[proofplan] We first record the residual-intersection principle: a $k$-line meeting a cubic in two prescribed $k$-rational intersection points has a $k$-rational residual third point, with tangent and multiplicity cases included. This gives closure because both lines used in the chord-and-tangent construction are defined over $k$. The identity, inverse, and commutativity statements then follow directly from the symmetry of lines and from the flex condition $T_OE \cdot E = 3O$. [/proofplan] [step:Show that residual third intersections on $k$-lines are $k$-rational] Let $\bar{k}$ denote a fixed [algebraic closure](/page/Algebraic%20Closure) of $k$, and let $L \subset \mathbb{P}^2_k$ be a projective line defined over $k$. Since $E$ is a plane cubic and $L$ is not a component of $E$, the scheme-theoretic intersection $E \cap L$ base-changed to $\bar{k}$ is an effective degree-three divisor on $L_{\bar{k}} \cong \mathbb{P}^1_{\bar{k}}$, counted with intersection multiplicity. We use the following elementary residual principle. Suppose that, inside $E \cap L$, two intersection contributions are supported at $k$-rational points and are defined over $k$, for example two distinct points $A,B \in E(k)$, or a tangent contribution of multiplicity $2$ at a point $A \in E(k)$. Then the residual degree-one intersection point is also $k$-rational. Indeed, choose a $k$-isomorphism $\varphi: \mathbb{P}^1_k \to L$. Let $F \in k[X,Y,Z]$ be a homogeneous cubic equation for $E$. Pulling $F$ back along $\varphi$ gives a binary cubic form $\tilde{f} \in k[U,V]$, whose zero divisor on $\mathbb{P}^1_{\bar{k}}$ is exactly $\varphi^{-1}(E \cap L)$, with intersection multiplicities. If two prescribed intersection contributions are supported at $k$-rational points, then their corresponding degree-two effective sub-divisor of the zero divisor of $\tilde{f}$ is defined over $k$. Removing that sub-divisor leaves an effective degree-one divisor defined over $k$. To see this in coordinates, choose an affine chart of $\mathbb{P}^1_k$ containing the residual point; if the residual point lies on the chart at infinity, use the other standard affine chart. In that chart the form $\tilde{f}$ is represented by a polynomial $g \in k[t]$ after multiplying by the appropriate power of the homogenising coordinate. The two known rational contributions give two linear factors of $g$ over $k$, counted with multiplicity. Dividing by those factors leaves a degree-one polynomial over $k$, so its root is fixed by $\operatorname{Gal}(\bar{k}/k)$ and therefore represents a $k$-rational point of $\mathbb{P}^1_k$. Applying $\varphi$ shows that the residual point on $L$ lies in $L(k)$, hence in $E(k)$. The same argument applies when one of the prescribed contributions has multiplicity $2$, because tangency at a $k$-rational smooth point means that the corresponding root of the restricted cubic has multiplicity at least $2$ and the tangent line is defined over $k$. [guided] The point of this step is to justify the phrase “the third point is rational” without hiding the field argument. Let $\bar{k}$ denote the fixed algebraic closure of $k$, and let $L \subset \mathbb{P}^2_k$ be a line defined over $k$. Since $E$ is a plane cubic, restricting a homogeneous cubic equation of $E$ to $L$ produces a cubic equation on $L$. After identifying $L$ with $\mathbb{P}^1_k$ by a $k$-isomorphism $\varphi: \mathbb{P}^1_k \to L$, this restriction becomes a binary cubic form over $k$. Now suppose that two intersection contributions are already known to be supported at $k$-rational points. This includes the ordinary chord case, where $L$ passes through two distinct points $A,B \in E(k)$, and the tangent case, where $L=T_AE$ at a point $A \in E(k)$ and the intersection at $A$ has multiplicity at least $2$. In an affine coordinate $t$ on $\mathbb{P}^1_k$, the restricted cubic is represented by a polynomial $g \in k[t]$ of degree at most $3$, with the missing point at infinity handled by changing affine charts if necessary. The two prescribed rational intersection contributions give two linear factors of $g$ over $k$, counted with multiplicity. Therefore \begin{align*} g(t) = c(t-a)(t-b)(t-r) \end{align*} in $\bar{k}[t]$, where $c \in k^\times$ and $a,b \in k$ in the distinct-point case; in the tangent case one has $a=b \in k$. Because the quotient of $g(t)$ by the known linear factors lies in $k[t]$ and has degree $1$, its root $r$ lies in $k$. Thus the residual point of $E \cap L$ is fixed by every element of $\operatorname{Gal}(\bar{k}/k)$, equivalently it is a $k$-rational point. This is the exact algebraic reason that the chord-and-tangent construction does not leave $E(k)$. [/guided] [/step] [step:Apply the residual principle twice to prove closure] Let $P,Q \in E(k)$. Define $L_{P,Q} \subset \mathbb{P}^2_k$ to be the line through $P$ and $Q$ if $P \neq Q$, and the tangent line $T_PE$ if $P=Q$. In both cases $L_{P,Q}$ is defined over $k$: the line through two $k$-rational projective points has equations over $k$, and the tangent line at a nonsingular $k$-rational point is defined by the linear part of a cubic equation with coefficients in $k$. Let $R$ be the residual third intersection point of $L_{P,Q}$ with $E$. By the residual principle, $R \in E(k)$. Now define $M_{R,O} \subset \mathbb{P}^2_k$ to be the line through $R$ and $O$ if $R \neq O$, and the tangent line $T_OE$ if $R=O$. Since $R,O \in E(k)$, the line $M_{R,O}$ is defined over $k$. Applying the residual principle again, the residual third point of $M_{R,O} \cap E$ is $k$-rational. By definition this point is $P+Q$. Hence $P+Q \in E(k)$. [/step] [step:Verify that the flex point $O$ is the identity] Let $P \in E(k)$. If $P \neq O$, let $L_{P,O}$ be the $k$-line through $P$ and $O$, and let $R \in E(k)$ be the residual third intersection point of $L_{P,O}$ with $E$. In the construction of $P+O$, the second line is the line through $R$ and $O$. Since $P,R,O$ all lie on $L_{P,O}$, this second line is again $L_{P,O}$ unless $R=O$, in which case it is the tangent line at $O$ and the same multiplicity convention gives the same residual recovery. The degree-three intersection divisor on $L_{P,O}$ is \begin{align*} (E \cdot L_{P,O}) = P + O + R \end{align*} with multiplicities understood. Removing the contributions $R$ and $O$ in the second stage leaves $P$. Therefore \begin{align*} P+O = P. \end{align*} If $P=O$, then the first line is $T_OE$. Since $O$ is a flex point, the intersection divisor satisfies \begin{align*} (E \cdot T_OE) = 3O. \end{align*} Thus the residual point after the first step is $O$, and the second step again uses $T_OE$, whose residual point is $O$. Hence $O+O=O$. Therefore $P+O=P$ for every $P \in E(k)$. [/step] [step:Construct inverses using the line through $P$ and $O$] Let $P \in E(k)$. If $P=O$, then $O$ is its own inverse because $O+O=O$. Assume $P \neq O$. Let $L_{P,O}$ be the line through $P$ and $O$, and let $P' \in E(k)$ be the residual third intersection point of $L_{P,O}$ with $E$. The point $P'$ is $k$-rational by the residual principle. In the computation of $P+P'$, the first line is $L_{P,O}$ if $P' \neq P$. If $P'=P$, then the divisor $E \cdot L_{P,O}$ has intersection multiplicity at least $2$ at $P$, so $L_{P,O}$ is the tangent line $T_PE$; hence the tangent-line convention in the definition of $P+P'$ again selects the same line $L_{P,O}$. In either case, the residual third point of this first intersection is $O$. Therefore the second line is the tangent line $T_OE$. Since $O$ is a flex point, \begin{align*} (E \cdot T_OE) = 3O. \end{align*} The residual third point in this second step is $O$. Hence \begin{align*} P+P' = O. \end{align*} Thus every $P \in E(k)$ has an inverse. [/step] [step:Use symmetry of the first chord or tangent to prove commutativity] Let $P,Q \in E(k)$. If $P \neq Q$, the line through $P$ and $Q$ is the same line as the line through $Q$ and $P$: \begin{align*} L_{P,Q} = L_{Q,P}. \end{align*} Hence the residual third point $R$ obtained in the first stage is the same for $P+Q$ and $Q+P$. The second stage then uses the same line through $R$ and $O$, or the same tangent line $T_OE$ if $R=O$, so the final residual point is the same. Therefore \begin{align*} P+Q = Q+P. \end{align*} If $P=Q$, both expressions are identical by definition. Hence the operation is commutative on $E(k)$. [/step]