[proofplan] We first verify that the projective Weierstrass cubic is geometrically nonsingular, using the discriminant hypothesis and the assumptions $p \neq 2,3$. This makes the chord-and-tangent construction legitimate at every point of the curve. We then check that the addition formulas produce $\mathbb{F}_p$-rational points, identify the point at infinity and vertical reflection as the identity and inverse operations, and use the algebraic associativity theorem for nonsingular plane cubics to obtain associativity. Finiteness follows from the fact that the curve has only finitely many affine $\mathbb{F}_p$-points together with the single point at infinity. [/proofplan] [step:Verify that the projective cubic is geometrically nonsingular] Let $K := \overline{\mathbb{F}}_p$ denote an [algebraic closure](/page/Algebraic%20Closure) of $\mathbb{F}_p$, and regard $a,b \in \mathbb{F}_p$ as elements of $K$ through the natural field embedding $\mathbb{F}_p \subset K$. Define the homogeneous cubic map $F: K^3 \to K$ by \begin{align*} F(X,Y,Z)=Y^2Z-X^3-aXZ^2-bZ^3. \end{align*} This polynomial defines the projective cubic $E_K \subset \mathbb{P}^2_K$ obtained from $E$ by base change from $\mathbb{F}_p$ to $K$. Its partial derivatives are as follows: \begin{align*} \partial_X F=-3X^2-aZ^2. \end{align*} \begin{align*} \partial_Y F=2YZ. \end{align*} \begin{align*} \partial_Z F=Y^2-2aXZ-3bZ^2. \end{align*} Because $p \neq 2,3$, the scalars $2$ and $3$ are nonzero in $\mathbb{F}_p$. At the point $O=[0:1:0] \in \mathbb{P}^2_K$, one has \begin{align*} \partial_ZF(0,1,0)=1 \neq 0, \end{align*} so $O$ is nonsingular. If $[X:Y:Z] \in E_K$ has $Z=0$, then the equation $F=0$ gives $X^3=0$ in the field $K$, hence $X=0$, so this point is precisely $O$. It remains to check affine points over $K$. Let $P=[x:y:1] \in E_K$, so $x,y \in K$. If $P$ were singular, then \begin{align*} 2y=0. \end{align*} \begin{align*} -3x^2-a=0. \end{align*} \begin{align*} y^2=x^3+ax+b. \end{align*} Since $p \neq 2$, the scalar $2$ is nonzero in $K$, and therefore $y=0$. Define the polynomial maps $f: K \to K$ and $f': K \to K$ by \begin{align*} f(t)=t^3+at+b. \end{align*} \begin{align*} f'(t)=3t^2+a. \end{align*} Here $f'$ is the polynomial map induced by the formal derivative of $t^3+at+b \in \mathbb{F}_p[t]$, after extending coefficients from $\mathbb{F}_p$ to $K$. The equations above say that $x \in K$ is a common root of $f$ and $f'$. For a cubic of the form $t^3+at+b$ in characteristic different from $2$ and $3$, the discriminant is \begin{align*} \operatorname{disc}(t^3+at+b) = -4a^3-27b^2. \end{align*} The hypothesis $4a^3+27b^2 \neq 0$ in $\mathbb{F}_p$ is therefore equivalent to $\operatorname{disc}(f) \neq 0$, which is equivalent to $f$ having no repeated root over $K$, equivalently no common root in $K$ with its formal derivative $f'$. Hence no affine singular point exists over $K$. Therefore $E_K$ is nonsingular over $K$, so the original projective cubic is geometrically nonsingular over $\mathbb{F}_p$. [/step] [step:Check that the chord-and-tangent formulas remain inside $E(\mathbb{F}_p)$] Let $P,Q \in E(\mathbb{F}_p)$. If one of $P,Q$ is $O$, the chord-and-tangent law defines $P+O=O+P=P$, so the result lies in $E(\mathbb{F}_p)$. Now suppose $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ are affine points. If $x_1=x_2$ and $y_2=-y_1$, the line through $P$ and $Q$ is vertical, and the chord-and-tangent law defines \begin{align*} P+Q=O. \end{align*} This point belongs to $E(\mathbb{F}_p)$. In the remaining nonvertical cases, define the slope $m \in \mathbb{F}_p$ as follows. If $P \neq Q$, set \begin{align*} m=\frac{y_2-y_1}{x_2-x_1}. \end{align*} If $P=Q$ and $y_1 \neq 0$, set \begin{align*} m=\frac{3x_1^2+a}{2y_1}. \end{align*} The denominators are nonzero by the exclusion of the vertical case and by $p \neq 2$. Define $x_3 \in \mathbb{F}_p$ and $y_3 \in \mathbb{F}_p$ by \begin{align*} x_3=m^2-x_1-x_2. \end{align*} \begin{align*} y_3=m(x_1-x_3)-y_1. \end{align*} Since $m,x_1,x_2,y_1 \in \mathbb{F}_p$, we have $x_3,y_3 \in \mathbb{F}_p$. Define the affine line map $\ell: \mathbb{F}_p \to \mathbb{F}_p^2$ by \begin{align*} \ell(T)=(T,m(T-x_1)+y_1). \end{align*} Substituting this line into the Weierstrass equation gives the polynomial $G \in \mathbb{F}_p[T]$ defined by \begin{align*} G(T)=(m(T-x_1)+y_1)^2-(T^3+aT+b). \end{align*} The polynomial $G$ has degree $3$ and leading coefficient $-1$. In the secant case $P \neq Q$, the equalities $G(x_1)=G(x_2)=0$ follow from $P,Q \in E(\mathbb{F}_p)$. In the tangent case $P=Q$, the tangent slope formula gives $G(x_1)=0$ and $G'(x_1)=0$, so $x_1$ is counted as a double root. Since the coefficient of $T^2$ in $G$ is $m^2$, Vieta's relation gives the third root as \begin{align*} x_3=m^2-x_1-x_2, \end{align*} with $x_2=x_1$ in the tangent case. The corresponding third intersection point has ordinate $m(x_3-x_1)+y_1=-y_3$, and the sum is defined as its reflection across the $x$-axis: \begin{align*} P+Q=(x_3,y_3). \end{align*} Because the Weierstrass equation contains $Y$ only through $Y^2$, this reflected point also satisfies the equation. Therefore $P+Q \in E(\mathbb{F}_p)$. [guided] We need to check two things at once: the operation is defined over $\mathbb{F}_p$, and the output is again a point of the curve. The only possible obstruction in the affine formulas is division by zero. Let $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ be affine $\mathbb{F}_p$-points. If $x_1=x_2$ and $y_2=-y_1$, then the line through the two points is vertical. In the chord-and-tangent convention, the vertical case is assigned the sum \begin{align*} P+Q=O, \end{align*} and $O=[0:1:0]$ is already a point of $E(\mathbb{F}_p)$. If the line is not vertical, its slope belongs to $\mathbb{F}_p$. For two distinct points we define \begin{align*} m=\frac{y_2-y_1}{x_2-x_1}. \end{align*} Here $x_2-x_1 \neq 0$ because the case $x_1=x_2$ has already been treated. For doubling a point $P=(x_1,y_1)$ with $y_1 \neq 0$, the tangent slope is \begin{align*} m=\frac{3x_1^2+a}{2y_1}. \end{align*} The denominator is nonzero because $p \neq 2$ and $y_1 \neq 0$. If $P=Q$ and $y_1=0$, then the tangent is vertical, so this is again the vertical case and $2P=O$. In the nonvertical cases define $x_3 \in \mathbb{F}_p$ and $y_3 \in \mathbb{F}_p$ by \begin{align*} x_3=m^2-x_1-x_2. \end{align*} \begin{align*} y_3=m(x_1-x_3)-y_1. \end{align*} These are expressions formed from elements of $\mathbb{F}_p$ using addition, multiplication, subtraction, and division by nonzero elements; hence $x_3,y_3 \in \mathbb{F}_p$. It remains to see why $(x_3,y_3)$ lies on the curve. The line through $P$ and $Q$, or the tangent line at $P$ in the doubling case, has equation \begin{align*} Y=m(X-x_1)+y_1. \end{align*} Substituting this expression for $Y$ into the affine Weierstrass equation \begin{align*} Y^2=X^3+aX+b \end{align*} produces a cubic polynomial in $X$ over $\mathbb{F}_p$. The known intersection points contribute the roots $x_1$ and $x_2$, with $x_1$ counted twice in the tangent case. By Vieta's relation for the coefficient of $X^2$, the third root is \begin{align*} x_3=m^2-x_1-x_2. \end{align*} The corresponding third intersection point on the line has ordinate $m(x_3-x_1)+y_1=-y_3$. Reflecting this third point across the $x$-axis gives $(x_3,y_3)$, and because the equation contains $Y$ only through $Y^2$, this reflected point still satisfies the curve equation. Hence $P+Q=(x_3,y_3)$ belongs to $E(\mathbb{F}_p)$. [/guided] [/step] [step:Identify the identity element and inverses] The point at infinity is $O=[0:1:0]$, and the chord-and-tangent law is normalized so that \begin{align*} P+O=O+P=P \end{align*} for every $P \in E(\mathbb{F}_p)$. For an affine point $P=(x,y) \in E(\mathbb{F}_p)$, define \begin{align*} -P := (x,-y). \end{align*} Since $y^2=(-y)^2$, the point $-P$ also lies on $E(\mathbb{F}_p)$. The line through $P$ and $-P$ is the vertical line $X=x$, and the chord-and-tangent rule assigns the sum of the two finite intersection points on a vertical line to the point at infinity. Therefore \begin{align*} P+(-P)=O. \end{align*} Also $-O=O$ by definition. Hence $O$ is the identity element and the inverse of every affine point is $(x,-y)$. [/step] [step:Use the nonsingular plane cubic associativity theorem] Let $K := \overline{\mathbb{F}}_p$ be the algebraic closure defined above, and let $E_K \subset \mathbb{P}^2_K$ be the corresponding projective cubic. The line at infinity is the projective line $Z=0$. Its intersection with $E_K$ is determined by \begin{align*} 0=X^3, \end{align*} so it meets $E_K$ only at $O=[0:1:0]$, with intersection multiplicity $3$. Thus $O$ is a flex point of the nonsingular plane cubic $E_K$. Define $E(K)$ to be the set of $K$-rational projective points of $E_K$: \begin{align*} E(K)=\{[X:Y:Z] \in \mathbb{P}^2_K : F(X,Y,Z)=0\}. \end{align*} We now invoke the [Associativity of the Chord-and-Tangent Law on a Nonsingular Plane Cubic](/theorems/???) for the chord-and-tangent law on a nonsingular plane cubic with a chosen flex point as origin. It applies here because the first step proved that $E_K$ is nonsingular over the algebraically closed field $K$, and the computation above proved that $O$ is a flex. Therefore the operation on $E(K)$ satisfies \begin{align*} (P+Q)+R=P+(Q+R) \end{align*} for all $P,Q,R \in E(K)$. Since $E(\mathbb{F}_p) \subset E(K)$ and the addition formulas preserve $\mathbb{F}_p$-rationality, the same associativity identity holds for all $P,Q,R \in E(\mathbb{F}_p)$. [/step] [step:Prove commutativity from the symmetry of the chord construction] Let $P,Q \in E(\mathbb{F}_p)$. If either point is $O$, then \begin{align*} P+Q=Q+P \end{align*} by the identity property. If $P$ and $Q$ are affine and the line through them is vertical, then both $P+Q$ and $Q+P$ are $O$. In the nonvertical affine case, the line through $P$ and $Q$ is the same as the line through $Q$ and $P$. Therefore the third intersection point with the cubic is the same in both constructions, and the final reflection across the $x$-axis is also the same. Hence \begin{align*} P+Q=Q+P. \end{align*} Thus the operation is commutative. [/step] [step:Conclude that $E(\mathbb{F}_p)$ is a finite abelian group] The affine part of $E(\mathbb{F}_p)$ is contained in the finite set $\mathbb{F}_p^2$, and the projective curve has exactly one point with $Z=0$, namely $O$. Therefore \begin{align*} E(\mathbb{F}_p) \subset \mathbb{F}_p^2 \cup \{O\}, \end{align*} so $E(\mathbb{F}_p)$ is finite. The preceding steps prove closure, the identity law, existence of inverses, associativity, and commutativity for the chord-and-tangent operation. Therefore $E(\mathbb{F}_p)$ is a finite abelian group with identity $O$ and inverse formula \begin{align*} -(x,y)=(x,-y). \end{align*} This proves the theorem. [/step]