Torsion Points of Elliptic Curves Over NumberFields

Christine Croll

A thesis presented to the faculty of the University of Massachusettsin partial fulfillment of the requirements for the degree of

Bachelor of Science with Honors.

Department of Mathematics

Amherst, Massachusetts

April 21, 2006

Acknowledgements

I would like to thank my advisor, Prof. Farshid Hajir of the University of Mas-sachusetts at Amherst, for his willingness to explain everything twice. I wouldalso like to thank Prof. Tom Weston of the University of Massachusetts atAmherst, for entertaining me during my 9 a.m. Number Theory course; Prof.Peter Norman of the University of Massachusetts, for offering me the summerresearch that inspired this thesis; and the Umass Mathematics departmentfor my Mathematical education. Lastly, to the English major, Animal Sciencemajor, and Biology major that have had to live with me, thank you for puttingup with this strange Math major.

Abstract

A curve C over Q is an equation f(x, y) = 0, where f is a polynomial: f ∈Z[x, y]. It is interesting to study the set of rational points for curves, denotedas C(Q), which consists of pairs (x, y) ∈ Q2 satisfying f(x, y) = 0. For curvesof degree 1 and 2 we know how to write C(Q) as a parametrized set, thereforeenabling us to know all the rational points for curves of these degrees. Forirreducible, smooth curves of degree 3 equipped with at least one rational point,which are called elliptic curves, C(Q) is a group. As with other groups, eachelement of C(Q) has an order. The subgroup C(Q)tors is the set of all rationalpoints of finite order in C(Q). This paper will briefly describe the basic theoryof elliptic curves and then focus on what is known about C(Q)tors, both overthe rationals and over the extension field Q(ζ11), where ζ11 is an irrational rootof x11 − 1 = 0.

Contents

1 Introduction 5

2 Background 82.1 Curves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82.2 Rational Points on Conics . . . . . . . . . . . . . . . . . . . . 82.3 Method for Rational Solutions for Quadratics . . . . . . . . . 92.4 Projective Space . . . . . . . . . . . . . . . . . . . . . . . . . 11

3 Elliptic Curves 133.1 EC Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . 133.2 Weierstrass Form . . . . . . . . . . . . . . . . . . . . . . . . . 133.3 EC Definitions Revisited . . . . . . . . . . . . . . . . . . . . . 133.4 Projective Space Revisited . . . . . . . . . . . . . . . . . . . . 14

4 Group Law 154.1 Defining ⊕ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154.2 (P ∗Q)⊕ (P ⊕Q) . . . . . . . . . . . . . . . . . . . . . . . . 164.3 P ⊕ P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174.4 Elliptic Curves Under ⊕ . . . . . . . . . . . . . . . . . . . . . 19

5 Torsion Points 205.1 Definition of torsion points . . . . . . . . . . . . . . . . . . . . 205.2 Points of Order 2 . . . . . . . . . . . . . . . . . . . . . . . . . 205.3 Points of Order 3 . . . . . . . . . . . . . . . . . . . . . . . . . 215.4 Nagell-Lutz Theorem . . . . . . . . . . . . . . . . . . . . . . . 225.5 Mazur’s Theorem . . . . . . . . . . . . . . . . . . . . . . . . . 235.6 Ψn(x) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

6 Appendix A 26

7 Appendix B 27

8 Appendix C 28

5

1 Introduction

The subject of rational points on elliptic curves could be seen as a componentof the theory of Diophantine equations. The study of elliptic curves has comea long way since its beginning, with elliptic curves currently being used in thearea of cryptography. My research did not delve into the role of elliptic curvesin cryptography; instead I studied basic theoretical tools for understandingrational points on an elliptic curve, which, simply put, are solutions with co-ordinates which can be expressed as ratios of whole numbers.

Interestingly enough, for a certain geometrically-defined binary operation⊕, to be described in more detail in chapter 4, we can turn the set of rationalpoints, notated as C(Q), into a commutative group. Furthermore, we canclassify elements into torsion points and non-torsion points, which are pointsof finite order and infinite order, respectively. In considering the set of alltorsion points, defined as C(Q)tors, we find that this set forms a subgroup. Itis actually known that for an elliptic curve C over Q that contains a point offinite order m, either

1 ≤ m ≤ 10 or m = 12.

More precisely, the set of all points of finite order in C(Q) forms a subgroupwhich has one of the following two forms:

(i) A cyclic group of order N with 1 ≤ N ≤ 10 or N = 12.(ii) The product of a cyclic group of order two and a cyclic group of order 2N with

1 ≤ N ≤ 4.

This characterization of C(Q)tors is known as Mazur’s Theorem.

Another valuable theorem is the Nagell-Lutz Theorem.

Theorem 1 Lety2 = f(x) = x3 + ax2 + bx + c

be a non-singular cubic curve with integer coefficients a,b,c; and let D be the dis-criminant of the cubic polynomial f(x),

D = −4a3c + a2b2 + 18abc− 4b3 − 27c2.

Let P = (x,y) be a rational point of finite order. Then x and y are inte-gers; and either y = 0, in which case P has order two, or else y divides D.

6

Once our cubic is put in the proper form, the Nagell-Lutz Theorem gives us aprocedure, although one that can be long and tedious, for finding the points offinite order for an elliptic curve. The procedure is simple; take D and find allthe integers that divide it. These are all of the possible y values. From here weplug in each y value into our curve and factor the resulting cubic to obtain anyinteger x values. The bigger D is, the longer this process takes. Luckily thereis a stronger version of Nagell-Lutz which tells us that y2 divides D, not justy. This means we only need to look at which perfect squares divide D insteadof which integers. This significantly cuts down on the number of y values wehave to process. After listing all possible (x, y) satisfying the hypotheses ofthe theorem, we then still need to check which of these are actually torsionpoints.

In addition to having a method for finding all the rational torsion pointsfor a given curve, there exists a way to find all the torsion points of a certainorder for that curve. For each integer n, there exists a polynomial with ra-tional coefficients called Ψn(x) where the roots of this polynomial are the xvalues of the torsion points of order n. For the rational torsion points of ordern you simply restrict your view to the roots of Ψn(x) that are rational.

For example, to find all the torsion points of order 3 on the curve y2 =x3 + bx+ c you would use Ψ3(x) = 3x4 +6bx2 +12cx− b2. Finding the roots ofΨ3 will give us the x-coordinates of our torsion points. To find the correspond-ing y values you simply plug these x values into our elliptic curve and solve fory. Note that because our elliptic curve contains a y2 term, we will get two yvalues for every x value. In other words, every x value yields two torsion points.

Remember, Ψn will give you all the possible torsion points of order n, bothrational and irrational. If Ψn has no rational roots, then there will be no ra-tional torsion points of order n.

Although the study of elliptic curves over Q is very rich, the topic broadenseven further when you consider elliptic curves over algebraic number fields. Analgebraic number field is a finite field extension of the rational numbers. Thatis, it is a field which contains Q and has finite dimension when considered asa vector space over Q. In other words, take Q and adjoin to it a root of apolynomial that is not found in Q. This gives us a field that contains a copyof Q and all linear combinations of powers of our adjoined root.

I focused on the curve X0(11) which is y2 = x3−4x2−160x−1264 over the

7

algebraic number field Q(ζ11), where ζ11 is an irrational root of x11 − 1 = 0,i.e. a root of x10 + x9 + x8 + x7 + x6 + x5 + x4 + x3 + x2 + x + 1 = 0.

In considering the size of the torsion subgroup of X0(11) over Q(ζ11), Idiscovered the subgroup has cardinality 5, the same cardinality as the tor-sion subgroup over Q. In fact, the same 5 points make up the two torsionsubgroups. Therefore, for X0(11), the torsion subgroup was not effected bylooking for points over Q(ζ11) instead of Q.

8

2 Background

2.1 Curves

Before we can talk about elliptic curves, we must first review a few basicdefinitions, starting with the definition of a curve. A curve C, is an equa-tion f(x, y) = 0, where f is a polynomial: f ∈ Z[x, y]. Without furthercomment, we will always assume that our curves are irreducible (meaning fis an irreducible polynomial) and smooth, meaning the system of equationsf(x, y) = 0, ∂xf = 0, ∂yf = 0 has no solutions.

A rational solution of a curve is a pair (x, y) such that x, y ∈ Q andf(x, y) = 0 . Similarly, an integer solution of a curve is a pair (x, y) such thatx, y ∈ Z and f(x, y) = 0. The definitions of rational and integer solutionsgive rise to two natural subsets of our curve, called C(Q) and C(Z). C(Q) :={(x, y) ∈ Q × Q | f(x, y) = 0} and C(Z) := {(x, y) ∈ Z × Z | f(x, y) = 0} .The majority of this paper will focus on C(Q).

The difficulty of finding C(Q) depends on the degree of the curve. Thestudy of linear curves is not very challenging, as the reader may imagine.Let’s jump instead to the slightly more interesting case of degree 2 curves,also known as the conics.

2.2 Rational Points on Conics

The general form of a quadratic equation, or conic, is

f(x, y) = ax2 + bxy + cy2 + dx + ey + f

with a, b, c, d, e, f ∈ Z. To demonstrate how to find C(Q) for any quadratic,let us consider the historical example of finding C(Q) for the unit circle

x2 + y2 = 1.

When we draw the unit circle, four rational (in fact integer) points imme-diately jump out at us: (1, 0), (0, 1), (−1, 0), and (0,−1), labeled in Figure 1.Some other rational points are also easy to recognize, such as (3/5, 4/5) and(5/13, 12/13). Note that these last two points are of the form x = m/n andy = l/n, where the gcd(m, n) and the gcd(l, n) are 1. When we plug these xand y values into C we get

(m/n)2 + (l/n)2 = 1 =⇒ m2/n2 + l2/n2 = 1 =⇒ m2 + l2 = n2.

9

Figure 1: Some Rational Points on the Unit Circle

This implies (m, l, n) is a primitive Pythagorean Triple. This process works inreverse also and gives a 1− 1 correspondence between primitive P triples andrational points on the unit circle. So we can easily think of examples of ratio-nal points on the unit circle, namely the rational solutions that correspond tothe primitive Pythagorean triples. The critical question is, how do we find allof the rational solutions on the unit circle?

2.3 Method for Rational Solutions for Quadratics

The first step in solving this problem is to pick a rational point on the curve.We can pick ANY rational point, but lets choose Po = (−1, 0). We selectedthis Po based on the knowledge that this point will make the following stepscomputationally nice. Keep in mind that we could have chosen any rationalpoint on the curve; there is nothing special about which rational point we use.

Suppose we look at the formula for the line going through Po using pointslope form. We get

10

y = t(x + 1) (1)

with t = slope.

Figure 2: Unit Circle with Line

If P ∈ C(Q) is not Po, then the line passing through Po and P has rationalslope (This is easy enough to see by the standard slope formula). What aboutthe converse? Does a line with rational slope passing through Po intersect theunit circle at a rational point P ∈ C(Q) distinct from Po? Yes! Consequently,we will be able to find a way to parametrize all the rational points based onPo via the rational parameter t.

We prove the converse statement by intersecting y = t(x+1) with x2+y2 =1. Plugging in y = tx + t and simplifying we get

(1 + t2)x2 + 2t2x + t21 = 0. (2)

From here we know x = −1 is a root, due to our choice of Po, so we know(x + 1) divides (2). Factoring (2) gives us

(x + 1)[(1 + t2)x + t2 − 1] = 0.

11

Solving for x in the factor (1 + t2)x + t2 − 1 gives us

x = (1− t2)/(1 + t2). (3)

We know that t, which equals the slope, is given as a rational number.Therefore (3) is rational, which gives us x is rational. Plugging in (3) into (1)gives us that y is rational, with

y = t((1− t2)/(1 + t2) + 1) = t((1− t2 + 1 + t2)/(1 + t2)) = 2t/(1 + t2).

Therefore we have shown that the converse statement is true. We can nowparametrize C(Q):

C(Q) = {((1− t2)/(1 + t2), 2t/(1 + t2)) | t ∈ Q}.

This method of finding all the rational points works for any quadratic equa-tion, assuming that you have one rational point to start with. C(Q) can eitherbe the empty set () or infinite in size and is, in the second case, parametrizedby a single rational parameter.

2.4 Projective Space

It will be exceedingly helpful later on to look at our curves as projective curves.This requires us to know at least a little about projective space. We will startby describing what we mean when we say a curve is projective.

Definition 1 A projective curve is the set of zeros of a homogeneous polyno-mial of three variables: F (x, y, z) = 0. We will assume that F has coefficientsin Z. We recall that F (x, y, z) is homogeneous of degree d if F (kx, ky, kz) =kdF (x, y, z) for all constants k.

The curves we have been considering are of two variables only and have notbeen restricted to being homogeneous. This, however, is not a problem. Anycurve in two variables can be made into a homogeneous curve in three. Takef to be a curve in two variables and make the substitution x = X/Z andy = Y/Z. This makes f(x, y) = 0 into f(X/Z, Y/Z) = 0, which clearing de-nominators, becomes F (X, Y, Z) = 0.

More specifically, if we multiply both sides of f(X/Z, Y/Z) = 0 through byZd where d is the greatest degree of the individual terms of f, we get a homoge-neous equation F (X,Y, Z) = 0. This substitution and multiplication can also

12

be performed by completing each monomial in f(X, Y ) = 0 with the power ofZ which makes that monomial have total degree d where d is as above. Forexample, the curve y2 = x3 +x2 +17 would become Y 2Z = X3 +X2Z +17Z3.To summarize, F (X, Y, Z) = Zdf(X/Z, Y/Z).

The introduction of an extra variable serves to embed the ordinary planecurve f(x, y) = 0 into what is called the projective plane P2. We will nowdescribe the latter. Consider the set of all triples (X,Y, Z) ∈ C3, minus theorigin triple (0, 0, 0). On this set, we introduce an equivalence relation by

(X,Y, Z) ∼ (λX, λY, λZ) for all λ ∈ C×.

The (complex) projective plane P2 is defined to be the set of equivalence classesof this equivalence relation. According to this description, two points areequivalent if they lie along the same line towards the origin. We formallywrite projective space as

P2(C) = {(X, Y, Z) | X, Y, Z ∈ C}/ ∼= {[X : Y : Z]}.

This means [x : y : z] = [λx, λy, λz] | λ 6= 0. For example, [1 : 0.5 : 1.5] is thesame point in projective space as [2 : 1 : 3].

How do these projective points relate to the homogenization process wedescribed above? Given a point [X : Y : Z] in P2, we can always write[X : Y : Z] = [X/Z : Y/Z : 1] as long as Z 6= 0. Now, if F (X, Y, Z) = 0 andZ 6= 0, then (x, y) = (X/Z, Y/Z) is on our original curve f(x, y) = 0; con-versely, given a point (x, y) on f(x, y) = 0, we get a projective point [x : y : 1]on F (X, Y, Z) = 0. Note that the projective curve F (X, Y, Z) = 0 carries allthe points on f(x, y) = 0 in its Z 6= 0 component, but, in addition, could havemore points “at infinity,” meaning in its Z = 0 component. These additionalpoints serve to “complete” the curve (in various senses) which will be seen tohave various benefits.

This is a quick overview of projective curves and projective space. We willbriefly revisit projective curves in chapter 3.

13

3 Elliptic Curves

3.1 EC Definitions

As the degree of f increases, the amount known about C(Q) drastically de-creases. It is here that we enter the study of degree three curves, of whichelliptic curves are the most interesting. So, what is an elliptic curve?

Definition 2 An elliptic curve over Q is a smooth (non-singular) projectivecurve of degree 3 F (X, Y, Z) = 0 (where F has rational coefficients), equippedwith a rational base point O.

A basic form for an elliptic curve is

y2 + a1xy + a3y = x3 + a2x2 + a4x + a6.

This, in fact, is the form that Pari uses when initializing a new elliptic curve.Pari is a special math program that is incredibly useful when working withelliptic curves, as well as many other branches of advanced mathematics.

3.2 Weierstrass Form

We can always put elliptic curves in a standard useful form, called WeierstrassForm. In general, any cubic equation with a rational point can be put intothis form. Classic Weierstrass Form is

y2 = 4x3 − g2x− g3.

A variation of Weierstrass Form, which is more commonly in use today, andthe one I will be referring to from here on out, is

y2 = x3 + ax2 + bx + c.

The trick to making this change of form is to make a change of axes by lineartransformations. For an example of this process see Appendix A.

From now on, all our elliptic curves we be in Weierstrass form.

3.3 EC Definitions Revisited

According to the definition, there are three interesting conditions that must bemet in order for a curve to be an elliptic curve. First, curve must be projective,

14

which we described in chapter 2. Second, the curve must be smooth. Thismeans that the gradient of F

〈∂F/∂x, ∂F/∂y, ∂F/∂z〉

never vanishes simultaneously (all three parts of this vector never equal zeroat the same time) on the curve. This tells us there are no cusps or nodes inthe graph of our curve and that that the cubic part has three distinct roots.One can check that y2 = x3 + ax2 + bx + c is smooth if and only if the cubicpolynomial in x in the right hand side has no repeated roots.

3.4 Projective Space Revisited

The third condition is our curve must be equipped with a rational base pointO. This means that C(Q) for an elliptic curve C is never empty; C always hasat least one rational point. In fact, because C is restricted to being a projec-tive curve, we actually have a nice and compact way of writing this rationalbase point.

Let us recall that in projective space f(x, y) = 0 becomes F (X, Y, Z) = 0and that we are now going to restrict our f to being an elliptic curve. Thismeans that when f becomes homogeneous, all of the terms on both sides ofthe equation will have at least one power of Z, except the X3 term. Our curvethen looks like

Y 2Z = X3 + aX2Z + bXZ2 + cZ3.

What happens when we let Z = 0?. All of the terms become zero expect X3

and we get the equation X3 = 0. This has the solution X = 0. We thereforehave a single projective point [0 : Y : O] = [0 : 1 : 0] in the intersection of thecurve with the line at infinity Z = 0. We will call this the point at infinity:

[0 : 1 : 0].

Due to the fact that elliptic curves are by definition projective curves, ourelliptic curve C contains this point at infinity. It therefore makes sense toset the rational base point mentioned in the definition of elliptic curves equalto the point at infinity. By convention, whenever our curve is in Weierstrassform, this point O will serve as the “origin” of the curve.

We therefore have completed the breakdown of the definition and forms ofelliptic curves. We are now ready to start to explore what makes these curvesso interesting to study!

15

4 Group Law

4.1 Defining ⊕Assume we are working with the elliptic curve y2 = x3 + ax2 + bx + c. Curvesof this form look similar to figure 3.

Figure 3: Elliptic Curve

Let’s define a way for rational points on this curve to interact. In fact, weare going to define a binary operation, notated ⊕, for C(Q). Let P and Qbe elements in C(Q) with P = (x1, y1), Q = (x2, y2). Suppose we draw a linethat connects P and Q. It is easy enough to see that there will be a pointwhere this line intersects with the elliptic curve. Let’s see what we can findout about this intersection point.Using the point-slope form of a line we get ~PQ =: y − y1 = λ(x − x1) withλ = y2−y1

x2−x1. Solving for y gives us the equation y = y1 + λ(x − x1). Plugging

this y value into our elliptic curve gives us

y2 = λ2(x− x1)2 + 2λ(x− x1)y1 + y1

2 = x3 + ax2 + bx + c.

16

Let’s consider the equation formed by the second equal sign. Moving every-thing to the right and collecting terms gives us

0 = x3 + (a− λ2)x2 + ...lower terms.

Due to the fact that this is a cubic equation in x and we know the equationhas three roots, we get that

x3 + (a− λ2)x2 + ... = (x− x1)(x− x2)(x− x3).

Using Vieta’s formulas, which allow us to write the coefficients of powers of xin terms of the roots of the polynomial, we get that −(x1 + x2 + x3) is the x2

coefficient. We know x1 and x2 from P and Q, so we get the formula

x3 = λ2 − a− x1 − x2

which tells us that x3 is rational. In terms of our picture, this x3 is the x valueof our intersection point. From here, plugging in x3 into the line equationgives us a y3 value that is also rational. Summing up what we have found;the intersection of the line ~PQ and the elliptic curve gives us a rational point(x3, y3), labeled as P ∗Q in Figure 4.

So a line connecting two points in C(Q) intersects the curve at anotherpoint in C(Q), similar to what we found with conics! In fact, because ourcubic curve has a y2 in it, we actually have found a fourth point that is inC(Q), namely P ∗ Q reflected over the x − axis, which is (x3,−y3). Let’sdo something crazy and define this fourth point as P ⊕ Q. Therefore the ⊕operator extends the line connecting two points and reflects it over the x-axis.

4.2 (P ∗Q)⊕ (P ⊕Q)

From this definition of ⊕ we can make a few important observations. First,what happens when we ⊕ P ∗Q and P ⊕Q? We can’t use our normal methodbecause λ does not exist (connecting the two points creates a vertical line).The solution is to set P ∗Q⊕P ⊕Q equal to the point at infinity, notated fromhere on as O. Remember that we are using a projective curve by definition!Because we are working with an elliptic curve, it would be good to note that−O = O. Therefore, the connecting line between P ∗Q and P ⊕Q intersectsthe curve at a third point infinitely high above and below these two points.(See Figure 5)

It is easy enough to see that P ⊕O = P by using the definitions of O and⊕. What we have then is the two following facts:

17

Figure 4: Elliptic Curve Intersected with ~PQ

i) P ⊕O = Pii) P ∗Q⊕ P ⊕Q = O (true for any two points reflected over the x-axis).

From these two facts it looks like O acts like an identity for the ⊕ operatorand reflection over the x-axis defines a point’s inverse.

4.3 P ⊕ P

Although we have defined how to ⊕ two different points, ⊕ a point P and O,and ⊕ inverses, we have yet to define how to ⊕ a point to itself. Once againwe can’t use our normal method because λ would equal 0

0, which is undefined

and therefore does not exist. The question in defining P ⊕P lies in answeringwhat should be choose our slope to be?

It turns out that the best way to define λ is to take the derivative of thecurve at P and use that value for the slope. THe easiest way to find λ is to useimplicit differentiation. For example, suppose we have the curve y2 = x3 + 17.

18

Figure 5: Adding P ∗Q and P ⊕Q

Differentiating this curve implicitly gives us

2yy′ = 3x2 =⇒ λ = y′ =3x2

2y

In general we would get

λ = y′ =3x2 + 2az + b

2y=

f ′(x)

2y

To get the numerical value of the slope at a point P we would plug in thecoefficients a, b, and c, and the coordinates of the point P . Once λ is obtainedwe can simply continue with the normal process described in section 4.1.

It turns out to be convenient to have an explicit expression for 2P interms of the coordinates for P . If we plug in λ = f ′(x)

2yinto the equation

y2 = (λx+x1)2 (from section 4.1), put everything over a common denominator,

and substitute y2 by f(x), the we get the duplication formula

x coordinate of 2(x, y) =x4 − 2bx2 − 8cx + b2 − 4ac

4x3 + 4ax2 + 4bx + 4c.

19

It turns out that adding a point to itself once, twice, even n times, is some-thing of great interest in the study of elliptic curves. This is because for somepoints P ∈ C(Q) there exists a smallest integer n such that nP = O, wherenP is defined as P ⊕P ⊕ ...⊕P n times. Any point that satisfies this property,i.e. such an n exists, is called a torsion point of finite order n. Any point forwhich no such n exists is called a torsion point of infinite order. This will bediscussed more formally in Chapter 5.

4.4 Elliptic Curves Under ⊕So what we have found is that the set of rational points on an elliptic curve hasan operation, ⊕, which gives rise to a unique identity point O and makes everypoint have an inverse. If only we had associativity, then the set of rationalpoints on elliptic curves would be a group. As it turns out associativity doeshold, so C(Q) is a group under ⊕. Proving associativity is not hard, but it isvery time consuming and therefore it will be left as a fun little exercise for thereader.

The fact that C(Q) is a group allows us to explore a wide variety of things,such as the existence of a group structure. The classification of the groupstructures of rational points on elliptic curves is known as the Mordell-WeilTheorem.

Theorem 2 Let C be a non-singular cubic curve. Then C(Q) is a finitelygenerated abelian group isomorphic to Zr ⊕ F whereZr = Z× Z× ...× Z r timesF = {P ∈ C(Q) | P has finite order} andr = rank, which is the number of generators needed.

This theorem tells us that if C is a non-singular cubic curve, then thegroup C(Q) is finitely generated. This means that there exist a finite numberof points in C(Q) such that if we took all the possible linear combinations ofthose points, we would have generated C(Q).

20

5 Torsion Points

5.1 Definition of torsion points

Every point on an elliptic curve is one of two kinds: a point of finite orderor a point of infinite order. For P to be a point of finite order means thereexist a smallest integer n such that nP = O. If no such n exists then P is ofinfinite order. In other words, P being of infinite order means you can neverget the point at infinity by adding P to itself, no matter how many times youdo it. This distinction between finite and infinite points leads to the followingdefinition:

Definition 3 A point P ∈ C(Q) is called a torsion point of order n if P hasorder n.

Gathering all of the torsion points of a an elliptic curve C will form a finitesubgroup of C(Q), called C(Q)tor:

C(Q)tor = {P ∈ C(Q) | P has finite order} ⊆ C(Q).

5.2 Points of Order 2

What do we actually know about these points of finite order? Let’s start withpoints of order two. We want

2P = O, where P 6= O.

If we allow P = (x, y), then −P = (x,−y). Therefore 2P = O is equivalent toP = −P . This implies (x, y) = (x,−y), which can only happen when y = 0.So all points of order two must have y = 0. If we allow x ∈ C, we find we getfour points of order two:

S = {O, (α1, 0), (α2, 0), (α3, 0)}

where α1, α2, α3 are the roots of x3 + ax2 + bx + c. It turns out S is a groupof order 4, where every element is of order 1 or 2. What we have is S is theFour Group, which is the direct product of two groups of order 2.

If we restrict x to being in R, we have two possibilities: either all threeroots are real, in which case we get the Four Group, or only one root is realand we get a cyclic group of order 2. The second possibility results in a graphlike Figure 3. The first possibility’s graph is seen in Figure 6.

21

Figure 6: Three real Torsion Points of Order 2

Similarly, if we restrict x to being in Q we get the above two possibilities,plus a third possibility, the trivial possibility S = {O}, which tells us no ra-tional roots exist. We have found that it is easy enough to find the torsionpoints of order 2.

5.3 Points of Order 3

Torsion Points of order 3 are the points that satisfy 3P = O, which implies weare looking for the points such that 2P = −P . Recall the duplication formulafrom section 4.3. This formula gives us the x value of 2P based on the x valueof P = (x, y). We want 2P = −P = (−x, y), which means the x value of 2Pmust equal the x value of (−P ). We therefore get the equation

x =x4 − 2bx2 − 8cx + b2 − 4ac

4x3 + 4ax2 + 4bx + 4c.

Through cross multiplication and moving every term to one side of the equalsign we get a simplified equation in terms of x. For reasons that will make

22

sense in a little bit, let’s call this equation Ψ3. The equation is

Ψ3(x) = 3x4 + 4ax3 + 6bx2 + 12cx + (4ac− b2).

The roots of this equation will be the x values for our points of order 3.

If we allow x ∈ C we get 4 distinct roots. We know they are distinct be-cause you can check that Ψ3(x) and Ψ′

3(x) have no common roots. In the eventthat they had a common root, then f(x) and f ′(x) would have a common root,which would be a contradiction to f(x) being non-singular. Plugging in these4 roots of Ψ3(x) into our elliptic curve will yield a total of 8 distinct points. Alltogether we get 9 points of order 3, the above mentioned 8 together with thepoint at infinity O. There is only one commutative group of order 9 with everyelement having order 3, and that is the product of two cyclic groups of order 3.

If we restrict x to being in R, we will always get a cyclic group of order 3.If we restrict x to being in Q, we will either get a cyclic group of order 3 orthe trivial group {O}.

It is not too hard to see that we can use the process we used in findingtorsion points of order 3 to find torsion points of order higher than three. Wesimply need to find a way of re-writing nP = O that will utilize what wealready know.

5.4 Nagell-Lutz Theorem

There are many more points of infinite order than finite order. This willbecome immediately evident if you were to try and discover elements in C(Q)tor

by trial and error. In fact, it would be a nearly impossible feat to discoverthe torsion points of a curve simply by the guess-and-check method. FindingC(Q)tor would be extremely frustrating if it weren’t for a very convenienttheorem, named for its two independent discoverers, the Norwegian TrygveNagell (18951988) who published it in 1935, and Elisabeth Lutz (1937).

Theorem 3 Let P = (x, y) be a rational point of finite order. Then x and yare integers and either y = 0 (for points of order 2) or else y divides D, whereD is the discriminant

D = −4a3c + a2b2 + 18abc− 4b3 − 27c2 for y2 = f(x) = x3 + ax2 + bx + c.

23

Using this theorem gives us a way to find all the rational points of finite order.However, one must keep in mind that this is not an if and only if statement. Arational point on an elliptic curve can have integer coefficients with y dividingD and not be a rational torsion point.

It turns out that there is a stronger form of the Nagell-Lutz theorem thatis useful for calculating:

Theorem 4 Let y2 = f(x) = x3 + ax2 + bx + c be a non-singular cubiccurve with integer coefficients a, b, c; and let D be the discriminant of thecubic polynomial f(x), D = −4a3c + a2b2 + 18abc− 4b3− 27c2. Let P = (x, y)be a rational point of finite order. Then x and y are integers and either y = 0,in which case P has order 2, or else y2 divides D.

The Nagell-Lutz Theorem gives us a procedure, although one that can be longand tedious, for finding the points of finite order for an elliptic curve. Theprocedure is simple; take D and find all the integers that divide it. These areall of the possible y values. From here we plug in each y value into our curveand factor the resulting cubic to obtain any integer x values. The bigger D is,the longer this process takes. Luckily the stronger form of Nagell-Lutz helps tocut down the number of y possibilities that divide D. Since y2 divides D, weonly need to look at which perfect squares divide D instead of which integers.This significantly cuts down on the number of y values we have to process.After listing all possible (x, y) satisfying the hypotheses of the theorem, wethen still need to check which of these are actually torsion points.

It is good to note that the Nagell-Lutz Theorem cannot be used to provea rational point is of finite order, but it can be, and is often, used to prove arational point is of infinite order. How? Easily enough, we keep computing nPuntil you reach either an n that gives coordinates that are not integers or untilwe compute past 16P , whichever happens first. Why are we only interestedin up to at most 16P? The answer lies in Mazur’s Theorem.

5.5 Mazur’s Theorem

Mazur’s Theorem is a theorem which describes what we can expect about thestructure of C(Q)tor.

Theorem 5 Let C be a non-singular rational cubic curve, and suppose thatC(Q) contains a point of finite order m. Then either

1 ≤ m ≤ 10 or m = 12.

24

More precisely, the set of all points of finite order in C(Q) forms a subgroupof C(Q) which has the following forms:i) A cyclic group of order N with 1 ≤ N ≤ 10 or N = 12.ii) The product of a cyclic group of order 2 and a cyclic group of order 2Nwith 1 ≤ N ≤ 4.

Amazingly, this theorem tells us that there are no rational torsion points oforder greater than 12. Even more odd, there are no rational torsion points oforder 11 either. Unfortunately I was unable to delve into the proof as to whyno rational torsion points of order 11 exist. I was, however, able to computethe torsion subgroups of 15 different elliptic curves, one corresponding to eachof the possible subgroup structures. In Appendix B you can find an examplethat takes you through finding C(Q)tor for one of the easier curves among the15 I did.

5.6 Ψn(x)

Suppose you were interested in finding all the rational torsion points of aspecific order instead of searching for the set of all rational torsion points.Sections 5.2 and 5.3 covered torsion points of order 2 and 3; for order 3 weuse Ψ3(x) = 3x4 + 4ax3 + 6bx2 + 12cx + (4ac− b2) and for order 2 we can useΨ2(x) = x3 +ax2 + bx+ c, whose roots corresponds to our elliptic curve valueswhen y = 0. Solving

4P = O =⇒ 2P = −2P

gives us

Ψ4(x) = 4y(x6 + 5bx4 + 20cx3 − 5b2x2 − 4bcx− 8c2 − b3).

The roots of this equation can be used to find the torsion points of order 4.Setting Ψ4 equal to zero tells us either y = 0, giving us the points of order 2( 2 divides 4 so the points of order 2 will also satisfy 4P = O, and there forΨ4 must give us the points of order 2 as well), or x6 + 5bx4 + 20cx3 − 5b2x2 −4bcx− 8c2 − b3 = 0, giving us the points of order four.

It turns out that we can find equations Ψn(x) for each integer n, where theroots of Ψn(x) will be the x values for the points of order n. For n > 4, a setof recursion formulas take over and allow us an easy way to calculate Ψn(x).Using Ψ2(x) = 2y and Ψ/3(x) = 3x4 + 4ax3 + 6bx2 + 12cx + (4ac− b2) we get

25

Definition 4

Ψ2n+1(x) = Ψn+2(x)Ψn(x)3 −Ψn−1(x)Ψn+1(x)3 for n ≥ 2

Ψ2n(x) =Ψn(x)(Ψn+2(x)Ψn−1(x)2 −Ψn−2(x)Ψn+1(x)2)

2yfor n ≥ 3.

A quick note about the Ψn(x) equations; the roots of these equations arethe torsion points of order n. These equations give both the rational and ir-rational torsion points for a given curve. If in factoring these equations wefind that there are no integer x values, or if there are no integer roots thatlead to integer y values, then there are no rational torsion points of that order.Therefore, Ψ13(x) will have at least one real root, however it will never haveany integer roots. This is a direct observation from Mazur’s Theorem.

The degrees of these Ψ equations grows very quickly. The task of calcu-lating Ψn(x) for even relatively small values of n, such as 11, because verycumbersome. It is possible, however, to write a program that will carry outthe recursions for you. In Appendix C you will find my Ψn(x) converter pro-gram, written for gp-PARI.

26

6 Appendix A

Let’s put the curve y2 + y = x3 − x2 − 10x − 20 into Weierstrass form. Westart by completing the square on the left hand side:

y2 + y = (y + 1/2)− 1/4 = x3 − x2 − 10x− 20.

Adding 1/4 to each side and making the substitution Y = y + 1/2 gives us

Y 2 = x3 − x2 − 10x− 20 + 1/4.

This substitution corresponds to making a change of axis, where the new axisY is the old axis plus 1/2. We now need to clear the denominator on theright hand side. Suppose we allowed the following substitutions, y = d3Y andx = d2x. Plugging in Y = d−3y and x = d−2x we get

d−6y2 = d−6x3 − d−4x2 − 10d−2x− 20 + 1/4.

From here we multiply the entire equation through by d6, which leaves us with

y2 = x3 − d2x2 − 10d4x− 20d6 + d6/4.

If we choose d wisely, we can clear the denominator on the right hand side.Setting d = 2 gives us the final equation

y2 = x3 − 4x2 − 160x− 1264.

27

7 Appendix B

Finding C(Q)tor for the curve y2 = x3 + 4.

a = 0, b = 0, c = 4 D = 432

Possible y values- {0, 1,−1, 2,−2, 3,−3, 4,−4, 6,−6, 12,−12}

0 =⇒ 0 = x3 + 4 =⇒ −4 = x3 =⇒ x /∈ Z =⇒ no points with y = 0+1 =⇒ 1 = x3 + 4 =⇒ −3 = x3 =⇒ x /∈ Z =⇒ no points with y = +1+2 =⇒ 4 = x3 + 4 =⇒ 0 = x3 =⇒ x = 0 =⇒ (0, 2) and (0,−2)+3 =⇒ 9 = x3 + 4 =⇒ 5 = x3 =⇒ x /∈ Z =⇒ no points with y = +3+4 =⇒ 16 = x3 + 4 =⇒ 12 = x3 =⇒ x /∈ Z =⇒ no points with y = +4+6 =⇒ 36 = x3 + 4 =⇒ 32 = x3 =⇒ x /∈ Z =⇒ no points with y = +6+12 =⇒ 144 = x3+4 =⇒ 140 = x3 =⇒ x /∈ Z =⇒ no points with y = +12

All possible points

(0, 2)→2(0,2)=(0,-2) =⇒ 2P = −P =⇒ order 3(0,−2)→2(0,-2)=(0,2) =⇒ 2P = −P =⇒ order 3O → order 1

So C(Q)tor = {O, (0, 2), (0,−2)}.

The structure of C(Qtor is a cyclic group of order 3.

28

8 Appendix C

Since all elliptic curves can be put into Classical Weierstrass Form, which hasno x2 term, we can allow a = 0, thus simplifying our recursion equations. Myprogram is broken into three parts: