LECTURE 7, WEDNESDAY 25.02.04
FRANZ LEMMERMEYER
1. Singular Weierstrass Curves
Consider cubic curves in Weierstraß form
E : y 2 + a1 xy + a3 y = x3 + a2 x2 + a4 x + a6 ,
(1)
where the coefficients ai lie in some field K; we say that E is defined over K and
occasionally denote this by E/K.
Note that (1) is irreducible; this is clear if a1 = a3 = 0, since Y 2 = f (X) can
only be reducible if deg f is even, and can be proved with a little bit more effort in
the general case.
We next observe that the point O = [0 : 1 : 0] at infinity is always smooth since
FZ (O) = 1. It thus remains to study affine points.
Before we do that, we will show how to transform long into short Weierstrass
forms over fields of characteristic 6= 2, 3.
If K is a field of characteristic 6= 2, we can put η = y + (a1 x + a3 )/2 (we are
completing the square) and find
b6
b 2 2 b4
x + x+
4
2
4
2
2
with b2 = a1 + 4a2 , b4 = a1 a3 + 2a4 , and b6 = a3 + 4a6 .
If, moreover, char K 6= 3, then we can put ξ = x + b2 /12 and find the short
Weierstraß normal form
c6
c4
,
(3)
η2 = ξ 3 − ξ −
48
864
where
c4 = b22 − 24b4 , c6 = −b32 + 36b2 b4 − 216b6 .
η 2 = x3 +
(2)
We also introduce
b8 = a21 a6 − a1 a3 a4 + 4a2 a6 + a2 a23 − a24
and define the discriminant ∆ of E by
∆ = −b22 b8 − 8b34 − 27b26 + 9b2 b4 b6 .
We will see below that ∆ 6= 0 for elliptic (i.e., nonsingular) cubics, hence we can
define the j-invariant of E by j = c34 /∆.
We have collected all these definitions in table 1.
Recall that the discriminant of a cubic polynomial
f (x) = x3 + ax2 + bx + c = (x − α)(x − α0 )(x − α00 )
is defined to be
disc f = [(α − α0 )(α0 − α00 )(α00 − α)]2 .
1
2
FRANZ LEMMERMEYER
Table 1
b2
= a21 + 4a2 ,
b4
= a1 a3 + 2a4 ,
b6
= a23 + 4a6 ,
b8
= a21 a6 − a1 a3 a4 + 4a2 a6 + a2 a23 − a24 ,
c4
= b22 − 24b4 ,
c6
= −b32 + 36b2 b4 − 216b6 ,
∆
= −b22 b8 − 8b34 − 27b26 + 9b2 b4 b6 ,
4b8
= b2 b6 − b24 ,
1728∆
= c34 − c26 ,
j
= c34 /∆ = 1728 + c26 /∆ .
Thus disc f = 0 if and only if f has multiple roots. Moreover, for the polynomial
f (x) = x3 + 14 b2 x2 + 12 b4 x + 14 b6 on the right hand side of (2) we have 16 disc f = ∆.
When should we consider two elliptic curves to be essentially the same? Consider
the transformation
x 7−→ x0 + r,
(4)
y 7−→ y 0 + sx0 + t
for coefficients r, s, t, u ∈ K. Substituting these equations into (1) gives a new
2
3
2
equation E 0 : y 0 + a01 x0 y 0 + a03 y 0 = x0 + a02 x0 + a04 x0 + a06 , where (with a little help
from pari)
a01 = a1 + 2s,
a02 = a2 − a1 s + 3r − s2 ,
a03 = a3 + a1 r + 2t,
a04 = a4 − a3 s + 2ra2 − a1 (rs + t) − 2st + 3r2 ,
a06 = a6 + a4 r − a3 t + a2 r2 − a1 rt − t2 + r3 ,
b02
b04
b06
c04
hence
= b2 + 12r,
= b4 + rb2 + 6r2 ,
= b6 + 2rb4 + r2 b2 + 4r3 ,
= c4 ,
c06 = c6 ,
∆0 = ∆.
Thus changing the coordinate system via (4) does not change c4 , c6 , and the discriminant. These transformations allow us to move any affine point P into the
origin. Note that the point at infinity as well as the line at infinity are fixed by (4).
In addition to these translations we can also rescale the equation by substituting
x = u−2 x0 ,
(5)
y = u−3 y 0
for some u ∈ K × . After getting rid of denominators we find
2
3
2
E 0 : y 0 + a1 ux0 y 0 + a3 u3 y 0 = x0 + a2 u2 x0 + a4 u4 x0 + a6 u6 .
LECTURE 7, WEDNESDAY 25.02.04
3
Thus each ai gets multiplied by ui , and the same thing happens to the b’s and the
3
c’s. In particular c04 = u4 c4 and ∆0 = u12 ∆, hence j 0 = c04 /∆0 = j remains the
same: the j-invariant is invariant under both types of transformations (whence the
name).
Weierstrass curves that can be transformed into each other using (4) or (5) are
called isomorphic. Isomorphic elliptic curves have the same j-invariant. It can be
proved (quite easily) that elliptic curves with the same j-invariant are isomorphic
over the algebraic closure of K (that is, the transformations (4) and (5) might
involve coefficients from some extension of K).
Now we are ready for
Theorem 1. The cubic E in (1) defined over some field K is singular if and only if
∆ = 0 in K. In this case there exists a unique singular point P which is determined
as follows:
• If char K = 2 and E in given by (1), then
(√ √
( a4 , a2 a4 + a6 )
if c4 = 0 ( ⇐⇒ a1 = 0)
P =
(a3 /a1 , (a23 + a21 a4 )/a31 ) if c4 6= 0 ( ⇐⇒ a1 6= 0)
• If char K = 3 and E is given by (2), then
( √
(− 3 b6 , 0) if c4 = 0 ( ⇐⇒ b2 = 0)
P =
(−b4 /b2 , 0) if c4 =
6 0 ( ⇐⇒ b2 =
6 0)
• Finally, if char K 6= 2, 3 and E is given by (3), then
(
(0, 0)
if c4 = 0
P =
(−c6 /12c4 , 0) if c4 6= 0.
In particular, the unique singularity of E/K is always K-rational if K has characteristic 0 or is a finite field.
Proof. Let us first consider the case where char K 6= 2, 3. Then we may assume
that E is given in short Weierstrass form. Here we use the fact that invertible affine
transformations x0 = ax + by + c, y 0 = dx + ey + f map singular points to singular
points, since the derivatives of g(x0 , y 0 ) = f (x, y) with respect to x0 and y 0 are
linear combinations of f1 and f2 and therefore vanish; we also use that translations
x0 = x + c, y 0 = y + c do not change the discriminant ∆.
The derivatives we have to look at are fx = −3x2 + c4 /48 and fy = 2y. The
√
first equation gives x = ± c4 /12, the second y = 0; plugging this into (3) we get
√ 3
√
c6 = ∓ c4 (in particular we have c4 ∈ K). This implies that ∆ = 0.
√
If c4 = 0, then x = 0 and y = 0; if c4 6= 0, then x = ± c4 /12 = −c6 /12c4 . Thus
we have seen: if there is a singular point, then it is the one given above, and we
have ∆ = 0. Conversely, if ∆ = 0, then the derivatives fx and fy vanish in the
given point, and the equation ∆ = 0 guarantees that the point lies on E.
Now assume that char K = 2. Then b2 = a21 , b4 = a1 a3 , c4 = a41 , hence
c4 = 0 ⇐⇒ a1 = 0.
The coordinates of a singular point in the affine plane satisfy the three equations
f
fx
fy
= y 2 + a1 xy + a3 y + x3 + a2 x2 + a4 x + a6 ,
= a1 y + x2 + a4 ,
= a1 x + a3 .
4
FRANZ LEMMERMEYER
Note that signs are irrelevant in light of −1 = +1. If a1 = 0, then fy = 0 is
√
equivalent
to a3 = 0, and in this case we have ∆ = 0 as well as x0 = a4 and
√
y0 = a2 a4 + a6 .
If a1 6= 0, then x = a3 /a1 (since fy = 0) and y = (a23 + a21 a4 )/a31 (since fx = 0).
The condition f = 0 now yields ∆ = 0: on the one hand we have (observe that
2 = 0 and −1 = 1)
∆ = b22 b8 + b26 + b2 b4 b6
= a61 a6 + a51 a3 a4 + a41 a2 a23 + a41 a24 + a43 + a31 a33 ,
on the other hand we find
a61 f (x, y) = a61 (y 2 + a1 xy + a3 y + x3 + a2 x2 + a4 x + a6 )
= a43 + a41 a24 + a31 a33 + a31 a33 + a51 a3 a4 + a31 a33 + a41 a2 a23 + a6 a61 ,
and since 3a31 a33 = a31 a33 , we see that ∆ = 0 is in fact equivalent to f (x, y) = 0.
The case char K = 3 is left as an exercise.
Finally some remarks on the question whether the singular point is defined over
K (i.e. has coordinates from K): if K is a finite field of characteristic 2, then
x 7−→ x2 is an automorphism, hence every element of K is a square.
Corollary 2. Cubic curves in Weierstrass form are irreducible.
Proof. Reducible cubic curves consist of three lines or a conic and a line; every
point of intersection of components is singular, hence reducible cubics have at least
two singular points.
If a Weierstrass curve E defined over a field K has a singular point P , then
Ens = E(K) \ {P } is called the nonsingular part of E.
2. Addition Formulas
Let E be an elliptic curve in long Weierstrass form (1) defined over some field K.
For P ∈ E(K) we define −P as the third point of intersection of the line through
P and O = [0 : 1 : 0] with E. If P = [x1 : y1 : 1], the line P O is given by x = x1 ;
intersection gives
y 2 + (a1 x1 + a3 )y − (x31 + a2 x21 + a4 x1 + a6 ) = 0,
that is, the sum of the two roots of this quadratic equation is −(a1 x1 + a3 ); note
that this equation describes the affine points only. Since one root is given by y = y1 ,
the other one must be −(a1 x1 + a3 ) − y1 .
Given two points P1 = (x1 , y1 ) and P1 = (x2 , y2 ) in E(K) with x1 6= x2 , let
−P1 − P2 = P3 = (x3 , y3 ) be the third point of intersection of the line P1 P2 with E.
The line P1 P2 has the equation y = y1 + m(x − x1 ) with m = (y2 − y1 )/(x2 − x1 );
plugging this into (1) yields a cubic equation in x with the roots x1 , x2 and x3 .
The sum of these roots is the coefficient of x2 (observe that the coefficient of x3 is
−1), hence x3 = −x1 − x2 − a2 + m(a1 + m). Plugging this into the line equation
we find the y-coordinate of P3 , hence
x3 = −x1 − x2 + m(a1 + m),
y3 = −[y1 + m(x3 − x1 ) + a1 x3 + a3 ].
If x1 = x2 , then y1 = ±y2 . If y1 = −y2 , then we put P1 + P2 = O; if y1 = y2 ,
that is, P1 = P2 , then we let −2P1 be the third point of intersection of the tangent
to E in P1 with E; a simple calculation then gives
LECTURE 7, WEDNESDAY 25.02.04
5
Theorem 3. Let E/K be an elliptic curve given in long Weierstrass form (1). The
chord-tangent method defines an addition on the set E(K) of K-rational points on
E; the addition formulas are given by
(x1 , y1 ) + (x2 , y2 ) = (x3 , y3 ),
where
and
x3 = −x1 − x2 − a2 + a1 m + m2
y3 = −y1 − (x3 − x1 )m − a1 x3 − a3

y2 − y1


if x1 6= x2

x2 − x1
m=
3x2 + 2a2 x1 + a4 − a1 y1


if x1 = x2
 1
2y1 + a1 x1 + a3
In particular, for P = (x, y) the x-coordinate of 2P is given by
x4 − b4 x2 − 2b6 x − b8
.
4x3 + b2 x2 + 2b4 x + b6
Specializing this to curves in short Weierstrass form, we get
(6)
x2P =
x3 = −x1 − x2 + m2 , y3 = −y1 − m(x3 − x1 ),
where
(
m=
y2 −y1
x2 −x1
3x2 +a
2y
if x2 6= x1 ,
if x2 = x1 , y 6= 0.
The cases not covered by these formulas are
a) x1 = x2 and y1 = −y2 : here P1 = −P2 , hence P1 + P2 = O;
b) 2(x, y) with y = 0: here (x, 0) is a point of order 2, that is, 2(x, y) = O.
In order to see these formulas in action take the curve E : y 2 +xy = x3 −18x+27.
Here a1 = 1, a2 = a3 = 0, a4 = −18 and a6 = 27. We find b2 = 1, b4 = −36,
b6 = 108, b8 = −324, hence c4 = 865, c6 = −24625 and ∆ = 23625 = 33 · 53 · 7.
Thus E is an elliptic curve over Fp for all p 6= 3, 5, 7. The point P = (1, 1) is in
E(F2 ) : y 2 + xy = x3 + 1; let us compute a few multiples of P .
Bu the addition law we have
3x2 + 2a2 x1 + a4 − a1 y1
x2 − y1
m= 1
= 1
= 0,
2y1 + a1 x1 + a3
x1
hence x2P = −2xP + m + m2 = 0 and y2P = −yP − (x2P − xP )m − x2P = 1, i.e.,
2P = (0, 1).
We get 3P by adding P and 2P ; here m = (y2 − y1 )/(x2 − x1 ) = 0, hence
x3P = −xP − x2P = 1, as well as y3P = −yP − x3P = 0, hence 3P = (1, 0).
Finally 4P = P + 3P , but here m is not defined because xP = x3P . This implies
(since P 6= 3P ) that 4P = O. In fact we have seen that −(x, y) = (x, −a1 x−a3 −y),
so in our case we have −(x, y) = (x, −x − y), in particular −(1, 1) = (1, 0).
Thus P generates a group of order 4. Listing all points in E(F2 ) we find that
these are all, and we have proved that E(F2 ) ' Z/4Z.