For an elliptic curve \((E,p_0)\) over an algebraically closed field, \(p\mapsto\OO_E(p-p_0)\) is a bijection \(E\to\Pic^0(E)\).
The group law on an elliptic curve, and multiplication by $n$ (Tag PR-CRVGRP)
Let \(E\) be a curve of genus \(1\) with a chosen point \(p_0\). Then \(p \mapsto \OO_E(p - p_0)\) is a bijection \(E \to \Pic^0(E)\), and the group structure it pulls back makes \(E\) a group variety: inversion and addition are morphisms, so \(E\) is a group scheme over \(k\) with identity \(p_0\). Under the embedding by \(\abs{3p_0}\) as a plane cubic, three points sum to zero exactly when they are collinear.
(Multiplication by $n$)
\([n] \colon E \to E\) is a finite morphism of degree \(n^2\). If \(n\) is prime to \(\operatorname{char} k\) then \(E[n] \cong (\ZZ/n)^2\). If \(n = p = \operatorname{char} k\) then \(E[p]\) is \(\ZZ/p\) or trivial, according to the Hasse invariant; the trivial case is called supersingular.
The bijection is the whole proof and is pure Riemann–Roch: given \(D\) of degree zero, \(D + p_0\) has degree \(1 > 2g-2 = 0\), so \(\ell(D+p_0) = 1\) and there is a unique effective divisor \(x\) with \(x \sim D + p_0\), that is \(D \sim x - p_0\). Surjectivity and injectivity both fall out of this uniqueness.
The chord-and-tangent construction is then a translation of the same statement: \(p + q + r \sim 3p_0\) exactly when \(p, q, r\) are cut out by a line, since \(\abs{3p_0}\) is the hyperplane system. So the geometric group law is not an extra structure, it is the linear equivalence written in coordinates.
Two consequences: a morphism of elliptic curves carrying base point to base point is automatically a group homomorphism, and \(\operatorname{End}(E, p_0)\) is a ring containing \(\ZZ\). When it is strictly larger, \(E\) has complex multiplication, which over \(\CC\) means \(\tau\) generates an imaginary quadratic field.
The group law on \(E\) is the group structure of \(\Pic^0(E)\) transported along this bijection, which Riemann–Roch supplies. On the plane cubic model given by \(\abs{3p_0}\), \(p+q+r=0\) exactly when \(p+q+r\sim3p_0\), that is, when \(p,q,r\) are the intersection of \(E\) with a line; this is the chord-and-tangent construction.
Addition and inversion are morphisms, so \(E\) is a group scheme. For \(n\neq0\), \([n]\) is a nonconstant morphism of smooth projective curves, hence finite, of degree \(n^2\).
Classification
The $j$-invariant classifies elliptic curves (Tag T-CRVJINV)
Over \(k = \bar{k}\) with \(\operatorname{char} k \neq 2\), every elliptic curve has a Legendre model \(y^2 = x(x-1)(x-\lambda)\) with \(\lambda \neq 0,1\), and \[ j = 2^8 \frac{(\lambda^2 - \lambda + 1)^3}{\lambda^2(\lambda-1)^2} \] depends only on \(E\). Two elliptic curves are isomorphic exactly when their \(j\)-invariants agree, and every element of \(k\) occurs. So \(\AA^1\) is a coarse moduli space for elliptic curves.
The construction combines Riemann–Roch, Riemann–Hurwitz, and normalization of branch points. Take \(\abs{2p_0}\): it is nonspecial, so Riemann–Roch gives \(\dim = 1\), and it is base-point free since \(E\) is not rational, giving a degree-two map \(E \to \PP^1\) with \(p_0 \mapsto \infty\). Riemann–Hurwitz forces exactly four branch points, which a Möbius transformation fixing \(\infty\) normalizes to \(0, 1, \lambda, \infty\). The residual ambiguity is the \(S_3\)-action permuting \(\{0,1,\lambda\}\), whose orbit is \(\lambda, \lambda^{-1}, 1-\lambda, (1-\lambda)^{-1}, \lambda(\lambda-1)^{-1}, \lambda^{-1}(\lambda-1)\); the formula for \(j\) is the symmetric function that kills it.
The Weierstrass model comes from \(\abs{3p_0}\): \(\ell(np_0) = n\) gives a linear relation among \(1, x, y, x^2, xy, y^2, x^3\), and completing the square puts it in Legendre form.
The space \(\AA^1\) is only a coarse moduli space: nontrivial isotrivial families show that no fine moduli space exists.
(Automorphisms)
Over \(k = \bar k\), \[ \abs{\Aut(E, p_0)} = \begin{cases} 2 & j \neq 0, 1728 \\ 4 & j = 1728, \ \operatorname{ch} k \neq 2, 3 \\ 6 & j = 0, \ \operatorname{ch} k \neq 2, 3 \\ 12 & \operatorname{ch} k = 3 \\ 24 & \operatorname{ch} k = 2 \end{cases} \] where in the last two rows \(1728 = 2^6 \cdot 3^3\) is zero in \(k\), so the conditions \(j = 0\) and \(j = 1728\) coincide and name a single curve.
Away from characteristics \(2\) and \(3\) the counts come from where the \(S_3\)-orbit of \(\lambda\) collapses: generically \(\Aut(E,p_0) = \ts{\pm 1}\); the orbit meets itself once at \(j = 1728\) (\(\lambda = -1\), the curve \(y^2 = x^3-x\)), giving order \(4\); and twice at \(j = 0\) (the Fermat cubic \(x^3+y^3=z^3\)), giving order \(6\). In all three cases the group is cyclic, generated by \((x,y) \mapsto (\zeta^2 x, \zeta^3 y)\) for an appropriate root of unity.
Characteristics \(2\) and \(3\) have different automorphism groups. In characteristic \(3\) take \(y^2 = x^3 - x\). Substituting \(x \mapsto u^2 x + r\), \(y \mapsto u^3 y\) and using that cubing is additive, the equation is preserved exactly when \(u^4 = 1\) and \(r^3 = r\), that is \(u \in \mu_4\) and \(r \in \FF_3\): twelve automorphisms. In characteristic \(2\) take \(y^2 + y = x^3\); the same computation with \(x \mapsto u^2x+r\), \(y \mapsto u^3y + u^2 s x + t\) forces \(u^3 = 1\), \(r = s^2\), \(s^4 = s\) and \(t^2 + t = s^6\), giving \(3 \cdot 4 \cdot 2 = 24\).
Two consequences follow. The automorphism group is noncommutative in these two characteristics — order \(12\) as \(\FF_3 \rtimes \mu_4\), order \(24\) as \(\SL_2(\FF_3)\) — whereas it is cyclic everywhere else. And the unique curve involved is supersingular, which is why characteristics \(2\) and \(3\) are excluded from so many statements in this chapter: the Legendre model itself requires \(\operatorname{ch} k \neq 2\).
In the proof, \(\abs{2p_0}\) gives a degree-two map \(E\to\PP^1\), Riemann–Hurwitz gives four branch points, a Möbius transformation moves them to \(0,1,\lambda,\infty\), and \(j\) is the rational function of \(\lambda\) invariant under the \(S_3\)-action permuting \(\{0,1,\lambda\}\).
\(\AA^1\) is a coarse moduli space: its \(k\)-points are the isomorphism classes of elliptic curves. It is not a fine moduli space. For \(\operatorname{char}k\neq2\), the family \(ty^2=x^3-x\) over \(\Spec k[t,t^{-1}]\) has every geometric fibre isomorphic to \(y^2=x^3-x\), but it is not isomorphic to the constant family, since the isomorphism \(y\mapsto\sqrt t\,y\) is defined only after adjoining \(\sqrt t\). The automorphism \(-1\) of every elliptic curve permits this twist.
The automorphism counts \(2\), \(4\), and \(6\) apply away from characteristics \(2\) and \(3\). In characteristic \(3\) the conditions \(j = 0\) and \(j = 1728\) describe one curve, whose automorphism group is noncommutative of order \(12\); in characteristic \(2\) the same curve has noncommutative automorphism group of order \(24\).
Over \(\CC\), elliptic curves are also classified by lattices up to homothety: elliptic curves over $\CC$.
Characteristic \(p\)
The Hasse invariant, and ordinary versus supersingular (Tag D-CRVHASSE)
Let \(k\) be perfect with \(\operatorname{ch} k = p > 0\) and let \(E/k\) be elliptic, with Frobenius \(F \colon E \to E\). Then \(F\) acts on cohomology by \[ F^* \colon H^1(E; \OO_E) \selfmap , \] which is not \(k\)-linear but \(p\)-linear: \(F^*(\lambda a) = \lambda^p F^*(a)\) for \(\lambda \in k\). Since \(E\) is elliptic, \(h^1(\OO_E) = 1\). Say \(E\) has Hasse invariant \(0\), and call \(E\) supersingular, when \(F^* = 0\); otherwise \(F^*\) is bijective, \(E\) has Hasse invariant \(1\), and \(E\) is ordinary.
(Independence of the basis)
Fix a basis vector \(e\) of the line \(H^1(E;\OO_E)\) and write \(F^*(e) = c\, e\). Then \(F^*(\lambda e) = \lambda^p c \, e = (\lambda^{p-1} c)(\lambda e)\), so changing the basis replaces \(c\) by \(\lambda^{p-1}c\), and whether \(c = 0\) is independent of the basis. If \(c \neq 0\) then \(F^*\) is injective, and it is surjective because every element of the perfect field \(k\) has a \(p\)-th root: \(\mu e = F^*\big( (\mu/c)^{1/p} e \big)\). Over an imperfect field with \(c\ne0\), the image of \(F^*\) is \(k^pc\,e\), a proper subset of \(k\,e\).
(The $p$-torsion group scheme)
The Hasse invariant separates the two possible \(p\)-torsion group schemes. In both cases \(E[p]\) has order \(p^2\), while the group of geometric points is \(\ZZ/p\) in the ordinary case and trivial in the supersingular case.
Ordinary. \(E[p] \cong \mu_p \times \ZZ/p\) over \(\bar k\). The connected-étale sequence has étale quotient \(\ZZ/p\) and connected part \(\mu_p\), which is forced by Cartier self-duality of \(E[p]\). So \(E[p](\bar k) \cong \ZZ/p\): \(p\) points, not \(p^2\).
Supersingular. \(E[p]\) is connected with connected Cartier dual — local-local — of order \(p^2\), the unique self-dual non-split extension of \(\alpha_p\) by \(\alpha_p\). It has no nontrivial \(\bar k\)-points at all, so \(E[p](\bar k) = 0\).
For a prime \(\ell \neq p\), \(E[\ell] \cong (\ZZ/\ell)^2\) over \(\bar k\). Multiplication by \(p\) has degree \(p^2\) in both cases; its separable degree is \(p\) when \(E\) is ordinary and \(1\) when \(E\) is supersingular.
(Endomorphisms)
Let \(E_{\bar k}\) be the base change of \(E\) to \(\bar k\). For \(E\) ordinary, \(\operatorname{End}(E_{\bar k},p_0)\) is \(\ZZ\) or an order in an imaginary quadratic field, and it is an order in an imaginary quadratic field when \(k\) is finite. For \(E\) supersingular, \(\operatorname{End}(E_{\bar k},p_0)\) is a maximal order in the quaternion algebra over \(\QQ\) ramified exactly at \(p\) and \(\infty\); it has rank four and is noncommutative. Over \(\CC\), the endomorphism ring of an elliptic curve has rank \(1\) or \(2\), and the \(j\)-invariants of the curves with rank \(2\) are the singular moduli; the name supersingular refers to the larger endomorphism ring, and a supersingular curve is smooth.
The group scheme \(E[p]\) always has order \(p^2\), while its geometric points number \(p\) in the ordinary case and \(1\) in the supersingular case.
The Hasse invariant criterion and the Hasse polynomial $h_p(\lambda)$ (Tag T-CRVHASSE)
Let \(\operatorname{ch} k = p > 0\) and let \(E = V(f) \subseteq \PP^2\) be a smooth cubic, \(f\) homogeneous of degree \(3\). Then \(E\) has Hasse invariant zero, that is \(E\) is supersingular, if and only if \[ \text{the coefficient of } (xyz)^{p-1} \text{ in } f^{p-1} \text{ is } 0 . \]
(The Legendre family)
For \(p \neq 2\) and \(E \colon y^2 = x(x-1)(x-\lambda)\) with \(\lambda \neq 0,1\), put \(m \da \tfrac{p-1}{2}\) and \[ h_p(\lambda) \da \sum_{i=0}^{m} \binom{m}{i}^2 \lambda^i . \] Then \(E\) is supersingular exactly when \(h_p(\lambda) = 0\). Consequently, for each \(p\) there are at most \(\left\lfloor p/12 \right\rfloor + 2\) supersingular elliptic curves over \(\bar k\) up to isomorphism.
(Where the criterion comes from)
Each step in the coefficient criterion is forced by the cohomological realization below.
The ideal sheaf of a plane cubic is \(\OO_{\PP^2}(-3)\), so \[ 0 \to \OO_{\PP^2}(-3) \xrightarrow{\ f\ } \OO_{\PP^2} \to \OO_E \to 0 . \] Since \(h^1(\OO_{\PP^2}) = h^2(\OO_{\PP^2}) = 0\), the long exact sequence gives \(H^1(\OO_E) \iso H^2(\PP^2; \OO(-3))\). That group is one-dimensional with basis the Čech class \(\tfrac{1}{xyz}\) — it is the unique monomial of degree \(-3\) with all three exponents negative. So the line whose endomorphism is being tested has a canonical monomial basis, and the test becomes a computation with monomials.
Frobenius on \(\PP^2\) sends \(\tfrac{1}{xyz} \mapsto \tfrac{1}{(xyz)^p}\). Transporting along the diagram that compares \(E = V(f)\) with \(V(f^p)\) multiplies by \(f^{p-1}\), so the image is the class of \[ \frac{f^{p-1}}{(xyz)^{p}} . \] In \(H^2(\PP^2; \OO(-3))\) every monomial with a non-negative exponent is zero, so only the term of \(f^{p-1}\) equal to \((xyz)^{p-1}\) survives, and it contributes that coefficient times \(\tfrac{1}{xyz}\). The criterion is then the definition read off: \(F^* = 0\) exactly when that coefficient vanishes.
The degree bookkeeping explains why the distinguished monomial can occur: both \(f^{p-1}\) and \((xyz)^{p-1}\) have degree \(3(p-1)\).
(Using the Legendre form)
Dehomogenising, the criterion for \(y^2 = g(x)\) with \(\deg g = 3\) becomes: supersingular exactly when the coefficient of \(x^{p-1}\) in \(g(x)^{(p-1)/2}\) vanishes. Expanding \(\big(x(x-1)(x-\lambda)\big)^m\) and collecting gives \((-1)^m h_p(\lambda)\), so the sign is irrelevant and the vanishing is \(h_p(\lambda) = 0\).
Two low-characteristic checks are:
\(p = 3\): \(m = 1\), \(h_3(\lambda) = 1 + \lambda\), so \(\lambda = -1\), and there \(\lambda^2 - \lambda + 1 = 3 = 0\), giving \(j = 0\) — the one supersingular curve in characteristic \(3\).
\(p = 5\): \(m = 2\), \(h_5(\lambda) = \lambda^2 + 4\lambda + 1\), whose roots lie in \(\FF_{25}\) and satisfy \(\lambda^2 - \lambda + 1 = -5\lambda = 0\), again giving \(j = 0\).
The count follows because \(h_p\) has degree \(m = \tfrac{p-1}{2}\) and the map \(\lambda \mapsto j\) is generically six-to-one, so the supersingular \(j\)-values number about \(p/12\); the exact count is \(\left\lfloor p/12 \right\rfloor\) adjusted by \(0, 1, 1, 2\) according to \(p \equiv 1, 5, 7, 11 \bmod 12\), which the stated bound covers. Supersingular curves therefore exist for every \(p\) and are always finite in number; \(h_p\) has simple roots, so no value of \(\lambda\) is counted twice.
The coefficient criterion comes from the ideal sequence of a plane cubic: \(H^1(\OO_E)\cong H^2(\PP^2,\OO(-3))\) is the line spanned by the Čech class \(\tfrac{1}{xyz}\), and Frobenius sends it to \(f^{p-1}/(xyz)^p\), whose image in that line is the coefficient of \((xyz)^{p-1}\) in \(f^{p-1}\) times \(\tfrac1{xyz}\). For the Legendre family this coefficient is, up to a nonzero constant, the Hasse polynomial \(h_p(\lambda)\).
Fixing the curve and varying $p$, and the density of supersingular primes (Tag FE-CRVSSPRIMES)
Let \(X = V(f) \subseteq \PP^2_{/\ZZ}\) with \(f \in \ZZ[x,y,z]\) a cubic whose base change to \(\CC\) is smooth. For all but finitely many primes the reduction \(X_{(p)} \subseteq \PP^2_{/\FF_p}\) is again smooth, and one can ask for \[ B \da \ts{ p \st X_{(p)} \text{ is smooth over } \bar\FF_p \text{ and has Hasse invariant } 0 } . \] The answer depends entirely on whether \(X_{/\CC}\) has complex multiplication:
With CM by an order in \(K\): for \(p\) of good reduction, \(p \in B\) exactly when \(p\) does not split in \(K\), that is when \(p\) is inert or ramified. Half the primes split, so \(B\) has density \(\tfrac{1}{2}\). This is Deuring’s theorem.
Without CM: \(B\) has density \(0\), and \(B\) is nevertheless infinite. Both of these are theorems, the second Elkies’. A finer count is not known: the expected asymptotic \(\abs{\ts{p \in B \st p \leq x}} \sim c\,\tfrac{\sqrt x}{\log x}\) is the Lang–Trotter conjecture and is open.
(What is proved and what is not)
The three claims have different logical status and should remain separate. Deuring’s criterion is a clean equivalence and gives the density \(\tfrac12\) immediately from Chebotarev, or from Dirichlet in the cases where the splitting condition is a congruence. Density zero in the non-CM case follows from the distribution of Frobenius traces. Infinitude in the non-CM case is much harder and was open for a long time; it is a theorem only for elliptic curves over \(\QQ\). The \(\sqrt x/\log x\) growth is a conjecture and should be labelled as one.
($y^2 = x^3 - x$, worked out)
Here \(\lambda = -1\), \(j = 1728\), and the curve has CM by \(\ZZ[i]\). Apply the criterion directly: with \(m = \tfrac{p-1}{2}\) and \(g(x) = x(x^2-1)\), \[ g(x)^m = x^m (x^2-1)^m , \] so the coefficient of \(x^{p-1} = x^{2m}\) is the coefficient of \(x^m\) in \((x^2-1)^m\). Only even powers appear there, so that coefficient is \(0\) when \(m\) is odd, and \((-1)^{m/2}\binom{m}{m/2}\) when \(m\) is even — which is prime to \(p\), since \(m < p\). Hence \[ X_{(p)} \text{ supersingular} \iff m = \tfrac{p-1}{2} \text{ is odd} \iff p \equiv 3 \bmod 4 . \] And \(p \equiv 3 \bmod 4\) is exactly the condition that \(p\) stays prime in \(\ZZ[i]\), matching the general statement. By Dirichlet these have density \(\tfrac{1}{2}\) and there are infinitely many.
($y^2 = x(x-1)(x-3)$, the contrast)
Here \(\lambda = 3\) and \[ j = 2^8 \cdot \frac{(9-3+1)^3}{9 \cdot 4} = \frac{2^6 \cdot 7^3}{3^2} \notin \ZZ . \] Computing \(h_p(3) \bmod p\) for the primes of good reduction, the only supersingular prime below \(120\) is \(p = 23\). The density-zero statement follows from the non-CM theorem above, and \(j\notin\overline{\ZZ}\) rules out complex multiplication entirely.
The density \(\tfrac12\) in the CM case comes from the splitting behavior of primes in the CM field. For a CM curve the reduction inherits the CM order, and the splitting behaviour of \(p\) in \(K\) decides whether the reduced endomorphism ring stays commutative. When \(p\) splits, Frobenius generates the old imaginary quadratic order and the curve is ordinary; when \(p\) is inert or ramified it cannot, the endomorphism ring jumps to a quaternion order, and the curve is supersingular. So a single congruence condition governs every \(p\) at once.
Without CM there is no such rigid structure and the supersingular primes are governed instead by how often the Frobenius trace \(a_p\) vanishes, a much thinner condition; density zero, infinitude, and the \(\sqrt x / \log x\) heuristic all belong to that side.
Conversely, integrality of the \(j\)-invariant gives an obstruction to CM: a non-integral rational \(j\) rules out CM, and more generally a \(j\)-invariant that is not an algebraic integer cannot be a CM \(j\)-invariant.
For a curve over \(\QQ\) with complex multiplication by an order in \(K\), a prime of good reduction is supersingular exactly when it does not split in \(K\) (Deuring), a set of density \(\tfrac{1}{2}\). Without complex multiplication the supersingular primes have density \(0\) and are infinite in number (Elkies). For \(y^2=x^3-x\), with complex multiplication by \(\ZZ[i]\), the supersingular primes are the \(p\equiv3\bmod4\), the odd primes inert in \(\ZZ[i]\).
Rational points
Mordell's theorem, and $E(\QQ)$ as a finitely generated abelian group (Tag T-CRVMORDELL)
Let \(k = \bar k\), let \((E, p_0)\) be elliptic, and embed \(E \embeds \PP^2_{/k}\) by \(\abs{3p_0}\), so \(E = V(f)\) for a cubic \(f\). Say \((E, p_0)\) is defined over a subfield \(k_0 \subseteq k\) when \(f\) can be taken with coefficients in \(k_0\) and \(p_0 \in E(k_0)\). Then \(E(k_0) \leq E(k)\) is a subgroup.
(Mordell)
If \((E,p_0)\) is defined over \(\QQ\), then \(E(\QQ)\) is a finitely generated abelian group: \[ E(\QQ) \iso \ZZ^r \oplus E(\QQ)_{\mathrm{tors}} , \] with \(r\) the rank and the torsion subgroup finite.
Rank \(0\), torsion \(C_3\). The Fermat cubic \(x^3 + y^3 = z^3\) has \[ E(\QQ) = \ts{ \tv{1:-1:0},\ \tv{1:0:1},\ \tv{0:1:1} } \iso C_3 , \] these being its three rational inflection points. That the list stops there is Fermat’s last theorem for \(n=3\), so this example is a restatement of a genuine theorem and not a computation.
Rank \(1\), no torsion. For \(y^2 + y = x^3 - x\) with \(p_0 = \tv{0:1:0}\), \[ E(\QQ) = \gens{P} \iso \ZZ, \qquad P = (0,0) \text{ in affine coordinates} . \] That \(P\) has infinite order is visible after a few doublings, and the denominators are the thing to watch: \[ 2P = (1, 0), \quad 3P = (-1,-1), \quad 4P = (2,-3), \quad 5P = \qty{ \tfrac{1}{4}, -\tfrac{5}{8} }, \quad 6P = (6, 14), \quad 7P = \qty{ -\tfrac{5}{9}, \tfrac{8}{27} } . \] The denominators appear as \(d^2\) and \(d^3\) in the two coordinates, which is exactly the shape a height function measures.
Two points require explanation: why \(E(\QQ)\) is closed under the group law, and why that subgroup is finitely generated.
The subgroup claim is not automatic and is the reason the definition insists that \(p_0\) be rational. Addition is defined by “three collinear points sum to zero”, and a line through two rational points of a rational cubic meets it in a third point whose coordinates are rational, because substituting the line into the cubic gives a cubic in one variable with rational coefficients and two rational roots, so the third root is rational too. Inversion is reflection, also rational. If \(p_0\notin E(\QQ)\), then the identity is not rational, so \(E(\QQ)\) is not a subgroup of \(E(\bar\QQ)\) with respect to that chosen group law.
That subgroup is where the geometry turns into arithmetic. Writing a rational point in lowest terms and clearing denominators converts \(E(\QQ)\) into the integral solutions of a homogeneous cubic in three variables, so the chord-and-tangent construction becomes an operation that manufactures new integer solutions from old ones — the classical secant method, predating any of this language. Reading it the other way, a Diophantine question about a cubic acquires a group acting on its own solution set, and Mordell’s theorem says that group is small enough to describe: finitely many generators account for every solution there is. This exchange is the entire reason elliptic curves sit in number theory rather than only in geometry.
Finite generation is proved by combining descent with a height argument. It is a descent: the weak Mordell theorem gives \(E(\QQ)/2E(\QQ)\) finite, and a height function measuring the arithmetic size of a point turns that finiteness into generation by a bounded set. Neither half is formal, and neither is visible from the geometry over \(\bar\QQ\), where \(E\) is divisible and nothing is finitely generated.
What the theorem does not give is the rank. Torsion is completely understood — by Mazur’s theorem, \(E(\QQ)_{\mathrm{tors}}\) is one of fifteen groups — while no algorithm is known to compute the rank \(r\) in general, and no proven uniform bound for it is known.
\(E(k_0)\) is a subgroup of \(E(k)\) because \(p_0\in E(k_0)\) and the chord-and-tangent construction has coefficients in \(k_0\). Finite generation of \(E(\QQ)\) follows from weak Mordell–Weil, the finiteness of \(E(\QQ)/2E(\QQ)\), together with a height argument. By Mazur’s theorem \(E(\QQ)_{\mathrm{tors}}\) is one of fifteen groups; no general algorithm for computing the rank \(r\) is known.
Families of elliptic curves
Elliptic curves over a scheme (Tag D-ELLSCH)
An elliptic curve over a scheme \(S\) is a proper smooth morphism \(p \colon E \to S\) with a section \(e \colon S \to E\) whose geometric fibres are connected curves of genus \(1\).
Locally on \(S\), an elliptic curve is a Weierstrass cubic: every point of \(S\) has an affine neighbourhood \(\Spec A\) over which \(E\) is the closed subscheme of \(\PP^2_A\) cut out by \[ y^2 z + a_1 xyz + a_3 y z^2 = x^3 + a_2 x^2 z + a_4 x z^2 + a_6 z^3 \] with discriminant \(\Delta \in A^\times\), and \(e\) is the point \([0:1:0]\). The fibres are elliptic curves over the residue fields, and the group laws on the fibres come from a morphism \(E \times_S E \to E\) making \(E\) a commutative group scheme over \(S\).
Over \(S = \Spec \ZZ[1/6][a, b][\Delta^{-1}]\) with \(\Delta = -16(4a^3 + 27b^2)\), the curve \(y^2 z = x^3 + a x z^2 + b z^3\) is an elliptic curve; its fibre over a point of \(S\) is the Weierstrass curve with the images of \(a\) and \(b\). Over \(\Spec \ZZ\), the equation \(y^2 z = x^3 - x z^2\) has discriminant \(64\), so it defines an elliptic curve over \(\Spec \ZZ[1/2]\) but not over \(\Spec \ZZ\).
Twists
Twists of a variety, and quadratic twists of elliptic curves (Tag D-VARTWIST)
Let \(X\) be a variety over a field \(k\). A twist of \(X\) is a variety \(T\) over \(k\) such that \(T \times_k \Spec K \cong X \times_k \Spec K\) as \(K\)-varieties for some field extension \(K/k\).
(Quadratic twists)
Let \(k\) be a field of characteristic not \(2\), \(f \in k[x]\) a monic cubic without repeated roots, \(E \colon y^2 = f(x)\), and \(d \in k^\times\). The quadratic twist \(E_d \colon d y^2 = f(x)\) is a twist of \(E\): over \(K = k(\sqrt{d})\), the substitution \(y \mapsto \sqrt{d}\, y\) is an isomorphism \(E_d \times_k K \to E \times_k K\).
Let \(E\) and \(d\) be as above. If \(d \in (k^\times)^2\), then \(E_d \cong E\) over \(k\). If \(j(E) \neq 0, 1728\) and \(d \notin (k^\times)^2\), then \(E_d \not\cong E\) over \(k\).
The hypothesis on \(j\) is needed. For \(E \colon y^2 = x^3 - x\), with \(j(E) = 1728\), and \(d = -1\), the twist \(E_{-1} \colon -y^2 = x^3 - x\) is isomorphic to \(E\) over every field \(k\) of characteristic not \(2\), by \((x, y) \mapsto (-x, y)\), whether or not \(-1\) is a square in \(k\).