This course develops elliptic curves from the ground up, starting with plane cubic curves and ending with the group law that makes these curves central objects in number theory. The focus is on how a geometric picture leads to arithmetic structure: first by understanding cubic curves in the plane, then by moving to projective geometry and Weierstrass form, and finally by turning geometric constructions into explicit algebraic formulas and computations. The early chapters build the geometric foundations, explaining smooth versus singular cubics, why the point at infinity is needed, and how chords and tangents define addition on the curve. From there, the course proves that this operation really does satisfy the group axioms, with associativity as the key conceptual hurdle. Later chapters explore the same curve from several viewpoints: as a real geometric object, as a computational tool over the rationals, and as a finite set over finite fields. The final chapters return to the geometry to explain flexes, collinearity, and the deeper reason the group law works, tying together the course's geometric intuition, algebraic formulas, and arithmetic applications. # Introduction These notes introduce elliptic curves through the geometry of plane cubic curves. The guiding question is how a geometric construction with lines and cubics produces an abelian group, and why that group can be computed over fields such as $\mathbb R$, $\mathbb Q$, and $\mathbb F_q$. The first part of the course builds the construction from projective geometry; the later parts translate it into explicit Weierstrass formulas and arithmetic examples. The course begins before the phrase "elliptic curve" has a formal meaning. We first study cubic equations in two variables, discover why affine geometry loses intersection points, and then move to the projective plane where lines meet cubics with the correct count. This introduction records the main objects, the intended prerequisites, and the central theorem toward which the early lectures are directed. ## The Central Question A line through two points on a cubic usually meets the cubic once more. The group law starts from the idea that this third intersection point should be converted into a sum, after choosing a distinguished point to act as the identity. [explanation: Why Cubics Lead To Addition] For a conic, a line through two known points has already used up its two intersections. For a cubic, a line through two known points still has one intersection remaining, counted with multiplicity and after passing to projective space. This extra point is the geometric resource that makes an operation possible. The operation is not merely a rule for drawing pictures. Once the cubic is nonsingular and a base point is chosen, the chord-and-tangent construction gives an abelian group on the set of points of the cubic over the field under consideration. The rest of the course is devoted to making each phrase in that sentence precise. [/explanation] This viewpoint explains the order of the course. We cannot define the addition law responsibly until we know what points at infinity are, how tangencies count as repeated intersections, and why singular cubics must be excluded. ## Plane Cubics As The Starting Object The first problem is to decide what kind of equation should be allowed. We want a class of curves large enough to contain examples such as $y^2=x^3-x$, but rigid enough that a line has a predictable intersection theory. [definition: Affine Plane Cubic] Let $k$ be a field. An affine plane cubic over $k$ is a subset $C \subset k^2$ of the form \begin{align*} C = \{(x,y) \in k^2 : F(x,y)=0\}, \end{align*} where $F \in k[x,y]$ is a polynomial of total degree $3$. [/definition] Affine cubics are easy to write down, but they are not the right final setting. Vertical lines may miss the expected third point, and two parallel lines never meet in the affine plane. These defects are not arithmetic phenomena; they come from using an incomplete geometric space. [example: Missing Point At Infinity] Consider the affine cubic over $\mathbb R$ \begin{align*} y^2=x^3-x. \end{align*} Its projective closure is obtained by replacing $x$ by $X/Z$ and $y$ by $Y/Z$: \begin{align*} \left(\frac{Y}{Z}\right)^2=\left(\frac{X}{Z}\right)^3-\frac{X}{Z}. \end{align*} Multiplying both sides by $Z^3$ gives \begin{align*} Y^2Z=X^3-XZ^2. \end{align*} Fix $a \in \mathbb R$. The affine vertical line $x=a$ becomes the projective line $X=aZ$. Substituting $X=aZ$ into the projective cubic gives \begin{align*} Y^2Z=(aZ)^3-(aZ)Z^2. \end{align*} The right-hand side expands to \begin{align*} (aZ)^3-(aZ)Z^2=a^3Z^3-aZ^3=(a^3-a)Z^3. \end{align*} Hence the intersection points on this projective line satisfy \begin{align*} Y^2Z=(a^3-a)Z^3. \end{align*} Moving all terms to one side and factoring out $Z$ gives \begin{align*} Z\left(Y^2-(a^3-a)Z^2\right)=0. \end{align*} The factor $Z=0$ gives $X=aZ=0$, so the point has the form $[0:Y:0]$. Since projective coordinates cannot all be zero, $Y \ne 0$, and therefore \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} If $a^3-a>0$ and $y^2=a^3-a$, the factor $Y^2-(a^3-a)Z^2=0$ gives, in the affine chart $Z=1$, the two points $[a:y:1]$ and $[a:-y:1]$, corresponding to $(a,y)$ and $(a,-y)$. Thus the affine plane sees only the two finite intersections, while the projective closure supplies the third point $[0:1:0]$, later used as the identity element for the Weierstrass group law. [/example] This example is the first warning that the course cannot remain purely affine. The geometric operation becomes uniform only after replacing the affine plane by the projective plane. ## Projective Geometry Needed For Cubics The next problem is to add the missing points without changing the equations beyond recognition. Projective coordinates achieve this by treating scalar multiples of nonzero triples as the same point. [definition: Projective Plane] Let $k$ be a field. The projective plane over $k$ is \begin{align*} \mathbb P^2_k = (k^3 \setminus \{0\})/\sim, \end{align*} where $(X,Y,Z) \sim (\lambda X,\lambda Y,\lambda Z)$ for every $\lambda \in k^\times$. The equivalence class of $(X,Y,Z)$ is written $[X:Y:Z]$. [/definition] The affine plane $k^2$ appears inside $\mathbb P^2_k$ as the chart $Z \ne 0$ by sending $(x,y)$ to $[x:y:1]$. The remaining line $Z=0$ is the line at infinity, where the missing intersections of affine geometry live. [definition: Homogeneous Cubic] Let $k$ be a field. A homogeneous cubic over $k$ is a polynomial $F \in k[X,Y,Z]$ whose monomials all have total degree $3$. [/definition] A homogeneous cubic $F$ determines a projective plane cubic by taking its zero locus \begin{align*} C = \{[X:Y:Z] \in \mathbb P^2_k : F(X,Y,Z)=0\}. \end{align*} This is well-defined because scaling $[X:Y:Z]$ by $\lambda \in k^\times$ scales $F(X,Y,Z)$ by $\lambda^3$, so the condition $F(X,Y,Z)=0$ does not depend on the chosen representative. Homogenisation turns affine equations into projective ones. For instance, the affine equation $y^2=x^3+ax+b$ becomes \begin{align*} Y^2Z=X^3+aXZ^2+bZ^3. \end{align*} This projective equation contains the affine curve in the chart $Z \ne 0$ and also records its behaviour at infinity. [example: Homogenising A Weierstrass Cubic] Let $k$ be a field with $\operatorname{char}(k) \ne 2,3$, and let $a,b \in k$. We homogenise the affine equation $y^2=x^3+ax+b$ by working on the affine chart $Z \ne 0$ and writing $x=X/Z$ and $y=Y/Z$. Substitution gives \begin{align*} \left(\frac{Y}{Z}\right)^2=\left(\frac{X}{Z}\right)^3+a\left(\frac{X}{Z}\right)+b. \end{align*} Equivalently, \begin{align*} \frac{Y^2}{Z^2}=\frac{X^3}{Z^3}+\frac{aX}{Z}+b. \end{align*} Multiplying each term by $Z^3$ gives \begin{align*} Z^3\cdot \frac{Y^2}{Z^2}=Z^3\cdot \frac{X^3}{Z^3}+Z^3\cdot \frac{aX}{Z}+Z^3\cdot b. \end{align*} The terms reduce separately as $Z^3\cdot Y^2/Z^2=Y^2Z$, $Z^3\cdot X^3/Z^3=X^3$, $Z^3\cdot aX/Z=aXZ^2$, and $Z^3\cdot b=bZ^3$, so the projective closure is defined by \begin{align*} Y^2Z=X^3+aXZ^2+bZ^3. \end{align*} To find the points at infinity, set $Z=0$. Substituting into the homogeneous equation gives \begin{align*} Y^2\cdot 0=X^3+aX\cdot 0^2+b\cdot 0^3. \end{align*} Thus \begin{align*} 0=X^3. \end{align*} Since $k$ is a field, $X^3=0$ implies $X=0$. A point at infinity on the curve therefore has the form $[0:Y:0]$. Projective coordinates cannot all be zero, so $Y \ne 0$, and scaling the coordinates by $Y^{-1}$ gives \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} Thus a Weierstrass cubic of the form $Y^2Z=X^3+aXZ^2+bZ^3$ has exactly one projective point at infinity, namely $[0:1:0]$. [/example] This point at infinity will later be denoted $O$. In Weierstrass form it is the natural identity candidate, because vertical lines meet the cubic in two affine points and $O$. ## Nonsingularity And The Need To Exclude Bad Cubics The third problem is that not every cubic should carry the desired group law. Singularities produce exceptional behaviour: tangents may not be unique, and the chord-and-tangent recipe can fail to behave like addition. [definition: Singular Point Of A Projective Cubic] Let $C \subset \mathbb P^2_k$ be defined by a homogeneous cubic $F \in k[X,Y,Z]$. A point $P \in C$ is singular if \begin{align*} \frac{\partial F}{\partial X}(P)=\frac{\partial F}{\partial Y}(P)=\frac{\partial F}{\partial Z}(P)=0. \end{align*} The cubic $C$ is nonsingular if it has no singular points over an [algebraic closure](/page/Algebraic%20Closure) of $k$. [/definition] The reference to an algebraic closure is important. A cubic may appear smooth when only $k$-rational points are inspected, but acquire a singular point after extending the field. The group law is part of the geometry of the curve, so the exclusion must be geometric rather than tied to the visible rational points. [example: A Singular Cubic] Consider the affine cubic $y^2=x^3$ and its projective closure \begin{align*} F(X,Y,Z)=Y^2Z-X^3. \end{align*} The affine point $(0,0)$ corresponds to $[0:0:1]$, and it lies on the projective cubic because \begin{align*} F(0,0,1)=0^2\cdot 1-0^3=0. \end{align*} We compute the first partial derivatives term by term. Differentiating with respect to $X$, the term $Y^2Z$ is constant in $X$, while $X^3$ has derivative $3X^2$, so \begin{align*} \frac{\partial F}{\partial X}=0-3X^2=-3X^2. \end{align*} Differentiating with respect to $Y$, the term $Y^2Z$ has derivative $2YZ$ and $X^3$ is constant in $Y$, so \begin{align*} \frac{\partial F}{\partial Y}=2YZ-0=2YZ. \end{align*} Differentiating with respect to $Z$, the term $Y^2Z$ has derivative $Y^2$ and $X^3$ is constant in $Z$, so \begin{align*} \frac{\partial F}{\partial Z}=Y^2-0=Y^2. \end{align*} Evaluating these derivatives at $[0:0:1]$ gives \begin{align*} \frac{\partial F}{\partial X}(0,0,1)=-3\cdot 0^2=0. \end{align*} Also, \begin{align*} \frac{\partial F}{\partial Y}(0,0,1)=2\cdot 0\cdot 1=0. \end{align*} Finally, \begin{align*} \frac{\partial F}{\partial Z}(0,0,1)=0^2=0. \end{align*} Thus all three first partial derivatives vanish at a point of the cubic, so $[0:0:1]$ is a singular point. Geometrically, this is the cusp at the affine point $(0,0)$, and its degenerate tangent behaviour is exactly the kind of obstruction excluded from the theory of elliptic curves in this course. [/example] In Chapter 3 we will see that singular cubics still have interesting parametrisations, but they do not provide the same group law. The nonsingular condition is the geometric boundary between general cubic curves and elliptic curves. ## The Main Construction Preview After projective closure and nonsingularity are in place, the central construction can be stated. The preview below is the destination of the first part of the course, not a result we use without explanation. [explanation: Chord And Tangent Group Law With A Flex Origin] Let $k$ be a field, let $C \subset \mathbb{P}^2_k$ be a smooth projective plane cubic, and let $O \in C(k)$ be a flex point. For $P,Q \in C(k)$, take the line through $P$ and $Q$, using the tangent when $P=Q$, and let $R$ be the third intersection point counted with multiplicity. Define $P+Q$ to be the point obtained by reflecting $R$ through the origin construction based at $O$. With this flex origin, the chord-and-tangent operation gives an abelian group with identity $O$. [/explanation] This preview explains why the course begins with geometric preparation rather than formulas. Each hypothesis removes a genuine obstruction. Projectivity ensures that the third intersection point exists even when the affine picture sends it to infinity; nonsingularity rules out cusps and nodes, where tangent lines and multiplicities no longer support the same addition law; and the flex point $O \in C(k)$ is needed for the standard chord-and-tangent construction used throughout these notes. The preview is also deliberately not a computational formula. It says that the geometric construction produces an abelian group, but it does not yet give the slope formulas for adding points on a Weierstrass equation, nor does it prove associativity by manipulating coordinates. Those tasks come in Chapters 5 through 10: first the course proves the geometric intersection facts, then it translates the law into explicit algebra over $\mathbb R$, $\mathbb Q$, and finite fields. [illustration:chord-tangent-group-law-overview] [example: The Real Shape Of A Cubic And Addition] On the real curve $y^2=x^3-x=x(x-1)(x+1)$, real affine points occur exactly where $x^3-x\ge 0$. Since $x^3-x=x(x-1)(x+1)$, its sign is nonnegative on $[-1,0]$ and on $[1,\infty)$, so the visible affine curve has two components. Take two real points $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ with $x_1\ne x_2$. The secant line through them has equation \begin{align*} y=mx+c, \end{align*} where \begin{align*} m=\frac{y_2-y_1}{x_2-x_1} \end{align*} and \begin{align*} c=y_1-mx_1. \end{align*} Substituting $y=mx+c$ into $y^2=x^3-x$ gives \begin{align*} (mx+c)^2=x^3-x. \end{align*} Expanding the left-hand side gives \begin{align*} m^2x^2+2mcx+c^2=x^3-x. \end{align*} Moving all terms to the right gives \begin{align*} 0=x^3-m^2x^2-(2mc+1)x-c^2. \end{align*} Because $P$ and $Q$ lie on both the line and the cubic, $x_1$ and $x_2$ are roots of this cubic polynomial. If $x_3$ is the remaining root, then \begin{align*} x^3-m^2x^2-(2mc+1)x-c^2=(x-x_1)(x-x_2)(x-x_3). \end{align*} Expanding the product gives \begin{align*} (x-x_1)(x-x_2)=x^2-(x_1+x_2)x+x_1x_2. \end{align*} Multiplying by $x-x_3$ gives \begin{align*} (x^2-(x_1+x_2)x+x_1x_2)(x-x_3)=x^3-(x_1+x_2+x_3)x^2+(x_1x_2+x_1x_3+x_2x_3)x-x_1x_2x_3. \end{align*} Comparing the coefficients of $x^2$ gives \begin{align*} -(x_1+x_2+x_3)=-m^2. \end{align*} Therefore \begin{align*} x_3=m^2-x_1-x_2. \end{align*} The third affine intersection point of the secant with the cubic is \begin{align*} R=(x_3,y_3), \end{align*} where \begin{align*} y_3=mx_3+c. \end{align*} Now write $R$ projectively as $[x_3:y_3:1]$ and let $O=[0:1:0]$. The projective line through $R$ and $O$ is \begin{align*} X=x_3Z, \end{align*} because $X=x_3Z$ holds at $[x_3:y_3:1]$ and also at $[0:1:0]$. Substituting $X=x_3Z$ into the projective cubic $Y^2Z=X^3-XZ^2$ gives \begin{align*} Y^2Z=(x_3Z)^3-(x_3Z)Z^2. \end{align*} Expanding the right-hand side gives \begin{align*} Y^2Z=x_3^3Z^3-x_3Z^3. \end{align*} Factoring out $Z^3$ gives \begin{align*} Y^2Z=(x_3^3-x_3)Z^3. \end{align*} In the affine chart $Z=1$, this becomes \begin{align*} Y^2=x_3^3-x_3. \end{align*} Since $R$ lies on the cubic, $y_3^2=x_3^3-x_3$, so the two affine intersections on this vertical line are \begin{align*} (x_3,y_3) \end{align*} and \begin{align*} (x_3,-y_3). \end{align*} Thus the chord-and-tangent sum is obtained by replacing the third secant intersection $R=(x_3,y_3)$ with its reflection $(x_3,-y_3)$ across the $x$-axis. This is why, in the nonvertical secant case, the usual Weierstrass-coordinate rule gives $P+Q=(x_3,-y_3)$. [/example] This example also previews a recurring theme: the same geometric law looks different over different fields. Over $\mathbb R$ it has a visible shape, over $\mathbb Q$ it becomes an arithmetic structure, and over finite fields it becomes a finite abelian group. ## Fields That Appear In The Course The final introductory problem is to understand what changes when the ground field changes. The equations may look the same, but the available points and the arithmetic of slopes depend on the field. [definition: Rational Points Of A Projective Cubic] Let $k$ be a field, and let $C \subset \mathbb P^2_k$ be the projective cubic defined by a homogeneous cubic $F \in k[X,Y,Z]$. The set of $k$-rational points of $C$ is \begin{align*} C(k)=\{[X:Y:Z] \in \mathbb P^2_k : X,Y,Z \in k,\ F(X,Y,Z)=0\}. \end{align*} [/definition] When $k=\mathbb R$, the course uses pictures and calculus intuition to interpret tangents and components. When $k=\mathbb Q$, the same formulas turn $C(\mathbb Q)$ into a group whose structure is a central object of arithmetic. When $k=\mathbb F_q$, the group $C(\mathbb F_q)$ is finite and can be computed by counting solutions. [example: The Same Equation Over Three Fields] The equation $y^2=x^3-x=x(x-1)(x+1)$ has the same formal expression over several fields, but the available solutions depend on the field. Over $\mathbb R$, affine points occur exactly when the right-hand side is nonnegative: \begin{align*} x^3-x=x(x-1)(x+1)\ge 0. \end{align*} The zeros of $x(x-1)(x+1)$ are $-1$, $0$, and $1$. Testing one value in each interval gives \begin{align*} (-2)(-3)(-1)<0. \end{align*} Also, \begin{align*} \left(-\frac12\right)\left(-\frac32\right)\left(\frac12\right)>0. \end{align*} Next, \begin{align*} \left(\frac12\right)\left(-\frac12\right)\left(\frac32\right)<0. \end{align*} Finally, \begin{align*} 2\cdot 1\cdot 3>0. \end{align*} Thus $x^3-x\ge 0$ precisely on $[-1,0]\cup[1,\infty)$, so the real affine curve has one visible component over $[-1,0]$ and another over $[1,\infty)$. Over $\mathbb Q$, the same equation contains rational points such as \begin{align*} 0^2=0=0^3-0, \end{align*} so $(0,0)\in C(\mathbb Q)$. Similarly, \begin{align*} 0^2=0=1^3-1, \end{align*} so $(1,0)\in C(\mathbb Q)$, and \begin{align*} 0^2=0=(-1)^3-(-1), \end{align*} so $(-1,0)\in C(\mathbb Q)$. The projective closure is \begin{align*} Y^2Z=X^3-XZ^2. \end{align*} At $[0:1:0]$, the left-hand side is \begin{align*} 1^2\cdot 0=0, \end{align*} and the right-hand side is \begin{align*} 0^3-0\cdot 0^2=0, \end{align*} so $[0:1:0]$ is also a rational point. Over $\mathbb F_5$, compute $x^3-x$ for each residue class. For $x=0$, \begin{align*} 0^3-0\equiv 0 \pmod 5. \end{align*} For $x=1$, \begin{align*} 1^3-1\equiv 0 \pmod 5. \end{align*} For $x=2$, \begin{align*} 2^3-2\equiv 8-2\equiv 6\equiv 1 \pmod 5. \end{align*} For $x=3$, \begin{align*} 3^3-3\equiv 27-3\equiv 24\equiv 4 \pmod 5. \end{align*} For $x=4$, \begin{align*} 4^3-4\equiv 64-4\equiv 60\equiv 0 \pmod 5. \end{align*} The square residues modulo $5$ are obtained from \begin{align*} 0^2\equiv 0 \pmod 5, \end{align*} \begin{align*} 1^2\equiv 1 \pmod 5, \end{align*} \begin{align*} 2^2\equiv 4 \pmod 5, \end{align*} \begin{align*} 3^2\equiv 9\equiv 4 \pmod 5, \end{align*} and \begin{align*} 4^2\equiv 16\equiv 1 \pmod 5. \end{align*} Therefore the affine $\mathbb F_5$-points are \begin{align*} (0,0),\ (1,0),\ (2,1),\ (2,4),\ (3,2),\ (3,3),\ (4,0). \end{align*} Adjoining the projective point $[0:1:0]$ gives eight $\mathbb F_5$-rational projective points. Thus the same cubic gives a real curve with two visible components, a set of rational points over $\mathbb Q$, and a finite point set over $\mathbb F_5$ on which the chord-and-tangent law later becomes a finite group law. [/example] The first course therefore has two intertwined goals. Geometrically, it explains why nonsingular projective cubics carry a natural addition law. Arithmetically, it shows how the same law can be calculated and studied over fields where the points encode number-theoretic information. ## Prerequisites And What Will Be Developed The course assumes linear algebra, basic group theory, fields, polynomial algebra, and elementary multivariable calculus. Projective geometry is helpful but is developed from the required definitions, because it is part of the mechanism of the group law. [remark: Minimal Projective Geometry] Only the projective plane, homogeneous coordinates, projective lines, and basic intersection counting are needed at the start. The course does not require a previous course in algebraic geometry. Whenever a geometric principle is used, it will be stated in the form needed for plane cubics. [/remark] This limited projective toolkit is enough because the early lectures use geometry for a specific purpose: controlling intersections between lines and cubics. Once that control is available, the next task is to turn the incidence picture into calculations that can be carried out in a field. This is where algebra re-enters the course, because a drawn secant line becomes a slope, a third intersection becomes a polynomial root calculation, and the point at infinity becomes an exceptional case in the formulas. The main computational skill is translating geometry into formulas. Given a Weierstrass equation and two points, we will compute the slope of a secant or tangent, find the third intersection point, and then apply the reflection that gives the group sum. [remark: Computation And Geometry] The formula for adding points is not introduced as a separate algebraic trick. It is the coordinate expression of the projective chord-and-tangent construction. Keeping the geometric origin visible is essential for remembering the exceptional cases, such as doubling a point or adding inverse points. [/remark] This introduction should be read as a map for the lectures that follow. The course begins with cubics, repairs affine geometry using projective space, excludes singular curves, constructs the group law, and then studies that law over several fields. The next chapter begins by looking more closely at the geometry hidden inside a cubic equation. Rather than asking first for an algebraic definition, it asks how a line can meet a cubic and why that intersection behavior is the right starting point for addition. # 1. Cubics Before Elliptic Curves What distinguishes an elliptic curve from a random cubic equation is not the equation alone, but the way its intersections with lines behave. This first chapter prepares that geometry in the affine plane, where the pictures are familiar but the rules are incomplete. We will see why a line should meet a cubic in three points, why the third point suggests a binary operation, and why affine geometry loses exactly the points needed to make the construction uniform. ## Polynomial Equations as Plane Curves How should we turn an algebraic equation into a geometric object when the coefficients lie in an arbitrary field $k$? The first step is to separate the polynomial, which is syntax, from its solution set, which depends on the field in which we look for points. [definition: Affine Plane Over A Field] Let $k$ be a field. The affine plane over $k$ is the set \begin{align*} \mathbb A^2_k := k^2 = \{(x,y) : x,y \in k\}. \end{align*} [/definition] The affine plane gives the ambient coordinate system, but elliptic curves are not all of $k^2$; they are subsets selected by equations. To discuss a cubic geometrically, we need a formal name for the zero set of a polynomial in this ambient plane. [definition: Affine Plane Curve] Let $k$ be a field and let $F \in k[x,y]$ be a nonzero polynomial. The affine plane curve cut out by $F$ over $k$ is \begin{align*} C(k) := \{(x,y) \in \mathbb A^2_k : F(x,y)=0\}. \end{align*} [/definition] The notation $C(k)$ records that the visible points depend on $k$. The same equation may have many real points, fewer rational points, and a different finite set of points over a finite field. Before specialising to elliptic curves, it is useful to see this dependence in one equation that will reappear throughout the chapter. [example: A Cubic Over Different Fields] Consider the affine cubic \begin{align*} C: y^2 = x^3 - x = x(x-1)(x+1). \end{align*} Over $\mathbb R$, real points occur exactly when $x^3-x\ge 0$, because $y^2$ is always nonnegative and every nonnegative real number has real square roots. The roots of $x(x-1)(x+1)$ are $-1$, $0$, and $1$. Testing one point in each interval determined by these roots gives \begin{align*} (-2)^3-(-2)=-8+2=-6<0. \end{align*} \begin{align*} \left(-\frac12\right)^3-\left(-\frac12\right)=-\frac18+\frac12=\frac38>0. \end{align*} \begin{align*} \left(\frac12\right)^3-\frac12=\frac18-\frac12=-\frac38<0. \end{align*} \begin{align*} 2^3-2=8-2=6>0. \end{align*} Thus $x^3-x\ge 0$ exactly on $[-1,0]\cup[1,\infty)$, and for each such real $x$ the real points are $(x,\pm\sqrt{x^3-x})$, with the two signs giving the same point when $x^3-x=0$. In particular $(-1,0)$, $(0,0)$, and $(1,0)$ lie on the curve. Over $\mathbb Q$, the same three points remain because \begin{align*} 0^2=(-1)^3-(-1)=-1+1=0. \end{align*} \begin{align*} 0^2=0^3-0=0. \end{align*} \begin{align*} 0^2=1^3-1=0. \end{align*} However, a rational value of $x$ gives rational points only when $x^3-x$ is a square in $\mathbb Q$, so the rational point set is not determined only by the real sign pattern. Over $\mathbb F_5$, the square values are $0$, $1$, and $4$, since \begin{align*} 0^2\equiv 0 \pmod 5,\quad 1^2\equiv 1 \pmod 5,\quad 2^2\equiv 4 \pmod 5,\quad 3^2\equiv 4 \pmod 5,\quad 4^2\equiv 1 \pmod 5. \end{align*} Checking each $x\in\mathbb F_5$ gives \begin{align*} 0^3-0\equiv 0 \pmod 5. \end{align*} \begin{align*} 1^3-1\equiv 0 \pmod 5. \end{align*} \begin{align*} 2^3-2=8-2=6\equiv 1 \pmod 5. \end{align*} \begin{align*} 3^3-3=27-3=24\equiv 4 \pmod 5. \end{align*} \begin{align*} 4^3-4=64-4=60\equiv 0 \pmod 5. \end{align*} Therefore \begin{align*} C(\mathbb F_5)=\{(0,0),(1,0),(2,1),(2,4),(3,2),(3,3),(4,0)\}. \end{align*} The polynomial is unchanged in all three cases, but the available point set changes with the ground field. [/example] This example shows that an equation and a field together determine the available points. The next structural feature is degree: it controls how a curve meets a line, and line intersections are the raw material for the group operation. [definition: Affine Cubic] Let $k$ be a field. An affine cubic over $k$ is an affine plane curve cut out by a polynomial $F \in k[x,y]$ of total degree $3$. [/definition] A cubic equation is still too broad for the full theory of elliptic curves, since singularities and missing points will matter later. For this chapter, the degree-three condition is enough to explain why lines interact with cubics in triples. ## Lines, Cubics, and the Third Intersection Why should two points on a cubic produce a third point? The guiding observation is that a line through two points of a cubic can be substituted into the cubic equation, leaving a polynomial equation in one parameter of degree at most three. [definition: Affine Line] Let $k$ be a field. An affine line in $\mathbb A^2_k$ is either a set of the form \begin{align*} L = \{(x,y) \in k^2 : y = mx+b\} \end{align*} for some $m,b \in k$, or a set of the form \begin{align*} L = \{(x,y) \in k^2 : x=a\} \end{align*} for some $a \in k$. [/definition] For a nonvertical line, substituting $y=mx+b$ into a cubic $F(x,y)$ produces a one-variable polynomial $F(x,mx+b)$. Its roots are the $x$-coordinates of intersection points, counted with the algebraic limitations caused by multiplicity and by roots outside $k$. This turns line-cubic intersection into a problem about roots of a polynomial, so the next result records the degree count that drives the whole construction. [explanation: Affine Line-Cubic Root Count] For a nonvertical affine line $y=mx+b$ and an affine cubic $F(x,y)=0$, the intersection points on that line are found by solving \begin{align*} F(x,mx+b)=0. \end{align*} This is a one-variable polynomial equation of degree at most three. When it has degree three and two roots are already known, the remaining root is forced over an algebraic closure, counted with multiplicity. [/explanation] This principle is the local algebraic reason behind the chord construction, but its hypotheses are doing real work. The condition that $L$ is not contained in the cubic excludes the degenerate case where every point of the line is an intersection point, so there is no finite list of three parameters to count. The degree-exactly-three condition is also essential: a vertical line on a Weierstrass cubic often gives only a quadratic equation in the affine parameter, so the affine theorem deliberately does not say that every affine line meets every affine cubic in three visible affine points. What it does say is narrower and more useful here: when a line through two known points gives a genuine cubic equation after substitution, the third root is forced by the coefficients. [example: Secant Through Two Real Points] On the real affine cubic $C: y^2=x^3-x$, the point $P=(-1,0)$ lies on $C$ because \begin{align*} 0^2=0 \end{align*} and \begin{align*} (-1)^3-(-1)=-1+1=0. \end{align*} The point $Q=(0,0)$ lies on $C$ because \begin{align*} 0^2=0^3-0=0. \end{align*} The line through $P$ and $Q$ has slope \begin{align*} \frac{0-0}{0-(-1)}=\frac{0}{1}=0, \end{align*} so its equation is $y=0$. Substituting $y=0$ into $y^2=x^3-x$ gives \begin{align*} 0^2=x^3-x. \end{align*} Since $0^2=0$, this is \begin{align*} 0=x^3-x. \end{align*} Factoring the right-hand side, \begin{align*} x^3-x=x(x^2-1)=x(x-1)(x+1). \end{align*} Thus the intersection points on this line have $x=-1$, $x=0$, or $x=1$. The first two roots recover $P=(-1,0)$ and $Q=(0,0)$, while the remaining root gives the third intersection point $(1,0)$. This is the secant construction in its simplest affine form: the line through two known points on the cubic forces a third point before any reflection convention or identity element has been chosen. [/example] The group law on an elliptic curve will not use the third intersection directly as $P+Q$. Instead, after choosing a special point at infinity as the identity, the third intersection is reflected in a systematic way. The present chapter only explains why a third point is naturally available. [remark: Why Multiplicity Is Needed] When the line through two points is replaced by a tangent at one point, the tangent point should count twice. Algebraically this corresponds to a repeated root of $F|_L$. This is why later chapters count intersections with multiplicity rather than only as distinct visible points. [/remark] ## Where Affine Geometry Breaks What goes wrong if we try to make the secant construction entirely inside $\mathbb A^2_k$? Two defects appear at once: some line-cubic intersections escape to infinity, and vertical lines behave differently from nonvertical lines in Weierstrass equations. The first defect is already visible in the degree count. A substituted cubic may lose degree because the missing root belongs to the line at infinity rather than to the affine chart. [example: Missing Point At Infinity] For the affine cubic $C: y^2=x^3-x$, fix a vertical line $x=a$ and parametrize it by $(x,y)=(a,t)$. Substituting this parametrization into the cubic gives \begin{align*} t^2=a^3-a. \end{align*} Equivalently, \begin{align*} t^2-(a^3-a)=0. \end{align*} This is a polynomial equation of degree $2$ in the affine parameter $t=y$, so in affine coordinates it accounts for only the two solutions of $y^2=a^3-a$, counted over an algebraic closure. To locate the missing intersection, homogenize the cubic to \begin{align*} Y^2Z=X^3-XZ^2. \end{align*} The projective closure of the vertical line $x=a$ is $X=aZ$. Substituting $X=aZ$ into the homogeneous cubic gives \begin{align*} Y^2Z=(aZ)^3-(aZ)Z^2. \end{align*} Expanding the right-hand side, \begin{align*} (aZ)^3-(aZ)Z^2=a^3Z^3-aZ^3. \end{align*} Factoring, \begin{align*} a^3Z^3-aZ^3=(a^3-a)Z^3. \end{align*} Hence the intersection equation on the projective line is \begin{align*} Y^2Z=(a^3-a)Z^3. \end{align*} Moving all terms to one side gives \begin{align*} Y^2Z-(a^3-a)Z^3=0. \end{align*} Factoring out $Z$, \begin{align*} Z\bigl(Y^2-(a^3-a)Z^2\bigr)=0. \end{align*} When $Z\ne 0$, we may set $Z=1$, and the second factor becomes \begin{align*} Y^2-(a^3-a)=0, \end{align*} which is exactly the affine equation $y^2=a^3-a$. When $Z=0$, the line equation gives \begin{align*} X=aZ=a\cdot 0=0. \end{align*} Thus the projective point has the form $[0:Y:0]$. Since projective coordinates cannot all be zero, $Y\ne 0$, and therefore \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} The missing third intersection is not visible in affine coordinates; it is the point at infinity $[0:1:0]$ on the projective closure. [/example] The example identifies a precise failure: affine coordinates cannot record intersections whose limiting direction is vertical. To repair the count, we add a new coordinate that remembers whether a point is finite or lies at infinity, and we need the definition that rewrites the polynomial so all terms have the same total degree. [definition: Homogenisation Of An Affine Polynomial] Let $k$ be a field and let $d \ge 0$. Homogenisation in degree $d$ is the map from polynomials $F \in k[x,y]$ of total degree at most $d$ to homogeneous polynomials $F^h \in k[X,Y,Z]$ of total degree $d$ defined by \begin{align*} F^h(X,Y,Z) := Z^d F(X/Z,Y/Z). \end{align*} [/definition] The formula is interpreted by expanding and clearing denominators, so $F^h$ is a genuine homogeneous polynomial. Homogenisation fixes the obstruction that the affine equation has no value at $Z=0$: after all terms have the same total degree, the same equation can be tested on finite points and on directions at infinity. The completed curve is therefore defined by taking the zero set of this homogeneous equation in the projective plane. [definition: Projective Closure Of An Affine Plane Curve] Let $C \subset \mathbb A^2_k$ be cut out by $F \in k[x,y]$ of total degree $d$. The projective closure of $C$ is the projective plane curve cut out by $F^h(X,Y,Z)=0$ in $\mathbb P^2_k$. [/definition] This construction is designed so that setting $Z=1$ recovers the original affine equation. The new information is contained on the line $Z=0$, where the added points at infinity live. The next result locates the added point for the running cubic and explains exactly what the vertical line was missing. [explanation: The Point At Infinity On $y^2=x^3-x$] The projective closure of the affine cubic $y^2=x^3-x$ is \begin{align*} Y^2Z=X^3-XZ^2. \end{align*} Its points with $Z=0$ consist of the single projective point \begin{align*} O=[0:1:0]. \end{align*} Moreover, every projective vertical line $X=aZ$ contains this same point $O$. [/explanation] This single point at infinity is not decoration. It is the point that vertical lines meet after their two finite intersections, and it will become the identity element for the elliptic curve group law. The computation also shows why projectivising matters: the affine equation cannot record the intersection lying in the direction $Z=0$, while the homogeneous equation can. What is special here is the shape of this particular cubic; the calculation does not prove that every affine cubic has exactly one point at infinity, nor that an arbitrary projective cubic is nonsingular. Those stronger facts require separate hypotheses in the later theory. [example: Vertical Line And The Point At Infinity] On the projective closure \begin{align*} Y^2Z=X^3-XZ^2, \end{align*} the affine vertical line $x=a$ is represented projectively by \begin{align*} X=aZ. \end{align*} Substitute $X=aZ$ into the cubic equation. The left-hand side remains $Y^2Z$, and the right-hand side becomes \begin{align*} X^3-XZ^2=(aZ)^3-(aZ)Z^2=a^3Z^3-aZ^3=(a^3-a)Z^3. \end{align*} Thus the intersection points on the projective line $X=aZ$ satisfy \begin{align*} Y^2Z=(a^3-a)Z^3. \end{align*} Moving all terms to one side gives \begin{align*} Y^2Z-(a^3-a)Z^3=0, \end{align*} and factoring out $Z$ gives \begin{align*} Z\bigl(Y^2-(a^3-a)Z^2\bigr)=0. \end{align*} If $Z\ne 0$, we may use the affine chart $Z=1$. Then $X=aZ$ gives $X=a$, and the second factor becomes \begin{align*} Y^2-(a^3-a)\cdot 1^2=0, \end{align*} so \begin{align*} Y^2=a^3-a. \end{align*} Writing $y=Y$ in the chart $Z=1$, these are exactly the affine intersections \begin{align*} (a,y)\quad\text{with}\quad y^2=a^3-a, \end{align*} counted over an algebraic closure. If $Z=0$, then the line equation gives \begin{align*} X=aZ=a\cdot 0=0. \end{align*} So the point has the form $[0:Y:0]$. Projective coordinates cannot all be zero, hence $Y\ne 0$, and scaling by $Y^{-1}$ gives \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} Thus the vertical line contributes the two finite solutions of $y^2=a^3-a$ and the single point at infinity $[0:1:0]$, giving the expected total of three projective intersections when the two finite solutions are counted with multiplicity. [/example] The vertical-line computation completes the chapter's diagnosis of affine geometry: the secant idea works, but only after the plane is completed and intersections are counted with the correct algebraic conventions. We can now summarise the construction that the rest of the course will make rigorous. [explanation: From Third Intersections To Addition] The emerging rule is geometric: draw the line through two points on a cubic, find the third intersection, and then use a fixed convention to turn that third point into a sum. Affine geometry gives the computation in familiar coordinates, but it does not provide a uniform identity element or a uniform intersection count. Projective geometry supplies the missing point at infinity, while intersection multiplicity supplies the correct interpretation of tangency. The remaining chapters refine each part of this outline. Chapter 2 introduces the projective plane and homogeneous cubics systematically. Chapter 3 imposes nonsingularity and defines tangent lines by derivatives, Chapter 4 chooses the point at infinity as the identity in Weierstrass form, and Chapter 7 proves that the resulting operation is an abelian group law on a nonsingular cubic. [/explanation] Affine cubics suggest the right rule, but they also expose what the plane is missing. Passing to projective geometry restores the lost points at infinity and makes intersection counts behave uniformly, which is exactly what the next chapter needs. # 2. The Projective Plane and Homogeneous Cubics The first chapter treated cubics as affine curves and used lines to motivate a possible addition rule. The difficulty was that affine space loses intersection points: vertical lines may seem to meet a cubic only twice, and parallel lines may fail to meet at all. Projective geometry repairs this by adding a line at infinity and by replacing ordinary polynomials with homogeneous equations. In this chapter we set up the projective plane, turn Weierstrass cubics into homogeneous cubics, and record the intersection-counting principle that makes the group law possible. ## Projective Coordinates and Affine Charts What kind of plane contains the missing directions of affine geometry without privileging any chosen origin? The answer is to treat nonzero triples as coordinates only up to simultaneous scaling. This turns a direction in $k^3$ into a point of a two-dimensional projective plane. [definition: Projective Plane] Let $k$ be a field. The projective plane over $k$ is \begin{align*} \mathbb P^2_k = (k^3 \setminus \{0\})/{\sim}, \end{align*} where $(X,Y,Z) \sim (\lambda X, \lambda Y, \lambda Z)$ for every $\lambda \in k^\times$. A point is written $[X:Y:Z]$ for the equivalence class of $(X,Y,Z)$. [/definition] The notation $[X:Y:Z]$ records ratios, not three independent coordinates. For example, over any field $k$, the points $[1:2:1]$ and $[3:6:3]$ are the same point when $3 \in k^\times$. The brackets also remind us that $[0:0:0]$ is not a point. [example: Equivalent Homogeneous Coordinates] Over $\mathbb Q$, the scalar $2$ is nonzero, so it is allowed in the projective [equivalence relation](/page/Equivalence%20Relation). We have \begin{align*} 2(1,2,3)=(2\cdot 1,2\cdot 2,2\cdot 3)=(2,4,6), \end{align*} hence $(2,4,6)\sim (1,2,3)$ and the two triples define the same point: \begin{align*} [2:4:6]=[1:2:3]. \end{align*} The triple $(0,1,0)$ is permitted because it is not the zero triple, so it defines the point $[0:1:0]$. By contrast, $(0,0,0)$ is excluded from $\mathbb Q^3\setminus\{0\}$, so $[0:0:0]$ is not a projective point. This is why projective coordinates record only nonzero proportional triples, not an actual ordered triple of coordinates. [/example] This example tells us how to recognise a projective point, but computations with cubics still need ordinary affine coordinates. To recover the familiar affine plane inside $\mathbb P^2_k$, choose a coordinate that is nonzero and scale it to $1$; the chart used for Weierstrass equations is the chart $Z \ne 0$. [definition: Standard Affine Chart] The standard affine chart $U_Z \subset \mathbb P^2_k$ is \begin{align*} U_Z = \{[X:Y:Z] \in \mathbb P^2_k : Z \ne 0\}. \end{align*} Its affine coordinates are \begin{align*} x = X/Z, \qquad y = Y/Z. \end{align*} [/definition] In this chart, every point has a unique representative $[x:y:1]$. The remaining projective points are not visible in affine coordinates, so we give that complement a name before studying where cubics meet it. [definition: Line At Infinity] The line at infinity in $\mathbb P^2_k$ relative to the chart $Z \ne 0$ is \begin{align*} L_\infty = \{[X:Y:Z] \in \mathbb P^2_k : Z = 0\}. \end{align*} [/definition] Affine lines of the same slope meet at a common point of $L_\infty$. This is the projective repair promised in Chapter 1: vertical lines meet a Weierstrass cubic at the same point at infinity, even when the affine picture has only two visible intersections. [example: Parallel Affine Lines Meet At Infinity] Let $m,c \in k$ and start with the affine line $y=mx+c$ in the chart $Z \ne 0$, where $x=X/Z$ and $y=Y/Z$. Substituting these affine coordinates gives \begin{align*} \frac{Y}{Z}=m\frac{X}{Z}+c. \end{align*} Multiplying by the nonzero chart coordinate $Z$ gives \begin{align*} Y=mX+cZ, \end{align*} so the projective closure of the affine line is the projective line cut out by $Y-mX-cZ=0$. To find its point at infinity, impose $Z=0$. The line equation becomes \begin{align*} Y=mX+c\cdot 0=mX. \end{align*} Thus any point at infinity on the closure has the form $[X:mX:0]$. Since $[0:0:0]$ is not a projective point, we must have $X \ne 0$, and scaling by $X^{-1}$ gives \begin{align*} [X:mX:0]=[1:m:0]. \end{align*} The parameter $c$ has disappeared, so all affine lines with slope $m$ meet $L_\infty$ at the same point $[1:m:0]$. For a vertical affine line $x=a$, the same chart substitution gives \begin{align*} \frac{X}{Z}=a. \end{align*} Multiplying by $Z$ gives its projective closure \begin{align*} X=aZ. \end{align*} On $L_\infty$ we have $Z=0$, hence \begin{align*} X=a\cdot 0=0. \end{align*} A projective point with $X=0$ and $Z=0$ must have $Y \ne 0$, so scaling by $Y^{-1}$ gives \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} Thus vertical affine lines share the point at infinity $[0:1:0]$, while nonvertical parallel lines share the point determined by their common slope. [/example] The example explains how affine lines acquire points at infinity. To use lines in intersection arguments, we need their projective equations in a form compatible with homogeneous coordinates. [definition: Projective Line] A projective line in $\mathbb P^2_k$ is a subset of the form \begin{align*} aX+bY+cZ=0, \end{align*} where $(a,b,c) \in k^3 \setminus \{0\}$. [/definition] This definition includes ordinary affine lines and the line at infinity. In the chart $Z \ne 0$, the equation becomes $ax+by+c=0$, unless the line is entirely contained in $Z=0$. ## Homogeneous Cubics and the Point at Infinity How should an affine equation such as $y^2=x^3+ax+b$ be rewritten so that it makes sense on projective coordinates? The equation must be invariant under scaling: if $[X:Y:Z]$ is a point, replacing $(X,Y,Z)$ by $(\lambda X,\lambda Y,\lambda Z)$ should not change whether the point lies on the curve. This forces all terms to have the same total degree. [definition: Homogeneous Polynomial] A polynomial $F \in k[X,Y,Z]$ is homogeneous of degree $d$ if every monomial appearing in $F$ has total degree $d$. [/definition] A homogeneous equation $F(X,Y,Z)=0$ is well-defined on projective points because $F(\lambda X,\lambda Y,\lambda Z)=\lambda^dF(X,Y,Z)$. Without homogeneity, the truth of the equation could change after choosing a different representative of the same projective point. This gives the basic object needed for projective geometry: not just a polynomial, but the collection of projective points where its homogeneous equation vanishes. The next definition packages that zero set as a projective plane curve, so later cubic equations can be treated as geometric objects in $\mathbb P^2_k$. [definition: Projective Plane Curve] Let $F \in k[X,Y,Z]$ be a nonzero homogeneous polynomial. The projective plane curve cut out by $F$ is \begin{align*} C_F = \{[X:Y:Z] \in \mathbb P^2_k : F(X,Y,Z)=0\}. \end{align*} [/definition] When $F$ has degree $3$, the curve $C_F$ is called a projective plane cubic. Projective plane curves are the objects we want, but most equations in the course begin in affine coordinates. For Weierstrass cubics, homogenisation adds enough powers of $Z$ to make every term cubic while preserving the original affine equation on $Z=1$. [definition: Homogenisation Of An Affine Polynomial] Let $f \in k[x,y]$ have total degree at most $d$. Its homogenisation to degree $d$ is \begin{align*} F(X,Y,Z)=Z^d f(X/Z,Y/Z). \end{align*} After expanding, $F$ is regarded as a homogeneous polynomial in $k[X,Y,Z]$. [/definition] The formula is a compact way to remember the rule: each affine monomial receives the power of $Z$ needed to reach total degree $d$. Dehomogenising by setting $Z=1$ recovers the original polynomial. [example: Homogenising A Weierstrass Cubic] Let $a,b \in k$ and consider the affine curve \begin{align*} y^2=x^3+ax+b. \end{align*} Writing all terms on the left gives the affine polynomial \begin{align*} f(x,y)=y^2-x^3-ax-b. \end{align*} To homogenise $f$ to degree $3$, substitute $x=X/Z$ and $y=Y/Z$, then multiply by $Z^3$: \begin{align*} Z^3 f(X/Z,Y/Z)=Z^3\left(\left(\frac{Y}{Z}\right)^2-\left(\frac{X}{Z}\right)^3-a\left(\frac{X}{Z}\right)-b\right). \end{align*} Expanding each term inside the parentheses gives \begin{align*} Z^3 f(X/Z,Y/Z)=Z^3\left(\frac{Y^2}{Z^2}-\frac{X^3}{Z^3}-\frac{aX}{Z}-b\right). \end{align*} Distributing the factor $Z^3$ term by term gives \begin{align*} Z^3 f(X/Z,Y/Z)=Z^3\cdot \frac{Y^2}{Z^2}-Z^3\cdot \frac{X^3}{Z^3}-Z^3\cdot \frac{aX}{Z}-Z^3\cdot b. \end{align*} Cancelling powers of $Z$ in each term gives \begin{align*} Z^3 f(X/Z,Y/Z)=Y^2Z-X^3-aXZ^2-bZ^3. \end{align*} Thus the homogenised cubic equation is \begin{align*} Y^2Z-X^3-aXZ^2-bZ^3=0, \end{align*} or equivalently \begin{align*} Y^2Z=X^3+aXZ^2+bZ^3. \end{align*} On the affine chart $Z=1$, the homogeneous equation becomes \begin{align*} Y^2\cdot 1=X^3+aX\cdot 1^2+b\cdot 1^3. \end{align*} Since the chart coordinates are $x=X$ and $y=Y$ when $Z=1$, this is exactly \begin{align*} y^2=x^3+ax+b. \end{align*} The added powers of $Z$ make every term have total degree $3$, while the chart $Z=1$ preserves the original affine curve. [/example] After homogenising, the next question is whether the new projective curve has one point or several points at infinity. For the short Weierstrass cubic, this computation identifies the point that will later serve as the identity element of the group law. [quotetheorem:5621] [citeproof:5621] This computation resolves the affine issue with vertical lines: every vertical affine line has the same missing point $O$ on its projective closure, so it can contribute a third intersection even when the affine chart shows only two points. The conclusion is special to the short Weierstrass shape and to the chosen line at infinity; a different homogeneous cubic may meet $L_\infty$ in several points. For instance, the cubic $XYZ=0$ contains the whole line $Z=0$, while $Y^2Z=X^3+XZ^2$ still has the single point $[0:1:0]$ at infinity but may have affine singularities. Thus locating $O$ is not the same as proving the cubic is nonsingular; nonsingularity for short Weierstrass cubics requires the usual discriminant condition, which will matter when the group law is made global. [example: Vertical Line Through A Weierstrass Cubic] Take the projective cubic \begin{align*} C: Y^2Z=X^3+aXZ^2+bZ^3 \end{align*} and the projective line \begin{align*} X=rZ. \end{align*} On the affine chart $Z\ne 0$, the affine coordinate is $x=X/Z$. Dividing the line equation by the nonzero coordinate $Z$ gives \begin{align*} \frac{X}{Z}=r, \end{align*} so this projective line restricts to the affine vertical line $x=r$. Substitute $X=rZ$ into the cubic equation. The term $X^3$ becomes \begin{align*} X^3=(rZ)^3=r^3Z^3, \end{align*} and the term $aXZ^2$ becomes \begin{align*} aXZ^2=a(rZ)Z^2=arZ^3. \end{align*} Therefore the right-hand side of the cubic becomes \begin{align*} X^3+aXZ^2+bZ^3=r^3Z^3+arZ^3+bZ^3. \end{align*} Thus points of $C$ lying on the line $X=rZ$ satisfy \begin{align*} Y^2Z=r^3Z^3+arZ^3+bZ^3. \end{align*} In the affine chart $Z=1$, this equation becomes \begin{align*} Y^2\cdot 1=r^3\cdot 1^3+ar\cdot 1^3+b\cdot 1^3. \end{align*} Since the affine coordinate is $y=Y$ on the chart $Z=1$, the affine intersections satisfy \begin{align*} y^2=r^3+ar+b. \end{align*} Now impose $Z=0$ on the same projective line. The equation $X=rZ$ gives \begin{align*} X=r\cdot 0=0. \end{align*} A projective point with $X=0$ and $Z=0$ has the form $[0:Y:0]$. Since $[0:0:0]$ is excluded from projective space, we must have $Y\ne 0$. Scaling by $Y^{-1}$ gives \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} Thus every vertical line $X=rZ$ contains the same point at infinity $[0:1:0]$, which is the projective point missing from the affine vertical-line picture. [/example] ## Line Substitution and Intersection Multiplicity The group law on a cubic rests on the slogan that a line meets a cubic in three points. To make this reliable, we must count repeated intersections: tangent contact should count twice, and a flex should count three times. A practical way to define the relevant multiplicity for this chapter is to parametrize the line and inspect the resulting one-variable polynomial. [definition: Intersection Multiplicity Along A Projective Line] Let $F \in k[X,Y,Z]$ be homogeneous of degree $3$, and let $\ell \subset \mathbb P^2_k$ be a projective line. A projective linear parametrisation of $\ell$ is an isomorphism \begin{align*} P: \mathbb P^1_k \longrightarrow \ell \subset \mathbb P^2_k \end{align*} of the form \begin{align*} P([u:v])=[L_0(u,v):L_1(u,v):L_2(u,v)], \end{align*} where $L_0,L_1,L_2 \in k[u,v]$ are linear forms with no common zero. If $P([u_0:v_0]) \in C_F$, choose an affine coordinate $t$ on $\mathbb P^1_k$ near $[u_0:v_0]$. The intersection multiplicity of $C_F$ and $\ell$ at $P([u_0:v_0])$ is the order of vanishing at that parameter value of \begin{align*} F(L_0(u,v),L_1(u,v),L_2(u,v)). \end{align*} [/definition] The restriction to projective linear parametrisations prevents artificial changes of multiplicity from ramified reparametrisations such as $t \mapsto t^2$. For the computations in this course, this includes affine coordinates such as $x=r+t$ and $y=s+\nu t$, as well as projective coordinates on a vertical line. With this convention, the slogan that a line meets a cubic three times becomes a precise statement about roots of a cubic polynomial. [explanation: Line-Cubic Intersection Count] Let $F$ be homogeneous of degree $3$, and let $\ell$ be a projective line not contained in the cubic $F=0$. Choose a projective linear parametrisation \begin{align*} P([u:v])=[L_0(u,v):L_1(u,v):L_2(u,v)] \end{align*} of $\ell$. Then \begin{align*} F(L_0(u,v),L_1(u,v),L_2(u,v)) \end{align*} is a nonzero homogeneous cubic in $u$ and $v$. Over an algebraic closure, that cubic has three roots counted with multiplicity, and those roots are exactly the intersections of $\ell$ with the original cubic counted by the definition above. [/explanation] This theorem is the line-cubic case of [Bezout's theorem](/theorems/2131), specialised to the only case needed for the group law. The condition that $\ell$ is not contained in $C_F$ is essential: if the line is a component of the cubic, substitution gives the zero polynomial and there is no finite list of three intersection points to count. The algebraic-closure clause is also essential. Over the base field, the third intersection may be defined only after adjoining roots of the substituted cubic, so the theorem counts geometric intersections rather than guaranteeing three $k$-rational points. The proof is computational enough for the course: the intersection problem is reduced to factoring a cubic polynomial in one variable. [example: A Secant Substitution] Let $C$ be the affine cubic $y^2=x^3+ax+b$, and let the affine line be $y=mx+c$. A point lies on both the curve and the line exactly when its coordinates satisfy both equations, so substituting $y=mx+c$ into the cubic gives \begin{align*} (mx+c)^2=x^3+ax+b. \end{align*} Expanding the square gives \begin{align*} (mx+c)^2=m^2x^2+2mcx+c^2. \end{align*} Thus the intersection equation is \begin{align*} m^2x^2+2mcx+c^2=x^3+ax+b. \end{align*} Moving the left-hand side to the right-hand side gives \begin{align*} 0=x^3+ax+b-m^2x^2-2mcx-c^2. \end{align*} Combining the terms with the same powers of $x$ gives \begin{align*} 0=x^3-m^2x^2+(a-2mc)x+(b-c^2). \end{align*} Equivalently, the possible $x$-coordinates of affine intersection points are the roots of \begin{align*} x^3-m^2x^2+(a-2mc)x+(b-c^2)=0. \end{align*} If two known points $P_1=(x_1,y_1)$ and $P_2=(x_2,y_2)$ of $C$ lie on the line, then $y_i=mx_i+c$ for $i=1,2$. Substituting $x=x_i$ into the displayed cubic therefore gives zero, so $x_1$ and $x_2$ are two roots. The remaining root, counted with multiplicity, gives the $x$-coordinate of the third intersection point on the secant line, which is the point used in the chord construction. [/example] The secant example handles distinct intersections, while the tangent case is the first place where multiplicity matters. To state tangency algebraically, we first need a condition saying that the curve has a genuine first-order direction at the point. [definition: Smooth Point Of A Plane Cubic] Let $F \in k[X,Y,Z]$ be homogeneous of degree $3$, and let $P=[X_0:Y_0:Z_0] \in C_F$. The point $P$ is smooth on $C_F$ if \begin{align*} (F_X(P),F_Y(P),F_Z(P)) \ne (0,0,0), \end{align*} where $F_X,F_Y,F_Z$ are the first partial derivatives of $F$. [/definition] At a smooth point, the first-order part of the equation gives a nonzero linear approximation. The obstruction is that a projective tangent line must be independent of the chosen homogeneous coordinates, while ordinary affine slope formulas depend on a chart. The derivative data give a coordinate-free linear equation for the tangent line, which is the line later used for point doubling. [quotetheorem:5622] [citeproof:5622] The smoothness hypothesis is what makes there be a unique first-order direction. At a singular point all first partial derivatives vanish, so the displayed equation degenerates to $0=0$ and does not define a tangent line. For example, the nodal affine cubic $y^2=x^2(x+1)$ has a singular point at $(0,0)$, and its projective tangent cone has two directions rather than one. Thus the derivative formula applies to the smooth points used in the chord-and-tangent construction, not to singularities of an arbitrary cubic. The formula also gives the familiar slope for a short Weierstrass cubic. It is important here that tangent means contact of order at least two, not merely a line that looks visually close to the curve. [example: Tangent To A Short Weierstrass Cubic] Let \begin{align*} F(X,Y,Z)=Y^2Z-X^3-aXZ^2-bZ^3, \end{align*} and let $P=[r:s:1]$ be an affine point of the cubic, so \begin{align*} s^2=r^3+ar+b. \end{align*} We compute the first partial derivatives term by term. Differentiating with respect to $X$ gives \begin{align*} F_X(X,Y,Z)=-3X^2-aZ^2. \end{align*} Differentiating with respect to $Y$ gives \begin{align*} F_Y(X,Y,Z)=2YZ. \end{align*} Differentiating with respect to $Z$ gives \begin{align*} F_Z(X,Y,Z)=Y^2-2aXZ-3bZ^2. \end{align*} Evaluating these at the representative $(r,s,1)$ gives \begin{align*} F_X(P)=-3r^2-a. \end{align*} \begin{align*} F_Y(P)=2s. \end{align*} \begin{align*} F_Z(P)=s^2-2ar-3b. \end{align*} By *[Tangent Line to a Smooth Plane Curve via Partial Derivatives](/theorems/5622)*, the tangent line at $P$ is therefore \begin{align*} (-3r^2-a)X+2sY+(s^2-2ar-3b)Z=0. \end{align*} On the affine chart $Z=1$, write $x=X$ and $y=Y$. The tangent equation becomes \begin{align*} (-3r^2-a)x+2sy+s^2-2ar-3b=0. \end{align*} At $(x,y)=(r,s)$, the left-hand side is \begin{align*} (-3r^2-a)r+2s^2+s^2-2ar-3b=-3r^3-3ar+3s^2-3b. \end{align*} Factoring out $3$ gives \begin{align*} -3r^3-3ar+3s^2-3b=3(s^2-r^3-ar-b). \end{align*} Since $s^2=r^3+ar+b$, this value is \begin{align*} 3(s^2-r^3-ar-b)=0. \end{align*} Subtracting this zero value from the affine tangent equation gives \begin{align*} (-3r^2-a)(x-r)+2s(y-s)=0. \end{align*} Moving the first term to the other side gives \begin{align*} 2s(y-s)=(3r^2+a)(x-r). \end{align*} When $\operatorname{char}(k)\ne 2$ and $s\ne 0$, the scalar $2s$ is invertible, so division by $2s$ gives \begin{align*} y-s=\frac{3r^2+a}{2s}(x-r). \end{align*} Thus the affine tangent has slope \begin{align*} \nu=\frac{3r^2+a}{2s}, \end{align*} which is the slope used in the doubling construction at a nonvertical affine tangent point. [/example] To see multiplicity directly, parametrize a tangent line through $P=(r,s)$ by $x=r+t$ and $y=s+\nu t$. Substitution into the affine equation produces a cubic in $t$ whose constant and linear terms vanish. The root $t=0$ therefore has multiplicity at least two. [example: Tangency As A Repeated Root] Let $C$ be $y^2=x^3+ax+b$, and let $P=(r,s)$ lie on $C$ with $s \ne 0$ and $2s$ invertible in $k$. Put \begin{align*} \nu=\frac{3r^2+a}{2s}, \qquad x=r+t, \qquad y=s+\nu t. \end{align*} This parametrizes the line through $P$ with slope $\nu$, since at $t=0$ it gives $(x,y)=(r,s)$. Its intersections with $C$ are detected by substituting into $y^2-x^3-ax-b$: \begin{align*} (s+\nu t)^2-(r+t)^3-a(r+t)-b. \end{align*} Expanding the square gives \begin{align*} (s+\nu t)^2=s^2+2s\nu t+\nu^2t^2. \end{align*} Expanding the cube gives \begin{align*} (r+t)^3=r^3+3r^2t+3rt^2+t^3. \end{align*} Also, \begin{align*} a(r+t)=ar+at. \end{align*} Therefore the substituted expression is \begin{align*} s^2+2s\nu t+\nu^2t^2-r^3-3r^2t-3rt^2-t^3-ar-at-b. \end{align*} Grouping the constant terms, the $t$-terms, the $t^2$-terms, and the $t^3$-term gives \begin{align*} (s^2-r^3-ar-b)+(2s\nu-3r^2-a)t+(\nu^2-3r)t^2-t^3. \end{align*} Since $P=(r,s)$ lies on $C$, \begin{align*} s^2=r^3+ar+b, \end{align*} so \begin{align*} s^2-r^3-ar-b=0. \end{align*} By the definition of $\nu$, \begin{align*} 2s\nu=2s\cdot \frac{3r^2+a}{2s}=3r^2+a, \end{align*} and therefore \begin{align*} 2s\nu-3r^2-a=0. \end{align*} Thus the substituted polynomial becomes \begin{align*} (\nu^2-3r)t^2-t^3. \end{align*} Factoring out $t^2$ gives \begin{align*} (\nu^2-3r)t^2-t^3=t^2(\nu^2-3r-t). \end{align*} The factor $t^2$ shows that $t=0$, corresponding to the point $P$, is a root of multiplicity at least two. The remaining linear factor gives the third intersection of the tangent line with the cubic, counted with multiplicity. [/example] These three ingredients now replace the unreliable affine picture with a stable projective one. Homogeneous coordinates supply the missing point $O=[0:1:0]$, line substitution counts intersections with multiplicity, and the derivative formula identifies tangents. Chapter 3 first explains why singular points must be excluded, and Chapter 5 then uses these ingredients to define the chord-and-tangent operation on a nonsingular Weierstrass cubic. Once intersections are counted correctly in projective space, the remaining obstacle is singularity. The next chapter isolates the cubics where tangents and chord constructions become ambiguous, so we can separate the curves that support a group law from those that do not. # 3. Smoothness, Singular Cubics, and What Goes Wrong The previous chapter explained how projective closure repairs the most visible defects of affine cubic curves: missing points at infinity and line intersections that escape the affine chart. This chapter addresses a deeper problem. Even after passing to the projective plane, some cubics have points where the tangent direction is not well behaved, and at those points the geometric construction behind the group law loses its meaning. The goal is to isolate exactly what goes wrong and to identify nonsingularity as the condition that makes elliptic curves the right objects. ## Detecting Singular Points by Partial Derivatives How can we tell, from the equation alone, whether a plane cubic has a well-defined tangent at every point? For a curve cut out by one polynomial, the first-order part of the polynomial at a point controls the tangent line. If all first-order terms vanish at a point of the curve, the tangent construction degenerates there. [definition: Singular Point of a Plane Curve] Let $k$ be a field, let $F \in k[X,Y,Z]$ be a homogeneous polynomial, and let $C \subset \mathbb P^2_k$ be the projective plane curve defined by $F=0$. A point $P=[X_0:Y_0:Z_0] \in C$ is singular if \begin{align*} F(P)=0, \qquad \frac{\partial F}{\partial X}(P)=0, \qquad \frac{\partial F}{\partial Y}(P)=0, \qquad \frac{\partial F}{\partial Z}(P)=0. \end{align*} [/definition] The curve $C$ is nonsingular if it has no singular points over the algebraic closure $\overline{k}$. The definition is made over $\overline{k}$ because a curve may hide a bad point after extending the field. For a first course, most computations take place over $\mathbb Q$, $\mathbb R$, or a finite field, but smoothness is a geometric property of the curve rather than a property of the chosen list of rational points. [quotetheorem:5623] [citeproof:5623] This criterion turns smoothness into a finite calculation: solve the cubic equation together with its three partial derivative equations. It does not say that the tangent line can be read off from the original affine picture without checking points at infinity, nor does it say that a point is singular merely because a familiar affine formula has a repeated-looking feature. For example, a vertical tangent on a smooth Weierstrass cubic has $F_Y(P)=0$, but it is not singular unless all three partial derivatives vanish at the same point. For homogeneous cubics, Euler's identity often reduces the workload. If $\operatorname{char}(k)$ does not divide $3$, then \begin{align*} 3F = X F_X + Y F_Y + Z F_Z. \end{align*} Thus common zeros of the three partial derivatives automatically lie on the cubic in characteristic not $3$. This shortcut is characteristic-sensitive: in characteristic $3$, Euler's identity no longer lets us recover $F(P)=0$ from the vanishing of the partial derivatives, so the curve equation must still be checked. The examples below use the criterion in the intended way: first locate common zeros of the partial derivatives, then verify that they lie on the projective cubic. [example: Nodal Cubic Singular Point] Consider the projective closure of $y^2=x^3+x^2$ over a field of characteristic not $2$: \begin{align*} F(X,Y,Z)=Y^2Z-X^3-X^2Z. \end{align*} The affine point $(0,0)$ corresponds to $P=[0:0:1]$, and \begin{align*} F(P)=0^2\cdot 1-0^3-0^2\cdot 1=0. \end{align*} Differentiating term by term gives \begin{align*} F_X=0-3X^2-2XZ=-3X^2-2XZ. \end{align*} \begin{align*} F_Y=2YZ-0-0=2YZ. \end{align*} \begin{align*} F_Z=Y^2-0-X^2=Y^2-X^2. \end{align*} At $P=[0:0:1]$, these values are \begin{align*} F_X(P)=-3\cdot 0^2-2\cdot 0\cdot 1=0. \end{align*} \begin{align*} F_Y(P)=2\cdot 0\cdot 1=0. \end{align*} \begin{align*} F_Z(P)=0^2-0^2=0. \end{align*} Thus $F(P)$ and all three first partial derivatives vanish at $P$, so $P$ is a singular point of the projective cubic. Now check that this singularity is not coming from the point at infinity. In the affine chart $Z=1$, any affine singular point must satisfy \begin{align*} F_Y(X,Y,1)=2Y=0. \end{align*} Since $\operatorname{char}(k)\ne 2$, this implies $Y=0$. The equation \begin{align*} F_Z(X,Y,1)=Y^2-X^2=0 \end{align*} then becomes \begin{align*} 0^2-X^2=0, \end{align*} so $X=0$ over the algebraic closure. Hence the only affine singular candidate is $[0:0:1]$. At infinity, $Z=0$, and the curve equation becomes \begin{align*} F(X,Y,0)=-X^3=0. \end{align*} Thus $X=0$, so the only point at infinity is $O=[0:1:0]$. At this point, \begin{align*} F_Z(O)=1^2-0^2=1. \end{align*} Therefore at least one partial derivative is nonzero at $O$, so $O$ is nonsingular. The projective cubic has a genuine affine singularity at $(0,0)$; projectivising the curve has not created or repaired it. [/example] The example shows that the singularity is not caused by missing projective points; it remains after projectivising. The next question is what the local geometry of such a point looks like, since different singularities obstruct the group law in different ways. ## Nodes and Cusps as Obstructions to the Chord-Tangent Construction What geometric behaviour at a bad point prevents the chord-and-tangent rule from defining addition? The group law needs a tangent line at each point and a controlled intersection count when points collide. At a singular point, either there are multiple tangent directions or the tangent line meets with excessive contact, and both situations destroy the uniform rule that made smooth cubics attractive. [definition: Node] Let $C$ be a plane curve over an algebraically closed field, and let $P \in C$ be a singular point. The point $P$ is a node if the lowest-degree nonzero homogeneous part of a local affine equation for $C$ at $P$ has degree $2$ and factors as two distinct linear forms. [/definition] A node is the algebraic version of two branches crossing at one point. The curve has two tangent directions there, so the phrase "the tangent at $P$" is not a single object without choosing a branch. [example: Tangent Directions on the Nodal Cubic] For $C: y^2=x^3+x^2$ at $(0,0)$, put all terms on the left: \begin{align*} f(x,y)=y^2-x^3-x^2. \end{align*} The terms of $f$ have total degrees \begin{align*} \deg(y^2)=2,\qquad \deg(x^3)=3,\qquad \deg(x^2)=2, \end{align*} so the lowest-degree homogeneous part is \begin{align*} f_2(x,y)=y^2-x^2. \end{align*} Factoring this quadratic gives \begin{align*} y^2-x^2=(y-x)(y+x), \end{align*} because \begin{align*} (y-x)(y+x)=y^2+xy-xy-x^2=y^2-x^2. \end{align*} Thus the tangent cone at $(0,0)$ is the union of the two lines \begin{align*} y-x=0 \qquad \text{and} \qquad y+x=0, \end{align*} that is, \begin{align*} y=x \qquad \text{and} \qquad y=-x. \end{align*} These two tangent lines are distinct exactly when $y-x$ and $y+x$ are not scalar multiples, which holds in characteristic not $2$. Hence $(0,0)$ is a node in those characteristics. The singular point has two limiting tangent directions, so a tangent-based addition rule would have to choose a branch before it could say which tangent line to use. [/example] Nodes are already enough to make the usual elliptic-curve group law fail as a law on the whole cubic. There is another standard singularity where the problem is not two directions, but a single direction counted too strongly. [definition: Cusp] Let $C$ be a plane curve over an algebraically closed field, and let $P \in C$ be a singular point. In these notes, $P$ is called a cusp when the lowest-degree nonzero homogeneous part of a local affine equation at $P$ is a square of a linear form, so the singularity has one tangent direction counted twice rather than two distinct tangent directions. [/definition] A cusp has a unique tangent direction, but the curve doubles back into that direction. The tangent exists as a line, yet it does not behave like the tangent at a smooth point of a cubic. [illustration:node-vs-cusp-singular-cubic] [example: The Cuspidal Cubic] Consider $C: y^2=x^3$ over a field $k$ with $\operatorname{char}(k)\ne 2,3$, and write its projective equation as \begin{align*} F(X,Y,Z)=Y^2Z-X^3. \end{align*} The affine point $(0,0)$ corresponds to $P=[0:0:1]$, and \begin{align*} F(P)=0^2\cdot 1-0^3=0. \end{align*} Differentiating term by term gives \begin{align*} F_X=0-3X^2=-3X^2. \end{align*} Also, \begin{align*} F_Y=2YZ-0=2YZ. \end{align*} Finally, \begin{align*} F_Z=Y^2-0=Y^2. \end{align*} At $P=[0:0:1]$, these values are \begin{align*} F_X(P)=-3\cdot 0^2=0. \end{align*} Similarly, \begin{align*} F_Y(P)=2\cdot 0\cdot 1=0. \end{align*} And \begin{align*} F_Z(P)=0^2=0. \end{align*} Thus $F(P)$ and all three first partial derivatives vanish at $P$, so $P$ is singular. In the affine chart $Z=1$, the local equation at $(0,0)$ is \begin{align*} f(x,y)=y^2-x^3. \end{align*} The two terms have total degrees \begin{align*} \deg(y^2)=2 \end{align*} and \begin{align*} \deg(x^3)=3, \end{align*} so the lowest-degree homogeneous part is \begin{align*} f_2(x,y)=y^2. \end{align*} Since \begin{align*} y^2=y\cdot y, \end{align*} the tangent cone is the double line $y=0$. The parametrisation \begin{align*} x=t^2 \end{align*} and \begin{align*} y=t^3 \end{align*} passes through $(0,0)$ at $t=0$, and it lies on the curve because \begin{align*} y^2-x^3=(t^3)^2-(t^2)^3=t^6-t^6=0. \end{align*} It uses one parameter $t$ for the branch through the singular point, so this singularity has one branch and one tangent direction counted twice. Therefore $(0,0)$ is a cusp rather than a node. [/example] The nodal and cuspidal examples explain why singular cubics are excluded from the definition of elliptic curve. They may still have rich algebraic structure, but the chord-tangent process no longer gives the uniform geometric group law attached to a nonsingular cubic. [remark: Singular Cubics Are Not Elliptic Curves] A singular cubic can often be parametrised explicitly and is closer to the affine line or the multiplicative group than to an elliptic curve. For instance, nodal cubics are related to $\mathbb G_m$, while cuspidal cubics are related to $\mathbb G_a$. This course focuses on the nonsingular case because that is where the projective cubic itself carries the elliptic-curve group law. [/remark] The obstruction has now been identified geometrically. The remaining task is to find an efficient algebraic test for the most important family of cubics used in computations. ## Short Weierstrass Cubics and the Discriminant For explicit arithmetic, the main cubics in this course will have the form $y^2=x^3+ax+b$. Which values of $a$ and $b$ give nonsingular curves? The answer is encoded by the discriminant of the cubic polynomial on the right-hand side. [definition: Short Weierstrass Cubic] Let $k$ be a field with $\operatorname{char}(k) \ne 2,3$. A short Weierstrass cubic over $k$ is the projective plane cubic \begin{align*} E: Y^2Z=X^3+aXZ^2+bZ^3 \end{align*} with $a,b \in k$. [/definition] The point at infinity on this curve is always $O=[0:1:0]$. The affine chart $Z=1$ contains the visible equation $y^2=x^3+ax+b$, while the point $O$ is the projective point that later serves as the identity element for the group law. The next problem is to attach to this model a single coefficient expression whose vanishing records exactly when the cubic polynomial $x^3+ax+b$ has a repeated root. That expression is important enough to name, because it will be checked every time a Weierstrass equation is proposed as an elliptic curve. [definition: Discriminant of a Short Weierstrass Cubic] Let $k$ be a field with $\operatorname{char}(k) \ne 2,3$, and let \begin{align*} E: y^2=x^3+ax+b. \end{align*} The discriminant of $E$ is \begin{align*} \Delta(E)=-16(4a^3+27b^2). \end{align*} [/definition] The factor $-16$ is conventional and is harmless in characteristic not $2$. The reason this quantity matters is that a singular affine point would have $y=0$ and would also be a repeated root of $x^3+ax+b$. Thus the next result turns the partial-derivative smoothness test into the single condition $\Delta(E) \ne 0$. [quotetheorem:5624] [citeproof:5624] This theorem is the computational smoothness test used throughout the rest of the course, but its hypotheses matter. The restriction $\operatorname{char}(k) \ne 2,3$ is what allows the equation to be put in short Weierstrass form and makes the equations $2y=0$ and $3x^2+a=0$ behave as expected. In characteristic $2$ or $3$, elliptic curves still exist, but the correct Weierstrass equations and discriminants have extra terms, so the expression $-16(4a^3+27b^2)$ is not the right general test. The criterion is also a test for this particular model, not for every cubic equation one might write down. A general plane cubic may contain $x^2$, $xy$, $y$, or other terms, and then smoothness must be checked either by all the relevant partial derivatives or by first transforming to an appropriate Weierstrass model. The importance of the discriminant is that, once the curve is genuinely in short Weierstrass form, the whole geometric question of singularity is compressed into the single condition $\Delta(E) \ne 0$. [example: A Nonsingular Short Weierstrass Cubic] For \begin{align*} E: y^2=x^3-x+1, \end{align*} the coefficients in short Weierstrass form $y^2=x^3+ax+b$ are \begin{align*} a=-1,\qquad b=1. \end{align*} The discriminant formula gives \begin{align*} \Delta(E)=-16(4a^3+27b^2). \end{align*} Substituting $a=-1$ and $b=1$ gives \begin{align*} \Delta(E)=-16\bigl(4(-1)^3+27\cdot 1^2\bigr). \end{align*} Since $(-1)^3=-1$ and $1^2=1$, this becomes \begin{align*} \Delta(E)=-16\bigl(4(-1)+27\cdot 1\bigr). \end{align*} Thus \begin{align*} \Delta(E)=-16(-4+27). \end{align*} Since $-4+27=23$, we get \begin{align*} \Delta(E)=-16\cdot 23=-368. \end{align*} The image of $-368$ in a field $k$ is nonzero exactly when $\operatorname{char}(k)$ does not divide $368$. Because \begin{align*} 368=16\cdot 23=2^4\cdot 23, \end{align*} this excludes characteristics $2$ and $23$. The short Weierstrass discriminant criterion also assumes $\operatorname{char}(k)\ne 2,3$, so this cubic is nonsingular over every field of characteristic different from $2$, $3$, and $23$. In particular, over $\mathbb Q$ or $\mathbb R$, the discriminant is the nonzero number $-368$, so this model is a genuine nonsingular elliptic curve for the next chapters. [/example] The discriminant also explains the two singular examples already studied. For $y^2=x^3+x^2$ the equation is not in short Weierstrass form because of the $x^2$ term, but the repeated root at $x=0$ is visible in the cubic $x^3+x^2=x^2(x+1)$. For $y^2=x^3$, the root $x=0$ has multiplicity $3$, producing the cusp rather than a node. ## Nonsingular Cubics as the Right Objects Why does nonsingularity mark the transition from cubic curves to elliptic curves? The answer is that the chord-tangent construction needs every line intersection to vary consistently, including the limiting case where two points merge. Smoothness supplies exactly the condition that each point has a well-defined tangent line and that local intersection multiplicity behaves as expected. [explanation: Chord-Tangent Construction Before the Group Law] Let $k$ be a field, and let $C \subset \mathbb P^2_k$ be a nonsingular projective plane cubic with a chosen point $O \in C(k)$. Given $P,Q \in C(k)$, the line through $P$ and $Q$ is used when $P \ne Q$, and the tangent line to $C$ at $P$ is used when $P=Q$. By the line-cubic intersection count from Chapter 2, over $\overline{k}$ this line meets $C$ in a third point when intersections are counted with multiplicity. Because the line and the cubic are defined over $k$, if the first two intersection points are $k$-rational then the residual intersection point is also $k$-rational. On a short Weierstrass cubic, the visible affine formula for addition then reflects this third point across the $x$-axis. For an arbitrary smooth plane cubic, however, there is no canonical vertical reflection built into the model. The intrinsic group law is formulated instead by using the chosen origin $O$: three collinear points $P,Q,R$ on $C$ are required to satisfy $P+Q+R=O$, with tangent contact counted twice. Proving that this prescription is associative is a later theorem, not a consequence of the construction alone. [/explanation] [illustration:weierstrass-secant-reflection] The chosen point $O$ will become the identity element, and for a short Weierstrass cubic it is the point at infinity $[0:1:0]$. The singular examples fail before associativity is even considered: at a node there are two tangent directions, and at a cusp the tangent has abnormal contact with the curve. Smoothness supplies the local tangent needed to define the construction, while projective geometry supplies the residual intersection point used throughout the later group-law chapters. [remark: Working Definition for the Course] For the rest of these notes, an elliptic curve over a field $k$ will mean a nonsingular projective cubic together with a specified $k$-rational point. In computations, and assuming $\operatorname{char}(k) \ne 2,3$, this will usually be written in short Weierstrass form \begin{align*} y^2=x^3+ax+b, \qquad \Delta=-16(4a^3+27b^2) \ne 0, \end{align*} with the point at infinity as the identity. [/remark] This chapter has separated two ideas that are often introduced at the same time. Projective geometry ensures the line-cubic intersection count needed for the chord construction, while nonsingularity ensures the local tangent behaviour needed for the tangent construction. The next chapter puts the curve into Weierstrass form and singles out the point at infinity, so the abstract projective picture can be turned into a concrete coordinate model for the later group-law formulas. # 4. Weierstrass Form and the Point at Infinity This chapter puts the projective cubic into the coordinate system used for computations. The preceding chapters explained why projective closure is needed and how lines meet cubics with multiplicity. We now choose equations in which the special point at infinity is visible, the tangent there has controlled behaviour, and the later chord-and-tangent group law can be written by formulas. ## Why Weierstrass Equations Are the Right Coordinates The problem is that a general homogeneous cubic has many coefficients and no preferred point. For the group law we want a nonsingular cubic together with a chosen base point $O$, because this point will serve as the identity. Weierstrass form packages this choice into the equation: the base point is built into the projective model. [definition: Long Weierstrass Equation] Let $k$ be a field. A long Weierstrass equation over $k$ is an affine equation \begin{align*} y^2 + a_1xy + a_3y = x^3 + a_2x^2 + a_4x + a_6, \end{align*} where $a_1,a_2,a_3,a_4,a_6 \in k$. [/definition] Its projective closure is obtained by homogenising to degree $3$: \begin{align*} Y^2Z + a_1XYZ + a_3YZ^2 = X^3 + a_2X^2Z + a_4XZ^2 + a_6Z^3. \end{align*} This equation is designed so that the affine chart $Z=1$ recovers the displayed affine curve, while the line at infinity $Z=0$ can be checked directly. [example: Homogenising A Long Weierstrass Equation] Over a field $k$, consider \begin{align*} y^2+xy=x^3-x+2. \end{align*} Comparing this with \begin{align*} y^2+a_1xy+a_3y=x^3+a_2x^2+a_4x+a_6, \end{align*} gives \begin{align*} a_1=1,\quad a_2=0,\quad a_3=0,\quad a_4=-1,\quad a_6=2. \end{align*} To homogenise, replace $x$ by $X/Z$ and $y$ by $Y/Z$, then multiply both sides by $Z^3$. The left-hand side becomes \begin{align*} Z^3\left(\frac{Y^2}{Z^2}+\frac{XY}{Z^2}\right)=Y^2Z+XYZ. \end{align*} The right-hand side becomes \begin{align*} Z^3\left(\frac{X^3}{Z^3}-\frac{X}{Z}+2\right)=X^3-XZ^2+2Z^3. \end{align*} Thus the projective closure is \begin{align*} Y^2Z+XYZ=X^3-XZ^2+2Z^3. \end{align*} On the affine chart $Z=1$, this equation becomes \begin{align*} Y^2+XY=X^3-X+2, \end{align*} which is the original affine equation after writing $x=X$ and $y=Y$. On the line at infinity $Z=0$, the equation becomes \begin{align*} 0=X^3. \end{align*} Hence $X=0$. Since a projective point cannot have all coordinates zero, $Y\ne 0$, and rescaling gives \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} Therefore this projective cubic has exactly one point at infinity, namely $[0:1:0]$. [/example] For many first computations the linear terms in $y$ and the quadratic term in $x$ are avoidable. The simplification depends on the characteristic of the field, because completing the square and translating $x$ require division by $2$ and $3$. [definition: Short Weierstrass Equation] Let $k$ be a field with $\text{char}(k) \ne 2,3$. A short Weierstrass equation over $k$ is an affine equation \begin{align*} y^2 = x^3 + ax + b, \end{align*} where $a,b \in k$. [/definition] The corresponding projective cubic is \begin{align*} Y^2Z = X^3 + aXZ^2 + bZ^3. \end{align*} Short Weierstrass form is the coordinate system in which most formulas in this course will be derived, but the long form is the correct general shape when the characteristic may be $2$ or $3$. [example: Completing The Square And Translating] Assume $\text{char}(k)\ne 2,3$ and start with \begin{align*} y^2=x^3+3x^2+2x+1. \end{align*} There are no $xy$ or $y$ terms, so the completing-square step does not change this example. To remove the $x^2$ term, translate the $x$-coordinate by putting \begin{align*} x=u-1. \end{align*} Now expand each power: \begin{align*} (u-1)^2=u^2-2u+1. \end{align*} Also, \begin{align*} (u-1)^3=(u-1)(u^2-2u+1)=u^3-3u^2+3u-1. \end{align*} Substituting these into the right-hand side gives \begin{align*} x^3+3x^2+2x+1=(u^3-3u^2+3u-1)+3(u^2-2u+1)+2(u-1)+1. \end{align*} Expanding the remaining scalar multiples gives \begin{align*} (u^3-3u^2+3u-1)+3(u^2-2u+1)+2(u-1)+1=u^3-3u^2+3u-1+3u^2-6u+3+2u-2+1. \end{align*} Collecting like terms gives \begin{align*} u^3-3u^2+3u-1+3u^2-6u+3+2u-2+1=u^3+(-3u^2+3u^2)+(3u-6u+2u)+(-1+3-2+1). \end{align*} The quadratic terms cancel, the linear coefficient is $3-6+2=-1$, and the constant term is $-1+3-2+1=1$, so \begin{align*} x^3+3x^2+2x+1=u^3-u+1. \end{align*} Therefore the translated equation is \begin{align*} y^2=u^3-u+1. \end{align*} The coefficient of $x^2$ was $3$, and the substitution $x=u-1$ subtracts $3/3=1$ from the old coordinate, which is why division by $3$ is part of the standard translation step. [/example] ## Nonsingularity In Short Weierstrass Form The next question is which short Weierstrass equations define elliptic curves rather than singular cubics. Since the equation is projective, singularities must be checked both in the affine chart and at infinity. [definition: Singular Point Of A Plane Cubic] Let $F(X,Y,Z) \in k[X,Y,Z]$ be homogeneous of degree $3$. A point $P=[X:Y:Z] \in \mathbb P^2_k$ on the cubic $F=0$ is singular if \begin{align*} \frac{\partial F}{\partial X}(P)=\frac{\partial F}{\partial Y}(P)=\frac{\partial F}{\partial Z}(P)=0. \end{align*} [/definition] This derivative test turns nonsingularity into a finite calculation in the coefficients. For $F(X,Y,Z)=Y^2Z-X^3-aXZ^2-bZ^3$, the affine part is governed by $f(x)=x^3+ax+b$, so the needed criterion should say exactly when this cubic polynomial has no repeated root and when the point at infinity remains smooth. [quotetheorem:5624] [citeproof:5624] This criterion is the first place where the expression $4a^3+27b^2$ appears. Many authors define the discriminant of $y^2=x^3+ax+b$ as $\Delta=-16(4a^3+27b^2)$; the nonzero condition is unchanged. The hypotheses on the characteristic are part of the statement, not a cosmetic restriction: in characteristic $2$ the derivative of $y^2$ vanishes, and in characteristic $3$ the derivative of $x^3$ vanishes, so the repeated-root calculation no longer has the displayed form. For instance, over a field of characteristic $3$, the affine equation $y^2=x^3+1$ has $x^3+1=(x+1)^3$ and is singular at $(-1,0)$, even though the characteristic-zero discriminant formula cannot be used in the same way. The theorem also does not say that every smooth plane cubic is already in short Weierstrass form; it applies after a choice of coordinates and after the point at infinity has been put into the Weierstrass position. Its role in the course is computational: it converts the geometric condition "smooth projective cubic" into a coefficient test, which is exactly what later examples of elliptic curves over $\mathbb Q$, finite fields, and other arithmetic fields will use. [example: Discriminant Of y Squared Equals x Cubed Minus x] For \begin{align*} E: y^2=x^3-x, \end{align*} the short Weierstrass coefficients are $a=-1$ and $b=0$, because \begin{align*} x^3+ax+b=x^3+(-1)x+0=x^3-x. \end{align*} Therefore the nonsingularity expression is \begin{align*} 4a^3+27b^2=4(-1)^3+27(0)^2. \end{align*} Since $(-1)^3=-1$ and $(0)^2=0$, this becomes \begin{align*} 4(-1)^3+27(0)^2=4(-1)+27\cdot 0=-4+0=-4. \end{align*} If $\operatorname{char}(k)\ne 2$, then $4\ne 0$ in $k$, so $-4\ne 0$. Hence, over any field with $\operatorname{char}(k)\ne 2,3$, the projective cubic \begin{align*} Y^2Z=X^3-XZ^2 \end{align*} is nonsingular by the *[Discriminant Criterion for Nonsingularity of Short Weierstrass Cubics](/theorems/5624)*. The affine cubic polynomial factors as \begin{align*} x^3-x=x(x^2-1). \end{align*} Using $x^2-1=(x-1)(x+1)$, we get \begin{align*} x^3-x=x(x-1)(x+1). \end{align*} Its roots are $0$, $1$, and $-1$; when $\operatorname{char}(k)\ne 2$, these are distinct because $1\ne -1$, and neither $1$ nor $-1$ equals $0$. Thus the coefficient test agrees with the geometric picture: the points with $y=0$ do not come from a repeated root of $x^3-x$, so they do not produce an affine cusp or node. [/example] The criterion also detects singular curves which may look harmless in affine form. The polynomial can have a repeated root even when the equation is compact. [example: Discriminant Of y Squared Equals x Cubed Plus One] For \begin{align*} C: y^2=x^3+1, \end{align*} the short Weierstrass coefficients are $a=0$ and $b=1$, since \begin{align*} x^3+ax+b=x^3+0x+1=x^3+1. \end{align*} The nonsingularity expression from the *Discriminant Criterion for Nonsingularity of Short Weierstrass Cubics* is \begin{align*} 4a^3+27b^2=4(0)^3+27(1)^2. \end{align*} Because $(0)^3=0$ and $(1)^2=1$, this gives \begin{align*} 4(0)^3+27(1)^2=4\cdot 0+27\cdot 1=0+27=27. \end{align*} If $\operatorname{char}(k)\ne 3$, then $3\ne 0$ in $k$, so \begin{align*} 27=3^3\ne 0 \end{align*} because a field has no zero divisors. Hence over every field with $\operatorname{char}(k)\ne 2,3$, the projective cubic \begin{align*} Y^2Z=X^3+Z^3 \end{align*} is nonsingular by the *Discriminant Criterion for Nonsingularity of Short Weierstrass Cubics*. In characteristic $3$, the same short-form criterion is not applicable. The affine equation is \begin{align*} y^2=x^3+1, \end{align*} and in characteristic $3$ we have \begin{align*} (x+1)^3=x^3+3x^2+3x+1=x^3+0x^2+0x+1=x^3+1. \end{align*} Thus \begin{align*} x^3+1=(x+1)^3. \end{align*} At the point $(-1,0)$, the equation is satisfied because \begin{align*} 0^2=0 \end{align*} and \begin{align*} (-1)^3+1=-1+1=0. \end{align*} For $F(x,y)=y^2-x^3-1$, the partial derivatives are \begin{align*} \frac{\partial F}{\partial x}=-3x^2,\qquad \frac{\partial F}{\partial y}=2y. \end{align*} In characteristic $3$, \begin{align*} \frac{\partial F}{\partial x}(-1,0)=-3(-1)^2=0 \end{align*} and, since the characteristic is not $2$, \begin{align*} \frac{\partial F}{\partial y}(-1,0)=2\cdot 0=0. \end{align*} So $(-1,0)$ is a singular affine point in characteristic $3$, showing exactly why the characteristic restriction is part of the nonsingularity criterion. [/example] ## The Distinguished Point At Infinity The group law needs a point to play the role of zero. In short Weierstrass form this point is not chosen after the fact; it is forced by the projective equation. [quotetheorem:5625] [citeproof:5625] This theorem explains why vertical affine lines will behave well later. A vertical line $x=c$ has projective closure $X-cZ=0$, and its third intersection with the cubic occurs at $O$ after the two affine points with $x=c$ are counted. The statement is special to Weierstrass coordinates: a general projective cubic can meet the line at infinity in three points, or in one point with different multiplicity behaviour, depending on its highest-degree homogeneous part. Thus uniqueness of $O$ is not merely a fact about projective closure; it is a coordinate normalisation that prepares the cubic for a single identity element. For example, the Fermat cubic $X^3+Y^3=Z^3$ meets the line at infinity in the solutions of $X^3+Y^3=0$. Over an algebraically closed field of characteristic not $3$, these give three distinct points at infinity. This contrast shows why the Weierstrass equation is doing geometric work: it arranges the line at infinity to meet the cubic only at the chosen base point. At the same time, the theorem alone does not prove that the cubic is nonsingular, nor does it construct a group law. A singular cubic may still have a unique point at infinity, and the chord-and-tangent operation only becomes a group operation once smoothness and the flex property of $O$ are also in place. [illustration:vertical-line-projective-closure] [example: Vertical Lines Meet At O] On $E:y^2=x^3-x$ over $\mathbb R$, take the affine line $x=0$. Substituting $x=0$ into the affine equation gives \begin{align*} y^2=0^3-0=0, \end{align*} so the only affine intersection point on this line is $(0,0)$. The intersection equation along the line is \begin{align*} y^2=0, \end{align*} which has the single root $y=0$ with multiplicity two because the polynomial is $(y-0)^2$. The projective closure is \begin{align*} Y^2Z=X^3-XZ^2. \end{align*} The affine line $x=0$ has projective closure $X=0$. Substituting $X=0$ into the projective equation gives \begin{align*} Y^2Z=0^3-0\cdot Z^2=0. \end{align*} Hence the intersection count on the projective line $X=0$ is governed by \begin{align*} Y^2Z=0. \end{align*} The factor $Y^2=0$ gives $Y=0$ with multiplicity two; since $Z\ne 0$ for this point, rescaling gives \begin{align*} [0:0:Z]=[0:0:1], \end{align*} which is the affine point $(0,0)$. The remaining factor $Z=0$ gives \begin{align*} [0:Y:0]=[0:1:0], \end{align*} because a projective point cannot have $Y=0$ and $Z=0$ when $X=0$. Thus the line $x=0$ meets the cubic twice at the affine point $(0,0)$ and once at the point at infinity $O=[0:1:0]$. [/example] To use $O$ as the identity, we need more than its existence: the tangent at $O$ should have triple contact with the cubic. This is the geometric meaning of saying that $O$ is a flex. [definition: Flex Point] Let $C \subset \mathbb P^2_k$ be a plane cubic and let $P \in C$ be a nonsingular point. The point $P$ is a flex if the tangent line to $C$ at $P$ meets $C$ at $P$ with intersection multiplicity $3$. [/definition] For $O$ to serve as the origin in the chord-and-tangent law, it is not enough that $O$ lies on the projective curve. An arbitrary point at infinity would not control how tangent intersections are counted, and the identity law would have no reason to match the vertical reflection rule. The next obstruction is therefore local at $O$: the line at infinity must meet the cubic there with exactly the contact behavior required of a flex. The following result verifies that concrete triple-contact property for the Weierstrass point at infinity, which is what makes this distinguished point compatible with the later group law. [quotetheorem:5626] [citeproof:5626] The flex condition is stronger than merely saying that $O$ lies at infinity. It says that the line at infinity is tangent with the maximum possible contact for a line and a cubic, so the projective intersection bookkeeping is compatible with using $O$ as zero. If the distinguished point were not a flex, the same chord construction would still produce third intersection points, but the identity and inverse rules would not have the simple Weierstrass form used later. The characteristic assumption is included because this chapter is working in the short Weierstrass setting used for the standard formulas. The displayed tangent computation itself depends only on the nonsingularity of the short Weierstrass projective cubic at $O$ and on the equation having the form $Y^2Z=X^3+aXZ^2+bZ^3$. In characteristics $2$ and $3$, short equations no longer represent the general nonsingular Weierstrass model, so later group-law formulas must be written in long Weierstrass coordinates instead. The result does not say that every chosen point on a smooth cubic is a flex. Rather, Weierstrass form is built by choosing a flex and placing it at $[0:1:0]$. This is the bridge from the projective geometry of Chapters 2 and 3 to the arithmetic model used in the addition formulas of Chapters 5 and 6. ## Changes Of Variables Preserving Weierstrass Shape A final coordinate question remains: when are two Weierstrass equations the same curve written in different coordinates? We want transformations that keep $O=[0:1:0]$ fixed and keep the equation in Weierstrass shape, because later formulas for addition depend on that shape. [definition: Weierstrass Change Of Variables] Let $k$ be a field. A Weierstrass change of variables is an invertible affine morphism \begin{align*} \varphi: \mathbb A^2_k \to \mathbb A^2_k \end{align*} defined by \begin{align*} \varphi(x',y')=(u^2x' + r,\, u^3y' + u^2sx' + t), \end{align*} where $u \in k^\times$ and $r,s,t \in k$. [/definition] Equivalently, it is the coordinate substitution \begin{align*} x = u^2x' + r \end{align*} and \begin{align*} y = u^3y' + u^2sx' + t. \end{align*} The same change extends projectively by fixing the line at infinity in the $Z$-coordinate. The projective extension is the morphism \begin{align*} \Phi: \mathbb P^2_k \to \mathbb P^2_k \end{align*} defined by \begin{align*} \Phi([X':Y':Z'])=[u^2X' + rZ' : u^3Y' + u^2sX' + tZ' : Z']. \end{align*} The powers of $u$ are chosen so that the terms $y^2$ and $x^3$ scale in the same way. The remaining question is whether all lower-degree terms still have the allowed long Weierstrass pattern after substitution, since otherwise this coordinate freedom would not be usable in the course's normal form. [quotetheorem:5627] [citeproof:5627] This theorem is computational rather than mysterious: it says that the allowed coordinate changes are exactly tailored to protect the weighted degrees of $x$ and $y$. The condition $u\ne 0$ is essential, because if $u=0$ then the displayed map collapses the affine plane to the single point $(r,t)$ and cannot represent the same curve in new coordinates. The special powers $u^2$ and $u^3$ are also essential: a general affine change such as mixing $y'$ into the new $x$-coordinate can create terms like $(y')^3$ or $(x')^2y'$, which are outside long Weierstrass form. Thus this is not the full group of projective coordinate changes of $\mathbb P^2_k$; it is the subgroup adapted to the chosen point $O$ and the weighted roles of $x$ and $y$. In characteristic not $2$ or $3$, these transformations also explain why a nonsingular long Weierstrass equation can often be converted to short form. [example: Removing Mixed Terms In Characteristic Not Two Or Three] Let $k$ have characteristic not $2$ or $3$, and start with the long Weierstrass equation \begin{align*} y^2+a_1xy+a_3y=x^3+a_2x^2+a_4x+a_6. \end{align*} Since $2$ is invertible in $k$, put \begin{align*} A=a_1x+a_3. \end{align*} Then the left-hand side is $y^2+Ay$. Substitute \begin{align*} y=y'-\frac{A}{2}=y'-\frac{1}{2}(a_1x+a_3). \end{align*} Expanding the square gives \begin{align*} \left(y'-\frac{A}{2}\right)^2=(y')^2-Ay'+\frac{A^2}{4}. \end{align*} The linear term gives \begin{align*} A\left(y'-\frac{A}{2}\right)=Ay'-\frac{A^2}{2}. \end{align*} Adding these two expressions, \begin{align*} y^2+Ay=(y')^2-Ay'+\frac{A^2}{4}+Ay'-\frac{A^2}{2}. \end{align*} The $y'$ terms cancel: \begin{align*} -Ay'+Ay'=0. \end{align*} The constant terms combine as \begin{align*} \frac{A^2}{4}-\frac{A^2}{2}=\frac{A^2}{4}-\frac{2A^2}{4}=-\frac{A^2}{4}. \end{align*} Therefore \begin{align*} y^2+a_1xy+a_3y=(y')^2-\frac{(a_1x+a_3)^2}{4}. \end{align*} Moving the square term to the right gives \begin{align*} (y')^2=x^3+a_2x^2+a_4x+a_6+\frac{(a_1x+a_3)^2}{4}. \end{align*} Now expand the added square: \begin{align*} (a_1x+a_3)^2=a_1^2x^2+2a_1a_3x+a_3^2. \end{align*} Dividing by $4$ gives \begin{align*} \frac{(a_1x+a_3)^2}{4}=\frac{a_1^2}{4}x^2+\frac{a_1a_3}{2}x+\frac{a_3^2}{4}. \end{align*} Thus the equation becomes \begin{align*} (y')^2=x^3+Bx^2+Cx+D, \end{align*} where \begin{align*} B=a_2+\frac{a_1^2}{4},\quad C=a_4+\frac{a_1a_3}{2},\quad D=a_6+\frac{a_3^2}{4}. \end{align*} Since $3$ is invertible in $k$, translate the $x$-coordinate by \begin{align*} x=x'-\frac{B}{3}. \end{align*} First, \begin{align*} \left(x'-\frac{B}{3}\right)^2=(x')^2-\frac{2B}{3}x'+\frac{B^2}{9}. \end{align*} Multiplying by $x'-B/3$ gives \begin{align*} \left(x'-\frac{B}{3}\right)^3=(x')^3-B(x')^2+\frac{B^2}{3}x'-\frac{B^3}{27}. \end{align*} Also, \begin{align*} B\left(x'-\frac{B}{3}\right)^2=B(x')^2-\frac{2B^2}{3}x'+\frac{B^3}{9}. \end{align*} The linear term becomes \begin{align*} C\left(x'-\frac{B}{3}\right)=Cx'-\frac{BC}{3}. \end{align*} Substituting these into $x^3+Bx^2+Cx+D$ gives \begin{align*} x^3+Bx^2+Cx+D=(x')^3-B(x')^2+\frac{B^2}{3}x'-\frac{B^3}{27}+B(x')^2-\frac{2B^2}{3}x'+\frac{B^3}{9}+Cx'-\frac{BC}{3}+D. \end{align*} The quadratic terms cancel: \begin{align*} -B(x')^2+B(x')^2=0. \end{align*} The coefficient of $x'$ is \begin{align*} \frac{B^2}{3}-\frac{2B^2}{3}+C=C-\frac{B^2}{3}. \end{align*} The constant term is \begin{align*} -\frac{B^3}{27}+\frac{B^3}{9}-\frac{BC}{3}+D=D+\frac{2B^3}{27}-\frac{BC}{3}. \end{align*} Hence \begin{align*} x^3+Bx^2+Cx+D=(x')^3+\left(C-\frac{B^2}{3}\right)x'+\left(D+\frac{2B^3}{27}-\frac{BC}{3}\right). \end{align*} Therefore the transformed equation has short Weierstrass form \begin{align*} (y')^2=(x')^3+ax'+b, \end{align*} with \begin{align*} a=C-\frac{B^2}{3},\quad b=D+\frac{2B^3}{27}-\frac{BC}{3}. \end{align*} Completing the square uses division by $2$ to remove the $xy$ and $y$ terms, while the translation by $B/3$ uses division by $3$ to remove the quadratic term. [/example] The point $O$ survives these transformations. In projective coordinates, the change has leading form $X=u^2X'+rZ'$, $Y=u^3Y'+u^2sX'+tZ'$, and $Z=Z'$, so $[0:1:0]$ maps to $[0:u^3:0]=[0:1:0]$. [remark: Why The Point O Is Built Into The Model] A short Weierstrass cubic is not only an affine equation with a projective closure. It is a projective cubic together with a distinguished flex $O$. This is why the next chapter can define addition by drawing a line through two points, taking the third intersection point, and then using the geometry centred at $O$ to turn that construction into a group operation. [/remark] With a distinguished point at infinity in place, the chord-and-tangent rule can be stated cleanly. The next chapter turns that geometric incidence rule into the actual addition law on a nonsingular Weierstrass cubic. # 5. Chords, Tangents, Identity, and Inverses The preceding chapters explained why a nonsingular projective cubic should meet every line in three points when intersections are counted with multiplicity. This chapter turns that incidence statement into an operation on the points of a Weierstrass cubic. The main question is how to convert the third intersection point of a line into an addition law with an identity and inverses. We work throughout with an elliptic curve in short Weierstrass form over a field $k$ of characteristic not equal to $2$ or $3$, \begin{align*} E: y^2=x^3+ax+b, \end{align*} with discriminant $-16(4a^3+27b^2) \ne 0$. Its projective closure is \begin{align*} Y^2Z=X^3+aXZ^2+bZ^3, \end{align*} and its unique point at infinity is denoted $O=[0:1:0]$. ## The Third Intersection Operation What should the line through two points of a cubic produce? Since a projective line meets a nonsingular cubic in three points counted with multiplicity, two chosen points determine a third point once tangencies and the point at infinity are interpreted correctly. [illustration:third-intersection-multiplicity] [definition: Third Intersection Operation] Let $E/k$ be a nonsingular projective plane cubic. The third intersection operation is the map \begin{align*} \ast : E(k)\times E(k)\to E(k) \end{align*} defined as follows. For $P,Q \in E(k)$, the point $P*Q$ is the third intersection point of $E$ with the line through $P$ and $Q$, counted with multiplicity. If $P=Q$, the line through $P$ and $Q$ means the tangent line to $E$ at $P$. [/definition] The third point is again $k$-rational: the line is defined over $k$, the substituted cubic has two known $k$-rational roots counted with multiplicity, and the remaining root is therefore fixed by the same coefficient arithmetic. The operation $*$ is not yet the elliptic curve addition law; it is the raw geometric operation supplied by Bezout's line-cubic count. To compute with it, we need an affine formula that recovers the third root of the line-substitution cubic from the two roots already known. [quotetheorem:5628] [citeproof:5628] This theorem turns geometry into arithmetic: the third point can be computed using only field operations when the relevant line has an affine equation $y=mx+c$. The non-vertical hypothesis is essential for this displayed formula. If $Q=-P$, the line through $P$ and $Q$ is vertical, so it has no finite slope $m$ and the missing third point is $O$ rather than an affine point whose coordinates are obtained by substituting into $y=mx+c$. The nonsingularity assumption is also part of the mechanism, not decorative. At a singular point there may be more than one tangent direction, or the tangent may meet the cubic with behaviour not governed by the smooth implicit derivative used above; for instance a nodal cubic has two distinct tangent directions at the node, so the tangent case would not define a single geometric instruction at that point. The characteristic restriction keeps the short Weierstrass model and the derivative formula in the form used here: in characteristic $2$, reflection across the $x$-axis is not a separate operation, and in characteristic $3$ the term $3x_1^2$ vanishes in the formal derivative. Those cases require different Weierstrass equations and different coordinate formulas. Thus the theorem is a coordinate formula for smooth short Weierstrass cubics in characteristic not equal to $2$ or $3$, not a universal formula for every cubic in every characteristic. [example: Third Point On A Secant] Work over $K=\mathbb Q(\sqrt 2)$. The point $P=(-1,2)$ lies on $E$ because \begin{align*} 2^2=4=(-1)^3-2(-1)+3. \end{align*} The point $Q=(1,\sqrt 2)$ lies on $E(K)$ because \begin{align*} (\sqrt 2)^2=2=1^3-2\cdot 1+3. \end{align*} Since \begin{align*} x(Q)-x(P)=1-(-1)=2\ne 0, \end{align*} the secant is not vertical, and its slope is \begin{align*} m=\frac{\sqrt 2-2}{1-(-1)}=\frac{\sqrt 2-2}{2}. \end{align*} By the preceding chord-and-tangent third-point formula, if $P*Q=(x_3,y_3)$, then \begin{align*} x_3=m^2-x(P)-x(Q). \end{align*} Substituting $x(P)=-1$, $x(Q)=1$, and $m=(\sqrt 2-2)/2$ gives \begin{align*} x_3=\left(\frac{\sqrt 2-2}{2}\right)^2-(-1)-1. \end{align*} The last two terms cancel: \begin{align*} -(-1)-1=1-1=0. \end{align*} Thus \begin{align*} x_3=\left(\frac{\sqrt 2-2}{2}\right)^2. \end{align*} Expanding the square, \begin{align*} x_3=\frac{(\sqrt 2-2)^2}{4}. \end{align*} Using $(u-v)^2=u^2-2uv+v^2$ with $u=\sqrt 2$ and $v=2$, \begin{align*} (\sqrt 2-2)^2=(\sqrt 2)^2-4\sqrt 2+4. \end{align*} Since $(\sqrt 2)^2=2$, \begin{align*} (\sqrt 2-2)^2=2-4\sqrt 2+4=6-4\sqrt 2. \end{align*} Therefore \begin{align*} x_3=\frac{6-4\sqrt 2}{4}=\frac{3-2\sqrt 2}{2}. \end{align*} The secant line through $P$ is \begin{align*} y-2=\frac{\sqrt 2-2}{2}(x+1). \end{align*} Putting $x=x_3=(3-2\sqrt 2)/2$ into this line gives \begin{align*} y_3=2+\frac{\sqrt 2-2}{2}\left(\frac{3-2\sqrt 2}{2}+1\right). \end{align*} Inside the parentheses, \begin{align*} \frac{3-2\sqrt 2}{2}+1=\frac{3-2\sqrt 2+2}{2}=\frac{5-2\sqrt 2}{2}. \end{align*} Hence \begin{align*} y_3=2+\frac{(\sqrt 2-2)(5-2\sqrt 2)}{4}. \end{align*} Expanding the numerator, \begin{align*} (\sqrt 2-2)(5-2\sqrt 2)=5\sqrt 2-2(\sqrt 2)^2-10+4\sqrt 2. \end{align*} Since $(\sqrt 2)^2=2$, \begin{align*} 5\sqrt 2-2(\sqrt 2)^2-10+4\sqrt 2=5\sqrt 2-4-10+4\sqrt 2. \end{align*} Combining like terms, \begin{align*} 5\sqrt 2-4-10+4\sqrt 2=9\sqrt 2-14. \end{align*} Therefore \begin{align*} y_3=2+\frac{9\sqrt 2-14}{4}. \end{align*} Writing $2$ with denominator $4$, \begin{align*} y_3=\frac{8}{4}+\frac{9\sqrt 2-14}{4}=\frac{9\sqrt 2-6}{4}. \end{align*} Thus \begin{align*} P*Q=\left(\frac{3-2\sqrt 2}{2},\frac{9\sqrt 2-6}{4}\right). \end{align*} Both coordinates lie in $\mathbb Q(\sqrt 2)$, so the chord construction is algebraic over the field generated by the coordinates of the input points. [/example] For rational arithmetic on the same curve, it is useful to create a second rational point by doubling a known one. That computation appears below after the addition formula, where the reflected third intersection is the actual sum. ## Reflection And Addition The third point operation has the wrong identity behaviour: a line through $P$ and the point at infinity meets the cubic again at the reflection of $P$, not at $P$ itself. The repair is to reflect the third intersection point across the $x$-axis. [definition: Weierstrass Negation Map] Let $E: y^2=x^3+ax+b$ be a nonsingular Weierstrass cubic over a field $k$ with $\operatorname{char}(k) \ne 2,3$, and let $O$ be its point at infinity. The Weierstrass negation map is the function \begin{align*} \nu:E(k)\to E(k) \end{align*} defined by \begin{align*} \nu(x,y)=(x,-y) \end{align*} for affine points $(x,y)\in E(k)$, and \begin{align*} \nu(O)=O. \end{align*} [/definition] This map preserves $E(k)$ because replacing $y$ by $-y$ leaves the equation $y^2=x^3+ax+b$ unchanged. With negation now fixed as a genuine map on the set of $k$-points, the addition law can be stated without relying on an undeclared minus sign. [definition: Elliptic Curve Sum] Let $E: y^2=x^3+ax+b$ be a nonsingular Weierstrass cubic over a field $k$ with $\operatorname{char}(k) \ne 2,3$, and let $O$ be its point at infinity. For $P,Q \in E(k)$, define \begin{align*} {+} : E(k)\times E(k)\to E(k) \end{align*} by \begin{align*} P+Q=\nu(P*Q), \end{align*} where $\nu:E(k)\to E(k)$ is the Weierstrass negation map. [/definition] The definition packages the chord-and-tangent construction into the operation that will become the group law. The next task is to replace the geometric sentence "reflect the third intersection" by coordinate formulas, since those formulas are what make elliptic curve arithmetic possible over $\mathbb Q$ and over finite fields. [quotetheorem:5629] [citeproof:5629] This formula is the computational form of the group operation, but its cases must be read with their hypotheses. The condition $Q\ne -P$ excludes the vertical secant: if $P=(x,y)$ and $Q=(x,-y)$, then \begin{align*} \frac{y_2-y_1}{x_2-x_1} \end{align*} has denominator $0$, and the correct sum is $O$ rather than an affine point. In the doubling line, the condition $y_1\ne 0$ excludes the vertical tangent case. If $P=(x_1,0)$, then $P=-P$, so $2P=O$; the displayed tangent slope would divide by $2y_1=0$ and is not the right formula to use. The characteristic assumptions are the same limitations as in the third-point theorem. They allow the short Weierstrass equation, the reflection $(x,y)\mapsto (x,-y)$, and the tangent slope $(3x_1^2+a)/(2y_1)$ to be used without modification. In characteristic $2$, negation is not represented by changing the sign of $y$ in this model, and in characteristic $3$ the derivative term changes shape. All later arithmetic with elliptic curves depends on these rational expressions preserving the ground field whenever the selected case is defined over that field. [example: Doubling A Rational Point] On $E:y^2=x^3-2x+3$, the point $P=(-1,2)$ lies on $E$ because \begin{align*} 2^2=4 \end{align*} and \begin{align*} (-1)^3-2(-1)+3=-1+2+3=4. \end{align*} We compute $2P=P+P$. Since $y(P)=2\ne 0$, the doubling case of the *[Chord And Tangent Addition Formula](/theorems/5629)* applies. Here $a=-2$, so the tangent slope is \begin{align*} m=\frac{3x(P)^2+a}{2y(P)}=\frac{3(-1)^2-2}{2\cdot 2}. \end{align*} Because $(-1)^2=1$, this becomes \begin{align*} m=\frac{3\cdot 1-2}{4}=\frac{1}{4}. \end{align*} The addition formula gives \begin{align*} x(2P)=m^2-x(P)-x(P). \end{align*} Substituting $m=1/4$ and $x(P)=-1$ gives \begin{align*} x(2P)=\left(\frac{1}{4}\right)^2-(-1)-(-1). \end{align*} Now \begin{align*} \left(\frac{1}{4}\right)^2=\frac{1}{16} \end{align*} and \begin{align*} -(-1)-(-1)=1+1=2, \end{align*} so \begin{align*} x(2P)=\frac{1}{16}+2=\frac{1}{16}+\frac{32}{16}=\frac{33}{16}. \end{align*} For the $y$-coordinate, the addition formula gives \begin{align*} y(2P)=m\bigl(x(P)-x(2P)\bigr)-y(P). \end{align*} Substituting the known values gives \begin{align*} y(2P)=\frac{1}{4}\left(-1-\frac{33}{16}\right)-2. \end{align*} Inside the parentheses, \begin{align*} -1-\frac{33}{16}=-\frac{16}{16}-\frac{33}{16}=-\frac{49}{16}. \end{align*} Therefore \begin{align*} y(2P)=\frac{1}{4}\left(-\frac{49}{16}\right)-2=-\frac{49}{64}-2. \end{align*} Writing $2$ with denominator $64$, \begin{align*} y(2P)=-\frac{49}{64}-\frac{128}{64}=-\frac{177}{64}. \end{align*} Thus \begin{align*} 2(-1,2)=\left(\frac{33}{16},-\frac{177}{64}\right). \end{align*} Before reflection, the tangent line meets the curve with multiplicity $2$ at $P$ and has third intersection \begin{align*} P*P=\left(\frac{33}{16},\frac{177}{64}\right), \end{align*} so the addition law reflects that third point across the $x$-axis to produce the displayed double. [/example] The doubled point now gives a second rational point on the original curve, so the requested chord computation can be done entirely over $\mathbb Q$. This is the basic pattern in explicit elliptic curve arithmetic: known rational points generate further rational points. [example: Adding Two Rational Points] On $E: y^2=x^3-2x+3$, let \begin{align*} P=(-1,2), \qquad Q=\left(\frac{33}{16},-\frac{177}{64}\right). \end{align*} Since \begin{align*} x(Q)-x(P)=\frac{33}{16}-(-1)=\frac{33}{16}+\frac{16}{16}=\frac{49}{16}\ne 0, \end{align*} the line through $P$ and $Q$ is not vertical, so the secant case of the *Chord And Tangent Addition Formula* applies. Its slope is \begin{align*} m=\frac{y(Q)-y(P)}{x(Q)-x(P)} =\frac{-177/64-2}{33/16-(-1)}. \end{align*} The numerator is \begin{align*} -\frac{177}{64}-2=-\frac{177}{64}-\frac{128}{64}=-\frac{305}{64}, \end{align*} and the denominator is \begin{align*} \frac{33}{16}-(-1)=\frac{49}{16}. \end{align*} Therefore \begin{align*} m=\frac{-305/64}{49/16} =-\frac{305}{64}\cdot\frac{16}{49} =-\frac{305}{4\cdot 49} =-\frac{305}{196}. \end{align*} The addition formula gives \begin{align*} x(P+Q)=m^2-x(P)-x(Q). \end{align*} Substituting $m=-305/196$, $x(P)=-1$, and $x(Q)=33/16$ gives \begin{align*} x(P+Q)=\left(-\frac{305}{196}\right)^2-(-1)-\frac{33}{16}. \end{align*} Now \begin{align*} \left(-\frac{305}{196}\right)^2=\frac{305^2}{196^2}=\frac{93025}{38416}, \end{align*} because $305^2=93025$ and $196^2=38416$. Also, \begin{align*} -(-1)-\frac{33}{16}=1-\frac{33}{16}=\frac{16}{16}-\frac{33}{16}=-\frac{17}{16}. \end{align*} Since $38416=16\cdot 2401$, we have \begin{align*} -\frac{17}{16}=-\frac{17\cdot 2401}{16\cdot 2401}=-\frac{40817}{38416}. \end{align*} Thus \begin{align*} x(P+Q)=\frac{93025}{38416}-\frac{40817}{38416} =\frac{52208}{38416}. \end{align*} Dividing numerator and denominator by $16$ gives \begin{align*} x(P+Q)=\frac{3263}{2401}. \end{align*} For the $y$-coordinate, the addition formula gives \begin{align*} y(P+Q)=m\bigl(x(P)-x(P+Q)\bigr)-y(P). \end{align*} Substituting the known values gives \begin{align*} y(P+Q)=-\frac{305}{196}\left(-1-\frac{3263}{2401}\right)-2. \end{align*} Inside the parentheses, \begin{align*} -1-\frac{3263}{2401} =-\frac{2401}{2401}-\frac{3263}{2401} =-\frac{5664}{2401}. \end{align*} Therefore \begin{align*} -\frac{305}{196}\left(-\frac{5664}{2401}\right) =\frac{305\cdot 5664}{196\cdot 2401}. \end{align*} Since $305\cdot 5664=1727520$ and $196\cdot 2401=470596$, this is \begin{align*} \frac{1727520}{470596}. \end{align*} Dividing numerator and denominator by $4$ gives \begin{align*} \frac{1727520}{470596}=\frac{431880}{117649}. \end{align*} Hence \begin{align*} y(P+Q)=\frac{431880}{117649}-2. \end{align*} Writing $2$ with denominator $117649$, \begin{align*} 2=\frac{235298}{117649}, \end{align*} so \begin{align*} y(P+Q)=\frac{431880}{117649}-\frac{235298}{117649} =\frac{196582}{117649}. \end{align*} Thus \begin{align*} P+Q=\left(\frac{3263}{2401},\frac{196582}{117649}\right). \end{align*} The output coordinates are rational numbers, so adding these two rational points on $E$ produces another rational point on the same curve. [/example] ## The Identity And Inverses Which point should act like zero? Projective closure supplies a single point at infinity $O$, and the geometry of lines through $O$ forces it to be the identity once addition is defined by reflection. [illustration:vertical-line-inverses] [definition: Point At Infinity Identity] For a nonsingular Weierstrass cubic $E$, the point $O=[0:1:0]$ is called the identity point of the chord-and-tangent addition law. [/definition] The definition names the candidate zero, but a named point is not automatically an identity element. The possible failure is visible in the construction: joining a finite point to $O$ gives a vertical line, and before the final reflection that line naturally finds the inverse point. This leaves a genuine algebraic question about the operation just defined: does the reflection step convert the vertical-line intersection back into the original point when one input is $O$? The following theorem is needed to turn the chosen point at infinity from notation into the actual neutral element of the chord-and-tangent law. [quotetheorem:5630] [citeproof:5630] The identity law explains the earlier reflection convention: without reflecting the third intersection, the vertical line through $P$ and $O$ would return $-P$ rather than $P$. Its hypotheses still matter. The statement uses the projective closure of a nonsingular Weierstrass cubic, because the point $O$ is an actual point of the curve and vertical affine lines meet the curve there; if one worked only with the affine equation, there would be no point at infinity to serve as the third intersection of a vertical line. The nonsingularity condition rules out concrete failures such as the nodal cubic $y^2=x^3+x^2$, whose point $(0,0)$ has two tangent directions; at that point the phrase "the tangent line" does not specify a single line for doubling. The short Weierstrass and characteristic assumptions also carry real content. In characteristic $2$, the transformation $(x,y)\mapsto (x,-y)$ is the identity on affine coordinates, so it cannot serve as the reflection used in the addition law; in characteristic $3$, the formal derivative of $x^3+ax+b$ loses the $3x^2$ term, so the displayed tangent formula no longer describes the same model without modification. This result is only the identity axiom. It does not prove associativity, and it does not say that every point has an inverse; those are separate structural properties. The identity point is also the bridge to later arithmetic: over $\mathbb Q$ it gives a distinguished zero for rational points, while over finite fields it gives the neutral element used in repeated addition algorithms. Once a zero has been identified, the next group-theoretic question is which point cancels a given point under addition. [definition: Inverse Point] Let $E: y^2=x^3+ax+b$ be a nonsingular Weierstrass cubic over a field $k$ with $\operatorname{char}(k) \ne 2,3$. The inverse point operation is the map \begin{align*} {-}:E(k)\to E(k) \end{align*} defined by $P\mapsto -P$. For an affine point $P=(x,y) \in E(k)$, \begin{align*} -P=(x,-y), \end{align*} and define $-O=O$. [/definition] This inverse operation is visible in the equation: replacing $y$ by $-y$ preserves $y^2=x^3+ax+b$. The following criterion checks that this geometric reflection is also the algebraic inverse for the addition law. [quotetheorem:5631] [citeproof:5631] The criterion is the first place where the additive notation behaves like ordinary group notation. It says that the geometric negative is exactly the group inverse, and it also records the boundary case where the usual slope formula stops: if $P=(x,0)$, then $P=-P$, the tangent is vertical, and $P+P=O$. The point at infinity is consistent with the same rule because $-O=O$, so $O+O=O$. The converse uses the special form of a vertical line on a short Weierstrass cubic. For an affine point with $y\ne 0$, the vertical line $X=xZ$ meets the curve at $(x,y)$, $(x,-y)$, and $O$; hence no point other than the reflected one can add with $P$ to give $O$. In a singular cubic this uniqueness can fail as a group-law statement on all points, since the chord-and-tangent construction is not defined smoothly at the singularity. The theorem is therefore a criterion inside the nonsingular elliptic curve setting, not a general statement about arbitrary plane cubics. [example: A Point Of Order Two] On $E':y^2=x^3-2x+1$, first verify that $T=(1,0)$ lies on the curve: \begin{align*} 0^2=0 \end{align*} and \begin{align*} 1^3-2\cdot 1+1=1-2+1=0. \end{align*} The inverse of an affine point $(x,y)$ is $(x,-y)$, so \begin{align*} -T=(1,-0)=(1,0)=T. \end{align*} Thus $T+T=O$ by the *Vertical Line Inverse Criterion*. The same conclusion is visible from the tangent calculation. For $E':y^2=x^3-2x+1$, the doubling slope formula would have denominator \begin{align*} 2y(T)=2\cdot 0=0, \end{align*} so the affine tangent is vertical rather than a line of the form $y=mx+c$. The vertical line through $T$ is $x=1$, and substituting $x=1$ into the curve gives \begin{align*} y^2=1^3-2\cdot 1+1=0. \end{align*} Hence $y=0$ is the only affine intersection, counted with multiplicity $2$, and the remaining projective intersection is the point at infinity $O$. Therefore $T$ is a point of order two: it is nonzero and satisfies $2T=O$. [/example] ## Commutativity From Symmetric Lines The operation has been defined using ordered notation $P+Q$, but the geometric construction only uses the line determined by the unordered pair of points. This gives the first group axiom without any algebraic elimination. [explanation: Commutativity Of The Chord-And-Tangent Addition] For points $P,Q \in E(k)$ on a nonsingular short Weierstrass cubic with identity $O$, the chord-and-tangent construction satisfies \begin{align*} P+Q=Q+P. \end{align*} [/explanation] Commutativity is much easier than associativity because it uses only the symmetry of the line through two points. The nonsingularity and Weierstrass hypotheses ensure that the third intersection operation and reflection are well-defined in every case, including tangents and vertical lines. For example, when $Q=-P$, both $P+Q$ and $Q+P$ are $O$ because the same vertical line is used in either order; when $P=Q$, both orders mean the same tangent line at $P$. The result has a narrow scope. It does not use the explicit formulas except as a way to compute the same geometric construction, and it does not address associativity. If the cubic were singular, the phrase "the tangent line at $P$" could be ambiguous at a singular point: on $y^2=x^3+x^2$, the node $(0,0)$ has two tangent directions, so doubling that point would depend on which branch is chosen. Associativity will require a separate geometric argument using cubics through prescribed points, while this chapter only needs the uniqueness of the line through two projective points. [remark: What Has Not Yet Been Proved] The formulas above define a commutative operation with identity $O$ and inverse $-(x,y)=(x,-y)$. They do not by themselves prove associativity. Chapter 7 proves that $(P+Q)+R=P+(Q+R)$ using the nine-point cubic argument, completing the group law. [/remark] The geometric construction explains what addition should mean, but to use it effectively we need formulas. The next chapter gathers the coordinate expressions for sums, doubles, and inverses so they can be applied directly from the equation of the curve. # 6. Explicit Addition Formulas The geometric group law from the preceding chapters says how to add points by drawing a secant or tangent, taking the third intersection with the cubic, and reflecting in the $x$-axis. This chapter turns that construction into formulas. The aim is practical: given coordinates of points on a short Weierstrass curve, compute the coordinates of their sum without drawing the line each time. Throughout this chapter let $k$ be a field and let \begin{align*} E: y^2=x^3+ax+b \end{align*} be a nonsingular short Weierstrass curve over $k$, with point at infinity $O$. For the short Weierstrass equation we assume the usual characteristic restrictions: unless stated otherwise, $\operatorname{char}(k)\neq 2,3$. The affine points are pairs $(x,y)\in k^2$ satisfying the equation, and the inverse of $(x,y)$ is $(x,-y)$. ## Secants Through Distinct Points The first computational question is how to replace the geometric instruction “draw the line through $P$ and $Q$” by an algebraic expression. If $P$ and $Q$ are distinct affine points with different $x$-coordinates, the secant has a finite slope, and substituting that line into the cubic produces a cubic polynomial whose three roots are the three intersection $x$-coordinates. [definition: Secant Slope] Let $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ be affine points on $E$ with $P\neq Q$ and $x_1\neq x_2$. The secant slope from $P$ to $Q$ is \begin{align*} \lambda=\frac{y_2-y_1}{x_2-x_1}. \end{align*} [/definition] This number is the slope of the unique affine line through $P$ and $Q$. To compute the sum, we still need to convert the third intersection point into coordinates and then account for the reflection in the definition of the group law. [quotetheorem:5632] [citeproof:5632] The formula is symmetric in $P$ and $Q$, even though the final expression for $y_3$ uses $P$. Interchanging the two points gives the same line, so it gives the same third intersection and the same reflected point. The hypotheses also mark exactly what this formula does not cover: if $P=Q$, the quotient defining $\lambda$ has denominator zero and the tangent formula must be used instead; if $x_1=x_2$ and $P\neq Q$, then on a short Weierstrass curve the points are inverse pairs and the joining line is vertical. For example, on $E:y^2=x^3-x+1$, the points $(0,1)$ and $(0,-1)$ have the same $x$-coordinate, so the secant slope is undefined and their sum is $O$, not an affine point obtained from the displayed formula. The following computation shows the entire non-exceptional procedure on a curve where the numbers stay small. [illustration:secant-addition-weierstrass] [example: Adding Two Distinct Affine Points] On \begin{align*} E:y^2=x^3-x+1, \end{align*} the point $P=(0,1)$ lies on $E$ because \begin{align*} 1^2=1 \end{align*} and \begin{align*} 0^3-0+1=1. \end{align*} The point $Q=(1,1)$ also lies on $E$ because \begin{align*} 1^2=1 \end{align*} and \begin{align*} 1^3-1+1=1. \end{align*} Since $P\neq Q$ and $0\neq 1$, the secant slope is defined: \begin{align*} \lambda=\frac{y_Q-y_P}{x_Q-x_P} =\frac{1-1}{1-0} =\frac{0}{1} =0. \end{align*} Using the affine addition formula for distinct points, \begin{align*} x_3=\lambda^2-x_P-x_Q =0^2-0-1 =0-0-1 =-1 \end{align*} and \begin{align*} y_3=\lambda(x_P-x_3)-y_P =0(0-(-1))-1 =0(1)-1 =0-1 =-1. \end{align*} Therefore \begin{align*} P+Q=(-1,-1). \end{align*} The line through $P$ and $Q$ is horizontal: since $\lambda=0$ and it passes through $(0,1)$, its equation is $y=1$. Substituting $y=1$ into the curve gives \begin{align*} 1^2=x^3-x+1, \end{align*} so \begin{align*} 1=x^3-x+1. \end{align*} Subtracting $1$ from both sides gives \begin{align*} 0=x^3-x. \end{align*} Factoring, \begin{align*} x^3-x=x(x^2-1)=x(x-1)(x+1), \end{align*} so the three intersection $x$-coordinates are $0$, $1$, and $-1$. Thus the secant meets $E$ at $(0,1)$, $(1,1)$, and $(-1,1)$; reflecting the third point across the $x$-axis gives $(-1,-1)$, matching the computed sum. [/example] A useful check on any addition calculation is to verify the unreflected third point by substitution into the secant line. This protects against sign errors in the final reflection step. [example: Verifying The Third Intersection] For $E:y^2=x^3-x+1$ and $P=(0,1)$, $Q=(1,1)$, both points have $y$-coordinate $1$, so the line through them is horizontal: \begin{align*} y=1. \end{align*} To find all intersections of this line with $E$, substitute $y=1$ into the curve equation: \begin{align*} 1^2=x^3-x+1. \end{align*} Since $1^2=1$, this becomes \begin{align*} 1=x^3-x+1. \end{align*} Subtracting $1$ from both sides gives \begin{align*} 1-1=x^3-x+1-1. \end{align*} Thus \begin{align*} 0=x^3-x. \end{align*} Now factor the right-hand side: \begin{align*} x^3-x=x(x^2-1). \end{align*} Using $x^2-1=(x-1)(x+1)$, we get \begin{align*} x^3-x=x(x-1)(x+1). \end{align*} Therefore the intersection $x$-coordinates satisfy \begin{align*} x(x-1)(x+1)=0. \end{align*} Hence \begin{align*} x=0,\quad x=1,\quad \text{or}\quad x=-1. \end{align*} The first two values give the original points $(0,1)$ and $(1,1)$ on the line $y=1$, and the remaining value gives the third intersection point \begin{align*} R=(-1,1). \end{align*} Reflecting across the $x$-axis changes $(x,y)$ to $(x,-y)$, so \begin{align*} -R=(-1,-1). \end{align*} Therefore the geometric secant construction gives $P+Q=(-1,-1)$, matching the coordinate addition computation. [/example] ## Tangents And Doubling The next problem is what to do when the two input points coincide. The secant line has to be replaced by the tangent line, and the repeated intersection at $P$ must be counted twice. Algebraically, this changes the slope from a difference quotient to the derivative of the implicit curve at $P$. [definition: Tangent Slope On A Short Weierstrass Curve] Let $P=(x_1,y_1)$ be an affine point on $E:y^2=x^3+ax+b$ with $y_1\neq 0$. The tangent slope at $P$ is \begin{align*} \lambda=\frac{3x_1^2+a}{2y_1}. \end{align*} [/definition] The denominator records the vertical derivative of the equation $F(x,y)=y^2-x^3-ax-b$. The secant formula has a genuine obstruction when $P=Q$: its slope becomes $0/0$, so there is no line determined by two distinct points. The tangent line replaces the missing secant, and the intersection at $P$ must be counted with multiplicity two before reflecting the third intersection. [explanation: Affine Doubling Formula For A Short Weierstrass Curve] Let $P=(x_1,y_1)$ be an affine point on $E:y^2=x^3+ax+b$ with $y_1\neq 0$ over a field of characteristic not equal to $2$ or $3$. With \begin{align*} \lambda=\frac{3x_1^2+a}{2y_1}, \end{align*} the double $2P=(x_3,y_3)$ is given by \begin{align*} x_3=\lambda^2-2x_1,\qquad y_3=\lambda(x_1-x_3)-y_1. \end{align*} [/explanation] The doubling formula is the main computational tool for repeated addition, but its hypotheses are not decorative. The condition $y_1\neq 0$ is exactly the condition that $2y_1$ is invertible, so points with $y_1=0$ are excluded because their tangent is vertical rather than a finite-slope line. The assumption $\operatorname{char}(k)\neq 2,3$ keeps the short Weierstrass model and the derivative expression $3x_1^2+a$ in the expected form; in small characteristics the same geometric idea requires different coordinate formulas. The excluded vertical tangent case is handled separately below, after the ordinary doubling computation. [illustration:tangent-doubling-weierstrass] The next example applies the formula over $\mathbb Q$, where fractions appear even when the original point has integral coordinates. [example: Doubling A Point] On \begin{align*} E:y^2=x^3-x+1, \end{align*} we have $a=-1$ and $P=(0,1)$. The point lies on $E$ because its left-hand side is \begin{align*} 1^2=1 \end{align*} and its right-hand side is \begin{align*} 0^3-0+1=0-0+1=1. \end{align*} Since $y_P=1\neq 0$, the ordinary doubling formula applies. The tangent slope at $P$ is \begin{align*} \lambda=\frac{3x_P^2+a}{2y_P}. \end{align*} Substituting $x_P=0$, $y_P=1$, and $a=-1$ gives \begin{align*} \lambda=\frac{3\cdot 0^2+(-1)}{2\cdot 1}. \end{align*} Since $0^2=0$, this becomes \begin{align*} \lambda=\frac{3\cdot 0-1}{2}. \end{align*} Thus \begin{align*} \lambda=\frac{-1}{2}=-\frac{1}{2}. \end{align*} Now compute the $x$-coordinate of $2P$: \begin{align*} x_3=\lambda^2-2x_P. \end{align*} Substituting the values gives \begin{align*} x_3=\left(-\frac{1}{2}\right)^2-2\cdot 0. \end{align*} Since $\left(-\frac{1}{2}\right)^2=\frac{1}{4}$ and $2\cdot 0=0$, \begin{align*} x_3=\frac{1}{4}-0=\frac{1}{4}. \end{align*} For the $y$-coordinate, the doubling formula gives \begin{align*} y_3=\lambda(x_P-x_3)-y_P. \end{align*} Substituting $\lambda=-\frac{1}{2}$, $x_P=0$, $x_3=\frac{1}{4}$, and $y_P=1$ gives \begin{align*} y_3=-\frac{1}{2}\left(0-\frac{1}{4}\right)-1. \end{align*} The expression in parentheses is \begin{align*} 0-\frac{1}{4}=-\frac{1}{4}. \end{align*} Therefore \begin{align*} y_3=-\frac{1}{2}\left(-\frac{1}{4}\right)-1. \end{align*} Multiplying the two negative fractions gives \begin{align*} -\frac{1}{2}\left(-\frac{1}{4}\right)=\frac{1}{8}. \end{align*} Hence \begin{align*} y_3=\frac{1}{8}-1=\frac{1}{8}-\frac{8}{8}=-\frac{7}{8}. \end{align*} Thus \begin{align*} 2(0,1)=\left(\frac{1}{4},-\frac{7}{8}\right). \end{align*} The doubled point has rational coordinates, even though the tangent computation introduces fractions. [/example] The tangent formula required $y_1\neq 0$, so it leaves out the points where the tangent line is vertical. At such a point the algebraic obstruction is division by $2y_1=0$, and the geometric obstruction is that a vertical tangent has no finite affine slope. Doubling must therefore be handled by the projective intersection with the vertical line, which sends the point directly to the identity. [quotetheorem:5633] [citeproof:5633] This is the first visible source of torsion in the group law. A point with $y=0$ is its own inverse, so doubling it reaches the identity in one step. The hypothesis that the point is affine matters because the identity $O$ is already handled by the identity law, not by a tangent-slope computation. The short Weierstrass and characteristic assumptions are also part of the statement: in this model, $-(x,y)=(x,-y)$, so $y=0$ exactly means $P=-P$; in characteristic $2$, the inverse formula and the Weierstrass equation have a different shape. Thus the theorem is a rule for the vertical affine tangents in this coordinate system, not a replacement for the full addition law. [example: A Vertical Tangent] On $E:y^2=x^3-x$, take $P=(0,0)$. Substituting $x=0$ and $y=0$ into the equation gives \begin{align*} 0^2=0 \end{align*} and \begin{align*} 0^3-0=0-0=0, \end{align*} so $P$ lies on $E$. On a short Weierstrass curve the inverse of $(x,y)$ is $(x,-y)$, hence \begin{align*} -P=(0,-0)=(0,0)=P. \end{align*} Therefore \begin{align*} 2P=P+P=P+(-P)=O. \end{align*} The tangent is vertical for the same reason. Implicitly differentiating \begin{align*} y^2=x^3-x \end{align*} gives \begin{align*} 2y\frac{dy}{dx}=3x^2-1. \end{align*} At $P=(0,0)$ this becomes \begin{align*} 2\cdot 0\cdot \frac{dy}{dx}=3\cdot 0^2-1, \end{align*} so \begin{align*} 0=-1, \end{align*} which cannot hold for any finite slope. Thus the tangent line is vertical, and the doubling output is the identity point $O$. [/example] ## Exceptional Cases And Field Of Definition The formulas above cover the generic affine computations, but an addition law must also handle the identity, inverse pairs, and fields where denominators may vanish. The guiding principle is that the geometric group law already knows the answer in these cases; the formulas are used only when their divisions make sense. [definition: Affine Addition Cases] Let $E:y^2=x^3+ax+b$ be a nonsingular short Weierstrass curve over a field $k$ with $\operatorname{char}(k)\neq 2,3$, and let $O$ be its point at infinity. The addition map \begin{align*} +:E(k)\times E(k)\to E(k) \end{align*} is computed as follows for affine points $P=(x_1,y_1)$ and $Q=(x_2,y_2)$: 1. $P+O=O+P=P$. 2. If $x_1=x_2$ and $y_1=-y_2$, then $P+Q=O$. 3. If $P\neq Q$ and $x_1\neq x_2$, use the secant slope formula. 4. If $P=Q$ and $y_1\neq 0$, use the tangent slope formula. 5. If $P=Q$ and $y_1=0$, then $2P=O$. [/definition] These cases should be read as an algorithm, not as separate laws. They partition the possible inputs when the curve is in short Weierstrass form over a field where the displayed divisions are valid. [remark: Characteristic Restrictions] The short Weierstrass equation $y^2=x^3+ax+b$ is best suited to fields of characteristic not equal to $2$ or $3$. In characteristic $2$ or $3$, nonsingular elliptic curves require modified Weierstrass equations, and the formulas in this chapter must be replaced by the corresponding formulas for those models. The geometric principle of secants, tangents, and reflection survives, but the algebraic expressions change. [/remark] The addition cases are also important arithmetically: they use only the field operations in $k$ whenever the input coordinates lie in $k$. Closure is not automatic from the geometry over an algebraic closure, because a line through two $k$-rational points could a priori have its third intersection described using coordinates outside $k$. The next structural point is therefore closure over the field of definition. Once the formulas are known to produce coordinates in the same field, the set $E(k)$ can be studied as an arithmetic set equipped with addition, rather than as isolated points on a curve. [quotetheorem:5634] [citeproof:5634] Closure under addition is what lets us study $E(k)$ as an arithmetic object rather than only a geometric curve. The theorem depends on the curve and the input points being defined over the same field: for example, if a curve is defined over $\mathbb Q$ but one tries to add a point whose coordinates lie only in a quadratic extension, the coordinate formulas need not produce a rational point. The statement also says only that $E(k)$ is closed under the addition law; associativity, commutativity, and the full group structure come from the geometric group law developed earlier, not from this closure argument alone. This closure is the algebraic reason the same formulas underlie computations of multiples, torsion points, and finite-field arithmetic in elliptic-curve applications. The example already computed in the tangent section shows the mechanism in the rational case. [example: Rational Points Stay Rational] On $E:y^2=x^3-x+1$ over $\mathbb Q$, the point $P=(0,1)$ has rational coordinates and lies on $E$ because \begin{align*} 1^2=1 \end{align*} and \begin{align*} 0^3-0+1=0-0+1=1. \end{align*} Here $a=-1$ and $y_P=1\neq 0$, so the doubling formula uses \begin{align*} \lambda=\frac{3x_P^2+a}{2y_P} =\frac{3\cdot 0^2+(-1)}{2\cdot 1} =\frac{0-1}{2} =-\frac{1}{2}. \end{align*} The $x$-coordinate of $2P$ is \begin{align*} x(2P)=\lambda^2-2x_P =\left(-\frac{1}{2}\right)^2-2\cdot 0 =\frac{1}{4}-0 =\frac{1}{4}. \end{align*} For the $y$-coordinate, substitute $\lambda=-\frac{1}{2}$, $x_P=0$, $x(2P)=\frac{1}{4}$, and $y_P=1$: \begin{align*} y(2P)=\lambda(x_P-x(2P))-y_P. \end{align*} Thus \begin{align*} y(2P)=-\frac{1}{2}\left(0-\frac{1}{4}\right)-1. \end{align*} Since \begin{align*} 0-\frac{1}{4}=-\frac{1}{4}, \end{align*} we get \begin{align*} y(2P)=-\frac{1}{2}\left(-\frac{1}{4}\right)-1. \end{align*} Multiplying the fractions gives \begin{align*} -\frac{1}{2}\left(-\frac{1}{4}\right)=\frac{1}{8}, \end{align*} so \begin{align*} y(2P)=\frac{1}{8}-1=\frac{1}{8}-\frac{8}{8}=-\frac{7}{8}. \end{align*} Therefore \begin{align*} 2P=\left(\frac{1}{4},-\frac{7}{8}\right). \end{align*} Both $\frac{1}{4}$ and $-\frac{7}{8}$ lie in $\mathbb Q$, so this concrete doubling computation shows the closure mechanism behind studying $E(\mathbb Q)$ as a group of rational points. [/example] The chapter has converted the geometric construction into a reliable coordinate algorithm. Chapters 8 through 10 use these formulas repeatedly: first to interpret the real group geometrically, then to compute rational points exactly, and finally to investigate the finite groups $E(\mathbb F_p)$. The formulas now make addition usable, but they still need to be checked as a true group law. The next chapter verifies the axioms, with associativity supplied by the deeper geometric argument that completes the construction. # 7. The Group Axioms and Associativity Chapters 5 and 6 constructed the chord-and-tangent operation on a nonsingular projective cubic with a chosen base point $O$ and then wrote it in Weierstrass coordinates. This chapter checks that the operation is not merely a geometric recipe but a group law. Most axioms follow directly from the way the third intersection point and the reflection through $O$ were defined; associativity is the substantial part, and it is where the geometry of cubics enters in a deeper way. The main point is that addition on a cubic is controlled by collinearity. A line cuts the cubic in three points counted with multiplicity, and the construction arranges that those three points add to $O$. Associativity is then proved by comparing two different products of three lines and using the nine-point principle: eight shared intersection points of two cubics force the ninth. ## The Elementary Group Axioms from the Chord-and-Tangent Construction The first question is which group axioms are already built into the definition of addition. Let $E$ be a nonsingular projective plane cubic over a field $k$, and fix a flex point $O \in E(k)$, so the tangent line at $O$ meets $E$ three times at $O$. For $P,Q \in E(k)$, the line through $P$ and $Q$, interpreted as the tangent when $P=Q$, meets $E$ in a third point $R$ counted with multiplicity. The raw third-intersection operation is not yet addition: if $P$ and $O$ lie on a line with third point $R$, the raw operation sends $(P,O)$ to $R$, not back to $P$. The reflected construction through $O$ is introduced to make $O$ act as the identity. [definition: Chord And Tangent Sum] Let $E \subset \mathbb P^2_k$ be a nonsingular projective cubic and let $O \in E(k)$ be a flex point. The chord-and-tangent operation is the map \begin{align*} + : E(k) \times E(k) \to E(k), \qquad (P,Q) \mapsto P+Q, \end{align*} defined as follows. For $P,Q \in E(k)$, let $R$ be the third intersection point of $E$ with the line through $P$ and $Q$, with tangent interpretation if $P=Q$. If $R \neq O$, then $P+Q$ is the third intersection point of $E$ with the line through $R$ and $O$. If $R=O$, then $P+Q$ is the third intersection point of $E$ with the tangent line to $E$ at $O$. In both cases intersections are counted with multiplicity. [/definition] This definition is symmetric in $P$ and $Q$, because the line through $P$ and $Q$ does not depend on their order. The remaining elementary axioms come from choosing lines that pass through $O$ or from repeating the same line construction in reverse. [quotetheorem:5635] [citeproof:5635] The theorem explains why the base point $O$ is not an ornament: it is the point that turns the raw operation of taking a third intersection into an operation with an identity. It does not yet prove associativity, and it does not say that the same recipe works on an arbitrary cubic or on an affine piece after deleting points at infinity. Its hypotheses also matter. Projectivity guarantees that a line has a third intersection point even when an affine picture would send it to infinity; working with $k$-rational points uses the fact that a $k$-line through $k$-points on a cubic has a $k$-rational residual intersection; and nonsingularity is essential. For example, the cuspidal cubic $Y^2Z=X^3$ has a singular point at $[0:0:1]$, and tangent directions through that point are not governed by the smooth intersection picture used above. A naive rule on all points of this singular cubic would have to add the singular point as if it were an ordinary point, so it cannot be the group law supplied by the smooth chord-and-tangent construction. It is useful to isolate the inverse operation in the common Weierstrass situation. [example: Inverses On A Weierstrass Cubic] Assume $\operatorname{char} k \neq 2,3$, and let \begin{align*} E: y^2=x^3+ax+b \end{align*} be a nonsingular short Weierstrass cubic with point at infinity $O=[0:1:0]$. For $P=(x,y)$, the vertical line through $P$ is given in affine coordinates by $X=x$. Substituting $X=x$ into the equation of $E$ gives \begin{align*} Y^2=x^3+ax+b. \end{align*} Since $P=(x,y)$ lies on $E$, we have $y^2=x^3+ax+b$, so the intersection equation on this affine line is \begin{align*} Y^2=y^2, \end{align*} hence \begin{align*} (Y-y)(Y+y)=0. \end{align*} Thus the affine intersection points are $(x,y)$ and $(x,-y)$, counted with multiplicity if $y=0$. In projective closure the same vertical line also contains $O$, so the three intersections of the line with $E$ are $P$, $(x,-y)$, and $O$. By the inverse construction for the chord-and-tangent law, the inverse of $P$ is the third point on the line through $P$ and $O$. That line is exactly the vertical line above, whose remaining affine point is $(x,-y)$; therefore \begin{align*} -P=(x,-y). \end{align*} If $y=0$, then $(x,-y)=(x,y)$, so $P=-P$ and therefore \begin{align*} 2P=P+P=P+(-P)=O. \end{align*} Thus such a point has order two, provided $P \neq O$. In characteristic $2$, the equality $-y=y$ makes this reflection formula collapse, so one must use a long Weierstrass model and its corresponding inverse formula instead. [/example] This example shows that the abstract inverse construction recovers the familiar coordinate reflection. It also suggests a more compact way to remember the addition law: three points on a line have sum $O$. ## Collinearity as the Language of Addition The next problem is to replace the two-line definition of $P+Q$ by a single criterion involving a line. Such a criterion is what makes the associativity proof possible, because it allows line configurations to be translated into additive equations. [explanation: Collinearity Criterion For The Chord Law] Let a projective line meet a nonsingular cubic $E$ in the points $P$, $Q$, and $R$, counted with intersection multiplicity. With respect to the chord-and-tangent addition law based at the flex point $O$, the relation is \begin{align*} P+Q+R=O. \end{align*} [/explanation] The criterion turns geometry into algebra: a secant or tangent line becomes a relation among three points. The statement is limited to points on a smooth projective cubic, with the addition law already defined from the chosen flex $O$, and with intersections counted with their usual intersection multiplicities. Without smoothness, the line relation can break down at the singular point; on the nodal cubic $Y^2Z=X^2(X+Z)$, lines through the node meet the curve with singular contribution at the node, so the smooth three-point relation does not describe addition on all points of the cubic. Without projectivity, a line may have its residual intersection at infinity and therefore outside the affine curve. Without multiplicities, the tangent case would misrecord the relation: a tangent at $P$ must count $P$ twice, giving $(P+P)+R=O$, rather than treating the line as passing through only two points. This relation will be used repeatedly in the associativity proof, so the following example spells out the tangent case. [example: Tangent Relation] Let $L$ be the tangent to $E$ at $P$, and suppose its third intersection point with $E$ is $R$. Because $L$ has tangent contact at $P$, its intersection with $E$ is counted as the triple of points $P,P,R$. Applying the collinearity criterion to these three intersection points gives \begin{align*} (P+P)+R=O. \end{align*} Since $2P=P+P$, this is \begin{align*} 2P+R=O. \end{align*} Thus $R$ is the inverse of $2P$, so \begin{align*} 2P=-R. \end{align*} In short Weierstrass coordinates $E:y^2=x^3+ax+b$, take $P=(x,y)$ with $y\neq 0$. Differentiating the curve equation gives $2y\,dy=(3x^2+a)\,dx$, so the tangent slope is \begin{align*} m=\frac{3x^2+a}{2y}. \end{align*} The tangent line is $Y=y+m(X-x)$. Put $X=x+t$, so $Y=y+mt$. Substituting into the equation of $E$ gives \begin{align*} (y+mt)^2=(x+t)^3+a(x+t)+b. \end{align*} Expanding both sides gives \begin{align*} y^2+2myt+m^2t^2=x^3+3x^2t+3xt^2+t^3+ax+at+b. \end{align*} Since $P\in E$, we have $y^2=x^3+ax+b$, and since $m=(3x^2+a)/(2y)$, we have $2my=3x^2+a$. Removing the equal constant terms and the equal linear terms leaves \begin{align*} m^2t^2=3xt^2+t^3. \end{align*} Moving all terms to one side and factoring gives \begin{align*} 0=t^2(t+3x-m^2). \end{align*} Thus $t=0$ occurs twice, recording the tangent contact at $P$, and the third intersection has \begin{align*} t=m^2-3x. \end{align*} Therefore the third point is \begin{align*} R=\bigl(m^2-2x,\;y+m(m^2-3x)\bigr). \end{align*} Reflecting through $O$ changes the sign of the $y$-coordinate, so \begin{align*} 2P=-R=\bigl(m^2-2x,\;-y-m(m^2-3x)\bigr). \end{align*} Thus the tangent construction says exactly that the third intersection point of the tangent is reflected across the $x$-axis to obtain $2P$. [/example] The theorem is still a statement about one line. Associativity involves four input points and two different ways of grouping them, so it requires a way to compare several lines at once. ## Why Associativity Is the Hard Axiom The elementary axioms used only the symmetry and reversibility of the construction. Associativity asks for \begin{align*} (P+Q)+R = P+(Q+R), \end{align*} and the two sides are produced by different auxiliary lines. There is no single line whose symmetry exchanges the two expressions. [explanation: The Associativity Obstruction] To compute $(P+Q)+R$, first use the line through $P$ and $Q$, then the line through its third point and $O$, then combine the resulting point with $R$. To compute $P+(Q+R)$, the same procedure starts with the line through $Q$ and $R$. These constructions share some points, but they do not follow the same sequence of lines. The proof therefore cannot be a local argument about one secant or tangent. It must show that two global cubic configurations, each built as a union of three lines, force the same final point. This is exactly the kind of statement controlled by the nine intersections of two plane cubics. [/explanation] This is the first place where the fact that $E$ has degree three is essential beyond line intersection. The relevant auxiliary cubics are reducible cubics, each a product of three lines, but they are still plane cubics and therefore subject to cubic intersection geometry. [remark: Multiplicity Convention] When two of the points in an associativity diagram coincide, a secant line is replaced by a tangent line, and when a line has higher contact with $E$, the corresponding point is counted with higher intersection multiplicity. The statements in this chapter are meant with this convention. In a first reading, it is harmless to picture the generic case where all displayed points are distinct and all intersections are transverse. [/remark] The generic picture contains the main idea. Degenerate cases require the same intersection-counting principle with multiplicities, not a different group law. ## The Nine-Point Cubic Argument The geometric engine is a special nine-point principle for plane cubics. The version needed here concerns two cubics that meet in nine ordinary transverse points; if another cubic passes through eight of those points, then it must pass through the ninth. [explanation: Nine-Point Principle For Plane Cubics] Let $C_1$ and $C_2$ be plane cubics whose intersection consists of exactly nine distinct transverse points. If a third plane cubic passes through eight of those nine points, then it passes through the remaining point as well. [/explanation] The hypotheses are essential. The nine points must come from the full intersection of two cubics, not from an arbitrary list of points in the plane; otherwise eight point conditions do not usually force the ninth. Requiring only seven of the nine points would also leave too much freedom. In this course the principle is used in the generic transverse form, with auxiliary cubics that are often unions of three lines. Tangent and repeated-point cases follow the same intersection-counting philosophy, but the first reading can safely keep the transverse picture in mind. The associativity proof now has the missing ingredient. The collinearity criterion translates each auxiliary line into an additive relation, while the nine-point principle identifies the final undetermined point in the diagram. [quotetheorem:5649] [citeproof:5649] The diagram is a compact version of the whole argument. Each displayed line has a specific role: two lines form the first additions, two lines form the second additions, and the two inverse lines through $A,-A,O$ and $B,-B,O$ make the same eight already-known points lie on both reducible cubics. The operation on $E(k)$ is still the original rational operation, since all lines and residual intersections used to define the two sides are defined over $k$. The hypotheses explain where the argument would otherwise fail. Projectivity is needed because an affine cubic does not meet every affine line in three affine points; for instance, vertical lines on a Weierstrass model meet the third point at infinity, so deleting $O$ destroys the inverse step. Smoothness is needed because a singular cubic carries a generalized group law only after separating the singular point from the nonsingular locus; on a nodal or cuspidal cubic, lines through the singularity count extra multiplicity there and the naive chord rule on all points is not a group operation. The chosen rational flex point is also part of the structure: changing $O$ changes which point acts as the identity, while omitting a $k$-rational flex base point leaves no identity in $E(k)$ from which to define inverses by this construction. Associativity itself has a narrower meaning than these surrounding facts. It says that once the smooth projective cubic, rational flex base point, and chord-and-tangent operation have been fixed, parentheses may be removed from sums of $k$-rational points. It does not classify singular cubics, does not turn the affine curve $E \setminus \{O\}$ into a group, and does not say that a different choice of base point gives the same labelled group law. [illustration:cayley-bacharach-associativity] [explanation: Reading the Associativity Diagram] In the generic picture, the labels $A$ and $B$ record the third intersections from the first two secant lines through $P,Q$ and $Q,R$. The labels $-A$ and $-B$ are obtained by drawing the corresponding inverse lines through $O$. The two final auxiliary lines determine points $C$ and $D$, whose reflections are the two bracketed sums. The point of the diagram is not to compute those sums line by line in the page body. It shows the eight common marked points shared by two reducible cubics made from triples of lines. The nine-point principle then forces the remaining marked point to agree. The cited proof supplies the formal bookkeeping, including tangent and repeated-point cases. [/explanation] This is the diagrammatic idea without unpacking the proof in the page prose: every line contributes one geometric relation, and the single non-local step is the ninth-point assertion for cubics. ## A Coordinate Check on a Rational Curve The geometric proof establishes associativity in general, but it is worth seeing that the theorem agrees with coordinate arithmetic. We use a rational Weierstrass curve where all points involved are rational and the computations are still manageable. [example: Numerical Associativity On A Rational Curve] Let $E: y^2=x^3-7x+10$ over $\mathbb Q$, with $O$ the point at infinity. The points $P=(1,2)$, $Q=(2,2)$, and $R=(3,-4)$ lie on $E$, since $2^2=1^3-7\cdot 1+10$, $2^2=2^3-7\cdot 2+10$, and $(-4)^2=3^3-7\cdot 3+10$. We compute both bracketings using the secant-and-reflection rule for a short Weierstrass cubic. For $P=(1,2)$ and $Q=(2,2)$, the secant slope is \begin{align*} m=\frac{2-2}{2-1}=0. \end{align*} Thus the line is $Y=2$. Substituting $Y=2$ into $E$ gives \begin{align*} 4=X^3-7X+10. \end{align*} Equivalently, \begin{align*} 0=X^3-7X+6=(X-1)(X-2)(X+3). \end{align*} The third intersection point is $(-3,2)$, so reflecting across the $x$-axis gives \begin{align*} P+Q=(-3,-2). \end{align*} Now add $P+Q=(-3,-2)$ to $R=(3,-4)$. The secant slope is \begin{align*} m=\frac{-4-(-2)}{3-(-3)}=-\frac{1}{3}. \end{align*} The line is \begin{align*} Y=-2-\frac{1}{3}(X+3)=-\frac{X}{3}-3. \end{align*} Substituting into $E$ gives \begin{align*} \left(-\frac{X}{3}-3\right)^2=X^3-7X+10. \end{align*} Expanding and moving all terms to one side gives \begin{align*} 0=9X^3-X^2-81X+9=(X+3)(X-3)(9X-1). \end{align*} The third intersection has $X=1/9$, and its $Y$-coordinate is \begin{align*} Y=-\frac{1}{27}-3=-\frac{82}{27}. \end{align*} Reflecting gives \begin{align*} (P+Q)+R=\left(\frac{1}{9},\frac{82}{27}\right). \end{align*} For the other bracketing, the secant through $Q=(2,2)$ and $R=(3,-4)$ has slope \begin{align*} m=\frac{-4-2}{3-2}=-6. \end{align*} Its equation is \begin{align*} Y=2-6(X-2)=14-6X. \end{align*} Substitution gives \begin{align*} (14-6X)^2=X^3-7X+10. \end{align*} Expanding and collecting terms gives \begin{align*} 0=X^3-36X^2+161X-186=(X-2)(X-3)(X-31). \end{align*} The third intersection is $(31,-172)$, because $14-6\cdot 31=-172$, so reflection gives \begin{align*} Q+R=(31,172). \end{align*} Finally add $P=(1,2)$ to $Q+R=(31,172)$. The slope is \begin{align*} m=\frac{172-2}{31-1}=\frac{17}{3}. \end{align*} The line is \begin{align*} Y=2+\frac{17}{3}(X-1)=\frac{17X}{3}-\frac{11}{3}. \end{align*} Substituting into $E$ gives \begin{align*} \left(\frac{17X}{3}-\frac{11}{3}\right)^2=X^3-7X+10. \end{align*} Multiplying by $9$, expanding, and collecting terms gives \begin{align*} 0=9X^3-289X^2+311X-31=(X-1)(X-31)(9X-1). \end{align*} The third intersection again has $X=1/9$, and its $Y$-coordinate is \begin{align*} Y=\frac{17}{27}-\frac{11}{3}=-\frac{82}{27}. \end{align*} Reflecting gives \begin{align*} P+(Q+R)=\left(\frac{1}{9},\frac{82}{27}\right). \end{align*} Both bracketings produce the same rational point, so this coordinate calculation matches associativity for these three points on the curve. [/example] The coordinate formulas are best viewed as an implementation of the geometric group law, not as its foundation. The group axioms come from projective cubic geometry: identity, inverse, and commutativity from the chord-and-tangent construction, and associativity from the nine-point cubic argument. Once the group law is established, it can be viewed in a more visual setting over the [real numbers](/page/Real%20Numbers). The next chapter uses the same equations to show how the algebraic law appears in the shape and components of a real elliptic curve. # 8. Real Elliptic Curves as Geometric Objects This chapter turns the algebraic formulas for the group law into pictures over the real numbers. In earlier chapters the curve was treated over a general field, so the line-and-cubic construction was primarily projective and algebraic. Over $\mathbb R$ the same equations draw visible curves in the plane, and the topology of those curves explains why some real elliptic curves have one connected component while others have two. ## Reading the Real Shape from the Cubic Polynomial For a short Weierstrass equation \begin{align*} E: y^2=x^3+ax+b, \end{align*} the visible real points are controlled by where the cubic polynomial on the right is non-negative. The guiding question is: how much of the shape of $E(\mathbb R)$ can be read before solving for any group operation? [definition: Real Points of a Short Weierstrass Cubic] Let $a,b\in \mathbb R$, and define $f:\mathbb R\to\mathbb R$ by $f(x)=x^3+ax+b$. The real affine points of the short Weierstrass cubic are \begin{align*} E_{\mathrm{aff}}(\mathbb R)=\{(x,y)\in \mathbb R^2:y^2=f(x)\}. \end{align*} The real projective curve $E(\mathbb R)$ is obtained by adjoining the point at infinity $O=[0:1:0]$ to the projective closure \begin{align*} Y^2Z=X^3+aXZ^2+bZ^3. \end{align*} [/definition] This definition separates the affine drawing from the completed projective curve. To decide what the affine drawing contains, we need to know exactly which $x$-values can occur and how the answer changes when the cubic has different real root patterns. [quotetheorem:5636] [citeproof:5636] This theorem gives a direct bridge between polynomial algebra and the real plot: no group operation is needed to locate the real affine locus. The nonsingularity hypothesis is essential because a repeated root would create a cusp or node, and then the sign intervals would no longer describe a smooth elliptic curve. The monic cubic shape is also being used: its values are negative far to the left and positive far to the right, which fixes the alternating sign pattern across real roots. The discriminant condition from Chapter 3 decides which root pattern occurs: for $f(x)=x^3+ax+b$, the discriminant is \begin{align*} \Delta=-16(4a^3+27b^2), \end{align*} and the sign of $4a^3+27b^2$ distinguishes one real root from three real roots. [example: Comparing Two Real Cubics] For $E_1:y^2=x^3-x$, first factor the cubic: \begin{align*} x^3-x=x(x^2-1)=x(x-1)(x+1). \end{align*} The roots are $-1$, $0$, and $1$. Since the cubic is monic, it is negative for $x<-1$, and because each root is simple its sign changes at each root. Therefore \begin{align*} x^3-x\ge 0 \quad\Longleftrightarrow\quad x\in[-1,0]\cup[1,\infty). \end{align*} Thus the real affine points are \begin{align*} (x,y)=\bigl(x,\pm\sqrt{x^3-x}\bigr) \end{align*} over these two intervals, with $y=0$ at $x=-1,0,1$. The interval $[-1,0]$ gives the bounded oval, while the ray $[1,\infty)$ gives the unbounded branch. For $E_2:y^2=x^3-x+1$, set $g(x)=x^3-x+1$. Its derivative is \begin{align*} g'(x)=3x^2-1. \end{align*} Hence the only critical points are $x=-1/\sqrt{3}$ and $x=1/\sqrt{3}$. At the left critical point, \begin{align*} g\left(-\frac{1}{\sqrt{3}}\right)=-\frac{1}{3\sqrt{3}}+\frac{1}{\sqrt{3}}+1=1+\frac{2}{3\sqrt{3}}>0. \end{align*} At the right critical point, \begin{align*} g\left(\frac{1}{\sqrt{3}}\right)=\frac{1}{3\sqrt{3}}-\frac{1}{\sqrt{3}}+1=1-\frac{2}{3\sqrt{3}}>0. \end{align*} Also $g(x)\to-\infty$ as $x\to-\infty$ and $g(x)\to\infty$ as $x\to\infty$. Since both turning values are positive, the graph crosses the $x$-axis exactly once, before the left critical point. For the numerical location, \begin{align*} g(-1.325)=(-1.325)^3-(-1.325)+1=-0.001328125<0. \end{align*} Also, \begin{align*} g(-1.324)=(-1.324)^3-(-1.324)+1=0.004176576>0. \end{align*} So the unique real root lies between $-1.325$ and $-1.324$, approximately $-1.3247$. Hence the visible affine curve for $E_2$ begins at this root and extends rightward as a single unbounded branch. [/example] The comparison shows why the root count is not a cosmetic feature of the equation. It changes the topology of the real curve, and that topology later constrains how a continuous group operation can behave. ## One-Component and Two-Component Real Cubics The affine drawing omits the point at infinity, so it can be misleading about connectedness. The next question is: after adding $O$, when does the real elliptic curve form one loop, and when does it split into two components? [definition: Components of a Real Elliptic Curve] Let $E$ be a nonsingular short Weierstrass cubic over $\mathbb R$. A connected component of $E(\mathbb R)$ is a maximal connected subset of the real projective curve with its usual topology as a subset of $\mathbb P^2(\mathbb R)$. [/definition] This definition forces us to interpret the unbounded affine branch inside projective space. The obstruction is that the affine picture cuts off the point where the two infinite ends may meet, so apparent separation in the $(x,y)$-plane can give the wrong component count. The projective completion by $O$ is what decides whether the real curve is one connected loop or two connected pieces. [quotetheorem:5637] [citeproof:5637] The component classification singles out the component containing the identity element of the group law. The projective completion is essential here: if we reasoned only in the affine chart, the two branches over a ray would look disconnected, but their two ends meet at $O$ in $\mathbb P^2(\mathbb R)$. The nonsingularity assumption again prevents repeated-root degenerations, where the local topology at the singular point would not be that of a smooth one-dimensional manifold. This motivates naming the component containing $O$, because later arithmetic over $\mathbb R$ uses it to compare the topology of the curve with the algebra of the group. [definition: Identity Component] Let $E$ be an elliptic curve over $\mathbb R$. The identity component $E(\mathbb R)^0$ is the connected component of $E(\mathbb R)$ containing the point at infinity $O$. [/definition] This definition turns a geometric component into group-theoretic data. The point $O$ matters because it is both the projective point completing the unbounded branch and the identity element for the chord-and-tangent law. A different component, when it exists, cannot be a subgroup because it does not contain the identity. The next question is whether the identity component is merely a topological piece or whether it is preserved by addition and inverses. [quotetheorem:5638] [citeproof:5638] In the two-component case this theorem explains the visible asymmetry between the oval and the unbounded branch. The proof uses continuity in an essential way: a continuous image of a connected set cannot jump from the identity component to a different component. The condition that the chosen component contains $O$ is also essential, since subgroup closure must include the identity and inverses. Thus the unbounded branch plus $O$ is the identity component, while the bounded oval is not a subgroup because it does not contain $O$. [remark: Quotient by the Identity Component] For a nonsingular real short Weierstrass cubic, the [quotient group](/page/Quotient%20Group) $E(\mathbb R)/E(\mathbb R)^0$ is either the trivial group or a group of order $2$. The second case occurs exactly when the defining cubic has three distinct real roots. [/remark] ## Tangents, Chords, and Continuity of the Group Law The chord-and-tangent rule was introduced algebraically, but real pictures reveal its continuity. The guiding problem is to understand how secants become tangents, how vertical lines encode inverses, and how repeated doubling moves along the real component. [definition: Geometric Inverse on a Real Weierstrass Cubic] Let $E:y^2=x^3+ax+b$ be a nonsingular short Weierstrass cubic over $\mathbb R$. The negation map is the function \begin{align*} [-1]:E(\mathbb R)\to E(\mathbb R) \end{align*} defined on affine points $P=(x,y)\in E(\mathbb R)$ by \begin{align*} [-1](P)=-P=(x,-y), \end{align*} and defined at the point at infinity by $[-1](O)=O$. [/definition] The definition matches the vertical-line picture: the line $x=\text{constant}$ meets the cubic at $P$, at $-P$, and at $O$ in the projective closure. Thus the third-intersection rule makes reflection in the $x$-axis the inverse operation. [example: Inverses on the Two-Component Curve] On $E:y^2=x^3-x$, factor \begin{align*} x^3-x=x(x^2-1)=x(x-1)(x+1), \end{align*} so the real affine locus occurs over the intervals $[-1,0]$ and $[1,\infty)$. For $P=(2,\sqrt{6})$, the curve equation is satisfied because \begin{align*} 2^3-2=8-2=6 \end{align*} and \begin{align*} (\sqrt{6})^2=6. \end{align*} Since $2\in[1,\infty)$, the point $P$ lies on the unbounded component. The inverse map on a short Weierstrass cubic sends $(x,y)$ to $(x,-y)$, so \begin{align*} -P=(2,-\sqrt{6}). \end{align*} This point has the same $x$-coordinate $2$, so it is also on the unbounded component. For \begin{align*} Q=\left(-\frac{1}{2},\frac{\sqrt{6}}{4}\right), \end{align*} the right-hand side of the curve equation is \begin{align*} \left(-\frac{1}{2}\right)^3-\left(-\frac{1}{2}\right)=-\frac{1}{8}+\frac{1}{2}=\frac{3}{8}, \end{align*} and the square of the $y$-coordinate is \begin{align*} \left(\frac{\sqrt{6}}{4}\right)^2=\frac{(\sqrt{6})^2}{4^2}=\frac{6}{16}=\frac{3}{8}. \end{align*} Thus $Q$ lies on $E(\mathbb R)$. Since $-\frac{1}{2}\in[-1,0]$, it lies on the bounded oval. Its inverse is \begin{align*} -Q=\left(-\frac{1}{2},-\frac{\sqrt{6}}{4}\right), \end{align*} and this point remains over the same interval $[-1,0]$, so it is also on the bounded oval. Reflection across the $x$-axis preserves each visible component, even though only the unbounded component is completed by the point at infinity $O$ and contains the identity. [/example] After inverses, the next geometric operation is doubling. A tangent at $P$ meets the cubic with multiplicity two at $P$ and once more at a point $R$; the group law defines $2P=-R$. [quotetheorem:5639] [citeproof:5639] The formula is algebraic, but the real plot gives it a dynamic interpretation. The condition $y_1\ne 0$ is exactly the condition that the tangent is not vertical; when $y_1=0$, the point is a real point of order two and doubling gives $O$. The nonsingularity hypothesis ensures the tangent line is well-defined and that the substitution argument has the expected intersection multiplicities. As $P$ moves continuously along a component and avoids points of order two, the tangent line turns continuously and the point $2P$ moves continuously as well. [example: Repeated Doubling on One Real Component] Consider $E:y^2=x^3-x+1$ and $P=(0,1)$. First, \begin{align*} 0^3-0+1=1 \end{align*} and \begin{align*} 1^2=1, \end{align*} so $P\in E(\mathbb R)$. Here $a=-1$, $x_1=0$, and $y_1=1$, so the tangent slope in the doubling formula is \begin{align*} m=\frac{3x_1^2+a}{2y_1}=\frac{3\cdot 0^2-1}{2\cdot 1}=-\frac{1}{2}. \end{align*} Therefore the $x$-coordinate of $2P$ is \begin{align*} x(2P)=m^2-2x_1=\left(-\frac{1}{2}\right)^2-2\cdot 0=\frac{1}{4}. \end{align*} The $y$-coordinate is \begin{align*} y(2P)=m(x_1-x(2P))-y_1=-\frac{1}{2}\left(0-\frac{1}{4}\right)-1. \end{align*} Since \begin{align*} -\frac{1}{2}\left(0-\frac{1}{4}\right)-1=-\frac{1}{2}\left(-\frac{1}{4}\right)-1=\frac{1}{8}-1=-\frac{7}{8}, \end{align*} we get \begin{align*} 2P=\left(\frac{1}{4},-\frac{7}{8}\right). \end{align*} Checking the point against the curve equation, the right-hand side is \begin{align*} \left(\frac{1}{4}\right)^3-\frac{1}{4}+1=\frac{1}{64}-\frac{16}{64}+\frac{64}{64}=\frac{49}{64}, \end{align*} and the left-hand side is \begin{align*} \left(-\frac{7}{8}\right)^2=\frac{49}{64}. \end{align*} Thus $2P\in E(\mathbb R)$. Since this real curve has one connected component, $P$, $2P$, and every later iterate $4P,8P,\dots$ produced by repeated doubling lie on that same component; the computation gives one concrete tangent step along the single real projective loop. [/example] For adding two distinct points, the chord version is the same picture with a secant line in place of the tangent. The limiting case as the two points coalesce recovers doubling, so the tangent rule is not an extra operation but the continuous extension of the chord rule. [quotetheorem:5640] [citeproof:5640] These formulas make the real group operation compatible with the pictures from the first two sections. The hypothesis $x_1\ne x_2$ separates the secant case from the tangent case and excludes vertical pairs, where $Q=-P$ and the sum is $O$. Nonsingularity again keeps the third-intersection rule well behaved: the line meets a smooth cubic with multiplicities that match the algebraic substitution. In the one-component case every real point can be reached within the same connected loop. In the two-component case, adding two points on the bounded oval lands in the identity component, while adding a point on the oval to a point in the identity component lands back on the oval; this is the visible form of the [quotient group](/theorems/790) of order $2$. [example: Component Arithmetic on $y^2=x^3-x$] For $E:y^2=x^3-x=x(x-1)(x+1)$, the real affine locus lies over $[-1,0]\cup[1,\infty)$. The interval $[-1,0]$ is the bounded oval, while the ray $[1,\infty)$ is the affine part of the identity component after adjoining $O$. Take \begin{align*} P=\left(-\frac{1}{2},\frac{\sqrt{6}}{4}\right) \end{align*} and \begin{align*} Q=(0,0). \end{align*} The point $P$ lies on the curve because \begin{align*} \left(-\frac{1}{2}\right)^3-\left(-\frac{1}{2}\right)=-\frac{1}{8}+\frac{1}{2}=\frac{3}{8} \end{align*} and \begin{align*} \left(\frac{\sqrt{6}}{4}\right)^2=\frac{6}{16}=\frac{3}{8}. \end{align*} The point $Q$ lies on the curve because $0^3-0=0$ and $0^2=0$. Both points have $x$-coordinates in $[-1,0]$, so both lie on the bounded oval. The slope of the chord through $P$ and $Q$ is \begin{align*} m=\frac{0-\frac{\sqrt{6}}{4}}{0-\left(-\frac{1}{2}\right)}=\frac{-\frac{\sqrt{6}}{4}}{\frac{1}{2}}=-\frac{\sqrt{6}}{2}. \end{align*} By the *Chord Formula for Adding Distinct Points*, \begin{align*} x(P+Q)=m^2-x(P)-x(Q)=\left(-\frac{\sqrt{6}}{2}\right)^2-\left(-\frac{1}{2}\right)-0=\frac{6}{4}+\frac{1}{2}=2. \end{align*} For the ordinate, \begin{align*} y(P+Q)=m\bigl(x(P)-x(P+Q)\bigr)-y(P)=-\frac{\sqrt{6}}{2}\left(-\frac{1}{2}-2\right)-\frac{\sqrt{6}}{4}. \end{align*} Since \begin{align*} -\frac{\sqrt{6}}{2}\left(-\frac{1}{2}-2\right)-\frac{\sqrt{6}}{4}=-\frac{\sqrt{6}}{2}\left(-\frac{5}{2}\right)-\frac{\sqrt{6}}{4}=\frac{5\sqrt{6}}{4}-\frac{\sqrt{6}}{4}=\sqrt{6}, \end{align*} we get \begin{align*} P+Q=(2,\sqrt{6}). \end{align*} Because $2\in[1,\infty)$, this sum lies on the identity component. Now add the oval point $P$ to the point \begin{align*} R=(2,\sqrt{6}) \end{align*} on the unbounded component. The chord slope is \begin{align*} m=\frac{\sqrt{6}-\frac{\sqrt{6}}{4}}{2-\left(-\frac{1}{2}\right)}=\frac{\frac{3\sqrt{6}}{4}}{\frac{5}{2}}=\frac{3\sqrt{6}}{10}. \end{align*} Again by the chord formula, \begin{align*} x(P+R)=m^2-x(P)-x(R)=\left(\frac{3\sqrt{6}}{10}\right)^2-\left(-\frac{1}{2}\right)-2. \end{align*} The arithmetic is \begin{align*} \left(\frac{3\sqrt{6}}{10}\right)^2-\left(-\frac{1}{2}\right)-2=\frac{54}{100}+\frac{1}{2}-2=\frac{27}{50}+\frac{25}{50}-\frac{100}{50}=-\frac{24}{25}. \end{align*} For the ordinate, \begin{align*} y(P+R)=m\bigl(x(P)-x(P+R)\bigr)-y(P)=\frac{3\sqrt{6}}{10}\left(-\frac{1}{2}+\frac{24}{25}\right)-\frac{\sqrt{6}}{4}. \end{align*} Since \begin{align*} -\frac{1}{2}+\frac{24}{25}=-\frac{25}{50}+\frac{48}{50}=\frac{23}{50}, \end{align*} we have \begin{align*} \frac{3\sqrt{6}}{10}\left(-\frac{1}{2}+\frac{24}{25}\right)-\frac{\sqrt{6}}{4}=\frac{3\sqrt{6}}{10}\cdot\frac{23}{50}-\frac{\sqrt{6}}{4}=\frac{69\sqrt{6}}{500}-\frac{125\sqrt{6}}{500}=-\frac{14\sqrt{6}}{125}. \end{align*} Therefore \begin{align*} P+R=\left(-\frac{24}{25},-\frac{14\sqrt{6}}{125}\right). \end{align*} Because $-\frac{24}{25}\in[-1,0]$, this point lies on the bounded oval. These two computations show the component rule concretely: oval plus oval lands in the identity component, while oval plus identity component lands back on the oval, matching the quotient behavior of $\mathbb Z/2\mathbb Z$. [/example] The chapter's main point is that the real equation does more than draw a curve: it displays the group law as a continuous geometric operation. The cubic polynomial determines the number of real components, the point at infinity chooses the identity component, and the tangent-and-chord construction turns those components into visible group-theoretic structure. The real picture makes the geometry intuitive, but arithmetic over the rationals is where the law becomes computational. The next chapter keeps the same addition rule and uses it to study rational points, where exact calculations reveal the curve's arithmetic structure. # 9. Computations Over the Rationals Computing with elliptic curves over the rationals is the first place where the geometry of the group law becomes arithmetic. Chapters 5 through 8 gave formulas for adding points on a nonsingular Weierstrass cubic, first over a general field and then in geometric terms using secants, tangents, reflection, and real components. Here we ask what happens when the input coordinates are rational numbers: whether the output remains rational, how denominators encode exceptional cases, and how small finite subgroups can be detected by exact calculation. ## Rational Input and Rational Output The main arithmetic question is whether the chord-and-tangent construction respects the field in which the point coordinates live. Over $\mathbb R$ the picture suggests a continuous operation on the real locus, but pictures do not by themselves explain why starting with rational points cannot produce an irrational third intersection point. The answer is that the addition formulas are built from field operations, except at the special cases where the geometric line is vertical or tangent with a vertical tangent. Let $E$ be the nonsingular affine Weierstrass curve \begin{align*} E: y^2 = x^3 + ax + b, \end{align*} with $a,b \in \mathbb Q$, together with the point at infinity $O$. For points $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ on $E$, the usual formulas use the slope of the secant or tangent line and then reflect the third intersection point in the $x$-axis. [quotetheorem:5641] [citeproof:5641] The theorem shows that rationality is not a new geometric miracle; it is a consequence of the formulas living in $\mathbb Q$. The hypothesis $P+Q\ne O$ is necessary for an affine coordinate formula: on $E:y^2=x^3-x$, the points $(0,0)$ and its inverse are the same point, and their sum is $O$, which has no affine coordinates $(x_3,y_3)$. Nonsingularity is also essential because a singular cubic no longer has the same elliptic-curve group law; for instance $y^2=x^3$ has a cusp at $(0,0)$, so the chord-and-tangent construction degenerates at the singular point. The theorem does not say that all rational points are easy to find, only that once two suitable rational points are already known, the nonexceptional affine formula computes their sum exactly. We now turn this calculation into a closure theorem, because later computations over $\mathbb Q$ need a guarantee that every repeated addition remains inside the rational point set. [illustration:rational-secant-addition] [example: Adding Two Rational Points] On $E:y^2=x^3-x$, the point $P=(0,0)$ lies on the curve because $0^2=0$ and $0^3-0=0$. The point $Q=(1,0)$ lies on the curve because $0^2=0$ and $1^3-1=1-1=0$. Thus $P,Q\in E(\mathbb Q)$. We have $x_1=0$, $y_1=0$, $x_2=1$, and $y_2=0$, so $x_1\ne x_2$ and the secant slope is \begin{align*} \lambda=\frac{y_2-y_1}{x_2-x_1}=\frac{0-0}{1-0}=\frac{0}{1}=0. \end{align*} The affine addition formula gives \begin{align*} x_3=\lambda^2-x_1-x_2=0^2-0-1=0-0-1=-1. \end{align*} For the $y$-coordinate, \begin{align*} y_3=-y_1+\lambda(x_1-x_3)=-0+0(0-(-1))=0+0\cdot 1=0. \end{align*} Therefore \begin{align*} (0,0)+(1,0)=(-1,0). \end{align*} This is a nonexceptional secant calculation: rational input coordinates produce the rational output coordinates $(-1,0)$. [/example] This example gives one successful sum, but arithmetic needs stability under every allowed sum, not just under a chosen calculation. The possible failure is that a secant or tangent calculation might introduce coordinates outside $\mathbb Q$, especially through divisions or through coefficients not defined over $\mathbb Q$. For a nonsingular short Weierstrass curve with rational coefficients, the formulas show that every allowed addition step stays inside the rational point set. [quotetheorem:5642] [citeproof:5642] The same proof works over any field of characteristic not equal to $2$ or $3$ after replacing $\mathbb Q$ by that field. The coefficient hypothesis is part of the arithmetic statement, not decoration: on the nonsingular curve $E:y^2=x^3+\sqrt{2}x+1$, the rational point $P=(0,1)$ satisfies \begin{align*} \lambda=\frac{\sqrt{2}}{2}, \qquad x(2P)=\frac{1}{2}, \qquad y(2P)=-1-\frac{\sqrt{2}}{4}. \end{align*} Thus a rational input point can double to a point with irrational coordinates when the curve itself is not defined over $\mathbb Q$. The nonsingularity condition cannot be dropped: for the singular cubic $y^2=x^3$, the point $(0,0)$ is a cusp, so tangent-based addition at that point is not an elliptic-curve group operation. The theorem is also a closure statement, not a finiteness theorem, a generation theorem, or an algorithm for discovering every element of $E(\mathbb Q)$. For this chapter, the rational version is the one we use: once a starting set of points lies in $E(\mathbb Q)$, exact addition cannot leave $E(\mathbb Q)$. ## Denominators, Vertical Lines, and Exact Arithmetic The practical problem in rational computations is not merely whether the answer is rational, but how to compute it without losing the exact structure. Decimal approximations obscure whether a denominator is zero, whether a point is torsion, and whether two points that look close are actually equal. Exact arithmetic keeps the exceptional cases visible. For $P=(x,y)\in E(\mathbb Q)$, the inverse is \begin{align*} -P=(x,-y). \end{align*} Thus $P+Q=O$ precisely when $Q=-P$, which in affine coordinates means $x_Q=x_P$ and $y_Q=-y_P$. Geometrically, the line through the two points is vertical and meets the projective cubic at $O$ as its third intersection point. [quotetheorem:5643] [citeproof:5643] The theorem is the geometric meaning of the denominator $x_2-x_1$ in the secant slope. If that denominator vanishes and the points are distinct, the answer is not obtained by a finite slope; it is the point at infinity. The condition $P\ne Q$ in the second assertion is necessary, since $P=Q$ with $x_1=x_2$ is the tangent case rather than the vertical secant case. The affine Weierstrass form is also being used: the equation has only the two possible $y$-values $y$ and $-y$ above a fixed $x$, whereas a different singular or non-Weierstrass model may not support this exact argument. The result does not compute a finite affine sum; instead it tells the exact arithmetic algorithm when to stop before forming the fraction with denominator $x_2-x_1$. [illustration:vertical-exceptional-sum] [example: Order Two From A Vertical Tangent] On $E:y^2=x^3-x$, the point $P=(0,0)$ lies on the curve because \begin{align*} 0^2=0 \qquad\text{and}\qquad 0^3-0=0-0=0. \end{align*} The inverse of an affine point $(x,y)$ on this Weierstrass curve is $(x,-y)$, so \begin{align*} -P=(0,-0)=(0,0)=P. \end{align*} Hence \begin{align*} 2P=P+P=P+(-P)=O, \end{align*} by the *Vertical Line Case*. Since $P=(0,0)$ is an affine point and $O$ is the point at infinity, $P\ne O$; therefore the smallest positive integer $n$ with $nP=O$ is $n=2$, so $P$ has order $2$. [/example] This computation used the group inverse rather than the tangent formula, and that is intentional. At a point with $y=0$, the tangent slope formula has denominator $2y=0$, so doubling must be handled as an exceptional case. We therefore need a doubling rule that says both what to do when the tangent slope exists and what to do when it does not. [quotetheorem:5639] [citeproof:5639] Exact arithmetic therefore begins with a case distinction before any fraction is formed. The hypothesis $y\ne 0$ is necessary for the displayed slope: on $E:y^2=x^3-x$, the point $(0,0)$ has $2y=0$, and trying to use the fraction would require division by zero even though the correct group-theoretic answer is $O$. Nonsingularity again matters because the tangent at a singular point is not the tangent used in the elliptic-curve group law; the cusp on $y^2=x^3$ is the standard warning example. The theorem is only a local doubling rule, so it does not decide the order of a general rational point unless repeated exact additions eventually return to $O$. For rational points represented as pairs of rational numbers, the algorithm first checks whether either input is $O$, then whether $Q=-P$, then whether $P=Q$, and only then computes the relevant slope. [example: Exact Doubling With Fractions] On $E:y^2=x^3-x+1$, the point $P=(0,1)$ lies on the curve because \begin{align*} 1^2=1 \end{align*} and \begin{align*} 0^3-0+1=0-0+1=1. \end{align*} Thus $P\in E(\mathbb Q)$. Since the $y$-coordinate of $P$ is $1\ne 0$, the doubling formula from *[Tangent Formula for Point Doubling on a Weierstrass Elliptic Curve](/theorems/5639)* applies with $a=-1$, $x=0$, and $y=1$. The tangent slope is \begin{align*} \lambda=\frac{3x^2+a}{2y}=\frac{3\cdot 0^2+(-1)}{2\cdot 1}=\frac{0-1}{2}=-\frac12. \end{align*} Therefore the $x$-coordinate of $2P$ is \begin{align*} x(2P)=\lambda^2-2x=\left(-\frac12\right)^2-2\cdot 0=\frac14-0=\frac14. \end{align*} The $y$-coordinate is \begin{align*} y(2P)=-y+\lambda\bigl(x-x(2P)\bigr)=-1+\left(-\frac12\right)\left(0-\frac14\right). \end{align*} Since $0-\frac14=-\frac14$, this becomes \begin{align*} y(2P)=-1+\left(-\frac12\right)\left(-\frac14\right)=-1+\frac18=-\frac88+\frac18=-\frac78. \end{align*} The computed point also satisfies the curve equation. Its left-hand side is \begin{align*} \left(-\frac78\right)^2=\frac{49}{64}. \end{align*} Its right-hand side is \begin{align*} \left(\frac14\right)^3-\frac14+1=\frac{1}{64}-\frac{16}{64}+\frac{64}{64}=\frac{1-16+64}{64}=\frac{49}{64}. \end{align*} Hence \begin{align*} 2P=\left(\frac14,-\frac78\right)\in E(\mathbb Q). \end{align*} The calculation keeps the fractions exact: the nonzero denominator $2y=2$ permits the tangent formula, and the resulting coordinates remain rational. [/example] The example shows why rational arithmetic should be kept symbolic. The denominators are not computational nuisance terms; they record the geometry of secants and tangents and prevent the algorithm from confusing the point at infinity with a very large affine point. ## Small Finite Subgroups from Explicit Addition The final question in this chapter is how much group structure can be seen without height theory, descent, or the Mordell theorem. We can already identify small finite subgroups by calculating sums exactly. The curve $E:y^2=x^3-x$ is especially useful because its rational points with $y=0$ are visible immediately. On this curve, \begin{align*} y^2=x(x-1)(x+1), \end{align*} so $(0,0)$, $(1,0)$, and $(-1,0)$ are rational points. Together with $O$, they form a natural candidate for a finite subgroup. [explanation: Visible Two-Torsion On The Curve $y^2=x^3-x$] On $E:y^2=x^3-x$ over $\mathbb Q$, the set \begin{align*} \{O,(0,0),(1,0),(-1,0)\} \end{align*} is a subgroup of $E(\mathbb Q)$. Each nonidentity point in this subgroup has order $2$. [/explanation] This proposition gives an addition table that can be read directly from the geometry. The special factorisation matters: on $E:y^2=x^3-x+1$, the polynomial $x^3-x+1$ has no rational roots among $0$, $1$, and $-1$, so the same three visible $y=0$ points are absent. The proposition also does not classify all rational points on $y^2=x^3-x$; it only identifies one finite subgroup inside $E(\mathbb Q)$. The three nonzero points behave like the three nonidentity elements of the Klein four group, and the next example records this behaviour as an explicit addition table. [example: Addition Table For The Visible Subgroup] Let $A=(0,0)$, $B=(1,0)$, and $C=(-1,0)$ on $E:y^2=x^3-x$. These points lie on the curve because \begin{align*} 0^3-0=0 \end{align*} for $A$, \begin{align*} 1^3-1=1-1=0 \end{align*} for $B$, and \begin{align*} (-1)^3-(-1)=-1+1=0 \end{align*} for $C$; in each case $y=0$, so $y^2=0$. Since the inverse of $(x,y)$ on this Weierstrass curve is $(x,-y)$, we have $-A=A$, $-B=B$, and $-C=C$. Therefore \begin{align*} A+A=O,\qquad B+B=O,\qquad C+C=O \end{align*} by the *Vertical Line Case*. Now compute the three off-diagonal sums. For $A+B$, the slope is \begin{align*} \lambda=\frac{0-0}{1-0}=0. \end{align*} The addition formula gives \begin{align*} x(A+B)=0^2-0-1=-1. \end{align*} It also gives \begin{align*} y(A+B)=-0+0(0-(-1))=0. \end{align*} Thus $A+B=(-1,0)=C$. For $B+C$, the slope is \begin{align*} \lambda=\frac{0-0}{-1-1}=\frac{0}{-2}=0. \end{align*} Hence \begin{align*} x(B+C)=0^2-1-(-1)=0. \end{align*} The $y$-coordinate is \begin{align*} y(B+C)=-0+0(1-0)=0. \end{align*} So $B+C=(0,0)=A$. For $C+A$, the slope is \begin{align*} \lambda=\frac{0-0}{0-(-1)}=\frac{0}{1}=0. \end{align*} Thus \begin{align*} x(C+A)=0^2-(-1)-0=1. \end{align*} The $y$-coordinate is \begin{align*} y(C+A)=-0+0(-1-1)=0. \end{align*} Therefore $C+A=(1,0)=B$. Together with $O+P=P+O=P$, the full addition table is: the $O$ row is $O,A,B,C$; the $A$ row is $A,O,C,B$; the $B$ row is $B,C,O,A$; and the $C$ row is $C,B,A,O$. The four visible points are closed under addition: each nonzero point doubles to $O$, and the sum of two distinct nonzero points is the remaining nonzero point. [/example] The calculation is small, but it establishes an important habit: finite subgroups can be tested by exact closure under the addition formulas. Later methods will prove far stronger finiteness and structure results, but they must agree with these direct computations in the cases where the points are visible. [remark: What This Chapter Does Not Use] No descent, height function, or Mordell-Weil theorem is needed to produce the subgroup above. The argument only uses the group law, rational exact arithmetic, and the factorisation $x^3-x=x(x-1)(x+1)$. This is why small torsion phenomena are often the first arithmetic features one can see on an elliptic curve. [/remark] The chapter therefore closes the loop between geometry and arithmetic: the chord-and-tangent law is geometric in definition, algebraic in formula, and field-preserving in computation. Over $\mathbb Q$, this means rational points can be added exactly, exceptional denominators have geometric meaning, and small finite subgroups can be found by hand before invoking deeper arithmetic theory. Rational computations show how the group law behaves in arithmetic terms, and the same mechanism survives reduction modulo primes. The next chapter carries the construction to finite fields, where point counting and subgroup structure become completely explicit. # 10. Elliptic Curves Over Finite Fields After the real and rational computations of Chapters 8 and 9, this chapter moves the same group law to finite fields. It assumes the earlier construction of the chord-and-tangent law for nonsingular Weierstrass cubics, together with basic finite group theory: identity, inverses, cyclic subgroups, and [Lagrange's theorem](/theorems/841). The formulas for adding points still make sense after reducing coefficients modulo a prime $p$, provided the curve remains nonsingular and $p\ne 2,3$. The new feature is that $E(\mathbb F_p)$ is a finite group, so geometric addition can be studied by counting points, writing tables, and applying the elementary theorems of finite group theory. Point counts also carry arithmetic information about how a curve over $\mathbb Q$ behaves modulo different primes. ## Reducing the Group Law Modulo a Prime What must be checked before the chord-and-tangent formulas can be used modulo $p$? Over $\mathbb F_p$, division is allowed only by nonzero residue classes, and singular reduction can destroy the elliptic curve structure. Thus the first task is to separate good primes, where the same algebraic formulas define a group, from bad primes, where the cubic has a singular point. [definition: Elliptic Curve Over A Finite Field] Let $p$ be a prime with $p \ne 2,3$. An elliptic curve over $\mathbb F_p$ is a projective plane curve \begin{align*} E: Y^2Z = X^3 + aXZ^2 + bZ^3 \end{align*} with $a,b \in \mathbb F_p$ and discriminant \begin{align*} \Delta = -16(4a^3+27b^2) \ne 0 \end{align*} in $\mathbb F_p$. [/definition] The affine part is written $y^2=x^3+ax+b$, and the projective point $O=[0:1:0]$ is the point at infinity. The discriminant condition says that the cubic has no repeated root after passing to an algebraic closure, so the tangent line is well-defined at every point of $E$. [remark: Good And Bad Reduction] Suppose $E$ is first written over $\mathbb Z$ by $y^2=x^3+ax+b$. For a prime $p \ne 2,3$, reducing the coefficients modulo $p$ gives an elliptic curve over $\mathbb F_p$ exactly when $4a^3+27b^2 \not\equiv 0 \pmod p$. Such a prime is called a prime of good reduction for this equation. [/remark] Good reduction lets the earlier geometric setup survive in a new arithmetic setting, but it does not by itself tell us how to add two finite-field points. We need a formula-level statement because every later enumeration and addition table depends on being able to compute sums using only residues modulo $p$. [quotetheorem:5644] [citeproof:5644] The theorem matters because it turns a geometric construction into arithmetic in residues. A computation that looked analytic over $\mathbb R$ becomes a finite calculation with inverses modulo $p$. The hypotheses are doing real work: if the reduced cubic is singular, the tangent construction can pass through a point where there is no elliptic curve group structure. For example, $y^2=x^3$ over $\mathbb F_5$ has discriminant $0$ and a cusp at $(0,0)$, so it is not an elliptic curve even though the displayed equation still has finite-field solutions. The restriction $p\ne 2,3$ also keeps the short Weierstrass form and the slope formula $\lambda=(3x_1^2+a)/(2y_1)$ from degenerating. Finally, these formulas describe the candidate sum; associativity is a separate group-law theorem, not a consequence of the coordinate calculation alone. [example: Doubling A Point Modulo Five] On $E: y^2=x^3+x+1$ over $\mathbb F_5$, take $P=(0,1)$. Here $a=1$, and the denominator in the tangent slope is nonzero because $2\cdot 1=2\ne 0$ in $\mathbb F_5$. Thus \begin{align*} \lambda = \frac{3\cdot 0^2+1}{2\cdot 1}=\frac{1}{2}. \end{align*} In $\mathbb F_5$, $2^{-1}=3$ because $2\cdot 3=6\equiv 1\pmod 5$, so \begin{align*} \lambda=\frac{1}{2}=3. \end{align*} Using the doubling formulas with $x_1=x_2=0$ and $y_1=1$, the new $x$-coordinate is \begin{align*} x(2P)=\lambda^2-x_1-x_2=3^2-0-0=9\equiv 4\pmod 5. \end{align*} The new $y$-coordinate is \begin{align*} y(2P)=\lambda(x_1-x(2P))-y_1=3(0-4)-1=-12-1=-13\equiv 2\pmod 5. \end{align*} Therefore $2P=(4,2)$. This example shows that the real tangent formula is still the operative formula, but division has become multiplication by an inverse in $\mathbb F_5$. [/example] ## Enumerating Points By Direct Calculation How can the group be made visible when the field has only finitely many elements? The most direct method is to list all $x \in \mathbb F_p$, compute $x^3+ax+b$, and ask which residues are squares. This gives the affine points, and then $O$ is added separately. [definition: Finite Field Points Of A Weierstrass Curve] For $E: y^2=x^3+ax+b$ over $\mathbb F_p$, the set of finite-field points is \begin{align*} E(\mathbb F_p)=\{(x,y)\in \mathbb F_p^2 : y^2=x^3+ax+b\}\cup\{O\}. \end{align*} [/definition] This definition is deliberately concrete. It says that $E(\mathbb F_p)$ is not an approximation to the real curve; it is the set of solutions whose coordinates lie in the finite field itself. [example: Enumerating The Curve Over Five Elements] Let $E: y^2=x^3+x+1$ over $\mathbb F_5$. First compute the possible square values in $\mathbb F_5$. We have \begin{align*} 0^2\equiv 0 \pmod 5. \end{align*} Also \begin{align*} 1^2\equiv 1 \pmod 5. \end{align*} Next, \begin{align*} 2^2=4\equiv 4 \pmod 5. \end{align*} For the remaining residues, \begin{align*} 3^2=9\equiv 4 \pmod 5. \end{align*} Finally, \begin{align*} 4^2=16\equiv 1 \pmod 5. \end{align*} Thus the quadratic residues in $\mathbb F_5$ are $0,1,4$. Now evaluate the right-hand side $x^3+x+1$ for each $x\in\mathbb F_5$. For $x=0$, \begin{align*} 0^3+0+1=1\equiv 1 \pmod 5. \end{align*} For $x=1$, \begin{align*} 1^3+1+1=3\equiv 3 \pmod 5. \end{align*} For $x=2$, \begin{align*} 2^3+2+1=8+2+1=11\equiv 1 \pmod 5. \end{align*} For $x=3$, \begin{align*} 3^3+3+1=27+3+1=31\equiv 1 \pmod 5. \end{align*} For $x=4$, \begin{align*} 4^3+4+1=64+4+1=69\equiv 4 \pmod 5. \end{align*} So when $x=0$, the equation is $y^2=1$, giving $y=1$ or $y=4$. When $x=1$, the equation is $y^2=3$, and there is no solution because $3$ is not among the quadratic residues $0,1,4$. When $x=2$ or $x=3$, the equation is again $y^2=1$, giving $y=1$ or $y=4$ in each case. When $x=4$, the equation is $y^2=4$, giving $y=2$ or $y=3$. Therefore the affine points are \begin{align*} (0,1),(0,4),(2,1),(2,4),(3,1),(3,4),(4,2),(4,3). \end{align*} There are $8$ affine points, and adding the point at infinity $O$ gives \begin{align*} |E(\mathbb F_5)|=8+1=9. \end{align*} This enumeration shows that $E(\mathbb F_5)$ is a finite set of nine points, with $O$ included separately from the affine solutions. [/example] The enumeration also reveals the inverse operation. Points with the same $x$-coordinate and opposite $y$-coordinates add to $O$, while points with $y=0$ would be their own inverses. [remark: Inverses In The Finite Table] For $E: y^2=x^3+x+1$ over $\mathbb F_5$, the inverse of $(x,y)$ is $(x,-y)=(x,5-y)$ when $y \ne 0$. Hence $(0,1)^{-1}=(0,4)$, $(2,1)^{-1}=(2,4)$, $(3,1)^{-1}=(3,4)$, and $(4,2)^{-1}=(4,3)$. [/remark] Counting by hand is possible for small $p$, but the result is more than a count. The addition formulas give a binary operation on the listed points, and the inverse pairs suggest the identity behaviour expected from a group. The next theorem packages these computations into the finite-field version of the group law. [quotetheorem:5645] [citeproof:5645] The theorem is the bridge from geometry to finite group theory. The nonsingularity hypothesis cannot be dropped: the singular curve $y^2=x^3$ over $\mathbb F_5$ has a cusp at $(0,0)$, and the chord-and-tangent rules do not produce an elliptic curve group on all its projective points. The theorem also has a definite limitation: it proves that the listed points form a finite abelian group, but it does not give $|E(\mathbb F_p)|$, identify generators, or determine whether the group is cyclic. Those questions require enumeration, point-counting estimates, or additional finite group theory. ## Addition Tables And Cyclic Behaviour What does repeated addition look like in a finite elliptic curve group? Since the group is finite, every point eventually returns to $O$. The number of steps required is the order of the point, and the possible orders are constrained by the size of the group. [definition: Order Of A Finite Field Point] Let $E(\mathbb F_p)$ be an elliptic curve group and let $P\in E(\mathbb F_p)$. The order of $P$, denoted $\operatorname{ord}(P)$, is the least $n\ge 1$ such that \begin{align*} nP=O. \end{align*} [/definition] The order definition turns a repeated-addition orbit into a measurable cycle length, but it gives no test for which cycle lengths are possible. To rule out impossible table patterns, we need a divisibility theorem connecting the cycle generated by one point to the size of the entire group. This is the point where the course imports [Lagrange's theorem](/theorems/782) from elementary group theory. [quotetheorem:5646] [citeproof:5646] The finiteness and group hypotheses are essential here. Without a finite group, the cyclic orbit of $P$ need not return to the identity, and without the nonsingular elliptic curve group law there may be no subgroup $\langle P\rangle$ to which Lagrange's theorem applies. The theorem is also only a divisibility obstruction: if $d\mid |E(\mathbb F_p)|$, it does not follow that there is a point of order $d$. For the curve over $\mathbb F_5$ counted above, the group has $9$ elements. Therefore every point order divides $9$, so a non-identity point has order $3$ or $9$. [example: Repeated Addition On The Nine Point Curve] Continue with $E: y^2=x^3+x+1$ over $\mathbb F_5$ and $P=(0,1)$. From the doubling computation, $2P=(4,2)$. To compute $3P=P+2P$, the slope between $(0,1)$ and $(4,2)$ is \begin{align*} \lambda=\frac{2-1}{4-0}=\frac{1}{4}. \end{align*} Since $4\cdot 4=16\equiv 1 \pmod 5$, we have $4^{-1}=4$, so $\lambda=4$. The addition formulas give \begin{align*} x(3P)=4^2-0-4=16-4=12\equiv 2 \pmod 5. \end{align*} Also, \begin{align*} y(3P)=4(0-2)-1=-8-1=-9\equiv 1 \pmod 5. \end{align*} Thus $3P=(2,1)$. Now add $P$ repeatedly, reducing every coordinate modulo $5$. For $4P=3P+P=(2,1)+(0,1)$, the slope is \begin{align*} \lambda=\frac{1-1}{0-2}=\frac{0}{-2}=0. \end{align*} Hence \begin{align*} x(4P)=0^2-2-0=-2\equiv 3 \pmod 5. \end{align*} And \begin{align*} y(4P)=0(2-3)-1=-1\equiv 4 \pmod 5. \end{align*} So $4P=(3,4)$. For $5P=4P+P=(3,4)+(0,1)$, \begin{align*} \lambda=\frac{1-4}{0-3}=\frac{-3}{-3}=1. \end{align*} Therefore \begin{align*} x(5P)=1^2-3-0=-2\equiv 3 \pmod 5. \end{align*} And \begin{align*} y(5P)=1(3-3)-4=-4\equiv 1 \pmod 5. \end{align*} So $5P=(3,1)$. For $6P=5P+P=(3,1)+(0,1)$, \begin{align*} \lambda=\frac{1-1}{0-3}=0. \end{align*} Thus \begin{align*} x(6P)=0^2-3-0=-3\equiv 2 \pmod 5. \end{align*} And \begin{align*} y(6P)=0(3-2)-1=-1\equiv 4 \pmod 5. \end{align*} So $6P=(2,4)$. For $7P=6P+P=(2,4)+(0,1)$, \begin{align*} \lambda=\frac{1-4}{0-2}=\frac{-3}{-2}=\frac{2}{3}. \end{align*} Since $3\cdot 2=6\equiv 1 \pmod 5$, we have $3^{-1}=2$, and therefore \begin{align*} \lambda=2\cdot 2=4. \end{align*} Now \begin{align*} x(7P)=4^2-2-0=16-2=14\equiv 4 \pmod 5. \end{align*} And \begin{align*} y(7P)=4(2-4)-4=4(-2)-4=-8-4=-12\equiv 3 \pmod 5. \end{align*} So $7P=(4,3)$. For $8P=7P+P=(4,3)+(0,1)$, \begin{align*} \lambda=\frac{1-3}{0-4}=\frac{-2}{-4}=\frac{3}{1}=3. \end{align*} Thus \begin{align*} x(8P)=3^2-4-0=9-4=5\equiv 0 \pmod 5. \end{align*} And \begin{align*} y(8P)=3(4-0)-3=12-3=9\equiv 4 \pmod 5. \end{align*} So $8P=(0,4)=-P$. Therefore \begin{align*} 9P=8P+P=(0,4)+(0,1)=O, \end{align*} because the two points have the same $x$-coordinate and opposite $y$-coordinates in $\mathbb F_5$. The successive multiples are $P=(0,1)$, $2P=(4,2)$, $3P=(2,1)$, $4P=(3,4)$, $5P=(3,1)$, $6P=(2,4)$, $7P=(4,3)$, $8P=(0,4)$, and $9P=O$. The first eight multiples are all affine points and none is $O$, while $9P=O$. Hence $\operatorname{ord}(P)=9$. Since the previous enumeration gave $|E(\mathbb F_5)|=9$, these nine multiples are all the points of $E(\mathbb F_5)$, so $P$ generates the group. [/example] This example shows how a complete addition table can be compressed by finding a generator. If $P$ generates the group, then every entry in the table is determined by adding exponents modulo $\operatorname{ord}(P)$. [example: Addition Table From A Generator] For the same curve, the previous computation showed that $P=(0,1)$ has order $9$, with $0P=O$, $3P=(2,1)$, $6P=(2,4)$, and $9P=O$. Since the curve has exactly nine finite-field points, every element is uniquely one of $0P,P,2P,\ldots,8P$. To compute an entry in the addition table, write the two inputs as $mP$ and $nP$ with $0\le m,n\le 8$. By associativity of the group law, adding $m$ copies of $P$ and then $n$ copies of $P$ gives $m+n$ copies of $P$, so \begin{align*} (mP)+(nP)=(m+n)P. \end{align*} Because $9P=O$, any multiple can be reduced modulo $9$. For example, \begin{align*} 7P+6P=(7+6)P. \end{align*} Since $7+6=13=9+4$, \begin{align*} 13P=(9+4)P. \end{align*} Associativity gives \begin{align*} (9+4)P=9P+4P. \end{align*} Using $9P=O$ and the identity property, \begin{align*} 9P+4P=O+4P=4P. \end{align*} Thus the whole table is governed by \begin{align*} (mP)+(nP)=rP, \end{align*} where $r$ is the residue of $m+n$ modulo $9$ with $0\le r\le 8$. The row and column labelled $O=0P$ are identity row and column because \begin{align*} 0P+nP=(0+n)P=nP \end{align*} and \begin{align*} mP+0P=(m+0)P=mP. \end{align*} For $1\le n\le 8$, the inverse of $nP$ is $(9-n)P$, since \begin{align*} nP+(9-n)P=(n+9-n)P=9P=O. \end{align*} In particular, \begin{align*} 3P+6P=(3+6)P=9P=O, \end{align*} so $3P=(2,1)$ and $6P=(2,4)$ are inverse points. The addition table has therefore been reduced to ordinary addition of exponents modulo $9$. [/example] A generator gives the best possible compression, but an arbitrary finite elliptic curve group need not have one. To know what addition tables can look like beyond cyclic examples, we need the general classification framework for finite abelian groups. The next theorem is quoted rather than proved here, since its proof belongs to group theory rather than to the geometry of cubics. [quotetheorem:850] This theorem is quoted from the classification theorem for finite abelian groups. The hypotheses are essential: finiteness gives a decomposition into finitely many cyclic factors, and commutativity permits the invariant-factor form written above. The statement is structural rather than computational; it does not determine the actual integers $n_1,\dots,n_r$ for a particular curve, nor does it give the point count needed to find them. In later courses, the elliptic-curve-specific refinement over finite fields gives sharper information about how many cyclic factors can occur. The chapter's practical lesson is that the same chord-and-tangent formulas now give a fully finite arithmetic object. By reducing modulo a good prime, enumerating solutions, and applying Lagrange's theorem, we can turn a cubic curve into an explicit finite group whose elements and cycles can be computed by hand in small cases. Finite fields make the group law tangible, but they also suggest that the chord-and-tangent rule is only the surface of something more intrinsic. The next chapter explains that deeper structure through flexes and collinearity, showing why the same geometry naturally produces an abelian group. # 11. Flexes and a Conceptual View of the Law Chapters 5 through 10 built and used the group law on a nonsingular plane cubic by drawing chords and tangents, then reflecting the third intersection point. This chapter steps back from the formulas and isolates the geometric reason the construction is so stable: the chosen origin is a flex, and every line through the cubic gives a three-point relation. We keep working with a nonsingular projective cubic $E$ over a field $k$, with a chosen point $O \in E(k)$. For the computational Weierstrass model, $O$ is the point at infinity. The line at infinity meets the cubic at $O$ three times, and that triple contact is what makes the identity and inverse rules fit the same line-counting pattern as ordinary secants and tangents. ## Why the Tangent at the Origin Counts Three Times The group law used $O$ as the identity, but this only works because $O$ is not just another point on the cubic. The tangent at $O$ must use all three intersections with the cubic at $O$ itself; otherwise a leftover third point would enter the construction and spoil the identity law. For a Weierstrass cubic \begin{align*} E : Y^2Z = X^3 + aXZ^2 + bZ^3, \end{align*} the point at infinity is $O = [0:1:0]$. The line at infinity is $Z=0$. Substituting $Z=0$ into the homogeneous equation gives $0=X^3$, so the only intersection point on that line is $X=0$, namely $O$, and the root has multiplicity three. [definition: Flex Point] Let $E \subset \mathbb{P}^2_k$ be a nonsingular plane cubic. A point $P \in E$ is a flex point if the tangent line to $E$ at $P$ intersects $E$ at $P$ with multiplicity at least three. [/definition] The definition names the special contact behaviour we just computed at infinity. The next explanation records that computation as the reason the Weierstrass origin is geometrically distinguished. [explanation: Line At Infinity As The Flex Tangent] For the short Weierstrass cubic above, the line $Z=0$ meets the curve only at $O=[0:1:0]$, and the restricted equation is $X^3=0$. Thus the contact at $O$ is counted three times. In the language of flexes, the line at infinity is the flex tangent at $O$. [/explanation] The Weierstrass equation and the specified point $O=[0:1:0]$ are both doing real work here. If an ordinary point were chosen as the origin instead, the tangent line at that point would usually leave a third residual intersection. The identity law would then interact with that leftover point, rather than with the simple rule that the origin contributes three copies of itself. [example: An Ordinary Tangent Is Not Usually A Flex Tangent] On \begin{align*} E : y^2=x^3-x+1 \end{align*} the point $P=(0,1)$ has tangent slope \begin{align*} \lambda=\frac{3\cdot 0^2-1}{2\cdot 1}=-\frac12. \end{align*} The tangent line is \begin{align*} y=1-\frac{x}{2}. \end{align*} Substituting this line back into the cubic gives a double intersection at $P$ and a third intersection at \begin{align*} R=\left(\frac14,\frac78\right). \end{align*} Thus the tangent at $P$ does not spend all three intersections at $P$. By contrast, the tangent at the Weierstrass point $O$ spends all three intersections at $O$, which is why $O$ is suitable as the identity for the standard group law. [/example] The contrast with an ordinary tangent makes the point at infinity worth checking directly. The next example repeats the short computation in projective coordinates so the triple contact is visible without appealing to a picture. [example: The Point At Infinity On A Short Weierstrass Cubic] Consider the short Weierstrass cubic \begin{align*} E : Y^2Z=X^3-XZ^2+Z^3 \end{align*} over $\mathbb{Q}$, and let $O=[0:1:0]$. The line at infinity is $Z=0$. Substituting $Z=0$ into the homogeneous equation gives \begin{align*} Y^2\cdot 0 = X^3-X\cdot 0^2+0^3. \end{align*} The left side is $0$, and the last two terms on the right side are $0$, so the restricted equation is \begin{align*} 0=X^3. \end{align*} Hence $X=0$. On the projective line $Z=0$, a point with $X=0$ has the form $[0:Y:0]$ with $Y\ne 0$, and all such points are projectively equal to $[0:1:0]=O$. The root $X=0$ occurs with multiplicity three, so all three intersections of the line at infinity with the cubic are concentrated at $O$. [/example] This flex condition is the hidden reason that the identity law fits into the same collinearity pattern as the secant and tangent cases. Once $O$ contributes three times on its tangent line, every ordinary line relation can be read relative to the same origin. ## Collinear Triples As Addition Relations The group law was built from the observation that a line meets a cubic in three points. If a line meets $E$ in $P$, $Q$, and $R$, counted with multiplicity, then the chord-and-tangent law reads that line as the additive relation \begin{align*} P+Q+R=O. \end{align*} This is not a new operation. It is the same operation already defined by taking the third intersection and reflecting through the origin. [explanation: Collinear Triple Relation] Let a projective line meet the nonsingular cubic $E$ in $P$, $Q$, and $R$, counted with intersection multiplicity. With respect to the chord-and-tangent law based at the flex origin $O$, the three points satisfy \begin{align*} P+Q+R=O. \end{align*} When the line is tangent at one point, that point is repeated in the displayed sum. [/explanation] The flex origin is essential. If the chosen origin were not a flex, then the tangent at the proposed origin would have a leftover intersection point, and the identity case would no longer match the clean three-point relation above. [example: Secant Relation] Suppose a line $L$ meets $E$ at three distinct points $P,Q,R$. The chord construction first takes $R$ as the third intersection of the line through $P$ and $Q$. The group sum $P+Q$ is then the reflection of $R$ through the vertical line through $O$, which is the point $-R$. Therefore \begin{align*} P+Q=-R. \end{align*} Adding $R$ to both sides gives \begin{align*} P+Q+R=O. \end{align*} Thus the familiar drawing rule and the compact collinearity relation say the same thing. [/example] The tangent case uses the same relation, but with one point counted twice. This is the first place where multiplicity turns a special case into the same rule rather than a separate convention. [example: Tangent Relation] Let $L$ be tangent to $E$ at $P$, and suppose its remaining intersection point is $R$. Tangency means that the line counts $P$ twice, so the collinear triple is $P,P,R$. The relation becomes \begin{align*} P+P+R=O. \end{align*} Since $P+P=2P$, this is \begin{align*} 2P+R=O. \end{align*} Therefore \begin{align*} 2P=-R, \end{align*} which is exactly the tangent-and-reflect rule for doubling. [/example] The inverse law is another special line, not a new algebraic axiom. A vertical line supplies the third example because it always passes through the point at infinity. [example: Vertical Line Relation] For an affine point $P=(x,y)$ on a short Weierstrass cubic, the vertical line through $P$ also meets the curve at $-P=(x,-y)$ and at $O$. The three-point relation is \begin{align*} P+(-P)+O=O. \end{align*} Cancelling the identity point $O$ leaves \begin{align*} P+(-P)=O. \end{align*} Thus the coordinate reflection rule is also a special case of the same collinearity principle. [/example] The three examples show why the construction feels more rigid than an arbitrary formula. Secants, tangents, vertical lines, and the identity point are all governed by one line-counting rule once the flex origin has been chosen. ## Comparing Geometry And Formulas The affine formulas from earlier chapters are not a separate definition of addition; they are coordinates for the same line construction. The secant case is the clearest place to see the agreement. [example: Comparing Geometry and Formulas] On $E:y^2=x^3+ax+b$, take affine points $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ with $P\ne Q$ and $x_1\ne x_2$. The line through them has slope \begin{align*} m=\frac{y_2-y_1}{x_2-x_1}, \end{align*} so its equation is \begin{align*} y=m(x-x_1)+y_1. \end{align*} Writing the same line as $y=mx+c$, its constant term is \begin{align*} c=y_1-mx_1. \end{align*} Substituting $y=mx+c$ into the Weierstrass equation gives \begin{align*} (mx+c)^2=x^3+ax+b. \end{align*} After moving all terms to the right, the possible $x$-coordinates of intersections are the roots of \begin{align*} 0=x^3-m^2x^2+(a-2mc)x+(b-c^2). \end{align*} Since $P$ and $Q$ lie on both the line and the curve, $x_1$ and $x_2$ are two roots. If the third root is $x_3$, comparing the $x^2$ coefficient with \begin{align*} (x-x_1)(x-x_2)(x-x_3) \end{align*} gives \begin{align*} x_3=m^2-x_1-x_2. \end{align*} The third intersection point on the line has $y$-coordinate \begin{align*} m(x_3-x_1)+y_1. \end{align*} The group sum reflects this third point across the $x$-axis, so \begin{align*} y(P+Q)=m(x_1-x_3)-y_1. \end{align*} Thus the coordinate formula is exactly the chord-and-reflect construction written in affine coordinates. [/example] The calculation shows that the slope formulas are just the line construction with coordinates attached. The final remark states what this viewpoint contributes before the course turns back to a worked curve. [remark: What The Conceptual View Adds] The flex-and-collinearity viewpoint does not replace the explicit formulas. The formulas remain the practical way to add points over $\mathbb Q$, $\mathbb R$, or $\mathbb F_p$. What the viewpoint adds is a unifying explanation: the same line relation accounts for secants, tangents, inverses, and the identity point. [/remark] The chapter therefore reframes the group law rather than replacing the earlier constructions. Chords, tangents, vertical lines, and coordinate formulas remain the practical tools for computing sums, while the flex origin explains why the rules fit together into a natural abelian group structure on a nonsingular cubic. The conceptual picture now explains why the geometric and algebraic descriptions agree, so the final step is to consolidate them in one worked example. The next chapter brings the theory back to a specific curve and uses it to connect geometry, computation, and reduction in a single coherent calculation. # 12. Consolidation: From Geometry to Computation The guiding example is the short Weierstrass curve $E:y^2=x^3-x+1$. It is rich enough to have real geometry, rational points, and nontrivial reduction modulo $5$, but simple enough that every calculation can be checked by hand. The chapter ends by placing this first course in the larger arithmetic story: rational-point computation, torsion, reduction, and descent. ## A Complete Worked Curve What must be checked before an affine cubic deserves to be called an elliptic curve, and how do the checks feed into the group law? The affine equation alone is not enough: we must pass to the projective closure, locate the identity point, verify smoothness, and then confirm that the algebraic addition formulas agree with the geometric construction. We begin with the model used throughout the computational part of the course. [definition: Short Weierstrass Elliptic Curve] Let $k$ be a field with $\textrm{char}(k) \ne 2,3$. A short Weierstrass elliptic curve over $k$ is a nonsingular projective plane cubic \begin{align*} Y^2Z=X^3+aXZ^2+bZ^3 \end{align*} with $a,b \in k$, together with the distinguished point $O=[0:1:0]$. [/definition] The affine chart $Z=1$ has equation $y^2=x^3+ax+b$. The point $O$ is the single point on the projective closure [lying over](/theorems/2876) the vertical direction at infinity, and it is chosen as the zero element for the group law. [example: Projective Closure Of A Short Weierstrass Cubic] For $E:y^2=x^3-x+1$, introduce homogeneous coordinates $[X:Y:Z]$ with $x=X/Z$ and $y=Y/Z$ on the affine chart $Z\ne 0$. Substituting into the affine equation gives \begin{align*} \left(\frac{Y}{Z}\right)^2=\left(\frac{X}{Z}\right)^3-\frac{X}{Z}+1. \end{align*} Multiplying both sides by $Z^3$ gives \begin{align*} Y^2Z=X^3-XZ^2+Z^3. \end{align*} Thus the projective closure is \begin{align*} Y^2Z=X^3-XZ^2+Z^3. \end{align*} The points at infinity are the points on this projective curve with $Z=0$. Substituting $Z=0$ into the homogeneous equation gives \begin{align*} Y^2\cdot 0=X^3-X\cdot 0^2+0^3. \end{align*} Therefore \begin{align*} 0=X^3. \end{align*} Hence $X=0$. Since $[0:0:0]$ is not a projective point, the remaining coordinate satisfies $Y\ne 0$, and projective rescaling gives \begin{align*} [0:Y:0]=[0:1:0]. \end{align*} So the affine curve is completed by exactly one point at infinity, namely $[0:1:0]$, which is the distinguished point used as the identity in the short Weierstrass group law. [/example] Having found the projective curve, the next question is whether any point has lost a well-defined tangent direction. Smoothness is the condition that the gradient of the defining homogeneous cubic does not vanish at a point of the curve. [explanation: Smoothness Criterion For A Short Weierstrass Cubic] Let $k$ be a field with $\operatorname{char}(k)\ne 2,3$, and consider the projective curve \begin{align*} Y^2Z=X^3+aXZ^2+bZ^3. \end{align*} This short Weierstrass cubic is nonsingular exactly when \begin{align*} 4a^3+27b^2\ne 0. \end{align*} Equivalently, the discriminant $\Delta=-16(4a^3+27b^2)$ is nonzero. [/explanation] The criterion is necessary because a repeated root of $x^3+ax+b$ produces an affine point where the curve has no unique tangent direction. For example, $y^2=x^3$ has discriminant $0$ and is cuspidal at $(0,0)$, while $y^2=x^3+x^2$ has a node at $(0,0)$; in both cases the chord-and-tangent construction no longer gives the group law of an elliptic curve. Thus the discriminant check is the first computational gate: before adding rational points, reducing modulo a prime, or asking about torsion, we must know that the geometric operation is being performed on a smooth cubic. The criterion is also limited: it verifies smoothness of the model, but it does not by itself compute rational points, prove associativity, or describe the arithmetic of $E(k)$. Those later tasks use smoothness as an input, then add the coordinate formulas and global group-law arguments developed below. For the worked curve $a=-1$ and $b=1$, so \begin{align*} 4a^3+27b^2=4(-1)^3+27=23 \ne 0. \end{align*} Over any field of characteristic not dividing $2$, $3$, or $23$, the same equation defines a nonsingular short Weierstrass elliptic curve. [example: Smoothness Of The Worked Curve] For $E:y^2=x^3-x+1$, the short Weierstrass coefficients are $a=-1$ and $b=1$. The smoothness expression is \begin{align*} 4a^3+27b^2=4(-1)^3+27(1)^2. \end{align*} Since $(-1)^3=-1$ and $(1)^2=1$, this becomes \begin{align*} 4(-1)^3+27(1)^2=4(-1)+27=-4+27=23. \end{align*} In both $\mathbb R$ and $\mathbb Q$, the element $23$ is nonzero, and both fields have characteristic different from $2$ and $3$. Therefore, by the smoothness criterion for a short Weierstrass cubic, the projective curve \begin{align*} Y^2Z=X^3-XZ^2+Z^3 \end{align*} is nonsingular over $\mathbb R$ and over $\mathbb Q$. Over $\mathbb F_5$, the same value reduces modulo $5$ as \begin{align*} 23 \equiv 3 \pmod 5, \end{align*} because $23=4\cdot 5+3$. Since $3\ne 0$ in $\mathbb F_5$ and $\textrm{char}(\mathbb F_5)=5\ne 2,3$, the reduced projective curve \begin{align*} Y^2Z=X^3-XZ^2+Z^3 \end{align*} is also nonsingular over $\mathbb F_5$. Thus the worked curve has a well-defined tangent direction over $\mathbb R$, over $\mathbb Q$, and after reduction modulo $5$, so the same chord-and-tangent addition recipe applies in all three settings. [/example] The real picture explains why the group law is geometric rather than an arbitrary formula. The cubic $f(x)=x^3-x+1$ has one real root, since its discriminant is negative, so $E(\mathbb R)$ has one connected component. Points occur in pairs $(x,y)$ and $(x,-y)$ whenever $f(x)>0$, and the point $O$ closes the curve projectively. ## Coordinatising The Group Law Once the curve is smooth, how do we compute without redrawing the secant or tangent line each time? The geometric rule says: take the line through $P$ and $Q$, find the third intersection point $R$, and reflect $R$ in the $x$-axis. Coordinates turn this into formulas, but the formulas only apply after the exceptional cases have been separated. [definition: Inverse On A Short Weierstrass Curve] Let $E:y^2=x^3+ax+b$ be a short Weierstrass elliptic curve over a field $k$. The inverse map is the function \begin{align*} -:E(k) \to E(k) \end{align*} defined by \begin{align*} -(x,y)=(x,-y) \end{align*} for affine points $(x,y) \in E(k)$, and by $-O=O$. [/definition] The vertical line through $(x,y)$ and $(x,-y)$ meets the projective cubic at $O$ as its third intersection point. Since $O$ is the zero element, this explains the identity $P+(-P)=O$ and singles out the remaining task: for nonvertical lines, compute the reflected third intersection point directly from the two input coordinates. [illustration:chord-tangent-and-inverse-cases] The next formula records the nonvertical part of this construction. Its purpose is to turn the third-intersection rule into a reusable calculation: once the line slope is known, Vieta's relation for the substituted cubic gives the third $x$-coordinate, and the final reflection gives the sign of the resulting $y$-coordinate. [quotetheorem:5647] [citeproof:5647] The theorem is a computation rule, not a replacement for the geometry. Its hypotheses are necessary because the displayed fractions stop making sense in vertical cases: on the worked curve, $P=(0,1)$ and $-P=(0,-1)$ have $x_2-x_1=0$, and the correct sum is $O$, not an affine point obtained from a slope. Likewise, if $P=Q$ and $y_1=0$, then the tangent denominator $2y_1$ vanishes and the tangent line is vertical, so the double is $O$. The formula also has a limitation: it computes only after the identity and inverse cases have already been removed, which is why the next section turns the exceptional cases into an explicit checklist. [example: Rational Addition On The Worked Curve] On $E:y^2=x^3-x+1$, first verify the two input points. For $P=(0,1)$, \begin{align*} 1^2=0^3-0+1=1. \end{align*} For $Q=(1,1)$, \begin{align*} 1^2=1^3-1+1=1. \end{align*} Thus $P$ and $Q$ lie on $E$. They are distinct, and $Q\ne -P=(0,-1)$, so the nonvertical secant case of the *Affine Addition Formula* applies. The slope is \begin{align*} \lambda=\frac{y_Q-y_P}{x_Q-x_P}=\frac{1-1}{1-0}=\frac{0}{1}=0. \end{align*} With $x_P=0$ and $x_Q=1$, the $x$-coordinate of the sum is \begin{align*} x_3=\lambda^2-x_P-x_Q=0^2-0-1=-1. \end{align*} The $y$-coordinate is \begin{align*} y_3=\lambda(x_P-x_3)-y_P=0\bigl(0-(-1)\bigr)-1=0\cdot 1-1=-1. \end{align*} Therefore \begin{align*} P+Q=(-1,-1). \end{align*} The resulting point is still on the curve: its left-hand side is \begin{align*} (-1)^2=1, \end{align*} and its right-hand side is \begin{align*} (-1)^3-(-1)+1=-1+1+1=1. \end{align*} So adding $(0,1)$ and $(1,1)$ by the secant formula gives the rational point $(-1,-1)$ on $E$. [/example] Doubling is the same geometric operation with a tangent line. This is the first place where checking exceptional cases before applying formulas matters: if $y=0$, the tangent is vertical and the double is $O$. [example: Doubling And Tripling A Rational Point] Let $P=(0,1)$ on $E:y^2=x^3-x+1$. First, \begin{align*} 1^2=1 \end{align*} and \begin{align*} 0^3-0+1=1, \end{align*} so $P\in E(\mathbb Q)$. Since $y_P=1\ne 0$, the tangent case of the *Affine Addition Formula* applies. With $a=-1$, the tangent slope is \begin{align*} \lambda =\frac{3x_P^2+a}{2y_P} =\frac{3\cdot 0^2-1}{2\cdot 1} =\frac{0-1}{2} =-\frac{1}{2}. \end{align*} Therefore \begin{align*} x(2P) =\lambda^2-x_P-x_P =\left(-\frac{1}{2}\right)^2-0-0 =\frac{1}{4}, \end{align*} and \begin{align*} y(2P) =\lambda(x_P-x(2P))-y_P =-\frac{1}{2}\left(0-\frac{1}{4}\right)-1 =-\frac{1}{2}\left(-\frac{1}{4}\right)-1 =\frac{1}{8}-1 =-\frac{7}{8}. \end{align*} Thus \begin{align*} 2P=\left(\frac{1}{4},-\frac{7}{8}\right). \end{align*} This point lies on $E$, since \begin{align*} \left(-\frac{7}{8}\right)^2=\frac{49}{64} \end{align*} and \begin{align*} \left(\frac{1}{4}\right)^3-\frac{1}{4}+1 =\frac{1}{64}-\frac{16}{64}+\frac{64}{64} =\frac{49}{64}. \end{align*} To compute $3P=2P+P$, use the secant case with \begin{align*} 2P=\left(\frac{1}{4},-\frac{7}{8}\right) \end{align*} and \begin{align*} P=(0,1). \end{align*} The two points have different $x$-coordinates, so the denominator is nonzero. The slope is \begin{align*} \lambda =\frac{1-\left(-\frac{7}{8}\right)}{0-\frac{1}{4}} =\frac{1+\frac{7}{8}}{-\frac{1}{4}} =\frac{\frac{15}{8}}{-\frac{1}{4}} =\frac{15}{8}\cdot(-4) =-\frac{15}{2}. \end{align*} Hence \begin{align*} x(3P) =\lambda^2-\frac{1}{4}-0 =\left(-\frac{15}{2}\right)^2-\frac{1}{4} =\frac{225}{4}-\frac{1}{4} =\frac{224}{4} =56. \end{align*} Using the first point $2P$ as $(x_1,y_1)$ in the formula gives \begin{align*} y(3P) =\lambda\left(\frac{1}{4}-56\right)-\left(-\frac{7}{8}\right) =-\frac{15}{2}\left(\frac{1}{4}-\frac{224}{4}\right)+\frac{7}{8} =-\frac{15}{2}\left(-\frac{223}{4}\right)+\frac{7}{8} =\frac{3345}{8}+\frac{7}{8} =\frac{3352}{8} =419. \end{align*} Therefore \begin{align*} 3P=(56,419). \end{align*} The final point also satisfies the curve equation, because \begin{align*} 419^2=175561 \end{align*} and \begin{align*} 56^3-56+1 =175616-56+1 =175561. \end{align*} So repeated chord-and-tangent addition starting from the rational point $(0,1)$ gives the rational points $2P=(1/4,-7/8)$ and $3P=(56,419)$ on $E$. [/example] The formula can also be used over finite fields, where division means multiplication by a nonzero inverse modulo $p$. The same preliminary exclusions are required. [example: The Worked Curve Over The Field With Five Elements] Consider $E:y^2=x^3-x+1$ over $\mathbb F_5$. The squares in $\mathbb F_5$ are \begin{align*} 0^2\equiv 0 \pmod 5,\quad 1^2\equiv 1 \pmod 5,\quad 2^2\equiv 4 \pmod 5,\quad 3^2\equiv 4 \pmod 5,\quad 4^2\equiv 1 \pmod 5. \end{align*} Thus the quadratic residues are $0,1,4$. Evaluating the right-hand side at each element of $\mathbb F_5$ gives \begin{align*} 0^3-0+1\equiv 1 \pmod 5. \end{align*} \begin{align*} 1^3-1+1\equiv 1 \pmod 5. \end{align*} \begin{align*} 2^3-2+1=7\equiv 2 \pmod 5. \end{align*} \begin{align*} 3^3-3+1=25\equiv 0 \pmod 5. \end{align*} \begin{align*} 4^3-4+1=61\equiv 1 \pmod 5. \end{align*} For $x=0,1,4$, the equation is $y^2=1$, so $y=1$ or $y=4$. For $x=2$, the equation is $y^2=2$, and $2$ is not a square in $\mathbb F_5$. For $x=3$, the equation is $y^2=0$, so $y=0$. Including the point at infinity, \begin{align*} E(\mathbb F_5)=\{O,(0,1),(0,4),(1,1),(1,4),(3,0),(4,1),(4,4)\}. \end{align*} Now take $P=(0,1)$ and $Q=(1,1)$. They are distinct, and \begin{align*} -P=(0,-1)=(0,4), \end{align*} so $Q\ne -P$ and the nonvertical secant case of the *Affine Addition Formula* applies. The slope is \begin{align*} \lambda=\frac{1-1}{1-0}=\frac{0}{1}=0 \end{align*} in $\mathbb F_5$. Therefore \begin{align*} x(P+Q)=\lambda^2-x_P-x_Q=0^2-0-1=-1\equiv 4 \pmod 5. \end{align*} Also, \begin{align*} y(P+Q)=\lambda(x_P-x(P+Q))-y_P=0(0-4)-1=-1\equiv 4 \pmod 5. \end{align*} Thus \begin{align*} P+Q=(4,4) \end{align*} in $E(\mathbb F_5)$. This matches the rational computation $(-1,-1)$ after reduction, since $-1\equiv 4 \pmod 5$ in both coordinates. Finally, \begin{align*} -(3,0)=(3,-0)=(3,0), \end{align*} so \begin{align*} (3,0)+(3,0)=O. \end{align*} Because $(3,0)\ne O$, the point $(3,0)$ has order $2$ in $E(\mathbb F_5)$. [/example] ## Exceptional Cases Before Formulas Why do many wrong elliptic-curve computations produce points that fail the equation? The common cause is applying an affine formula in a case where its denominator is zero, or forgetting that projective geometry has already assigned a meaning to the vertical line. [definition: Formula Checklist For Short Weierstrass Addition] Let $E:y^2=x^3+ax+b$ be a short Weierstrass elliptic curve over a field $k$ with identity $O$. The short Weierstrass addition operation is the map \begin{align*} +:E(k)\times E(k)\to E(k) \end{align*} defined for $P,Q \in E(k)$ by the following clauses, where affine points are written as $P=(x_P,y_P)$ and $Q=(x_Q,y_Q)$: 1. $O+Q=Q$. 2. $P+O=P$. 3. $(x,y)+(x,-y)=O$. 4. If $P \ne Q$ and $Q \ne -P$, then $P+Q=(x_3,y_3)$ is given by the affine addition formula with \begin{align*} \lambda=\frac{y_Q-y_P}{x_Q-x_P}. \end{align*} 5. If $P=Q=(x_P,y_P)$ and $y_P \ne 0$, then $2P=(x_3,y_3)$ is given by the affine addition formula with \begin{align*} \lambda=\frac{3x_P^2+a}{2y_P}. \end{align*} 6. If $P=Q=(x_P,0)$, then $2P=O$. [/definition] This checklist is the computational form of the projective chord-and-tangent construction. The cases are not ad hoc patches; each one corresponds to a different intersection behaviour of the line with the cubic. The next result verifies that after these cases are separated, the algebraic routine and the geometric construction are the same operation. [quotetheorem:5648] [citeproof:5648] The hypotheses matter because singular cubics can pass through many of the same-looking secant computations without producing an elliptic-curve group law. For instance, a nodal cubic has a singular point where there are two tangent directions, so the instruction to take the tangent at that point is not well-defined. The characteristic restriction also protects the displayed formulas: in characteristic $2$ the inverse is not given by $(x,y)\mapsto (x,-y)$ in this short form, and in characteristic $3$ the tangent numerator $3x^2+a$ no longer carries the same information. The theorem also does not prove the full group axioms: it identifies the coordinate checklist with the geometric operation in the cases where both are defined. Closure, identity, and inverses are visible from the construction, but associativity is a global compatibility statement about several line intersections at once. The next theorem is needed because no local slope calculation, taken by itself, explains why $(P+Q)+R$ and $P+(Q+R)$ must coincide. [explanation: Chord-And-Tangent Operation Is An Abelian Group] Let $E$ be a nonsingular short Weierstrass cubic over a field $k$ with $\operatorname{char} k\ne 2,3$, and let $O$ be the point at infinity. The operation defined by the chord-and-tangent construction, equivalently by the formula checklist above, makes $E(k)$ into an abelian group with identity $O$. [/explanation] This is the conceptual bridge between drawing lines and obtaining a group. Nonsingularity is needed because a singular point can destroy the uniqueness of the tangent line, and the chosen flex point matters because it supplies the identity and the reflection convention used in the addition rule. If a smooth cubic is given a rational point $T$ that is not a flex and we try to use $T$ as the identity, the tangent at $T$ usually meets the cubic twice at $T$ and once at another point $U$; the tangent construction would then force the double of the proposed identity to interact with $U$ rather than return to the identity behaviour required by a group law. Equivalently, the line-through-$T$ reflection no longer matches the clean relation that makes three collinear points sum to zero. The result is still limited to the elliptic-curve group structure; it does not determine the size of $E(k)$, the torsion subgroup, or the rational points over $\mathbb Q$. The formula is efficient for computation, while the associativity proof explains why the computation is part of a stable algebraic structure rather than a coincidence of coordinates. ## Connections And Further Topics What does this first course make possible next? Once the group law is reliable, elliptic curves become arithmetic objects: we can ask which rational points exist, which have finite order, how points reduce modulo primes, and how local information constrains global solutions. [definition: Rational Points Of An Elliptic Curve] Let $E$ be an elliptic curve over $\mathbb Q$. The set $E(\mathbb Q)$ consists of all projective points on $E$ whose homogeneous coordinates may be chosen in $\mathbb Q$, equipped with the group operation \begin{align*} +:E(\mathbb Q)\times E(\mathbb Q)\to E(\mathbb Q) \end{align*} inherited from the chord-and-tangent construction. [/definition] The examples above show that $E(\mathbb Q)$ is closed under addition, because every slope and coordinate expression uses rational field operations. After closure, the next structural question is whether repeated addition of a point can return to $O$, since these finite-order points are the first part of the group that can often be determined exactly. [definition: Torsion Point] Let $E$ be an elliptic curve over a field $k$. A point $P \in E(k)$ is a torsion point if there exists $n \in \mathbb N$ such that \begin{align*} nP=O. \end{align*} The smallest such $n$ is the order of $P$. [/definition] Torsion is visible in the finite-field example because every point in a finite group has finite order. Over $\mathbb Q$, torsion is much more rigid: later arithmetic tools show that only certain finite groups can occur. [example: Detecting A Two-Torsion Point] On a short Weierstrass curve, the inverse of an affine point is \begin{align*} -(x,y)=(x,-y). \end{align*} Thus an affine point $P=(x,y)$ satisfies $P=-P$ exactly when \begin{align*} (x,y)=(x,-y), \end{align*} which is equivalent to \begin{align*} y=-y. \end{align*} Over a field of characteristic not equal to $2$, this is equivalent to \begin{align*} 2y=0, \end{align*} and hence to \begin{align*} y=0. \end{align*} For $E:y^2=x^3-x+1$ over $\mathbb Q$, a nonzero affine point of order $2$ would therefore have the form $(x,0)$. Substituting $y=0$ into the equation gives \begin{align*} 0^2=x^3-x+1, \end{align*} so \begin{align*} x^3-x+1=0. \end{align*} If a rational number $x=m/n$ in lowest terms were a root, then the rational [root test](/theorems/175) applied to the monic polynomial $x^3-x+1$ would force $x$ to divide the constant term $1$, so the only possible rational roots are \begin{align*} x=1 \quad \text{or} \quad x=-1. \end{align*} Checking both candidates, \begin{align*} 1^3-1+1=1 \end{align*} and \begin{align*} (-1)^3-(-1)+1=-1+1+1=1. \end{align*} Neither value is $0$, so $x^3-x+1$ has no rational root. Therefore $E(\mathbb Q)$ has no affine point $(x,0)$, and hence no rational point of order $2$. Over $\mathbb F_5$, the point $(3,0)$ lies on the reduced curve because \begin{align*} 0^2\equiv 0 \pmod 5 \end{align*} and \begin{align*} 3^3-3+1=27-3+1=25\equiv 0 \pmod 5. \end{align*} Its inverse is \begin{align*} -(3,0)=(3,-0)=(3,0), \end{align*} so \begin{align*} (3,0)+(3,0)=O. \end{align*} Since $(3,0)\ne O$, the point $(3,0)$ has order $2$ in $E(\mathbb F_5)$. [/example] Reduction modulo primes is the next computational doorway. A rational curve with integral coefficients can be viewed modulo $p$ as long as the reduced discriminant is nonzero. [definition: Good Reduction For A Short Weierstrass Model] Let $E:y^2=x^3+ax+b$ with $a,b \in \mathbb Z$, and let $p \ge 5$ be prime. The model has good reduction at $p$ if \begin{align*} 4a^3+27b^2 \not\equiv 0 \pmod p. \end{align*} [/definition] For the worked curve the discriminant factor is $23$, so every prime $p \ge 5$ with $p \ne 23$ gives a nonsingular reduced curve. The finite group $E(\mathbb F_p)$ then becomes a computable shadow of the rational group. [remark: From Reduction To Descent] Reduction maps, torsion constraints, and height functions are the arithmetic refinements of the elementary computations in this course. Descent methods use auxiliary maps from $E(\mathbb Q)$ to more manageable algebraic data, then combine local information from several completions or reductions. The chord-and-tangent law remains the underlying operation throughout. [/remark] The practical workflow from the course can now be summarised without separating geometry from computation. The preceding chapters have treated projective closure, smoothness, exceptional cases, and arithmetic examples separately; the final remark packages them into the order in which they should be used in future calculations. [remark: Verification Workflow For A Short Weierstrass Curve] Let $k$ be a field with $\textrm{char}(k) \ne 2,3$, and let $E:y^2=x^3+ax+b$ with $a,b \in k$. First homogenise the equation to obtain $Y^2Z=X^3+aXZ^2+bZ^3$ and identify $O=[0:1:0]$ as the point at infinity. Then check $4a^3+27b^2 \ne 0$, which is exactly the smoothness criterion for this model. Smoothness supplies the tangent line needed for doubling and prevents the singular failures seen in nodal or cuspidal cubics. After that, use the exceptional-case checklist before applying the affine addition formulas, so that identity, inverse, secant, tangent, and vertical tangent cases are handled in the correct order. [/remark] The course therefore closes where it began: with a line meeting a cubic in three points. The difference is that the missing point at infinity, the smoothness hypothesis, and the exceptional cases have now been incorporated into a single reliable arithmetic machine. ## References - Internal Androma references: - [Group](/page/Group), for the abstract group structure underlying the chord-and-tangent construction. - [Cambridge IA Groups](/page/Cambridge%20IA%20Groups), for the basic language of identities, inverses, cyclic subgroups, and torsion. - [Cambridge II Algebraic Geometry](/page/Cambridge%20II%20Algebraic%20Geometry), for projective curves, tangent lines, and intersection-theoretic background. - [Diophantine Equations](/page/Diophantine%20Equations), for the arithmetic setting of rational points. - [Collinearity and the Group Law](/theorems/2191), for a formal internal theorem connecting collinearity with the elliptic-curve group law. - J. Silverman and J. Tate, *Rational Points on Elliptic Curves*. - J. H. Silverman, *The Arithmetic of Elliptic Curves*. - L. C. Washington, *Elliptic Curves: Number Theory and Cryptography*.