| Algebraic structure →Group theory Group theory |
|---|
 |
Infinite dimensional Lie group
|
Inmathematics, anelliptic curve is asmooth,projective,algebraic curve ofgenus one, on which there is a specified pointO. An elliptic curve is defined over afieldK and describes points inK2, theCartesian product ofK with itself. If the field'scharacteristic is different from 2 and 3, then the curve can be described as aplane algebraic curve which consists of solutions(x,y) for:
for some coefficientsa andb inK. The curve is required to benon-singular, which means that the curve has nocusps orself-intersections. (This is equivalent to the condition4a3 + 27b2 ≠ 0, that is, beingsquare-free inx.) It is always understood that the curve is really sitting in theprojective plane, with the pointO being the uniquepoint at infinity. Many sources define an elliptic curve to be simply a curve given by an equation of this form. (When thecoefficient field has characteristic 2 or 3, the above equation is not quite general enough to include all non-singularcubic curves; see§ Elliptic curves over a general field below.)
An elliptic curve is anabelian variety – that is, it has a group law defined algebraically, with respect to which it is anabelian group – andO serves as the identity element.
Ify2 =P(x), whereP is any polynomial of degree three inx with no repeated roots, the solution set is a nonsingular plane curve ofgenus one, an elliptic curve. IfP has degree four and issquare-free this equation again describes a plane curve of genus one; however, it has no natural choice of identity element. More generally, any algebraic curve of genus one, for example the intersection of twoquadric surfaces embedded in three-dimensional projective space, is called an elliptic curve, provided that it is equipped with a marked point to act as the identity.
Using the theory ofelliptic functions, it can be shown that elliptic curves defined over thecomplex numbers correspond to embeddings of thetorus into thecomplex projective plane. The torus is also anabelian group, and this correspondence is also agroup isomorphism.
Elliptic curves are especially important innumber theory, and constitute a major area of current research; for example, they were used inAndrew Wiles's proof of Fermat's Last Theorem. They also find applications inelliptic curve cryptography (ECC) andinteger factorization.
An elliptic curve isnot anellipse in the sense of a projective conic, which has genus zero: seeelliptic integral for the origin of the term. However, there is a natural representation of real elliptic curves with shape invariantj ≥ 1 as ellipses in the hyperbolic plane. Specifically, the intersections of the Minkowski hyperboloid with quadric surfaces characterized by a certain constant-angle property produce the Steiner ellipses in (generated by orientation-preserving collineations). Further, the orthogonal trajectories of these ellipses comprise the elliptic curves withj ≤ 1, and any ellipse in described as a locus relative to two foci is uniquely the elliptic curve sum of two Steiner ellipses, obtained by adding the pairs of intersections on each orthogonal trajectory. Here, the vertex of the hyperboloid serves as the identity on each trajectory curve.[1]
Topologically, a complex elliptic curve is atorus, while a complex ellipse is asphere.
Although the formal definition of an elliptic curve requires some background inalgebraic geometry, it is possible to describe some features of elliptic curves over thereal numbers using only introductoryalgebra andgeometry.
In this context, an elliptic curve is aplane curve defined by an equation of the form
after a linear change of variables (a andb are real numbers). This type of equation is called a Weierstrass equation, and said to be in Weierstrass form, or Weierstrass normal form.
The definition of elliptic curve also requires that the curve benon-singular. Geometrically, this means that the graph has nocusps, self-intersections, orisolated points. Algebraically, this holds if and only if thediscriminant,, is not equal to zero.
The discriminant is zero when.
(Although the factor −16 is irrelevant to whether or not the curve is non-singular, this definition of the discriminant is useful in a more advanced study of elliptic curves.)[2]
The real graph of a non-singular curve hastwo components if its discriminant is positive, andone component if it is negative. For example, in the graphs shown in figure to the right, the discriminant in the first case is 64, and in the second case is −368. Following the convention atConic section#Discriminant,elliptic curves require that the discriminant is negative.
When working in theprojective plane, the equation inhomogeneous coordinates becomes
This equation is not defined on theline at infinity, but we can multiply by to get one that is:
This resulting equation is defined on the whole projective plane, and the curve it defines projects onto the elliptic curve of interest. To find its intersection with the line at infinity, we can just posit. This implies, which in afield means. on the other hand can take any value, and thus all triplets satisfy the equation. In projective geometry this set is simply the point, which is thus the unique intersection of the curve with the line at infinity.
Since the curve is smooth, hencecontinuous, it can be shown that this point at infinity is the identity element of agroup structure whose operation is geometrically described as follows:
Since the curve is symmetric about thex axis, given any pointP, we can take−P to be the point opposite it. We then have, as lies on theXZ plane, so that is also the symmetrical of about the origin, and thus represents the same projective point.
IfP andQ are two points on the curve, then we can uniquely describe a third pointP +Q in the following way. First, draw the line that intersectsP andQ. This will generally intersect the cubic at a third point,R. We then takeP +Q to be−R, the point oppositeR.
This definition for addition works except in a few special cases related to the point at infinity and intersection multiplicity. The first is when one of the points isO. Here, we defineP +O =P =O +P, makingO the identity of the group. IfP =Q, we only have one point, thus we cannot define the line between them. In this case, we use the tangent line to the curve at this point as our line. In most cases, the tangent will intersect a second pointR, and we can take its opposite. IfP andQ are opposites of each other, we defineP +Q =O. Lastly, ifP is aninflection point (a point where the concavity of the curve changes), we takeR to beP itself, andP +P is simply the point opposite itself, i.e. itself.
LetK be a field over which the curve is defined (that is, the coefficients of the defining equation or equations of the curve are inK) and denote the curve byE. Then theK-rational points ofE are the points onE whose coordinates all lie inK, including the point at infinity. The set ofK-rational points is denoted byE(K).E(K) is a group, because properties of polynomial equations show that ifP is inE(K), then−P is also inE(K), and if two ofP,Q,R are inE(K), then so is the third. Additionally, ifK is a subfield ofL, thenE(K) is asubgroup ofE(L).
The above groups can be described algebraically as well as geometrically. Given the curvey2 =x3 +bx +c over the fieldK (whosecharacteristic we assume to be neither 2 nor 3), and pointsP = (xP,yP) andQ = (xQ,yQ) on the curve, assume first thatxP ≠xQ (case1). Lety =sx +d be the equation of the line that intersectsP andQ, which has the following slope:
The line equation and the curve equation intersect at the pointsxP,xQ, andxR, so the equations have identicaly values at these values.
which is equivalent to
SincexP,xQ, andxR are solutions, this equation has its roots at exactly the samex values as
and because both equations are cubics, they must be the same polynomial up to a scalar. Thenequating the coefficients ofx2 in both equations
and solving for the unknownxR,
yR follows from the line equation
and this is an element ofK, becauses is.
IfxP =xQ, then there are two options: ifyP = −yQ (case3), including the case whereyP =yQ = 0 (case4), then the sum is defined as 0; thus, the inverse of each point on the curve is found by reflecting it across thex axis.
IfyP =yQ ≠ 0, thenQ =P andR = (xR,yR) = −(P +P) = −2P = −2Q (case2 usingP asR). The slope is given by the tangent to the curve at (xP,yP).
A more general expression for that works in both case 1 and case 2 is
where equality toyP −yQ/xP −xQ relies onP andQ obeyingy2 =x3 +bx +c.
For the curvey2 =x3 +ax2 +bx +c (the general form of an elliptic curve withcharacteristic 3), the formulas are similar, withs =xP2 +xPxQ +xQ2 +axP +axQ +b/yP +yQ andxR =s2 −a −xP −xQ.
For a general cubic curve not in Weierstrass normal form, we can still define a group structure by designating one of its nine inflection points as the identityO. In the projective plane, each line will intersect a cubic at three points when accounting for multiplicity. For a pointP,−P is defined as the unique third point on the line passing throughO andP. Then, for anyP andQ,P +Q is defined as−R whereR is the unique third point on the line containingP andQ.
For an example of the group law over a non-Weierstrass curve, seeHessian curves.
A curveE defined over the field of rational numbers is also defined over the field of real numbers. Therefore, the law of addition (of points with real coordinates) by the tangent and secant method can be applied toE. The explicit formulae show that the sum of two pointsP andQ with rational coordinates has again rational coordinates, since the line joiningP andQ has rational coefficients. This way, one shows that the set of rational points ofE forms a subgroup of the group of real points ofE.
This section is concerned with pointsP = (x,y) ofE such thatx is an integer.
For example, the equationy2 =x3 + 17 has eight integral solutions withy > 0:[3][4]
As another example,Ljunggren's equation, a curve whose Weierstrass form isy2 =x3 − 2x, has only four solutions withy ≥ 0 :[5]
Rational points can be constructed by the method of tangents and secants detailedabove, starting with afinite number of rational points. More precisely[6] theMordell–Weil theorem states that the groupE(Q) is afinitely generated (abelian) group. By thefundamental theorem of finitely generated abelian groups it is therefore a finite direct sum of copies ofZ and finite cyclic groups.
The proof of the theorem[7] involves two parts. The first part shows that for any integerm > 1, thequotient groupE(Q)/mE(Q) is finite (this is the weak Mordell–Weil theorem). Second, introducing aheight functionh on the rational pointsE(Q) defined byh(P0) = 0 andh(P) = log max(|p|, |q|) ifP (unequal to the point at infinityP0) has asabscissa the rational numberx =p/q (withcoprimep andq). This height functionh has the property thath(mP) grows roughly like the square ofm. Moreover, only finitely many rational points with height smaller than any constant exist onE.
The proof of the theorem is thus a variant of the method ofinfinite descent[8] and relies on the repeated application ofEuclidean divisions onE: letP ∈E(Q) be a rational point on the curve, writingP as the sum 2P1 +Q1 whereQ1 is a fixed representant ofP inE(Q)/2E(Q), the height ofP1 is about1/4 of the one ofP (more generally, replacing 2 by anym > 1, and1/4 by1/m2). Redoing the same withP1, that is to sayP1 = 2P2 +Q2, thenP2 = 2P3 +Q3, etc. finally expressesP as an integral linear combination of pointsQi and of points whose height is bounded by a fixed constant chosen in advance: by the weak Mordell–Weil theorem and the second property of the height functionP is thus expressed as an integral linear combination of a finite number of fixed points.
The theorem however doesn't provide a method to determine any representatives ofE(Q)/mE(Q).
Therank ofE(Q), that is the number of copies ofZ inE(Q) or, equivalently, the number of independent points of infinite order, is called therank ofE. TheBirch and Swinnerton-Dyer conjecture is concerned with determining the rank. One conjectures that it can be arbitrarily large, even if only examples with relatively small rank are known. The elliptic curve with the currently largest exactly-known rank is
It has rank 20, found byNoam Elkies and Zev Klagsbrun in 2020. Curves of rank higher than 20 have been known since 1994, with lower bounds on their ranks ranging from 21 to 29, but their exact ranks are not known and in particular it is not proven which of them have higher rank than the others or which is the true "current champion".[9]
As for the groups constituting thetorsion subgroup ofE(Q), the following is known:[10] the torsion subgroup ofE(Q) is one of the 15 following groups (a theorem due toBarry Mazur):Z/NZ forN = 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, or 12, orZ/2Z ×Z/2NZ withN = 1, 2, 3, 4. Examples for every case are known. Moreover, elliptic curves whose Mordell–Weil groups overQ have the same torsion groups belong to a parametrized family.[11]
TheBirch and Swinnerton-Dyer conjecture (BSD) is one of theMillennium problems of theClay Mathematics Institute. The conjecture relies on analytic and arithmetic objects defined by the elliptic curve in question.
At the analytic side, an important ingredient is a function of a complex variable,L, theHasse–Weil zeta function ofE overQ. This function is a variant of theRiemann zeta function andDirichlet L-functions. It is defined as anEuler product, with one factor for everyprime numberp.
For a curveE overQ given by a minimal equation
with integral coefficients, reducing the coefficientsmodulop defines an elliptic curve over thefinite fieldFp (except for a finite number of primesp, where the reduced curve has asingularity and thus fails to be elliptic, in which caseE is said to be ofbad reduction atp).
The zeta function of an elliptic curve over a finite fieldFp is, in some sense, agenerating function assembling the information of the number of points ofE with values in the finitefield extensionsFpn ofFp. It is given by[12]
The interior sum of the exponential resembles the development of thelogarithm and, in fact, the so-defined zeta function is arational function inT:
where the 'trace of Frobenius' term[13] is defined to be the difference between the 'expected' number and the number of points on the elliptic curve over, viz.
or equivalently,
We may define the same quantities and functions over an arbitrary finite field of characteristic, with replacing everywhere.
TheL-function ofE overQ is then defined by collecting this information together, for all primesp. It is defined by
whereN is theconductor ofE, i.e. the product of primes with bad reduction),[14] in which caseap is defined differently from the method above: see Silverman (1986) below.
For example has bad reduction at 17, because has.
This productconverges for Re(s) > 3/2 only. Hasse's conjecture affirms that theL-function admits ananalytic continuation to the whole complex plane and satisfies afunctional equation relating, for anys,L(E,s) toL(E, 2 −s). In 1999 this was shown to be a consequence of the proof of the Shimura–Taniyama–Weil conjecture, which asserts that every elliptic curve overQ is amodular curve, which implies that itsL-function is theL-function of amodular form whose analytic continuation is known. One can therefore speak about the values ofL(E,s) at any complex numbers.
Ats = 1 (the conductor product can be discarded as it is finite), theL-function becomes
TheBirch and Swinnerton-Dyer conjecture relates the arithmetic of the curve to the behaviour of thisL-function ats = 1. It affirms that the vanishing order of theL-function ats = 1 equals the rank ofE and predicts the leading term of the Laurent series ofL(E,s) at that point in terms of several quantities attached to the elliptic curve.
Much like theRiemann hypothesis, the truth of the BSD conjecture would have multiple consequences, including the following two:
LetK =Fq be thefinite field withq elements andE an elliptic curve defined overK. While the precisenumber of rational points of an elliptic curveE overK is in general difficult to compute,Hasse's theorem on elliptic curves gives the following inequality:
In other words, the number of points on the curve grows proportionally to the number of elements in the field. This fact can be understood and proven with the help of some general theory; seelocal zeta function andétale cohomology for example.
The set of pointsE(Fq) is a finite abelian group. It is always cyclic or the product of two cyclic groups. For example,[17] the curve defined by
overF71 has 72 points (71affine points including (0,0) and onepoint at infinity) over this field, whose group structure is given byZ/2Z ×Z/36Z. The number of points on a specific curve can be computed withSchoof's algorithm.
Studying the curve over thefield extensions ofFq is facilitated by the introduction of the local zeta function ofE overFq, defined by a generating series (also see above)
where the fieldKn is the (unique up to isomorphism) extension ofK =Fq of degreen (that is,).
The zeta function is a rational function inT. To see this, consider the integer such that
There is a complex number such that
where is thecomplex conjugate, and so we have
We choose so that itsabsolute value is, that is, and that. Note that.
can then be used in the local zeta function as its values when raised to the various powers ofn can be said to reasonably approximate the behaviour of, in that
Using theTaylor series for the natural logarithm,
Then, so finally
For example,[18] the zeta function ofE :y2 +y =x3 over the fieldF2 is given by
which follows from:
as, then, so.
Thefunctional equation is
As we are only interested in the behaviour of, we can use a reduced zeta function
and so
which leads directly to the local L-functions
TheSato–Tate conjecture is a statement about how the error term in Hasse's theorem varies with the different primesq, if an elliptic curve E overQ is reduced modulo q. It was proven (for almost all such curves) in 2006 due to the results of Taylor, Harris and Shepherd-Barron,[19] and says that the error terms are equidistributed.
Elliptic curves over finite fields are notably applied incryptography and for thefactorization of large integers. These algorithms often make use of the group structure on the points ofE. Algorithms that are applicable to general groups, for example the group of invertible elements in finite fields,F*q, can thus be applied to the group of points on an elliptic curve. For example, thediscrete logarithm is such an algorithm. The interest in this is that choosing an elliptic curve allows for more flexibility than choosingq (and thus the group of units inFq). Also, the group structure of elliptic curves is generally more complicated.
Elliptic curves can be defined over anyfieldK; the formal definition of an elliptic curve is a non-singular projective algebraic curve overK withgenus 1 and endowed with a distinguished point defined overK.
If thecharacteristic ofK is neither 2 nor 3, then every elliptic curve overK can be written in the form
after a linear change of variables. Herep andq are elements ofK such that the right hand side polynomialx3 −px −q does not have any double roots. If the characteristic is 2 or 3, then more terms need to be kept: in characteristic 3, the most general equation is of the form
for arbitrary constantsb2,b4,b6 such that the polynomial on the right-hand side has distinct roots (the notation is chosen for historical reasons). In characteristic 2, even this much is not possible, and the most general equation is
provided that the variety it defines is non-singular. If characteristic were not an obstruction, each equation would reduce to the previous ones by a suitable linear change of variables.
One typically takes the curve to be the set of all points (x,y) which satisfy the above equation and such that bothx andy are elements of thealgebraic closure ofK. Points of the curve whose coordinates both belong toK are calledK-rational points.
Many of the preceding results remain valid when the field of definition ofE is anumber fieldK, that is to say, a finitefield extension ofQ. In particular, the groupE(K) ofK-rational points of an elliptic curveE defined overK is finitely generated, which generalizes the Mordell–Weil theorem above. A theorem due toLoïc Merel shows that for a given integerd, there are (up to isomorphism) only finitely many groups that can occur as the torsion groups ofE(K) for an elliptic curve defined over a number fieldK ofdegreed. More precisely,[20] there is a numberB(d) such that for any elliptic curveE defined over a number fieldK of degreed, any torsion point ofE(K) is oforder less thanB(d). The theorem is effective: ford > 1, if a torsion point is of orderp, withp prime, then
As for the integral points, Siegel's theorem generalizes to the following: LetE be an elliptic curve defined over a number fieldK,x andy the Weierstrass coordinates. Then there are only finitely many points ofE(K) whosex-coordinate is in thering of integersOK.
The properties of the Hasse–Weil zeta function and the Birch and Swinnerton-Dyer conjecture can also be extended to this more general situation.
The formulation of elliptic curves as the embedding of atorus in thecomplex projective plane follows naturally from a curious property ofWeierstrass's elliptic functions. These functions and their first derivative are related by the formula
Here,g2 andg3 are constants;℘(z) is theWeierstrass elliptic function and℘′(z) its derivative. It should be clear that this relation is in the form of an elliptic curve (over thecomplex numbers). The Weierstrass functions are doubly periodic; that is, they areperiodic with respect to alatticeΛ; in essence, the Weierstrass functions are naturally defined on a torusT =C/Λ. This torus may be embedded in the complex projective plane by means of the map
This map is agroup isomorphism of the torus (considered with its natural group structure) with the chord-and-tangent group law on the cubic curve which is the image of this map. It is also an isomorphism ofRiemann surfaces from the torus to the cubic curve, so topologically, an elliptic curve is a torus. If the latticeΛ is related by multiplication by a non-zero complex numberc to a latticecΛ, then the corresponding curves are isomorphic. Isomorphism classes of elliptic curves are specified by thej-invariant.
The isomorphism classes can be understood in a simpler way as well. The constantsg2 andg3, called themodular invariants, are uniquely determined by the lattice, that is, by the structure of the torus. However, all real polynomials factorize completely into linear factors over the complex numbers, since the field of complex numbers is thealgebraic closure of the reals. So, the elliptic curve may be written as
One finds that
and
withj-invariantj(τ) andλ(τ) is sometimes called themodular lambda function. For example, letτ = 2i, thenλ(2i) = (−1 +√2)4 which impliesg′2,g′3, and thereforeg′23
− 27g′32
of the formula above are allalgebraic numbers ifτ involves animaginary quadratic field. In fact, it yields the integerj(2i) = 663 =287496.
In contrast, themodular discriminant
is generally atranscendental number. In particular, the value of theDedekind eta functionη(2i) is
Note that theuniformization theorem implies that everycompact Riemann surface of genus one can be represented as a torus. This also allows an easy understanding of thetorsion points on an elliptic curve: if the latticeΛ is spanned by the fundamental periodsω1 andω2, then then-torsion points are the (equivalence classes of) points of the form
for integersa andb in the range0 ≤ (a,b) <n.
If
is an elliptic curve over the complex numbers and
then a pair of fundamental periods ofE can be calculated very rapidly by
M(w,z) is thearithmetic–geometric mean ofw andz. At each step of the arithmetic–geometric mean iteration, the signs ofzn arising from the ambiguity of geometric mean iterations are chosen such that|wn −zn| ≤ |wn +zn| wherewn andzn denote the individual arithmetic mean and geometric mean iterations ofw andz, respectively. When|wn −zn| = |wn +zn|, there is an additional condition thatIm(zn/wn) > 0.[21]
Over the complex numbers, every elliptic curve has nineinflection points. Every line through two of these points also passes through a third inflection point; the nine points and 12 lines formed in this way form a realization of theHesse configuration.
Given anisogeny
of elliptic curves of degree, thedual isogeny is an isogeny
of the same degree such that
Here denotes the multiplication-by- isogeny which has degree
Often only the existence of a dual isogeny is needed, but it can be explicitly given as the composition
where is the group ofdivisors of degree 0. To do this, we need maps given by where is the neutral point of and given by
To see that, note that the original isogeny can be written as a composite
and that since isfinite of degree, is multiplication by on
Alternatively, we can use the smallerPicard group, aquotient of The map descends to anisomorphism, The dual isogeny is
Note that the relation also implies the conjugate relation Indeed, let Then But issurjective, so we must have
Elliptic curves over finite fields are used in somecryptographic applications as well as forinteger factorization. Typically, the general idea in these applications is that a knownalgorithm which makes use of certain finite groups is rewritten to use the groups of rational points of elliptic curves. For more see also:
Serge Lang, in the introduction to the book cited below, stated that "It is possible to write endlessly on elliptic curves. (This is not a threat.)" The following short list is thus at best a guide to the vast expository literature available on the theoretical, algorithmic, and cryptographic aspects of elliptic curves.
This article incorporates material from Isogeny onPlanetMath, which is licensed under theCreative Commons Attribution/Share-Alike License.
