\documentclass{article}

\usepackage{amssymb}
\usepackage{amsthm}
\usepackage[UKenglish]{babel}
\usepackage[backend=biber,sorting=none]{biblatex}
\usepackage{enumitem}
\usepackage{fancyhdr}
\usepackage[margin=1in]{geometry}
\usepackage{graphicx}
\usepackage[utf8]{inputenc}
\usepackage{listings}
\usepackage{mathtools}
\usepackage{tikz-cd}
\usepackage{csquotes}

\newcommand{\F}{\mathbb{F}}
\newcommand{\Z}{\mathbb{Z}}
\newcommand{\Q}{\mathbb{Q}}
\newcommand{\R}{\mathbb{R}}
\newcommand{\C}{\mathbb{C}}
\newcommand{\A}{\mathbb{A}}
\renewcommand{\P}{\mathbb{P}}

\newcommand{\val}[1]{\left. #1 \right\rvert}
\newcommand{\rb}[1]{\left( #1 \right)}
\renewcommand{\sb}[1]{\left[ #1 \right]}
\newcommand{\cb}[1]{\left\{ #1 \right\}}
\newcommand{\ab}[1]{\left\langle #1 \right\rangle}
\newcommand{\abs}[1]{\left\lvert #1 \right\rvert}

\newcommand{\twobyone}[2]{\begin{pmatrix} #1 \\ #2 \end{pmatrix}}
\newcommand{\onebythree}[3]{\begin{pmatrix} #1 & #2 & #3 \end{pmatrix}}
\newcommand{\threebyone}[3]{\begin{pmatrix} #1 \\ #2 \\ #3 \end{pmatrix}}
\newcommand{\threebythree}[9]{\begin{pmatrix} #1 & #2 & #3 \\ #4 & #5 & #6 \\ #7 & #8 & #9 \end{pmatrix}}

\theoremstyle{definition}
\newtheorem*{definition}{Definition}
\newtheorem*{example}{Example}
\newtheorem*{remark}{Remark}
\newtheorem{proposition}{Proposition}[subsection]
\newtheorem{lemma}[proposition]{Lemma}
\newtheorem{theorem}[proposition]{Theorem}
\newtheorem{algorithm}[proposition]{Algorithm}
\newtheorem{conjecture}[proposition]{Conjecture}

\pagestyle{fancy}
\lhead{The Arithmetic of Elliptic Curves}
\rhead{David Kurniadi Angdinata}

\addbibresource{bibliography.bib}

\title{The Arithmetic of Elliptic Curves}
\author{David Kurniadi Angdinata}
\date{Monday, 2 July 2018 - Friday, 28 September 2018}

\begin{document}

\maketitle

\vspace{1cm}

\begin{center}
\includegraphics*[width=0.5\textwidth]{img/EllipticCurveCatalog.png}
\end{center}

\vfill

\begin{center}
\emph{"It is possible to write endlessly on elliptic curves. (This is not a threat.)"\cite{lang}} \\
\end{center}

\vspace{1cm}

\begin{abstract}
In the field of algebraic geometry, elliptic curves are deeply studied rich structures with far-fetching computational applications to classical number theory and contemporary cryptography. It is a fundamental tool in Wiles' proof of Fermat's last theorem, as well as the main object of discussion in the Birch and Swinnerton-Dyer conjecture, an open problem in number theory deemed worthy of being called one of the Millennium Prize Problems by the Clay Mathematics Institute. In this project, three of the four most fundamental theorems in the arithmetic of elliptic curves, namely the Hasse-Weil theorem, the Nagell-Lutz theorem, and the Mordell-Weil theorem, are proven in their respective special forms. Schoof's algorithm for counting rational points over Galois fields will also be briefly discussed, allowing for an application to integer factorisation and primality testing. An introductory section and a brief appendix on fields, varieties, curves, and groups are also included for completion.
\end{abstract}

\pagebreak

\tableofcontents

\pagebreak

\section*{Preface}

\addcontentsline{toc}{section}{Preface}\par

The aim of this project is to provide a gentle introduction to the deep theory of \emph{elliptic curves}. My approach for the report is to deliver information in the form of general propositions and fundamental theorems, providing adequate proofs whenever possible. Admittedly, almost all of the work here is unoriginal and should have been done elsewhere in a similar fashion, but I have tried to make the flow of information as coherent as possible, consulting various online resources as well as the two books \cite{gtm} and \cite{utm}.

As the theory of elliptic curves requires some technical background in algebraic geometry, which in turn requires prerequisites in commutative algebra, both of which I have zero background in, the report is rather superficial and may not provide as good of an insight to deeper theory. In addition to the first two years of undergraduate mathematics, the first three preliminary appendices A.1, A.2, and A.3 will provide all the required background to understand the first introductory section, while a few additional notions in appendix A.4 will allow the rest to be fully accessible to middle-year undergraduates such as myself.

The first section introduces elliptic curves while hiding away the definitions and results taken from algebraic geometry. For instance, the use of explicit \emph{Weierstrass equations} and formulae for the \emph{group law} is an active attempt to avoid bringing in the \emph{Riemann-Roch theorem} in algebraic geometry to prove that they are related. As such, many proofs in this section are omitted, but are all given a direct reference.

The second section discusses elliptic curves over finite fields, which hinges on \emph{Hasse's theorem} to explain \emph{Schoof's algorithm} for counting rational points. This in turn paves the path for applications in the last section, as well as an alternative method of counting rational points in the following section. Proofs are mostly given in full, except for an overly lengthy but elementary proof based on induction.

The third section discusses elliptic curves over the rationals, which can be split into two parts due to the \emph{fundamental theorem of finitely generated abelian groups}. The \emph{Nagell-Lutz theorem} and \emph{reduction modulo prime} are two related ways to compute the \emph{torsion subgroup}, while \emph{Mordell's theorem} proves that the fundamental theorem indeed holds and provides a semi-workable method to compute the \emph{rank}. Again, proofs are mostly given in full, except for an assumption made in the last part of Mordell's theorem.

The last section touches on some applications to classical arithmetic, including integer factorisation and primality proving, as well as the basics of contemporary cryptography, which could potentially be explored into if time permitted. There was originally an intention to cover complex elliptic curves in here instead, leading to a brief exposition of Fermat's last theorem, but was omitted due to lack of time.

The appendices include the aforementioned preliminaries, as well as proofs of two algorithms and listings of code. The proofs are placed here as they are deemed less relevant and too lengthy to be included in the main text. All code under code listings are in the functional \emph{Haskell} programming language compiled by the \emph{Glassgow Haskell Compiler}, which is markedly different from many implementations publicly available.

I will also present several remarks regarding the style of the report, which is an attempt to imitate typical lecture notes and textbooks. Definitions are all given in bold, while italics are reserved for less important terms that are undefined, all of which provided with adequate examples whenever possible. Theorems are important results and propositions those less important, while lemmas serve as intermediate checkpoints to theorems and propositions. All of these are provided immediate proofs after their statements, or postponed for later as \emph{Proof of \emph{statement}}. Remarks are largely irrelevant to the flow of the main discussion and can be disregarded, but are included for interesting points, which may include previously undefined terms.

In terms of notation, most of the symbols I have used are those found in books, such as $ \F_p $, $ \Z $, or $ \Q $, and should be unambiguous. While there are unfortunate cases of equivalent symbols being used to mean completely different objects due to limitations of the English and Greek alphabet system, I have tried to minimise these or make them clear from context. An example being $ f, g, h $ being used for general functions, while homomorphisms are always denoted $ \phi, \psi, \chi $ or their variants. In examples like the following,
$$ f\rb{x, y} = xg\rb{y} + yh\rb{x}, \qquad g \in F\sb{y}, \qquad h \in F\sb{x}, $$
$ g $ and $ h $ are always existentially quantified, while $ f $ and $ F $ are initially fixed or explicitly universally quantified. A function $ f' $ will always be distinct, but possibly related, to the function $ f $, while differentiation with respect to a variable $ x $ will always be denoted $ d / dx $ or $ \partial / \partial x $. No distinction will be made between sums and \emph{formal sums}, or derivatives and \emph{formal derivatives}, as they are clear from the context of this report.

I would like to thank my supervisor Prof Johannes Nicaise for his support and guidance throughout the duration of this project. I had many doubts and questions early on, all of which he clarified with great detail.

\pagebreak

\section{Introduction}

Informally, an elliptic curve is a cubic curve with no cusps, self-intersections, or isolated points, whose solutions are confined to a region of space topologically equivalent to a torus. It can represented by a cubic equation in two variables, with its coefficients being elements of a specified field. Two elliptic curves over the field of real numbers are illustrated below.

\begin{center}
\includegraphics*[width=0.4\textwidth]{img/ECClines-3.png}
\end{center}

\subsection{Definition}

A formal definition is as follows.

\begin{definition}[Elliptic curve]
An \textbf{elliptic curve} over a perfect field $ F $ is an ordered pair $ \rb{E, \mathcal{O}_E} $ such that $ E $ is a smooth projective plane curve of genus one over $ F $ and $ \mathcal{O}_E \in E $ is an $ F $-rational \textbf{base point}.
\end{definition}

This definition uses several terms in other fields of mathematics, which are briefly covered in the appendices. In particular, one of the many characterisations of a perfect field is given in Appendix A.1, while several fundamental notions in projective and algebraic geometry such as projective planes and smoothness are laid out in Appendix A.2. Appendix A.3 defines a curve and the genus due to the \emph{genus-degree formula}.

\begin{remark}
The genus in algebraic geometry is usually defined in general literature by the \emph{Riemann-Roch theorem}, which does coincide with the topological definition.
\end{remark}

As the report is a gentle introduction to elliptic curves, further delving into the vast world of algebraic geometry will be avoided, and so explicit formulae will be provided whenever possible. To this end, the various definitions in the appendix can be summarised in the following proposition.

\begin{proposition}
\label{prop:appendices}
Let $ \rb{E, \mathcal{O}_E} $ be an elliptic curve over a perfect field $ F $. Then:
\begin{enumerate}
\item $ I\rb{E} = \ab{e} $ for some homogeneous irreducible polynomial $ e $ of three variables,
\item any point $ P \in E $ has multiplicity $ m_P\rb{e} = 1 $, and
\item $ e $ have roots confined to a torus and is cubic.
\end{enumerate}
\end{proposition}

\begin{proof}
This follows directly from the appendices.
\end{proof}

Thus an elliptic curve can be fully defined in terms of its defining polynomial, which would need to satisfy certain conditions. As per the appendix, an abuse of notation will be used to denote an elliptic curve $ \rb{E, \mathcal{O}_E} $ over $ F $ \emph{given} by a polynomial $ e $, namely
$$ E : e\rb{X, Y, Z} = 0 \qquad \iff \qquad E : e\rb{x, y} = 0, $$
which are respectively the homogenised and dehomogenised forms of a polynomial that can be used interchangeably. For the rest of this section, let $ E : e\rb{x, y} = 0 $ and $ E' : e'\rb{x, y} = 0 $ be two elliptic curves over a perfect field $ F $ with algebraic closure $ K = \overline{F} $. The notion of an isomorphism, as for any algebraic geometric structure, would be useful. This is captured in the following definition.

\begin{definition}[Isomorphism]
$ \rb{E, \mathcal{O}_E} $ and $ \rb{E', \mathcal{O}_{E'}} $ are \textbf{isomorphic}, denoted by $ \rb{E, \mathcal{O}_E} \cong \rb{E', \mathcal{O}_{E'}} $, iff there is an isomorphism $ \phi : E \to E' $ such that $ \phi\rb{\mathcal{O}_E} = \mathcal{O}_{E'} $.
\end{definition}

\begin{remark}
Isomorphism defines an equivalence relation of elliptic curves, such that two elliptic curves from an equivalence class are indistinguishable.
\end{remark}

Again, this abstract notion can be made explicit later by the defining polynomials of the elliptic curves.

\pagebreak

\subsection{Weierstrass equations}

The definition of an elliptic curve boils down to its defining polynomial, which will be made explicit in this subsection. A family of curves related to elliptic curves will be defined beforehand.

\begin{definition}[Weierstrass curve]
A \textbf{Weierstrass curve} is a projective plane curve $ W $ over $ F $ \emph{given} by the \textbf{Weierstrass equation}
$$ W : w\rb{x, y} = 0 : y^2 + a_1xy + a_3y = x^3 + a_2x^2 + a_4x + a_6, \qquad a_i \in F, $$
with associated quantities:
$$ b_2 = a_1^2 + 4a_2, \qquad b_4 = a_1a_3 + 2a_4, \qquad b_6 = a_3^2 + 4a_6, \qquad b_8 = a_1^2a_6 + 4a_2a_6 - a_1a_3a_4 + a_2a_3^2 - a_4^2, $$
$$ c_4 = b_2^2 - 24b_4, \qquad c_6 = 36b_2b_4 - b_2^3 - 216b_6, \qquad \Delta_W = 9b_2b_4b_6 - b_2^2b_8 - 8b_4^3 - 27b_6^2, \qquad j_W = c_4^3 / \Delta_W. $$
\end{definition}

It holds that $ 4b_8 = b_2b_6 - b_4^2 $ and $ 1728\Delta_W = c_4^3 - c_6^2 $. It can be easily verified that Weierstrass curves, with the additional condition of smoothness, would almost satisfy Proposition \ref{prop:appendices}. The only remaining requirement is having an additional base point in its definition, which can be easily fixed as follows.

\begin{definition}[Point at infinity]
The \textbf{point at infinity} of $ E $ is the point $ \mathcal{O} = \sb{0, 1, 0} $.
\end{definition}

In contrast to general projective geometry, the \emph{line at infinity} $ L : l\rb{X, Y, Z} = Z = 0 $ intersects a Weierstrass curve only at $ \mathcal{O} $, where $ X = Z = 0 $ and $ Y \ne 0 $. As such, any other point would have $ Z \ne 0 $ and can be treated as an affine point $ \rb{a, b} $. Now since $ 0, 1 \in F $, the point $ \mathcal{O} $ is actually an $ F $-rational point, and can be paired with a smooth Weierstrass curve $ W $ to give an elliptic curve $ \rb{W, \mathcal{O}} $. Conversely, any elliptic curve can also be explicitly given by a smooth Weierstrass curve through an isomorphism as follows.

\begin{proposition}
$ \rb{E, \mathcal{O}_E} \cong \rb{W, \mathcal{O}} $ for some smooth Weierstrass curve $ W $ over $ F $.
\end{proposition}

\begin{proof}
Omitted, see III.3.1a in \cite{gtm}.
\end{proof}

There are even computerised algorithms to transform a general smooth projective plane cubic curve with a given arbitrary $ F $-rational flex point, or an elliptic curve, into a Weierstrass curve with the $ F $-rational point $ \mathcal{O} $. The following algorithm summarises the process in \cite{weierstrass} proven in the appendix.

\begin{algorithm}[Transformation of a cubic curve into Weierstrass form]
Input: a cubic curve $ E $ over $ F $ with an $ F $-rational flex point $ P \in E $. Output: $ E $ in Weierstrass form.
\begin{enumerate}
\item Get the unique tangent line $ L $ at $ P $.
\item Find the intersection $ L \cap E $ to get a point $ Q \in L \setminus E $ distinct to $ P $.
\item Write down an invertible matrix $ M = \onebythree{Q}{P}{R} $, where $ R \in \cb{\sb{1, 0, 0}, \sb{0, 1, 0}, \sb{0, 0, 1}} $.
\item Transform $ \sb{X, Y, Z} \mapsto M\sb{X, Y, Z}^T $ to get a scaled Weierstrass equation.
\item Rescale $ \sb{X, Y, Z} \mapsto \sb{X, Y, cZ} $ for some $ c \in K^* $ to get a Weierstrass equation.
\end{enumerate}
\end{algorithm}

The following example illustrates an implementation of the algorithm.

\begin{example}
Let $ E : e\rb{X, Y, Z} = 0 : X^3 + Y^3 = Z^3 $ be a smooth projective plane cubic curve over $ \R $ with an $ \R $-rational flex $ P = \sb{1, -1, 0} \in E $. Then the unique tangent at $ P $ is
$$ L : \twobyone{1}{1, 0, 0}\val{\dfrac{\partial e}{\partial X}}_P\rb{X - 1} + \twobyone{1}{0, 1, 0}\val{\dfrac{\partial e}{\partial Y}}_P\rb{Y + 1} + \twobyone{1}{0, 0, 1}\val{\dfrac{\partial e}{\partial Z}}_PZ = 3\rb{X + Y} = 0, $$
which intersects $ E $ at $ X^3 + \rb{-X}^3 + Z^3 = 0 $, or $ Z = 0 $. Hence $ L \cap E = \cb{P} $ and let $ Q = \sb{1, -1, 1} \in L \setminus E $. Then there is an invertible affine transformation matrix
$$ M = \threebythree{1}{1}{1}{-1}{-1}{0}{1}{0}{0} \qquad \implies \qquad M^{-1} = \threebythree{0}{0}{1}{0}{-1}{-1}{1}{1}{0}. $$
such that the affine transformation $ \sb{X, Y, Z} \mapsto M\sb{X, Y, Z}^{T} $ gives
$$ \rb{X + Y + Z}^3 + \rb{-X - Y}^3 = X^3 \qquad \implies 3Y^2Z + 6XYZ + 3YZ^2 = X^3 - 3X^2Z - 3XZ^2 - Z^3. $$
Thus the affine transformation $ \sb{X, Y, Z} \mapsto \sb{X, Y, \tfrac{1}{3}Z} $ gives a Weierstrass curve
$$ E : Y^2Z + 2XYZ + \tfrac{1}{3}YZ^2 = X^3 - X^2Z - \tfrac{1}{3}XZ^2 - \tfrac{1}{27}Z^3. $$
\end{example}

This characterisation allows a smooth Weierstrass curve to act as an alternative definition for an elliptic curve, and will be done for ease of future discussions. For the rest of this subsection, let $ E $ and $ E' $ be respectively given by the two Weierstrass curves over $ F $
$$ W : w\rb{x, y} = 0 : y^2 + a_1xy + a_3y = x^3 + a_2x^2 + a_4x + a_6, \qquad a_i \in F, $$
$$ W' : w'\rb{x, y} = 0 : y^2 + a_1'xy + a_3'y = x^3 + a_2'x^2 + a_4'x + a_6', \qquad a_i' \in F, $$
and write them interchangeably as an abuse of notation by
$$ \rb{E, \mathcal{O}_E} = E : e\rb{x, y} = 0 \qquad \iff \qquad \rb{W, \mathcal{O}} = W : w\rb{x, y} = 0, $$
$$ \rb{E', \mathcal{O}_{E'}} = E' : e'\rb{x, y} = 0 \qquad \iff \qquad \rb{W', \mathcal{O}} = W' : w'\rb{x, y} = 0. $$
With these explicit equations at hand, the abstract notion of isomorphism between elliptic curves can now be made explicit by considering affine transformations of these equations, which is given below.

\begin{proposition}
\label{prop:affine}
$ E \cong E' $ iff there is an affine transformation
$$ \rb{x, y} \mapsto \rb{u^2x + r, u^3y + u^2sx + t}, \qquad u \in K^*, \qquad r, s, t \in K $$
from $ W $ to $ W' $.
\end{proposition}

\begin{proof}
Omitted, see III.3.1b in \cite{gtm}.
\end{proof}

\begin{remark}
This affine transformation also transforms the coefficients and quantities of $ W $ and $ W' $ by
$$ a_1 \mapsto \dfrac{a_1 + 2s}{u}, \qquad a_2 \mapsto \dfrac{a_2 - sa_1 + 3r - s^2}{u^2}, \qquad a_3 \mapsto \dfrac{a_3 + ra_1 + 2t}{u^3}, $$
$$ a_4 \mapsto \dfrac{a_4 - sa_3 + 2ra_2 - \rb{t + rs}a_1 + 3r^2 - 2st}{u^4}, \qquad a_6 \mapsto \dfrac{a_6 + ra_4 - ta_3 + r^2a_2 - rta_1 + r^3 - t^2}{u^6}, $$
$$ b_2 \mapsto \dfrac{b_2 + 12r}{u^2}, \qquad b_4 \mapsto \dfrac{b_4 + rb_2 + 6r^2}{u^4}, \qquad b_6 \mapsto \dfrac{b_6 + 2rb_4 + r^2b_2 + 4r^3}{u^6}, $$
$$ b_8 \mapsto \dfrac{b_8 + 3rb_6 + 3r^2b_4 + r^3b_2 + 3r^4}{u^8}, \qquad c_4 \mapsto \dfrac{c_4}{u^4}, \qquad c_6 \mapsto \dfrac{c_6}{u^6}, \qquad \Delta_W \mapsto \dfrac{\Delta_W}{u^{12}}, \qquad j_W \mapsto j_W $$
which can be tediously verified.
\end{remark}

Again, this will be treated as the definition of isomorphism between elliptic curves. Now in the original definition of a Weierstrass curve, it is given by a Weierstrass equation that is somewhat perverse. This \emph{long} Weierstrass equation can in fact be greatly simplified, provided there are small restrictions on the characteristic of the underlying field.

\begin{proposition}
If $ char\rb{F} \ne 2 $, then
$$ E : y^2 = x^3 + Ax^2 + Bx + C, \qquad A, B, C \in F. $$
If $ char\rb{F} \ne 3 $ as well, then
$$ E : y^2 = x^3 + Ax + B, \qquad A, B \in F. $$
\end{proposition}

\begin{proof}
Let $ char\rb{F} \ne 2 $, then the affine transformation $ \rb{x, y} \mapsto \rb{x, y - \tfrac{1}{2}\rb{a_1x + a_3}} $ gives an isomorphism from $ E $ to the curve given by the \emph{medium} Weierstrass equation
$$ y^2 = x^3 + Ax^2 + Bx + C, \qquad A = \tfrac{1}{4}b_2, \qquad B = \tfrac{1}{2}b_4, \qquad C = \tfrac{1}{4}b_6. $$
Let $ char\rb{F} \ne 3 $ as well, then the affine transformation $ \rb{x, y} \mapsto \rb{x - \tfrac{1}{12}b_2, y} $ gives an isomorphism from $ E $ to the curve given by the \emph{short} Weierstrass equation
$$ y^2 = x^3 + Ax + B, \qquad A = -\tfrac{1}{48}c_4, \qquad B = -\tfrac{1}{864}c_6. $$
\end{proof}

Medium and short Weierstrass equations greatly reduce the tedium when manipulating them, since there is a symmetry to the equation itself, giving two $ y $ opposite in sign for each $ x $. As there are only two characteristics that do not permit the affine transformation to a short Weierstrass equation, they will be disregarded for ease of future discussions. Hence always assume that $ char\rb{F} \notin \cb{2, 3} $ and write the Weierstrass equations of $ W $ and $ W' $ as
$$ W : w\rb{x, y} = 0 : y^2 = x^3 + Ax + B, \qquad A, B \in F, $$
$$ W' : w'\rb{x, y} = 0 : y^2 = x^3 + A'x + B', \qquad A', B' \in F. $$
The following example illustrates the affine transformation to a short Weierstrass equation.

\begin{example}
Let
$$ E : y^2 + 2xy + \tfrac{1}{3}y = x^3 - x^2 - \tfrac{1}{3}x - \tfrac{1}{27} $$
be the Weierstrass curve over $ \R $ from the example above. Since $ char\rb{\R} = 0 \notin \cb{2, 3} $, there is an affine transformation $ \rb{x, y} \mapsto \rb{x, y - x - \tfrac{1}{6}} $ such that
$$ \rb{y - x - \tfrac{1}{6}}^2 + 2x\rb{y - x - \tfrac{1}{6}} + \tfrac{1}{3}\rb{y - x - \tfrac{1}{6}} = x^3 - x^2 - \tfrac{1}{3}x - \tfrac{1}{27} \qquad \implies \qquad y^2 = x^3 + \tfrac{1}{108}, $$
which is a short Weierstrass equation.
\end{example}

Among the quantities associated with Weierstrass curves, most are used in defining the simplified Weierstrass equations, while the last two, the discriminant $ \Delta_W $ and the $ j $-invariant $ j_W $, encode various properties of the curve itself. As only short Weierstrass equations are considered, these two quantities can be restated in an equivalent form in terms of the new coefficients. The discriminant is redefined as follows.

\begin{definition}[Discriminant]
The \textbf{discriminant} of $ W $ is
$$ \Delta_W = -16\rb{4A^3 + 27B^2}. $$
\end{definition}

The discriminant is transformed as $ \Delta_W \mapsto \Delta_W / u^{12} $ by the affine transformation in Proposition \ref{prop:affine}. It encodes behaviours at the singularities of Weierstrass curves, and whether they exist. The following proposition allows for an easy method of checking the smoothness of a Weierstrass curve.

\begin{proposition}
$ W $ is smooth iff $ \Delta_W \ne 0 $.
\end{proposition}

\begin{proof}
Assume that $ W $ is not smooth and $ P = \rb{a, b} \in W $ is singular. Then
$$ 0 = \val{\dfrac{\partial w}{\partial X}}_P = -3a^2 - A, \qquad 0 = \val{\dfrac{\partial w}{\partial Y}}_P = 2b, \qquad 0 = \val{\dfrac{\partial w}{\partial Z}}_P = b^2 - 2Aa - 3B. $$
Since $ b = 0 $ and $ A = -3a^2 $, it holds that $ 0 = 2Aa + 3B = -6a^3 + 3B $, so $ B = 2a^3 $. Hence $ \Delta_W = -16\rb{4\rb{-3a^2}^3 + 27\rb{2a^3}^2} = 0 $. Conversely assume that $ \Delta_W = -16\rb{4A^3 + 27B^2} = 0 $, such that the discriminant of $ x^3 + Ax + B $ is $ -\rb{4A^3 + 27B^2} = 0 $. Then there is a repeated root $ x = a \in K $, so $ P = \rb{a, 0} \in W $ and
$$ W : y^2 = \rb{x - a}^2\rb{x - a'}, \qquad a' \in K. $$
Then
$$ \val{\dfrac{\partial w}{\partial x}}_P = -2\rb{a - a}\rb{a - a'} - \rb{a - a}^2 = 0, \qquad \val{\dfrac{\partial w}{\partial y}}_P = 2\rb{0} = 0. $$
Thus $ P $ is singular and $ W $ is not smooth.
\end{proof}

Hence $ W $ is eligible as an elliptic curve iff $ \Delta_W \ne 0 $, and by the proof above, iff $ x^3 + Ax + B $ has distinct factors. The following example illustrates the discriminant.

\begin{example}
Let $ E $ be the Weierstrass curve over $ \R $ from the example above. Then
$$ \Delta_E = -16\rb{4\rb{0}^3 + 27\rb{\tfrac{1}{108}}^2} = -\tfrac{1}{27} < 0, $$
so $ E $ is smooth. Thus $ E $ is an elliptic curve over $ \R $.
\end{example}

The $ j $-invariant, defined only for smooth Weierstrass curves where $ \Delta_W \ne 0 $, is redefined as follows.

\begin{definition}[$ j $-invariant]
The \textbf{$ j $-invariant} of $ W $ is
$$ j_W = 1728\rb{\dfrac{4A^3}{4A^3 + 27B^2}}. $$
\end{definition}

The $ j $-invariant is transformed as $ j_W \mapsto j_W $ by the affine transformation in Proposition \ref{prop:affine}. It stays invariant between elliptic curves that are isomorphic, which gives its name. The following proposition allows for an alternative characterisation of an isomorphism.

\begin{proposition}
$ E \cong E' $ iff $ j_W = j_{W'} $.
\end{proposition}

\begin{proof}
Assume that $ E \cong E' $, then the affine transformation maps $ j_W $ to $ j_W $, so $ j_W = j_{W'} $. Conversely assume that $ j_W = j_{W'} $, so
$$ 1728\rb{\dfrac{4A^3}{4A^3 + 27B^2}} = 1728\rb{\dfrac{4A'^3}{4A'^3 + 27B'^2}} \qquad \implies \qquad A^3B'^2 = A'^3B^2. $$
If $ A = 0 $, then $ B \ne 0 $ and $ A' = 0 $. Then there is an affine transformation
$$ \rb{x, y} \mapsto \rb{\sqrt[3]{\dfrac{B}{B'}}x, \sqrt{\dfrac{B}{B'}}y} \qquad \implies \qquad \dfrac{B}{B'}y^2 = \dfrac{B}{B'}x^3 + A'\sqrt[3]{\dfrac{B}{B'}}x + B', $$
such that $ y^2 = x^3 + B' = x^3 + A'x + B' $. If $ B = 0 $, then $ A \ne 0 $ and $ B' = 0 $. Then there is also an affine transformation
$$ \rb{x, y} \mapsto \rb{\sqrt{\dfrac{A}{A'}}x, \sqrt[4]{\dfrac{A}{A'}}^3y} \qquad \implies \qquad \sqrt{\dfrac{A}{A'}}^3y^2 = \sqrt{\dfrac{A}{A'}}^3x^3 + A'\sqrt{\dfrac{A}{A'}}x + B', $$
such that $ y^2 = x^3 + A'x = x^3 + A'x + B' $. Otherwise $ A \ne 0 $ and $ B \ne 0 $, then there is an affine transformation from $ W $ to $ W' $ equal to the two affine transformations above. Thus $ E \cong E' $.
\end{proof}

While $ j $-invariant affine transformations preserve elliptic curves, this does not necessarily hold for their set of rational points. The following illustrates the $ j $-invariant.

\begin{example}
Let $ E $ be the elliptic curve over $ \R $ from the example above. Then
$$ j_E = -1728\rb{\dfrac{4\rb{0}^3}{4\rb{0}^3 + 27\rb{\frac{1}{108}}^2}} = 0. $$
Hence $ E $ is isomorphic to any elliptic curve with zero $ j $-invariant. Now let $ E' : y^2 = x^3 + B $ for some $ B \in \R $ such that $ j_{E'} = 0 $, then there is an affine transformation
$$ \rb{x, y} \mapsto \rb{\dfrac{1}{3\sqrt[3]{2}^2B}x, \dfrac{1}{2\sqrt{3}^3B}y}. $$
from $ E $ to $ E' $. Thus $ E \cong E' $.
\end{example}

The definition and isomorphism classes of elliptic curves are now fully characterised.

\begin{remark}
There are alternate characterisations of elliptic curves by other families of curves, which will not be discussed here. One of these is the \emph{Legendre form} of a Weierstrass curve, written as
$$ E : y^2 = x\rb{x - 1}\rb{x - \lambda}, \qquad \lambda \in K \setminus \cb{0, 1}. $$
This is merely a transformation, but proves useful when studying elliptic curves over the reals.
\end{remark}

\pagebreak

\subsection{Group law}

An elliptic curve has an additional group theoretic property that makes it an \emph{algebraic group}. This subsection provides a full definition of the additive group induced by an elliptic curve, as well as an attempt to prove that it is indeed one. The following lemma will be used in the definition of the addition operation.

\begin{lemma}
\label{lem:thirdpoint}
Let $ P = \sb{a, b, c} \in E $ and $ Q = \sb{a', b', c'} \in E $ be points. Then:
\begin{enumerate}
\item if $ P \ne Q $, there is a unique line joining $ P $ and $ Q $ given by
$$ L : \rb{bc' - b'c}X + \rb{a'c - ac'}Y + \rb{ab' - a'b}Z = 0, $$
\item if $ P = Q $, there is a unique tangent at $ P $ given by
$$ L : \rb{-3a^2 - Ac^2}X + 2bcY + \rb{b^2 - 2Aac - 3Bc^2}Z = 0, $$
\item there is a unique third point $ R \in E $ such that $ L $ intersects $ E $ at $ P $, $ Q $, and $ R $.
\end{enumerate}
\end{lemma}

\begin{proof}
Let $ L : l\rb{X, Y, Z} = 0 $.
\begin{enumerate}
\item If $ P \ne Q $, then
$$ l\rb{X, Y, Z} = \threebyone{X}{Y}{Z} \cdot \rb{\threebyone{a}{b}{c} \times \threebyone{a'}{b'}{c'}}. $$
\item If $ P = Q $, then
$$ l\rb{X, Y, Z} = \twobyone{1}{1, 0, 0}\val{\dfrac{\partial e}{\partial X}}_P\rb{X - a} + \twobyone{1}{0, 1, 0}\val{\dfrac{\partial e}{\partial Y}}_P\rb{Y - b} + \twobyone{1}{0, 0, 1}\val{\dfrac{\partial e}{\partial Z}}_P\rb{Z - c}. $$
\item Since $ \deg\rb{l} = 1 $ and $ \deg\rb{\gcd\rb{e, l}} = 0 $, B\'ezout's theorem gives that $ L $ intersects $ E $ at three points up to multiplicity. Assume that $ P = \sb{a, b, c} \ne Q = \sb{a', b', c'} $. If $ I_P\rb{e, l} = 1 $ and $ I_Q\rb{e, l} = 1 $, then there is a unique third point $ R \in E $ such that $ R \ne P, Q $ and $ I_R\rb{e, l} = 1 $. Otherwise $ I_P\rb{e, l} = 2 $ or $ I_Q\rb{e, l} = 2 $, then there is also a unique third point $ R = P $ or $ R = Q $ respectively. Otherwise assume that $ P = Q = \sb{a, b, c} $. Since $ \cb{l} = T_P\rb{l} \in T_P\rb{e} $, it holds that $ I_P\rb{e, l} > m_P\rb{e}m_P\rb{l} = 1 $. If $ I_P\rb{e, l} = 2 $, then there is a unique third point $ R \in E $ such that $ R \ne P $ and $ I_R\rb{e, l} = 1 $. Otherwise $ I_P\rb{e, l} = 3 $, then there is also a unique third point $ R = P $.
\end{enumerate}
\end{proof}

The following example illustrates the unique lines and tangents above.

\begin{example}
Let $ E : y^2 = x^3 + 2x + 1 $ be an elliptic curve over $ \R $ with points $ P = \rb{0, -1} \in E $ and $ Q = \rb{1, 2} \in E $. Then the unique line joining $ P $ and $ Q $ is $ L : y = 3x - 1 $, while the tangent at $ P $ is $ L_P : y = -x - 1 $, and the tangent at $ Q $ is $ L_Q : y = \tfrac{5}{4}x + \tfrac{3}{4} $.
\end{example}

Instead of defining the addition operation right away, it is clearer to define an intermediate operation with the above lemma as follows.

\begin{definition}[$ * $]
$ * : E \times E \to E $ is defined by $ P * Q = R $, where $ R $ is the unique third point in Lemma \ref{lem:thirdpoint}.
\end{definition}

The addition operation can then be defined immediately in terms of this intermediate operation, which are both symmetric and hence commutative.

\begin{definition}[$ + $]
$ + : E \times E \to E $ is defined by $ P + Q = \rb{P * Q} * \mathcal{O} $.
\end{definition}

This definition is chosen carefully so as to make a group law possible. While it might be slightly convoluted, there is an easy geometrical interpretation. While $ P * Q \in E $ is simply the unique third intersection point of two points $ P \in E $ and $ Q \in E $, reflecting it along the horizontal axis gives $ P + Q $. This motivates writing out several explicit formulae relating the affine coordinates of $ P $, $ Q $ and $ P + Q $, which will allow equation manipulations in later sections. The following algorithm summarises the explicit formulae for $ + $, which are proven in the appendix.

\begin{algorithm}[Group law explicit formulae]
Input: points $ P, Q \in E $. Output: $ P + Q $.
$$ P + Q = \begin{cases} R & P = \rb{a, b}, \ Q = \rb{a', b'}, \ a \ne a' \\ S & P = Q = \rb{a, b}, \ b \ne 0 \\ P & Q = \mathcal{O} \\ \mathcal{O} & P = Q = \rb{a, 0} \end{cases}, $$
where
$$ R = \rb{\dfrac{\rb{A + aa'}\rb{a + a'} + 2\rb{B - bb'}}{\rb{a - a'}^2}, \dfrac{\rb{Ab' - a'^2b}\rb{3a + a'} + \rb{a^2b' - Ab}\rb{a + 3a'} - 4B\rb{b - b'}}{\rb{a - a'}^3}}, $$
$$ S = \rb{\dfrac{a^4 - 2Aa^2 - 8Ba + A^2}{4b^2}, \dfrac{a^6 + 5Aa^4 + 20Ba^3 - 5A^2a^2 - 4ABa - A^3 - 8B^2}{8b^3}}. $$
\end{algorithm}

The first case is referred to as the \emph{addition formula}, while the second case is referred to as the \emph{duplication formula}. The last two cases allows the definition of a negation operation used for inverses in the group law. This is referred to as the \emph{negation formula}, where $ -\mathcal{O} = \mathcal{O} $ and $ -\rb{a, b} = \rb{a, -b} $. Now the group law explicit formulae for characteristic two and three are more complicated and given in full under code listings in the appendix. The following example illustrates an implementation of the algorithm in the appendix.

\begin{example}
Let $ E $ be the elliptic curve over $ \R $ and let $ L $, $ L_P $, $ L_Q $ be the lines for the points $ P, Q \in E $ from the example above. Then $ L $ intersects $ E $ at $ \rb{3x - 1}^2 = x^3 + 2x + 1 $, or $ x\rb{x - 1}\rb{x - 8} = 0 $. Hence $ P * Q = \rb{8, 23} $, so $ P + Q = \rb{8, -23} $. Similarly $ L_P $ intersects $ E $ at $ \rb{-x - 1}^2 = x^3 + 2x + 1 $, or $ x^2\rb{x - 1} = 0 $, while $ L_Q $ intersects $ E $ at $ \rb{\tfrac{5}{4}x + \tfrac{3}{4}}^2 = x^3 + 2x + 1 $, or $ \rb{x - 1}^2\rb{16x + 7} = 0 $. Thus $ P * P = \rb{1, -2} $ and $ Q * Q = \rb{-7 / 16, 13 / 64} $, so $ P + P = \rb{1, 2} $ and $ Q + Q = \rb{-7 / 16, -13 / 64} $.
\end{example}

An alternative formulation for $ + $ is such that three points $ P, Q, R \in E $ are collinear iff
$$ P + Q + R = P + \rb{Q + R} = \rb{P + Q} + R = \mathcal{O}. $$
This formulation will help in proving that certain maps obey some property later, but also allows for a pictorial description for $ * $. As per the notation in the appendix: the first pane describes $ \rb{*}_2 $; the second pane describes $ \rb{*}_3 $; the third pane describes $ \rb{*}_1 $ and $ \rb{*}_5 $; the fourth pane describes $ \rb{*}_4 $; the unillustrated line at infinity describes $ \rb{*}_6 $.
\begin{center}
\includegraphics*[width=0.9\textwidth]{img/ECClines.png}
\end{center}

\pagebreak

The group structure of an elliptic curve with respect to $ + $ can now be stated in the following theorem.

\begin{theorem}[Group law]
$ \rb{E, \mathcal{O}, +} $ is an abelian group.
\end{theorem}

As full proofs for associativity such as in III.3.4 of \cite{gtm} require further prerequisites on algebraic curves, particularly on \emph{divisors} and \emph{differentials}, only the sketch of an alternative geometric proof is given, of which the special case of nine pairwise distinct points is assumed.

\begin{proof}
The unique right identity is $ \mathcal{O} \in E $ and unique right inverses are given by the negation formula. Symmetry of $ + $ gives the unique identity, unique right inverses, and commutativity. Associativity of $ + $ can be checked with various methods, such as by tediously verifying cases of the explicit formulae in \cite{grouplaw}. Alternatively, let $ P, Q, R \in E $ be points, and let
\begin{itemize}
\item $ L_1 : l_1\rb{X, Y, Z} = 0 $ be the line joining $ P $, $ Q $, and $ P * Q = -\rb{P + Q} $,
\item $ L_2 : l_2\rb{X, Y, Z} = 0 $ be the line joining $ Q $, $ R $, and $ Q * R = -\rb{Q + R} $,
\item $ L_3 : l_3\rb{X, Y, Z} = 0 $ be the line joining $ P + Q $, $ \mathcal{O} $, and $ \rb{P + Q} * \mathcal{O} = -\rb{P + Q} $,
\item $ L_4 : l_4\rb{X, Y, Z} = 0 $ be the line joining $ Q + R $, $ \mathcal{O} $, and $ \rb{Q + R} * \mathcal{O} = -\rb{Q + R} $,
\item $ L_5 : l_5\rb{X, Y, Z} = 0 $ be the line joining $ P + Q $, $ R $, and $ \rb{P + Q} * R = -\rb{\rb{P + Q} + R} $, and
\item $ L_6 : l_6\rb{X, Y, Z} = 0 $ be the line joining $ P $, $ Q + R $, and $ P * \rb{Q + R} = -\rb{P + \rb{Q + R}} $,
\end{itemize}
assuming that these points are pairwise distinct except for $ -\rb{\rb{P + Q} + R} $ and $ -\rb{P + \rb{Q + R}} $. Now let
$$ C_1 : \rb{l_1l_4l_5}\rb{X, Y, Z} = 0, \qquad C_2 : \rb{l_2l_3l_6}\rb{X, Y, Z} = 0, $$
be cubics such that
$$ I = \cb{\mathcal{O}, P, Q, R, P + Q, Q + R, -\rb{P + Q}, -\rb{Q + R}} \subseteq C_1 \cap C_2. $$
Then B\'ezout's theorem gives that $ E $, $ C_1 $, and $ C_2 $ pairwise intersect at nine points up to multiplicity. Hence
$$ E \cap C_1 = I \cup \cb{-\rb{\rb{P + Q} + R}}, \qquad E \cap C_2 = I \cup \cb{-\rb{P + \rb{Q + R}}}, \qquad C_1 \cap C_2 = I \cup \cb{S}, $$
for some ninth point $ S \in C_1 \cap C_2 $. Since $ I \subseteq E $, the Cayley-Bacharach theorem gives $ S \in E $, so
$$ -\rb{\rb{P + Q} + R} = S = -\rb{P + \rb{Q + R}}. $$
Thus $ \rb{P + Q} + R = P + \rb{Q + R} $.
\end{proof}

With an abelian group at hand, some group theoretic properties of an elliptic curve can be explored. In particular, restricting an elliptic curve onto its $ F $-rational points retain the group structure.

\begin{proposition}
$ \rb{E\rb{F}, \mathcal{O}, +} \le \rb{E, \mathcal{O}, +} $.
\end{proposition}

\begin{proof}
Since $ 0, 1 \in F $, it holds that $ \mathcal{O} \in E\rb{F} $. Let $ P, Q \in E\rb{F} $ be points, then the explicit formulae give $ -P, P + Q \in E\rb{F} $. Thus $ \rb{E\rb{F}, \mathcal{O}, +} \le \rb{E, \mathcal{O}, +} $.
\end{proof}

Additionally, the $ n $-torsion points of an elliptic curve also form a group, provided $ \mathcal{O} $ is included. The following example illustrates the structure of the $ 2 $-torsion subgroup.

\begin{example}
Let $ P = \rb{a, b} \in E\sb{2} $, then $ b = -b = 0 $. Since $ x^3 + Ax + B = 0 $ has three distinct solutions, there are three distinct points $ P_1 = \rb{a_1, 0} $, $ P_2 = \rb{a_2, 0} $, and $ P_3 = \rb{a_3, 0} $ in $ E\sb{2} $. Thus $ \rb{E\sb{2}, \mathcal{O}, +} = \rb{\cb{\mathcal{O}, P_1, P_2, P_3}, \mathcal{O}, +} \cong \rb{\Z_2^2, 0, +} $.
\end{example}

Hence $ b = 0 $ iff $ ord\rb{a, b} = 2 $.

\begin{remark}
In fact, the $ n $-torsion points of $ E $ form a subgroup $ E\sb{n} $ of $ E $, such that $ \rb{E\sb{p}, \mathcal{O}, +} \cong \rb{\Z_p^2, 0, +} $ if $ char\rb{F} \nmid p $, and either $ \rb{E\sb{p^e}, \mathcal{O}, +} \cong \rb{\cb{0}, 0, +} $ or $ \rb{E\sb{p^e}, \mathcal{O}, +} \cong \rb{\Z_{p^e}, 0, +} $ for all $ e \in \Z_{> 0} $ if $ char\rb{F} \mid p $.
\end{remark}

\pagebreak

\subsection{Isogenies}

Prior to this section, the only maps between elliptic curves that have been defined were affine transformations. Now that the group law is defined, group homomorphisms can also be considered. However, a slightly different approach to this will be taken with the following definition, noting that morphisms of curves are either constant or surjective.

\begin{definition}[Isogeny]
An \textbf{isogeny} from $ E $ to $ E' $ is a surjective morphism $ \phi : E \to E' $ such that $ \phi\rb{\mathcal{O}} = \mathcal{O} $.
\end{definition}

As isomorphisms are defined as invertible morphisms that preserve the point at infinity, they are isogenies as well. Now despite the simple condition, isogenies are actually group homomorphisms, which also preserve the point at infinity. The following proposition then gives an equivalent definition.

\begin{proposition}
Let $ \phi : E \to E' $ be an isogeny. Then $ \phi $ is a group homomorphism.
\end{proposition}

\begin{proof}
Omitted, see III.4.8 in \cite{gtm}.
\end{proof}

The following is a typical example of an isogeny.

\begin{example}
The \emph{multiplication by $ n $ map} $ \sb{n} : E \to E $ defined by $ \sb{n}\rb{P} = nP $ is an isogeny such that $ Ker\rb{\sb{n}} = E\sb{n} $.
\end{example}

Let $ \phi : E \to E' $ be an isogeny. While isomorphisms are easily characterised by $ j $-invariant affine transformations, the smaller restriction on isogenies allow for a wider range of coordinate transformations that still obey the group homomorphism property. In particular, rational functions that define isogenies can be characterised by the following lemma.

\begin{lemma}
Let $ f \in F\rb{E} $ be a rational function. Then
$$ f\rb{x, y} = \dfrac{f'\rb{x} + f''\rb{x}y}{f'''\rb{x}}, \qquad f', f'' \in F\sb{x}, \qquad f''' \in F\sb{x} \setminus \cb{0}. $$
\end{lemma}

\begin{proof}
Let $ f = g / h $ for some $ g \in F\sb{x, y} $ and some $ h \in F\sb{x, y} \setminus \cb{0} $. Then $ g\rb{x, y} = \sum_{i = 0}^n g_i\rb{x}y^i $ for some $ g_i \in F\sb{x} $, some $ h_i \in F\sb{x} \setminus \cb{0} $, and some $ n, m \in \Z_{\ge 0} $, so:
\begin{align*}
g\rb{x, y}
& = \sum_{i = 0}^n g_i\rb{x}y^i
= \sum_{i = 0}^{n / 2} g_{2i}\rb{x}y^{2i} + \sum_{i = 0}^{n / 2} g_{2i + 1}\rb{x}y^{2i + 1} \\
& = \sum_{i = 0}^{n / 2} g_{2i}\rb{x}\rb{x^3 + Ax + B}^i + \sum_{i = 0}^{n / 2} g_{2i + 1}\rb{x}\rb{x^3 + Ax + B}^iy \\
& = g'\rb{x} + g''\rb{x}y, \qquad g', g'' \in F\sb{x}.
\end{align*}
Similarly $ h\rb{x, y} = h'\rb{x} + h''\rb{x}y $ for some $ h', h'' \in F\sb{x} $. Thus
\begin{align*}
f\rb{x, y}
& = \dfrac{g\rb{x, y}}{h\rb{x, y}}
= \dfrac{g'\rb{x} + g''\rb{x}y}{h'\rb{x} + h''\rb{x}y}
= \dfrac{\rb{g'\rb{x} + g''\rb{x}y}\rb{h'\rb{x} - h''\rb{x}y}}{\rb{h'\rb{x} + h''\rb{x}y}\rb{h'\rb{x} - h''\rb{x}y}} \\
& = \dfrac{g'\rb{x}h'\rb{x} - g''\rb{x}h''\rb{x}y^2 - g'\rb{x}h''\rb{x}y + g''\rb{x}h'\rb{x}y}{h'\rb{x}^2 - h''\rb{x}^2y^2} \\
& = \dfrac{g'\rb{x}h'\rb{x} - g''\rb{x}h''\rb{x}\rb{x^3 + Ax + B} - g'\rb{x}h''\rb{x}y + g''\rb{x}h'\rb{x}y}{h'\rb{x}^2 - h''\rb{x}^2\rb{x^3 + Ax + B}} \\
& = \dfrac{f'\rb{x} + f''\rb{x}y}{f'''\rb{x}}, \qquad f, f' \in F\sb{x}, \qquad f'' \in F\sb{x} \setminus \cb{0}.
\end{align*}
\end{proof}

\pagebreak

An entire isogeny can now be characterised similarly, noting the group homomorphism property. The following proposition gives the explicit \emph{standard form} of an isogeny, defined in terms of its image.

\begin{proposition}
Let $ P = \rb{a, b} \in E \setminus Ker\rb{\phi} $ be a point. Then
$$ \phi\rb{P} = \rb{\dfrac{r\rb{a}}{s\rb{a}}, \dfrac{u\rb{a}}{v\rb{a}}b} \qquad r, u \in F\sb{x}, \qquad s, v \in F\sb{x} \setminus \cb{0}, $$
such that $ \gcd\rb{r, s} = \gcd\rb{u, v} = 1 $.
\end{proposition}

\begin{proof}
Let $ \phi = \sb{\phi_x, \phi_y, \phi_z} $ for some $ \phi_x, \phi_y, \phi_z \in F\rb{E} $. Since $ \phi\rb{P} \ne \mathcal{O} $, it holds that $ \phi_z\rb{P} \ne 0 $, so
$$ \phi\rb{P} = \sb{\phi_x\rb{P}, \phi_y\rb{P}, \phi_z\rb{P}} = \rb{\dfrac{\phi_x\rb{P}}{\phi_z\rb{P}}, \dfrac{\phi_y\rb{P}}{\phi_z\rb{P}}}. $$
Then $ \phi_x\rb{P} / \phi_z\rb{P}, \phi_y\rb{P} / \phi_z\rb{P} \in F\rb{E} $ are rational functions, so
$$ \dfrac{\phi_x\rb{P}}{\phi_z\rb{P}} = \dfrac{\psi\rb{a} + \psi'\rb{a}b}{\psi''\rb{a}}, \qquad \dfrac{\phi_y\rb{P}}{\phi_z\rb{P}} = \dfrac{\chi\rb{a} + \chi'\rb{a}b}{\chi''\rb{a}}, \qquad \psi, \psi', \chi, \chi' \in F\sb{x}, \qquad \psi'', \chi'' \in F\sb{x} \setminus \cb{0}. $$
Since $ \phi\rb{-P} = -\phi\rb{P} $,
$$ \rb{\dfrac{\psi\rb{a} + \psi'\rb{a}\rb{-b}}{\psi''\rb{a}}, \dfrac{\chi\rb{a} + \chi'\rb{a}\rb{-b}}{\chi''\rb{a}}} = \phi\rb{-P} = -\phi\rb{P} = \rb{\dfrac{\psi\rb{a} + \psi'\rb{a}b}{\psi''\rb{a}}, -\dfrac{\chi\rb{a} + \chi'\rb{a}b}{\chi''\rb{a}}}. $$
Hence $ \psi'\rb{a} = \chi\rb{a} = 0 $. Now let $ g = \gcd\rb{\psi, \psi''} $ and $ g' = \gcd\rb{\chi', \chi''} $. Thus let
$$ r = \dfrac{\psi}{g}, u = \dfrac{\chi'}{g'} \in F\sb{x}, \qquad s = \dfrac{\psi''}{g}, v = \dfrac{\chi''}{g'} \in F\sb{x} \setminus \cb{0}, $$
such that $ \gcd\rb{r, s} = \gcd\rb{u, v} = 1 $.
\end{proof}

In the above proof, the assumption that a point $ P \in E $ is not in the kernel allows for the isogeny to be scaled appropriately. If $ P $ is in the kernel, it would be mapped to the point at infinity, which would mean that $ \phi_z $, and hence $ s $ or $ v $, is zero. With this in mind, an abuse of notation allows for the standard form to be written as
$$ \phi\rb{x, y} = \rb{\dfrac{r\rb{x}}{s\rb{x}}, \dfrac{u\rb{x}}{v\rb{x}}y}, \qquad r, s, u, v \in F\sb{x}, \qquad \gcd\rb{r, s} = \gcd\rb{u, v} = 1, $$
remembering that $ \phi\rb{\mathcal{O}} = \mathcal{O} $, and $ \phi\rb{a, b} = \mathcal{O} $ whenever $ s\rb{a} = 0 $ or $ v\rb{a} = 0 $ for any point $ \rb{a, b} \in E $. The following example rewrites the multiplication by two map with the familiar duplication formula.

\begin{example}
By the duplication formula,
\begin{align*}
\sb{2}\rb{x, y}
& = \rb{\dfrac{x^4 - 2Ax^2 - 8Bx + A^2}{4y^2}, \dfrac{x^6 + 5Ax^4 + 20Bx^3 - 5A^2x^2 - 4ABx - A^3 - 8B^2}{8y^3}} \\
& = \rb{\dfrac{x^4 - 2Ax^2 - 8Bx + A^2}{4\rb{x^3 + Ax + B}}, \dfrac{x^6 + 5Ax^4 + 20Bx^3 - 5A^2x^2 - 4ABx - A^3 - 8B^2}{8\rb{x^3 + Ax + B}^2}y},
\end{align*}
which is in standard form. Then $ \sb{2}\rb{a, b} = \mathcal{O} $ iff $ b^2 = a^3 + Aa + B = 0 $ for any point $ \rb{a, b} \in E $.
\end{example}

There are also two useful notions of an isogeny, the first of which is its degree.

\begin{definition}[Isogeny degree]
The \textbf{degree} of $ \phi $ is $ \deg\rb{\phi} = \max\cb{\deg\rb{r}, \deg\rb{s}} $.
\end{definition}

The degree of the constant morphism, while not an isogeny, is defined to be zero. The degrees of two trivial isogenies are given in the following example.

\begin{example}
The identity isogeny, or the multiplication by one map $ \sb{1} $ has degree $ \deg\rb{\sb{1}} = \max\cb{1, 1} = 1 $. Similarly, the multiplication by negative one map $ \sb{-1} $ also has degree $ \deg\rb{\sb{-1}} = 1 $.
\end{example}

\pagebreak

The second invariant notion of an isogeny is its separability.

\begin{definition}[Separable isogeny]
$ \phi $ is \textbf{separable} iff $ d\rb{r / s} / dx \ne 0 $.
\end{definition}

\begin{remark}
The isogeny $ \phi $ induces an injection $ \phi^* : F\rb{E'} \to F\rb{E} $ of function fields. Its separability is equivalently formulated as that of $ F\rb{E} / \phi^*F\rb{E'} $, which reflects the definition of a separable extension.
\end{remark}

The following example of the multiplication by two map illustrates these two notions.

\begin{example}
$ \sb{2} $ has degree $ \deg\rb{\sb{2}} = \max\cb{4, 3} = 4 $ and is separable since
$$ \dfrac{d}{dx}\rb{\dfrac{x^4 - 2Ax^2 - 8Bx + A^2}{4\rb{x^3 + Ax + B}}} = \dfrac{x^6 + 5Ax^4 + 20Bx^3 - 5A^2x^2 - 4ABx - A^3 - 8B^2}{4\rb{x^3 + Ax + B}^2} \ne 0. $$
\end{example}

Separability always holds in $ char\rb{F} = 0 $, but there are inseparable isogenies in $ char\rb{F} = p $ for some prime $ p \in \Z_{> 0} $. More on separable isogenies will be discussed in a later section. Now since $ + $ is a morphism, the set of all isogenies between $ E $ and $ E' $, together with the constant morphism, forms an abelian group $ Hom\rb{E, E'} $ under the operation
$$ \rb{\phi + \psi}\rb{P} = \phi\rb{P} + \psi\rb{P}. $$
Isogenies in the group can also compose to form a ring when $ E = E' $ in the following definition.

\begin{definition}[Endomorphism]
$ \phi $ is an \textbf{endomorphism} of $ E $ iff $ E = E' $. The \textbf{endomorphism ring} $ End\rb{E} $ of $ E $ is the ring of all endomorphisms of $ E $ with respect to $ + $ and $ \circ $, where
$$ \rb{\phi \circ \psi} = \phi\rb{\psi\rb{P}}. $$
\end{definition}

The following example gives an endomorphism of elliptic curves over fields of non-zero characteristic that is of particular interest.

\begin{example}
Let $ F = \F_p $ for some prime $ p \in \Z_{> 0} $. Then the \emph{Frobenius endomorphism} $ Fr : E \to E $ defined by $ Fr\rb{x, y} = \rb{x^p, y^p} $ is an inseparable endomorphism with degree $ \deg\rb{Fr} = p $.
\end{example}

The Frobenius endomorphism will be formally defined in a later section. On a final note, endomorphisms with inverses also form a multiplicative subgroup.

\begin{definition}[Automorphism]
$ \phi $ is an \textbf{automorphism} of $ E $ iff it is an endomorphism and an isomorphism. The \textbf{automorphism group} $ Aut\rb{E} $ is the group of all automorphisms of $ E $.
\end{definition}

Unlike the endomorphism ring, the automorphism group of an elliptic curve is easily characterised.

\begin{proposition}
$$ Aut\rb{E} \cong \begin{cases} \Z_6 & j_E = 0 \\ \Z_4 & j_E = 1728 \\ \Z_2 & j_E \notin \cb{0, 1728} \end{cases}. $$
\end{proposition}

\begin{proof}
Let $ \phi \in Aut\rb{E} $. Then $ \phi $ induces a $ j $-invariant affine transformation
$$ \rb{x, y} \mapsto \rb{u^2x + r, u^3y + u^2sx + t}, \qquad u \in K^*, \qquad r, s, t \in K $$
from $ W $ to itself. Since $ \phi $ is an automorphism, it holds that $ r = s = t = 0 $, and $ A = A / u^4 $ and $ B = B / u^6 $. If $ j_E = 0 $, then $ A = 0 $ and $ B \ne 0 $, so $ u^6 = 1 $. Hence $ u $ is a sixth root of unity and $  Aut\rb{E} \cong \Z_6 $. If $ j_E = 1728 $, then $ A \ne 0 $ and $ B = 0 $, so $ u^4 = 1 $. Hence $ u $ is a fourth root of unity and $ Aut\rb{E} \cong \Z_4 $. Otherwise $ j_E \notin \cb{0, 1728} $, then $ A \ne 0 $ and $ B \ne 0 $, so $ u^6 = 1 $ and $ u^4 = 1 $. Hence $ u^2 = 1 $ and $ u $ is a second root of unity. Thus $ Aut\rb{E} \cong \Z_2 $.
\end{proof}

\begin{remark}
If $ char\rb{F} \in \cb{2, 3} $, then the above list of cases for $ Aut\rb{E} $ with $ j_E = 0, 1728 $ is not exhaustive. In particular, if $ char\rb{F} = 2 $, then $ Aut\rb{E} \cong \Z_4 \ltimes \Z_3 $, otherwise $ char\rb{F} = 3 $, then $ Aut\rb{E} \cong \Z_3 \ltimes Q_8 $.
\end{remark}

The above definitions are defined for $ E\rb{F} $ as well, and are written $ Hom_F\rb{E, E'} $, $ End_F\rb{E} $, and $ Aut_F\rb{E} $ respectively.

\pagebreak

\section{Elliptic curves over finite fields}

When studying elliptic curves over a field or a family of fields, an important question would be to determine the set of solutions existing in that field. For instance, it is desirable to count the rational solutions in that field, which would have far fetching applications in number theory and cryptography. For finite fields, there is a finite process to compute the rational points that would always work. The following example illustrates a naive approach for this.

\begin{example}
Let $ E : y^2 = x^3 + x + 1 $ be an elliptic curve over $ \F_5 $. Since there are five distinct values for $ x \in \F_5 = \cb{0, 1, 2, 3, 4} $, computing $ x^3 + x + 1 $ for each value of $ x $ and checking if it is a quadratic residue $ y^2 $ in $ \F_5 $ gives the following
\begin{itemize}
\item If $ x = 0 $, then $ y^2 = x^3 + x + 1 = 1 = 1^2 = 4^2 $, so $ y = 1 $ or $ y = 4 $.
\item If $ x = 1 $, then $ y^2 = x^3 + x + 1 = 3 $ is not a quadratic residue.
\item If $ x = 2 $, then $ y^2 = x^3 + x + 1 = 1 = 1^2 = 4^2 $, so $ y = 1 $ or $ y = 4 $.
\item If $ x = 3 $, then $ y^2 = x^3 + x + 1 = 1 = 1^2 = 4^2 $, so $ y = 1 $ or $ y = 4 $.
\item If $ x = 4 $, then $ y^2 = x^3 + x + 1 = 4 = 2^2 = 3^2 $, so $ y = 2 $ or $ y = 3 $.
\end{itemize}
Since $ \mathcal{O} \in E\rb{\F_5} $, there are exactly nine $ \F_5 $-rational points
$$ E\rb{\F_5} = \cb{\mathcal{O}, \rb{0, 1}, \rb{0, 4}, \rb{2, 1}, \rb{2, 4}, \rb{3, 1}, \rb{3, 4}, \rb{4, 2}, \rb{4, 3}}. $$
Hence $ E\rb{\F_5} \cong \Z_3^2 $ or $ E\rb{\F_5} \cong \Z_9 $. Now Lagrange's theorem gives that $ ord\rb{P} = 3 $ or $ ord\rb{P} = 9 $ for any non-zero point $ P \in E\rb{\F_5} $. Let $ P = \rb{0, 1} \in E\rb{\F_5} $. By the addition and duplication formulae, it holds that $ 3P = \rb{2, 1} $ and $ 9P = \mathcal{O} $, so it has order $ ord\rb{P} = 9 $ and is a generator of $ E\rb{\F_5} $. Thus $ E\rb{\F_5} \cong \Z_9 $.
\end{example}

This finite process is straightforward in the sense that it always terminates. However, as it runs with an asymptotic time complexity of $ O\rb{q} $ for a finite field $ \F_q $, the approach becomes rather intractable for large prime powers $ q \in \Z_{> 0} $. This section will attempt to develop several techniques to compute $ E\rb{\F_q} $, or more specifically $ \abs{E\rb{\F_q}} $, which will span the next few subsections. Now let $ E $ be an elliptic curve over the perfect field $ F = \F_q = \F_{p^e} $ for some prime $ p \in \Z_{> 0} \setminus \cb{2, 3} $ and some $ e \in \Z_{> 0} $, given by the Weierstrass curve
$$ E : y^2 = x^3 + Ax + B, \qquad A, B \in F, $$
with the group of rational points $ E\rb{F} = \rb{E\rb{F}, \mathcal{O}, +} $.

\subsection{Hasse's theorem: inseparable isogenies}

The following theorem bounds the maximum cardinality of the group of rational points.

\begin{theorem}[Hasse]
\label{thm:hasse}
$ \abs{E\rb{F}} = q - t + 1 $ for some \emph{trace} $ t \in \Z $ such that $ \abs{t} \le 2\sqrt{q} $.
\end{theorem}

\begin{remark}
This is a special case of the Hasse-Weil theorem, which states that $ \abs{C\rb{F}} = q - t + 1 $ for some $ \abs{t} \le 2g\sqrt{q} $ for any projective algebraic curve $ C $ over $ F $ of genus $ g $.
\end{remark}

Proof of Hasse's theorem concerns the properties of separable and inseparable isogenies, which are given by separable and inseparable polynomials. The following lemma allows inseparable polynomials to be written in a reduced form.

\begin{lemma}
Let $ f \in F\sb{x} $ be an inseparable polynomial. Then $ f\rb{x} = g\rb{x^p} $ for some $ g \in F\sb{x} $.
\end{lemma}

\begin{proof}
Let $ f\rb{x} = \sum_{i = 0}^n a_ix^i = \sum_{a_i \ne 0} a_ix^{m_i} $ for some $ a_i \in F $ and some $ n, m_i \in \Z_{> 0} $. Since $ f $ is separable, it holds that $ 0 = df / dx = \sum_{a_i \ne 0} m_ia_ix^{m_i - 1} $. Then $ m_ia_i = 0 $ for each $ a_i \ne 0 $, so $ p \mid m_i $ and $ m_i = pk $ for some $ k \in \Z_{\ge 0} $. Thus $ f\rb{x} = \sum_{a_i \ne 0} a_i\rb{x^p}^k = g\rb{x^p} $ for some $ g \in F\sb{x} $.
\end{proof}

The polynomial $ g $ would then be of a smaller degree than $ f $, which justifies why it is deemed as reduced. A similar argument allows inseparable isogenies to be reduced, so let $ E' $ be another elliptic curve over $ F $ given by the Weierstrass curve
$$ E' : y^2 = x^3 + A'x + B', \qquad A', B' \in F,  $$
and let $ \phi : E \to E' $ be an isogeny. The following lemma again allows inseparable isogenies to be written in a reduced form.

\begin{lemma}
Let $ \phi $ be inseparable. Then
$$ \phi\rb{x, y} = \rb{\dfrac{r'\rb{x^p}}{s'\rb{x^p}}, \dfrac{u'\rb{x^p}}{v'\rb{x^p}}y^p}, \qquad r', s', u', v' \in F\sb{x}. $$
\end{lemma}

\begin{proof}
Since $ \phi $ is inseparable,
$$ 0 = \dfrac{d}{dx}\rb{\dfrac{r}{s}} = \dfrac{1}{s^2}\rb{\dfrac{dr}{dx}s - \dfrac{ds}{dx}r} \qquad \implies \qquad \dfrac{dr}{dx}s = \dfrac{ds}{dx}r. $$
Since $ \gcd\rb{r, s} = 1 $, it holds that $ r \mid dr / dx $. Since $ \deg\rb{dr / dx} < \deg\rb{r} $, it also holds that $ dr / dx = 0 $, so $ r $ is inseparable and $ r\rb{x} = r'\rb{x^p} $ for some $ r' \in F\sb{x} $. Similarly $ s $ is inseparable, so $ ds / dx = 0 $ and $ s\rb{x} = s'\rb{x^p} $ for some $ s' \in F\sb{x} $. Now
$$ \rb{\dfrac{u}{v}y}^2 = \rb{\dfrac{r}{s}}^3 + A'\dfrac{r}{s} + B' \qquad \implies \qquad u^2s^3y^2 = v^2t, \qquad t = r^3 + A'rs^2 + B's^3. $$
Then $ dr / dx = 0 $ and $ ds / dx = 0 $ gives $ dt / dx = 0 $, which gives $ d\rb{u^2y^2 / v^2} / dx = d\rb{t / s^3} / dx = 0 $. Hence $ u\rb{x}^2y^2 = y'\rb{x^p} $ and $ v\rb{x}^2 = v'\rb{x^p} $ for some $ y', v' \in F\sb{x} $ similarly. Now since $ y^2 = x^3 + Ax + B $ has distinct factors, let $ y^2 = \rb{x - \alpha_1}\rb{x - \alpha_2}\rb{x - \alpha_3} $ for some $ \alpha_i \in K $. Then each $ \rb{x - \alpha_i} $ is a factor of $ y'\rb{x^p} $, so $ \rb{x^p - \alpha_i^p} = \rb{x - \alpha_i}^p $ is also a factor of $ y'\rb{x^p} $ and of $ u\rb{x}y^2 $. Hence $ y'\rb{x^p} = t'\rb{x^p}\rb{y^2}^p $ for some $ t' \in F\sb{x} $. Now any factor $ \rb{x - \alpha} $ of $ u\rb{x} $ is such that $ \rb{x - \alpha}^p = \rb{x^p - \alpha^p} $ is a factor of $ t'\rb{x^p} $. Since $ \gcd\rb{p, 2} = 1 $, it holds that $ \rb{\rb{x - \alpha}^p}^2 $ is also a factor of $ t'\rb{x^p} $, so $ t'\rb{x^p} = u'\rb{x^p}^2 $ for some $ u' \in F\sb{x} $. Thus $ u\rb{x}^2y^2 = u'\rb{x^p}^2\rb{y^p}^2 $ and
$$ \phi\rb{x, y} = \rb{\dfrac{r\rb{x}}{s\rb{x}}, \dfrac{u\rb{x}}{v\rb{x}}y} = \rb{\dfrac{r'\rb{x^p}}{s'\rb{x^p}}, \pm\dfrac{u'\rb{x^p}}{v'\rb{x^p}}y^p}. $$
\end{proof}

Now the above lemma might feel slightly arbitrary due to the presence of $ x^p $ and $ y^p $ in the isogeny. This brings the discussion to a particular endomorphism defined as follows, which would simplify the above expression.

\begin{definition}[Frobenius endomorphism]
The \textbf{Frobenius endomorphism} $ Fr : E \to E $ is defined by $ Fr\rb{x, y} = \rb{x^p, y^p} $ if $ e = 1 $. The $ q $-th power Frobenius endomorphism $ Fr_q : E \to E $ is defined by $ Fr_q\rb{x, y} = \rb{x^q, y^q} $.
\end{definition}

The Frobenius endomorphism is also injective by virtue of the field characteristic, and hence bijective, which allows for an inverse isogeny to be easily defined.

\begin{remark}
A remarkable equivalent characterisation of a perfect field is that the Frobenius endomorphism of a field with positive characteristic is an automorphism, which induces a similar property for isogenies defined over this field.
\end{remark}

The above lemmas for inseparable $ \phi $ can now be written in terms of the Frobenius endomorphism $ \phi = \phi' \circ Fr $, where
$$ \phi'\rb{x, y} = \rb{\dfrac{r'\rb{x}}{s'\rb{x}}, \dfrac{u'\rb{x}}{v'\rb{x}}y}, \qquad r', s', u', v' \in F\sb{x}, $$
which is a reduced standard form of an isogeny. In fact, any isogeny can be written as the composition of a Frobenius endomorphism. The following proposition summarises the above lemmas nicely.

\begin{proposition}
$ \phi = \phi_s \circ Fr^n $ for some separable isogeny $ \phi_s : E \to E' $ and some $ n \in \Z_{\ge 0} $.
\end{proposition}

\begin{proof}
If $ \phi $ is separable, then let $ \phi_s = \phi $ and $ n = 0 $. Otherwise $ \phi = \phi_1 \circ Fr $ for some $ \phi_1 : E \to E' $. If $ \phi_i : E \to E' $ is inseparable, then $ \phi_i = \phi_{i + 1} \circ Fr^i $ for some $ \phi_{i + 1} : E \to E' $. Since $ \deg\rb{\phi} $ is finite, by induction, there is some $ n \in \Z_{\ge 0} $ such that $ n \le \deg\rb{\phi} $ and $ \phi_n : E \to E' $ is separable. Thus let $ \phi_s = \phi_n $.
\end{proof}

\begin{remark}
Since $ F $ is a perfect field, the isogeny $ \phi $ can also be written as $ \phi = Fr^n \circ \phi'_s $ for some separable isogeny $ \phi'_s : E \to E' $ such that $ \deg\rb{\phi_s} = \deg\rb{\phi'_s} $. If $ F $ is not a perfect field, the Frobenius endomorphism is not necessarily an automorphism, so $ Im\rb{Fr} \subseteq E $ and the domain of $ \phi_s $ is only a subset of $ E $.
\end{remark}

Hence any isogeny can be decomposed as the unique composition of a separable isogeny and a Frobenius endomorphism, so $ \phi $ will be written as
$$ \phi = \phi_s \circ Fr^n, \qquad \phi_s \in F\sb{E}, \qquad n \in \Z_{\ge 0}, $$
where $ \phi_s $ is a separable isogeny. Two additional notions of degree of an isogeny can then be defined as follows.

\begin{definition}[Separable degree]
The \textbf{separable degree} of $ \phi $ is $ \deg_s\rb{\phi} = \deg\rb{\phi_s} $. The \textbf{inseparable degree} of $ \phi $ is $ \deg_i\rb{\phi} = p^n $.
\end{definition}

It is clear that the degree of an isogeny is related to these two degrees by
$$ \deg\rb{\phi} = \deg_s\rb{\phi}\deg_i\rb{\phi}. $$
If an isogeny is separable, its decomposition to a Frobenius endomorphism is trivial, so its separable degree is equal to its degree and its inseparable degree is one.

\begin{remark}
An inseparable isogeny does not necessarily have its inseparable degree equal to its degree and its separable degree equal to one. If this is the case, then the isogeny is \emph{purely inseparable}. However, purely inseparable isogenies are not always inseparable, as with the case for degree one isogenies, which are isomorphisms, with all three degree equal to one.
\end{remark}

The following example illustrates the two additional notions of degree.

\begin{example}
$ Fr $ has separable degree $ \deg_s\rb{Fr} = 1 $ and inseparable degree $ \deg_i\rb{Fr} = p $, while $ \sb{2} $ has separable degree $ \deg_s\rb{\sb{2}} = \deg\rb{\sb{2}} = 4 $ and inseparable degree $ \deg_i\rb{\sb{2}} = 1 $.
\end{example}

This digression leads to an important proposition relating the kernel and the separable degree of an isogeny as follows, which is crucial to the proof of Hasse's theorem.

\begin{proposition}
$ \abs{Ker\rb{\phi}} = \deg_s\rb{\phi} $.
\end{proposition}

\begin{proof}
Let
$$ S_1 = \cb{\rb{a, 0} \in E'} = E\sb{2}, \qquad S_2 = \cb{\rb{0, b} \in E'}, \qquad S_3 = \cb{\rb{a, b} \in E' \mid \deg\rb{r - as} < \deg\rb{\phi_s}}, $$
$$ S_4 = \cb{\rb{a, b} \in E' \ \Bigg| \ \rb{\dfrac{r}{s}}\rb{a'} = a, \ \dfrac{d}{dx}\rb{\dfrac{r}{s}}\rb{a'} = 0, \ \rb{a', b'} \in E}, \qquad S = S_1 \cup S_2 \cup S_3 \cup S_4. $$
Then $ \abs{S_1} \le 3 $ and $ \abs{S_2} \le 2 $ are finite. Since $ \deg\rb{\phi_s} $ is finite, it holds that $ \abs{S_3} \le 2\deg\rb{\phi_s} $ is also finite. Since $ \phi_s $ is separable, it holds that $ d\rb{r / s} / dx \ne 0 $, so $ \abs{S_4} \le \deg\rb{r} $ is also finite. Hence $ S $ is finite and $ E' \setminus S $ is non-empty. Now let $ P = \rb{a, b} \in E' \setminus S $ and $ P' = \rb{a', b'} \in E $ be points, and let $ \psi = r - as \in K\sb{x} $ be such that $ \deg\rb{\psi} = \deg\rb{\phi_s} $. Then $ \phi_s\rb{P'} = P $ iff $ \rb{r / s}\rb{a'} = a $ and $ \rb{u / v}\rb{a'}b' = b $. Since $ b \ne 0 $ gives $ u\rb{a'} \ne 0 $, this also holds iff $ \psi\rb{a'} = r\rb{a'} - as\rb{a'} = 0 $ and $ b' = \rb{v / u}\rb{a'}b $. Hence $ \abs{\phi_s^{-1}\rb{P}} $ is the number of distinct roots of $ \psi $. Suppose for a contradiction that $ a' $ is a repeated root of $ \psi $. Then
$$ 0 = \psi\rb{a'} = r\rb{a'} - as\rb{a'}, \qquad 0 = \dfrac{d\psi}{dx}\rb{a'} = \dfrac{dr}{dx}\rb{a'} - a\dfrac{ds}{dx}\rb{a'}, $$
such that
$$ \rb{\dfrac{r}{s}}\rb{a'} = a, \qquad \dfrac{dr}{dx}\rb{a'}s\rb{a'} = \dfrac{ds}{dx}\rb{a'}r\rb{a'} \qquad \implies \qquad \dfrac{d}{dx}\rb{\dfrac{r}{s}}\rb{a'} = 0, $$
so $ P' \in S_4 $, which is a contradiction. Hence $ \psi $ splits over $ K $ and $ \abs{\phi_s^{-1}\rb{P}} = \deg\rb{\psi} $. Since $ \chi : Ker\rb{\phi_s} \to \phi_s^{-1}\rb{P} $ defined by $ \chi\rb{Q} = Q + P $ is a bijection, it holds that $ \abs{Ker\rb{\phi_s}} = \abs{\phi_s^{-1}\rb{P}} $. Since $ Fr $ is bijective, so are $ Fr^n $ and $ \val{Fr^n}_{Ker\rb{\phi}} : Ker\rb{\phi} \to Ker\rb{\phi_s} $, so $ \abs{Ker\rb{\phi}} = \abs{Ker\rb{\phi_s}} $. Thus
$$ \abs{Ker\rb{\phi}} = \abs{Ker\rb{\phi_s}} = \abs{\phi_s^{-1}\rb{P}} = \deg\rb{\psi} = \deg\rb{\phi_s} = \deg_s\rb{\phi}. $$
\end{proof}

Motivated by the endomorphism ring, composition of isogenies with appropriate domains can be seen as multiplication. In particular, their degrees multiply out naturally in the following lemma.

\begin{lemma}
Let $ E'' $ be an elliptic curve over $ F $ such that $ \psi : E' \to E'' $ is an isogeny. Then
$$ \deg\rb{\psi \circ \phi} = \deg\rb{\psi}\deg\rb{\phi}, \qquad \deg_s\rb{\psi \circ \phi} = \deg_s\rb{\psi}\deg_s\rb{\phi}, \qquad \deg_i\rb{\psi \circ \phi} = \deg_i\rb{\psi}\deg_i\rb{\phi}. $$
\end{lemma}

\begin{proof}
Since $ \phi $ and $ \psi $ are surjective, so is $ \psi \circ \phi $, so the first isomorphism theorem gives
$$ \dfrac{E}{Ker\rb{\phi}} \cong E', \qquad \dfrac{E'}{Ker\rb{\psi}} \cong E'', \qquad \dfrac{E}{Ker\rb{\psi \circ \phi}} \cong E'', $$
such that
$$ \abs{Ker\rb{\psi \circ \phi}} = \dfrac{\abs{E}}{\abs{E''}} = \dfrac{\abs{E'}\abs{Ker\rb{\phi}}}{\abs{E'} / \abs{Ker\rb{\psi}}} = \abs{Ker\rb{\psi}}\abs{Ker\rb{\phi}}. $$
Hence $ \deg_s\rb{\psi \circ \phi} = \deg_s\rb{\psi}\deg_s\rb{\phi} $. Now let $ \psi = \psi_s \circ Fr^m $ and $ \psi \circ \phi = \chi_s \circ Fr^k $ for some isogenies $ \psi_s : E' \to E'' $ and $ \chi_s : E \to E'' $ and some $ m, k \in \Z_{\ge 0} $. Then
$$ \chi_s \circ Fr^k = \psi_s \circ Fr^m \circ \phi_s \circ Fr^n. $$
Since $ \deg_s\rb{Fr} = 1 $, it holds that $ \deg_s\rb{Fr^m} = 1 $, so
$$ \deg_s\rb{Fr^m \circ \phi_s} = \deg_s\rb{Fr^m}\deg_s\rb{\phi_s} = \deg_s\rb{\phi_s}. $$
Then $ Fr^m \circ \phi_s = \chi'_s \circ Fr^m $ for some isogeny $ \chi'_s : E \to E' $ such that $ \deg\rb{\phi_s} = \deg\rb{\chi'_s} $, so
$$ \chi_s \circ Fr^k = \psi_s \circ \chi'_s \circ Fr^{n + m}. $$
Since $ \psi_s \circ \chi'_s $ is separable, it holds that $ k = n + m $. Hence $ \deg_i\rb{\psi \circ \phi} = \deg_i\rb{\psi}\deg_i\rb{\phi} $. Thus
$$ \deg\rb{\psi \circ \phi} = \deg_s\rb{\psi}\deg_i\rb{\psi}\deg_s\rb{\phi}\deg_i\rb{\phi} = \deg\rb{\psi}\deg\rb{\phi}. $$
\end{proof}

This paves the way to the proof of the following proposition on inseparable isogenies, which is also crucial to the proof of Hasse's theorem. Now let $ \psi : E \to E' $ be an isogeny.

\begin{proposition}
Let $ \phi $ and $ \psi $ be inseparable, and let $ E'' $ and $ E''' $ be elliptic curves over $ F $ such that $ \chi : E'' \to E $ and $ \chi' : E' \to E''' $ are isogenies. Then $ \phi \circ \chi $, $ \chi' \circ \phi $, and $ \phi - \psi $ are inseparable.
\end{proposition}

\begin{proof}
Since $ \deg_i\rb{\phi \circ \chi} = \deg_i\rb{\phi}\deg_i\rb{\chi} > 1 $ and $ \deg_i\rb{\chi' \circ \phi} = \deg_i\rb{\phi}\deg_i\rb{\chi} > 1 $, it holds that $ \phi \circ \chi $ and $ \chi' \circ \phi $ are inseparable. Now let $ \phi = \phi_s \circ Fr^n $ and $ \psi = \psi_s \circ Fr^m $ for some separable isogenies $ \phi_s : E \to E' $ and $ \psi_s : E \to E' $ and some $ n, m \in \Z_{> 0} $. Then
$$ \phi - \psi = \phi_s \circ Fr^n - \psi_s \circ Fr^m = \rb{\phi_s \circ Fr^{n - 1} - \psi_s \circ Fr^{m - 1}} \circ Fr. $$
Thus $ \phi - \psi $ is inseparable.
\end{proof}

Hence adding a separable isogeny with an inseparable isogeny will give a separable isogeny. Returning to the initial motivation, letting $ E = E' = E'' = E''' $ in the above results implies that the set of all inseparable endomorphisms of $ E $ is an ideal of $ End\rb{E} $.

\pagebreak

\subsection{Hasse's theorem: quadratic forms}

Now the \emph{degree map} $ \deg : Hom\rb{E, E'} \to \Z_{\ge 0} $ has a particular property that allows a form of the Cauchy-Schwarz inequality to be defined on it. This property can be defined with the aid of the following notion.

\begin{definition}[Bilinear pairing]
A pairing $ b : G \times G \to F $ of an group $ G $ is \textbf{bilinear} iff $ b\rb{x + y, z} = b\rb{x, z} + b\rb{y, z} $ and $ b\rb{x, y + z} = b\rb{x, y} + b\rb{x, z} $ for any $ x, y, z \in G $.
\end{definition}

In other words the pairing is linear in both components. A bilinear pairing can be defined in terms of the degree map, with the set of isogenies $ Hom\rb{E, E'} $ as the abelian group, which has the following property.

\begin{definition}[Quadratic form]
A \textbf{quadratic form} is a map $ d : A \to F $ of an abelian group $ A $ such that $ d\rb{x} = d\rb{-x} $ for any $ x \in A $, and the \textbf{associated pairing} $ b_d : A \times A \to F $ defined by
$$ b_d\rb{x, y} = \tfrac{1}{2}\rb{d\rb{x + y} - d\rb{x} - d\rb{y}} $$
is bilinear.
\end{definition}

The associated bilinear pairing is usually written $ \ab{\cdot, \cdot} : A \times A \to F $ with context, and inherits all the definitions from linear algebra, such as the notions of being symmetric and positive definite.

\begin{remark}
Conversely, for any symmetric bilinear pairing $ \ab{\cdot, \cdot} : A \times A \to F $, the map $ d : A \to F $ defined by $ d\rb{x} = \ab{x, x} $ is a quadratic form, so notions related to symmetric bilinear pairings and quadratic forms are interchangeable, provided $ char\rb{F} \ne 2 $.
\end{remark}

Hence an aim would be to show that the degree map indeed is a positive definite quadratic form, as symmetry follows by definition. This could be done by proving a particular fundamental property that holds for all quadratic forms, which is given in the following theorem. Now denote $ -\phi = \sb{-1} \circ \phi $ and
$$ \phi + \dots + \phi = n\phi = \sb{n} \circ \phi, \qquad \psi + \dots + \psi = m\psi = \sb{m} \circ \psi, \qquad n, m \in \Z, $$
to ease the proofs below.

\begin{theorem}[Parallelogram law]
$ \deg\rb{\phi + \psi} + \deg\rb{\phi - \psi} = 2\deg\rb{\phi} + 2\deg\rb{\psi} $.
\end{theorem}

\begin{proof}
If $ \phi = 0 $ or $ \psi = 0 $, then $ \deg\rb{\phi + \psi} + \deg\rb{\phi - \psi} = 2\deg\rb{\phi} + 2\deg\rb{\psi} $ holds. If $ \phi = \psi $ or $ \phi = -\psi $, then
$$ \deg\rb{\phi + \psi} + \deg\rb{\phi - \psi} = \deg\rb{2\phi} = \deg\rb{\sb{2}}\deg\rb{\phi} = 4\deg\rb{\phi} = 2\deg\rb{\phi} + 2\deg\rb{\psi} $$
also holds. Otherwise let
$$ \phi\rb{x, y} = \rb{w_1, z_1}, \qquad \psi\rb{x, y} = \rb{w_2, z_2}, \qquad \rb{\phi + \psi}\rb{x, y} = \rb{w_3, z_3}, \qquad \rb{\phi - \psi}\rb{x, y} = \rb{w_4, z_4}, $$
for each $ w_i = r_i\rb{x} / s_i\rb{x} $ and $ z_i = u_i\rb{x}y / v_i\rb{x} $ for some homogeneous polynomials $ r_i, s_i, u_i, v_i \in F\sb{x} $ such that each $ \gcd\rb{r_i, s_i} = \gcd\rb{u_i, v_i} = 1 $ and
$$ \deg\rb{\phi} = \deg\rb{r_1} = \deg\rb{s_1}, \qquad \deg\rb{\psi} = \deg\rb{r_2} = \deg\rb{s_2}, $$
$$ \deg\rb{\phi + \psi} = \deg\rb{r_3} = \deg\rb{s_3}, \qquad \deg\rb{\phi - \psi} = \deg\rb{r_4} = \deg\rb{s_4}. $$
By the addition formula,
$$ w_3 = \dfrac{\rb{A + w_1w_2}\rb{w_1 + w_2} + 2\rb{B - z_1z_2}}{\rb{w_1 - w_2}^2}, \qquad w_4 = \dfrac{\rb{A + w_1w_2}\rb{w_1 + w_2} + 2\rb{B + z_1z_2}}{\rb{w_1 - w_2}^2}. $$
Adding these two equations gives $ \rb{w_3 + w_4}\rb{w_1 - w_2}^2 = 2\rb{A + w_1w_2}\rb{w_1 + w_2} + 4B $, so
$$ \dfrac{r_3s_4 + r_4s_3}{s_3s_4} = \dfrac{2\rb{As_1s_2 + r_1r_2}\rb{r_1s_2 + r_2s_1} + 4Bs_1^2s_2^2}{\rb{r_1s_2 - r_2s_1}^2}. $$
Hence let
$$ R = r_3s_4 + r_4s_3, \qquad S = s_3s_4, \qquad U = 2\rb{As_1s_2 + r_1r_2}\rb{r_1s_2 + r_2s_1} + 4Bs_1^2s_2^2, \qquad V = \rb{r_1s_2 - r_2s_1}^2. $$
Similarly multiplying these two equations gives
\begin{align*}
w_3w_4\rb{w_1 - w_2}^4
& = \rb{A + w_1w_2}^2\rb{w_1 + w_2}^2 + 4B\rb{A + w_1w_2}\rb{w_1 + w_2} + 4B^2 - 4z_1^2z_2^2 \\
& = \rb{A^2 + 2Aw_1w_2 + w_1^2w_2^2}\rb{w_1^2 + 2w_1w_2 + w_2^2} + 4B\rb{Aw_1 + Aw_2 + w_1^2w_2 + w_1w_2^2} \\
& \qquad + 4B^2 - 4\rb{w_1^3 + Aw_1 + B}\rb{w_2^3 + Aw_2 + B} \\
& = A^2w_1^2 - 2A^2w_1w_2 + A^2w_2^2 - 4Bw_1^3 + 4Bw_1^2w_2 + 4Bw_1w_2^2 - 4Bw_2^3 \\
& \qquad - 2Aw_1^3w_2 + 4Aw_1^2w_2^2 - 2Aw_1w_2^3 + w_1^4w_2^2 - 2w_1^3w_2^3 + w_1^2w_2^4 \\
& = A^2\rb{w_1 - w_2}^2 - 4Bw_1^2\rb{w_1 - w_2} + 4Bw_2^2\rb{w_1 - w_2} \\
& \qquad - 2Aw_1w_2\rb{w_1 - w_2}^2 + w_1^2w_2^2\rb{w_1 - w_2}^2 \\
& = \rb{A^2 - 2Aw_1w_2 + w_1^2w_2^2}\rb{w_1 - w_2}^2 - 4B\rb{w_1^2 - w_2^2}\rb{w_1 - w_2} \\
& = \rb{A - w_1w_2}^2\rb{w_1 - w_2}^2 - 4B\rb{w_1 + w_2}\rb{w_1 - w_2}^2,
\end{align*}
such that $ w_3w_4\rb{w_1 - w_2}^2 = \rb{A - w_1w_2}^2 - 4B\rb{w_1 + w_2} $, so
$$ \dfrac{r_3r_4}{s_3s_4} = \dfrac{\rb{As_1s_2 - r_1r_2}^2 - 4B\rb{r_1s_2 + r_2s_1}s_1s_2}{\rb{r_1s_2 - r_2s_1}^2}. $$
Hence also let
$$ T = r_3r_4, \qquad W = \rb{As_1s_2 - r_1r_2}^2 - 4B\rb{r_1s_2 + r_2s_1}s_1s_2, $$
such that
$$ \deg\rb{R} = \deg\rb{S} = \deg\rb{T} = \deg\rb{\phi + \psi} + \deg\rb{\phi - \psi}, $$
$$ \deg\rb{U} = \deg\rb{V} = \deg\rb{W} = 2\deg\rb{\phi} + 2\deg\rb{\psi}. $$
Suppose for a contradiction that $ \gcd\rb{R, S, T} \ne 1 $, so $ g \mid \gcd\rb{R, S, T} $ for some irreducible homogeneous polynomial $ g \in F\sb{x} $. If $ g \mid r_3 $, then $ g \nmid s_3 $, so $ g \mid s_4 $ and $ g \nmid r_4 $ gives $ g \nmid r_3s_4 + r_4s_3 = R $. Otherwise $ g \nmid r_3 $, then $ g \mid r_4 $, so $ g \nmid s_4 $ and $ g \mid s_3 $ also gives $ g \nmid r_3s_4 + r_4s_3 = R $, which is a contradiction. Hence $ \gcd\rb{R, S, T} = 1 $. Now let $ g' = \gcd\rb{U, V, W} $, so
$$ U = g'U', \qquad V = g'V', \qquad W = g'W', \qquad U', V', W' \in F\sb{x}, \qquad \gcd\rb{U', V', W'} = 1, $$
such that
$$ \deg\rb{U'} = \deg\rb{V'} = \deg\rb{W'} = \deg\rb{U} - \deg\rb{g'}. $$
Combining the two equations from adding and multiplying gives a ratio
$$ \sb{R, S, T} = \sb{\dfrac{R}{S}, 1, \dfrac{T}{S}} = \sb{\dfrac{U}{V}, 1, \dfrac{W}{V}} = \sb{U, V, W} = \sb{g'U', g'V', g'W'} = \sb{U', V', W'}, $$
such that $ R = U' $, $ T = W' $, and $ S = V' $. Hence
$$ \deg\rb{\phi + \psi} + \deg\rb{\phi - \psi} = \deg\rb{R} = \deg\rb{U'} = \deg\rb{U} - \deg\rb{g'} \le \deg\rb{U} = 2\deg\rb{\phi} + 2\deg\rb{\psi}. $$
Now replacing $ \rb{\phi, \psi} \mapsto \rb{\phi + \psi, \psi + \phi} $ gives the converse
\begin{align*}
2\deg\rb{\phi + \psi} + 2\deg\rb{\phi - \psi}
& \ge \deg\rb{\phi + \psi + \phi - \psi} + \deg\rb{\phi + \psi - \phi + \psi} \\
& = \deg\rb{\sb{2}}\deg\rb{\phi} + \deg\rb{\sb{2}}\deg\rb{\psi} \\
& = 4\deg\rb{\phi} + 4\deg\rb{\psi},
\end{align*}
Thus $ \deg\rb{\phi + \psi} + \deg\rb{\phi - \psi} = 2\deg\rb{\phi} + 2\deg\rb{\psi} $.
\end{proof}

An application of the parallelogram law would be a simple inductive proof of the following lemma, which has many other proofs.

\begin{lemma}
Let $ n \in \Z $. Then $ \deg\rb{\sb{n}} = n^2 $.
\end{lemma}

\begin{proof}
$ \deg\rb{\sb{0}} = 0 $ and $ \deg\rb{\sb{1}} = 1 $. Assume that $ \deg\rb{\sb{m}} = m^2 $ for any $ m \le n $ for some $ n \in \Z_{\ge 0} $. Then
$$ \deg\rb{\sb{n + 1}} = 2\deg\rb{\sb{n}} + 2\deg\rb{\sb{1}} - \deg\rb{\sb{n - 1}} = 2n^2 + 2 - \rb{n - 1}^2 = n^2 + 2n + 1 = \rb{n + 1}^2. $$
Hence $ \deg\rb{\sb{n}} = n^2 $ for any $ n \in \Z_{\ge 0} $ by induction. Similarly $ \deg\rb{\sb{-n}} = \deg\rb{\sb{-1}}\deg\rb{\sb{n}} = \deg\rb{\sb{n}} $ for any $ n \in \Z_{\ge 0} $. Thus $ \deg\rb{\sb{n}} = n^2 $ for any $ n \in \Z $.
\end{proof}

In fact, the above lemma can be generalised for arbitrary isogenies, as follows.

\begin{lemma}
Let $ n, m \in \Z $. Then $ \deg\rb{n\phi + m\psi} = n^2\deg\rb{\phi} + 2nm\ab{\phi, \psi} + m^2\deg\rb{\psi} $.
\end{lemma}

\begin{proof}
Since $ \ab{\phi, \phi} = \tfrac{1}{2}\rb{\deg\rb{2\phi} - 2\deg\rb{\phi}} = 2\deg\rb{\phi} - \deg\rb{\phi} = \deg\rb{\phi} $, it holds that
$$ \deg\rb{n\phi + m\psi} = \ab{n\phi + m\psi, n\phi + m\psi} = n^2\deg\rb{\phi} + 2nm\ab{\phi, \psi} + m^2\deg\rb{\psi}. $$
\end{proof}

The initial aim can then be proven in the following lemma.

\begin{lemma}
$ \deg : Hom\rb{E, E'} \to \Z_{\ge 0} $ is a positive definite quadratic form.
\end{lemma}

\begin{proof}
$ \deg\rb{-\phi} = \deg\rb{\sb{-1}}\deg\rb{\phi} = \deg\rb{\phi} $. Let $ \chi : E \to E' $ be an isogeny. Since
\begin{align*}
\deg\rb{\phi + \psi + \chi}
& = 2\deg\rb{\phi + \psi} + 2\deg\rb{\chi} - \deg\rb{\phi + \psi - \chi} \\
& = 2\deg\rb{\phi + \psi} + 2\deg\rb{\chi} - 2\deg\rb{\phi - \chi} - 2\deg\rb{\psi} + \deg\rb{\phi - \psi - \chi} \\
& = 2\deg\rb{\phi + \psi} + 2\deg\rb{\chi} - 2\deg\rb{\phi - \chi} - 2\deg\rb{\psi} \\
& \qquad + 2\deg\rb{\psi + \chi} + 2\deg\rb{\phi} - \deg\rb{\phi + \psi + \chi},
\end{align*}
it holds that $ \deg\rb{\phi + \psi + \chi} =  \deg\rb{\phi + \psi} + \deg\rb{\chi} - \deg\rb{\phi - \chi} - \deg\rb{\psi} + \deg\rb{\psi + \chi} + \deg\rb{\phi} $.
Hence
\begin{align*}
\ab{\phi + \psi, \chi}
& = \tfrac{1}{2}\rb{\deg\rb{\phi + \psi + \chi} - \deg\rb{\phi + \psi} - \deg\rb{\chi}} \\
& = \tfrac{1}{2}\rb{-\deg\rb{\phi - \chi} - \deg\rb{\psi} + \deg\rb{\psi + \chi} + \deg\rb{\phi}} \\
& = \tfrac{1}{2}\rb{-2\deg\rb{\phi} - 2\deg\rb{\chi} + \deg\rb{\phi + \chi} - \deg\rb{\psi} + \deg\rb{\psi + \chi} + \deg\rb{\phi}} \\
& = \tfrac{1}{2}\rb{\deg\rb{\phi + \chi} - \deg\rb{\phi} - \deg\rb{\chi} + \deg\rb{\psi + \chi} - \deg\rb{\psi} - \deg\rb{\chi}}
= \ab{\phi, \chi} + \ab{\psi, \chi}.
\end{align*}
Similarly $ \ab{\phi, \psi + \chi} = \ab{\phi, \psi} + \ab{\phi, \chi} $ by symmetry. Thus since $ \deg\rb{\phi} > 0 $ for any $ \phi \ne 0 $ and $ \deg\rb{0} = 0 $, it holds that $ \deg $ is a positive definite quadratic form.
\end{proof}

Replacing the degree map with any map satisfying the parallelogram law also gives a quadratic form. The following variant of the Cauchy-Schwarz inequality generalises to quadratic forms similarly.

\begin{theorem}[Cauchy-Schwarz]
$ \ab{\phi, \psi}^2 \le \deg\rb{\phi}\deg\rb{\psi} $.
\end{theorem}

\begin{proof}
Let $ n = -\ab{\phi, \psi} $ and $ m = \deg\rb{\phi} $. Then
$$ 0 \le \ab{\phi, \psi}^2\deg\rb{\phi} - 2\ab{\phi, \psi}^2\deg\rb{\phi} + \deg\rb{\phi}^2\deg\rb{\psi} = \deg\rb{\phi}\rb{\deg\rb{\phi}\deg\rb{\psi} - \ab{\phi, \psi}^2}. $$
Thus $ \ab{\phi, \psi}^2 \le \deg\rb{\phi}\deg\rb{\psi} $.
\end{proof}

Hasse's theorem can finally be proven.

\begin{proof}[Proof of Theorem \ref{thm:hasse}]
A point $ P = \sb{a, b, c} \in E\rb{F} $ iff $ a^q = a $, $ b^q = b $, and $ c^q = c $ by Fermat's little theorem, or $ \sb{a^q, b^q, c^q} = \sb{a, b, c} $. This holds iff the $ q $-th power Frobenius endomorphism $ Fr_q : E \to E $ is such that $ Fr_q\rb{P} = P $, or $ P \in Ker\rb{Fr_q - \sb{1}} $. Hence $ E\rb{F} = Ker\rb{Fr_q - \sb{1}} $. Since $ \sb{1} $ is separable and $ Fr_q $ is inseparable with degree $ \deg\rb{Fr_q} = \deg_i\rb{Fr_q} = q $, it holds that $ Fr_q - \sb{1} $ is separable, so
$$ Ker\rb{Fr_q - \sb{1}} = \deg_s\rb{Fr_q - \sb{1}} = \deg\rb{Fr_q - \sb{1}} = \deg\rb{Fr_q} - 2\ab{Fr_q, \sb{1}} + \deg\rb{\sb{1}} = q - 2\ab{Fr_q, \sb{1}} + 1. $$
Then let $ t = 2\ab{Fr_q, \sb{1}} $, so Cauchy-Schwarz gives $ t^2 = 4\ab{Fr_q, 1}^2 \le 4\deg\rb{Fr_q}\deg\rb{\sb{1}} = 4q $. Thus $ \abs{E\rb{F}} = q - t + 1 $ for $ \abs{t} \le 2\sqrt{q} $.
\end{proof}

\pagebreak

\subsection{Riemann hypothesis}

Hasse's theorem, or more accurately the Hasse-Weil theorem, is also sometimes referred to as the \emph{Riemann hypothesis} for smooth projective algebraic curves over finite fields. It has an alternative formulation that makes it analogous to the famous classical Riemann hypothesis, an open problem in number theory deemed worthy of being called one of the Millennium Prize Problems by the Clay Mathematics Institute with a monetary prize of a million dollars. The conjecture revolves around zeroes of the following complex function.

\begin{definition}[Riemann zeta function]
The Riemann zeta function $ \zeta : \C \to \C $ is defined for any $ \Re\rb{s} > 1 $ as the power series $ \zeta\rb{s} = \sum_{n = 1}^\infty n^{-s} $, and extended to $ \C $ by analytic continuation.
\end{definition}

Riemann himself proved the analytic continuation, as well as a functional equation satisfied by the Riemann zeta function given by
$$ \xi\rb{s} = \xi\rb{1 - s}, \qquad \xi\rb{s} = \tfrac{1}{2}\sqrt{\pi}^{-s}s\rb{s - 1}\Gamma\rb{\tfrac{1}{2}s}\zeta\rb{s}. $$
The conjecture is then formulated in \cite{riemann} as follows.

\begin{conjecture}[Riemann]
Let $ s \in \C $ be such that $ s \notin -2\Z_{> 0} $. If $ \zeta\rb{s} = 0 $, then $ \Re\rb{s} = \tfrac{1}{2} $.
\end{conjecture}

The connection to this still open problem can be seen via a powerful theorem known as the \emph{Weil conjectures}, proposed by Weil and proven in steps later by himself, Dwork, Deligne, Grothendieck, and many others. The so-called conjectures also involve a related zeta function encoding the number of rational points of a smooth projective algebraic varieties variety, which is defined as follows.

\begin{definition}[Local zeta function]
The \textbf{local zeta function} of a projective algebraic variety $ V $ over $ F $ is the power series
$$ Z_V\rb{t} = \exp\rb{\sum_{n = 1}^\infty \abs{V\rb{F_n}}\dfrac{t^n}{n}}, \qquad \abs{V\rb{F_n}} = \dfrac{1}{\rb{n - 1}!}\val{\dfrac{d^n}{dt^n}\ln\rb{Z_V\rb{t}}}_{t = 0}. $$
where $ F_n = \F_{q^n} $.
\end{definition}

The following example is a trivial application the local zeta function.

\begin{example}
Let $ V\rb{0} $ be the trivial projective algebraic variety over $ F $. Then $ \abs{V\rb{F_n}} = 1 $ for any $ n \in \Z_{> 0} $, so
$$ Z_V\rb{t} = \exp\rb{\sum_{n = 1}^\infty \dfrac{t^n}{n}} = \exp\rb{\ln\rb{\dfrac{1}{1 - t}}} = \dfrac{1}{1 - t}. $$
\end{example}

His three conjectures are then formulated as follows, which are easily satisfied by the above example.

\begin{theorem}[Weil conjectures]
\label{thm:weil}
Let $ V $ be a smooth projective algebraic variety over $ F $ of dimension $ n \in \Z_{\ge 0} $.
\begin{itemize}
\item Rationality. $ Z_V\rb{t} = P\rb{t} / \rb{1 - t}\rb{1 - q^nt} \in \Q\sb{t} $, where
$$ P\rb{t} = \prod_{i = 1}^{2n - 1} P_i\rb{t}^{\rb{-1}^{i + 1}}, \qquad P_i \in \Z\sb{t}. $$
\item Functional equation. Let $ \epsilon \in \Z $ be the \emph{Euler characteristic} of $ V $. Then
$$ Z_V\rb{\dfrac{1}{q^nt}} = \pm \sqrt{q}^{n\epsilon} t^\epsilon Z_V\rb{t}. $$
\item Riemann hypothesis. Let $ S_i = \cb{\alpha \in \C \mid \abs{\alpha} = \sqrt{q}^i} $ and $ P_i $ be as per above. Then each
$$ P_i\rb{t} = \prod_{\alpha \in S_i'} \rb{1 - \alpha t}, $$
over some $ S_i' \subseteq S_i $ such that $ P_i \in \Z\rb{t} $.
\end{itemize}
\end{theorem}

\begin{proof}
Omitted, see \cite{weil1}, \cite{weil2}, and \cite{weil3}.
\end{proof}

\pagebreak

\begin{remark}
There is a fourth Weil conjecture on \emph{Betti numbers} that states if $ V $ is a \emph{reduction modulo $ q $} of a smooth projective algebraic variety $ W $ over a number field, then $ \deg\rb{P_i} $ is the $ i^{th} $ topological Betti number of $ W $ for each $ P_i $.
\end{remark}

In the special case where $ V $ is a smooth projective algebraic curve $ C $ of genus $ g_C $, its dimension is $ n = 1 $ and its Euler characteristic is $ \epsilon = 2 - 2g_C $, which greatly simplifies Theorem \ref{thm:weil}. The following is a formulation for the elliptic curve $ E $ of genus one.

\begin{theorem}[Weil conjectures for elliptic curves]
\label{thm:weilcurve}
$ Z_E $ satisfies the following properties.
\begin{itemize}
\item Rationality. $ Z_E\rb{t} = P\rb{t} / \rb{1 - t}\rb{1 - qt} \in \Q\rb{t} $ for some $ P \in \Z\rb{t} $.
\item Functional equation. $ Z_E\rb{1 / qt} = \pm Z_E\rb{t} $.
\item Riemann hypothesis. $ P\rb{t} = \prod_\alpha \rb{1 - \alpha t} $ for some $ \alpha \in \C $ such that $ \abs{\alpha} = \sqrt{q} $ and $ P \in \Z\rb{t} $.
\end{itemize}
\end{theorem}

As full proofs of the Weil conjectures, even just for elliptic curves, requires further prerequisites on algebraic geometry, particularly on the \emph{Tate module} and the \emph{Weil pairing}, only the final part of the proof is given, of which the following lemma will be assumed.

\begin{lemma}
$ \abs{E\rb{F_n}} = 1 + q^n - \alpha^n - \overline{\alpha}^n $ for some $ \alpha \in \C $ such that $ \abs{\alpha} = \sqrt{q} $.
\end{lemma}

\begin{proof}
Omitted, see V.2.3 in \cite{gtm}.
\end{proof}

Letting $ n = 1 $ in the above lemma for Theorem \ref{thm:weilcurve} gives $ \abs{\abs{E\rb{F}} - 1 - q} = \abs{-\alpha - \overline{\alpha}} \le 2\abs{\alpha} = 2\sqrt{q} $, which proves Hasse's theorem once again. The final part of the proof is as follows.

\begin{proof}[Proof of Theorem \ref{thm:weilcurve}]
The above lemma on the zeta function gives $ \alpha \in \C $ such that $ \abs{\alpha} = \sqrt{q} $, and
$$ \ln\rb{Z_E\rb{t}} = \sum_{n = 1}^\infty \rb{1 + q^n - \alpha^n - \overline{\alpha}^n}\dfrac{t^n}{n} = -\ln\rb{1 - t} - \ln\rb{1 - qt} + \ln\rb{1 - \alpha t} + \ln\rb{1 - \overline{\alpha} t}. $$
Thus
$$ Z_E\rb{t} = \dfrac{\rb{1 - \alpha t}\rb{1 - \overline{\alpha}t}}{\rb{1 - t}\rb{1 - qt}}, \qquad \abs{\alpha} = \sqrt{q}, $$
which satisfies rationality and the Riemann hypothesis, and gives the functional equation
$$ Z_E\rb{\dfrac{1}{qt}} = \dfrac{\rb{1 - \dfrac{\alpha}{qt}}\rb{1 - \dfrac{\overline{\alpha}}{qt}}}{\rb{1 - \dfrac{1}{qt}}\rb{1 - \dfrac{1}{t}}} = \dfrac{qt^2 - \rb{\alpha + \overline{\alpha}}t + \dfrac{\alpha\overline{\alpha}}{q}}{\rb{qt - 1}\rb{t - 1}} = \dfrac{\rb{1 - \alpha t}\rb{1 - \overline{\alpha}t}}{\rb{1 - t}\rb{1 - qt}} = Z_E\rb{t}. $$
\end{proof}

By the above proof, the connection to the classical Riemann hypothesis can then be seen as follows. An analogue of the Riemann zeta function can be defined for elliptic curves over $ F $ as $ \zeta_E\rb{s} = Z_E\rb{q^{-s}} $. It then satisfies a similar functional equation,
$$ \zeta_E\rb{s} = Z_E\rb{q^{-s}} = Z_E\rb{q^{s - 1}} = \zeta_E\rb{1 - s}. $$
If $ \zeta_E\rb{s} = 0 $, Theorem \ref{thm:weilcurve} also gives
$$ \dfrac{\rb{1 - \alpha q^{-s}}\rb{1 - \overline{\alpha}q^{-s}}}{\rb{1 - q^{-s}}\rb{1 - q^{1 - s}}} = 0, \qquad \abs{\alpha} = \sqrt{q}. $$
Hence $ 1 = \alpha q^{-s} $ or $ 1 = \overline{\alpha} q^{-s} $, so $ q^{\Re\rb{s}} = \abs{q^s} = \sqrt{q} $. Thus $ \Re\rb{s} = \tfrac{1}{2} $.

\begin{remark}
The Weil conjectures is a generalisation of Riemann hypothesis, which those for elliptic curves is in turn a special case of. In general, there are many zeta functions analogous to the Riemann zeta function. One such family of zeta functions is for a \emph{finitely generated algebra} $ R $ over $ \Z $, defined as
$$ \zeta_R\rb{s} = \prod_M \dfrac{1}{1 - \abs{R / M}^{-s}}, $$
over all maximal ideals $ M \subset R $.
\end{remark}

\pagebreak

\subsection{Schoof's algorithm}

In light of Hasse's theorem, there were improved algorithms to compute $ E\rb{F} $ similar to the naive approach described in a previous subsection. Lagrange's theorem gives that $ ord\rb{P} \mid \abs{E\rb{F}} $ for any point $ P \in E\rb{F} $, the latter of which is bounded by Hasse's theorem. After obtaining a random point $ P \in E\rb{F} $ by inspection or otherwise, simply try all values of $ n \in \Z $ such that $ q - 2\sqrt{q} + 1 \le n \le q + 2\sqrt{q} + 1 $ to catch whenever $ nP = \mathcal{O} $. If this $ n $ is unique, the point $ P $ is a generator of $ E\rb{F} $ and hence $ \abs{E\rb{F}} = ord\rb{P} = n $. Otherwise obtain a different random point $ P \in E\rb{F} $ and repeat. This process can be illustrated with a prior example.

\begin{example}
Let $ E : y^2 = x^3 + x + 1 $ be an elliptic curve over $ \F_5 $ and $ P = \rb{0, 1} \in E\rb{\F_5} $ be a point. Hasse's theorem gives $ \abs{E\rb{\F_5}} = 5 - t + 1 $ for some $ \abs{t} \le 2\sqrt{5} $, so $ \abs{E\rb{\F_5}} \in \cb{2, \dots, 10} $. Then the addition formula gives only $ 9P = \mathcal{O} $, so $ \abs{E\rb{\F_5}} = 9 $.
\end{example}

There is then room for algorithms like \emph{baby-step giant-step} that trades a space complexity of $ O\rb{\sqrt{q}} $ for a time complexity of also $ O\rb{\sqrt{q}} $, speeding up the computation further. However, discussions here will be on a different algorithm for computing $ \abs{E\rb{F}} $, which also builds upon Hasse's theorem. A high-level description of the \emph{deterministic polynomial time} algorithm is as follows.

\begin{algorithm}[Schoof's algorithm]
Input: an elliptic curve $ E $ over $ \F_q $. Output: $ \abs{E\rb{\F_q}} $.
\begin{enumerate}
\item Generate a set $ S $ of distinct primes excluding $ p $ with product $ N \in \Z_{> 0} $, such that $ N > 4\sqrt{q} $.
\item Compute $ t \mod n $ for each $ n \in S $.
\item Obtain $ t \mod N $ from each $ t \mod n $.
\item Reduce $ t $ into a value between $ -2\sqrt{q} $ and $ 2\sqrt{q} $.
\item Calculate $ \abs{E\rb{F}} = q - t + 1 $.
\end{enumerate}
\end{algorithm}

The proof of this algorithm will be done in reverse. The first and last two steps will be made clear later, but several results will be proven for the second and third. In particular, the former generates a system of prime congruences for the latter, which in turn employs a classical theorem in number theory as follows.

\begin{theorem}[Chinese remainder]
Let $ n_1, \dots, n_k \in \Z_{> 1} $ be pairwise coprime with product $ N \in \Z_{> 0} $, and let $ t_1, \dots, t_k \in \Z $. Then there is a unique $ t \in \Z_{\ge 0} $ such that $ t < N $ and each $ t \equiv t_i \mod n_i $.
\end{theorem}

\begin{proof}
Let $ k = 2 $. B\'ezout's identity gives $ m_1n_1 + m_2n_2 = 1 $ for some $ m_i \in \Z $. Let $ t' = t_2m_1n_1 + t_1m_2n_2 $, so
$$ t' = \rb{t_2 - t_1}m_1n_1 + t_1\rb{m_1n_1 + m_2n_2} \equiv t_1 \mod n_1, $$
$$ t' = t_2\rb{m_1n_1 + m_2n_2} - \rb{t_2 - t_1}m_2n_2 \equiv t_2 \mod n_2. $$
If $ t'' \in \Z $ is such that $ t'' \equiv t_1 \mod n_1 $ and $ t'' \equiv t_2 \mod n_2 $, then $ t' \equiv t'' \mod n_1 $ and $ t' \equiv t'' \mod n_2 $, so $ n_1 \mid t' - t'' $ and $ n_2 \mid t' - t'' $. Then $ N = n_1n_2 \mid t' - t'' $, so $ t' \equiv t'' \mod N $ and $ t' $ is unique up to congruences. Hence division gives a unique $ t \in \Z_{\ge 0} $ such that $ t < N $ and $ t \equiv t' \mod N $. Now let $ k \in \Z_{\ge 2} $ with product $ N_k \in \Z_{> 0} $ and assume that there is a unique $ t' \in \Z_{\ge 0} $ such that $ t' < N_k $ and each $ t' \equiv t_i \mod n_i $. Since $ N_k $ and $ n_{k + 1} $ are coprime, the case $ k = 2 $ gives a unique $ t \in \Z_{\ge 0} $ such that $ t < N_kn_{k + 1} $, and $ t \equiv t' \mod N_k $ and $ t \equiv t_{k + 1} \mod n_{k + 1} $. Thus the unique $ t \in \Z_{\ge 0} $ holds by induction.
\end{proof}

\begin{remark}
The Chinese remainder theorem can be generalised to ideals $ I_i $ of arbitrary commutative unital rings $ R $, replacing the coprime condition with $ I_n + I_m = R $ for all $ n, m \in \Z $ and modulo with respect to $ I_i $.
\end{remark}

A general process for computing this unique $ t \in \Z_{\ge 0} $ can be inferred directly from the proof of the Chinese remainder theorem, using the extended Euclidean algorithm for B\'ezout's identity, illustrated as follows.

\begin{example}
Let
$$ t \equiv 1 \mod 2, \qquad t \equiv 2 \mod 3, \qquad t \equiv 3 \mod 5 $$
be a system of congruences for $ t \in \Z_{\ge 0} $. B\'ezout's identity gives $ \rb{-1}\rb{2} + \rb{1}\rb{3} = 1 $, so let $ t' = 2\rb{-1}\rb{2} + 1\rb{1}\rb{3} = -1 $ be such that $ t' \equiv 1 \mod 2 $ and $ t' \equiv 2 \mod 3 $. Hence division gives $ t'' = 1\rb{6} + \rb{-1} = 5 < 6 $ such that $ t'' \equiv t' \mod 6 $. Similarly B\'ezout's identity gives $ \rb{1}\rb{6} + \rb{-1}\rb{5} = 1 $, so let $ t''' = 3\rb{1}\rb{6} + 5\rb{-1}\rb{5} = -7 $ be such that $ t''' \equiv 5 \mod 6 $ and $ t''' \equiv 3 \mod 5 $. Thus division gives $ t = 1\rb{30} + \rb{-7} = 23 < 30 $ such that $ t \equiv t''' \mod 30 $ similarly.
\end{example}

For the rest of this section, let $ S $ be as in the first step of Schoof's algorithm and $ n \in S $ be a prime. Now invoking the Chinese remainder theorem on the system of congruences $ t' \equiv t \mod n $ generated by the second step gives a unique $ t'' \in \Z_{\ge 0} $ such that $ t'' < N $ and $ t'' \equiv t' \mod N $, as in the third step. The fourth step then ensures this $ t'' $ falls within the required bound using careful Euclidean division to give the trace $ t \in \Z $, of which the first step has made possible by forcing $ S $ to span the entire interval over which it could lie in. The fifth step is merely a simple application of Hasse's theorem. It only remains to understand the second step of Schoof's algorithm. This uses the properties of a general system of polynomials allowing for recursive operations, given in the following definition.

\begin{definition}[Division polynomial]
The \textbf{$ n $-th division polynomial} $ \psi_n \in F\sb{x, y} $ is defined for $ n \in \Z $ by
\begin{align*}
\psi_0\rb{x, y} & = 0, \\
\psi_1\rb{x, y} & = 1, \\
\psi_2\rb{x, y} & = 2y, \\
\psi_3\rb{x, y} & = 3x^4 + 6Ax^2 + 12Bx - A^2, \\
\psi_4\rb{x, y} & = 4y\rb{x^6 + 5Ax^4 + 20Bx^3 - 5A^2x^2 - 4ABx - A^3 - 8B^2},
\end{align*}
recursively defined for $ n > 4 $ by
\begin{align*}
\psi_{2m} & = \tfrac{1}{2y}\psi_m\rb{\psi_{m + 2}\psi_{m - 1}^2 - \psi_{m - 2}\psi_{m + 1}^2}, \\
\psi_{2m + 1} & = \psi_{m + 2}\psi_m^3 - \psi_{m - 1}\psi_{m + 1}^3,
\end{align*}
and for $ n < 0 $ by $ \psi_{-n} = -\psi_n $, with associated polynomials $ \phi_n, \omega_n \in F\sb{x, y} $ defined for $ n \in \Z_{\ge 0} $ by
\begin{align*}
\phi_n & = x\psi_n^2 - \psi_{n + 1}\psi_{n - 1}, \\
\omega_n & = \tfrac{1}{4y}\rb{\psi_{n + 2}\psi_{n - 1}^2 - \psi_{n - 2}\psi_{n + 1}^2}.
\end{align*}
\end{definition}

It holds that $ \phi_{-n} = -\phi_n $ and $ \omega_{-n} = -\omega_n $, and $ \psi_{2m} = 2\omega_n\psi_n $. The following lemma allows certain division polynomials to be written solely in terms of $ x $.

\begin{lemma}
If $ n \in \Z $ is even, then
$$ \psi_n \in 2y\Z\sb{x, A, B}, \qquad \phi_n \in \Z\sb{x, A, B}, \qquad \omega_n \in \Z\sb{x, A, B}, $$
otherwise $ n \in \Z $ is odd, then
$$ \psi_n \in \Z\sb{x, A, B}, \qquad \phi_n \in \Z\sb{x, A, B}, \qquad \omega_n \in y\Z\sb{x, A, B}. $$
\end{lemma}

\begin{proof}
Let $ Z = \Z\sb{x, A, B} $, then $ \psi_0, \psi_2, \psi_4 \in 2yZ $ and $ \psi_1, \psi_3 \in Z $. Assume that $ \psi_n \in 2yZ $ for any even $ n \in \Z_{\ge 0} $ and $ \psi_n \in Z $ for any odd $ n \in \Z_{\ge 0} $ such that $ n < 2m $. If $ m $ is even, then
$$ \psi_m, \psi_{m + 2}, \psi_{m - 2} \in 2yZ, \qquad \psi_{m - 1}, \psi_{m + 1} \in Z \qquad \implies \qquad \psi_{2m} \in 2yZ, \qquad \psi_{2m + 1} \in Z. $$
Otherwise $ m $ is odd, then similarly
$$ \psi_{m - 1}, \psi_{m + 1} \in 2yZ, \qquad \psi_m, \psi_{m + 2}, \psi_{m - 2} \in Z \qquad \implies \qquad \psi_{2m} \in 2yZ, \qquad \psi_{2m + 1} \in Z. $$
Hence $ \psi_n \in 2yZ $ for any even $ n \in \Z $ and $ \psi_n \in Z $ for any odd $ n \in \Z $. If $ n $ is even, then
$$ \psi_n^2 \in y^2Z = Z, \qquad \psi_{n + 1}\psi_{n - 1} \in Z \qquad \implies \qquad \phi_n \in Z. $$
Otherwise $ n $ is odd, then similarly
$$ \psi_n^2 \in Z, \qquad \psi_{n + 1}\psi_{n + 1} \in 4y^2Z = Z \qquad \implies \qquad \phi_n \in Z. $$
Now if $ n $ is even, then also
$$ \psi_{n + 2}, \psi_{n - 2} \in 2yZ, \qquad \psi_{n - 1}, \psi_{n + 1} \in Z \qquad \implies \qquad \omega_n \in Z. $$
Otherwise $ n $ is odd, then similarly also
$$ \psi_{n - 1}, \psi_{n + 1} \in 2yZ, \qquad \psi_{n + 2}, \psi_{n - 2} \in Z \qquad \implies \qquad \omega_n \in yZ. $$
\end{proof}

The division polynomials $ \phi_n\rb{x, y} $, $ \psi_n\rb{x, y}^2 $, and $ \omega_n\rb{x, y}^2 $ can then be written as $ \phi_n\rb{x} $, $ \psi_n\rb{x}^2 $, and $ \omega_n\rb{x}^2 $ respectively as an abuse of notation without ambiguity. Now the familiar expression for $ \psi_4 $ is that of the multiplication by two map, generalised as follows.

\begin{proposition}
Let $ n \in \Z $. Then
$$ \sb{n}\rb{x, y} = \rb{x - \dfrac{\psi_{n + 1}\rb{x, y}\psi_{n - 1}\rb{x, y}}{\psi_n\rb{x}^2}, \dfrac{\psi_{2n}\rb{x, y}}{2\psi_n\rb{x, y}^4}} = \rb{\dfrac{\phi_n\rb{x}}{\psi_n\rb{x}^2}, \dfrac{\omega_n\rb{x, y}}{\psi_n\rb{x, y}^3}}. $$
\end{proposition}

The proof of this proposition is through induction on $ n \in \Z_{\ge 0} $ with base cases $ n \in \cb{0, \dots, 4} $, while $ n \in \Z_{< 0} $ follows directly from the above observation. While it is completely elementary through the group law explicit formulae, it is extremely tedious and computational and hence are omitted altogether.

\begin{proof}
Omitted, see III.E.3.7 in \cite{gtm}.
\end{proof}

\begin{remark}
This proof can be approached via other ways, such as through properties of the \emph{Weierstrass elliptic function} $ \wp $ in 9.33 of \cite{crypto}, which will not be discussed. The fact that $ \gcd\rb{\phi_n, \psi_n^2} = 1 $ and $ \deg\rb{\phi_n} = n^2 $ also lends itself to another proof that $ \deg\rb{\sb{n}} = n^2 $ for any $ n \in \Z $.
\end{remark}

Relating this back to the standard form of isogenies, it holds that $ \psi_n\rb{a, b} = 0 $ iff $ \sb{n}\rb{P} = \mathcal{O} $ for any point $ P = \rb{a, b} \in E $, which is the case whenever $ P \in E\sb{n} $. Group operations in $ End\rb{E\sb{n}} $ can be more easily done since the polynomials involved in the endomorphisms have bounded degrees in the \emph{coordinate ring} $ F\sb{x, y} / \ab{y^2 - x^3 - Ax - B, \psi_n} $, provided $ \psi_n $ is already precomputed. Now arithmetic in $ End\rb{E\sb{n}} $ is motivated by the second step of Schoof's algorithm, where all congruences are modulo $ n $ and endomorphisms are computed modulo $ \psi_n $. A \emph{characteristic} equation that all endomorphisms satisfy will be given in the following lemma.

\begin{lemma}
Let $ \phi \in End\rb{E} $ be an endomorphism, and let $ d = \deg\rb{\phi} $ and $ t = 2\ab{\phi, \sb{1}} $. Then $ \phi^2 - t\phi + \sb{d} = 0 $.
\end{lemma}

\begin{proof}
Let $ n \in \cb{-1, 1} $. Since $ \deg{\phi + \sb{n}} = \deg\rb{\phi} + 2n\ab{\phi, \sb{1}} + \deg\rb{\sb{n}} = d + nt + 1 $,
it holds that
\begin{align*}
\ab{\phi^2, \sb{1}}
& = -\tfrac{1}{2}\rb{\deg\rb{\phi^2 - \sb{1}} - \deg\rb{\phi^2} - \deg\rb{-\sb{1}}} \\
& = -\tfrac{1}{2}\rb{\deg\rb{\phi - \sb{1}}\deg\rb{\phi + \sb{1}} - \deg\rb{\phi}^2 - 1} \\
& = -\tfrac{1}{2}\rb{\rb{d + t + 1}\rb{d - t + 1} - d^2 - 1}
= -\tfrac{1}{2}\rb{2d - t^2}.
\end{align*}
Since also
$$ \ab{\phi^2, \phi} = \tfrac{1}{2}\rb{\deg\rb{\phi^2 + \phi} - \deg\rb{\phi^2} - \deg\rb{\phi}} = \tfrac{1}{2}\deg\rb{\phi}\rb{\deg\rb{\phi + \sb{1}} - \deg\rb{\phi} - \sb{1}} = d\ab{\phi, \sb{1}} = \tfrac{1}{2}dt, $$
it holds that
\begin{align*}
\deg\rb{\phi^2 - t\phi + \sb{d}}
& = \deg\rb{\phi^2} + \deg\rb{t\phi} + \deg\rb{\sb{d}} - 2\ab{\phi^2, t\phi} + 2\ab{\phi^2, \sb{d}} - 2\ab{t\phi, \sb{d}} \\
& = \deg\rb{\phi}^2 + t^2\deg\rb{\phi} + d^2 - 2t\ab{\phi^2, \phi} + 2d\ab{\phi^2, \sb{1}} - 2dt\ab{\phi, \sb{1}} \\
& = 2d^2 - 2t\ab{\phi^2, \phi} + 2d\ab{\phi^2, \sb{1}} \\
& = 2d^2 - 2\rb{\tfrac{1}{2}dt^2} + 2d\rb{-\tfrac{1}{2}\rb{2d - t^2}}
= 0.
\end{align*}
Thus $ \phi^2 - t\phi + \sb{d} = 0 $.
\end{proof}

In particular, the $ q $-th Frobenius endomorphism satisfies the characteristic equation, so it can be written as $ tFr_q = Fr_q^2 + \sb{q} $. While it is possible to compute the right hand side directly and try all values of $ t $ until one satisfies the characteristic equation, the polynomials involved in $ Fr_q $ and $ Fr_q^2 $ will have rapidly increasing degrees, which is highly impractical for huge $ q $. The second step handles exactly this by reducing the equation in $ End\rb{E} $ to one in $ End\rb{E\sb{n}} $ with affine points, as seen in the following lemma.

\begin{lemma}
Let $ P = \rb{a, b} \in E\sb{n} $ be a point. Then there are unique $ t_n \in \Z_{\ge 0} $ and $ q_n \in \Z_{> 0} $ such that $ t_n \equiv t, \ q_n \equiv q \mod n $ with $ \abs{t_n}, \abs{q_n} < n $, and
$$ t_n\rb{a^q, b^q} = \rb{a^{q^2}, b^{q^2}} + \rb{a_q, b_q}, \qquad q_nP = \rb{a_q, b_q} \in E\sb{n}. $$
\end{lemma}

\begin{proof}
Since $ Fr_q $ is injective, so is $ Fr_q^2 $, so $ Fr_q\rb{P} = \rb{a^q, b^q} $ and $ Fr_q^2\rb{P} = \rb{a^{q^2}, b^{q^2}} $. Hence
$$ t\rb{a^q, b^q} = \rb{a^{q^2}, b^{q^2}} + q\rb{a, b}. $$
Now Lagrange's theorem gives that $ P \in E\sb{n} $ iff $ ord\rb{P} = n $. Since $ q $ is prime and $ q \ne n $, it holds that $ \gcd\rb{q, n} = 1 $, so $ qP \ne \mathcal{O} $. Then division gives a unique $ q_n \in \Z_{> 0} $ such that $ q_n \equiv q \mod n $ with $ \abs{q_n} < n $. Hence $ q_nP = qP = \rb{a_q, b_q} $ for some point $ \rb{a_q, b_q} \in E\sb{n} $. Similarly division gives a unique $ t_n \in \Z_{\ge 0} $ such that $ t_n \equiv t \mod n $ and $ \abs{t_n} < n $. Since $ Fr_q $ has a trivial kernel and $ nFr_q\rb{P} = Fr_q\rb{nP} = Fr_q\rb{\mathcal{O}} = \mathcal{O} $, it holds that $ ord\rb{Fr_q\rb{P}} = n = ord\rb{P} $, so $ t_nFr_q\rb{P} = tFr_q\rb{P} $ similarly. Thus
$$ t_n\rb{a^q, b^q} = \rb{a^{q^2}, b^{q^2}} + \rb{a_q, b_q}. $$
\end{proof}

Hence it boils down to obtaining a suitable $ t_n \in \Z_{\ge 0} $ satisfying
$$ t_n\rb{x^q, y^q} = \rb{x^{q^2}, y^{q^2}} + q_n\rb{x, y}, $$
all of which can be computed as per usual, but in the coordinate ring $ F\sb{x, y} / \ab{y^2 - x^3 - Ax - B, \psi_n} $. The following algorithm illustrates the process of computing this $ t_n $, with further details given in \cite{crypto}.

\begin{algorithm}[Computation of the trace modulo prime]
Input: an elliptic curve $ E $ over $ \F_q $ and a prime $ n \in S $. Output: $ t_n $. If $ n = 2 $, then
$$ t_n = \begin{cases} 0 & g \ne 1 \\ 1 & g = 1 \end{cases}, \qquad g = \gcd\rb{x^q - x, x^3 + Ax + B}. $$
Otherwise $ n > 2 $, then compute $ \psi_n $ and $ q_n $, and reduce $ q_n $ into a value between $ -n / 2 $ and $ n / 2 $. Let
$$ \rb{x', y'} = \rb{x^{q^2}, y^{q^2}} + q_n\rb{x, y}, \qquad \rb{x'', y''} = \rb{x^q, y^q}. $$
If $ x' = x_i $, where $ \rb{x_i, y_i} = i\rb{x'', y''} $ for some $ i \in \cb{1, \dots, \rb{n - 1} / 2} $, then
$$ t_n = \begin{cases} i & y' = y_i \\ -i & y' = -y_i \end{cases}. $$
Otherwise if $ q_n \equiv r_n^2 \mod n $ for some $ r_n \in \cb{1, \dots, \rb{n - 1} / 2} $, then let $ \rb{x_r, y_r} = r_n\rb{x, y} $ and
$$ \rb{\dfrac{r\rb{x}}{s\rb{x}}, \dfrac{u\rb{x}}{v\rb{x}}y} = \rb{x'' - x_r, y'' - y_r}, \qquad \gcd\rb{r, s} = \gcd\rb{u, v} = 1. $$
If $ \gcd\rb{r, \psi_n} = 1 $, then
$$ t_n = \begin{cases} 2r_n & g' \ne 1 \\ -2r_n & g' = 1 \end{cases}, \qquad g' = \gcd\rb{u, \psi_n} $$
Otherwise $ t_n = 0 $.
\end{algorithm}

An analysis of Schoof's algorithm shows that it has a time complexity of $ O\rb{\log^8\rb{q}} $, which is asymptotically faster than that of the naive approach. Subsequently, there were refinements that restricted the primes in $ S $ into \emph{Elkies primes} and \emph{Atkin primes} rather than arbitrary small primes, and made use of \emph{modular polynomials} rather than division polynomials. Now known as the \emph{Schoof-Elkies-Atkin} algorithm, it has a time complexity of $ O\rb{\log^6\rb{q}} $ and is widely used in practicality when the prime $ q $ in question is huge, seen in the \emph{ellcard} command in the \emph{PARI} programming language. In implementations when maximum efficiency is required, a probabilistic version is used, which allows even faster computations of many operations.

\pagebreak

\subsection{Point counting}

As per the aim of this section, Schoof's algorithm computes the number of rational points of elliptic curves over finite fields. Although computations are generally done by code due to routine tedium, the following simple example illustrates a possible execution process.

\begin{example}
Let $ E : y^2 = x^3 + 2x + 1 $ be an elliptic curve over $ \F_{19} $, so let $ S = \cb{2, 3, 5} $ be such that $ N = \rb{2}\rb{3}\rb{5} = 30 > 20 = 4\sqrt{25} > 4\sqrt{19} $.
\begin{itemize}
\item Let $ n = 2 $. Then
\begin{align*}
x^{19}
& = x\rb{-2x - 1}^6
= 7x^7 + 2x^6 + 12x^5 + 8x^4 + 3x^3 + 12x^2 + x \\
& = 7x\rb{-2x - 1}^2 + 2\rb{-2x - 1}^2 + 12x^2\rb{-2x - 1} + 8x\rb{-2x - 1} + 3\rb{-2x - 1} + 12x^2 + x \\
& = 4x^3 + x^2 + 2x + 18
= 4\rb{-2x - 1} + x^2 + 2x + 18
= x^2 + 13x + 14,
\end{align*}
so $ \gcd\rb{x^{19} - x, x^3 + 2x + 1} = \gcd\rb{x^2 + 12x + 14, x^3 + 2x + 1} = 1 $. Hence $ t_2 = 1 $.
\item Let $ n = 3 $. Then $ q_3 = 1 \equiv 19 \mod 3 $ such that $ -3 / 2 \le 1 \le 3 / 2 $, and $ \psi_3\rb{x} = 3x^4 + 12x^2 + 12x + 15 $. Since $ \psi_3\rb{8} = 3\rb{8}^4 + 12\rb{8}^2 + 12\rb{8} + 15 = 0 $, it holds that $ \rb{8, b} \in E\rb{\F_{19}}\sb{3} $ for some $ b \in \F_{19} $. Lagrange's theorem gives $ 3 \mid \abs{E\rb{\F_{19}}} $, so $ 19 - t + 1 \equiv 0 \mod 3 $ and $ t \equiv 20 \equiv 2 \mod 3 $. Hence $ t_3 = 2 $.
\item Let $ n = 5 $. Then $ q_5 = -1 \equiv 19 \mod 5 $ such that $ -5 / 2 \le 1 \le 5 / 2 $, and
\begin{align*}
\psi_5\rb{x}
& = \psi_4\rb{x, y}\psi_2\rb{x, y}^3 - \psi_1\rb{x, y}\psi_3\rb{x, y}^3 \\
& = 4y\rb{x^6 + 10x^4 + x^3 + 18x^2 + 11x + 11 + 11}\rb{2y}^3 - 1\rb{3x^4 + 12x^2 + 12x + 15}^3 \\
& = 13\rb{x^3 + 2x + 1}^2\rb{x^6 + 10x^4 + x^3 + 18x^2 + 11x + 3} \\
& \qquad + 11x^{12} + 18x^{10} + 18x^9 + 9x^8 + 11x^7 + 6x^6 + 12x^5 + 10x^4 + 18x^3 + 12x^2 + 13x + 7 \\
& = 5x^{12} + 10x^{10} + 17x^8 + 5x^7 + x^6 + 9x^5 + 12x^4 + 2x^3 + 5x^2 + 8x + 8,
\end{align*}
so let $ \rb{x', y'} = \rb{x^{361}, y^{361}} - \rb{x, y} $ and $ \rb{x'', y''} = \rb{x^{19}, y^{19}} $. It can be tediously verified that $ x' \ne x_1 $ but $ x' = x_2 $, where $ \rb{x_i, y_i} = i\rb{x'', y''} $, so $ t_n \equiv 2 \mod 5 $ or $ t_n \equiv -2 \mod 5 $. Another tedious verification gives $ y' = -y_2 $, so $ t_n \equiv -2 \equiv 3 \mod 5 $. Hence $ t_5 = 3 $.
\end{itemize}
The Chinese remainder theorem from the example above gives $ t \equiv 23 \mod 30 $ such that $ 0 \ge 23 < 30 = N $. Thus $ t = 23 - 30 = -7 $ is such that $ \abs{-7} < 8 = 4\sqrt{4} < 4\sqrt{19} $ and $ \abs{E\rb{\F_{19}}} = 19 - \rb{-7} + 1 = 27 $.
\end{example}

While just counting $ F $-rational points may have many practical applications, a subtler question would be characterising their group structure. This would be more than just Schoof's algorithm, but machinery from previous subsections can finally combine to give the following proposition.

\begin{proposition}
$ E\rb{F} \cong \Z_{n_1} $ or $ E\rb{F} \cong \Z_{n_1} \oplus \Z_{n_2} $ for some $ n_1, n_2 \in \Z_{> 0} $ such that $ n_1 \mid n_2 $.
\end{proposition}

\begin{proof}
The fundamental theorem of finite abelian groups gives
$$ E\rb{F} \cong \bigoplus_{i = 1}^m \Z_{n_i}, \qquad m \in \Z_{\ge 0}, \qquad n_i \in \Z_{> 0}, $$
such that each $ n_i \mid n_{i + 1} $. Let $ G_i = \cb{x \in \Z_{n_i} \mid ord\rb{x} \mid n_1} \le \Z_{n_i} $ be subgroups. Then each $ \phi_i : \Z_{n_1} \to G_i $ defined by $ \phi_i\rb{x} = n_ix / n_1 $ is an isomorphism, so each $ \abs{G_i} = \abs{\Z_{n_1}} = n_1 $. Hence
$$ n_1^m = \abs{\bigoplus_{i = 1}^m G_i} = \abs{E\rb{F}\sb{n_1}} \le \abs{E\sb{n_1}} = \abs{Ker\rb{n_1}} = \deg_s\rb{\sb{n_1}} \le \deg\rb{\sb{n_1}} = n_1^2. $$
Since $ q \notin \cb{2, 3} $, it holds that $ \abs{E\rb{F}} = q - t + 1 \ge q - 2\sqrt{q} + 1 > 1 $. Thus $ \abs{E\rb{F}} \ncong \cb{0} $ and $ m \in \cb{1, 2} $.
\end{proof}

Both cases can arise from different elliptic curves and finite fields, as seen in the following example.

\begin{example}
$ E\rb{\F_5} \cong \Z_9 $ in the above example, while $ E' : y^2 = x^3 + x $ over $ \F_5 $ has $ E'\rb{\F_5} \cong \Z_2 \oplus \Z_2 $.
\end{example}

\begin{remark}
If $ q \in \cb{2, 3} $, then $ E\rb{F} $ could be trivial, but the only examples with this property are $ E_2 : y^2 + y = x^3 + x + 1 $ and $ E_2' : y^2 + y = x^3 + x^2 + 1 $ over $ \F_2 $ and $ E_3 : y^2 = x^3 - x - 1 $ over $ \F_3 $, up to isomorphism.
\end{remark}

\pagebreak

\section{Elliptic curves over the rationals}

After the discussion of elliptic curves over finite fields, the focus redirects to the field of rational numbers. Again, the question of computing the rational points arises again, with the unfortunate answer that it is not as straightforward as finite fields. Due to the countably infinite nature of the rationals, enumerating all possible rational solutions of all elliptic curves is not possible, so other techniques will be deployed. In particular, there will be an attempt to prove one of the most fundamental theorems of elliptic curves over the rationals, namely that the rational points form a finitely generated group. While finite groups arising from finite fields can be fully characterised by the fundamental theorem of finite abelian groups, finitely generated groups arising from the rationals can be fully characterised by the fundamental theorem of finitely generated abelian groups,
$$ E\rb{\Q} \cong \Z^r \oplus \bigoplus_{i = 1}^m \Z_{n_i}, \qquad r, m \in \Z_{\ge 0}, \qquad n_i \in \Z_{> 1}, $$
such that each $ n_i \mid n_{i + 1} $, which is given in full in Appendix A.4. However, there are issues with computing $ r \in \Z_{\ge 0} $, which will be discussed later. Now let $ E $ be an elliptic curve over the perfect field $ \Q $, given by the Weierstrass curve
$$ E : y^2 = x^3 + A'x + B', \qquad A' = \dfrac{p}{q}, B' = \dfrac{p'}{q'} \in \Q, $$
with the group of rational points $ E\rb{\Q} = \rb{E\rb{\Q}, \mathcal{O}, +} $. Since there is a $ j $-invariant affine transformation $ \rb{x, y} \mapsto \rb{q^{-2}q'^{-2}x, q^{-3}q'^{-3}y} $, there is an isomorphism from $ E $ to the curve given by the Weierstrass equation
$$ \rb{\dfrac{1}{q^3q'^3}y}^2 = \rb{\dfrac{1}{q^2q'^2}x}^3 + \dfrac{p}{q}\rb{\dfrac{1}{q^2q'^2}x} + \dfrac{p'}{q'} \qquad \implies \qquad y^2 = x^3 + pq^3q'^4x + p'q^6q'^5. $$
Hence for this section, assume without loss of generality that
$$ E : y^2 = x^3 + Ax + B, \qquad A, B \in \Z. $$

\subsection{Nagell-Lutz theorem}

For the following sections, let $ \Delta'_E = \tfrac{1}{16}\Delta_E $ be the \emph{reduced discriminant}. Then the following theorem characterises the affine coordinates of torsion points.

\begin{theorem}[Nagell-Lutz]
\label{thm:nagelllutz}
Let $ P = \rb{a, b} \in E\rb{\Q} $ be a non-zero torsion point. Then:
\begin{enumerate}
\item $ a, b \in \Z $, and
\item $ b = 0 $ or $ b^2 \mid \Delta'_E $.
\end{enumerate}
\end{theorem}

Proof of the first part of the Nagell-Lutz theorem will be split into several definitions and lemmas, many of which follows from the properties of \emph{$ p $-adic numbers}, which will not be discussed. Now let $ p \in \Z_{> 0} $ be a prime. A particular valuation in the construction of $ p $-adic numbers describing how a prime divides the numerator or denominator of a rational number is given in the following definition.

\begin{definition}[$ p $-adic valuation]
The \textbf{$ p $-adic valuation} is a valuation $ v_p : \Q \to \Z \cup \cb{\infty} $ defined by
$$ v_p\rb{x} = \begin{cases} \max\cb{v \in \Z_{\ge 0} \ \Big| \ x = \dfrac{q}{r}p^v, \ q \in \Z, \ r \in \Z_{> 0}, \ p \nmid r} & x \ne 0 \\ \infty & x = 0 \end{cases}. $$
\end{definition}

Hence any $ x \in \Q $ will be uniquely written as
$$ x = \dfrac{q}{r}p^v, \qquad q \in \Z, \qquad r \in \Z_{> 0}, $$
such that $ p, q, r $ are pairwise coprime, where $ v = v_p\rb{x} $. It is clear that $ v_p\rb{q / r} $ is positive whenever $ p $ divides $ q $ and $ v_p\rb{q / r} $ is negative whenever $ p $ divides $ r $, while $ v_p\rb{q / r} $ is zero otherwise. This can be illustrated in the following example.

\begin{example}
$$ v_5\rb{\dfrac{100}{10}} = v_5\rb{\dfrac{2}{1}5^1} = 1, \qquad v_5\rb{\dfrac{10}{100}} = v_5\rb{\dfrac{1}{2}5^{-1}} = -1, \qquad v_5\rb{1} = v_5\rb{5^0} = 0. $$
\end{example}

Three properties given in the following lemma will come in handy when computing $ p $-adic valuations of sums and products.

\begin{lemma}
Let $ x, y \in \Q $. Then:
\begin{enumerate}
\item $ v_p\rb{1 / x} = -v_p\rb{x} $,
\item $ v_p\rb{xy} = v_p\rb{x} + v_p\rb{y} $, and
\item $ v_p\rb{x + y} \ge \min\cb{v_p\rb{x}, v_p\rb{y}} $, with equality if $ v_p\rb{x} \ne v_p\rb{y} $.
\end{enumerate}
\end{lemma}

\begin{proof}
Let
$$ x = \dfrac{q}{r}p^v, \qquad y = \dfrac{q'}{r'}p^{v'}, \qquad q, q' \in \Z, \qquad r, r' \in \Z_{> 0}, $$
such that $ p, q, r $ are pairwise coprime and $ p, q', r' $ are pairwise coprime, where $ v = v_p\rb{x} $ and $ v' = v_p\rb{y} $.
\begin{enumerate}
\item Since $ \gcd\rb{r, q} = 1 $,
$$ v_p\rb{\dfrac{1}{x}} = v_p\rb{\dfrac{r}{q}p^{-v}} = -v = -v_p\rb{x}. $$
\item Since $ \gcd\rb{p, qq'} = \gcd\rb{p, rr'} = 1 $,
$$ v_p\rb{xy} = v_p\rb{\dfrac{qq'}{rr'}p^{v + v'}} = v + v' = v_p\rb{x} + v_p\rb{y}. $$
\item Assume that $ v = v' $. Then
$$ v_p\rb{x + y} = v_p\rb{\dfrac{qr'p^v + q'rp^v}{rr'}} = v_p\rb{\dfrac{qr' + q'r}{rr'}p^v} \ge v = \min\cb{v, v'} = \min\cb{v_p\rb{x}, v_p\rb{y}}. $$
Assume otherwise that $ v > v' $. Since $ \gcd\rb{rr'} = \gcd\rb{p, qr'p^{v - v'} + q'r} = 1 $,
$$ v_p\rb{x + y} = v_p\rb{\dfrac{qr'p^v + q'rp^{v'}}{rr'}} = v_p\rb{\dfrac{qr'p^{v - v'} + q'r}{rr'}p^{v'}} = v' = \min\cb{v, v'} = \min\cb{v_p\rb{x}, v_p\rb{y}}. $$
Similarly, if $ v < v' $, then $ v_p\rb{x + y} = \min\cb{v_p\rb{x}, v_p\rb{y}} $.
\end{enumerate}
\end{proof}

The following example illustrates the above lemma.

\begin{example}
$$ v_5\rb{\dfrac{25}{5}} = v_5\rb{5} = 1 = 2 - 1 = v_5\rb{25} - v_5\rb{5}, \qquad v_2\rb{8} = 3 > 2 = \min\cb{v_2\rb{4}, v_2\rb{4}}. $$
\end{example}

With this trick, a relation between the $ p $-adic valuated coordinates of any affine rational point in an elliptic curve can be seen in the following lemma.

\begin{lemma}
Let $ P = \rb{a, b} \in E\rb{\Q} $ be a point. Then $ v_p\rb{a} < 0 $ iff $ v_p\rb{b} < 0 $, for which $ v_p\rb{a} = -2v $ and $ v_p\rb{b} = -3v $ for some $ v \in \Z_{> 0} $.
\end{lemma}

\begin{proof}
Assume that $ v_p\rb{a} < 0 $. Since $ A, B \in \Z $, it holds that $ v_p\rb{A}, v_p\rb{B} \ge 0 $, so
$$ 2v_p\rb{b} = v_p\rb{b^2} = v_p\rb{a^3 + Aa + B} = \min\cb{3v_p\rb{a}, v_p\rb{A} + v_p\rb{a}, v_p\rb{B}} = 3v_p\rb{a}. $$
Hence $ 2 \mid v_p\rb{a} $ and $ 3 \mid v_p\rb{b} $, so $ v_p\rb{a} = -2v $ and $ v_p\rb{b} = -3v $ for some $ v \in \Z_{> 0} $. Conversely assume that $ v_p\rb{a} \ge 0 $. Then $ 2v_p\rb{b} \ge \min\cb{3v_p\rb{a}, v_p\rb{A} + v_p\rb{a}, v_p\rb{B}} \ge 0 $. Thus $ v_p\rb{b} \ge 0 $.
\end{proof}

Hence for any point $ P = \rb{a, b} \in E\rb{\Q} $,
$$ a = \dfrac{q}{d^2}, \qquad b = \dfrac{r}{d^3}, \qquad q, r \in \Z, \qquad d \in \Z_{> 0} $$
such that $ \gcd\rb{q, d} = \gcd\rb{r, d} = 1 $. This fact will be proven explicitly here as it will be used several times in later subsections. Now a change of coordinates will be undertaken to ease discussions, namely
$$ t = T = \dfrac{X}{Y}, \qquad s = S = \dfrac{Z}{Y}, \qquad \sb{X, Y, Z} \mapsto \sb{T, 1, S} = \rb{t, s}, $$
which is an invertible projective transformation
$$ E : Y^2Z = X^3 + AXZ^2 + BZ^3 \qquad \iff \qquad E' : S = T^3 + ATS^2 + BS^3 : s = t^3 + Ats^2 + Bs^3. $$
This has the effect that
$$ \mathcal{O} \mapsto \rb{0, 0}, \qquad \rb{a, b} \mapsto \rb{\dfrac{a}{b}, \dfrac{1}{b}} $$
for any point $ \rb{a, b} \in E\rb{\Q} $ such that $ b \ne 0 $, while the three $ 2 $-torsion points $ \rb{a, 0} $ map to three points at infinity and can be disregarded for now. The modified group law is then given in the following lemma.

\begin{lemma}
Let $ P = \rb{a, b} \in E'\rb{\Q} $ and $ Q = \rb{a', b'} \in E'\rb{\Q} $ be points such that $ P + Q = \rb{a'', b''} \in E'\rb{\Q} $. Then $ -P = \rb{-a, -b} $ and
$$ a'' = a + a' + \dfrac{2A\lambda\mu + 3B\lambda^2\mu}{1 + A\lambda^2 + B\lambda^3}, \qquad \lambda = \dfrac{a^2 + aa' + a'^2 + Ab'^2}{1 - Aa\rb{b + b'} - B\rb{b^2 + bb' + b'^2}}, \qquad \mu = b - \lambda a. $$
\end{lemma}

\begin{proof}
Since $ \rb{a, b} \mapsto \rb{a / b, 1 / b} $, it holds that $ -\rb{a, b} = \rb{a, -b} \mapsto \rb{-a / b, -1 / b} $. Let $ P * Q = -\rb{P + Q} = \rb{-a'', -b''} $. If $ a \ne a' $, then the line joining $ P $ and $ Q $ is
$$ L : s = \lambda_1 t + \mu_1, \qquad \lambda_1 = \dfrac{b - b'}{a - a'}, \qquad \mu_1 = b - \lambda_1 a. $$
Otherwise $ a = a' $, then the tangent at $ P $ is
$$ L : s = \lambda_2 t + \mu_2, \qquad \lambda_2 = \dfrac{3a^2 + Ab^2}{1 - 2Aab - 3Bb^2}, \qquad \mu_2 = b - \lambda_2 a. $$
Since
\begin{align*}
b - b'
& = a^3 + Aab^2 + Bb^3 - a'^3 - Aa'b'^2 - Bb'^3 \\
& = a^3 - a'^3 + Aab^2 - Aab'^2 + Aab'^2 - Aa'b'^2 + Bb^3 - Bb'^3 \\
& = \rb{a - a'}\rb{a^2 + aa' + a'^2} + Aa\rb{b - b'}\rb{b + b'} + Ab'^2\rb{a - a'} + B\rb{b - b'}\rb{b^2 + bb' + b'^2},
\end{align*}
it holds that
$$ \rb{b - b'}\rb{1 - Aa\rb{b + b'} - B\rb{b^2 + bb' + b'^2}} = \rb{a - a'}\rb{a^2 + aa' + a'^2 + Ab'^2}, $$
so $ \rb{b - b'} / \rb{a - a'} = \lambda = \lambda_1 = \lambda_2 $ and $ \mu = \mu_1 = \mu_2 $. Now $ L : s = \lambda t + \mu $ intersects $ E' $ at
$$ \rb{1 + A\lambda^2 + B\lambda^3}t^3 + \rb{2A\lambda\mu + 3B\lambda^2\mu}t^2 + \rb{A\mu^2 + 3B\lambda\mu^2 - \lambda}t - \rb{\mu - B\mu^3} = 0. $$
Thus comparing coefficients gives $ -\rb{2A\lambda\mu + 3B\lambda^2\mu} / \rb{1 + A\lambda^2 + B\lambda^3} = a + a' - a'' $.
\end{proof}

The above proof is brief but can be verified manually. Now let
$$ E\rb{p^v} = \cb{\mathcal{O}} \cup \cb{\rb{a, b} \in E\rb{\Q} \mid v_p\rb{a} \le -2v, \ v_p\rb{b} \le -3v} $$
be a subset of $ E\rb{\Q} $. Rewriting coordinates accordingly gives $ v_p\rb{a / b} \ge v $ and $ v_p\rb{1 / b} \ge 3v $, so let
$$ E'\rb{p^v} = \cb{\rb{0, 0}} \cup \cb{\rb{a, b} \in E'\rb{\Q} \mid v_p\rb{a} \ge v, \ v_p\rb{b} \ge 3v} $$
be a subset of $ E'\rb{\Q} $ bijective to $ E\rb{p^v} $. These two sets induce two decreasing sequences of subsets.

\begin{definition}[Filtration]
A \textbf{filtration} is a decreasing sequence of subsets $ S_i $ such that $ S_i \supseteq S_j $ for any $ i \le j $.
\end{definition}

A simple rephrasal gives that $ E\rb{p^v} $ and $ E'\rb{p^v} $ \emph{induce} two $ p $-adic filtrations
$$ E\rb{\Q} \supseteq E\rb{p} \supseteq E\rb{p^2} \supseteq E\rb{p^3} \supseteq \dots \supseteq \cb{\mathcal{O}}, \qquad E'\rb{\Q} \supseteq E'\rb{p} \supseteq E'\rb{p^2} \supseteq E'\rb{p^3} \supseteq \dots \supseteq \cb{\rb{0, 0}}. $$
The individual subsets in these filtrations are actually subgroups, giving a filtration of subgroups, which will be proven in the following lemma.

\begin{lemma}
Let $ v \in \Z_{> 0} $ and $ P = \rb{a, b} \in E'\rb{p^v} $ and $ Q = \rb{a', b'} \in E'\rb{p^v} $ be points such that $ P + Q = \rb{a'', b''} \in E'\rb{\Q} $. Then $ -P, P + Q \in E'\rb{p^v} $ and $ v_p\rb{a + a' + a''} \ge 5v $.
\end{lemma}

\begin{proof}
Since $ -P = \rb{-a, -b} $, it holds that $ v_p\rb{-a} = v_p\rb{a} $, so $ -P \in E'\rb{p^v} $. Since $ A, B \in \Z $, it holds that $ v_p\rb{A}, v_p\rb{B} \ge 0 $. Now the group law gives
$$ a'' = a + a' + \dfrac{2A\lambda\mu + 3B\lambda^2\mu}{1 + A\lambda^2 + B\lambda^3}, \qquad \lambda = \dfrac{a^2 + aa' + a'^2 + Ab'^2}{1 - Aa\rb{b + b'} - B\rb{b^2 + bb' + b'^2}}, \qquad \mu = b - \lambda a. $$
Then
\begin{align*}
v_p\rb{a^2 + aa' + a'^2 + Ab'^2} & \ge \min\cb{2v_p\rb{a}, v_p\rb{a} + v_p\rb{a'}, 2v_p\rb{a'}, v_p\rb{A} + 2v_p\rb{b'}} \ge 2v, \\
v_p\rb{Aa\rb{b + b'}} & \ge \min\cb{v_p\rb{a} + v_p\rb{a'} + v_p\rb{b}, v_p\rb{a} + v_p\rb{a'} + v_p\rb{b'}} \ge 5v, \\
v_p\rb{B\rb{b^2 + bb' + b'^2}} & \ge \min\cb{v_p\rb{B} + 2v_p\rb{b}, v_p\rb{B} + v_p\rb{b} + v_p\rb{b'}, v_p\rb{B} + 2v_p\rb{b'}} \ge 6v,
\end{align*}
so $ v_p\rb{\lambda} \ge 2v - \min\cb{0, 5v, 6v} = 2v $ and $ v_p\rb{\mu} \ge \min\cb{3v, 3v} = 3v $. Hence
\begin{align*}
v_p\rb{2A\lambda\mu + 3B\lambda^2\mu} & \ge \min\cb{v_p\rb{2} + v_p\rb{A} + v_p\rb{\lambda} + v_p\rb{\mu}, v_p\rb{3} + v_p\rb{B} + 2v_p\rb{\lambda} + v_p\rb{\mu}} \ge 5v, \\
v_p\rb{1 + A\lambda^2 + B\lambda^3} & = \min\cb{v_p\rb{1}, v_p\rb{A} + 2v_p\rb{\lambda}, v_p\rb{B} + 3v_p\rb{\lambda}} = 0,
\end{align*}
so $ v_p\rb{a''} \ge \min\cb{a, a', 5v} \ge v $. Thus $ P + Q \in E'\rb{p^v} $ and $ v_p\rb{a + a' - a''} \ge 5v $.
\end{proof}

Note that the second part of the lemma proves something stronger, that the $ x $ coordinates of three collinear points add to give a large $ p $-adic valuation. Now let $ R = \cb{x \in \Q \mid v_p\rb{x} \ge 0} $ be a unique factorisation domain such that $ \ab{p^v} = \cb{x \in \Q \mid v_p\rb{x} \ge v} \subseteq R $ is a principal ideal. This also induces a filtration of subgroups
$$ R \ge \ab{p} \ge \ab{p^2} \ge \ab{p^3} \ge \dots \cb{0}. $$
Then $ v_p\rb{a + a' - a''} \ge 5v $ from the previous lemma can be rephrased as $ a + a' - a'' \in \ab{p^{5v}} $, or even better as $ \ab{p^{5v}} + a + a' = \ab{p^{5v}} + a'' $. The following lemma attempts to makes use of this fact.

\begin{lemma}
There is an injective group homomorphism
$$ \phi : E\rb{p^v} / E\rb{p^{5v}} \to \ab{p^v} / \ab{p^{5v}}, \qquad \phi\rb{E\rb{p^{5v}} + P} = \begin{cases} \ab{p^{5v}} + \dfrac{a}{b} & P = \rb{a, b} \\ \ab{p^{5v}} & P = \mathcal{O} \end{cases}. $$
\end{lemma}

\begin{proof}
Let $ \psi : E\rb{p^v} \to \ab{p^v} / \ab{p^{5v}} $ be defined by
$$ \psi\rb{P} = \begin{cases} \ab{p^{5v}} + \dfrac{a}{b} & P = \rb{a, b} \\ \ab{p^{5v}} & P = \mathcal{O} \end{cases}, $$
and let $ P, Q \in E\rb{p^v} $ be points. If $ P = \mathcal{O} $, then
$$ \psi\rb{P} + \psi\rb{Q} = \ab{p^{5v}} + \ab{p^{5v}} + \dfrac{a'}{b'} = \ab{p^{5v}} + \dfrac{a'}{b'} = \psi\rb{Q} = \psi\rb{P + Q}, $$
or similar for $ Q = \mathcal{O} $. If $ P = \rb{a, b} $ and $ Q = \rb{a, -b} $, then
$$ \psi\rb{P} + \psi\rb{Q} = \ab{p^{5v}} + \dfrac{a}{b} + \ab{p^{5v}} - \dfrac{a}{b} = \ab{p^{5v}} = \psi\rb{\mathcal{O}} = \psi\rb{P + Q}. $$
Otherwise $ P = \rb{a, b} $ and $ Q = \rb{a', b'} $ such that $ P + Q = \rb{a'', b''} $, then
$$ \psi\rb{P} + \psi\rb{Q} = \ab{p^{5v}} + \dfrac{a}{b} + \ab{p^{5v}} + \dfrac{a'}{b'} = \ab{p^{5v}} + \dfrac{a}{b} + \dfrac{a'}{b'} = \ab{p^{5v}} + \dfrac{a''}{b''} = \psi\rb{P + Q}. $$
Hence $ \psi $ is a group homomorphism. Now $ \mathcal{O} \in Ker\rb{\psi} $, and $ \rb{a, b} \in Ker\rb{\psi} $ iff $ v_p\rb{a / b} \ge 5v $. This holds iff $ \rb{a / b, 1 / b} \in E'\rb{p^{5v}} $ and $ \rb{a, b} \in E\rb{p^{5v}} $, so $ Ker\rb{\psi} = E\rb{p^{5v}} $. Thus the first isomorphism theorem gives a natural injective group homomorphism
$$ \phi : \dfrac{E\rb{p^v}}{E\rb{p^{5v}}} \to Im\rb{\psi} \subseteq \dfrac{\ab{p^v}}{\ab{p^{5v}}}. $$
\end{proof}

Now the subgroup $ E\rb{p} $ can be proven to be \emph{torsion-free} with a proof by contradiction in the following lemma, from which the first part of the Nagell-Lutz theorem can be deduced.

\begin{lemma}
$ E\rb{p} $ has no non-zero torsion points.
\end{lemma}

\begin{proof}
Let $ P = \rb{a, b} \in E\rb{\Q} $ be an $ n $-torsion point. Suppose for a contradiction that $ P \in E\rb{p} $, so $ v_p\rb{a} = -2v $ for some $ v \in \Z_{> 0} $ and $ v_p\rb{a / b} = v $. Then
$$ \ab{p^{5v}} = \phi\rb{E\rb{p^{5v}}} = \phi\rb{E\rb{p^{5v}} + nP} = n\phi\rb{E\rb{p^{5v}} + P} = n\rb{\ab{p^{5v}} + \dfrac{a}{b}} = \ab{p^{5v}} + n\dfrac{a}{b}, $$
so $ n\rb{a / b} \in \ab{p^{5v}} $. Assume that $ p \nmid n $, so $ a / b \in \ab{p^{5v}} $ and $ v = v_p\rb{a / b} \ge 5v $, which is a contradiction. Hence $ P \notin E\rb{p} $. Otherwise assume that $ p \mid n $, then $ n = mp $ for some $ m \in \Z_{> 0} $. Now let $ Q = mP = \rb{a', b'} \in E\rb{\Q} $ be a $ p $-torsion point. Since $ P \in E\rb{p} $, it holds that $ Q \in E\rb{p} $, so $ v_p\rb{a'} = -2v' $ for some $ v' \in \Z_{> 0} $ and $ v_p\rb{a' / b'} = v' $. Then
$$ \ab{p^{5v'}} = \phi\rb{E\rb{p^{5v'}}} = \phi\rb{E\rb{p^{5v'}} + pQ} = p\phi\rb{E\rb{p^{5v'}} + Q} = p\rb{\ab{p^{5v'}} + \dfrac{a'}{b'}} = \ab{p^{5v}} + p\dfrac{a'}{b'}, $$
so $ p\rb{a' / b'} \in \ab{p^{5v'}} $. Then $ 5v' \le v_p\rb{p\rb{a' / b'}} = v_p\rb{p} + v_p\rb{a' / b'} = 1 + v' $, which is again a contradiction. Hence $ Q \notin E\rb{p} $ and $ P \notin E\rb{p} $. Thus $ E\rb{p} $ has no non-zero torsion points.
\end{proof}

Both parts of the Nagell-Lutz theorem can finally be proven here, the second part a corollary of the first.

\begin{proof}[Proof of Theorem \ref{thm:nagelllutz}]
Let $ P = \rb{a, b} \in E\rb{\Q} $ be a non-zero $ n $-torsion point.
\begin{enumerate}
\item Since $ P \notin E\rb{p} $ for any prime $ p \in \Z_{> 0} $, it holds that $ v_p\rb{a} \ge 0 $ and $ v_p\rb{b} \ge 0 $. Thus $ a, b \in \Z $.
\item Assume that $ b \ne 0 $ and let $ 2P = \rb{a', b'} \in E\rb{\Q} $. By the duplication formula,
$$ a' = \dfrac{a^4 - 2Aa^2 - 8Ba + A^2}{4b^2}. $$
Since $ P $ and $ 2P $ are torsion points, it holds that $ a, b, a', b' \in \Z $, so $ b^2 \mid a^4 - 2Aa^2 - 8Ba + A^2 $. Thus
$$ b^2 \mid \rb{a^4 - 2Aa^2 - 8Ba + A^2}\rb{3a^2 + 4A} - \rb{a^3 + Aa + B}\rb{3a^3 - 5Aa - 27B} = 4A^3 + 27B^2 = \Delta'_E. $$
\end{enumerate}
\end{proof}

\pagebreak

\subsection{Torsion computation}

An application of the Nagell-Lutz theorem is as follows. Assuming the fundamental theorem of finite abelian groups,
$$ E\rb{\Q} \cong \Z^r \oplus E\rb{\Q}_{tors}, \qquad r \in \Z_{\ge 0}, $$
the Nagell-Lutz theorem can be used to compute the torsion subgroup $ E\rb{\Q}_{tors} $, since there are only finitely many torsion points $ \rb{a, b} \in E\rb{\Q} $ such that $ b^2 \mid \Delta'_E $. The following example illustrates the full computation of the torsion subgroup of an elliptic curve.

\begin{example}
Let $ E : y^2 = x^3 + 4 $ be an elliptic curve over $ \Q $ and $ P = \rb{a, b} \in E\rb{\Q} $ be a torsion point. Then either $ b = 0 $ or $ b^2 \mid 4\rb{0}^3 + 27\rb{4}^2 = 3\rb{12}^2 $, so $ b \in \cb{0, \pm 1, \pm 2, \pm 3, \pm 4, \pm 6, \pm 12} $, of which only $ P_1 = \rb{0, 2} \in E\rb{\Q} $ and $ P_2 = \rb{0, -2} \in E\rb{\Q} $. Then
$$ 2P_1 = \rb{\dfrac{0}{4\rb{4}}, \dfrac{2^2 - 3\rb{4}}{2\rb{2}}} = \rb{0, -2} = P_2, $$
so $ ord\rb{P_1} = ord\rb{P_2} = 3 $. Thus the torsion subgroup is $ E\rb{\Q}_{tors} = \cb{\mathcal{O}, P_1, P_2} \cong \Z_3 $.
\end{example}

The following algorithm summarises the process and code in the appendix.

\begin{algorithm}[Computation of the torsion subgroup]
Input: an elliptic curve $ E $ over $ \Q $. Output: $ E\rb{\Q}_{tors} $.
\begin{enumerate}
\item Calculate $ \Delta'_E $ and get all non-negative $ b $ coordinates such that $ b^2 \mid \Delta'_E $.
\item Get all $ a $ coordinates for each non-negative $ b $ coordinate such that $ b^2 = a^3 + Aa + B $.
\item Add points $ \rb{a, b} $ with itself repeatedly and stop at $ \mathcal{O} $ or non-integer coordinates.
\item Negate each point $ \rb{a, b} $ to $ \rb{a, -b} $ and do the same.
\item Insert $ \mathcal{O} $ into the list of all points that add to $ \mathcal{O} $.
\end{enumerate}
\end{algorithm}

The torsion subgroups of the following examples of elliptic curves given by the Weierstrass equations $ y^2 = x^3 - px $ for $ p \in \Z_{> 0} $ can be computed similarly. This information will be used in a later subsection.

\begin{example}
The elliptic curves $ E : y^2 = x^3 - x $ has torsion subgroup $ E\rb{\Q}_{tors} = \cb{\mathcal{O}, \rb{0, 0}, \rb{1, 0}, \rb{-1, 0}} \cong \Z_2^2 $, while the elliptic curves $ E : y^2 = x^3 - 5x $, $ E : y^2 = x^3 - 17x $, $ E : y^2 = x^3 - 226x $ all have torsion subgroup $ E\rb{\Q}_{tors} = \cb{\mathcal{O}, \rb{0, 0}} \cong \Z_2 $.
\end{example}

The converse to the Nagell-Lutz theorem does not generally hold. It cannot be used to prove that a certain point is a torsion point, but it can be used to show the contrapositive, that a point is not a torsion point, by duplicating it until its coordinates are not integers. The following example illustrates this.

\begin{example}
Let $ E : y^2 = x^3 - 4 $ be an elliptic curve over $ \Q $ with torsion subgroup $ E\rb{\Q}_{tors} = \cb{\mathcal{O}} \cong \Z_1 $. Now let $ P = \rb{2, 2} \in E\rb{\Q} $ be a point. Then
$$ 2P = \rb{5, -11}, \qquad 4P = \rb{\dfrac{785}{484}, -\dfrac{5497}{10648}}. $$
Thus $ ord\rb{P} $ is infinite.
\end{example}

These are several examples of different torsion subgroups. In fact, there are even elliptic curves with as large as $ 12 $-torsion elements, but there are strangely none with $ 11 $-torsion elements. The following difficult theorem was proven to be an exhaustive list of all possible torsion subgroups of all elliptic curves.

\begin{theorem}[Mazur]
$ E\rb{\Q} $ is isomorphic to one of
$$ \Z_n, \qquad n \in \cb{1, \dots, 10, 12}, $$
$$ \Z_2 \times \Z_{2n}, \qquad n \in \cb{1, \dots, 4}. $$
\end{theorem}

\begin{proof}
Omitted, see \cite{mazur}.
\end{proof}

As such, the torsion subgroup of an elliptic curve $ E\rb{\Q} $ can be computed in a finite number of steps. However, computations may still be intensive if $ \Delta'_E $ has many squared factors, as the computation involves solving a cubic equation. The next section provides an alternative method for this.

\pagebreak

\subsection{Reduction modulo prime}

Another method of computing the torsion subgroup is to reduce the elliptic curve over rationals into one over a finite field, by applying isomorphisms that simplify the Weierstrass equation, then applying a particular group homomorphism. The assumption of integer coefficients in a previous subsection makes the Weierstrass equation \emph{integral}, but a further reduction can be done as follows.

\begin{definition}[Minimal]
A Weierstrass equation is \textbf{minimal} iff it is integral and $ g \in \cb{-1, 1} $ if $ g^4 \mid A $ and $ g^6 \mid B $.
\end{definition}

A minimal Weierstrass equation is unique up to sign. The above definition reflects the minimality of the integer coefficients after $ j $-invariant affine transformations, which is illustrated in the following example.

\begin{example}
Let $ E : y^2 = x^3 + n^4x + n^6 $ be an elliptic curve over $ \Q $ for some $ n \in \Q $. Since there is a $ j $-invariant affine transformation $ \rb{x, y} \mapsto \rb{n^2x, n^3y} $, there is an isomorphism from $ E $ to the curve given by the Weierstrass equation $ y^2 = x^3 + x + 1 $, which is integral and minimal.
\end{example}

Minimal Weierstrass equations can then be treated as if their coefficients are modulo a prime, which is stated formally as a map in the following definition.

\begin{definition}[Reduction map]
The \textbf{reduction modulo $ p $ map} $ r_p : E\rb{\Q} \to E_p\rb{\F_p} $ for some prime $ p \in \Z_{> 0} $ is defined by
$$ E_p : y^2 = x^3 + \tilde{A}x + \tilde{B}, \qquad r_p\rb{P} = \begin{cases} \rb{\tilde{a}, \tilde{b}} & P = \rb{a, b} \\ \mathcal{O} & P = \mathcal{O} \end{cases}, $$
where $ \tilde{\cdot} : \Z \to \F_p $ denotes modulo $ p $.
\end{definition}

There is a minor hiccup with this definition, since $ E_p $ might not even define a smooth Weierstrass curve. However, since $ 0 \ne \Delta_E = p_1 \dots p_n $ for some primes $ p_i \in \Z_{> 0} $ and $ \Delta_{E_p} = 0 $ only if any $ p_i \mid p $, this issue can be easily fixed by considering only the primes that are not $ p_i $, which is given in the following definition.

\begin{definition}[Good reduction]
A prime $ p \in \Z_{> 0} $ is of \textbf{good reduction} iff $ p \nmid \Delta_E $.
\end{definition}

Hence $ r_p $ has a well-defined codomain for infinitely many primes of good reduction, while those of bad reduction will not be considered. Additionally since the discriminant has a coefficient of $ 16 $, the prime $ 2 $ will always be considered one of bad reduction. Now $ r_p $ is also well-defined, which is immediate considering the following lemma.

\begin{lemma}
\label{lem:normalise}
Let $ P = \sb{a, b, c} \in E\rb{\Q} $ be a point. Then $ P = \sb{a', b', c'} $ for some $ a', b', c' \in \Z $ such that $ \gcd\rb{a', b', c'} = 1 $.
\end{lemma}

\begin{proof}
If $ c = 0 $, then $ P = \mathcal{O} $, so $ \gcd\rb{0, 1, 0} = 1 $. Otherwise $ c \ne 0 $, then $ P = \rb{a / c, b / c} $. Then $ a / c = q / d^2 $ and $ b / c = r / d^3 $ for some $ q, r \in \Z $ and some $ d \in \Z_{> 0} $ such that $ \gcd\rb{q, d} = \gcd\rb{r, d} = 1 $. Thus $ P = \rb{q / d^2, r / d^3} = \sb{qd, r, d^3} $ is such that $ \gcd\rb{qd, r, d^3} = 1 $.
\end{proof}

This integral and minimal condition will also be defined as follows.

\begin{definition}[Normalised]
A point $ P \in E\rb{\Q} $ has \textbf{normalised} coordinates iff it satisfies Lemma \ref{lem:normalise}.
\end{definition}

With this representation, there must be one of $ a', b', c' $ coprime to $ p $ for any prime $ p \in \Z_{> 0} $ of good reduction, so $ r_p\rb{P} = \sb{\tilde{a'}, \tilde{b'}, \tilde{c'}} \in E_p\rb{\F_p} $ is well-defined. The normalised coordinates of any point is unique up to sign, which is illustrated with the following example.

\begin{example}
Let $ P = \rb{2 / 5, -1 / 3} \in E\rb{\Q} $ be a point. Then
$$ \rb{\dfrac{2}{5}, -\dfrac{1}{3}} = \sb{\dfrac{2}{5}, -\dfrac{1}{3}, 1} = \sb{6, -5, 15}, \sb{-6, 5, -15} $$
are its normalised coordinates.
\end{example}

\pagebreak

Let $ p \in \Z_{> 0} $ be a prime of good reduction. Then the following proposition characterises $ r_p $.

\begin{proposition}
$ r_p : E\rb{\Q} \to E_p\rb{\F_p} $ is a group homomorphism such that $ Ker\rb{r_p} = E\rb{p} $.
\end{proposition}

\begin{proof}
Let $ P, Q \in E\rb{\Q} $ be points with normalised coordinates and
$$ L : l\rb{X, Y, Z} = kX + mY + nZ = 0 $$
be a line joining $ P $ and $ Q $ with coefficients in $ \Q $ such that $ P, Q, -\rb{P + Q} \in E\rb{\Q} \cap L $. Then normalising $ \sb{l, m, n} $ similarly gives $ \sb{l', m', n'} $ for some $ l', m', n '\in \Z $ such that $ \gcd\rb{l, m, n} = 1 $. Hence the line
$$ L_p : l_p\rb{X, Y, Z} = \tilde{l}X + \tilde{m}Y + \tilde{n}Z = 0 $$
with coefficients in $ \F_p $ is well-defined. Now let $ P = \sb{a, b, c} $. Then
$$ la + mb + nc = 0 \qquad \implies \qquad \tilde{l}\tilde{a} + \tilde{m}\tilde{b} + \tilde{n}\tilde{c} = 0, $$
so $ r_p\rb{P} = \rb{\tilde{a}, \tilde{b}, \tilde{c}} \in E_p\rb{\F_p} \cap L_p $. Similarly $ r_p\rb{Q} \in E_p\rb{\F_p} \cap L_p $. Since $ r_p\rb{-\mathcal{O}} = r_p\rb{\mathcal{O}} = -r_p\rb{\mathcal{O}} $ and
$$ r_p\rb{-\rb{a, b}} = r_p\rb{\rb{a, -b}} = \rb{\tilde{a}, \tilde{-b}} = \rb{\tilde{a}, -\tilde{b}} = -\rb{\tilde{a}, \tilde{b}} = -r_p\rb{\rb{a, b}} $$
for any point $ \rb{a, b} \in E\rb{\Q} $, similarly $ -r_p\rb{P + Q} = r_p\rb{-\rb{P + Q}} \in E_p\rb{\F_p} \cap L_p $. Since $ \gcd\rb{e_p, l_p} = 1 $ where $ e_p\rb{x, y} $ is the Weierstrass equation of $ E_p $, B\'ezout's theorem gives that $ L_p $ intersects $ E_p\rb{\F_p} $ at three points up to multiplicity, so
$$ E_p\rb{\F_p} \cap L_p = \cb{r_p\rb{P}, r_p\rb{Q}, -r_p\rb{P + Q}}. $$
Hence $ r_p\rb{P} + r_p\rb{Q} = r_p\rb{P + Q} $. Now let $ R = \rb{a, b} \in E\rb{\Q} $ be a point. Then $ a = q / d^2 $ and $ b = r / d^3 $ for some $ q, r \in \Z $ and some $ d \in \Z_{> 0} $ such that $ \gcd\rb{q, d} = \gcd\rb{r, d} = 1 $. Since $ R = \sb{qd, r, d^3} $ has normalised coordinates, it holds that $ r_p\rb{R} = \sb{\tilde{q}\tilde{d}, \tilde{r}, \tilde{d}^3} \in E_p\rb{\F_p} $. Then $ R \in Ker\rb{r_p} $ iff $ \tilde{d}^3 = 0 $, or $ p \mid d $. This holds iff $ v_p\rb{a} \le -2 $ and $ v_p\rb{b} \le -3 $, or $ R \in E\rb{p} $. Thus $ Ker\rb{r_p} = E\rb{p} $.
\end{proof}

Restricting $ r_p $ into the torsion subgroup of its domain gives it a stronger property as follows.

\begin{theorem}[Reduction]
$ E\rb{\Q}_{tors} \cong G $ for some $ G \le E_p\rb{\F_p} $.
\end{theorem}

\begin{proof}
Since $ Ker\rb{r_p} = E\rb{p} $, it holds that $ v_p\rb{a} \le -2 $ and $ v_p\rb{b} \le -3 $ for any point $ P = \rb{a, b} \in Ker\rb{r_p} $, so $ a, b \notin \Z $. Then the Nagell-Lutz theorem gives that $ ord\rb{P} $ is infinite, so $ P \notin E\rb{\Q}_{tors} $. Now let $ r_p' = \val{r_p}_{E\rb{\Q}_{tors}} $ and $ G = Im\rb{r_p'} $, so $ Ker\rb{r_p'} = Ker\rb{r_p} \cap E\rb{\Q}_{tors} = \cb{\mathcal{O}} $. Thus the first isomorphism theorem gives $ G \cong E\rb{\Q}_{tors} / Ker\rb{r_p'} \cong E\rb{\Q}_{tors} $.
\end{proof}

Lagrange's theorem then gives $ \abs{E\rb{\Q}_{tors}} \mid \abs{E_p\rb{\F_p}} $, which enforces a restriction of the possible torsion subgroups. The following reignites a prior example, this time with the reduction theorem.

\begin{example}
Let $ E : y^2 = x^3 + 4 $ be an elliptic curve over $ \Q $. Then $ \Delta_E = -16\rb{4\rb{0}^3 + 27\rb{4}^2} = -\rb{2}^8\rb{3}^3 $, so let $ p = 5 $ be a prime of good reduction. Then the previous section gives $ \abs{E_5\rb{\F_5}} = 6 $. Since $ \abs{E\rb{\Q}_{tors}} \mid \abs{E_5\rb{\F_5}} $, it holds that $ \abs{E\rb{\Q}_{tors}} \in \cb{1, 2, 3, 6} $. Since $ ord\rb{\rb{0, 2}} = 3 $ and there are no points $ P \in E\rb{\Q} $ such that $ ord\rb{P} = 2 $, it holds that $ E\rb{\Q}_{tors} = \cb{\mathcal{O}, \rb{0, 2}, \rb{0, -2}} \cong \Z_3 $.
\end{example}

While this might not seem much of a timesave, the following example begs to differ.

\begin{example}
Let $ E : y^2 = x^3 + 1680 $ be an elliptic curve over $ \Q $. Then $ \Delta'_E = 4\rb{0}^3 + 27\rb{1680}^2 = 3\rb{5040}^2 = \rb{2}^8\rb{3}^5\rb{5}^2\rb{7}^2 $ and $ \Delta_E = -\rb{2}^{12}\rb{3}^5\rb{5}^2\rb{7}^2 $, so $ p \ge 11 $ are primes of good reduction. Now $ 5040 $ is a \emph{colossally abundant number} with exactly $ 120 $ positive and negative divisors, so more than $ 120 $ values of $ b $ such that $ b^2 \mid \Delta'_E $ needs to be checked. Instead the previous section computes $ \abs{E_{13}\rb{\F_{13}}} = 9 $ and $ \abs{E_{19}\rb{\F_{19}}} = 28 $. Since $ \abs{E\rb{\Q}_{tors}} \mid \abs{E_{13}\rb{\F_{13}}} $ and $ \abs{E\rb{\Q}_{tors}} \mid \abs{E_{19}\rb{\F_{19}}} $, and $ \gcd\rb{9, 28} = 1 $, it holds that $ \abs{E\rb{\Q}_{tors}} = 1 $. Thus $ E\rb{\Q}_{tors} = \cb{\mathcal{O}} $.
\end{example}

Counting points over finite fields can generally be done very efficiently, so the reduction theorem allows for an immediate answer. In any case, computation of the torsion subgroup is relatively straightforward.

\pagebreak

\subsection{Mordell's theorem: descent}

The following theorem is one of the most fundamental theorems of elliptic curves over the rationals, as stated in a previous subsection.

\begin{theorem}[Mordell]
\label{thm:mordell}
The \emph{Mordell-Weil group} $ E\rb{\Q} $ is finitely generated.
\end{theorem}

\begin{remark}
This is a special case of the \emph{Mordell-Weil theorem}, which states that $ E\rb{K} $ is finitely generated over any number field $ K $.
\end{remark}

Proof of Mordell's theorem will be split into two distinct steps. The first step of the proof develops some theory of a certain function that describes the size of points. The second step of the proof is a weak variant of the theorem stating that the index of a subgroup is finite. These two steps are then used in a variant of \emph{Fermat's infinite descent}, which can be stated in full generalisation for arbitrary abelian groups as follows.

\begin{theorem}[Descent]
Let $ G $ be an abelian group such that the index $ \sb{G : 2G} $ is finite, and let $ h : G \to \R_{\ge 0} $ be such that:
\begin{itemize}
\item the set $ \cb{P \in G \mid h\rb{P} \le C_1} $ is finite for any $ C_1 \in \R_{\ge 0} $,
\item for any $ Q \in G $, there is a constant $ C_2 \in \R_{\ge 0} $ such that $ h\rb{P + Q} \le 2h\rb{P} + C_2 $ for any $ P \in G $, and
\item there is a constant $ C_3 \in \R_{\ge 0} $ such that $ h\rb{2P} \ge 4h\rb{P} - C_3 $ for any $ P \in G $.
\end{itemize}
Then $ G $ is finitely generated.
\end{theorem}

\begin{proof}
Let $ Q_1, \dots, Q_n \in G $ be representatives such that $ 2G + Q_i \in G / 2G $ are distinct cosets. For any $ P \in G $, the upper bound gives each $ h\rb{P - Q_i} \le 2h\rb{P} + C_i $ for some $ C_i \in \R_{\ge 0} $, so
$$ h\rb{P - Q_i} \le 2h\rb{P} + C, \qquad i \in \cb{1, \dots, n}, \qquad C = \max\cb{C_i} \in \R_{\ge 0}. $$
For any $ P \in G $, the lower bound also gives
$$ h\rb{2P} \ge 4h\rb{P} - C', \qquad C' \in \R_{\ge 0}. $$
Then there is a finite set
$$ S = \cb{P \in G \mid h\rb{P} \le C + C'}. $$
Now let $ P \in G $. Then $ 2G + P = 2G + Q_{i_0} $ for some $ i_0 \in \cb{1, \dots, n} $, so $ P = 2P_0 + Q_{i_0} $ for some $ P_0 \in G $. By induction, for any $ j \in \Z_{> 0} $, there is some $ i_j \in \cb{1, \dots, n} $ such that $ 2G + P_{j - 1} = 2G + Q_{i_j} $, so
$$ P_{j - 1} = 2P_j + Q_{i_j}, \qquad P = 2^{j + 1}P_j + \sum_{k = 0}^j 2^kQ_{i_k}, \qquad P_j \in G. $$
Now for any $ j \in \Z_{> 0} $,
$$ 4h\rb{P_j} \le h\rb{2P_j} + C' = h\rb{P_{j - 1} - Q_{i_j}} + C' \le 2h\rb{P_{j - 1}} + \rb{C + C'}, $$
so that
$$ h\rb{P_j} \le \tfrac{1}{2}h\rb{P_{j - 1}} + \tfrac{1}{4}\rb{C + C'} = \dfrac{3}{4}h\rb{P_{j - 1}} - \tfrac{1}{4}\rb{h\rb{P_{j - 1}} - \rb{C + C'}}. $$
If $ h\rb{P_{j - 1}} > C + C' $ for some $ j \in \Z_{> 0} $, then $ h\rb{P_j} < \dfrac{3}{4}h\rb{P_{j - 1}} $, so $ h\rb{P_m} \le C + C' $ for some $ m \in \Z_{> 0} $ such that $ m \ge j $ and $ P_m \in S $. Otherwise $ h\rb{P_{j - 1}} \le C + C' $ for all $ j \in \Z_{> 0} $, so let $ m = 1 $ such that $ P_m \in S $ as well. Hence
$$ P = 2^{m + 1}P_m + \sum_{k = 0}^m 2^kQ_{i_k} = \sum_{S_i \in S} n_iS_i + \sum_{i = 1}^n m_iQ_i, \qquad n_i, m_i \in \Z. $$
Thus $ G $ is finitely generated by $ S \cup \cb{Q_i} $.
\end{proof}

Mordell's theorem is simply an application of the general descent procedure.

\begin{proof}[Proof of Theorem \ref{thm:mordell}]
The three properties of the function $ h $ will be given in Propositions \ref{prop:finiteness}, \ref{prop:upperbound}, \ref{prop:lowerbound} of the next section. The weak version of the theorem will be given in Theorem \ref{thm:weakmordell} of the section after the next. Applying descent to $ G = E\rb{\Q} $ with $ h $ gives that $ E\rb{\Q} $ is finitely generated.
\end{proof}

The next subsections will be devoted to proving these claims.

\pagebreak

\subsection{Mordell's theorem: heights}

The function $ h $ can be defined as follows.

\begin{definition}[Height]
The \textbf{height} of a point $ P \in E\rb{\Q} $ is a function $ h\rb{P} : E\rb{\Q} \to \R_{\ge 0} $ defined by $ h\rb{P} = \log_2\rb{H\rb{P}} $, where
$$ H\rb{P} = \begin{dcases} \max\cb{\abs{p}, \abs{q}} & P = \rb{\dfrac{p}{q}, y}, \ \gcd\rb{p, q} = 1 \\ 1 & P = \mathcal{O} \end{dcases}. $$
\end{definition}

\begin{remark}
The above definition for heights is chosen due to its simplicity, and is not the \emph{canonical height} in the general literature. The theory of height functions will not be discussed here.
\end{remark}

The three intended properties of height function will then be proven, the first of which states that there are a finite number of points less than a given height. This property is trivial and stated as follows.

\begin{proposition}
\label{prop:finiteness}
The set $ S = \cb{P \in E\rb{\Q} \mid h\rb{P} \le C_1} $ is finite for any $ C_1 \in \R_{\ge 0} $.
\end{proposition}

\begin{proof}
Let $ C_1 \in \R_{\ge 0} $ and $ P \in E\rb{\Q} $ be a point. If $ P = \mathcal{O} $, then $ P \in S $. Otherwise $ P = \rb{p / q, y} $, then $ \max\cb{\abs{p}, \abs{q}} \le 2^{C_1} $, so $ -2^{C_1} \le p, q \le 2^{C_1} $. Thus $ \abs{S} \le \rb{2^{C_1 + 1} + 1}^2 + 1 $ is finite.
\end{proof}

The second property provides an upper bound for the height of added points. This is relatively easy and is stated in the following proposition.

\begin{proposition}
\label{prop:upperbound}
Let $ Q \in E\rb{\Q} $. Then there is a constant $ C_2 \in \R_{\ge 0} $ such that $ h\rb{P + Q} \le 2h\rb{P} + C_2 $ for any $ P \in E\rb{\Q} $.
\end{proposition}

\begin{proof}
If $ P = \mathcal{O} $ or $ Q = \mathcal{O} $ or $ P + Q = \mathcal{O} $, let $ C_2 = 2h\rb{Q} $ such that $ h\rb{P + Q} \le 2h\rb{P} + 2h\rb{Q} $. Otherwise $ P = \rb{a, b} $ and $ Q = \rb{a', b'} $ for $ a \ne a' $ or $ a = a' $ and $ b = b' \ne 0 $. Assume that $ a = a' $ and $ b = b' \ne 0 $, then let $ C_2 = h\rb{2Q} $ such that $ h\rb{P + Q} = h\rb{2Q} \le 2h\rb{P} + h\rb{2Q} $. Assume otherwise that $ a \ne a' $, and let $ C_2 = \log_2\rb{\max\cb{K_3, K_2}} $, where
$$ K_1 = \sqrt{1 + \abs{A} + \abs{B}}, \qquad K_2 = 1 + \abs{a'}, \qquad K_3 = \rb{\abs{A} + \abs{a'}}K_2 + 2\rb{\abs{B} + \abs{b'}K_1}. $$
Then $ a = p / d^2 $ and $ b = q / d^3 $ for some $ p, q \in \Z $ and some $ d \in \Z_{> 0} $ such that $ \gcd\rb{p, d} = \gcd\rb{q, d} = 1 $, and $ q^2 = p^3 + Apd^4 + Bd^6 $. Since $ H\rb{P} = \max\cb{\abs{p}, \abs{d}^2} $, it holds that $ \abs{p}, \abs{d}^2 \le H\rb{P} $, so $ \abs{d} \le \sqrt{H\rb{P}} $ and
$$ \abs{q}\abs{d} = \abs{\sqrt{p^3 + Apd^4 + Bd^6}}\abs{d} \le \sqrt{\abs{p}^3\abs{d}^2 + \abs{A}\abs{p}\abs{d}^6 + \abs{B}\abs{d}^8} \le K_1H\rb{P}^2. $$
Now let $ P + Q = \rb{a'', b''} $. By the addition formula,
$$ a'' = \dfrac{\rb{A + aa'}\rb{a + a'} + 2\rb{B - bb'}}{\rb{a - a'}^2} = \dfrac{\rb{Ad^2 + a'p}\rb{p + a'd^2} + 2\rb{Bd^4 - b'qd}}{\rb{p - a'd^2}^2}. $$
Thus
\begin{align*}
h\rb{P + Q}
& \le \log_2\rb{\max\cb{\abs{\rb{Ad^2 + a'p}\rb{p + a'd^2} + 2\rb{Bd^4 - b'qd}}, \abs{\rb{p - a'd^2}^2}}} \\
& \le \log_2\rb{\max\cb{\rb{\abs{A}\abs{d}^2 + \abs{a'}\abs{p}}\rb{\abs{p} + \abs{a'}\abs{d}^2} + 2\rb{\abs{B}\abs{d}^4 + \abs{b'}\abs{q}\abs{d}}, \rb{\abs{p} + \abs{a'}\abs{d}^2}^2}} \\
& \le \log_2\rb{\max\cb{K_3H\rb{P}^2, K_2H\rb{P}^2}}
= \log_2\rb{H\rb{P}^2\max\cb{K_3, K_2}}
= 2h\rb{P} + C_2.
\end{align*}
\end{proof}

\pagebreak

The third property provides an lower bound for the height of doubled points. It is more difficult as it involves seemingly arbitrary identities, and is stated in the following proposition.

\begin{proposition}
\label{prop:lowerbound}
There is a constant $ C_3 \in \R_{\ge 0} $ such that $ h\rb{2P} \ge 4h\rb{P} - C_3 $ for any $ P \in E\rb{\Q} $.
\end{proposition}

\begin{proof}
If $ P = \mathcal{O} $, let $ C_3 = 0 $ such that $ h\rb{2P} \ge 4h\rb{P} $. If $ P = \rb{a, 0} $, let $ C_3 = 4h\rb{P} $ such that $ h\rb{2P} \ge 0 $. Otherwise $ P = \rb{a, b} $ for $ b \ne 0 $. Let $ a = p / q $ for some $ p \in \Z $ and some $ q \in \Z^* $ such that $ \gcd\rb{p, q} = 1 $, and let
\begin{align*}
p' & = p^4 - 2Ap^2q^2 - 8Bpq^3 + A^2q^4, \\
q' & = 4p^3q + 4Apq^3 + 4Bq^4, \\
\lambda & = 12p^2q + 16Aq^3, \\
\mu & = -3p^3 + 5Apq^2 + 27Bq^3, \\
\lambda' & = \rb{16A^3 + 108B^2}p^3 - 4A^2Bp^2q + \rb{12A^4 + 88AB^2}pq^2 + \rb{12A^3B + 96B^3}q^3, \\
\mu' & = A^2Bp^3 + \rb{5A^4 + 32AB^2}p^2q + \rb{26A^3B + 192B^3}pq^2 - \rb{3A^5 + 24A^2B^2}q^3, \\
K_1 & = 4\max\cb{12, 16\abs{A}}, \\
K_2 & = 4\max\cb{3, 5\abs{A}, 27\abs{B}}, \\
K_3 & = 4\max\cb{16\abs{A}^3 + 108B^2, 4A^2\abs{B}, 12A^4 + 88\abs{A}B^2, 12\abs{A}^3\abs{B} + 96\abs{B}^3}, \\
K_4 & = 4\max\cb{A^2\abs{B}, 5A^4 + 32\abs{A}B^2, 26\abs{A}^3\abs{B} + 192\abs{B}^3, 3\abs{A}^5 + 24A^2B^2}.
\end{align*}
Then it can be tediously verified that $ \lambda p' + \mu q' = 4\Delta'_E q^7 $ and $ \lambda' p' + \mu' q' = 4\Delta'_E p^7 $. Since $ \abs{p}^2\abs{q} $ and $ \abs{p}\abs{q}^2 $ are between $ \abs{p}^3 $ and $ \abs{q}^3 $, it holds that $ \max\cb{\abs{p}^3, \abs{p}^2\abs{q}, \abs{p}\abs{q}^2, \abs{q}^3} = \max\cb{\abs{p}^3, \abs{q}^3} $. Then it can also be verified that
$$ \abs{\lambda} \le K_1M, \qquad \abs{\mu} \le K_2M, \qquad \abs{\lambda'} \le K_3M, \qquad \abs{\mu'} \le K_4M, $$
for $ M = \max\cb{\abs{p}^3, \abs{q}^3} $, so let $ C_3 = \log_2\rb{2\max\cb{K_1, K_2, K_3, K_4}} $. Since
\begin{align*}
4\abs{\Delta'_E}\max\cb{\abs{p}^3, \abs{q}^3}\rb{\max\cb{\abs{p}, \abs{q}}}^4
& = 4\abs{\Delta'_E}\max\cb{\abs{q}^7, \abs{p}^7}
= \max\cb{\abs{4\Delta'_E q^7}, \abs{4\Delta'_E p^7}} \\
& \le \max\cb{\abs{\lambda}\abs{p'} + \abs{\mu}\abs{q'}, \abs{\lambda'}\abs{p'} + \abs{\mu'}\abs{q'}} \\
& \le 2\max\cb{\abs{\lambda}, \abs{\mu}, \abs{\lambda'}, \abs{\mu'}}\max\cb{\abs{p'}, \abs{q'}} \\
& \le 2M\max\cb{K_1, K_2, K_3, K_4}\max\cb{\abs{p'}, \abs{q'}},
\end{align*}
it holds that
$$ 4\abs{\Delta'_E}H\rb{P}^4 = 4\abs{\Delta'_E}\rb{\max\cb{\abs{p}, \abs{q}}}^4 \le 2\max\cb{K_1, K_2, K_3, K_4}\max\cb{\abs{p'}, \abs{q'}}. $$
Now let $ 2P = \rb{a', b'} $. By the duplication formula,
$$ a' = \dfrac{a^4 - 2Aa^2 - 8Ba + A^2}{4b^2} = \dfrac{a^4 - 2Aa^2 - 8Ba + A^2}{4a^3 + 4Aa + 4B} = \dfrac{p'}{q'}. $$
Since $ g = \gcd\rb{p', q'} \mid \gcd\rb{4\Delta'_E p^7, 4\Delta'_E q^7} = 4\Delta'_E $, it holds that $ 1 \le \abs{g} \le 4\abs{\Delta'_E} $. Thus
\begin{align*}
h\rb{2P}
& = \log_2\rb{\max\cb{\abs{\dfrac{p'}{g}}, \abs{\dfrac{q'}{g}}}}
= \log_2\rb{\dfrac{\max\cb{\abs{p'}, \abs{q'}}}{\abs{g}}} \\
& \ge \log_2\rb{\dfrac{\max\cb{\abs{p'}, \abs{q'}}}{4\abs{\Delta'_E}}}
\ge \log_2\rb{\dfrac{H\rb{P}^4}{2\max\cb{K_1, K_2, K_3, K_4}}}
\ge 4h\rb{P} - C_3.
\end{align*}
\end{proof}

The properties of the height function $ h $ are now verified.

\pagebreak

\subsection{Mordell's theorem: weak Mordell}

The weak version of Mordell's theorem, restricted to $ \Q $, states that the index of the normal subgroup $ 2E\rb{\Q} = \cb{2P \mid P \in E\rb{\Q}} $ is finite.

\begin{theorem}[Weak Mordell]
\label{thm:weakmordell}
$ \abs{E\rb{\Q} : 2E\rb{\Q}} $ is finite.
\end{theorem}

As full proofs of the weak theorem, such as in VIII.1 of \cite{gtm}, requires further prerequisites on algebraic number theory, particularly finiteness of the \emph{ideal class group} of number fields, only an alternative proof is given, of which the special case of a rational $ 2 $-torsion point $ \rb{a_0, 0} $ is assumed. Since there is a $ j $-invariant affine transformation $ \rb{x, y} \mapsto \rb{x + a_0, y} $, there is an isomorphism from $ E $ to the curve given by the Weierstrass equation
$$ y^2 = \rb{x + a_0}^3 + A\rb{x + a_0} + B \qquad \implies \qquad y^2 = x^3 + 3a_0x^2 + \rb{3a_0^2 + A}x. $$
Hence for this subsection and the next, assume without loss of generality that $ a_0 = 0 $ and
$$ T = \rb{a_0, 0} = \rb{0, 0} \in E : y^2 = x^3 + Ax^2 + Bx, \qquad A, B \in \Z. $$
The modified discriminant and group law is then given in the following lemma.

\begin{lemma}
The following properties hold:
\begin{enumerate}
\item $ B \ne 0 $ and $ A^2 - 4B \ne 0 $.
\item Let $ P = \rb{a, b} \in E\rb{\Q} $ and $ Q = \rb{a', b'} \in E\rb{\Q} $ be points such that $ a \ne a' $ and $ P + Q = \rb{a'', b''} \in E\rb{\Q} $. Then $ aa'a'' = \mu^2 $ for some $ \mu \in \Q $.
\item Let $ P = \rb{a, b} \in E\rb{\Q} $ be a point such that $ b \ne 0 $. Then
$$ 2P = \rb{\dfrac{\rb{a^2 - B}^2}{4b^2}, \dfrac{\rb{a^2 - B}\rb{a^4 + B^2 + 2Aa^3 + 2ABa + 6Ba^2}}{8b^3}} \in E\rb{\Q}. $$
\end{enumerate}
\end{lemma}

\begin{proof}
The negation formula remains unmodified, so $ -\rb{a, b} = \rb{a, -b} $ for any point $ \rb{a, b} \in E $.
\begin{enumerate}
\item Since $ E $ is smooth and the discriminant is
$$ \Delta_E = 9\rb{4A}\rb{2B}\rb{0} - \tfrac{1}{4}\rb{4A}^2\rb{\rb{4A}\rb{0} - \rb{2B}^2} - 8\rb{2B}^3 - 27\rb{0}^2 = 16B^2\rb{A^2 - 4B}, $$
$ 16B^2\rb{A^2 - 4B} \ne 0 $. Thus $ B \ne 0 $ and $ A^2 - 4B \ne 0 $.
\item The line joining $ P $ and $ Q $ is
$$ L : y = \lambda x + \mu, \qquad \lambda = \dfrac{b - b'}{a - a'}, \qquad \mu = \dfrac{ab' - a'b}{a - a'}, $$
which intersects $ E $ at $ x^3 - \rb{\lambda^2 - A}x^2 + \rb{B - 2\lambda\mu}x - \mu^2 = 0 $. Let $ P * Q = -\rb{P + Q} = \rb{a'', -b''} $. Thus comparing coefficients gives $ \mu^2 = aa'a'' $.
\item The tangent at $ P $ is
$$ L : y = \lambda x + \mu, \qquad \lambda = \dfrac{3a^2 + 2Aa + B}{2b}, \qquad \mu = \dfrac{b^2 - Aa^2 - 2Ba}{2b}, $$
which intersects $ E $ at $ x^3 - \rb{\lambda^2 - A}x^2 + \rb{B - 2\lambda\mu}x - \mu^2 = 0 $. Let $ P * P = -2P = \rb{a', -b'} $, so comparing coefficients gives $ \lambda^2 - A = 2a + a' $. Thus
$$ 2P = \rb{\lambda^2 - A - 2a, \mu - \lambda\rb{\lambda^2 - A - 2a}} \in E\rb{\Q}. $$
\end{enumerate}
\end{proof}

The above proof is brief but can be verified manually. Let a related curve be
$$ E' : y^2 = x^3 + A'x^2 + B'x, \qquad A' = -2A, \qquad B' = A^2 - 4B, $$
such that $ T \in E' $ and $ B' \ne 0 $. Then $ A'^2 - 4B' = \rb{-2A}^2 - 4\rb{A^2 - 4B} = 16B $, and the group law is similar to that of $ E $ but with $ A' $ and $ B' $ instead of $ A $ and $ B $. Now let the two maps $ \phi : E \to E' $ and $ \psi : E' \to E $ be defined by
$$ \phi\rb{P} = \begin{dcases} \rb{\dfrac{b^2}{a^2}, \dfrac{b\rb{a^2 - B}}{a^2}} & P = \rb{a, b} \ne T \\ \mathcal{O} & P \in \cb{\mathcal{O}, T} \end{dcases}, \qquad \psi\rb{P} = \begin{dcases} \rb{\dfrac{b^2}{4a^2}, \dfrac{b\rb{a^2 - B'}}{8a^2}} & P = \rb{a, b} \ne T \\ \mathcal{O} & P \in \cb{\mathcal{O}, T} \end{dcases}. $$
These two maps are related in the obvious way, where one can be seen as the scaling of the other. They also relate the two elliptic curves, as seen in the following lemma.

\begin{lemma}
$ \phi : E \to E' $ and $ \psi : E' \to E $ are isogenies such that $ \psi \circ \phi = \sb{2}_E $ and $ \phi \circ \psi = \sb{2}_{E'} $.
\end{lemma}

\begin{remark}
Preserving the point at infinity induces a group homomorphism, but the full property can be tediously verified in III.4 of \cite{utm} for each case of the group law.
\end{remark}

\begin{proof}
For any point $ P = \rb{a, b} \in E $,
$$ \rb{\dfrac{b^2}{a^2}}^3 + A'\rb{\dfrac{b^2}{a^2}}^2 + B'\dfrac{b^2}{a^2}
= \dfrac{b^2}{a^4}\rb{\dfrac{\rb{b^2 - Aa^2}^2 - 4Ba^4}{a^2}}
= \dfrac{b^2}{a^4}\rb{\dfrac{\rb{a^3 + Ba}^2 - 4Ba^4}{a^2}}
= \rb{\dfrac{b\rb{a^2 - B}}{a^2}}^2, $$
so $ \phi\rb{P} \in E' $. Since $ \phi\rb{T} = \phi\rb{\mathcal{O}} = \mathcal{O} $, it holds that $ \phi $ is a well-defined non-constant morphism, and hence an isogeny. Since $ \psi $ can be seen as applying $ \chi \circ \phi $ to $ E $, where $ \chi $ is the $ j $-invariant affine transformation $ \rb{x, y} \mapsto \rb{x / 4, y / 8} $, it is also a well-defined non-constant morphism, and hence an isogeny. Now let $ P \in E $. If $ P = \mathcal{O} $ or $ P = \rb{a, 0} $, then $ \rb{\psi \circ \phi}\rb{P} = \mathcal{O} = 2P $. Otherwise $ P = \rb{a, b} $ such that $ a \ne 0 $ and $ b \ne 0 $, then
\begin{align*}
\rb{\psi \circ \phi}\rb{P}
& = \rb{\dfrac{\rb{b\rb{a^2 - B} / a^2}^2}{4\rb{b^2 / a^2}^2}, \dfrac{\rb{b\rb{a^2 - B} / a^2}\rb{\rb{b^2 / a^2}^2 - B'}}{8\rb{b^2 / a^2}^2}} \\
& = \rb{\dfrac{\rb{a^2 - B}^2}{4b^2}, \dfrac{\rb{a^2 - B}\rb{b^4 - \rb{A^2 - 4B}a^4}}{8b^3a^2}} \\
& = \rb{\dfrac{\rb{a^2 - B}^2}{4b^2}, \dfrac{\rb{a^2 - B}\rb{a^4 + B^2 + 2Aa^3 + 2ABa + 6Ba^2}}{8b^3}} = 2P.
\end{align*}
Hence $ \psi \circ \phi = \sb{2}_E $. Similarly let $ P' \in E' $. If $ P' = \mathcal{O} $ or $ P' = \rb{a, 0} $, then $ \rb{\phi \circ \psi}\rb{P'} = \mathcal{O} = 2P' $. Otherwise $ P' = \rb{a, b} $ such that $ a \ne 0 $ and $ b \ne 0 $, then
\begin{align*}
\rb{\phi \circ \psi}\rb{P'}
& = \rb{\dfrac{\rb{b\rb{a^2 - B'} / 8a^2}^2}{\rb{b^2 / 4a^2}^2}, \dfrac{\rb{b\rb{a^2 - B'} / 8a^2}\rb{\rb{b^2 / 4a^2}^2 - B}}{\rb{b^2 / 4a^2}^2}} \\
& = \rb{\dfrac{\rb{a^2 - B'}^2}{4b^2}, \dfrac{\rb{a^2 - B'}\rb{b^4 - 16\rb{\rb{A'^2 - 4B'} / 16}a^4}}{8b^3a^2}} \\
& = \rb{\dfrac{\rb{a^2 - B'}^2}{4b^2}, \dfrac{\rb{a^2 - B'}\rb{a^4 + B'^2 + 2A'a^3 + 2A'B'a + 6B'a^2}}{8b^3}} = 2P'.
\end{align*}
Thus $ \phi \circ \psi = \sb{2}_{E'} $.
\end{proof}

Hence the multiplication by $ 2 $ map can be decomposed into two isogenies $ \phi $ and $ \psi $. As only the image of these isogenies will be used, their standard forms will not be used to prevent confusion.

\begin{remark}
These two isogenies are \emph{dual isogenies} to each other. Any isogeny of degree $ n \in \Z_{> 0} $ has a dual isogeny, which composes with it to give two multiplication by $ n $ maps in their respective domains.
\end{remark}

\pagebreak

The image of the isogeny $ \psi $ depends on whether $ B $ is a perfect square or whether $ x $ coordinates are in the normal subgroup $ \rb{\Q^*}^2 = \cb{q^2 \mid q \in \Q^*} $. In particular, the equation $ x^3 + A'x + B' = 0 $ with discriminant $ 16\rb{A'^2 - 4B'} = 16B $ has two solutions in $ \Q^* $ iff $ 16B \in \rb{\Z^*}^2 $, or $ B \in \rb{\Z^*}^2 $, stated as follows.

\begin{lemma}
The image $ Im\rb{\psi} $ is such that:
\begin{itemize}
\item $ \mathcal{O} \in Im\rb{\psi} $,
\item $ T \in Im\rb{\psi} $ iff $ B \in \rb{\Z^*}^2 $, and
\item $ \rb{a, b} \ne T \in Im\rb{\psi} $ iff $ a \in \rb{\Q^*}^2 $.
\end{itemize}
\end{lemma}

\begin{proof}
Since $ \psi\rb{\mathcal{O}} = \mathcal{O} $, it holds that $ \mathcal{O} \in Im\rb{\psi} $. Now $ T \in Im\rb{\psi} $ iff there is a point $ P = \rb{a, b} \in E'\rb{\Q} $ such that $ \psi\rb{P} = T $ and $ 0 = b^2 / 4a^2 $. This holds iff $ a \in \Q^* $ and $ b = 0 $, or $ B \in \rb{\Z^*}^2 $. Now assume that $ P = \rb{a, b} \ne T \in Im\rb{\psi} $. Then there is a point $ Q = \rb{a', b'} \in E'\rb{\Q} $ such that $ \psi\rb{Q} = P $, so $ a = b'^2 / 4a'^2 = \rb{b' / 2a}^2 \in \rb{\Q^*}^2 $. Conversely assume that $ P = \rb{a, b} \ne T \in E\rb{\Q} $ and $ a \in \rb{\Q^*}^2 $. Then $ a = c^2 $ for some $ c \in \Q^* $, so
$$ b^2 = c^6 - \dfrac{A'c^4}{2} + \dfrac{A'^2 - 4B'}{16}c^2 \qquad \implies \qquad B' = \rb{2c^2 - \dfrac{A'}{2} + \dfrac{2b}{c}}\rb{2c^2 - \dfrac{A'}{2} - \dfrac{2b}{c}}. $$
Now let $ Q = \rb{a', b'} $, where $ a' = 2c^2 - A' / 2 + 2b / c $ and $ b' = 2a'c $, such that $ B' = a'\rb{a' - 4b / c} $. Then
$$ a'^3 + A'a'^2 + B'a' = a'^3 + A'a'^2 + a'^2\rb{a' - \dfrac{2b}{c}} = 2a'^2\rb{a' + \dfrac{A'}{2} - \dfrac{4b}{c}} = 4a'^2c^2 = b'^2, $$
so $ Q \in E'\rb{\Q} $, and
$$ \psi\rb{Q} = \rb{\dfrac{b'^2}{4a'^2}, \dfrac{b'\rb{a'^2 - B'}}{8a'^2}} = \rb{\dfrac{4a'^2c^2}{4a'^2}, \dfrac{2a'c\rb{a'^2 - a'\rb{a' - 4b / c}}}{8a'^2}} = \rb{c^2, \dfrac{c\rb{4a'b / c}}{4a'}} = \rb{a, b} = P. $$
Thus $ P \in Im\rb{\psi} $.
\end{proof}

The image of the isogeny $ \phi $ can be characterised analogously, and will not be explicitly stated here. Now let another map be defined as
$$ \alpha : E\rb{\Q} \to \Q^* / \rb{\Q^*}^2, \qquad \alpha\rb{P} = \begin{cases} \rb{\Q^*}^2a & P = \rb{a, b} \ne T \\ \rb{\Q^*}^2B & P = T \\ \rb{\Q^*}^2 & P = \mathcal{O} \end{cases}. $$
Then $ \psi $ and $ \alpha $ induce an \emph{exact sequence} $ E'\rb{\Q} \xrightarrow{\psi} E\rb{\Q} \xrightarrow{\alpha} \Q^* / \rb{\Q^*}^2 $, which can be stated more concretely in the following lemma.

\begin{lemma}
$ \alpha : E\rb{\Q} \to \Q^* / \rb{\Q^*}^2 $ is a group homomorphism such that $ Im\rb{\psi} = Ker\rb{\alpha} $.
\end{lemma}

\begin{proof}
Let $ P, Q \in E\rb{\Q} $ be points. If $ P = \mathcal{O} $,
$$ \alpha\rb{P}\alpha\rb{Q} = \rb{\Q^*}^2\alpha\rb{Q} = \alpha\rb{Q} = \alpha\rb{P + Q}, $$
or similar for $ Q = \mathcal{O} $. If $ P = \rb{a, b} $ and $ Q = \rb{a', b'} $ such that $ a \ne a' $ and $ P + Q = \rb{a'', b''} \in E\rb{\Q} $, then
$$ \alpha\rb{P}\alpha\rb{Q} = \rb{\Q^*}^2a\rb{\Q^*}^2a' = \rb{\Q^*}^2aa' = \rb{\Q^*}^2\dfrac{\mu^2}{a''} = \rb{\Q^*}^2\mu^2a'' = \rb{\Q^*}^2a'' = \alpha\rb{P + Q}. $$
Otherwise $ P = \rb{a, b} $ and $ Q = \rb{a, b'} $, then
$$ \alpha\rb{P}\alpha\rb{Q} = \rb{\Q^*}^2a\rb{\Q^*}^2a = \rb{\Q^*}^2a^2 = \rb{\Q^*}^2 = \rb{\Q^*}^2\dfrac{\rb{a^2 - B}^2}{4b^2} = \alpha\rb{P + Q}. $$
Hence $ \alpha $ is a group homomorphism. Now $ \mathcal{O} \in Ker\rb{\alpha} $, the point $ T \in Ker\rb{\alpha} $ iff $ B \in \rb{\Q^*}^2 $, and a point $ \rb{a, b} \ne T \in Ker\rb{\alpha} $ iff $ a \in \rb{\Q^*}^2 $. Thus $ Im\rb{\psi} = Ker\rb{\alpha} $.
\end{proof}

The image of the group homomorphism $ \alpha $ can again be characterised, as being contained in a finite subgroup of $ \Q^* / \rb{\Q^*}^2 $. Now let $ S\rb{B} $ be the set of primes $ p \in \Z_{> 0} $ such that $ p \mid B $, and let
$$ G\rb{B} = \cb{\rb{\Q^*}^2\rb{\prod_{p \in S} p} \ \Bigg| \ S \subseteq S\rb{B}} \cup \cb{\rb{\Q^*}^2\rb{-\prod_{p \in S} p} \ \Bigg| \ S \subseteq S\rb{B}}. $$
Recalling the fact that for any point $ \rb{a, b} \in E\rb{\Q} $,
$$ a = p / d^2, \qquad b = q / d^3, \qquad p, q \in \Z, \qquad d \in \Z_{> 0}, $$ such that $ \gcd\rb{p, d} = \gcd\rb{q, d} = 1 $, the following lemma characterises $ \alpha $.

\begin{lemma}
$ G\rb{B} $ is a group such that $ \abs{G\rb{B}} = 2^{\abs{S\rb{B}} + 1} $ and $ Im\rb{\alpha} \le G\rb{B} \le \Q^* / \rb{\Q^*}^2 $.
\end{lemma}

\begin{proof}
Since $ \emptyset \subseteq S\rb{B} $, it holds that $ \rb{\Q^*}^2 \in G\rb{B} $. Let $ a, b \in G\rb{B} $. Then
$$ a = \rb{\Q^*}^2 j p_1 \dots p_n p'_1 \dots p'_{n'}, \qquad b = \rb{\Q^*}^2 j' p_1 \dots p_n p''_1 \dots p''_{n''} $$
for some $ j, j' \in \cb{-1, 1} $ and some distinct primes $ p_i, p'_i, p''_i \in S\rb{B} $, so
$$ \dfrac{a}{b} = \dfrac{\rb{\Q^*}^2 j p_1 \dots p_n p'_1 \dots p'_{n'}}{\rb{\Q^*}^2 j' p_1 \dots p_n p''_1 \dots p''_{n''}} = \rb{\Q^*}^2\dfrac{j p'_1 \dots p'_{n'}}{j' p''_1 \dots p''_{n''}} = \rb{\Q^*}^2 j j' p'_1 \dots p'_{n'} p''_1 \dots p''_{n''} \in G\rb{B}. $$
Hence $ G\rb{B} \le \Q^* / \rb{\Q^*}^2 $ and $ \abs{G\rb{B}} = 2^{\abs{S\rb{B}}} + 2^{\abs{S\rb{B}}} = 2^{\abs{S\rb{B}} + 1} $. Now let $ P \in E\rb{\Q} $ be a point. If $ P = \mathcal{O} $, then $ \alpha\rb{P} = \rb{\Q^*}^2 \in G\rb{B} $. If $ P = T $, then $ \alpha\rb{P} = \rb{\Q^*}^2B \in G\rb{B} $. Otherwise $ P = \rb{a, b} \ne T $, then $ a = r / d^2 $ and $ b = s / d^3 $ for some $ r, s \in \Z $ and some $ d \in \Z_{> 0} $ such that $ \gcd\rb{r, d} = \gcd\rb{s, d} = 1 $ and $ s^2 = r^3 + Ar^2d^2 + Brd^4 = r\rb{r^2 + Ard^2 + Bd^4} $. Let $ g = \gcd\rb{r, r^2 + Ard^2 + Bd^4} $, then $ r = cg $ and $ r^2 + Ard^2 + Bd^4 = c'g $ for some $ c, c' \in \Z_{\ge 0} $ such that $ \gcd\rb{c, c'} = 1 $. Since $ s^2 = \rb{cg}\rb{c'g} = cc'g^2 $, it holds that $ \rb{s / g}^2 = cc' $, so $ c = k q_1^2 \cdots q_m^2 $ for some $ k \in \cb{-1, 1} $ and some primes $ q_i \in \Z_{> 0} $. Since $ g \mid r $ and $ g \mid Bd^4 $, it also holds that $ g \mid B $, so $ g = k' q'_1 \dots q'_{m'} $ for some $ k' \in \cb{-1, 1} $ and some primes $ q'_i \in \Z_{> 0} $ such that $ q'_i \mid B $, and hence $ q'_i \in S\rb{B} $. Hence
$$ \alpha\rb{P} = \rb{\Q^*}^2a = \rb{\Q^*}^2\dfrac{r}{d^2} = \rb{\Q^*}^2\dfrac{k k' q_1^2 \cdots q_m^2 q'_1 \dots q'_{m'}}{d^2} = \rb{\Q^*}^2 k k' q'_1 \dots q'_{m'} \in G\rb{B}. $$
Thus $ Im\rb{\alpha} \le G\rb{B} $.
\end{proof}

A similar group homomorphism $ \alpha' : E'\rb{\Q} \to \Q^* / \rb{\Q^*}^2 $ can again be characterised analogously, and will not be explicitly stated here. The weak theorem can then be proven here, for the special case of a rational $ 2 $-torsion point.

\begin{proof}[Proof of Theorem \ref{thm:weakmordell}]
The first isomorphism theorem with the preceding lemmas give two inclusions
$$ \dfrac{E\rb{\Q}}{Im\rb{\psi}} = \dfrac{E\rb{\Q}}{Ker\rb{\alpha}} \cong Im\rb{\alpha} \le G\rb{B}, \qquad \dfrac{E'\rb{\Q}}{Im\rb{\phi}} = \dfrac{E'\rb{\Q}}{Ker\rb{\alpha'}} \cong Im\rb{\alpha'} \le G\rb{B'}, $$
which give finite indices
$$ n = \abs{E\rb{\Q} : Im\rb{\psi}} \le \abs{G\rb{B}} = 2^{\abs{S\rb{B}} + 1}, \qquad m = \abs{E'\rb{\Q} : Im\rb{\phi}} \le \abs{G\rb{B'}} = 2^{\abs{S\rb{B'}} + 1}. $$
Let $ P_1, \dots, P_n \in E\rb{\Q} $ be representative points such that $ Im\rb{\psi} + P_i \in E\rb{\Q} / Im\rb{\psi} $ are distinct cosets, and let $ Q_1, \dots, Q_m \in E'\rb{\Q} $ be representative points such that $ Im\rb{\phi} + Q_i \in E'\rb{\Q} / Im\rb{\phi} $ are distinct cosets. Now let $ P \in E\rb{\Q} $ be a point. Then $ Im\rb{\psi} + P = Im\rb{\psi} + P_j $ for some $ j \in \cb{1, \dots, n} $, so $ P = \psi\rb{Q} + P_j $ for some $ Q \in E'\rb{\Q} $ and $ \psi\rb{Q} \in Im\rb{\psi} $. Similarly $ Im\rb{\phi} + Q = Im\rb{\phi} + Q_k $ for some $ k \in \cb{1, \dots, m} $, so $ Q = \phi\rb{P'} + Q_k $ for some $ P' \in E\rb{\Q} $ and $ \phi\rb{P'} \in Im\rb{\phi} $. Hence
$$ P = \psi\rb{Q} + P_j = \psi\rb{\phi\rb{P'} + Q_k} + P_j = \psi\rb{\phi\rb{P'}} + \psi\rb{Q_k} + P_j \in 2E\rb{\Q} + \psi\rb{Q_k} + P_j, $$
and $ \psi\rb{Q_k} + P_j \in E\rb{\Q} $ represent all cosets in $ E\rb{\Q} / 2E\rb{\Q} $. Thus
$$ \abs{E\rb{\Q} : 2E\rb{\Q}} \le nm = 2^{\rb{\abs{S\rb{B}} + 1}\rb{\abs{S\rb{B'}} + 1}} $$
is finite.
\end{proof}

The proof of Mordell's theorem is now complete.

\pagebreak

\subsection{Rank computation}

A direct application of Mordell's theorem would be the fundamental theorem of finite abelian groups,
$$ E\rb{\Q} \cong \Z^r \oplus \bigoplus_{i = 1}^m \Z_{n_i}, \qquad r, m \in \Z_{\ge 0}, \qquad n_i \in \Z_{> 1}, $$
such that each $ n_i \mid n_{i + 1} $. Thus for any point $ P \in E\rb{\Q} $,
$$ P = \sum_{i = 1}^r r_iP_i + \sum_{i = 1}^m m_iQ_i, \qquad r_i \in \Z, \qquad m_i \in \Z_{n_i}, \qquad P_i, Q_i \in E\rb{\Q}. $$
While the torsion subgroup can be easily computed, the rank $ r $ is generally difficult to compute, and can only be made slightly easier with Mordell's theorem. Noting that $ \bigoplus_i \rb{G_i / H_i} \cong \rb{\bigoplus_i G_i} / \rb{\bigoplus_i H_i} $ for any groups $ G_i, H_i $, the following proposition gives a direct formula for the rank.

\begin{proposition}
The rank $ r = rk\rb{E\rb{\Q}} $ is such that
$$ 2^r = \tfrac{1}{4}\abs{Im\rb{\alpha}}\abs{Im\rb{\alpha'}}. $$
\end{proposition}

\begin{proof}
The fundamental theorem of finite abelian groups gives
$$ \dfrac{E\rb{\Q}}{2E\rb{\Q}} \cong \dfrac{\Z^r \oplus \bigoplus_{i = 1}^m \Z_{n_i}}{r2\Z \oplus \bigoplus_{i = 1}^m 2\Z_{n_i}} \cong r\rb{\dfrac{\Z}{2\Z}} \oplus \bigoplus_{i = 1}^m \dfrac{\Z_{n_i}}{2\Z_{n_i}}. $$
Then $ \Z / 2\Z \cong \Z_2 $. If $ n_i \nmid 2 $, then $ 2^{-1} \in \Z_{n_i} $, so $ \Z_{n_i} \cong 2\Z_{n_i} $ and $ \Z_{n_i} / 2\Z_{n_i} \cong 0 $, otherwise $ n_i \mid 2 $. Now $ P \in E\rb{\Q}\sb{2} $ iff $ 2P = 0 $, or each $ r_i = 0 $ and each $ 2m_i = 0 \mod n_i $, which holds iff $ m_i = 0 $ or $ n_i \mid 2 $, so $ E\rb{\Q}\sb{2} = \bigoplus_{n_i \mid 2} \Z_{n_i} $. Hence
$$ \dfrac{E\rb{\Q}}{2E\rb{\Q}} \cong \Z^r_2 \oplus E\rb{\Q}\sb{2} \qquad \implies \qquad \abs{E\rb{\Q} : 2E\rb{\Q}} = 2^r\abs{E\rb{\Q}\sb{2}}. $$
Now let $ \theta : E'\rb{\Q} \to Im\rb{\psi} / 2E\rb{\Q} $ be a surjective group homomorphism defined by $ \theta\rb{P} = 2E\rb{\Q} + \psi\rb{P} $. Then $ P \in Ker\rb{\theta} $ iff $ \psi\rb{P} \in 2E\rb{\Q} $, or $ \psi\rb{P} = \psi\rb{\phi\rb{Q}} $ for some $ Q \in E\rb{\Q} $. This holds iff $ \psi\rb{P - \phi\rb{Q}} = 0 $, or $ P - \phi\rb{Q} \in Ker\rb{\psi} $ and $ P \in Ker\rb{\psi} + Im\rb{\phi} $. Then the three isomorphism theorems with $ Ker\rb{\theta} = Ker\rb{\psi} + Im\rb{\phi} $ give
$$ \dfrac{Im\rb{\psi}}{2E\rb{\Q}} \cong \dfrac{E'\rb{\Q}}{Ker\rb{\psi} + Im\rb{\phi}} \cong \dfrac{\dfrac{E'\rb{\Q}}{Im\rb{\phi}}}{\dfrac{Ker\rb{\psi} + Im\rb{\phi}}{Im\rb{\phi}}} \cong \dfrac{\dfrac{E'\rb{\Q}}{Im\rb{\phi}}}{\dfrac{Ker\rb{\psi}}{Ker\rb{\psi} \cap Im\rb{\phi}}}. $$
Hence
$$ \abs{E\rb{\Q} : 2E\rb{\Q}} = \dfrac{\abs{E\rb{\Q} : Im\rb{\psi}}\abs{E'\rb{\Q} : Im\rb{\phi}}}{\abs{Ker\rb{\psi} : Ker\rb{\psi} \cap Im\rb{\phi}}} = \dfrac{\abs{Im\rb{\alpha}}\abs{Im\rb{\alpha'}}}{\abs{Ker\rb{\psi} : Ker\rb{\psi} \cap Im\rb{\phi}}}. $$
Now $ B' \in \rb{\Z^*}^2 $ iff $ T \in Im\rb{\phi} $ and the equation $ x^2 + Ax + B = 0 $ with discriminant $ 16\rb{A^2 - 4B^2} = 16B' $ has solutions in $ \Z^* $. Since $ Ker\rb{\psi} = \cb{\mathcal{O}, T} $ and $ \mathcal{O} \in Im\rb{\phi} $, this holds iff $ Ker\rb{\psi} \cap Im\rb{\phi} = \cb{\mathcal{O}, T} $. Since $ \mathcal{O}, T \in E\rb{\Q}\sb{2} $, this also holds iff $ \rb{a, 0}, \rb{a', 0} \in E\rb{\Q}\sb{2} $ for the solutions $ a, a' \in \Q^* $ of $ x^2 + Ax + B = 0 $. Hence
$$ E\rb{\Q}\sb{2} = \begin{cases} \cb{\mathcal{O}, T, \rb{a, 0}, \rb{a', 0}} & B' \in \rb{\Z^*}^2 \\ \cb{\mathcal{O}, T} & B' \notin \rb{\Z^*}^2 \end{cases}, \qquad \dfrac{Ker\rb{\psi}}{Ker\rb{\psi} \cap Im\rb{\phi}} = \begin{cases} \cb{\mathcal{O}} & B' \in \rb{\Z^*}^2 \\ \cb{\mathcal{O}, T} & B' \notin \rb{\Z^*}^2 \end{cases}, $$
so $ \abs{Ker\rb{\psi} : Ker\rb{\psi} \cap Im\rb{\phi}}\abs{E\rb{\Q}\sb{2}} = 4 $. Thus
$$ 2^r = \dfrac{\abs{Im\rb{\alpha}}\abs{Im\rb{\alpha'}}}{\abs{Ker\rb{\psi} : Ker\rb{\psi} \cap Im\rb{\phi}}\abs{E\rb{\Q}\sb{2}}} = \tfrac{1}{4}\abs{Im\rb{\alpha}}\abs{Im\rb{\alpha'}}. $$
\end{proof}

Computation of the rank simply reduces to determining images of $ \alpha $ and $ \alpha' $. This in turn can be rephrased as a question of Diophantine equations.

\begin{proposition}
The image $ Im\rb{\alpha} $ is such that
$$ Im\rb{\alpha} = \cb{\rb{\Q^*}^2\beta \ \Big| \ \beta, B / \beta \in \Z^*, \ \rb{X, Y, Z} \in \Z^3 \setminus \cb{\rb{0, 0, 0}}, \ Y^2 = \beta X^4 + AX^2Z^2 + \rb{B / \beta}Z^4}. $$
\end{proposition}

\begin{proof}
Since $ \rb{\Q^*}^2 \in Im\rb{\alpha} $, there is a solution $ \rb{X, Y, Z} = \rb{1, 1, 0} $ for $ \beta = 1 $. Since $ \rb{\Q^*}^2B \in Im\rb{\alpha} $, there is also a solution $ \rb{X, Y, Z} = \rb{0, 1, 1} $ for $ \beta = B $. Let $ P = \rb{a, b} \ne T \in E\rb{\Q} $ such that $ \rb{\Q^*}^2a \in Im\rb{\alpha} $. Then $ a = r / Z_0^2 $ and $ b = s / Z_0^3 $ for some $ r, s \in \Z $ and some $ Z_0 \in \Z_{> 0} $ such that $ \gcd\rb{r, Z_0} = \gcd\rb{s, Z_0} = 1 $. Now let $ r = X_0^2\beta_0 $, where $ X_0 = p_1 \dots p_n \in \Z_{> 0} $ for some primes $ p_i \in \Z_{> 0} $ and $ \beta_0 = j q_1 \dots q_n $ for some $ j \in \cb{-1, 1} $ and some distinct primes $ q_i \in \Z_{> 0} $. Since $ \rb{\Q^*}^2\beta_0 = \rb{\Q^*}^2X_0^2\beta_0 / Z_0^2 = \rb{\Q^*}^2\beta_0 \in G\rb{B} $, each $ q_i \mid B $, so $ \beta_0 \mid B $ and hence $ B / \beta_0 \in \Z^* $. Then
$$ \rb{\dfrac{s}{Z_0^3}}^2 = \rb{\dfrac{X_0^2\beta_0}{Z_0^2}}^3 + A\rb{\dfrac{X_0^2\beta_0}{Z_0^2}}^2 + B\dfrac{X_0^2\beta_0}{Z_0^2} \qquad \implies \qquad s^2 = \beta_0^2X_0^2\rb{\beta_0X_0^4 + AX_0^2Z_0^2 + \rb{B / \beta_0}Z_0^4}, $$
so let $ Y_0 = s^2 / \beta_0^2X_0^2 \in \Z $ such that $ Y_0^2 = \beta_0X_0^4 + AX_0^2Z_0^2 + \rb{B / \beta_0}Z_0^4 $. Hence there is a non-zero solution $ \rb{X, Y, Z} = \rb{X_0, Y_0, Z_0} $ for $ \beta = \beta_0 $. Conversely let $ \rb{X, Y, Z} = \rb{X_0, Y_0, Z_0} $ be a non-zero solution for some $ \beta = \beta_0 \in \Z^* $, so $ Y_0^2 = \beta_0 X_0^4 + AX_0^2Z_0^2 + \rb{B / \beta_0}Z_0^4 $. Then $ P = \rb{\beta_0 X_0^2 / Z_0^2, \beta_0 X_0Y_0 / Z_0^3} $ is such that
$$ \rb{\dfrac{\beta_0 X_0Y_0}{Z_0^3}}^2 = \dfrac{\beta_0^2X_0^2\rb{\beta_0 X_0^4 + AX_0^2Z_0^2 + \rb{B / \beta_0}Z_0^4}}{Z_0^6} = \rb{\dfrac{\beta_0 X_0^2}{Z_0^2}}^3 + A\rb{\dfrac{\beta_0 X_0^2}{Z_0^2}}^2 + B\dfrac{\beta_0 X_0^2}{Z_0^2}, $$
so $ P \in E\rb{\Q} $ and $ \alpha\rb{P} = \rb{\Q^*}^2\rb{\beta_0 X_0^2 / Z_0^2} = \rb{\Q^*}^2\beta_0 $. Thus any non-zero solution is in $ Im\rb{\alpha} $.
\end{proof}

Again, the image of $ \alpha' $ is similar to that of $ \alpha $ but with $ B' $ instead of $ B $. The following example illustrates the full computation of the rank of a simple elliptic curve.

\begin{example}
Let $ E : y^2 = x^3 - x $ be an elliptic curve over $ \Q $. Then $ \beta \in \cb{\pm 1} $. Since $ \beta = 1 $ and $ \beta = -1 = B $ have solutions, it holds that $ \abs{Im\rb{\alpha}} = 2 $. Now $ E' : y^2 = x^3 + 4x $ gives $ \beta \in \cb{\pm 1, \pm 2, \pm 4} $. Since $ \rb{\Q^*}^2\rb{\pm 1} = \rb{\Q^*}^2\rb{\pm 4} $, the Diophantine equations to consider are:
\begin{enumerate}
\item $ \beta = 1 $ gives $ Y^2 = X^4 + 4Z^4 $, which has a solution $ \rb{X, Y, Z} = \rb{0, 2, 1} $.
\item $ \beta = 2 $ gives $ Y^2 = 2X^4 + 2Z^4 $, which has a solution $ \rb{X, Y, Z} = \rb{1, 2, 1} $.
\item $ \beta = -1 $ gives $ Y^2 = -X^4 - 4Z^4 $, which has no solutions by sign disparity.
\item $ \beta = -2 $ gives $ Y^2 = -2X^4 - 2Z^4 $, which has no solutions by sign disparity.
\end{enumerate}
Hence $ \abs{Im\rb{\alpha'}} = 2 $ and $ 2^r = \tfrac{1}{4}\rb{2}\rb{2} = 1 $. Thus $ rk\rb{E\rb{\Q}} = 0 $ and $ E\rb{\Q} = E\rb{\Q}_{tors} \cong \Z_2 $.
\end{example}

The following algorithm summarises the process and code in the appendix.

\begin{algorithm}[Computation of the rank]
Input: an elliptic curve $ E $ over $ \Q $. Output: $ rk\rb{E\rb{\Q}} $.
\begin{enumerate}
\item Get all positive $ \beta $ such that $ \beta \mid B $ and free the squares from each $ \beta $.
\item Print all Diophantine equations of the form $ Y^2 = \beta X^4 + AX^2Z^2 + \rb{B / \beta}Z^4 $.
\item Write down the elliptic curve $ E' : y^2 = x^3 - 2Ax^2 + \rb{A^2 - 4B}x $ and do the same.
\item Check if there are non-zero solutions to the systems of Diophantine equations.
\item Compute the rank with the formula $ rk\rb{E\rb{\Q}} = \log_2\abs{Im\rb{\alpha}} + \log_2\abs{Im\rb{\alpha'}} - 2 $.
\end{enumerate}
\end{algorithm}

Unfortunately, there are no known effective method for the second to last step. In contrast to attempting at a number theoretic algorithm like in \cite{rank}, only ad-hoc congruences will be used to complete the computations in the following examples of elliptic curves given by the Weierstrass equations $ y^2 = x^3 - px $ for $ p \in \Z_{> 0} $. The following example is an elliptic curve of rank one.

\begin{example}
Let $ E : y^2 = x^3 - 5x $ be an elliptic curve over $ \Q $, which gives $ \beta \in \cb{\pm 1, \pm 5} $. Since $ \beta = 1 $ and $ \beta = -5 $ have trivial solutions, the Diophantine equations to consider are $ Y^2 = -X^4 + 5Z^4 $, which has a solution $ \rb{X, Y, Z} = \rb{1, 2, 1} $, and $ Y^2 = 5X^4 - Z^4 $, which has a solution by symmetry. Hence $ \abs{Im\rb{\alpha}} = 4 $. Now $ E' : y^2 = x^3 + 20x $ gives $ \beta \in \cb{\pm 1, \pm 2, \pm 5, \pm 10} $. If $ \beta < 0 $, there are no solutions by sign disparity. Since $ \beta = 1 $ and $ \beta = 5 $ have trivial solutions, the Diophantine equations to consider are $ Y^2 = 2X^4 + 10Z^4 $ and $ Y^2 = 10X^4 + 2Z^4 $. Since $ \gcd\rb{X_0, Y_0} = 1 $, if the first has a solution $ \rb{X, Y, Z} = \rb{X_0, Y_0, Z_0} $, then $ Y_0^2 \equiv 2X_0^4 \equiv 2 \mod 5 $ gives no solutions for $ Y_0 $, so both equations have no solutions. Hence $ \abs{Im\rb{\alpha'}} = 2 $. Thus $ rk\rb{E\rb{\Q}} = \log_2\rb{4} + \log_2\rb{2} - 2 = 1 $ and $ E\rb{\Q} \cong \Z \oplus E\rb{\Q}_{tors} \cong \Z \times \Z_2 $.
\end{example}

The following example is an elliptic curve of rank two.

\begin{example}
Let $ E : y^2 = x^3 - 17x $ be an elliptic curve over $ \Q $, which gives $ \beta \in \cb{\pm 1, \pm 17} $. Since $ \beta = 1 $ and $ \beta = -17 $ have trivial solutions, the Diophantine equations to consider are $ Y^2 = -X^4 + 17Z^4 $, which has a solution $ \rb{X, Y, Z} = \rb{1, 4, 1} $, and $ Y^2 = 17X^4 - Z^4 $, which has a solution by symmetry. Hence $ \abs{Im\rb{\alpha}} = 4 $. Now $ E' : y^2 = x^3 + 68x $ gives $ \beta \in \cb{\pm 1, \pm 2, \pm 17, \pm 34} $. If $ \beta < 0 $, there are no solutions by sign disparity. Since $ \beta = 1 $ and $ \beta = 17 $ have trivial solutions, the Diophantine equations to consider are $ Y^2 = 2X^4 + 34Z^4 $, which has a solution $ \rb{X, Y, Z} = \rb{1, 6, 1} $, and $ Y^2 = 34X^4 + 2Z^4 $, which has a solution by symmetry. Hence $ \abs{Im\rb{\alpha'}} = 4 $. Thus $ rk\rb{E\rb{\Q}} = \log_2\rb{4} + \log_2\rb{4} - 2 = 2 $ and $ E\rb{\Q} \cong \Z^2 \oplus E\rb{\Q}_{tors} \cong \Z^2 \times \Z_2 $.
\end{example}

The following example is an elliptic curve of rank three.

\begin{example}
Let $ E : y^2 = x^3 - 226x $ be an elliptic curve over $ \Q $, which gives $ \beta \in \cb{\pm 1, \pm 2, \pm 113, \pm 226} $. Since $ \beta = 1 $ and $ \beta = -226 $ have trivial solutions, the Diophantine equations to consider are $ Y^2 = -X^4 + 226Z^4 $, $ Y^2 = 2X^4 - 113Z^4 $, $ Y^2 = -2X^4 + 113Z^4 $, $ Y^2 = 113X^4 - 2Z^4 $, $ Y^2 = -113X^4 + 2Z^4 $, and $ Y^2 = 226X^4 - Z^4 $. The first three have solutions $ \rb{X, Y, Z} = \rb{1, 15, 1} $, $ \rb{X, Y, Z} = \rb{3, 7, 1} $, and $ \rb{X, Y, Z} = \rb{1, 9, 2} $ respectively, while the last three have solutions by symmetry. Hence $ \abs{Im\rb{\alpha}} = 8 $. Now $ E' : y^2 = x^3 + 904x $ gives $ \beta \in \cb{\pm 1, \pm 2, \pm 113, \pm 226} $. If $ \beta < 0 $, there are no solutions by sign disparity. Since $ \beta = 1 $ and $ \beta = 226 $ have trivial solutions, the Diophantine equations to consider are $ Y^2 = 2X^4 + 452Z^4 $, which has a solution $ \rb{X, Y, Z} = \rb{1, 22, 2} $, and $ Y^2 = 113X^4 + 8Z^4 $, which has a solution $ \rb{X, Y, Z} = \rb{1, 11, 1} $. Hence $ \abs{Im\rb{\alpha'}} = 4 $. Thus $ rk\rb{E\rb{\Q}} = \log_2\rb{8} + \log_2\rb{4} - 2 = 3 $ and $ E\rb{\Q} \cong \Z^3 \oplus E\rb{\Q}_{tors} \cong \Z^3 \times \Z_2 $.
\end{example}

The ranks of elliptic curves above are relatively small in value and easy to compute, but there are elliptic curves with larger rank values. The record as of 2018 in \cite{rankhistory} for the elliptic curve with the largest rank was discovered by Elkies in 2006, and is given by the Weierstrass curve
$$ E : y^2 + xy + y = x^3 - x^2 - 20067762415575526585033208209338542750930230312178956502x $$
$$ + 34481611795030556467032985690390720374855944359319180361266008296291939448732243429, $$
which is proven to have rank at least 28. There are also elliptic curves with relatively large ranks known exactly, the largest of which was also discovered by Elkies in 2009, and is given by the Weierstrass curve
$$ E : y^2 + xy + y = x^3 - x^2 + 31368015812338065133318565292206590792820353345x $$
$$ + 302038802698566087335643188429543498624522041683874493555186062568159847, $$
which has rank 19. In fact, it is conjectured that the rank of an elliptic curve does not have an upper bound.

\begin{conjecture}
There are elliptic curves over $ \Q $ of arbitrary large rank.
\end{conjecture}

However, while they exist, elliptic curves of rank greater than one are rare. This notion of rarity is measured by the \emph{average rank} of all elliptic curves, of which is conjectured to exist as a quantity.

\begin{conjecture}
The average rank of all elliptic curves over $ \Q $ is $ \tfrac{1}{2} $.
\end{conjecture}

In particular, rank zero constitute a half and rank one constitute the other half, while all higher ranks constitute zero percent, of all elliptic curves. While it has not been definitely proven, Bhargava and Shankar showed in \cite{rankaverage} that the average rank of all elliptic curves is at most $ 7 / 6 $.

\pagebreak

\subsection{Birch and Swinnerton-Dyer conjecture}

Ultimately, the rank of an elliptic curve is not completely understood. It was greatly studied for decades, and had lead mathematicians to formalise one of the most influential conjectures in number theory, which is also deemed worthy of being called one of the Millennium Prize Problems. The problem, now commonly known as the \emph{Birch and Swinnerton-Dyer conjecture}, relates the rank with Taylor expansion of a particular complex series. Letting $ t_p $ denote the trace in Hasse's theorem applied to $ E_p\rb{\F_p} $ for any prime $ p \in \Z_{> 0} $ of good reduction, the series can be given as follows.

\begin{definition}[Incomplete Hasse-Weil $ L $-series]
The \textbf{incomplete Hasse-Weil $ L $-series} is defined for any $ \Re\rb{s} > 3 / 2 $ as the \emph{Euler product}
$$ L\rb{E, s} = \prod_p \dfrac{1}{1 - t_pp^{-s} + p^{1 - 2s}} $$
over all primes $ p \in \Z_{> 0} $ of good reduction, and extended to $ \C $ by analytic continuation.
\end{definition}

This analytic continuation, as well as a functional equation similar to that of the Riemann zeta function, was originally known as the \emph{Hasse-Weil conjecture}, but was subsequently implied by the \emph{modularity theorem}.

\begin{remark}
The \emph{complete Hasse-Weil $ L $-series} is defined over all primes $ p \in \Z_{> 0} $ as the Euler product
$$ L^*\rb{E, s} = \prod_{p \mid \Delta_E} \dfrac{1}{1 - t_pp^{-s}} \prod_{p \nmid \Delta_E} \dfrac{1}{1 - t_pp^{-s} + p^{1 - 2s}} = \sum_{n = 1}^\infty \dfrac{a_n}{n^s}. $$
Now $ E $ might be a singular cubic curve, so that $ t_p $ can be defined for primes of bad reduction as either $ t_p = \pm 1 $ or $ t_p = 0 $, depending on whether $ E $ has \emph{split} or \emph{non-split multiplicative} reduction or \emph{additive} reduction, which corresponds to whether $ E_p $ has a \emph{node} or a \emph{cusp} respectively.
\end{remark}

Due to analyticity in $ \C $, it makes sense to consider the Taylor expansion of $ L\rb{E, s} $ given by
$$ L\rb{E, s} = \sum_{i = 0}^\infty c_i\rb{s - s_0}^i, \qquad s_0 \in \C, \qquad c_i \in \C, $$
as well its \emph{order of vanishing} $ ord_{s = s_0} $ or order of zero at $ s_0 $, a value $ i $ such that $ c_i \ne 0 $ but $ c_j = 0 $ for any $ j < i $. A different notion of rank can then be defined for $ E $, as follows.

\begin{definition}[Analytic rank]
The \textbf{analytic rank} of $ E $ is $ rk_{an}\rb{E\rb{\Q}} = ord_{s = 1}L\rb{E, s} $.
\end{definition}

The conjecture then relates both notions of ranks as follows.

\begin{conjecture}[Birch and Swinnerton-Dyer] $ rk\rb{E\rb{\Q}} = rk_{an}\rb{E\rb{\Q}} $.
\end{conjecture}

\begin{remark}
There is also a refined version of the conjecture that involves the \emph{Tate-Shafarevich group}, which is omitted for further discussion. Proving this strong version will then indirectly lead to efficient algorithms for rank computation.
\end{remark}

A direct consequence of the conjecture is that $ E\rb{\Q} $ is infinite iff its ranks $ rk\rb{E\rb{\Q}} $ and $ rk_{an}\rb{E\rb{\Q}} $ are positive. This holds iff $ L\rb{E, s} $ does not have a constant term, or iff $ L\rb{E, 1} $ computes to give a value of $ 0 $. In other words, the finiteness of $ E\rb{\Q} $ holds iff $ L\rb{E, 1} \ne 0 $. Now the conjecture has been supported with much numerical evidence in \cite{bsd0}, and can also be verified by prior examples with the \emph{Sage} programming language as follows.

\begin{example}
Let $ E : y^2 = x^3 - x $ be an elliptic curve over $ \Q $. Then $ rk\rb{E\rb{\Q}} = 0 $ and
$$ L\rb{E, s} \approx 0.655514388573030 + 0.447208159472739s - 0.233131198781643s^2 + 0.0342258563577268s^3 + \dots, $$
Hence $ L\rb{E, 1} \approx 0.655514388573030 \ne 0 $. Now let $ E' : y^2 = x^3 - 5x $ be an elliptic curve over $ \Q $. Then $ rk\rb{E'\rb{\Q}} = 1 $ and
$$ L\rb{E', s} \approx 0.000000000000000 + 2.22876814774675s - 2.06654309593994s^2 + 0.549852427979257s^3 + \dots. $$
Thus $ L\rb{E', 1} \approx 0.000000000000000 = 0 $.
\end{example}

However, only special cases of the conjecture have been proven to date. The first general result, proven by Coates and Wiles, states that an elliptic curve $ E $ with $ L\rb{E, 1} \ne 0 $ and \emph{complex multiplication}, or when $ \abs{End\rb{E}} $ is strictly larger than $ \Z $, has finite $ E\rb{\Q} $, and hence $ rk\rb{E\rb{\Q}} = 0 $. A later result, proven by Gross and Zagier with \emph{Heegner points}, states that a \emph{modular} elliptic curve $ E $ with $ L\rb{E, 1} = 0 $ and $ \rb{d / ds}L\rb{E, 1} \ne 0 $, or equivalently $ rk_{an}\rb{E\rb{\Q}} = 1 $, has a non-torsion rational point in $ E\rb{\Q} $, and hence $ rk\rb{E\rb{\Q}} > 0 $. Subsequently, Kolyvagin extended this proof by showing that $ rk\rb{E\rb{\Q}} = 1 $ must hold for this latter case, and that $ rk\rb{E\rb{\Q}} = 0 $ if $ L\rb{E, 1} \ne 0 $ instead. With the modularity theorem proven by Breuil et al, it is now known that any elliptic curve over $ \Q $ is modular, hence proving the following special case of the Birch and Swinnerton-Dyer conjecture.

\begin{theorem}[Breuil, Coates, Conrad, Diamond, Gross, Kolyvagin, Taylor, Wiles, Zagier]
$ rk\rb{E\rb{\Q}} = rk_{an}\rb{E\rb{\Q}} $ for $ rk_{an}\rb{E\rb{\Q}} \in \cb{0, 1} $.
\end{theorem}

\begin{proof}
Omitted, see \cite{bsd1}, \cite{bsd2}, \cite{bsd3}, and \cite{modularity}.
\end{proof}

The very recent result due to Bhargava and Shankar in \cite{rankaverage} also showed that a large proportion of all elliptic curves must have either rank zero or one, but the conjecture still remain unproven for elliptic curves with higher ranks. Now as a Millenium Prize Problem, the Birch and Swinnerton-Dyer conjecture has significant implications in number theory, particularly on finiteness of the Tate-Shafarevich group, but it also proves other more elementary results, one of which concerns integers with the following property.

\begin{definition}[Congruent number]
$ n \in \Z_{> 0} $ is a \textbf{congruent number} iff it is the area of some right triangle with sides in $ \Q_{> 0} $.
\end{definition}

Congruent numbers can be illustrated with the following example.

\begin{example}
$ 5 = \tfrac{1}{2}\rb{3 / 2}\rb{20 / 3} $ is a congruent number since it is the area of the right triangle with sides $ 3 / 2, 20 / 3, 41 / 6 \in \Q_{> 0} $, while $ 10 $ is not a congruent number.
\end{example}

An open problem is the classification of all congruent numbers, known as the \emph{congruent number problem}, which boils down to obtaining simultaneous solutions for $ a^2 + b^2 = c^2 $ and $ 2n = ab $, for some $ n \in \Z_{> 0} $ and some $ a, b, c \in \Q_{> 0} $. Considering the non-zero inverse transformations
$$ \rb{x, y} = \rb{\dfrac{n\rb{a + c}}{b}, \dfrac{2n^2\rb{a + c}}{b^2}}, \qquad \rb{a, b, c} = \rb{\dfrac{\rb{x^2 - n^2}}{y}, \dfrac{2nx}{y}, \dfrac{\rb{x^2 + n^2}}{y}}, $$
the system of equations can be transformed with a bijective correspondence to the Weierstrass equation $ y^2 = x^3 - n^2x $. Hence checking whether $ n $ is a congruent number is in turn equivalent to determining whether an affine rational point with non-zero coordinates exists in the elliptic curve $ E : y^2 = x^3 - n^2x $ over $ \Q $. This prompts the following theorem that further classify the conditions for being a congruent number.

\begin{theorem}[Tunnell]
Let $ n \in \Z_{> 0} $ be a square-free congruent number. If $ n $ is odd, then
$$ 2\abs{\cb{\rb{x, y, z} \in \Z^3 \mid n = 2x^2 + y^2 + 32z^2}} = \abs{\cb{\rb{x, y, z} \in \Z^3 \mid n = 2x^2 + y^2 + 8z^2}}. $$
Otherwise $ n $ is even, then
$$ 2\abs{\cb{\rb{x, y, z} \in \Z^3 \mid n = 2\rb{4x^2 + y^2 + 32z^2}}} = \abs{\cb{\rb{x, y, z} \in \Z^3 \mid n = 2\rb{4x^2 + y^2 + 8z^2}}}. $$
\end{theorem}

\begin{proof}
Omitted, see \cite{tunnell}.
\end{proof}

The Birch and Swinnerton-Dyer conjecture, on the other hand, provides the converse to Tunnell's theorem, hence giving a single criterion for any congruent number that can be checked by enumerating the four sets involved. The following example illustrates the process, assuming the conjecture.

\begin{example}
Since $ 5 $ is an odd square-free congruent number, it holds that
$$ 2\abs{\cb{\rb{x, y, z} \in \Z^3 \mid 5 = 2x^2 + y^2 + 32z^2}} = 0 = \abs{\cb{\rb{x, y, z} \in \Z^3 \mid 5 = 2x^2 + y^2 + 8z^2}}. $$
Conversely, since $ 10 $ is an even square-free non-congruent number, it holds that
$$ 2\abs{\cb{\rb{x, y, z} \in \Z^3 \mid n = 2\rb{4x^2 + y^2 + 32z^2}}} = 8 \ne 4 = \abs{\cb{\rb{x, y, z} \in \Z^3 \mid n = 2\rb{4x^2 + y^2 + 8z^2}}}. $$
\end{example}

As such, the conjecture, if proven even only for elliptic curves given by the Weierstrass equation $ y^2 = x^3 - n^2x $, would allow the congruence number problem to be fully resolved.

\pagebreak

\section{Applications}

In this section, two elementary applications of elliptic curves are briefly touched on, together with a brief history of their development prior to elliptic curves.

\subsection{Arithmetic}

In arithmetic, the widely known fact that $ \Z $ is a unique factorisation domain acts as the modern rephrasing of the fundamental theorem of arithmetic, which states that any integer can be uniquely written as a product of primes up to rearrangement and sign. An classical problem in arithmetic is determining these primes, or more commonly known as integer factorisation, for a given huge integer $ N \in \Z_{> 0} $ with tens of digits. Clearly no work is required if $ N $ is prime, which can be verified for most cases by the following theorem.

\begin{theorem}[Fermat's little theorem]
Let $ N $ be prime. Then $ a^{N - 1} \equiv 1 \mod N $ for any $ a \in \Z_{> 0} $ such that $ N \nmid a $.
\end{theorem}

\begin{proof}
Since $ N \nmid a $, it holds that $ a \not\equiv 0 \mod N $, so $ a \in \Z_N^* $. Lagrange's theorem gives $ ord\rb{a} \mid \abs{\Z_N^*} = N - 1 $, so $ a^{N - 1} = 1 $. Thus $ a^{N - 1} \equiv 1 \mod N $.
\end{proof}

Unfortunately, its converse does not hold, due to the existence of \emph{Carmichael numbers}, which are composite integers that seemingly satisfy Fermat's little theorem, the first of which being relatively small at $ 561 $. These integers can be avoided manually due to their relative rarity, but there are indeed more reliable tests to check if $ N $ is prime. Now simply assume that $ N $ is composite, with an unknown large prime factor $ p \in \Z_{> 0} $. On first sight, there is a simple naive approach to factorise $ N $ involving trial division, applying Euclidean division to every positive integer less than $ N $. A clear improvement can be made by only considering $ 2, 3 $ and integers of the form $ 6m \pm 1 $, which is illustrated in the following example with a small value of $ N $.

\begin{example}
Let $ N = 420 $ be composite. Trial division on $ \cb{2, 3, 5, 7, \dots} $ gives $ 420 = 2\rb{210} + 0 $ and $ 210 = 2\rb{105} + 0 $, but $ 105 = 2\rb{52} + 1 $. Now $ 105 = 3\rb{35} + 0 $, but $ 35 = 3\rb{11} + 2 $. Then $ 35 = 7\rb{5} + 0 $, but $ 7 = 1\rb{5} + 2 $. Finally $ 7 = 1\rb{7} + 0 $. Thus $ L' = \cb{2, 2, 3, 5, 7} $ and $ N = \rb{2}\rb{2}\rb{3}\rb{5}\rb{7} $.
\end{example}

It is immediately evident that this process of factorising $ N $ into $ p $ and $ N / p $ is laborious, and especially difficult if $ N / p $ is also prime and relatively similar in magnitude to $ p $, since every integer below $ p $ and $ N / p $ will be checked for failure. In fact, while multiplying $ p $ and $ N / p $ to produce $ N $ is relatively easy, there are no known efficient \emph{non-quantum} polynomial time algorithms to deterministically do the reverse, of which is exactly the basis of modern cryptography. The fastest methods for integer factorisation involve either \emph{sieves} or elliptic curves, the latter of which discussed here has motivations stemming from the classical \emph{Pollard's $ p - 1 $ method}. The following definition, considering a fixed integer $ B \in \Z_{> 0} $, will be used.

\begin{definition}[$ B $-power smooth]
Let $ n \in \Z_{> 0} $ be such that $ n = p_1^{e_1} \dots p_n^{e_n} $ for some $ e_i \in \Z_{> 0} $ and some primes $ p_i \in \Z_{> 0} $. Then $ n $ is \textbf{$ B $-power smooth} iff each $ p_i^{e_i} \le B $.
\end{definition}

This definition is illustrated in the following example.

\begin{example}
$ 420 $ is $ 7 $-smooth, and $ 2\rb{420} $ is not $ 7 $-smooth but is $ 8 $-smooth.
\end{example}

$ B $ is typically chosen to be fairly large, such that the composite integer $ p - 1 $ is likely to be $ B $-power smooth. Now let $ l_B = \text{lcm}\rb{2, \dots, B} $, so that any prime below $ B $ divides $ l_B $, and so $ p - 1 \mid l_B $. The algorithm again uses Fermat's little theorem to give $ a^{l_B} \equiv 1 \mod p $ for any $ a \in \Z_{> 0} $ such that $ p \nmid a $. Hence $ p \mid a^{l_B} - 1 $, so letting $ g_B = \gcd\rb{a^{l_B} - 1, N} $ gives $ p \mid g_B \mid N $. Obtaining $ g_B < N $ immediately implies that $ g_B $ is a proper divisor of $ N $, so the process can be repeated replacing $ N $ with $ g_B $. The algorithm is summarised as follows.

\begin{algorithm}[Pollard's $ p - 1 $ method]
Input: an integer $ N \in \Z_{> 0} $. Output: a proper divisor of $ N $.
\begin{enumerate}
\item Choose a \emph{smoothness bound} $ B \in \Z_{> 0} $.
\item Calculate $ l_B = \text{lcm}\rb{1, \dots, B} $.
\item Compute $ g_B = \gcd\rb{a^{l_B} - 1, N} $ for some $ a \in \cb{2, \dots, N - 1} $.
\item If $ g_B = 1 $, then choose a larger smoothness bound $ B $, else if $ g_B = N $, then choose a different $ a $.
\item Otherwise $ 1 < g_B < N $, then return $ g_B $.
\end{enumerate}
\end{algorithm}

\pagebreak

\begin{remark}
In practicality, this $ B $ typically fixed, and a different algorithm is forcibly switched into if this algorithm fails, which would mean that Pollard's $ p - 1 $ algorithm only serves to simplify the problem.
\end{remark}

A simple observation picks out several possible concerns in the algorithm, most obviously being the question if the algorithm even terminates, which must be the case, as the smoothness bound $ B $ will eventually be large enough for $ l_B $ to exceed $ p - 1 $. Another issue might be the speed of computing $ l_B $ and $ g_B $, with the latter seemingly depending on the former. This is resolved by the realisation that $ l_B $ is arbitrarily defined as such to allow all factors below $ B $ to divide $ l_B $, so a purely multiplicative $ l_B = B! $ can be used. While $ g_B $ may require further exponentiation, this is not a concern as modular exponentiation with successive squaring to compute $ a^{l_B} $ is fast, and the result of this can be used in the computation instead of $ a^{l_B} - 1 $. In the highly unlikely chance that $ p \mid a $, a fix to this issue could be first doing trial division up to a small integer $ n \in \Z_{> 0} $ to rule out any possibility that $ p < n $, and only considering the cases where $ a < n $. With these concerns in mind, Pollard's $ p - 1 $ algorithm can be illustrated with the following example involving a small $ N $, which on modern computers can actually be done instantly even with trial division.

\begin{example}
Let $ N = 246082373 $. Then $ 2^{N - 1} \equiv 114193013 \ne 1 \mod N $, so Fermat's little theorem gives that $ N $ is composite. Now let $ B = 7 $ and $ l_B = \text{lcm}\rb{1, \dots, B} = 420 $, and let $ a = 2 $. Then $ a^{l_B} \equiv 60592910 \mod N $, so $ \gcd\rb{a^{l_B} - 1, N} = \gcd\rb{60592909, N} = 1 $. Hence choose $ B = 9 > 7 $ and $ l_B = \text{lcm}\rb{1, \dots, B} = 2520 $, and let $ a = 2 $. Then $ a^{l_B} \equiv 130940741 \mod N $, so $ \gcd\rb{a^{l_B} - 1, N} = \gcd\rb{130940740, N} = 2521 < N $. Thus $ 2521 \mid N $ and $ N = \rb{2521}\rb{97613} $, which are both prime.
\end{example}

A final serious concern would be overall efficiency of the algorithm that is only reasonable with the initial supposition that $ p - 1 $ is $ B $-power smooth, which may not always be the case, inevitably forcing large values of $ B $. Despite so, it may still be desirable to check the $ B $-power smoothness of $ p + 1 $, or even $ p \pm n $ for any small $ n \in \Z $, to see if the initially fixed $ B $ is sufficient to factorise $ N $. In this respect, Pollard's $ p - 1 $ algorithm has no way of allowing for other values of $ p \pm n $ due to the restriction given by Fermat's little theorem. Now \emph{Lenstra's elliptic curve factorisation method} takes this flaw into account by considering multiple random elliptic curves over finite fields. While the former considers the multiplicative group $ \Z_p^* $ of order $ \abs{\Z_p^*} = p - 1 $ and checks if $ a \in \Z_p^* $ satisfies $ a^{l_B} = 1 $, the latter considers the elliptic curve $ E\rb{\F_p} $ of order $ \abs{E\rb{\F_p}} = p - t + 1 $ and checks if $ P \in E\rb{\F_p} $ satisfies $ l_BP = \mathcal{O} $. Hasse's theorem gives $ \abs{t} \le 2\sqrt{p} $, allowing $ \abs{E\rb{\F_p}} $ to vary wildly within this interval and hence removing the aforementioned defect. The algorithm is stated as follows.

\begin{algorithm}[Lenstra's elliptic curve factorisation method]
Input: an integer $ N \in \Z_{> 0} $. Output: a proper divisor of $ N $.
\begin{enumerate}
\item Set $ P = \rb{a, b} $ and $ B = b^2 - a^3 - Aa $ for some $ A, a, b \in \cb{1, \dots, N - 1} $.
\item If $ g = \gcd\rb{4A^3 + 27B^2, N} = N $, choose a different $ A $, else if $ 1 < g < N $, return $ g $, else let $ E : y^2 = x^3 + Ax + B $ be an elliptic curve over $ \Q $, treated as over the ring $ \Z_N^* $.
\item Choose a smoothness bound $ C $ and calculate $ l_C $ as per Pollard's $ p - 1 $ method.
\item Compute $ l_CP = \rb{q / d^2, r / d^3} $ and $ g_C = \gcd\rb{d, N} $.
\item If $ g_C = 1 $, choose a larger $ C $ or a different $ A $, else if $ g_C = N $, choose a smaller $ C $, else return $ g_C $.
\end{enumerate}
\end{algorithm}

A couple of remarks will be made on Lenstra's elliptic curve factorisation method, which has the first two steps markedly differently from Pollard's $ p - 1 $ method. The last three steps of the former mirror the latter, but it is worth noting that $ l_CP = \mathcal{O} $ iff $ d = 0 $, which holds iff $ p \mid d $, or $ p \mid g_C = \gcd\rb{d, N} \mid N $. While it is possible to directly obtain a random elliptic curve $ E : y^2 = x^3 + Ax + B $ over $ \F_p $ by choosing some random $ A, B \in \Z $ and treating $ A, B $ as elements of $ \F_p $, obtaining a point in $ E $ afterwards will involve the laborious process of finding a modular square root, and so the above approach is taken. Moreover, to avoid having $ P $ be a torsion point and hence resulting in $ N \mid d $, a simple fix would be an additional condition to choose $ b^2 \nmid 4A^3 + 27\rb{A^3 + Aa} $ in this reverse approach, which by the contrapositive to the Nagell-Lutz theorem forces $ P $ to have infinite order. Again, computation of $ l_C $ will be done by successive duplication of points, but a concern arises from possibly having denominators $ d \in \Z_N $ being zero. Considering the cases when an inverse does not exist in $ \Z_N^* $, or when $ \gcd\rb{d, N} > 1 $, either $ \gcd\rb{d, N} = N $, for which it is sufficient to simply choose a different curve $ E $, or $ 1 < \gcd\rb{d, N} < N $, for which $ \gcd\rb{d, N} $ can be returned as a proper divisor of $ N $. In practice, the affine coordinates are computed modulo $ N $, catching a division by zero error only when the extended Euclidean algorithm fails to give a modular inverse, then computing $ g_C $ separately. With these remarks at hand, Lenstra's elliptic curve factorisation method can be illustrated with the following example involving a small $ N $, which again can actually be done instantly with a modern computer.

\begin{example}
Let $ N = 1715761513 $. Then $ 2^{N - 1} \equiv 114094409 \ne 1 \mod N $, so Fermat's little theorem gives that $ N $ is composite. Let $ A = 1 $, $ a = 2 $, and $ b = 1 $, such that $ P = \rb{2, 1} $ and $ B = 1^2 - 2^3 - 1\rb{2} = -9 $. Then $ g = \gcd\rb{4A^3 + 27B^2, N} = 1 $, such that $ E : y^2 = x^3 + x - 9 $ is an elliptic curve over $ \Q $. Now let $ C = 17 $ and $ l_C = \text{lcm}\rb{1, \dots, C} = 12252240 $. Then $ l_CP = \rb{1225303014, 142796033} $, so $ \rb{d, N} = 1 $. Instead of choosing a larger $ C $, choose a different $ A \in \cb{2, \dots, N} $ and recompute. Then $ A = 42 $ eventually returns $ \rb{d, N} = 26927 $. Thus $ 26927 \mid N $ and $ N = \rb{26927}\rb{63719} $, which are both prime.
\end{example}

As seen above, if choosing a different $ A $ does not work, a larger $ C $ could be tried, or even picking a different $ P = \rb{a, b} $ if all else fails, a sign of high algorithmic flexibility. While it may involve more sophistication and possibly a larger overhead in maintaining the elliptic curve data structure than Pollard's $ p - 1 $ method, Lenstra's elliptic curve factorisation method \emph{heuristically} runs at sub-exponential time complexity, due to a high probability that an integer is $ B $-power smooth within the interval in Hasse's theorem.

\begin{remark}
Using Pollard's $ p - 1 $ algorithm for this example will require $ B \ge 13463 $, which will take a while.
\end{remark}

With the discussion on factorising the composite $ N $ completed, the initial question of checking if $ N $ is prime makes a comeback. After all, probabilistic factorisation algorithms may never terminate if $ N $ was never composite in the first place. Again, there is a trivial method to do this, which involves factoring $ N $ by trial division, Fermat's little theorem, or any other factorisation methods and hoping to result in a definite failure. While there were subsequent developments on fast non-deterministic tests, such as \emph{Miller-Rabin}, that do not rely on factorisation but on Fermat's little theorem instead, the remaining discussion here focuses on one of the fastest \emph{primality tests} that involves elliptic curves. In contrast to factorisation, currently doable for tens to hundreds of digits, the primality of integers up to tens of thousands of digits have been proven.

\begin{remark}
These forms of primality testing hold for arbitrary integers, but there are certain classes of huge integers that have been proven to be primes using specialised methods. For instance, the largest integer ever proven to be a prime is a \emph{Mersenne prime} that has tens of millions of digits.
\end{remark}

The said primality test is also an elliptic curve version of another classical primality test, known as the \emph{Pocklington-Lehmer primality test}, which has its basis on the following theorem.

\begin{theorem}[Pocklington-Lehmer]
\label{thm:pocklington}
Let $ r \in \Z_{> 0} $ be such that $ r \mid N - 1 $ and $ r \ge \sqrt{N} $. Then $ N $ is prime if
$$ a_q^{N - 1} \equiv 1 \mod N, \qquad \gcd\rb{a_q^{\rb{N - 1} / q} - 1, N} = 1, \qquad a_q \in \Z_{> 0}, $$
for any prime $ q \in \Z_{> 0} $ such that $ q \mid r $.
\end{theorem}

\begin{proof}
Let $ p \in \Z_{> 0} $ be a prime such that $ p \mid N $, so $ p $ is a prime of good reduction, and let $ v = v_q\rb{r} $ be the $ q $-adic valuation of $ r $. Now let $ a \equiv a_q^{\rb{N - 1} / q^v} \mod p $ for some $ a \in \Z_p^* $. Then $ a^{q^v} = a_q^{N - 1} \equiv 1 \mod p $ and $ a^{q^{v - 1}} = a_q^{\rb{N - 1} / q} \not\equiv 1 \mod p $. Hence $ ord\rb{a} = q^v $. Lagrange's theorem gives $ q^v \mid \abs{\Z_p^*} = p - 1 $, so $ r \mid p - 1 $ and $ p > r \ge \sqrt{N} $. Thus $ p = N $ and $ N $ is prime.
\end{proof}

Again, a simple observation points that integer factorisation is involved in finding $ r $, as well as its prime factors $ q $. Similar to Pollard's $ p - 1 $ method, a prior assumption is required for the algorithm to run at a reasonable time, namely that $ p - 1 $ has many small factors $ q $ that allow $ r $ to be generated quickly with trial division. It is also worth noting that finding $ a_q $ is equivalent to finding a generator of the group $ \Z_p^* $, which might be laborious, but often letting $ a_q = 2 $ works. The test algorithm then simply follows from the theorem, but it is desirable to have a third party mechanism that checks validity of the primality proof, which will also help ensure functional correctness of implementations. In particular, the notion of a \emph{primality certificate}, which is an ordered pair $ \rb{r, c} $ as in Theorem \ref{thm:pocklington}, where $ c $ is a list of ordered pairs $ \rb{q, a_q} $, allows for a verification by simple modular exponentiation. The Pocklington-Lehmer primality test can be illustrated with a much larger value of $ N $ in the following example, owing to the fact that $ N - 1 $ has many small factors.

\begin{example}
Let $ N = 9223372036854775783 $. Then $ N - 1 = 9223372036854775782 $. Trial division for primes less than $ 400000 $ gives $ r = \rb{2}\rb{3}^4\rb{17}\rb{23}\rb{319279} \mid N - 1 $, such that $ r = 20223770418 \ge \sqrt{N} $. Then
$$ 2^{N - 1} \equiv 3^{N - 1} \equiv 1 \mod N, \qquad \gcd\rb{2^{\rb{N - 1} / 3} - 1, N} = \gcd\rb{3^{\rb{N - 1} / 2} - 1, N} = 1, $$
$$ \gcd\rb{2^{\rb{N - 1} / 17} - 1, N} = \gcd\rb{2^{\rb{N - 1} / 23} - 1, N} = \gcd\rb{2^{\rb{N - 1} / 319279} - 1, N} = 1. $$
Thus $ N $ is prime with primality certificate $ \rb{r, \sb{\rb{2, 3}, \rb{3, 2}, \rb{17, 2}, \rb{23, 2}, \rb{319279, 2}}} $.
\end{example}

As for Lenstra's elliptic curve factorisation method, an elliptic curve analogue attempts to fix the $ p - 1 $ assumption by virtue of Hasse's theorem. By first choosing $ A, a, b \in \Z_N^* $, a valid elliptic curve over the ring $ \Z_N^* $ is considered, giving the following analogous theorem.

\begin{theorem}[Goldwasser-Kilian]
Let $ E : y^2 = x^3 + Ax + B $ be an elliptic curve over $ \Q $ such that $ \gcd\rb{4A^3 + 27B^2, N} = 1 $, treated as over the ring $ \Z_N^* $, and let $ m \in \Z_{> 0} $ be such that $ m > \rb{\sqrt[4]{N} + 1}^2 $. Then $ N $ is prime if
$$ mP_q = \mathcal{O}, \qquad \dfrac{m}{q}P_q \ne \mathcal{O}, \qquad P_q \in E\rb{\Q} \setminus \cb{\mathcal{O}}, $$
for any distinct prime $ q \in \Z_{> 0} $ such that $ q \mid m $.
\end{theorem}

\begin{proof}
Let $ p \in \Z_{> 0} $ be a prime such that $ p \mid N $, and let $ v = v_q\rb{m} $ be the $ q $-adic valuation of $ m $. Now let $ r_p : E\rb{\Q} \to E_p\rb{\F_p} $ be the reduction modulo $ p $ map, and let $ P_q' = \rb{m / q^v}r_p\rb{P_q} $. Then $ q^vP_q' = mr_p\rb{P_q} = \mathcal{O} $ and $ q^{v - 1}P_q' = \rb{m / q}r_p\rb{P_q} \ne \mathcal{O} $. Hence $ ord\rb{P_q'} = q^v $. Lagrange's theorem gives $ q^v \mid \abs{E_p\rb{\F_p}} $, so $ m \mid \abs{E_p\rb{\F_p}} $. Now Hasse's theorem gives
$$ \rb{\sqrt[4]{N} + 1}^2 < m \le \abs{E_p\rb{\F_p}} \le p + 2\sqrt{p} + 1 = \rb{\sqrt{p} + 1}^2. $$
Hence $ p > \sqrt{N} $. Thus $ p = N $ and $ N $ is prime.
\end{proof}

As for the Pocklington-Lehmer primality test, an appropriate primality certificate, possibly with the form of an ordered triple $ \rb{m, A, c} $ as in Theorem \ref{thm:pocklington}, where $ c $ is a list of ordered pairs $ \rb{q, P_q} $, will act as the output of a successful test. With all previous considerations, the Goldwasser-Kilian primality test can be illustrated with an even larger value of $ N $ in the following example.

\begin{example}
Let $ N = 9223372036854775907 $. Instead let $ A = -2 $, $ a = 2 $, and $ b = 0 $, such that $ P = \rb{2, 0} $ and $ B = 0^2 - 2^3 - -2\rb{-2} = -4 $. Then $ \gcd\rb{4A^3 + 27B^2, N} = 1 $, such that $ E : y^2 = x^3 - 2x - 4 $ is an elliptic curve over $ \Q $. Now let $ m = \rb{2}\rb{11}\rb{13}\rb{37}\rb{269}\rb{1327} = 3777382466 $ such that $ \rb{\sqrt[4]{N} + 1}^2 < 3037110719 < m $. Then $ ord\rb{P} = 2 $, so $ mP = \mathcal{O} $, and
$$ \dfrac{m}{2}P \ne \mathcal{O}, \qquad \dfrac{m}{11}P \ne \mathcal{O}, \qquad \dfrac{m}{13}P \ne \mathcal{O}, \qquad \dfrac{m}{37}P \ne \mathcal{O}, \qquad \dfrac{m}{269}P \ne \mathcal{O}, \qquad \dfrac{m}{1327}P \ne \mathcal{O}. $$
Thus $ N $ is prime with primality certificate $ \rb{m, -2, \sb{\rb{2, P}, \rb{11, P}, \rb{13, P}, \rb{37, P}, \rb{269, P}, \rb{1327, P}}} $.
\end{example}

The heart of the algorithm lies on finding a suitable elliptic curve $ E\rb{\Q} $, which in the above example is seemingly conjured from thin air. As for Lenstra's elliptic curve factorisation method, many random values of $ A $, $ a $, and $ b $ are generated, until their corresponding elliptic curve is found to have an order with enough small distinct prime factors to multiply and exceed $ \rb{\sqrt[4]{N} + 1}^2 $. This order $ E_p\rb{F_p} $ is in turn efficiently computed through the Schoof-Elkies-Atkin algorithm.

\begin{remark}
Using the Pocklington-Lehmer primality test for this example will require $ r \ge 273901883852669 $, which is a prime and will take forever, even with a supercomputer.
\end{remark}

Most algorithms in this subsection are given in full under code listings in the appendix. Unfortunately, due to the difficulty in implementing Schoof's algorithm, the Goldwasser-Kilian primality test is omitted. Historically, Schoof's algorithm was seen as too cumbersome to implement, such that the theory of complex multiplication was utilised instead to construct an elliptic curve $ E $ with an easily computable order $ E_p\rb{F_p} $. This became known as the \emph{Atkin-Morain primality test}, which remained the fastest primality proving algorithm to date, despite the later advent of the much faster Schoof-Elkies-Atkin algorithm.

\pagebreak

\subsection{Cryptography}

\emph{Cryptography} is the study of computational techniques to allow for secure communication of information across public platforms in the presence of third party eavesdroppers. It is historically based on the computational intractability of certain mathematical problems, such as integer factorisation. As the difficult computations involved in elliptic curve point multiplication became more apparent, they saw great use in modern cryptography, of which a very brief introduction will be provided in this short subsection. With the standard notation of three parties, namely \emph{Alice}, the sender, \emph{Bob}, the receiver, and \emph{Eve}, the eavesdropper, the standard process of secure communication is as follows.

\begin{algorithm}[Communication across a public domain]
Alice sends a message to Bob.
\begin{enumerate}
\item Alice intends to send a \emph{plaintext} message $ P $ to Bob, without Eve eavesdropping.
\item Alice \emph{encrypts} $ P $ with an \emph{encryption key} $ E $, which is owned only by Alice.
\item The \emph{ciphertext} message $ C = E\rb{P} $ is sent across a public domain, from Alice to Bob.
\item Bob \emph{decrypts} $ C $ with a \emph{decryption key} $ D $, which is owned only by Bob.
\item Bob recovers $ P = D\rb{C} $ from Alice.
\end{enumerate}
\end{algorithm}

In this setup, it is clear that Bob should never leak $ D $ to Eve so as to keep $ P $ secret, and that $ D $ must be the left inverse of $ E $. In the case of \emph{symmetric encryption}, the right inverse property also holds, allowing for the roles of $ E $ and $ D $ to swap. However, Alice and Bob would then need to secretly agree on $ E $ and $ D $ in advance, which may be infeasible if there are no means for prior contact. \emph{Asymmetric encryption} solves this problem by introducing two pairs of inverse keys for Alice and Bob, such that they would publish their respective encryption keys $ E_A $ and $ E_B $, while hiding their respective decryption keys $ D_A $ and $ D_B $. Whenever Alice intends to send $ P $ to Bob, Alice would send $ C = E_B\rb{P} $ across the public domain, so that only Bob could recover $ P = D_B\rb{C} $, or vice versa. The modern \emph{Rivest-Shamir-Adleman cryptosystem}, or more commonly known as the \emph{RSA}, is a asymmetric encryption system that has its basis on the difficulty of integer factorisation, and is given in the following algorithm.

\begin{algorithm}[Rivest-Shamir-Adleman cryptosystem]
Outputs a pair of keys.
\begin{enumerate}
\item Choose two distinct huge prime numbers $ p, q \in \Z_{> 0} $ of similar magnitude and compute $ n = pq $.
\item Compute $ \lambda\rb{n} = \text{lcm}\rb{p - 1, q - 1} $ and choose a small $ e \in \Z_{> 0} $ such that $ \gcd\rb{e, \lambda\rb{n}} = 1 $.
\item Compute the multiplicative inverse $ d $ of $ e $ modulo $ \lambda\rb{n} $.
\item Return the public encryption key $ \rb{n, e} $ and function $ E\rb{P} \equiv P^e \mod n $.
\item Return the private decryption key $ \rb{n, d} $ and function $ D\rb{C} \equiv C^d \mod n $.
\end{enumerate}
\end{algorithm}

The functional correctness of the algorithm trivially follows from Fermat's little theorem, and as such will not be discussed. Now $ e $ is typically chosen to be small enough for quick encryption computations, but not too small so as to be insecure. Moreover $ P $ is also assumed to have been translated into an integer beforehand with some form of \emph{padded} cipher mechanism. The following example implements the RSA.

\begin{example}
Let $ p = 2147483647 $ and $ q = 2147483659 $ be primes. Then $ n = pq = 4611686039902224373 $ and $ \lambda\rb{n} = \text{lcm}\rb{p - 1, q - 1} = 768614339267876178 $. Now choose a public encryption key $ n $ and $ e = 65537 $ such that $ \gcd\rb{e, \lambda\rb{n}} = 1 $. Thus the private decryption key is $ n $ and $ d = 73205833433176421 \equiv e^{-1} \mod l $.
\end{example}

Now the availability of increasingly powerful techniques imposes a minimum bit size of $ p $ and $ q $ in order to make the RSA even remotely practical. Furthermore, the presence of specialised algorithms, such as Pollard's $ p - 1 $ method, forces a requirement on $ p - 1 $ and $ q - 1 $ to have large factors to prevent unprecedented \emph{attacks} as well. To date, a few hundred bits of $ n $ is easily factorisable by a desktop computer within hours, if not seconds, with a suitably powerful algorithm. As such, the RSA generally chooses an $ n $ with thousands of bits, which is somewhat cumbersome for massive amounts of data, and would require larger chip sizes and power consumption in the process of encryption. On the other hand, this drawback is less evident in symmetric encryption systems, which are generally faster if $ E $ and $ D $ were somehow agreed by Alice and Bob in advance. This could be feasibly done without any prior contact with the following \emph{key exchange protocol}.

\begin{algorithm}[Diffie-Hellman key exchange]
Outputs a private symmetric key.
\begin{enumerate}
\item Alice and Bob agree on a huge prime $ p \in \Z_{> 0} $ and a small $ g \in \Z_{> 0} $ such that $ g < p $.
\item Alice chooses $ a \in \Z_{> 0} $ such that $ a < p $ and sends $ g_a \equiv g^a \mod p $ to Bob across the public domain.
\item Bob chooses $ b \in \Z_{> 0} $ such that $ b < p $ and sends $ g_b \equiv g^b \mod p $ to Alice across the public domain.
\item Alice computes $ s \equiv g_b^a \equiv g^{ab} \mod p $ privately.
\item Bob computes $ s \equiv g_a^b \equiv g^{ab} \mod p $ privately.
\end{enumerate}
\end{algorithm}

The algorithm simply uses basic properties of modular exponentiation and produces a private symmetric key $ s $ between Alice and Bob, which as aforementioned allows secure communication in a public domain. In this process, only $ p $, $ g $, $ g_a $, and $ g_b $ is immediately available to Eve, while $ a $, $ b $, and $ s $ are kept secret between Alice and Bob. The following example implements the Diffie-Hellman key exchange.

\begin{example}
Let $ p = 2147483647 $ be prime and $ g = 65537 $. Alice chooses $ a = 16777259 $ and sends the public key $ g_a = 751856369 \equiv g^a \mod p $ to Bob, while Bob chooses $ b = 16777289 $ and sends the public key $ g_b = 1654172966 \equiv g^b \mod p $ to Alice. Thus the private symmetric key is $ s = 1288974049 \equiv g^{ab} \mod p $.
\end{example}

Reverse engineering these values as a third party attacker is known as the \emph{discrete logarithm problem}, which is, analogous to integer factorisation, computationally infeasible provided $ p $ is chosen to be huge. While there is an impossibly slow, naive approach by simply trying $ g^n $ for each $ n \in \Z_{> 0} $ until $ g^n = g^a $ or $ g^n = g^b $ is obtained, there are no known algorithms efficient enough to crack the system.

\begin{remark}
Unfortunately, the non-existence of efficient polynomial time algorithms for integer factorisation and the discrete logarithm problem is unproven. In fact, a \emph{quantum computer} running \emph{Shor's algorithm} would theoretically do both of these in polynomial time.
\end{remark}

Rephrasing the Diffie-Hellman key exchange in terms of finite cyclic groups, modulo operations involving $ p $ is equivalent to operating under the finite multiplicative cyclic group $ \Z_p^* $, while $ g $ is simply any generator of $ \Z_p^* $. A elliptic curve variant of Diffie-Hellman can then be stated easily as follows.

\begin{algorithm}[Elliptic curve Diffie-Hellman]
Outputs a private symmetric key.
\begin{enumerate}
\item Alice and Bob agree on an elliptic curve $ E $ over $ \F_p $ for some prime $ p \in \Z_{> 0} $ and a point $ P \in E\rb{\F_p} $.
\item Alice chooses $ a \in \Z_p^* $ and sends $ P_a = aP $ to Bob across the public domain.
\item Bob chooses $ b \in \Z_p^* $ and sends $ P_b = bP $ to Alice across the public domain.
\item Alice computes $ S = a\rb{P_b} = a\rb{bP} = abP $ privately.
\item Bob computes $ S = b\rb{P_a} = b\rb{aP} = abP $ privately.
\end{enumerate}
\end{algorithm}

The prior example can then be illustrated with elliptic curve Diffie-Hellman as follows.

\begin{example}
Let $ E : y^2 = x^3 + 65537x + 1 $ be an elliptic curve over $ \F_p $ where $ p = 2147483647 $ and $ P = \rb{0, 1} \in E\rb{\F_p} $. Alice chooses $ a = 16777259 $ and sends the public key $ P_a = aP = \rb{675295473, 1821381850} $ to Bob, while Bob chooses $ b = 16777289 $ and sends the public key $ P_b = bP = \rb{294235749, 438747352} $ to Alice. Thus the private symmetric key is $ S = abP = \rb{1210475635, 471187571} $.
\end{example}

The discrete logarithm problem on certain elliptic curves over finite fields is also significantly harder than that of generic finite fields, and as such a list of recommended elliptic curves for use in key exchanges was published publicly by the National Institute of Standards and Technology. These elliptic curves are used in several other cryptosystems, such as the underlying group of the \emph{ElGamal encryption system}, or in other cryptographic contexts, such as \emph{digital signatures}, but will not be discussed further. Most of these elliptic curve based systems require fewer bits than those based on traditional finite fields. An estimate places a key size of less than $ 2^9 $ bits having an equivalent security to a key size of $ 2^{12} $ bits for the RSA.

\begin{remark}
Unfortunately, the discrete logarithm problem for elliptic curves is still susceptible to attacks from a quantum computer. The \emph{supersingular isogeny key exchange} is an analogue of Diffie-Hellman that considers isogenies, and would in theory resist quantum attacks, but has a higher performance overhead.
\end{remark}

\pagebreak

\appendix

\section{Preliminaries}

\subsection{Rings and fields}

Let $ R $ be a commutative unital ring and $ F \subseteq K \subseteq L $ be fields.

\begin{definition}[Automorphism]
An \textbf{automorphism} of $ R $ is an isomorphism from $ R $ to itself, which are elements of the \textbf{automorphism group} $ Aut\rb{R} $ with respect to composition.
\end{definition}

\begin{example}
$ id_R $ is an automorphism of $ R $.
\end{example}

\begin{definition}[Prime ideal]
An ideal $ I \subset R $ is \textbf{prime} iff $ ab \in I $ implies $ a \in I $ or $ b \in I $ for any two elements $ a, b \in I $.
\end{definition}

\begin{example}
An irreducible element $ r \in R $ in a unique factorisation domain $ R $ generates a prime ideal $ \ab{r} $.
\end{example}

\begin{definition}[Chain]
A \textbf{chain} of subsets in $ R $ of length $ n \in \Z_{\ge 0} $ is a sequence of distinct subsets $ S_0 \subset \dots \subset S_n \subset R $.
\end{definition}

\begin{example}
$ \ab{0} \subset \ab{x_1} \subset \dots \subset \ab{x_1, \dots, x_n} \subset F\sb{x_1, \dots, x_n} $ is a chain of prime ideals of length $ n $.
\end{example}

\begin{definition}[Characteristic]
The \textbf{characteristic} $ char\rb{F} $ of $ F $ is the smallest $ n \in \Z_{> 0} $, if it exists, such that $ n \cdot 1 = 1 + \dots + 1 = 0 $. Otherwise $ char\rb{F} $ is $ 0 $.
\end{definition}

\begin{example}
$ char\rb{\C} = char\rb{\R} = char\rb{\Q} = 0 $ while $ char\rb{\F_{p^e}} = p $ for prime $ p \in \Z_{> 0} $ and $ e \in \Z_{\ge 0} $.
\end{example}

\begin{definition}[Field extension]
$ K $ is a \textbf{field extension} of $ F $, denoted by $ K / F $, iff $ F $ is a subfield of $ K $.
\end{definition}

\begin{example}
$ \C / \R $, $ \R / \Q $, $ \C / \Q $, and $ \F_{p^e} / \F_{p^{e'}} $ for prime $ p \in \Z_{> 0} $ and $ e \mid e' $ are field extensions.
\end{example}

\begin{definition}[$ F $-homomorphism]
An \textbf{$ F $-homomorphism} from $ K / F $ to another field extension $ K' / F $ is a field homomorphism $ \phi : K \to K' $ such that $ \val{\phi}_F = \val{id}_F $. The definitions of \textbf{$ F $-isomorphism} and \textbf{$ F $-automorphism} extend naturally, with $ Aut_F\rb{K} $ denoting the \textbf{$ F $-automorphism group} of $ K $.
\end{definition}

\begin{example}
Complex conjugation is an $ \R $-automorphism of $ \C $.
\end{example}

\begin{definition}[Finite extension]
$ K / F $ is \textbf{finite} iff the dimension $ dim_F K $ of $ K $ as a vector space over $ F $ is finite.
\end{definition}

\begin{example}
$ \C / \R $ is a finite extension with $ \sb{\C : \R} = 2 $ since $ \cb{1, i} $ is a basis of $ \C $ over $ \R $.
\end{example}

\begin{definition}[Finitely generated]
$ F\rb{s_1, \dots, s_n} $ is \textbf{finitely generated} by $ s_1, \dots, s_n \in K $ over $ F $ iff $ F\rb{S} $ is the smallest subfield of $ K $ containing $ s_1, \dots, s_n $ and the elements of $ F $.
\end{definition}

\begin{example}
$ \Q\rb{\sqrt{2}, \sqrt{3}} $ is finitely generated by $ \cb{\sqrt{2}, \sqrt{3}} $ over $ \Q $, by $ \cb{\sqrt{2}} $ over $ \Q\rb{\sqrt{3}} $, and by $ \cb{\sqrt{3}} $ over $ \Q\rb{\sqrt{2}} $.
\end{example}

\begin{definition}[Number field]
$ K $ is a \textbf{number field} iff $ K / F $ is finite and $ F = \Q $.
\end{definition}

\begin{example}
$ \Q\rb{\sqrt{d}} $ for square-free $ d \in \Z $ are number fields with $ \sb{\Q\rb{\sqrt{d}} : \Q} = 2 $.
\end{example}

\begin{definition}[Algebraic element]
$ \alpha \in K $ is \textbf{algebraic} over $ F $ iff it is a root of some non-zero polynomial in $ F\sb{x} $. Otherwise $ \alpha $ is \textbf{transcendental} over $ F $.
\end{definition}

\begin{example}
$ \pi $ is transcendental over $ \Q $ but algebraic over $ \R $ since it is the root of $ x - \pi $.
\end{example}

\begin{definition}[Minimal polynomial]
The \textbf{minimal polynomial} $ m_\alpha $ of $ \alpha $ over $ F $ is the unique monic irreducible polynomial in $ F\sb{x} $ with $ \alpha $ as a root.
\end{definition}

\begin{example}
The minimal polynomial of $ \sqrt{2} $ is $ x^2 - 2 $ over $ \Q $ and is $ x - \sqrt{2} $ over $ \R $.
\end{example}

\begin{definition}[Algebraic extension]
$ K / F $ is \textbf{algebraic} iff any element in $ K $ is algebraic over $ F $. Otherwise $ K / F $ is \textbf{transcendental}.
\end{definition}

\begin{example}
$ \C / \Q $ is not an algebraic extension since $ \pi $ is transcendental over $ \Q $.
\end{example}

\begin{definition}[Algebraically closed]
$ F $ is \textbf{algebraically closed} iff any non-constant polynomial in $ F\sb{x} $ has a root in $ F $.
\end{definition}

\begin{example}
$ \R $ is not algebraically closed since $ x^2 + 1 \in \R\sb{x} $ has no roots in $ \R $.
\end{example}

\begin{definition}[Algebraic closure]
An \textbf{algebraic closure} of $ F $ is an algebraically closed algebraic extension of $ F $ that is unique up to $ F $-isomorphism.
\end{definition}

\begin{example}
$ \overline{\R} = \C $ while $ \overline{\Q} $ is the field of algebraic numbers.
\end{example}

The existence and uniqueness of algebraic closures can be proven from \emph{Zorn's lemma}, which is equivalent to the \emph{Axiom of choice}.

\begin{proposition}
An algebraic closure $ \overline{F} $ of $ F $ exists and is unique up to $ F $-isomorphism.
\end{proposition}

\begin{definition}[Splits]
A polynomial $ f\rb{x} \in F\sb{x} $ of degree $ n > 0 $ \textbf{splits} over $ K $ iff $ f\rb{x} = c\prod_{i = 0}^n \rb{x - a_k} $ for some $ c \in F $ and $ a_k \in K $.
\end{definition}

\begin{example}
$ x^2 - 2 $ splits over $ \Q\rb{\sqrt{2}} $ but not over $ \Q $ since $ x^2 - 2 = \rb{x - \sqrt{2}}\rb{x + \sqrt{2}} $ in $ \Q\rb{\sqrt{2}} $.
\end{example}

\begin{definition}[Normal extension]
$ K / F $ is \textbf{normal} iff $ K / F $ is algebraic and any irreducible polynomial in $ F\sb{x} $ with a root in $ K $ splits over $ F $.
\end{definition}

\begin{example}
$ \Q\rb{\sqrt{2}} / \Q $ is a normal extension, while $ \Q\rb{\sqrt[3]{2}} / \Q $ is not a normal extension since $ f\rb{x} = x^3 - 2 = \rb{x - \sqrt[3]{2}} \rb{x^2 + \sqrt[3]{2}x + \sqrt[3]{4}} $ has a root $ x = \sqrt[3]{2} $ but does not split over $ \Q\rb{\sqrt[3]{2}} $.
\end{example}

\begin{definition}[Separable polynomial]
An polynomial $ f \in F\sb{x} $ is \textbf{separable} iff $ df / dx \ne 0 $.
\end{definition}

\begin{example}
$ x^2 - 2 \in \Q\sb{x} $ is a separable polynomial since $ d\rb{x^2 - 2} / dx = 2x \ne 0 $, while $ x^2 - y^2 \in \F_2\rb{y^2} $ is an inseparable polynomial since $ d\rb{x^2 - y^2} / d\rb{y^2} = 0 $.
\end{example}

\begin{definition}[Separable extension]
$ K / F $ is \textbf{separable} iff $ K / F $ is algebraic and the minimal polynomial of any $ \alpha \in K $ is separable.
\end{definition}

\begin{example}
$ \Q\rb{\sqrt{2}} / \Q $ is a separable extension, while $ \F_2\rb{y} / \F_2\rb{y^2} $ is an inseparable extension since the minimal polynomial of $ y $ over $ F_2\rb{y^2} $ is $ x^2 - y^2 $, which is inseparable.
\end{example}

\begin{definition}[Galois extension]
$ K / F $ is \textbf{Galois} iff $ K / F $ is normal and separable.
\end{definition}

\begin{example}
$ \C / \R $ and $ \Q\rb{\sqrt{2}} / \Q $ are Galois extensions.
\end{example}

\begin{definition}[Galois group]
$ Aut_F\rb{K} $ is the \textbf{Galois group} $ Gal_F\rb{K} $ of $ K $ over $ F $ iff $ K / F $ is Galois.
\end{definition}

\begin{example}
$ Gal_\R\rb{\C} = \cb{id_\R, \phi} $ where $ \phi $ is complex conjugation, while $ Gal_\Q\rb{\Q\sqrt{2}} = \cb{id_\Q, \phi} $ where $ \phi $ is the $ \Q $-automorphism that swaps $ \sqrt{2} $ and $ -\sqrt{2} $.
\end{example}

\begin{definition}[Perfect field]
$ F $ is \textbf{perfect} iff the algebraic closure of $ F $ is Galois.
\end{definition}

\begin{example}
Examples of perfect fields include any field of characteristic zero including $ \Q $, $ \R $, and $ \C $, any finite field $ \F_{p^e} $, and any algebraically closed field including $ \overline{\Q} $. Examples of imperfect fields include the field of rational functions $ \F_p\rb{y} $ of any finite field $ \F_p $ since $ x^p - y \in \F_p\rb{y} $ is irreducible but inseparable.
\end{example}

\pagebreak

\subsection{Algebraic varieties}

Let $ F $ be a perfect field of $ char\rb{F} \notin \cb{2, 3} $ with algebraic closure $ K = \overline{F} $ and Galois group $ Gal_F\rb{K} $.

\begin{definition}[Affine space]
An \textbf{affine $ n $-space} over $ F $ is $ \A^n = K^n $.
\end{definition}

\begin{definition}[Projective space]
A \textbf{projective $ n $-space} over $ F $ is $ \P^n = \rb{\A^{n + 1} \setminus \cb{\rb{0, \dots, 0}}} / \sim $, the set of equivalence classes of \textbf{homogeneous coordinates} $ \sb{p_0, \dots, p_n} $, where $ \rb{x_0, \dots, x_n} \sim \rb{y_0, \dots, y_n} $ iff each $ x_i = \lambda y_i $ for some $ \lambda \in F^* $.
\end{definition}

$ \P^n $ can be considered a superset of $ n + 1 $ copies of $ \A^n $ by the natural inclusions $ \phi_i : \A^n \to \P^n $ for each $ i \in \cb{0, \dots, n} $ defined by
$$ \phi_i\rb{x_1, \dots, x_n} = \sb{x_1, \dots, x_i, 1, x_{i + 1}, \dots, x_n}, $$
so write $ \A^n \subseteq \P^n $. Now let $ \A^n $ be an affine $ n $-space over $ F $ and $ \P^n $ be a projective $ n $-space over $ F $.

\begin{definition}[Rational point]
The set of \textbf{$ F $-rational points} of $ \A^n $ is $ \A^n\rb{F} = F^n $, and of $ \P^n $ is
$$ \P^n\rb{F} = \cb{\sb{p_0, \dots, p_n} \in \P^n \mid \forall p_j \ne 0, \ \forall p_i, \ p_i / p_j \in F}. $$
\end{definition}

$ \A^n $ can be equipped with $ Gal_F\rb{K} $, such that $ \A^n\rb{F} = \cb{a \in \A^n \mid \forall \sigma \in Gal_F\rb{K}, \ \sigma\rb{a} = a} $. This holds similarly in $ \P^n $.

\begin{example}
$ \C^n $ is an affine $ n $-space over $ \R $, with $ \C^n\rb{\R} = \R $. $ \overline{\F}^n $ is a projective $ n $-space over $ \F^n $, with $ \overline{\F}^n\rb{\F^n} $ being the projective plane of order $ n $.
\end{example}

\begin{definition}[Homogeneous]
A polynomial $ f \in K\sb{x_0, \dots, x_n} $ is \textbf{homogeneous} of degree $ d \in \Z_{\ge 0} $ iff for any $ \lambda \in K $, it holds that $ f\rb{\lambda x_0, \dots, \lambda x_n} = \lambda^d f\rb{x_0, \dots, x_n} $. An ideal $ I \subseteq K\sb{x_0, \dots, x_n} $ is homogeneous iff $ I $ is generated by homogeneous polynomials in $ K\sb{x_0, \dots, x_n} $.
\end{definition}

A homogeneous polynomial $ f^* \in K\sb{x_0, \dots, x_n} $ can be \emph{dehomogenised} into $ f \in K\sb{x_1, \dots, x_n} $ by
$$ f\rb{x_1, \dots, x_n} = f^*\rb{1, x_1, \dots, x_n}, $$
while a non-homogeneous polynomial $ g \in K\sb{x_1, \dots, x_n} $ can be \emph{homogenised} into $ g^* \in K\sb{x_0, \dots, x_n} $ by
$$ g^*\rb{x_0, \dots, x_n} = x_0^d g\rb{x_1 / x_0, \dots, x_n / x_0}. $$

\begin{example}
$ z^3 + wxy + 7w^3 \in \C\sb{w, x, y, z} $ is homogeneous, which can be dehomogenised to $ z^3 + xy + 7 \in \C\sb{x, y, z} $. Conversely $ x^3 + 3x^2y + z^7 \in \C\sb{x, y, z} $ is non-homogeneous, which can be homogenised to $ w^4x^3 + 3w^4x^2y + z^7 \in \C\sb{w, x, y, z} $. Thus $ \ab{z^3 + wxy + 7w^3, w^4x^3 + 3w^4x^2y + z^7} \subseteq \C\sb{w, x, y, z} $ is a homogeneous ideal.
\end{example}

The following definitions are simplified by considering only prime ideals in \emph{Hilbert's Nullstellensatz}.

\begin{definition}[Algebraic variety]
An \textbf{affine algebraic variety} of $ \A^n $ over $ F $ is
$$ A = \cb{a \in \A^n \mid \forall f \in I, \ f\rb{a} = 0} $$
for some finitely generated prime ideal $ I \subseteq F\sb{x_1, \dots, x_n} $, denoted by $ A\rb{I} $ and $ I\rb{A} $ respectively. The set of $ F $-rational points of $ A $ is $ A\rb{F} = A \cap \A^n\rb{F} $. A \textbf{projective algebraic variety} $ P $ of $ \P^n $ over $ F $ and the set of $ F $-rational points of $ P $ are defined similarly but with homogeneous prime ideals.
\end{definition}

Since $ I\rb{A} $ can be finitely generated by $ f_1, \dots, f_m \in F\sb{x_1, \dots, x_n} $, it holds that $ A\rb{f_1, \dots, f_m}\rb{F} $ is the set of solutions in $ F $ to the system of equations $ f_1\rb{x_1, \dots, x_n} = \dots = f_m\rb{x_1, \dots, x_n} = 0 $. This holds similarly in $ \P^n $.

\begin{example}
Let $ \ab{x^2 + y^2 - 1} \subseteq \R\sb{x, y} $ be a finitely generated prime ideal. Thus $ A\rb{x^2 + y^2 - 1} $ is an affine algebraic variety of $ \C^2 $ over $ \R $ and $ A\rb{x^2 + y^2 - 1}\rb{\R} $ is the unit circle $ S^1 $. Homogenisation gives a finitely generated homogeneous ideal $ \ab{x^2 + y^2 - w^2} \subseteq \R\sb{w, x, y} $. Similarly $ P\rb{x^2 + y^2 - w^2} $ is a projective algebraic variety of $ \C^2 $ over $ \R $ and $ P\rb{x^2 + y^2 - w^2}\rb{\R} $ is the unit circle $ S^1 $.
\end{example}

Let $ A $ be an affine algebraic variety of $ \A^n $ over $ F $ and $ P $ be a projective algebraic variety of $ \P^n $ over $ F $.

\begin{definition}[Dimension]
The \textbf{dimension} $ dim\rb{A} $ of $ A $ is the length of any longest chain of prime ideals in $ F\sb{x_1, \dots, x_n} / I\rb{A} $. The dimension of $ P $ is $ dim\rb{P} = dim\rb{A\rb{I\rb{P}}} - 1 $ for any $ A\rb{I\rb{P}} \subseteq \A^n $.
\end{definition}

\begin{example}
Let $ A\rb{x - y} $ be an affine algebraic variety of $ \C^3 $ over $ \R $. Then a longest chain of prime ideals is $ \ab{0} \subset \ab{y} \subset \ab{y, z} \subset \R\sb{x, y, z} / \ab{x - y} $, which has length two. Thus it has dimension $ dim\rb{A\rb{x - y}} = 2 $. A projective algebraic variety $ P\rb{x - y} $ of $ \C^2 $ over $ \R $ has dimension $ dim\rb{P\rb{x - y}} = dim\rb{A\rb{x - y}} - 1 = 1 $.
\end{example}

The dimension of projective algebraic varieties can also be defined from \emph{Krull's Hauptidealsatz}.

\begin{proposition}
$ dim\rb{P} = n - 1 $ iff $ I\rb{P} $ is generated by a homogeneous irreducible polynomial in $ F\sb{X_0, \dots, X_n} $.
\end{proposition}

\begin{definition}[Smooth]
A point $ a \in A $ is \textbf{singular} iff the Jacobian $ m \times n $ matrix $ J $ defined by $ J_{ij} = \partial f_i / \partial x_j $ is such that $ rk\rb{\val{J}_a} < n - dim\rb{A} $. $ A $ is \textbf{smooth} if it has no singular points. This holds similarly for $ P $.
\end{definition}

\begin{example}
Let $ A\rb{x - y} $ be an affine algebraic variety of $ \C^3 $ over $ \R $. Then $ dim\rb{A\rb{x - y}} = 2 $, so a point $ a = \rb{x, y, z} \in A\rb{x - y} $ is singular iff $ rk\rb{\val{J}_a} < 3 - 2 = 1 $, or
$$ 0 = rk\rb{\val{J}_a} = rk\onebythree{\val{\dfrac{\partial \rb{x - y}}{\partial x}}_a}{\val{\dfrac{\partial \rb{x - y}}{\partial y}}_a}{\val{\dfrac{\partial \rb{x - y}}{\partial z}}_a} = rk\onebythree{1}{-1}{0} = 1. $$
Thus there are no singular points and $ A\rb{x - y} $ is smooth.
\end{example}

\begin{definition}[Function field]
The \textbf{function field} of $ P $ is
$$ F\rb{P} = \cb{f\rb{x_0, \dots, x_n} / g\rb{x_0, \dots, x_n} \mid f, g \in F\sb{x_0, \dots, x_n}, \ \deg\rb{f} = \deg\rb{g}, \ g \notin I\rb{P}} / \sim, $$
the field of equivalence classes of \textbf{rational functions} of homogeneous polynomials, where $ f / g \sim f' / g' $ iff $ fg' - f'g \in I\rb{P} $.
\end{definition}

\begin{example}
Let $ P\rb{xy} $ be a projective algebraic variety of $ \C $ over $ \R $. Then $ x \in \R\sb{x, y} $ and $ y \in \R\sb{x, y} $ are homogeneous of degree one, and $ y \notin I\rb{P} $. Thus $ x / y \in \R\rb{P} $.
\end{example}

Let $ P' $ be a projective algebraic variety of $ \P^m $ over $ F $.

\begin{definition}[Morphism]
A \textbf{morphism} from $ P $ to $ P' $ is an equivalence class of rational functions $ \phi = \sb{\phi_0, \dots, \phi_m} : P \to P' $ for some $ \phi_i \in F\rb{P} $, such that for any $ p \in P $, there is a rational function $ g \in F\rb{P} $ such that $ g\phi_i\rb{p} \in P' $ for each $ \phi_i $ and $ g\phi_i\rb{p} \ne 0 $ for some $ \phi_i $, where $ \rb{\phi_0, \dots, \phi_m} \sim \rb{\psi_0, \dots, \psi_m} $ iff each $ \phi_i = g'\psi_i $ for some $ g' \in F\rb{P} $.
\end{definition}

\begin{example}
Let $ P\rb{x^2 + y^2 - w^2} $ be a projective algebraic variety of $ \C^2 $ over $ \R $ and $ P'\rb{0} $ be a projective algebraic variety of $ \C $ over $ \R $, and let $ \phi = \sb{w + x, y} : P \to P' $ be such that $ w + x, y \in \R\rb{P} $. Let $ p = \sb{w, x, y} \in P $ be a point such that $ w + x \ne 0 $ or $ y \ne 0 $. Then $ w + x, y \ne 0 $ are well-defined at $ p $. Now let $ p' = \sb{w, x, y} \in P $ be a point such that $ w + x = y = 0 $. Then $ \rb{\rb{w - x} / y}\rb{w + x} = \rb{w^2 - x^2} / y = y^2 / y = y $ and $ \rb{\rb{w - x} / y}y = w - x \ne 0 $ are well-defined at $ p' $. Thus $ \phi $ is a morphism.
\end{example}

A standard result in algebraic geometry states that images of morphisms are projective algebraic varieties.

\begin{proposition}
Let $ \phi : P \to P' $ be a morphism and $ dim\rb{P} = dim\rb{P'} = 1 $. Then $ \phi $ is either constant or surjective.
\end{proposition}

\begin{definition}[Isomorphism]
An \textbf{isomorphism} is a morphism $ \phi : P \to P' $ such that there is another morphism $ \phi' : P' \to P $ where $ \phi' \circ \phi = id_P $ and $ \phi \circ \phi' = id_{P'} $. $ P $ and $ P' $ are \textbf{isomorphic}, denoted by $ P \cong P' $, iff there is an isomorphism $ \phi : P \to P' $.
\end{definition}

\begin{example}
Let $ P\rb{x^2 + y^2 - w^2} $ be a projective algebraic variety of $ \C^2 $ over $ \R $ and $ P'\rb{0} $ be a projective algebraic variety of $ \C $ over $ \R $ with a morphism $ \phi : \sb{w + x, y} : P \to P' $. Then $ \phi' = \sb{x^2 + y^2, x^2 - y^2, 2xy} : P' \to P $ is also a morphism such that $ \phi \circ \phi' = \sb{2x^2, 2xy} = \sb{x, y} = id_{P'} $ and
$$ \phi' \circ \phi = \sb{\rb{w + x}^2 + y^2, \rb{w + x}^2 - y^2, 2\rb{w + x}y} = \sb{2w\rb{w + x}, 2x\rb{w + x}, 2y\rb{w + x}} = \sb{w, x, y} = id_P. $$
Thus $ \phi $ is an isomorphism and $ P \cong P' $.
\end{example}

\pagebreak

\subsection{Algebraic curves}

Let $ F $ be a perfect field of $ char\rb{F} \notin \cb{2, 3} $ with algebraic closure $ K = \overline{F} $ and $ V $ be a projective algebraic variety of $ \P^n $ over $ F $.

\begin{definition}[Projective plane curve]
$ V $ is a \textbf{projective plane curve} iff $ dim\rb{V} = 1 $ and $ n = 2 $.
\end{definition}

Since a projective plane curve $ V $ is such that $ \dim\rb{V} = 1 = 2 - 1 $, it holds that $ I\rb{V} $ is generated by some homogeneous irreducible polynomial $ f \subseteq F\sb{X, Y, Z} $. For ease of notation $ V $ will be written in the form $ V : f\rb{X, Y, Z} = 0 $, or in its simpler dehomogeneous form $ V : f\rb{x, y} = 0 $. Now let $ C : f\rb{X, Y, Z} = 0 $ and $ C' : g\rb{X, Y, Z} = 0 $ be two projective plane curves over $ F $ with a point $ P = \sb{a, b, c} \in C \cap C' $.

\begin{definition}[Multiplicity]
The \textbf{multiplicity} $ m_P\rb{f} $ of $ C $ at $ P $ is the smallest $ m \in \Z_{> 0} $ such that
$$ \forall i, j, k \in \Z_{\ge 0}, \qquad i + j + k = n, \qquad \val{\dfrac{\partial^n f}{\partial X^i \partial Y^j \partial Z^k}}_P = 0 $$
for any $ n \in \cb{0, \dots, m - 1} $ but not $ n = m $.
\end{definition}

$ P $ is singular iff $ rk\rb{\val{J}_P} < 1 $, or $ \val{\partial f / \partial X}_P = \val{\partial f / \partial Y}_P = \val{\partial f / \partial Z}_P = 0 $, which holds iff $ m_P\rb{f} > 1 $.

\begin{example}
Assume $ char\rb{F} = 0 $, and let $ f\rb{X, Y, Z} = f\rb{x, y} = \rb{x^2 + y^2}^2 + 3x^2y - y^3 $ with $ P = \sb{0, 0, 1} = \rb{0, 0} $. Then
$$ \val{\dfrac{\partial f}{\partial x}}_P = \val{\dfrac{\partial f}{\partial y}}_P = \val{\dfrac{\partial^2 f}{\partial x^2}}_P = \val{\dfrac{\partial^2 f}{\partial y^2}}_P = \val{\dfrac{\partial^2 f}{\partial x \partial y}}_P = 0, \qquad \val{\dfrac{\partial^3 f}{\partial y^3}}_P = -6 \ne 0. $$
Thus the multiplicity of $ C $ at $ P $ is $ m_P\rb{f} = 3 $ and $ P $ is singular.
\end{example}

\begin{definition}[Tangent]
The \textbf{tangents} $ T_P\rb{f} $ of $ C $ at $ P = \sb{a, b, c} $ with multiplicity $ m = m_P\rb{f} $ are the irreducible factors of the polynomial
$$ t_P\rb{f}\rb{X, Y, Z} = \sum_{i + j + k = m} \twobyone{m}{i, j, k} \val{\dfrac{\partial^m f}{\partial X^i \partial Y^j \partial Z^k}}_P \rb{X - a}^i \rb{Y - b}^j \rb{Z - c}^k. $$
\end{definition}

\begin{example}
Let $ f\rb{X, Y, Z} = f\rb{x, y} = \rb{x^2 + y^2}^2 + 3x^2y - y^3 $ with $ P = \sb{0, 0, 1} = \rb{0, 0} $ and $ m = m_P\rb{f} = 3 $. Then
\begin{align*}
t_P\rb{f}\rb{X, Y, Z} = t_P\rb{f}\rb{x, y}
& = \twobyone{3}{0}\val{\dfrac{\partial^3 f}{\partial x^3}}_Px^3 + \twobyone{3}{1}\val{\dfrac{\partial^3 f}{\partial x^2 \partial y}}_Px^2y + \twobyone{3}{2}\val{\dfrac{\partial^3 f}{\partial x \partial y^2}}_Pxy^2 + \twobyone{3}{3}\val{\dfrac{\partial^3 f}{\partial y^3}}_Py^3 \\
& = 18x^2y - 6y^3 = 6y\rb{\sqrt{3}x - y}\rb{\sqrt{3}x + y}.
\end{align*}
Thus the tangents of $ C $ at $ P $ are $ T_P\rb{f} = \cb{y, \sqrt{3}x - y, \sqrt{3}x + y} $.
\end{example}

\begin{definition}[Ordinary singularity]
A singular point $ P \in C $ is \textbf{ordinary} iff $ t_P\rb{f} $ has distinct factors.
\end{definition}

\begin{example}
Let $ f\rb{X, Y, Z} = f\rb{x, y} = \rb{x^2 + y^2}^2 + 3x^2y - y^3 $ with $ P = \sb{0, 0, 1} = \rb{0, 0} $. Then $ t_P\rb{f} $ have distinct factors $ y $, $ \sqrt{3}x - y $, and $ \sqrt{3}x + y $. Thus $ P $ is ordinary.
\end{example}

\begin{definition}[Intersection number]
The \textbf{intersection number} of $ C $ and $ C' $ at $ P $ if $ \deg\rb{\gcd\rb{f, g}} = 0 $ is $ I_P\rb{f, g} $, where $ I_P : F\sb{X, Y, Z} \times F\sb{X, Y, Z} \to \Z_{> 0} $ is defined for any $ f', g' \in F\sb{X, Y, Z} $ by:
\begin{itemize}
\item $ I_P\rb{f', g'} = I_P\rb{g', f'} $,
\item $ I_P\rb{f', g'} = I_P\rb{f', g' \circ h} $ for any affine transformation $ h $,
\item $ I_P\rb{f', g'} = I_P\rb{f', g' + hf'} $ for any $ h \in F\sb{X, Y, Z} $,
\item $ I_P\rb{f', hh'} = I_P\rb{f', h} + I_P\rb{f', h'} $ for any $ h, h' \in F\sb{X, Y, Z} $, and
\item $ I_P\rb{f', g'} \ge m_P\rb{f'} m_P\rb{g'} $, with equality iff $ T_P\rb{f'} \cap T_P\rb{g'} = \emptyset $.
\end{itemize}
\end{definition}

Since $ T_P\rb{X} = \cb{X} $, $ T_P\rb{Y} = \cb{Y} $, and $ T_P\rb{Z} = \cb{Z} $ are all distinct, it holds that $ I_P\rb{X, Y} = I_P\rb{X, Z} = I_P\rb{Y, Z} = 1 $.

\pagebreak

\begin{example}
Let $ f\rb{X, Y, Z} = f\rb{x, y} = \rb{x^2 + y^2}^2 + 3x^2y - y^3 $ and $ g\rb{X, Y, Z} = g\rb{x, y} = \rb{x^2 + y^2}^3 - 4x^2y^2 $ with $ P = \sb{0, 0, 1} = \rb{0, 0} $. Then $ \gcd\rb{f, g} = 1 $, so $ \deg\rb{\gcd\rb{f, g}} = 0 $. Now let $ h\rb{x, y} = 4x^2y + 4y^3 + 5x^2 - 3y^2 $, such that
$$ g + \rb{3y - x^2 - y^2}f = y^2h \qquad \text{and} \qquad f + \rb{y^2 - 2x^2y - y^3 - 3x^2}y = x^4. $$
Then
$$ I_P\rb{f, g} = I_P\rb{f, g + \rb{3y - x^2 - y^2}f} = I_P\rb{f, y^2h} = I_P\rb{f, y^2} + I_P\rb{f, h}. $$
The first term can be computed as
$$ I_P\rb{f, y^2} = 2I_P\rb{f, y} = 2I_P\rb{f + \rb{y^2 - 2x^2y - y^3 - 3x^2}y, y} = 2I_P\rb{x^4, y} = 8I_P\rb{x, y} = 8. $$
Now $ m_P\rb{f} = 3 $ and $ T_P\rb{f} = \cb{y, \sqrt{3}x - y, \sqrt{3}x + y} $. Since $ C'' : h\rb{x} = 0 $ is also a projective plane curve, its multiplicity at $ P $ can be computed to be $ m_P\rb{h} = 2 $ and its tangents at $ P $ can also be computed to be $ T_P\rb{h} = \cb{\sqrt{5}x - \sqrt{3}y, \sqrt{5}x + \sqrt{3}y} $. Hence $ I_P\rb{f, h} = m_P\rb{f} m_P\rb{h} = \rb{3}\rb{2} = 6 $. Thus the intersection number of $ C $ and $ C' $ at $ P $ is $ I_P\rb{f, g} = 8 + 6 = 14 $.
\end{example}

\begin{definition}[Flex]
$ P $ is a \textbf{flex} iff $ I_P\rb{f, g} > 2 $ is odd.
\end{definition}

\begin{example}
Let $ f\rb{X, Y, Z} = f\rb{x, y} = y - x^3 $ with $ P = \sb{0, 0, 1} = \rb{0, 0} $. Then $ \val{\partial f / \partial y}_P = 1 \ne 0 $, so $ m_P\rb{f} = 1 $. Since
$$ g\rb{X, Y, Z} = g\rb{x, y} = t_P\rb{f}\rb{x, y} = \val{\partial f / \partial x}_Px + \val{\partial f / \partial y}_Py = y, $$
it holds that $ \gcd\rb{f, g} = 1 $, so $ \deg\rb{\gcd\rb{f, g}} = 0 $. Hence
$$ I_P\rb{f, g} = I_P\rb{f - y, y} = I_P\rb{-x^3, y} = 3I_P\rb{-x, y} = 3 > 2. $$
Thus $ P $ is a flex.
\end{example}

The following follows from the fundamental theorem of algebra on the \emph{resultant} of $ f $ and $ g $.

\begin{theorem}[B\'ezout]
$ C $ intersects $ C' $ at $ \rb{\deg\rb{f}}\rb{\deg\rb{g}} $ points \emph{up to multiplicity}, so
$$ \sum_{P \in C \cap C'} I_P\rb{f, g} = \rb{\deg\rb{f}}\rb{\deg\rb{g}}. $$
\end{theorem}

The following follows from a \emph{dimension counting} argument.

\begin{theorem}[Cayley-Bacharach]
Let $ \deg\rb{f} = \deg\rb{g} = 3 $ such that $ C $ intersects $ C' $ at nine points up to multiplicity, and let $ C'' : h\rb{X, Y, Z} = 0 $ be a cubic projective plane curve over $ F $ such that at least eight of these points are in $ C'' $. Then the ninth point is also in $ C'' $.
\end{theorem}

The following definition is the \emph{genus-degree formula}, which is a corollary of the \emph{adjunction formula} and the \emph{Riemann-Roch theorem} for arbitrary curves and surfaces.

\begin{definition}[Degree]
The \textbf{degree} of $ C $ is $ d_C = \deg\rb{f} $.
\end{definition}

\begin{definition}[Genus]
The \textbf{genus} of $ C $ is
$$ g_C = \tfrac{1}{2}\rb{d_C - 1}\rb{d_C - 2} - \tfrac{1}{2}\sum_{P \in C} m\rb{m - 1}, $$
over all ordinary singularities $ P \in C $ with multiplicity $ m_P\rb{f} = m $.
\end{definition}

The genus of $ C $ is $ g_C = \tfrac{1}{2}\rb{d_C - 1}\rb{d_C - 2} $ if $ C $ is smooth.

\begin{example}
The line $ L : y = x $ is a smooth projective plane curve of degree one and genus zero. The unit circle $ S_1 : x^2 + y^2 = 1 $ is a smooth projective plane curve of degree two and genus zero. An elliptic curve $ E : y^2 = x^3 + Ax + B $ is a smooth projective plane curve of degree three and genus zero.
\end{example}

\pagebreak

\subsection{Groups}

Let $ G $ be an additive abelian group, with multiplication $ \cdot : \Z \times G \to G $ defined by
$$ nx = \begin{dcases} x + \dots + x & n > 0 \\ 0 & n = 0 \\ \rb{-x} + \dots + \rb{-x} & n < 0 \end{dcases}. $$

\begin{theorem}[Isomorphism theorems]
The following theorems hold:
\begin{enumerate}
\item Let $ H $ be a group and $ \phi : G \to H $ be a group homomorphism. Then:
$$ Ker\rb{\phi} \trianglelefteq G, \qquad \dfrac{G}{Ker\rb{\phi}} \cong Im\rb{\phi}. $$
\item Let $ N \trianglelefteq G $ and $ H \le G $ be subgroups. Then:
$$ N \cap H \trianglelefteq H, \qquad \dfrac{H}{N \cap H} \cong \dfrac{N + H}{N}. $$
\item Let $ N \trianglelefteq G $ and $ H \trianglelefteq G $ be subgroups such that $ N \le H $. Then:
$$ \dfrac{H}{N} \trianglelefteq \dfrac{G}{N}, \qquad \dfrac{G / N}{H / N} \cong \dfrac{G}{H}. $$
\end{enumerate}
\end{theorem}

All subgroups of $ G $ are normal, but the above theorems still hold if $ G $ is non-abelian.

\begin{definition}[Torsion element]
An \textbf{$ n $-torsion element} is an element $ x \in G $ such that $ n = ord\rb{x} $ is finite.
\end{definition}

\begin{example}
$ \Z + p / q \in \Q / \Z $ is a torsion element since $ ord\rb{x} \mid q $ is finite.
\end{example}

\begin{definition}[Torsion subgroup]
The \textbf{$ n $-torsion subgroup} $ G\sb{n} $ is the group of $ m $-torsion elements of $ G $ such that $ m \mid n $. The \textbf{torsion subgroup} $ G_{tors} $ of $ G $ is the group of $ m $-torsion elements of $ G $ for any $ m \in \Z_{\ge 0} $.
\end{definition}

\begin{example}
$ G = \R / \Z $ has torsion subgroup $ G_{tors} = \Q / \Z $ since any $ n $-torsion element $ \Z + x \in G $ is such that $ nx \in \Z $ and $ x \in \Q $.
\end{example}

\begin{definition}[Finitely generated]
$ G $ is \textbf{finitely generated} iff there are finitely many elements $ x_1, \dots, x_n \in G $ such that any element $ x \in G $ is a sum
$$ x = \sum_{i = 1}^n m_ix_i, \qquad m_i \in \Z. $$
\end{definition}

\begin{example}
$ \Z $ and $ \Z_n $ are finitely generated abelian groups.
\end{example}

The \emph{direct sum} $ \oplus $ of finitely many abelian groups is equivalent to their direct product $ \times $, thus $ \Z^n = \Z \times \dots \times \Z = \Z \oplus \dots \oplus \Z $. Now let $ G $ be finitely generated.

\begin{theorem}[Fundamental theorem of finitely generated abelian groups]
\label{thm:ftfgag}
There are unique $ r, m \in \Z_{\ge 0} $ and $ n_1, \dots, n_m \in \Z_{> 1} $ such that
$$ G \cong r\Z \oplus \bigoplus_{i = 1}^m \Z_{n_i}, $$
with each $ n_i \mid n_{i + 1} $.
\end{theorem}

\begin{definition}[Rank]
The \textbf{rank} $ rk\rb{G} $ of $ G $ is the unique $ r \in \Z_{\ge 0} $ in Theorem \ref{thm:ftfgag}.
\end{definition}

\begin{example}
A finite abelian group $ G $ has rank $ rk\rb{G} = 0 $ since $ G_{tors} = G $.
\end{example}

\pagebreak

\section{Algorithm proofs}

\subsection{Transformation of a cubic curve into Weierstrass form}

Let
$$ E : f\rb{X, Y, Z} = a_1X^3 + a_2X^2Y + a_3XY^2 + a_4Y^3 + a_5X^2Z + a_6XYZ + a_7Y^2Z + a_8XZ^2 + a_9YZ^2 + a_{10}Z^3 = 0 $$
for some $ a_i \in F $ be an elliptic curve over a perfect field $ F $, and let $ P = \sb{a, b, c} \in E $ be an $ F $-rational point. Then the unique tangent at $ P $ is
\begin{align*}
L
: & \twobyone{1}{1, 0, 0}\val{\dfrac{\partial f}{\partial X}}_P\rb{X - a} + \twobyone{1}{0, 1, 0}\val{\dfrac{\partial f}{\partial Y}}_P\rb{Y - b} + \twobyone{1}{0, 0, 1}\val{\dfrac{\partial f}{\partial Z}}_P\rb{Z - c} = 0 \\
: & \rb{3a_1a^2 + 2a_2ab + a_3b^2 + 2a_5ac + a_6bc + a_8c^2}\rb{X - a} \\
& + \rb{a_2a^2 + 2a_3ab + 3a_4b^2 + a_6ac + 2a_7bc + a_9c^2}\rb{Y - b} \\
& + \rb{a_5a^2 + a_6ab + a_7b^2 + 2a_8ac + 2a_9bc + 3a_{10}c^2}\rb{Z - c} = 0.
\end{align*}
If $ P $ is not a flex, B\'ezout's theorem gives that $ L $ intersects $ E $ at three points up to multiplicity, so $ E \cap L = \cb{P, P'} $ for some other $ F $-rational point $ P' \in E $, and repeat inductively with $ P' $. This \emph{chord-tangent} method eventually terminates until $ P' $ is a flex, so assume without loss of generality that $ P $ is a flex. Now let $ Q \in L \setminus E $ be a point distinct to $ P $ and define a matrix
$$ M = \onebythree{Q}{P}{R}, \qquad R \in \cb{\sb{1, 0, 0}^T, \sb{0, 1, 0}^T, \sb{0, 0, 1}^T}. $$
Since $ P $ and $ Q $ are linearly independent, at least one of these is invertible. Then transforming $ \sb{X, Y, Z} \mapsto M\sb{X, Y, Z}^T $ gives $ Q \mapsto \sb{1, 0, 0} $ and $ P \mapsto \sb{0, 1, 0} = \mathcal{O} $, and the elliptic curve
$$ E' : f'\rb{X, Y, Z} = a_1'X^3 + a_2'X^2Y + a_3'XY^2 + a_4'Y^3 + a_5'X^2Z + a_6'XYZ + a_7'Y^2Z + a_8'XZ^2 + a_9'YZ^2 + a_{10}'Z^3 = 0. $$
for some $ a_i' \in F $. Since $ \mathcal{O} \in E' $, it holds that $ f'\rb{0, 1, 0} = a_4' = 0 $. Now the tangent at $ \mathcal{O} $ is
$$ L' : \twobyone{1}{1, 0, 0}\val{\dfrac{\partial f'}{\partial X}}_\mathcal{O}X + \twobyone{1}{0, 1, 0}\val{\dfrac{\partial f'}{\partial Y}}_\mathcal{O}\rb{Y - 1} + \twobyone{1}{0, 0, 1}\val{\dfrac{\partial f'}{\partial Z}}_\mathcal{O}Z = 0 : a_3'X + a_7'Z = 0. $$
Since $ L' : Z = 0 $, it holds that $ a_3' = 0 $ and $ a_7' \ne 0 $. Then $ L' $ intersects $ E' $ at
$$ a_1'X^3 + a_2'X^2Y + a_5'X^2\rb{0} + a_6'XY\rb{0} + a_7'Y^2\rb{0} + a_8'X\rb{0}^2 + a_9'Y\rb{0}^2 + a_{10}'\rb{0}^3 = X^2\rb{a_1'X + a_2'Y} = 0. $$
Since $ \mathcal{O} $ is a flex, it holds that $ X = 0 $ is repeated three times, so $ a_1' \ne 0 $ and $ a_2' = 0 $. Hence
\begin{align*}
E'
& : a_1'X^3 + a_5'X^2Z + a_6'XYZ + a_7'Y^2Z + a_8'XZ^2 + a_9'YZ^2 + a_{10}'Z^3 = 0 \\
& : X^3 + \dfrac{a_5'}{a_1'}X^2Z + \dfrac{a_6'}{a_1'}XYZ + \dfrac{a_7'}{a_1'}Y^2Z + \dfrac{a_8'}{a_1'}XZ^2 + \dfrac{a_9'}{a_1'}YZ^2 + \dfrac{a_{10}'}{a_1'}Z^3 = 0.
\end{align*}
Then rescaling $ \sb{X, Y, Z} \mapsto \sb{X, Y, -\rb{a_1' / a_7'}Z} $ gives
\begin{align*}
E'
& : X^3 - \dfrac{a_5'}{a_7'}X^2Z - \dfrac{a_6'}{a_7'}XYZ - Y^2Z + \dfrac{a_8'a_1'}{a_7'^2}XZ^2 + \dfrac{a_9'a_1'}{a_7'^2}YZ^2 - \dfrac{a_{10}'a_1'^2}{a_7'^3}Z^3 = 0 \\
& : Y^2Z + \dfrac{a_5'}{a_7'}X^2Z + \dfrac{a_6'}{a_7'}XYZ = X^3 + \dfrac{a_8'a_1'}{a_7'^2}XZ^2 + \dfrac{a_9'a_1'}{a_7'^2}YZ^2 - \dfrac{a_{10}'a_1'^2}{a_7'^3}Z^3.
\end{align*}
Thus $ E' $ is a Weierstrass equation.

\pagebreak

\subsection{Group law explicit formulae}

Let $ P, Q \in E $ be points such that $ R = P * Q \in E $. Since $ * $ is symmetric, it is commutative, so only the following six cases need to be considered.
\begin{enumerate}[label=$ \rb{*}_\arabic* $]
\item Assume that $ P = \rb{a, b} $ and $ Q = \rb{a, b'} $ for $ b \ne b' $. Then the line joining $ P $ and $ Q $ is
$$ L : \rb{b - b'}X + \rb{ab' - ab}Z = 0 : X = aZ, $$
which intersects $ E $ at
$$ Y^2Z = \rb{aZ}^3 + A\rb{aZ}Z^2 + BZ^3 \qquad \implies \qquad Z\rb{a^3Z^2 + AaZ^2 + BZ^2 - Y^2} = 0. $$
If $ Z \ne 0 $, then this can be dehomogenised into
$$ y^2 = a^3 + Aa + B, $$
which has trivial solutions opposite in sign, so $ b' = -b $. Thus $ Z = 0 $ and $ R = \mathcal{O} $.
\item Assume that $ P = \rb{a, b} $ and $ Q = \rb{a', b'} $ for $ a \ne a' $, and let
$$ \lambda = \dfrac{b - b'}{a - a'}, \qquad \mu = \dfrac{ab' - a'b}{a - a'}. $$
Then the line joining $ P $ and $ Q $ is
$$ L : \rb{b - b'}X + \rb{a' - a}Y + \rb{ab' - a'b}Z = 0 : Y = \lambda X + \mu Z, $$
which intersects $ E $ at
$$ \rb{\lambda X + \mu Z}^2Z = X^3 + AXZ^2 + BZ^3 \qquad \implies \qquad X^3 - \lambda^2X^2Z + \rb{A - 2\lambda\mu}XZ^2 - \rb{\mu^2 - B}Z^3 = 0. $$
Since $ Z = 0 $ gives $ Y = 0 $, it holds that $ Z \ne 0 $, and this can be dehomogenised into
$$ x^3 - \lambda^2x^2 + \rb{A - 2\lambda\mu}x - \rb{\mu^2 - B} = 0. $$
Let $ R = \rb{a'', b''} $. Since
$$ 0 = \rb{x - a}\rb{x - a'}\rb{x - a''} = x^3 - \rb{a + a' + a''}x^2 + \rb{aa' + a'' + a'a''}x - aa'a'', $$
comparing coefficients gives
$$ \lambda^2 = a + a' + a'', \qquad A - 2\lambda\mu = aa' + aa'' + a'a'', \qquad \mu^2 - B = aa'a''. $$
Thus $ R = \rb{\lambda^2 - a - a', \lambda\rb{\lambda^2 - a - a'} + \mu} $.
\item Assume that $ P = Q = \rb{a, b} $ for $ b \ne 0 $, and let
$$ \lambda = \dfrac{3a^2 + A}{2b}, \qquad \mu = \dfrac{2Aa + 3B - b^2}{2b}. $$
Then the tangent at $ P $ is
$$ L : \rb{-3a^2 - A}X + 2bY + \rb{b^2 - 2Aa - 3B}Z = 0 : Y = \lambda X + \mu Z, $$
which intersects $ E $ by $ \rb{*}_2 $ at
$$ x^3 - \lambda^2x^2 + \rb{A - 2\lambda\mu}x - \rb{\mu^2 - B} = 0. $$
Let $ R = \rb{a', b'} $. Since
$$ 0 = \rb{x - a}^2\rb{x - a'} = x^3 - \rb{2a + a'}x^2 + \rb{2aa' + a^2}x - a^2a', $$
comparing coefficients gives
$$ \lambda^2 = 2a + a', \qquad A - 2\lambda\mu = 2aa' + a^2, \qquad \mu^2 - B = a^2a'. $$
Thus $ R = \rb{\lambda^2 - 2a, \lambda\rb{\lambda^2 - 2a} + \mu} $.
\item Assume that $ P = Q = \rb{a, 0} $. Then since $ a\rb{3a^2 + A} = 3\rb{a^3} + Aa = 3\rb{-Aa - B} + Aa = -2Aa - 3B $, the tangent at $ P $ is
$$ L : \rb{-3a^2 - A}X + \rb{-2Aa - 3B}Z = 0 : X = aZ, $$
which intersects $ E $ at $ \rb{a, 0} $, $ \rb{a, -0} = \rb{a, 0} $, and $ \mathcal{O} $ by $ \rb{*}_1 $. Thus $ R = \mathcal{O} $.
\item Assume that $ P = \rb{a, b} $ and $ Q = \mathcal{O} $. Then the line joining $ P $ and $ Q $ is
$$ L : -X + aZ = 0 : X = aZ, $$
which intersects $ E $ at $ \rb{a, b} $, $ \rb{a, -b} $, and $ \mathcal{O} $ by $ \rb{*}_1 $. Thus $ R = \rb{a, -b} $.
\item Assume that $ P = Q = \mathcal{O} $. Then the tangent at $ P $ is
$$ L : Z = 0. $$
Thus $ R = \mathcal{O} $.
\end{enumerate}
Similarly since $ + $ is symmetric, it is commutative, so only the following four cases need to be considered. If $ P = \rb{a, b} $ and $ Q = \rb{a', b'} $ for $ a \ne a' $, then $ \rb{*}_2 $ and $ \rb{*}_5 $ give
\begin{align*}
P + Q
& = \rb{\lambda^2 - a - a', -\rb{\lambda\rb{\lambda^2 - a - a'} + \mu}}, \qquad \lambda = \dfrac{b - b'}{a - a'}, \qquad \mu = \dfrac{ab' - a'b}{a - a'} \\
& = \rb{\dfrac{\rb{A + aa'}\rb{a + a'} + 2\rb{B - bb'}}{\rb{a - a'}^2}, \dfrac{a'b - ab' - \rb{\dfrac{\rb{A + aa'}\rb{a + a'} + 2\rb{B - bb'}}{\rb{a - a'}^2}}\rb{b - b'}}{a - a'}} \\
& = \rb{\dfrac{\rb{A + aa'}\rb{a + a'} + 2\rb{B - bb'}}{\rb{a - a'}^2}, \dfrac{\rb{Ab' - a'^2b}\rb{3a + a'} + \rb{a^2b' - Ab}\rb{a + 3a'} - 4B\rb{b - b'}}{\rb{a - a'}^3}}.
\end{align*}
If $ P = Q = \rb{a, b} $ for $ b \ne 0 $, then $ \rb{*}_3 $ and $ \rb{*}_5 $ give
\begin{align*}
P + Q
& = \rb{\lambda^2 - 2a, -\rb{\lambda\rb{\lambda^2 - 2a} + \mu}}, \qquad \lambda = \dfrac{3a^2 + A}{2b}, \qquad \mu = \dfrac{2Aa + 3B - b^2}{2b} \\
& = \rb{\dfrac{a^4 - 2Aa^2 - 8Ba + A^2}{4b^2}, \dfrac{b^2 - 2Aa - 3B - \rb{\dfrac{a^4 - 2Aa^2 - 8Ba + A^2}{4b^2}}\rb{3a^2 + A}}{2b}} \\
& = \rb{\dfrac{a^4 - 2Aa^2 - 8Ba + A^2}{4b^2}, \dfrac{a^6 + 5Aa^4 + 20Ba^3 - 5A^2a^2 - 4ABa - A^3 - 8B^2}{8b^3}}.
\end{align*}
If $ P = \rb{a, b} $ and $ Q = \mathcal{O} $, then $ \rb{*}_5 $ gives
$$ P + Q = \rb{\rb{a, b} * \mathcal{O}} * \mathcal{O} = \rb{a, -b} * \mathcal{O} = \rb{a, b} = P. $$
Otherwise $ P + Q = \mathcal{O} $ or $ P = Q = \mathcal{O} $, then $ \rb{*}_1 $, $ \rb{*}_4 $, and $ \rb{*}_6 $ give
$$ P + Q = \rb{P * Q} * \mathcal{O} = \mathcal{O} * \mathcal{O} = \mathcal{O}. $$
Thus the explicit formulae hold.

\pagebreak

\section{Code listings}

\subsection{Fields.hs}

This module includes basic types and instances for fields and prime subfields in Section 2.

\lstinputlisting{hs/Fields.hs}

\pagebreak

\subsection{WeierstrassEquations.hs}

This module includes data for Weierstrass curves in Section 1.2, as well as related quantities and transformations.

\lstinputlisting{hs/WeierstrassEquations.hs}

\pagebreak

\subsection{GroupLaw.hs}

This module includes data for the group law in Section 1.3, as well as those of points.

\lstinputlisting{hs/GroupLaw.hs}

\pagebreak

\subsection{Rationals.hs}

This module includes the algorithms in Section 3.2 and Section 3.7.

\lstinputlisting{hs/Rationals.hs}

\pagebreak

\subsection{Applications.hs}

This module includes the algorithms in Section 4.1 and Section 4.2.

\lstinputlisting{hs/Applications.hs}

\pagebreak

\subsection{Test.hs}

This module includes input of computations from previous modules.

\lstinputlisting{hs/Test.hs}

\pagebreak

\subsection{Output.txt}

This file includes output of computations from previous modules.

\lstinputlisting{hs/Output.txt}

\pagebreak

\nocite{*}

\printbibliography[heading=bibintoc]

\end{document}