52 2. Elliptic curves

Theorem 2.9.3. Let E/Q be an elliptic curve

y2

=

x3

+ Ax + B = (x − e1)(x − e2)(x − e3)

with distinct e1,e2,e3 ∈ Z and e1 + e2 + e3 = 0. There is a homomor-

phism of groups

δ : E(Q) →

Q×/(Q×)2

×

Q×/(Q×)2

×

Q×/(Q×)2

defined for P = (x0,y0) by

δ(P ) =

⎧

⎪

⎪

⎪(1,

⎪

⎪

⎪

⎪(x0

⎨

⎪

⎪

⎪

⎪

⎪(e2

⎪

⎪

⎩

1,1) if P = O;

− e1,x0 − e2,x0 − e3) if y0 = 0;

((e1 − e2)(e1 − e3),e1 − e2,e1 − e3) if P = (e1,0);

− e1, (e2 − e1)(e2 − e3),e2 − e3) if P = (e2,0);

(e3 − e1,e3 − e2, (e3 − e1)(e3 − e2)) if P = (e3,0).

If δ(P ) = (δ1,δ2,δ3), then δ1 ·δ2 ·δ3 = 1 in

Q×/(Q×)2.

Moreover, the

kernel of δ is precisely 2E(Q); i.e., if δ(Q) = (1,1,1), then Q = 2P

for some P ∈ E(Q).

Proof. Let δ be the function defined in the statement of the theorem.

Let us show that δ is a homomorphism of (abelian) groups; i.e., we

want to show that δ(P ) · δ(Q) = δ(P + Q). Notice first of all that

δ(P ) = δ(x0,y0) = δ(x0, −y0) = δ(−P ), because the definition of

δ does not depend on the sign of the y coordinate of P (in fact, it

only depends on whether y(P ) = 0). Thus, it suﬃces to prove that

δ(P ) · δ(Q) = δ(−(P + Q)) for all P, Q ∈ E(Q).

Let P = (x0,y0), Q = (x1,y1) and R = −(P + Q) = (x2,y2),

and let us assume, for simplicity, that yi = 0 for i = 1,2,3. By the

definition of the addition rule on an elliptic curve (see Figure 1), the

points P , Q and R are collinear. Let L = PQ be the line that goes

through all three points, and suppose it has equation L : y = ax + b.

Therefore, if we substitute y in the equation of E/Q, we obtain a

polynomial

p(x) = (ax +

b)2

− (x − e1)(x − e2)(x − e3).

The polynomial p(x) is cubic, its leading term is −1, and it has pre-

cisely three rational roots, namely x0, x1 and x2. Hence, it factors:

p(x) =

(ax+b)2

−(x−e1)(x−e2)(x−e3) = −(x−x0)(x−x1)(x−x2).