Solutions to January 2003 Examination. MATH444.

Question 1. Part (a) is a straightforward variation of questions both on the example sheets and in lectures. Parts (b),(c) are harder variations of three medium-level-difficulty questions on the exercise sheets, but are not similar to any examples in lectures. (a). The point (x, y) on f(X, Y) = Y^{2} − (X − 1)^{4}(X^{3} + 1) = 0 is singular if f(x, y) = 0, (∂f/∂X)(x, y) = −4(x − 1)^{3}(7x^{3} − 3x^{2} + 4) = 0 and (∂f/∂Y)(x, y) = 2y = 0. An immediate common solution is x = 1, y = 0, so that (1, 0) is a singular point [note that the question did not ask “find all singular points on the curve” and so it is not necessary to justify here the fact that (1, 0) is the only singular point]. f(X + 1, Y + 0) = Y^{2} − X^{4}((X + 1)^{3} + 1) = Y^{2}+ terms of higher degree, and so there are two tangents at (1, 0), namely Y − 0 = 0 twice; that is: Y = 0 twice.

The curve C : Y^{2} = (X − 1)^{4}(X^{3} + 1) can be written as (Y/(X − 1)^{2})^{2} = (X^{3} + 1), so that the birational transformation (X, Y) ↦ (X, Y/(X − 1)^{2}) [with inverse (X, Y) ↦ (X, Y (X − 1)^{2})] maps C to the curve Y^{2} = X^{3} + 1, which is of the required form. [8 marks] (b). Let C_{0} : Y^{2} = 4X^{6} + 2X^{5} + X^{2} + 6X + 1. Then the birational transformation (X, Y) ↦ (2X, 4Y) [with inverse (X, Y) ↦ (X/2, Y/4)] maps C_{0} to the curve C_{1} : (Y/4)^{2} = 4(X/2)^{6} + 2(X/2)^{5} + (X/2)^{2} + 6(X/2) + 1; multiplying both sides by 16 rearranges this as: C_{1} : Y^{2} = X^{6} + X^{5} + 4X^{2} + 48X + 16, which is of the first required form.

Starting at C_{0} again, the birational transformation (X, Y) ↦ (1/X, Y/X^{3}) [with inverse: (X, Y) ↦ (1/X, Y/X^{3})] maps C_{0} to the curve C_{2} : (Y/X^{3})^{2} = 4(1/X)^{6} + 2(1/X)^{5} + (1/X)^{2} + 6(1/X) + 1, and on multiplying both sides by X^{6}, we get: C_{2} : Y^{2} = 4 + 2X + X^{4} + 6X^{5} + X^{6}, which is the same as C_{2} : Y^{2} = X^{6} + 6X^{5} + X^{4} + 2X + 4, which is of the second required form.

Then the birational transformation (X, Y) ↦ (X + 1, Y) [with inverse (X, Y) ↦ (X − 1, Y)] maps C_{2} to the curve C_{3} : Y^{2} = (X − 1)^{6} + 6(X − 1)^{5} + (X − 1)^{4} + 2(X − 1) + 4; that is: C_{3} : Y^{2} = X^{6} − 14X^{4} + 36X^{3} − 39X^{2} + 22X − 5, which is of the third required form. [7 marks] (c). Let D_{1} : Y^{2} = −X^{4} + 2X^{2} − 2. The birational transformation (X, Y) ↦ (X, Y/i) [with inverse (X, Y) ↦ (X, iY)] maps D_{1} to the curve D_{2} : (iY)^{2} = −X^{4} + 2X^{2} − 2; that is D_{2} : Y^{2} = X^{4} − 2X^{2} + 2. Rewrite D_{2} as Y^{2} = X^{4} −2X^{2} +2 = (X^{2} −1)^{2} +1, which is the same as: D_{2} : (Y +X^{2} −1)(Y −(X^{2} −1)) = 1, or D_{2} : (Y + X^{2} − 1)(Y + X^{2} − 1 − 2((X(Y + X^{2} − 1)/(Y + X^{2} − 1))^{2} − 1)) = 1, from which it is clear that that the birational transformation (X, Y) ↦ (Y +X^{2} −1, X(Y +X^{2} −1)) [with inverse (X, Y) ↦ (Y/X, X − (Y/X)^{1} +1)] maps D_{2} to D_{3} : X(X −2((Y/X)^{2} −1)) = 1, which can be rearranged as: 2Y^{2} = X^{3} +2X^{2} −X. Finally, the birational transformation (X, Y) ↦ (2X, 4Y) [with inverse (X, Y) ↦ (X/2, Y/4)] maps D_{3} to D_{4} : 2(Y/4)^{2} = (X/2)^{3} + 2(X/2)^{2} − (X/2); that is: Y^{2} = X^{3} + 4X^{2} − 4X, as required. [6 marks]

This is not possible over R, since Y^{2} = −X^{4} + 2X^{2} − 2 is the same as Y^{2} = −(X^{2} − 1)^{2} − 1, which has no points over R, whereas Y^{2} = X^{3} + AX^{2} + BX has infinitely many (for X sufficiently large). Since there is no birational transformation over R there must also be none over Q(\sqrt{2}). However, the map (X, Y) ↦ (1/X, Y/X^{2}) [with inverse (X, Y) ↦ (1/X, Y/X^{2})] maps our curve to (Y/X^{2})^{2} = −(1/X)^{4} + 2(1/X)^{2} − 2, which is the same as Y^{2} = −2X^{4} + 2X^{2} − 1. Since the coefficient of X^{4} is a square in Q(\sqrt{−2}), the same procedure as before will clearly take us to the form Y^{2} = X^{3} + AX^{2} + BX, and so it is possible over Q(\sqrt{−2}). [4 marks]

Question 2. Parts (a),(b) are straightforward variations of problems on exercise sheets. Parts (c).(d) are unseen, although they have seen the x ↦ x^{3} injective trick in another context. (a). Let x_{0} = a_{0} = 3. Then |x_{0}^{2} + 2|_{11} = 11^{−1}. Look for x_{1} = a_{0} + 11a_{1} such that |x_{1}^{2} + 2|_{11} ⩽ 11^{−2}. This is satisfied if: (3 + 11a_{1})^{2} ≡ −2 (mod 11^{2}) ⟺ 2 · 3 · 11a_{1} ≡ −2 − 3^{2} (mod 11^{2}) ⟺ 6a_{1} ≡ −1 (mod 11) ⟺ a_{1} ≡ −2 ≡ 9 (mod 11). So, now define: a_{1} = 9 and x_{1} = a_{0} + 11a_{1} = 102. Check that indeed |x_{1}^{2} + 2|_{11} = |10406|_{11} = 11^{−2}. Now, look for x_{2} = a_{0} + 11a_{1} + 11^{2}a_{2} such that |x_{2}^{2} + 2|_{11} ⩽ 11^{−3}. This is satisfied if: (102 + 11^{2}a_{2})^{2} ≡ −2 (mod 11^{3}) ⟺ 2 · 102 · 11^{2}a_{2} ≡ −2 − 10404 ≡ −10406 (mod 11^{3}) ⟺ 204a_{2} ≡ −86 (mod 11) ⟺ 6a_{2} ≡ 2 (mod 11) ⟺ a_{2} ≡ 4 (mod 11). So, now define: a_{2} = 4 and x_{2} = 102 + 11^{2}a_{1} = 586. Check that indeed |x_{2}^{2} + 2|_{11} = |343398|_{11} = |11^{3} · 258|_{11} = 11^{−3}. [5 marks]

Suppose there were an x ∈ Z such that |x^{2} − 11|_{11} < 11^{−2}, and let |x|_{11} = 11^{r}, for some r ∈ Z. Then |x^{2}|_{11} = 11^{2r}. Note that | − 11|_{3} = |11|_{11} = 11^{−1}, so that |x^{2}|_{11} ≠ | − 11|_{11}, which means [from the general property for any p-adic valuation that, if |a|_{p} ≠ |b|_{p} then |a + b|_{p} = max(|a|_{p}, |b|_{p})] that |x^{2} − 11|_{11} = max(11^{2r}, 11^{−1}). If r < 0 then 11^{2r} < 11^{−1} and so this maximum will be 11^{−1}; if r ⩾ 0 then 11^{2r} > 11^{−1} and so this maximum will be 11^{2r}. In either case, we must always have |x^{2} − 11|_{11} ⩾ 11^{−1}, and so it never happens that |x^{2} − 11|_{11} < 11^{−2}. [3 marks] (b). First find the 5-adic expansion of 7/3. Note that |7/3|_{5} = 1, so the 5-adic expansion is of the form: 7/3 = a_{0}, a_{1}a_{2} … = a_{0} + 5a_{1} + 5^{2}a_{2} + . . .. So, 7 = 3(a_{0} + 5a_{1} + 5^{2}a_{2} + …). This gives 7 ≡ 3a_{0} (mod 5), so that a_{0} = 4. Hence, 7 ≡ 3 · 4 + 3 · 5a_{1} (mod 5^{2}), which implies −5 ≡ 3 · 5a_{1} (mod 5^{2}), and so −1 ≡ 3a_{1} (mod 5), giving a_{1} = 3. Similarly, a_{2} = 1, a_{3} = 4, a_{4} = 1. At this point, we suspect that 7/3 = 4, \overline{31}. We can confirm this by letting x = 4, \overline{31}. Then x − 4 = 0, \overline{31} and so 5^{2}(x − 4) = (x − 4) − 3 · 5 − 1 · 5^{2}, so that 24x = 56; that is: x = 7/3, as required. Finally, 7/15 = (1/5) · (7/3), so that the 5-adic expansion of 7/15 is the same as that of 7/3, but moved one place to the left; that is: 7/15 = 43, \overline{13}. [6 marks] (c). Compute 1, \overline{2} = 1 + 2p + 2p^{2} + 2p^{3} + … = 1 + 2p(1 + p + p^{2} + …) = 1 + 2p/(1 − p) = (1 + p)/(1 − p). So, 1, \overline{2} = −9/8 ⟺ (1 + p)/(1 − p) = −9/8 ⟺ 8(1 + p) = −9(1 − p) ⟺ p = 17.

Compute 11, \overline{1} = p^{−1} + 1 + p + p^{2} + p^{3} + … = p^{−1}(1 + p + p^{2} + …) = p/(1 − p). So, 11, \overline{1} = −1/110 ⟺ p/(1 − p) = −1/110 ⟺ −p(1 − p) = −110 ⟺ p^{2} − p − 110 = 0 ⟺ (p + 10)(p − 11) = 0 ⟺ p = −10 or 11. So we must have p = 11 since p is prime. [5 marks] (d). Note that 3 is coprime to p − 1, and so there exist λ, μ ∈ Z such that (p − 1)λ + 3μ = 1. Now, suppose that v^{3} = w^{3} in F_{p}^{∗}. Then v^{3μ} = w^{3μ}. Also (p − 1)λ is a multiple of the order of the group F_{p}^{∗} and so v^{(p−1)λ} = w^{(p−1)λ} (since both are equal to 1). Multiplying these last two equations gives: v^{(p−1)λ+3μ} = w^{(p−1)λ+3μ}, and so v = w. We have shown that v^{3} = w^{3} implies v = w, and so the map v ↦ v^{3} is injective, and hence surjective (and hence bijective), from F_{p}^{∗} to F_{p}^{∗}. Hence F_{p}^{∗} = (F_{p}^{∗})^{3} and so F_{p}^{∗}/(F_{p}^{∗})^{3} has only one element.

Let d ∈ Q_{p} satisfy |d|_{p} = 1. By the above, there exists x_{0} ∈ Z such that x_{0}^{3} ≡ d (mod p). This is the same as |f(x_{0})|_{p} < 1, where f(x) = x^{3} − d. But from the fact that d is not divisible by p and x_{0}^{3} ≡ d (mod p) it follows that x_{0} is not divisible by p, and so |x_{0}|_{p} = 1, giving that |f′(x_{0})|_{p} = |3x_{0}^{2}|_{p} = 1. Therefore, |f(x_{0})|_{p} < |f′(x_{0})|_{p}^{2} and so, by Hensel’s Lemma, there exists a solution in Q_{p} to x^{3} − d; that is, d is a cube in Q_{p}^{∗}; that is: d = 1 in Q_{p}^{∗}/(Q_{p}^{∗})^{3}. Any e ∈ Q_{p} satisfying |e|_{p} = p^{3r}, do some r, must therefore also be a cube in Q_{p}^{∗}, since |(p^{r})^{3}e|_{p} = 1. We can therefore divide up all members of Q_{p}^{∗} into: e such that |e|_{p} = p^{3r}, e such that |e|_{p} = p^{3r+1} and e such that |e|_{p} = p^{3r+2}, which give the only 3 distinct elements of Q_{p}^{∗}/(Q_{p}^{∗})^{3}. [6 marks]

Question 3. All parts of this question are unseen, but using general skills from exercise sheets. (a). To compute 2P, we first compute the tangent to C : Y^{2} = X(X^{2} + 4k^{4}) at P = (2k^{2}, 4k^{3}). This has slope: ℓ = (3 · (2k^{2})^{2} + 4k^{4})/(2 · 4k^{3}) = 2k, and it goes through the point P, so that the equation of the tangent is: Y = 2kX. Substituting this into Y^{2} = X(X^{2} + 4k^{4}) gives: 4k^{2}X^{2} = X(X^{2} + 4k^{4}), and so: X(X − 4k^{2}X + 4k^{4}) = 0; that is: X(X − 2k^{2})^{2} = 0, and so the line Y = 2kX meets C at the points: (2k^{2}, 4k^{3}), (2k^{2}, 4k^{3}), (0, 0). So, (2k^{2}, 4k^{3}) + (2k^{2}, 4k^{3}) + (0, 0) = o, giving: 2P = −(0, 0) = (0, 0). It follows that 3P = (2k^{2}, −4k^{3}) and 4P = o, so that P is of order 4. The group generated by P, namely {o, P, 2P, 3P }, is then a subgroup of C(F_{p}), giving 4|#C(F_{p}) by Lagrange’s Theorem, as required. [7 marks] (b). The points {o, (0, 0), (ℓ, 0), (−ℓ, 0)} ∈ D(Q) are all 2-torsion, and form a subgroup of of D(Q) [check: each element is self inverse; closure is clear from the fact that the sum of any two of the points of order 2 gives the third point of order 2]. So, again by Lagrange’s Theorem, 4|#D(F_{p}). [4 marks] (c). It is not possible for m = 0 or 4 = 0 in F_{p}, since then E would not be an elliptic curve. First note that (\frac{−m}{p}) = (\frac{−1}{p})(\frac{m}{p}), so that it is not possible for all of (\frac{−1}{p}) = −1, (\frac{m}{p}) = −1 and (\frac{−m}{p}) = −1, and so at least one of these must equal 1 (since none are 0). If (\frac{−1}{p}) = 1 then −1 = a^{2} for some a ∈ F_{p}, and so E can be written as: Y^{2} = X(X^{2} − (2am)^{2}) which by (b) gives that E(F_{p}) has 3 points of order 2 and 4|#E(F_{p}). If (\frac{m}{p}) = 1 or (\frac{−m}{p}) = 1 then m = ±k^{2} for some k ∈ F_{p}, and so E can be written as: Y^{2} = X(X^{2} + 4k^{4}) which by (a) gives that E(F_{p}) has a point order 4 and 4|#E(F_{p}). [7 marks] (d). The fact that p ≡ 3 (mod 4) gives (\frac{−1}{p}) = −1 so that, for any u, (\frac{−u(u^{2}+n)}{p}) = (\frac{−1}{p})(\frac{u(u^{2}+n)}{p}) =

−(\frac{u(u^{2}+n)}{p}). Now, let u ≠ 0, u ∈ F_{p}. If u is a root of X^{2} + n then so is −u, giving the two points (u, 0), (−u, 0) ∈ F(F_{p}). If u is not a root of X^{2} + n then u(u^{2} + n) ≠ 0 and from the identity we have just shown, exactly one of (\frac{−u(u^{2}+n)}{p}) and (\frac{u(u^{2}+n)}{p}) is equal to 1 and the other is equal to −1. Without loss of generality, say that (\frac{u(u^{2}+n)}{p}) = 1 and (\frac{−u(u^{2}+n)}{p}) = −1. Then there exists v ≠ 0, v ∈ F_{p} such that v^{2} = u(u^{2} + n), but there does not exist v such that v^{2} = −u(u^{2} + n). This gives the two points (u, v) and (u, −v) in F(F_{p}) with X-coordinate u and no points in F(F_{p}) with X-coordinate u. So, in all cases, there are two points in F(F_{p}) with X-coordinate u or −u. Divide the p − 1 nonzero elements of F_{p} into pairs u, −u, each pair contributing two members of F(F_{p}); this gives so far a total of p − 1 members of F(F_{p}) with nonzero X-coordinate. When we also include the points o, (0, 0) ∈ F(F_{p}), then we finally obtain #F(F_{p}) = p + 1, as required. Since p ≡ 3 (mod 4), it is immediate that 4|(p + 1); that is: 4|#F(F_{p}), as required. [7 marks]

Question 4. Part (a) requires regurgitation of one of the easier proofs from lectures (middle of the course). Part (b) is a variation of examples from the example sheets. Part (c) is unseen and somewhat tricky. (a). The Nagell-Lutz Theorem states that, if (x, y) is a Q-rational torsion point on E : Y^{2} = X^{3} + AX + B, where A, B ∈ Z, then x, y ∈ Z and y = 0 or y^{2}|Δ, where Δ = 4A^{3} + 27B^{2}. Proof (from lectures). We are given the result that x, y ∈ Z. If y = 0 then the result is satisfied; otherwise, (x, y) is not 2-torsion and we can consider (x_{2}, y_{2}) = 2(x, y), with (x_{2}, y_{2}) ≠ o, and so x_{2}, y_{2} ∈ Q. But (x_{2}, y_{2}) is also a torsion point, so x_{2}, y_{2} ∈ Z. Now, the line tangent to E at (x, y) has slope (3x^{2}+A)/(2y), from which we immediately get: x_{2} = ((3x^{2} + A)/(2y))^{2} − 2x. Now, we know x_{2}, x ∈ Z and so ((3x^{2} + A)/(2y))^{2} ∈ Z. It follows that 4y^{2}|(3x^{2} + A)^{2} and so y^{2}|(3x^{2} + A)^{2} = ψ_{1}(x). Also, y^{2} = x^{3} + Ax + B = ψ_{2}(x). Using the identity given on the exam paper, y^{2}|(ϕ_{1}(x)ψ_{1}(x) + ϕ_{2}(x)ψ_{2}(x)) = Δ, as required. [10 marks] (b). The discriminant of X^{3} − X − 1 is 4 · (−1)^{3} + 27 · (−1)^{2} = 23, and so C̃: Y^{2} = X^{3} − X − 1 is an elliptic curve for all p ≠ 2, 23. The only element of C̃(F_{3}) is o, and so C̃(F_{3}) has order 1. Since the torsion subgroup of C(Q) injects into this group, its order must divide 1 and so equal 1. Hence the torsion subgroup of C(Q) is precisely {o}.

The discriminant of X^{3} − X + 1 is 4 · (−1)^{3} + 27 · (−1)^{2} = 23, and so again D̃ : Y^{2} = X^{3} − X + 1 is an elliptic curve for all p ≠ 2, 23. The elements of D̃(F_{3}) are: o, (0, ±1), (1, ±1), (−1, ±1), and so D̃(F_{3}) has order 7. The elements of D̃(F_{5}) are: o, (0, ±1), (1, ±1), (−1, ±1), (−2, 0), and so D̃(F_{5}) has order 8. Since the torsion subgroup of D(Q) injects into both of these groups, its order must divide gcd(7, 8) = 1 and so equal 1. Hence the torsion subgroup of D(Q) is again precisely {o}. [Alternatively, Nagell-Lutz can be used for these examples] [9 marks] (c). The disciminant of X^{3} − k^{2}X + k^{3} is 4 · (−k^{2})^{3} + 27 · (k^{3})^{2} = 23k^{6}. If (x, y) is a Q-rational torsion point on E : Y^{2} = X^{3} − k^{2}X + k^{3}, then we know by Nagell-Lutz that x, y ∈ Z with y^{2}|23k^{6} and so |y|^{2} ≤ 23|k|^{6}; that is: |y| ≤ \sqrt{23}|k|^{3} = (4.79583 …)|k|^{3} < 5|k|^{3}.

Imagine |x| ≥ 3|k|^{2}. We cannot have k = 0 since then the discriminant would be 0 and E would not be an elliptic curve. The cases k = ±1 have already been dealt with in (b), when it the torsion group of E(Q) was shown to be trivial. So, we can take |k| > 1, giving |k|^{2} < |k|^{4} and |k|^{3} < |k|^{6}. Imagine |x| ≥ 3|k|^{2}. Then:

|x^{2} − k^{2}| ≥ |x^{2}| − |k^{2}| ≥ 9|k|^{4} − |k^{2}| > 9|k|^{4} − |k^{4}| = 8|k|^{4}, and so:
|y|^{2} = |x(x^{2} − k^{2}) + k^{3}| ≥ |x(x^{2} − k^{2})| − |k^{3}| = |x||x^{2} − k^{2}| − |k^{3}| > 3|k|^{2}8|k|^{4} − |k|^{6} = 23|k|^{6},

a contradiction, since we have already shown that |y|^{2} ≤ 23|k|^{6}. This contradiction arose from imagining that |x| ≥ 3|k|^{2}, and so we must have |x| < 3|k|^{2}, as required. [6 marks]

Question 5. The proof in part (a) is tricky bookwork from lectures. Part (b) is unseen. (a). Let r ∈ Q^{∗}/(Q^{∗})^{2}, r ∈ im q, r ∈ Z, r square free. We want to prove that r|b_{1}. Suppose r = q(u, v), where (u, v) ∈ D(Q), which must exist since r ∈ im q. Then: r = q(u, v) = u = u^{2} + a_{1}u + b_{1} in Q^{∗}/(Q^{∗})^{2} [since u(u^{2} + a_{1}u + b_{1}) = v^{2}]. So, r, u, u^{2} + a_{1}u + b_{1} are all the same modulo squares, which means we can write:

u^{2} + a_{1}u + b_{1} = rs^{2}, u = rt^{2}, for some s, t ∈ Q.

Hence: (rt^{2})^{2} + a_{1}(rt^{2}) + b_{1} = rs^{2}. Let t = ℓ/m, where ℓ, m ∈ Z and gcd(ℓ, m) = 1. Then: r^{2}ℓ^{4}/m^{4} + a_{1}rℓ^{2}/m^{2} + b_{1} = rs^{2}, and so: r^{2}ℓ^{4} + a_{1}rℓ^{2}m^{2} + b_{1}m^{4} = r(m^{2}s)^{2}. Now, a_{1}, b_{1}, r, ℓ, m ∈ Z, so the LHS of this last equation is in Z, and so the RHS is also in Z; that is: r(m^{2}s)^{2} ∈ Z. Since r is square free, we must therefore have m^{2}s ∈ Z. Define: n = m^{2}s ∈ Z. Then our equation becomes:

r^{2}ℓ^{4} + a_{1}rℓ^{2}m^{2} + b_{1}m^{4} = rn^{2}, for some ℓ, m, n ∈ Z, gcd(ℓ, m) = 1.  (†)

We want to show that r|b_{1}, and we know that r is square free. It is sufficient to show, for any prime p, that p|r ⇒ p|b_{1}.

Imagine p|r and p |̸ b_{1}, for some prime p. Then p|r^{2}ℓ^{4}, a_{1}rℓ^{2}m^{2}, rn^{2} and so by (†), p|b_{1}m^{4}, which in turn gives: p|m [since p |̸ b_{1}]. Hence, since now p|r and p|m, we have: p^{2}|r^{2}ℓ^{4}, a_{1}rℓ^{2}m^{2}, b_{1}m^{4}, and so by (†), p^{2}|rn^{2}, which in turn gives: p|n [since r is square free]. Hence, since now p|r, m, n, we have: p^{3}|a_{1}rℓ^{2}m^{2}, b_{1}m^{4}, rn^{2}, and so by (†), p^{3}|r^{2}ℓ^{4}, which in turn gives: p|ℓ [since r is square free]. This is a contradiction, since p|ℓ and p|m but gcd(ℓ, m) = 1.

The above assumption that p|r and p |̸ b_{1} let to a contradiction, and so it is impossible for any prime p to satisfy p|r and p |̸ b_{1}. This is the same as saying that p|r ⇒ p|b_{1} for any prime p. Since r is square free, we conclude that r|b_{1}, as required [16 marks] (b). Let P be a point of order m on C(Q), where m is odd. Then, since ϕ is a homomorphism, P′ = ϕ(P) satisfies: mP′ = mϕ(P) = ϕ(mP) = ϕ(o) = o, and so the order of P′ divides m and is at most m. Let j be the order of P′. Imagine that j < m. Then ϕ(jP) = jϕ(P) = jP′ = o, so jP ∈ ker ϕ and jP ≠ o since j < m and P has order m. But this is a contradiction, since jP ∈ ⟨P ⟩, and so jP has order dividing m, which means that jP has odd order and yet the only members of ker ϕ are o and (0, 0). This contradiction arose from imagining that j < m; hence j ≥ m; since also j|m, the only possibility is j = m; that is, the order of P′ is m, as required.

Let Q be a point of order n on C(Q), where n is even. As before, since ϕ is a homomorphism, Q′ = ϕ(Q) satisfies: nQ′ = nϕ(Q) = ϕ(nQ) = ϕ(o) = o, and so the order of Q′ divides n and is at most n. Let j be the order of Q′. Imagine that j < n/2. Then ϕ(jQ) = jϕ(Q) = jQ′ = o and ϕ(2jQ) = 2jϕ(Q) = 2jQ′ = o, so jQ, 2jQ ∈ ker ϕ and jQ, 2jQ ≠ o, jQ ≠ 2jQ since j, 2j < n and Q has order n. But this is a contradiction, since the only members of ker ϕ are o and (0, 0). This contradiction arose from imagining that j < n/2; hence j ≥ n/2; since also j|n, we must have j = n/2 or j = n; that is, the order of Q′ is n or n/2, as required [9 marks]

Question 6. Examples like this have appeared on the exercise sheets, but these descents via isogeny are probably the hardest thing in the course, since they require bringing together most of the techniques learnt throughout the course. I thought it was sufficient, therefore, to give a standard descent-via-isogeny as an entire question. Let C : Y^{2} = X(X^{2} + aX + b) = X(X^{2} + 3X + 7), where a = 3, b = 7, and isogenous curve D : Y^{2} = X(X^{2} + a_{1}X + b_{1}) = X(X^{2} − 6X − 19), where a_{1} = −6, b_{1} = −19, with the usual isogeny ϕ : C(Q) → D(Q) : (x, y) ↦ (y^{2}/x^{2}, y − 7y/x^{2}), and dual isogeny ϕ̂ : D(Q) → C(Q) : (u, v) ↦ (\frac{1}{4}v^{2}/u^{2}, \frac{1}{8}(v + 19v/u^{2})). [3 marks]

The map q : D(Q)/ϕ(C(Q)) → Q^{∗}/(Q^{∗})^{2} : (u, v) ↦ u, for (u, v) ≠ (0, 0), with q : (0, 0) ↦ b_{1} and q : o ↦ 1, is an injection with imq contained in {d : d is square free and d|b_{1}} = {±1, ±19}. Also, o ↦ 1, (0, 0) ↦ −19, so that {1, −19} ⊂ imq ⊂ {±1, ±19}. [3 marks]

There is only one coset to check, represented by −1, say. We know that −1 ∈ imq iff there are integers ℓ, m, n, not all 0, and with gcd(ℓ, m) = 1, such that: (−1) · ℓ^{4} + a_{1}ℓ^{2}m^{2} + (b_{1}/(−1)) · m^{4} = n^{2} that is: −ℓ^{4} − 6ℓ^{2}m^{2} + 19m^{4} = n^{2}. Rewrite as: −(ℓ^{2} + 3m^{2})^{2} + 28m^{4} = n^{2}. Reducing modulo 7 gives −(ℓ^{2} + 3m^{2})^{2} ≡ n^{2} (modulo 7). If n were coprime to 7, then this would give: ((ℓ^{2} + 3m^{2})/n)^{2} = −1 in F_{7}, contradicting the fact that −1 is not a quadratic residue modulo 7. So, 7|n and so 7|(ℓ^{2} + 3m^{2}) also. This means that 7^{2}|(ℓ^{2} + 3m^{2})^{2} and 7^{2}|n^{2}, which can be combined with −(ℓ^{2} + 3m^{2})^{2} + 28m^{4} = n^{2} to give: 7^{2}|28m^{4} and so 7|4m^{4}, giving 7|m. Combining 7|m with 7|(ℓ^{2} + 3m^{2}) gives that 7|ℓ. This contradicts the fact that gcd(ℓ, m) = 1. Hence our equation is impossible in Q_{7}, and so impossible in Q. Hence −1 ∉ imq. [6 marks]

We conclude that imq = {1, −19}, and so D(Q)/ϕ(C(Q)) is generated by (0, 0). [1 mark] The map q̂ : C(Q)/ϕ̂(D(Q)) → Q^{∗}/(Q^{∗})^{2} : (x, y) ↦ x, for (x, y) ≠ (0, 0), with q̂ : (0, 0) ↦ b and

q̂: o ↦ 1, is an injection with imq̂ contained in {d : d is square free and d|b} = {±1, ±7}. Also, o ↦ 1 and (0, 0) ↦ 7, so that {1, 7} ⊂ imq̂ ⊂ {±1, ±7}. [3 marks]

There is only one coset to check, represented by −1, say. We know that −1 ∈ imq̂ iff there are integers ℓ, m, n, not all 0, and with gcd(ℓ, m) = 1, such that: (−1) · ℓ^{4} + aℓ^{2}m^{2} + (b/(−1)) · m^{4} = n^{2}; that is: −ℓ^{4} + 3ℓ^{2}m^{2} − 7m^{4} = n^{2}. Multiply both sides by 4 and rewrite as: −(2ℓ^{2} − 3m^{2})^{2} − 19m^{4} = 4n^{2}. This is impossible in R (the left hand side is ⩽ 0 and the right hand side is ⩾ 0, and equality only occurs when 2ℓ^{2} − 3m^{2} = m^{4} = n^{2} = 0, implying ℓ = m = n = 0, which is not allowed). [A mod 19 argument would also work here.] Hence −1 ∉ imq̂. [4 marks]

We conclude that imq̂ = {1, 7}, and so C(Q)/ϕ̂(D(Q)) is generated by (0, 0). [1 mark]

Finally, since multiplication by 2 in C(Q) is ϕ̂∘ ϕ, we have that C(Q)/2C(Q) is generated by: generators for C(Q)/ϕ̂(D(Q)) [namely: (0, 0)] together with the images under ϕ̂ of generators for D(Q)/ϕ(C(Q)) [namely, ϕ̂((0, 0)) = o]. Conclusion: C(Q)/2C(Q) is generated by (0, 0), and so is isomorphic to C_{2}. We also know that C(Q)/2C(Q) is isomorphic to C_{tors}(Q)/2C_{tors}(Q) × C_{2}^{r}, which is isomorphic to C(Q)[2] × C_{2}^{r}, where C(Q)[2] is the 2-torsion group and r is the rank. The 2-torsion points on C : Y^{2} = X(X^{2} + 3X + 7) are o together with the points of the form (x, 0), where x is a root of X(X^{2} + 3X + 7), that is: (0, 0), (−\frac{3}{2} + \frac{\sqrt{−19}}{2}, 0) and (−\frac{3}{2} − \frac{\sqrt{−19}}{2}, 0), of which only o and (0, 0) are in C(Q)[2], giving that C(Q)[2] is isomorphic to C_{2}. Combining this with the facts (already found) that C(Q)/2C(Q) is isomorphic both to C_{2} and to C(Q)[2] × C_{2}^{r}, give that C(Q) has rank 0. [4 marks]

Question 7. Parts (a),(b),(c) are easy variations of a question on one of the examples sheets; this is intended to be an easy question accessible to the weaker students, although it is not quick to answer, since there are quite a few computations. In all of the following, each step multiplies numbers ⩽ N (followed by a possible reduction modulo N), and so we are guaranteed that everything can be done on an 9-digit calculator, since N^{2} has only 9 digits. (a). First compute (modulo N = 10001): 2^{1} ≡ 2, 2^{2} ≡ 4, 2^{4} ≡ 16, 2^{8} ≡ 256, 2^{16} ≡ 5530, 2^{32} ≡ 7843, 2^{64} ≡ 6499 (where each of these was obtained be squaring the previous one, and reducing modulo N). Now, we write 68 in base 2: 68 = 4 + 64 and so 2^{68} ≡ 2^{4}2^{64} ≡ 16 · 6499 ≡ 3974 modulo N, so that 2^{68} − 1 ≡ 3973 modulo N.

Now, compute gcd(3973, N) by Euclid’s Algorithm: 10001 = 2 · 3973 + 2055; 3973 = 1 · 2055 + 1918; 2055 = 1 · 1918 + 137, 1918 = 14 · 137 + 0. So, 137 is a factor of N. Compute 10001/137 = 73, giving the factorisation N = 10001 = 73 · 137. [8 marks] (b). The line tangent to E at P = (1, 1) has slope y′ given by 2yy′ = 3x^{2} + 2, with x = 1, y = 1; that is, the slope is 5/2. This tangent line also goes through (1, 1) and so has equation: Y = (5/2)X − 3/2. Note that 2 · 5001 = 10002 ≡ 1, so that 5001 is the inverse of 2 mod N, and the the tangent line has equation: Y = (5 · 5001)X − 3 · 5001 ≡ 5003X − 5002. The x-coordinate of 2P is therefore 5003^{2} − (1 + 1) ≡ 7505, and the y-coordinate is: −(5003 · 7505 − 5002) = −37542513 ≡ 1241, so that Q = 2P ≡ (7505, 1241) (modulo N = 10001). We now wish to double the point Q = 2P, and so again the first step is to find the line tangent to E at Q. This has slope y′ given by 2 · 1241 · y′ = 3 · 7505^{2} + 2, and so we need to compute (3 · 7505^{2} + 2)/(2 · 1241) (modulo N = 10001), for which the first step is to find the inverse of 2 · 1241 ≡ 2482 (modulo N = 10001). Using Euclid’s Algorithm: 10001 = 4·2482+73; 2482 = 34·73+0. So, we cannot find the inverse of 2482 (modulo N = 10001), and this step has given us a factor 73 of N. Similarly to before, compute 10001/73 = 137, again giving the factorisation N = 10001 = 73 · 137. [9 marks] (c). Since N = 73 · 137, we have ϕ(N) = 72 · 136 = 9792. Computing the gcd of d = 4451 and ϕ(N), we see: 9792 = 2 · 4451 + 890; 4451 = 5 · 890 + 1, so that gcd(9792, 4451) = 1. Reversing the steps: 1 = 4451 − 5 · 890 = 4451 − 5 · (9792 − 2 · 4451) = −5 · 9792 + 11 · 4451 Hence, 11 is the inverse of 4451 modulo 9792. The decoding operation is therefore X ↦ X^{11} mod N. Computing 6847^{11} = ((6847^{2})^{2})^{2} · (6847^{2} · 6847) ≡ (6722^{2})^{2} · (6722 · 6847) ≡ 766^{2} · 932 ≡ 6698 · 932 ≡ 1912. (modulo N = 10001). Also: 2577^{11} = ((2577^{2})^{2})^{2} · (2577^{2} · 2577) ≡ (265^{2})^{2} · (265 · 2577) ≡ 218^{2} · 2837 ≡ 7520 · 2837 ≡ 2107 (modulo N = 10001). The decoded message is therefore: 1912, 2107; that is: SLUG. [8 marks]