = 2f(-3- + 1), which remains nonzero as s -- 0. H' the only pole

75

§4. The prototype: the Riemann zeta-function

is at s = 1, where we compute the residue

(i

v s/2 "

1

o(s) r(s/2) 2

liM

s I

r (1/2)

:= 1.

It remains to prove the functional equation. Since, by (4.15), A(s) =-(1 -1 w and since + (1 1 s) is invariant under replacing s by 1 - s, 1430(s) it suffices to prove that Cs) = 0(1 - s). This is where we use the functional equation (4.10) for the theta-function. Using (4.10) and replacing t by -1- in under and J becomes (4.14), we obtain (note that d(-f )/(+) = the substitution):

s? =

fol

1 -42

e (1) u

dt 1)

+

t)

V

t (replacing by -1-)

co

I

dt .ji) Cs1200(t) 0 0) 1)— ± I - 412 (ft = t t 1 Jo odt = ' t2 s)12 (90) tu i1. i) 't11-t + ji t

f 0

(by (4.10))

.s

= 01 - s). This completes the proof of the theorem. In a similar way one can prove analytic continuation and a functional equation for the more general series obtained by inserting a Dirichlet character z(n) before rrs in (3.1), or, equivalently, inserting x(p) before p' in the Euler product (see Problem 1 below). That is, for any character (ZINZ)* --+ C*, one defines: co 1 where Re s > 1 (4.16) ) = EL(x,s x(n) n=1

( n ns

p1

X(P)P -s

The details of the proof of analytic continuation and the functional equation will be outlined in the form of problems below. The Hasse-Weil L-function for our elliptic curve En, to be defined in the next section, will also turn out to be a series similar to (4.16), except that the summation will be over Gaussian integers x, the denominator will be the norm of x to the s-th power, and the numerator will be n (x), where )-( n was defined in (3.3) in the last section. The techniques used in this section to treat the Riemann zeta-function can be modified to give analogous facts—analytic continuation and a functional equation—for the Hasse-Weil L-function for E. In the final section we shall use this information to investigate the "critical value" of the Hassp-Weil L-function, which is related to the congruent mi mber problem.

76

H. The Hasse-Weil L-Function of an Elliptic Curve

PROBLEMS 1. (a) Show that the summation form and the Euler product form of the definition of s) are equal.

(b) Prove that if x is nontrivial, then the sum in (4.15) actually converges (conditionally) for Re s > O. 2. Let G = ZINZ, and let = e2 . (a) Define the "finite group Fourier transform" of a function f: G f(a) = EbEGfibg -ab for a e G. Prove that f(b) k! Ea e G f (agab (b) For fixed s e C with Re s > 1, let f, : G -+ C be the function fs(b)

C by setting

n1 ,nb(mod N)

Prove that for any primitive Dirichlet character z modulo N and for any s with Re s > 1 :

L(x, s)= 1-g(x) N

E a€G

(a) n=1

where g(x) is the Gauss sum (see Problem 9 of 01.2). (c) Take the limit in part (1)) as s approaches 1 from above, supposing x nontrivial. In that way derive a simple formula for L.(x, 1). for fx1 1. Express L(x, 2) (d) Define the "dilogarithm" function by 1(x) = in terms of the dilogarithm.

02 ? For fixed t> 0 and a e R, what is the Fourier transform of e Suppose that a e R is in the open interval (0, 1). Define the following functions: CO

«a, s)=

Re s > 1;

± ay', n= 0 co

E ri-se'ina,

1(a, s) =

Re s> 1;

n=1

OA°

E e

=

-

iron +a)21

>

0;

n= - OD

0 a(1) =

n= - œ

e 2/ti na e -utn2

t > O.

(The notation 1(a, s) should not be confused with the function 1(x) in Problem-2) Prove that

(i) Oa(t)

(ii)Imo

t —10

t

"21 < e—Cdt

as t 0 for some positive constant C1 ; (Hi) 10a(t)i <e21' as t -* 0 for some positive constant C2. (c) Prove that a, s) + C(1 - a, s) as a function of se C extends to a`merorribrphic function with no pole except for a simple pole at s = 1; that the function /(a, s) + a, s) extends to an entire function; and that -

n-st2r0 2

s) + C(1 - a, s)) =,

r

(1

-

2

(1(ar , 1 - s) 1(1 - a, 1 - s)).

77

§4. The prototype: the Riemann zeta-function

(d) Let x be a primitive Dirichlet character mod N. Let L(x, s) be defined as in (4.16): Prove that for Re s >-- 1:

(i)

---- Ns L(x, s), 0
h

(ii) E wor(N ,$)= g ocgoz,S). 0
• (e) Suppose that X is a nontrivial even character, i.e., x( — 1) = L Prove that L(x, s) extends to an entire function of SEC, and find a functional equation relating L( ) , s) to L ( c- , 1 — s). (f) Let x be a primitive even quadratic character, i.e., x(n) = + 1. Recall from Problem 9(c) of §11.2 that g(x)2 = N, so that g(x) = ± fKr. Suppose you somehow knew that L(x,1--) # O. Show that this implies that g(x) (g) With x as in part (e), show that L(x, s) = 0 if s is an even negative integer or zero. (h) With x as in part (e), express L'(, —2k) in terms of L(k, 2k + 1). in particular, express L'(, 0) in terms of L ( , 1). -

4. Let x be a nontrivial even primitive Dirichlet character mod N, and define

2=— 1 E

co

o(x., 0= z x (n)e

2,7ex

st=1

An)e —ntn

2 /

(a) Prove that iN

(i ) 0 (X,

t) = -- E 2 a=1

x (a)e„,,„(N20;

1 N

E X(a) 04N (I) = g(x)Oc, 1 ); 2 a=1

(ii) —

(iii) 0(x, t) = g(X) 00?, 11N 2 t). (b) Show that the Mellin transform of 0(x, t) converges for any s (with no need for any correction term), and that for Re s> 1- it is equal to n-sr(s)L(x, 2s). (c) Use the functional equation in part (a)(iii) to give another proof of the functional equation for L(x, s) in Problem 3(e) above.

5. (a) Let fe Y, and g(x) = f ' (x). Show that 4(y) --z.-- 2niyi(y). (b) Find the Fourier transform of (x + a)e - n'(x+a)2 , with t and a as in Problem 3(a). (c) Let a ea 1). Define C(a, s) and 1(a, s) as in Problem 3 above, but- now define Oa and Oct differently:

0,

O(t) = E

(n + a)e - irt(n+a)2 ,

t > 0;

n = — co co

L ne 2ni ttae—ntrt 2

O" (t) = x"

,

t> O.

n=— ao

Prove that:

(i) 0.(t) = — it - 3/2 0a (1) ; (ii) 104AI < C cift as t --+ 0 for some positive constant C1 ; (iii) 10a(t)1 < e'/' as t --* 0 for some positive constant C2.

78

11. The Hasse—Weil L-Function of an Elliptic Curve

(d) Express the Mellin transform of Oa and Oa in terms of C(a, s) and 1(a, s); prove a, s) and 1(a, s) 1(1 a, s) extend to entire functions of that (a, s) ((I s EC; and derive a functional equation relating these two functions. (e) Suppose that xis a primitive odd character mod N, i.e., x( — 1) = — 1. Prove that L(x, s) extends to an entire function of sE C, and find a functional equation s). relating L(x, s) to L ( , 1 (f) Let x be an odd quadratic character. Show that if you somehow knew that L(x, 1/2) # 0, then thiswould imply that g(x) = iNM- (rather than —LA. (g) With x as in part (e), show that L(x, s) = 0 if s is a negative odd integer. 2k) in terms of L ( , 2k). In particular, (h) With x as in part (e), express L'(x, 1 express L'(, 1) in terms of the dilogarithm. For example, express L'(x, — 1), where x(n) r---- (i), in terms of the dilogarithm. —

—

—

—

—

—

—

6. Let x be an odd primitive Dirichlet character mod N, and define 0(x, 0 =

co

E n(n)e'2 n=1

1 E nx(n)e —n1n2 9 2„Ez

t> O.

(Note that this is different from the definition of 0(x, t) for even x in Problem 4.) Let Oa and Oa be as in Problem 5(c). (a) Prove that: CO O(X, t) = 1-1- ii AaVaiN(N 21); 1 N

(ii) -

E X62041'1(t) = g(X) 0(7, 1);

(iii) 0(x, 0 = —iN -2 1 -312 g(x)0(7, 1 /N 2 t)(b) Show that the Mellin transform of 0(x, t) converges for any s, and that for Re s > 1 it is equal to n- sr" (s)L(x, 2s 1). (c) Use the functional equation in part (a)(iii) to give another proof of the functional equation for L(x, s) in Problem 5(e) above. —

7. Let x be the character mod 12 such that x( ± 1) ------- 1, x( ± 5) = — 1. Let I/ (z) = 0(x, —iz/12) for Tm z > O. Prove that n(— i/z) = Jriri(z), where we take the branch of which has value 1 when z = i. We shall later encounter q (z) again, and give a different expression for it and a different proof of its functional equation.

8. (a) Use the functional equations derived above to express 1(a, 1 s) in terms of C(a, s) and ‘(1 a, s). (b) Use the properties (4.3) and (4.4) of the gamma-function along with part (a) to —

—

show that

1(a, 1

—

s) = 1- (s)(2n)_s e i"12 (C(a, s) + e-i"C(1

—

a, s)).

(c) For a E C, a + n, define (a + n)- S to mean e"- s'"(a" , where we take the branch of log having imaginary part in ( — n, 7r]. Show that for a e C, 1m a > 0, Re s> 1, one has: —

co

1(a, 1 — s) = r(s)(2n)_se i"12

E Pt= -CO

(a 4- n)'.

79

§5. The Hasse—Weil L-function and its functional equation

(d) Let s= k be a positive even integer. Show that for a e C, im a> 0:

(a 1 n)k

(27rOk " _ 2 E n"e (k 1)1 „=,

•

(e) Give a second derivation of the formula in part (d) by successively differentiating the formula 00 1 1 ncot(na) =-- — + + a n a+n a—n

E

§5. The Hasse—Weil L.-function and its functional equation Earlier in this chapter we studied the congruence zeta-function Z(EliT p ; T) for our elliptic curves E„: y 2 = x3 — n 2x. That function was defined by a generating series made up from the number N =-- N,.. p of F,, -points on the elliptic curve reduced mod p. We now combine these functions for all p to obtain a function which incorporates the numbers for all possible prime powers p', i.e., the numbers of points on En over all finite fields. Let s be a complex variable. We make the substitution T = p- s in Z(En/Fp ; T), and define the Hasse—Weil L-function L(En , s) as follows:

C(s)((s — 1)

L(E n , 5 Hp z(E n lf Fp ; P 1

i

p.f

2n

1

2aErrpP-s

1

a deg P Np)- s We must first explain the meaning of these products, why they are equivalent, and what restriction on s e C will ensure convergence. In (5.1) we are using the form of the congruence zeta-function in the theorem in §11.2 (see the first equality in (2.7)), where the notation a Ewp indicates that the coefficient a depends on En and also on the prime p. We put the term (.F)(s — 1) in the definition so that the uninteresting part of the congruence zeta-functionits denominator—disappears, as we see immediately by replacing “s) and C(s — 1) by their Euler products (see (3.1)). Note that when pi2n, the denominator term is all there is (see Problem 10 of §11.1), so we only have a contribution of 1 to the product in that case; so those primes do not appear in the product in (5.1). In (5.2) the product is overall prime ideals P of Z[i] which divide primes p of good reduction. Recall that those primes are of two types: P p), p -:a- 3 (mod 4), deg P = 2, ‘IP = p 2 ; and P = (a + bi), a2 + b2 = p 1 (mod 4), deg P = 1, NP = p. The meaning of ap and the equivalence of (Si) and.(5.2) are contained in Proposition I (see (3.2)).

II. The Hasse—Weil L-Function of an Elliptic Curve

80

As in the case of the Riemann zeta-function, we can expand the Euler product, writing each term as a geometric series and multiplying all of the geometric series corresponding to each prime. The result is a Dirichlet series, i.e., a series of the form CO

L(E„, s) =

E

b.,,,rn'.

(5.3)

Before discussing the "additive" form of L(E„, s) in detail, let us work out the values of the first few b.,,, for the example of the elliptic curve E l : y 2 = x 3 — x. We first compute the first few values of aE 2 ,p in (5.1). If p --4-: 3 (mod 4), then aE1 ,p = 0. Ifp F...- 1 (mod 4), there are two easy ways to compute a = aE 1 , p : (1) as the solution to a 2 + b 2 = p for which a + bi _-_=. I (mod 2 + 2i); (2) after counting the number N1 of Fp-points on El , we have 2a = p + 1 — N1 (see (1.5)). Here is the result:

L (E 1 , s) =

1 1 1 1 1 + 3 - 9- S 1 + 2 - 5 - s + 5 - 25 - s 1 +7491+ 11 - 121' •••

.

1 — 6 .13' + 13169g 1 — 2 .17 -s + 17 . 289" = 1 — 2 . 5 -s — 3 .9" + 6 - 13 -s + 2 . 17 - s -1-

E rr:25

b. n tn - s . (5.4) '

We have not yet discussed convergence of the series or product for L(E„, s). Using (52) and the standard criterion for an infinite product to converge to a nonzero value, we are led to consider Ep1api deg P(NP) -5 for s real. By Proposition 1, we have iap reg P = NP 1/2 . In addition, Np1/2-s

1 , e2nii1 pi+2(v-h) _

E

e 2.ii2p

0<j2

0
(where ] 1 = pj 2). The first sum is zero if h> y and it isp 2h if h < v; the second sum is zero if h> y + 1 and it is p 2 11 -1 if h < v ± 1. We conclude that all of the terms in the outer sum in (2.7) corresponding

to n =

no p 21' for fixed n o contribute Sno

v ( 1 + E p –hk( p 2h _ p 2h-1) ..... p

–(

v+1)kp2(v+1)-1

h=1,

= sno (1 _ p i-k) E p V

h(2–k)

h=0

We next suppose that pino , no = pti o . As representatives j of Z mod nZ we choose j

0 ....Ç i i
0 .,../0 < O'

=AP 2h+1 +iirio ',

We have = 11) (i o P)

en) = GI)G1-0)

(

P

Flo

Then S„ is the product of k –k/2 enn

E ,

joP e --2/tijoifiro

o:sio
and

E

0,<,2h-fi

.ii. e-2,,iiiTo p2(vœh) (p

But it is easy to see that for any h the latter sum is zero. Namely, if h < y, then we obtain E li. (k) P = 0; and if h > y, then the sum over any given residue class mod p, i.e., j i = j2 + pj 3 for fixed j2 , is equal to /2 e- 2/rii,ro p2(v -0 E e - 27rii3T0 p 21 \ PJ 0
and the latter sum is zero, because 2(v — h) ± 1. if n is divisible by an odd power of p.

,

< O and p,110 . Thus, Sn = 0

ro (4)

§2. Eisenstein series of half integer weight for

197

We' conclude that for p1/0 we have

bi=

irk/2

r (k) &Eno.

pki2)-1

— p I -k\) L p h( 2-k)

s no > 0 odd, pf no °

h= 0

Here Sn o depends only on 10 and not on / = /0 p2v, because for pit no (.2t_ 2v) 2

E (i) e - 27rilfino o

no

05j
0 jp2vino •

no

0.si<no

(i) -2 ne

E

0
ito Sno.

no

Thus,

bdb,o (00) (k/2)-1

E h(2 — k) = E

p h(k -2)

h=

h=

This relation between bl and 40 can be summarized in the following identity, which is valid for any 10 with pilo , p2 ,11 /0 : co

E

bi0p 2vp

-sv

=

y=o

1 p -s)(1

0 (1

p k- 2-sy

(2.24)

To. see the equivalence of this identity to the formula derived above for b,/b, 0 ; it suffices to expand (1 — p -s) 1 and (1 — pk- 2 -s%) in geometric series and in that way conclude that the coefficient of p the right in (2.24) is p 1(k-2) h=0

Case (ii) 010 . Again we fix no with p2 )(n0 and consider all terms Sn in = op2h5 h = 0, 1, 2, . . the outer sum in (2.7) for which nn First suppose that Ono . We take] = jo p' + 1 n0 as before, define 6(j) by (2.23), and find that (5( o e- 2 7t i j i lop 2(v h)

Snop-hk

Sn

05:7 1

As before, this sum can be rewritten in the form

>2

0<j i < p 2h

e

2 R ii p 2(v — h)

E

."M■

(3,i2

which equals zero if h> y and p2h p2h-1 if h

E h=0

sn0p 2h =

2(v —h)

E p -hk ( p 2h

v. Thus, p 2h-1 ■ )

) .

(2.25)

h=1

Now suppose that pino , no =pri o . At this point we change our notation, replacing ti o by no . That is, we shall determine E h Sn0p 2h+1, where now no is not divisible by p. As before, we set j =i0p2h+1 +j1 n0 , and find that S„, = 0p2k÷i, is equal to the product of where nn

Di. Modular Forms of Half Integer Weight

198 E

( joil

0 .5i0<no ..

n

p – k/2 spkno n 0– ki2

e - 2 nijollno

(2.26)

o

and P

-hk (no)

I0 p

1.) e 2 n —

p

(2.27)

P

Introduction to Elliptic Curves and Modular Forms (Graduate Texts in Mathematics, Vol 97)

Read more

Introduction to Elliptic Curves and Modular Forms (Graduate Texts in Mathematics, Vol 97)

Read more

Introduction to Elliptic Curves and Modular Forms

Read more

Introduction to elliptic curves and modular forms

Read more

Introduction to Elliptic Curves and Modular Forms (Graduate Texts in Mathematics)

Read more

Elliptic Curves (Graduate Texts in Mathematics)

Read more

Elliptic Curves (Graduate Texts in Mathematics)

Read more

Geometric Modular Forms and Elliptic Curves

Read more

Geometric Modular Forms and Elliptic Curves

Read more

A First Course in Modular Forms (Graduate Texts in Mathematics)

Read more

A First Course in Modular Forms (Graduate Texts in Mathematics)

Read more

Introduction to Elliptic Curves and Modular Forms, 1st Edition 1984 (GTM, 97)

Read more

Introduction to Modular Forms

Read more

Moduli of Curves (Graduate Texts in Mathematics)

Read more

Elliptic curves, modular forms, and their L-functions

Read more

Elliptic Curves, Modular Forms and Fermat's Last Theorem (2nd Edition)

Read more

Algorithms For Modular Elliptic Curves

Read more

Modular elliptic curves and Fermat’s Last Theorem

Read more

Elliptic curves (introduction)

Read more

Modular elliptic curves and Fermat's Last Theorem

Read more

Differential Geometry: Manifolds, Curves, and Surfaces (Graduate Texts in Mathematics)

Read more

Differential Forms in Algebraic Topology (Graduate Texts in Mathematics)

Read more

Differential Forms in Algebraic Topology (Graduate Texts in Mathematics)

Read more

Elliptic Modular Functions: An Introduction

Read more

Rational Points on Modular Elliptic Curves

Read more

Elliptic Modular Functions: An Introduction

Read more

Algebra (Graduate Texts in Mathematics)

Read more

Algebra (Graduate Texts in Mathematics)

Read more

Introduction to Topological Manifolds (Graduate Texts in Mathematics)

Read more

An Introduction to Convex Polytopes (Graduate Texts in Mathematics)

Read more

Recommend Documents

Introduction to Elliptic Curves and Modular Forms (Graduate Texts in Mathematics, Vol 97)

Introduction to Elliptic Curves and Modular Forms (Graduate Texts in Mathematics, Vol 97)

...

Introduction to Elliptic Curves and Modular Forms

Introduction to elliptic curves and modular forms

...

Introduction to Elliptic Curves and Modular Forms (Graduate Texts in Mathematics)

Elliptic Curves (Graduate Texts in Mathematics)

Graduate Texts in Mathematics 111 Editorial Board S. Axler F.W. Gehring K.A. Ribet Springer New York Berlin Heidelber...

Elliptic Curves (Graduate Texts in Mathematics)

Graduate Texts in Mathematics 111 Editorial Board S. Axler F.W. Gehring K.A. Ribet Springer New York Berlin Heidelber...

Geometric Modular Forms and Elliptic Curves

...

Geometric Modular Forms and Elliptic Curves

A First Course in Modular Forms (Graduate Texts in Mathematics)

Graduate Texts in Mathematics 228 Editorial Board S. Axler F.W. Gehring K.A. Ribet Graduate Texts in Mathematics 1 ...