[proofplan] We check the chord-tangent addition law case by case, first recording the notation for inverses and nonzero field elements. The exceptional cases give $O$ or return one of the input points, hence remain $k$-rational. In the affine non-exceptional cases, the slope used in the chord or tangent formula is a quotient of elements of $k$ with nonzero denominator, so it lies in $k$; the coordinate formulas then use only field operations in $k$. To avoid a circular appeal to closure, we verify the on-curve condition by substituting the relevant line into the Weierstrass equation and using the cubic root relation. [/proofplan] [step:Handle sums involving the point at infinity] Let $P,Q \in E(k)$. Write $k^\times := k \setminus \{0\}$ for the multiplicative group of nonzero elements of $k$. For an affine point $R=(x,y) \in E(k)$, write $-R := (x,-y)$ for its inverse under the chord-tangent group law, and write $-O := O$. If $P = O$, then the identity rule for the elliptic curve group law gives $P+Q = Q \in E(k)$. If $Q = O$, then the identity rule gives $P+Q = P \in E(k)$. [guided] We first fix two pieces of notation used in the affine cases. The symbol $k^\times$ denotes $k \setminus \{0\}$, the set of nonzero elements of $k$; every element of $k^\times$ has an inverse in the field $k$. If $R=(x,y)$ is an affine point of $E(k)$, its inverse in the chord-tangent group law is denoted by $-R$ and is the affine point $(x,-y)$; also $-O=O$. Now consider the identity cases. The point $O$ is included in the definition of $E(k)$, and the chord-tangent law declares it to be the identity element. Thus no coordinate computation is needed in this case. If $P = O$, then \begin{align*} P+Q = O+Q = Q. \end{align*} Since $Q \in E(k)$ by hypothesis, this gives $P+Q \in E(k)$. Similarly, if $Q = O$, then \begin{align*} P+Q = P+O = P, \end{align*} and $P \in E(k)$ by hypothesis. [/guided] [/step] [step:Handle inverse affine pairs] Assume now that $P$ and $Q$ are affine points. Write \begin{align*} P &= (x_1,y_1), & Q &= (x_2,y_2), \end{align*} with $x_1,y_1,x_2,y_2 \in k$. If $x_1=x_2$ and $y_2=-y_1$, then $Q=-P$ by the inverse notation fixed above, and the exceptional rule for inverse points gives \begin{align*} P+Q = O. \end{align*} Since $O \in E(k)$ by definition, $P+Q \in E(k)$. [guided] Assume $P$ and $Q$ are affine, so there are elements $x_1,y_1,x_2,y_2 \in k$ such that \begin{align*} P &= (x_1,y_1), & Q &= (x_2,y_2). \end{align*} The exceptional inverse-pair case occurs exactly when the two affine points have the same $x$-coordinate and opposite $y$-coordinates, that is, when $x_1=x_2$ and $y_2=-y_1$. By the definition of the inverse notation, this means $Q=-P$. The chord-tangent group law then assigns the point at infinity as the sum: \begin{align*} P+Q = O. \end{align*} The point $O$ belongs to $E(k)$ by definition of the $k$-rational points of the projective Weierstrass curve. Hence $P+Q \in E(k)$ in this case. [/guided] [/step] [step:Compute the sum of distinct non-inverse affine points] Assume that $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ are affine points with $P \neq Q$ and $Q \neq -P$. Then $x_1 \neq x_2$; otherwise $x_1=x_2$ and the curve equation gives $y_1^2=y_2^2$, so $(y_2-y_1)(y_2+y_1)=0$, forcing either $P=Q$ or $Q=-P$. Hence $x_2-x_1 \in k^\times$. Define the chord line $\ell:k\to k$ and its slope $\lambda \in k$ by \begin{align*} \ell(t) &:= \lambda(t-x_1)+y_1, & \lambda &:= \frac{y_2-y_1}{x_2-x_1}. \end{align*} The chord-tangent addition formula for a nonsingular short Weierstrass curve in characteristic not equal to $2$ or $3$ defines $P+Q=(x_3,y_3)$ by \begin{align*} x_3 &:= \lambda^2-x_1-x_2, & y_3 &:= \lambda(x_1-x_3)-y_1. \end{align*} Because $k$ is closed under subtraction, multiplication, and inversion of nonzero elements, we have $\lambda,x_3,y_3 \in k$. It remains to verify that $(x_3,y_3)$ lies on $E$. Define the cubic polynomial $F:k\to k$ by \begin{align*} F(t) := \ell(t)^2-(t^3+at+b). \end{align*} Since $P,Q\in E(k)$ and $\ell(x_1)=y_1$, $\ell(x_2)=y_2$, we have $F(x_1)=F(x_2)=0$. Expanding $F(t)$ shows that its leading coefficient is $-1$ and its $t^2$-coefficient is $\lambda^2$. Therefore the sum of the three roots of $F$ in the [splitting field](/page/Splitting%20Field) of $F$ is $\lambda^2$. Since two roots are $x_1$ and $x_2$, the third root is $\lambda^2-x_1-x_2=x_3$. Thus $F(x_3)=0$, which gives \begin{align*} \ell(x_3)^2 = x_3^3+ax_3+b. \end{align*} By the definition of $y_3$, we have $y_3=-\ell(x_3)$, so $y_3^2=\ell(x_3)^2$. Hence \begin{align*} y_3^2 = x_3^3+ax_3+b. \end{align*} Therefore $(x_3,y_3)\in E(k)$, and hence $P+Q\in E(k)$. [guided] Assume $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ are affine, distinct, and not inverse to each other. First we must justify the denominator in the chord slope. If $x_1=x_2$, then the curve equation for both points gives \begin{align*} y_1^2 &= x_1^3+ax_1+b, & y_2^2 &= x_1^3+ax_1+b, \end{align*} so $y_1^2=y_2^2$. Since $\operatorname{char}(k)\neq 2$, this factors as \begin{align*} 0=y_2^2-y_1^2=(y_2-y_1)(y_2+y_1). \end{align*} Because $k$ is a field, either $y_2=y_1$, giving $P=Q$, or $y_2=-y_1$, giving $Q=-P$. Both alternatives contradict the hypotheses of this case. Hence $x_1\neq x_2$, and so $x_2-x_1\in k^\times$. Define the line through the two affine points as the map $\ell:k\to k$ by \begin{align*} \ell(t) &:= \lambda(t-x_1)+y_1, & \lambda &:= \frac{y_2-y_1}{x_2-x_1}. \end{align*} The denominator is in $k^\times$, and the numerator is in $k$, so $\lambda\in k$. The short Weierstrass chord formula, valid for the nonsingular curve in characteristic not equal to $2$ or $3$, defines the affine sum by \begin{align*} x_3 &:= \lambda^2-x_1-x_2, & y_3 &:= \lambda(x_1-x_3)-y_1. \end{align*} These formulas involve only addition, subtraction, multiplication, and inversion of the already nonzero element $x_2-x_1$, so $x_3,y_3\in k$. Now we verify the point is actually on the curve rather than appealing to closure. Substitute the line into the Weierstrass equation and define $F:k\to k$ by \begin{align*} F(t) := \ell(t)^2-(t^3+at+b). \end{align*} The zeros of $F$ are precisely the $t$-coordinates where the line $y=\ell(t)$ meets the affine cubic. Since $\ell(x_1)=y_1$ and $\ell(x_2)=y_2$, and since $P$ and $Q$ lie on $E$, we get $F(x_1)=F(x_2)=0$. Expanding the highest-degree terms gives \begin{align*} F(t) = -t^3+\lambda^2t^2+\text{terms of degree at most }1. \end{align*} Thus, in a splitting field of $F$, the sum of its three roots is $\lambda^2$. Two roots are $x_1$ and $x_2$, so the third root is \begin{align*} \lambda^2-x_1-x_2=x_3. \end{align*} Therefore $F(x_3)=0$, which means \begin{align*} \ell(x_3)^2=x_3^3+ax_3+b. \end{align*} Finally, the group law reflects the third intersection point across the $x$-axis. Algebraically, the definition of $y_3$ gives \begin{align*} y_3=\lambda(x_1-x_3)-y_1=-\bigl(\lambda(x_3-x_1)+y_1\bigr)=-\ell(x_3). \end{align*} Hence $y_3^2=\ell(x_3)^2$, and so \begin{align*} y_3^2=x_3^3+ax_3+b. \end{align*} We have proved both required facts: the coordinates $x_3,y_3$ lie in $k$, and the point satisfies the defining equation of $E$. Therefore $P+Q=(x_3,y_3)\in E(k)$. [/guided] [/step] [step:Compute the double of a non-vertical affine point] Assume that $P=Q=(x_1,y_1)$ is affine and that $y_1 \neq 0$. Since $\operatorname{char}(k)\neq 2$, the element $2y_1$ lies in $k^\times$. Define the tangent line $\ell:k\to k$ and tangent slope $\lambda\in k$ by \begin{align*} \ell(t) &:= \lambda(t-x_1)+y_1, & \lambda &:= \frac{3x_1^2+a}{2y_1}. \end{align*} The doubling formula for a nonsingular short Weierstrass curve in characteristic not equal to $2$ or $3$ defines $2P=(x_3,y_3)$ by \begin{align*} x_3 &:= \lambda^2-2x_1, & y_3 &:= \lambda(x_1-x_3)-y_1. \end{align*} Since $a,x_1,y_1\in k$ and $2y_1\in k^\times$, the field operations in these formulas give $\lambda,x_3,y_3\in k$. It remains to verify the curve equation. Define $F:k\to k$ by \begin{align*} F(t):=\ell(t)^2-(t^3+at+b). \end{align*} Since $P\in E(k)$, $F(x_1)=0$. The choice of $\lambda$ is exactly the condition that the line has the same derivative as the cubic at $x_1$: differentiating $F$ as a polynomial gives $F'(x_1)=2y_1\lambda-(3x_1^2+a)=0$. Hence $x_1$ is a double root of $F$. The polynomial $F$ has leading coefficient $-1$ and $t^2$-coefficient $\lambda^2$, so the sum of its three roots in the splitting field is $\lambda^2$. Counting $x_1$ twice, the third root is $\lambda^2-2x_1=x_3$. Thus $F(x_3)=0$, so \begin{align*} \ell(x_3)^2=x_3^3+ax_3+b. \end{align*} Since $y_3=-\ell(x_3)$ by the definition of $y_3$, we obtain \begin{align*} y_3^2=x_3^3+ax_3+b. \end{align*} Thus $2P=(x_3,y_3)\in E(k)$. [guided] Assume $P=Q=(x_1,y_1)$ is affine and $y_1\neq 0$. In the doubling case the chord is replaced by the tangent line. The denominator in the tangent slope is $2y_1$. Since $\operatorname{char}(k)\neq 2$ and $y_1\neq 0$, we have $2y_1\in k^\times$. Define the tangent line as the map $\ell:k\to k$ by \begin{align*} \ell(t) &:= \lambda(t-x_1)+y_1, & \lambda &:= \frac{3x_1^2+a}{2y_1}. \end{align*} The numerator $3x_1^2+a$ lies in $k$ and the denominator lies in $k^\times$, so $\lambda\in k$. The short Weierstrass doubling formula, valid for the nonsingular curve in characteristic not equal to $2$ or $3$, defines \begin{align*} x_3 &:= \lambda^2-2x_1, & y_3 &:= \lambda(x_1-x_3)-y_1. \end{align*} Since these expressions use only field operations in $k$, we get $x_3,y_3\in k$. We now verify the point lies on $E$. Substitute the tangent line into the curve equation and define $F:k\to k$ by \begin{align*} F(t):=\ell(t)^2-(t^3+at+b). \end{align*} Because $P$ lies on $E$ and $\ell(x_1)=y_1$, we have $F(x_1)=0$. The tangent condition says that $x_1$ is a double intersection. Algebraically, differentiate the polynomial $F$ and evaluate at $x_1$: \begin{align*} F'(x_1)=2\ell(x_1)\lambda-(3x_1^2+a)=2y_1\lambda-(3x_1^2+a)=0, \end{align*} where the last equality is exactly the definition of $\lambda$. Hence $x_1$ is a double root of $F$. The highest-degree terms of $F$ are \begin{align*} F(t)=-t^3+\lambda^2t^2+\text{terms of degree at most }1. \end{align*} Therefore the sum of the three roots of $F$, counted with multiplicity in a splitting field, is $\lambda^2$. Since $x_1$ occurs twice, the remaining root is \begin{align*} \lambda^2-2x_1=x_3. \end{align*} Thus $F(x_3)=0$, so \begin{align*} \ell(x_3)^2=x_3^3+ax_3+b. \end{align*} The doubling formula reflects this third intersection across the $x$-axis, and the coordinate definition gives \begin{align*} y_3=\lambda(x_1-x_3)-y_1=-\ell(x_3). \end{align*} Consequently \begin{align*} y_3^2=x_3^3+ax_3+b. \end{align*} Thus $2P=(x_3,y_3)$ has coordinates in $k$ and satisfies the equation of $E$, so $2P\in E(k)$. [/guided] [/step] [step:Handle doubling at a point with vertical tangent] It remains to consider the affine doubling case $P=Q=(x_1,y_1)$ with $y_1=0$. In this case $P=-P$ by the definition of the inverse of an affine point, so the exceptional inverse-pair rule gives \begin{align*} P+P = O. \end{align*} Since $O \in E(k)$, we obtain $P+P \in E(k)$. [guided] Assume $P=Q=(x_1,y_1)$ and $y_1=0$. The inverse of an affine point $(x,y)$ is $(x,-y)$, so here \begin{align*} -P=(x_1,-y_1)=(x_1,0)=P. \end{align*} Thus the doubling problem is also an inverse-pair problem. The exceptional rule in the chord-tangent group law gives \begin{align*} P+P=O. \end{align*} Since $O$ is one of the $k$-rational points of the projective curve, $P+P\in E(k)$. [/guided] [/step] [step:Conclude closure under addition] The preceding cases exhaust all possibilities for $P,Q \in E(k)$: one point may be $O$, the affine points may be inverse pairs, the affine points may be distinct non-inverse points, or the operation may be doubling. In every case the chord-tangent sum belongs to $E(k)$. Therefore, for all $P,Q \in E(k)$, one has $P+Q \in E(k)$. [guided] Let $P,Q\in E(k)$. If one of the two points is $O$, the identity case proves the sum is in $E(k)$. Otherwise both points are affine. For affine points, either they are inverse pairs, they are distinct and not inverse to each other, or they are equal. If they are inverse pairs, the exceptional inverse rule gives $O\in E(k)$. If they are distinct and not inverse, the chord calculation proves that the coordinate formula gives a point $(x_3,y_3)$ with $x_3,y_3\in k$ satisfying \begin{align*} y_3^2=x_3^3+ax_3+b. \end{align*} If they are equal, then either $y_1\neq 0$, where the tangent calculation proves $2P\in E(k)$, or $y_1=0$, where the vertical tangent case gives $2P=O\in E(k)$. These alternatives cover every pair $P,Q\in E(k)$, so in all cases $P+Q\in E(k)$. [/guided] [/step]