View source for Elliptic curve

{{short description|Algebraic curve}}
{{Distinguish|Ellipse}}
{{Redirect|Elliptic Equation|the type of partial differential equation|Elliptic partial differential equation}}
[[Image:EllipticCurveCatalog.svg|right|thumb|392px|A catalog of elliptic curves. The region shown is {{math|''x'', ''y'' ∈ [−3,3]}}.<br>(For {{math|1=(''a'', ''b'') = (0, 0)}} the function is not smooth and therefore not an elliptic curve.)]]
{{Group theory sidebar |Algebraic}}

In [[mathematics]], an '''elliptic curve''' is a [[Smoothness|smooth]], [[Projective variety|projective]], [[algebraic curve]] of [[Genus of an algebraic curve|genus]] one, on which there is a specified point {{mvar|O}}. An elliptic curve is defined over a [[field (mathematics)|field]] {{mvar|K}} and describes points in {{math|''K''{{isup|2}}}}, the [[Cartesian product]] of {{mvar|K}} with itself. If the field's [[characteristic (algebra)|characteristic]] is different from 2 and 3, then the curve can be described as a [[plane algebraic curve]] which consists of solutions {{math|(''x'', ''y'')}} for:

:<math>y^2 = x^3 + ax + b</math>

for some coefficients {{mvar|a}} and {{mvar|b}} in {{mvar|K}}. The curve is required to be [[Singular point of a curve|non-singular]], which means that the curve has no [[cusp (singularity)|cusps]] or [[Self-intersection|self-intersections]]. (This is equivalent to the condition {{math|4''a''<sup>3</sup> + 27''b''<sup>2</sup> ≠ 0}}, that is, being [[square-free polynomial|square-free]] in {{mvar|x}}.)  It is always understood that the curve is really sitting in the [[projective plane]], with the point {{mvar|O}} being the unique [[point at infinity]]. Many sources define an elliptic curve to be simply a curve given by an equation of this form. (When the [[coefficient field]] has characteristic 2 or 3, the above equation is not quite general enough to include all non-singular [[cubic plane curve|cubic curves]]; see {{section link|#Elliptic curves over a general field}} below.)

An elliptic curve is an [[abelian variety]] – that is, it has a group law defined algebraically, with respect to which it is an [[abelian group]] – and {{mvar|O}} serves as the identity element.

If {{math|1=''y''<sup>2</sup> = ''P''(''x'')}}, where {{mvar|P}} is any polynomial of degree three in {{mvar|x}} with no repeated roots, the solution set is a nonsingular plane curve of [[genus (mathematics)|genus]] one, an elliptic curve. If {{mvar|P}} has degree four and is [[Square-free polynomial|square-free]] this equation again describes a plane curve of genus one; however, it has no natural choice of identity element. More generally, any algebraic curve of genus one, for example the intersection of two [[quadric (algebraic geometry)|quadric surfaces]] embedded in three-dimensional projective space, is called an elliptic curve, provided that it is equipped with a marked point to act as the identity.

Using the theory of [[elliptic function]]s, it can be shown that elliptic curves defined over the [[complex number]]s correspond to embeddings of the [[torus]] into the [[complex projective plane]]. The torus is also an [[abelian group]], and this correspondence is also a [[group isomorphism]].

Elliptic curves are especially important in [[number theory]], and constitute a major area of current research; for example, they were used in [[Wiles's proof of Fermat's Last Theorem|Andrew Wiles's proof of Fermat's Last Theorem]]. They also find applications in [[elliptic curve cryptography]] (ECC) and [[integer factorization]].

An elliptic curve is ''not'' an [[ellipse]] in the sense of a projective conic, which has genus zero: see [[elliptic integral]] for the origin of the term. However, there is a natural representation of real elliptic curves with shape invariant {{math|''j'' ≥ 1}} as ellipses in the hyperbolic plane <math>\mathbb{H}^2</math>. Specifically, the intersections of the Minkowski hyperboloid with quadric surfaces characterized by a certain constant-angle property produce the Steiner ellipses in <math>\mathbb{H}^2</math> (generated by orientation-preserving collineations). Further, the orthogonal trajectories of these ellipses comprise the elliptic curves with {{math|''j'' ≤ 1}}, and any ellipse in <math>\mathbb{H}^2</math> described as a locus relative to two foci is uniquely the elliptic curve sum of two Steiner ellipses, obtained by adding the pairs of intersections on each orthogonal trajectory. Here, the vertex of the hyperboloid serves as the identity on each trajectory curve.<ref>{{Cite journal |last=Sarli |first=J. |date=2012 |title=Conics in the hyperbolic plane intrinsic to the collineation group |journal=J. Geom. |volume=103 |pages=131–148 |doi=10.1007/s00022-012-0115-5|s2cid=119588289 }}</ref>

[[Topologically]], a complex elliptic curve is a [[torus]], while a complex ellipse is a [[sphere]].

==Elliptic curves over the real numbers==
[[Image:ECClines-3.svg|frame|right|Graphs of curves {{math|1=''y''<sup>2</sup> = ''x''<sup>3</sup> − ''x''}} and {{math|1=''y''<sup>2</sup> = ''x''<sup>3</sup> − ''x'' + 1}}]]
Although the formal definition of an elliptic curve requires some background in [[algebraic geometry]], it is possible to describe some features of elliptic curves over the [[real number]]s using only introductory [[algebra]] and [[geometry]].

In this context, an elliptic curve is a [[plane curve]] defined by an equation of the form

:<math>y^2 = x^3 + ax + b</math>

after a linear change of variables ({{mvar|a}} and {{mvar|b}} are real numbers). This type of equation is called a Weierstrass equation, and said to be in Weierstrass form, or Weierstrass normal form.

The definition of elliptic curve also requires that the curve be [[Singular point of an algebraic variety|non-singular]]. Geometrically, this means that the graph has no [[cusp (singularity)|cusps]], self-intersections, or [[Isolated point|isolated points]]. Algebraically, this holds if and only if the [[discriminant]], <math>\Delta</math>, is not equal to zero.

: <math>\Delta = -16\left(4a^3 + 27b^2\right) \neq 0</math>

The discriminant is zero when <math>a=-3k^2, b=2k^3</math>.

(Although the factor −16 is irrelevant to whether or not the curve is non-singular, this definition of the discriminant is useful in a more advanced study of elliptic curves.)<ref>{{Harvard citations|author=Silverman|year=1986|nb=yes|loc=III.1 Weierstrass Equations (p.45)}}</ref>

The real graph of a non-singular curve has ''two'' components if its discriminant is positive, and ''one'' component if it is negative. For example, in the graphs shown in figure to the right, the discriminant in the first case is 64, and in the second case is −368. Following the convention at [[Conic_section#Discriminant]], ''elliptic'' curves require that the discriminant is negative.

==The group law==
When working in the [[projective plane]], the equation in [[homogeneous coordinates]] becomes :

:<math>\frac{Y^2}{Z^2} =
\frac{X^3}{Z^3}
+a\frac{X}{Z} + b</math>

This equation is not defined on the [[line at infinity]], but we can multiply by <math>Z^3</math> to get one that is :

:<math>ZY^2 = X^3 + aZ^2X + bZ^3</math>

This resulting equation is defined on the whole projective plane, and the curve it defines projects onto the elliptic curve of interest.  To find its intersection with the line at infinity, we can just posit <math>Z = 0</math>.  This implies <math>X^3 = 0</math>, which in a [[Field (mathematics)|field]] means <math>X = 0</math>.  <math>Y</math> on the other hand can take any value, and thus all triplets <math>(0,Y,0)</math> satisfy the equation.  In projective geometry this set is simply the point <math>O = [0:1:0]</math>, which is thus the unique intersection of the curve with the line at infinity.

Since the curve is smooth, hence [[Continuous function|continuous]], it can be shown that this point at infinity is the identity element of a [[Group (mathematics)|group]] structure whose operation is geometrically described as follows:

Since the curve is symmetric about the {{mvar|x}}-axis, given any point {{mvar|P}}, we can take {{math|−''P''}} to be the point opposite it. We then have <math> -O = O</math>, as <math>O</math> lies on the {{mvar|XZ}}-plane, so that <math>-O</math> is also the symmetrical of <math>O</math> about the origin, and thus represents the same projective point.

If {{mvar|P}} and {{mvar|Q}} are two points on the curve, then we can uniquely describe a third point {{math|''P'' + ''Q''}} in the following way. First, draw the line that intersects {{mvar|P}} and {{mvar|Q}}. This will generally intersect the cubic at a third point, {{mvar|R}}. We then take {{math|''P'' + ''Q''}} to be {{math|−''R''}}, the point opposite {{mvar|R}}.

This definition for addition works except in a few special cases related to the point at infinity and intersection multiplicity. The first is when one of the points is {{mvar|O}}. Here, we define {{math|1=''P'' + ''O'' = ''P'' = ''O'' + ''P''}}, making {{mvar|O}} the identity of the group. If {{math|1=''P'' = ''Q''}} we only have one point, thus we cannot define the line between them. In this case, we use the tangent line to the curve at this point as our line. In most cases, the tangent will intersect a second point {{mvar|R}} and we can take its opposite. If {{mvar|P}} and {{mvar|Q}} are opposites of each other, we define {{math|1=''P'' + ''Q'' = ''O''}}. Lastly,  If {{mvar|P}} is an [[inflection point]] (a point where the concavity of the curve changes), we take {{mvar|R}} to be {{mvar|P}} itself and {{math|''P'' + ''P''}} is simply the point opposite itself, i.e. itself.

<div class="center">
[[Image:ECClines.svg]]
</div>

Let {{mvar|K}} be a field over which the curve is defined (that is, the coefficients of the defining equation or equations of the curve are in {{mvar|K}}) and denote the curve by {{mvar|E}}. Then the {{mvar|K}}-[[rational point]]s of {{mvar|E}} are the points on {{mvar|E}} whose coordinates all lie in {{mvar|K}}, including the point at infinity. The set of {{mvar|K}}-rational points is denoted by {{math|''E''(''K'')}}.  {{math|''E''(''K'')}} is a group, because properties of polynomial equations show that if {{mvar|P}} is in {{math|''E''(''K'')}}, then {{math|−''P''}} is also in {{math|''E''(''K'')}}, and if two of {{mvar|P}}, {{mvar|Q}}, {{mvar|R}} are in {{math|''E''(''K'')}}, then so is the third.  Additionally, if {{mvar|K}} is a subfield of {{mvar|L}}, then {{math|''E''(''K'')}} is a [[subgroup]] of {{math|''E''(''L'')}}.

===Algebraic interpretation===

The above groups can be described algebraically as well as geometrically. Given the curve {{math|1=''y''<sup>2</sup> = ''x''<sup>3</sup> + ''bx'' + ''c''}} over the field {{mvar|K}} (whose [[Prime subfield|characteristic]] we assume to be neither 2 nor 3), and points {{math|1=''P'' = (''x<sub>P</sub>'', ''y<sub>P</sub>'')}} and {{math|1=''Q'' = (''x<sub>Q</sub>'', ''y<sub>Q</sub>'')}} on the curve, assume first that {{math|''x<sub>P</sub>'' ≠ ''x<sub>Q</sub>''}} (case ''1''). Let {{math|1=''y'' = ''sx'' + ''d''}} be the equation of the line that intersects {{mvar|P}} and {{mvar|Q}}, which has the following slope:

:<math>s = \frac{y_P - y_Q}{x_P - x_Q}</math>

The line equation and the curve equation intersect at the points {{mvar|x<sub>P</sub>}}, {{mvar|x<sub>Q</sub>}}, and {{mvar|x<sub>R</sub>}}, so the equations have identical {{mvar|y}} values at these values.

:<math>\left(s x + d\right)^2 = x^3 + bx + c</math>

which is equivalent to

:<math>x^3 - s^2 x^2 - 2sdx + bx + c - d^2 = 0</math>

Since {{mvar|x<sub>P</sub>}}, {{mvar|x<sub>Q</sub>}}, and {{mvar|x<sub>R</sub>}} are solutions, this equation has its roots at exactly the same {{mvar|x}} values as

:<math>(x - x_P) (x - x_Q) (x - x_R) = x^3 + (-x_P - x_Q - x_R) x^2 + (x_P x_Q + x_P x_R + x_Q x_R) x - x_P x_Q x_R </math>

and because both equations are cubics they must be the same polynomial up to a scalar. Then [[equating the coefficients]] of {{math|''x''<sup>2</sup>}} in both equations

:<math>-s^2 = (-x_P - x_Q - x_R)</math>

and solving for the unknown {{mvar|x<sub>R</sub>}}. 

:<math>x_R = s^2 - x_P - x_Q</math>

{{mvar|y<sub>R</sub>}} follows from the line equation

:<math>y_R = y_P - s(x_P - x_R)</math>

and this is an element of {{mvar|K}}, because {{mvar|s}} is.

If {{math|1=''x<sub>P</sub>'' = ''x<sub>Q</sub>''}}, then there are two options: if {{math|1=''y<sub>P</sub>'' = −''y<sub>Q</sub>''}} (case ''3''), including the case where {{math|1=''y<sub>P</sub>'' = ''y<sub>Q</sub>'' = 0}} (case ''4''), then the sum is defined as 0; thus, the inverse of each point on the curve is found by reflecting it across the {{mvar|x}}-axis.

If {{math|1=''y<sub>P</sub>'' = ''y<sub>Q</sub>'' ≠ 0}}, then {{math|1=''Q'' = ''P''}} and {{math|1=''R'' = (''x''<sub>''R''</sub>, ''y''<sub>''R''</sub>) = −(''P'' + ''P'') = −2''P'' = −2''Q''}} (case ''2'' using {{mvar|P}} as {{mvar|R}}). The slope is given by the tangent to the curve at (''x''<sub>''P''</sub>, ''y''<sub>''P''</sub>).

<!-- As a reminder, R=-2P here, not 2P; it's the other point of intersection between the elliptic curve and the tangent line. The equation for y_R should be the same as above: y_R &= y_P - s(x_P - x_R). -->
:<math>\begin{align}
    s &= \frac{3{x_P}^2 + b}{2y_P}\\
  x_R &= s^2 - 2x_P\\
  y_R &= y_P - s(x_P - x_R)
\end{align}</math>

A more general expression for <math>s</math> that works in both case 1 and case 2 is

:<math>s = \frac{{x_P}^2 + x_P x_Q + {x_Q}^2 + b}{y_P + y_Q}</math>

where equality to {{math|1={{sfrac|''y<sub>P</sub>'' − ''y<sub>Q</sub>''|''x<sub>P</sub>'' − ''x<sub>Q</sub>''}}}} relies on {{mvar|P}} and {{mvar|Q}} obeying {{math|1=''y''<sup>2</sup> = ''x''<sup>3</sup> + ''bx'' + ''c''}}.

===Non-Weierstrass curves===

For the curve {{math|1=''y''<sup>2</sup> = ''x''<sup>3</sup> + ''ax''<sup>2</sup>  + ''bx'' + ''c''}} (the general form of an elliptic curve with [[Prime subfield|characteristic]] 3), the formulas are similar, with {{math|1=''s'' = {{sfrac|''x<sub>P</sub>''<sup>2</sup> + ''x<sub>P</sub>'' ''x<sub>Q</sub>'' + ''x<sub>Q</sub>''<sup>2</sup> + ''ax<sub>P</sub>'' + ''ax<sub>Q</sub>'' + ''b''|''y<sub>P</sub>'' + ''y<sub>Q</sub>''}}}} and {{math|1=''x<sub>R</sub>'' = ''s''<sup>2</sup> − ''a'' − ''x<sub>P</sub>'' − ''x<sub>Q</sub>''}}.

For a general cubic curve not in Weierstrass normal form, we can still define a group structure by designating one of its nine inflection points as the identity {{mvar|O}}. In the projective plane, each line will intersect a cubic at three points when accounting for multiplicity. For a point {{mvar|P}}, {{math|−''P''}} is defined as the unique third point on the line passing through {{mvar|O}} and {{mvar|P}}. Then, for any {{mvar|P}} and {{mvar|Q}}, {{math|''P'' + ''Q''}} is defined as {{math|−''R''}} where {{mvar|R}} is the unique third point on the line containing {{mvar|P}} and {{mvar|Q}}.

For an example of the group law over a non-Weierstrass curve, see [[Hessian_form_of_an_elliptic_curve#Group_law|Hessian curves]].

==Elliptic curves over the rational numbers==
A curve ''E'' defined over the field of rational numbers is also defined over the field of real numbers. Therefore, the law of addition (of points with real coordinates) by the tangent and secant method can be applied to ''E''. The explicit formulae show that the sum of two points ''P'' and ''Q'' with rational coordinates has again rational coordinates, since the line joining ''P'' and ''Q'' has rational coefficients.<!--Il en est de même pour le symétrique par rapport à l'axe des abscisses d'un point à coordonnées rationnelles.--> This way, one shows that the set of rational points of ''E'' forms a subgroup of the group of real points of ''E''.

===Integral points===
This section is concerned with points ''P'' = (''x'', ''y'') of ''E'' such that ''x'' is an integer.

For example, the equation ''y''<sup>2</sup> = ''x''<sup>3</sup> + 17 has eight integral solutions with ''y''&nbsp;> 0:<ref>T. Nagell, ''L'analyse indéterminée de degré supérieur'', Mémorial des sciences mathématiques 39, Paris, Gauthier-Villars, 1929, pp. 56–59.</ref><ref>OEIS: https://oeis.org/A029728</ref>
:(''x'', ''y'') = (−2, 3), (−1, 4), (2, 5), (4, 9), (8, 23), (43, 282), (52, 375), ({{val|5234}}, {{val|378661}}).

As another example, [[Stella octangula number|Ljunggren's equation]], a curve whose Weierstrass form is ''y''<sup>2</sup> = ''x''<sup>3</sup> − 2''x'', has only four solutions with ''y''&nbsp;≥ 0 :<ref>{{citation |hdl=10871/8323 |first=Samir |last=Siksek |type=Ph.D. thesis |publisher=University of Exeter |year=1995 |title=Descents on Curves of Genus 1 |pages=16–17 |postscript=. }}</ref>
:(''x'', ''y'') = (0, 0), (−1, 1), (2, 2), (338, {{val|6214}}).

===The structure of rational points===
Rational points can be constructed by the method of tangents and secants detailed [[#The group law|above]], starting with a ''finite'' number of rational points. More precisely<ref>{{Harvard citations|author=Silverman|year=1986|nb=yes|loc=Theorem 4.1}}</ref> the [[Mordell–Weil theorem]] states that the group ''E''('''Q''') is a [[finitely generated group|finitely generated]] (abelian) group. By the [[fundamental theorem of finitely generated abelian groups]] it is therefore a finite direct sum of copies of '''Z''' and finite cyclic groups.

The proof of the theorem<ref>{{Harvard citations|author=Silverman|year=1986|nb=yes|loc=pp. 199–205}}</ref> involves two parts. The first part shows that for any integer ''m''&nbsp;>&nbsp;1, the [[quotient group]] ''E''('''Q''')/''mE''('''Q''') is finite (this is the weak Mordell–Weil theorem). Second, introducing a [[height function]] ''h'' on the rational points ''E''('''Q''') defined by ''h''(''P''<sub>0</sub>) = 0 and {{math|''h''(''P'') {{=}} log max({{pipe}}''p''{{pipe}}, {{pipe}}''q''{{pipe}})}} if ''P'' (unequal to the point at infinity ''P''<sub>0</sub>) has as [[abscissa]] the rational number ''x'' = ''p''/''q'' (with [[coprime]] ''p'' and ''q''). This height function ''h'' has the property that ''h''(''mP'') grows roughly like the square of ''m''. Moreover, only finitely many rational points with height smaller than any constant exist on ''E''.

The proof of the theorem is thus a variant of the method of [[infinite descent]]<ref>See also {{cite journal
| last1=Cassels | first1=J. W. S. | authorlink1=J. W. S. Cassels
| title=Mordell's Finite Basis Theorem Revisited
| date=1986
| journal=[[Mathematical Proceedings of the Cambridge Philosophical Society]]
| volume=100
| issue=1
| pages=31–41
| doi=10.1017/S0305004100065841| bibcode=1986MPCPS.100...31C }} and the comment of A. Weil on the genesis of his work: A. Weil, ''Collected Papers'', vol. 1, 520–521.</ref> and relies on the repeated application of [[Euclidean algorithm|Euclidean division]]s on ''E'': let ''P'' ∈ ''E''('''Q''') be a rational point on the curve, writing ''P'' as the sum 2''P''<sub>1</sub> + ''Q''<sub>1</sub> where ''Q''<sub>1</sub> is a fixed representant of ''P'' in ''E''('''Q''')/2''E''('''Q'''), the height of ''P''<sub>1</sub> is about {{sfrac|1|4}} of the one of ''P'' (more generally, replacing 2 by any ''m'' > 1, and {{sfrac|1|4}} by {{sfrac|1|''m''<sup>2</sup>}}). Redoing the same with ''P''<sub>1</sub>, that is to say ''P''<sub>1</sub> = 2''P''<sub>2</sub> + ''Q''<sub>2</sub>, then ''P''<sub>2</sub> = 2''P''<sub>3</sub> + ''Q''<sub>3</sub>, etc. finally expresses ''P'' as an integral linear combination of points ''Q<sub>i</sub>'' and of points whose height is bounded by a fixed constant chosen in advance: by the weak Mordell–Weil theorem and the second property of the height function ''P'' is thus expressed as an integral linear combination of a finite number of fixed points. 

The theorem however doesn't provide a method to determine any representatives of ''E''('''Q''')/''mE''('''Q''').

The [[Rank of an abelian group|rank]] of ''E''('''Q'''), that is the number of copies of '''Z''' in ''E''('''Q''') or, equivalently, the number of independent points of infinite order, is called the ''rank'' of ''E''. The [[Birch and Swinnerton-Dyer conjecture]] is concerned with determining the rank. One conjectures that it can be arbitrarily large, even if only examples with relatively small rank are known. The elliptic curve with the currently largest exactly-known rank is
:''y''<sup>2</sup> + ''xy'' + ''y'' = ''x''<sup>3</sup> − ''x''<sup>2</sup> − {{gaps|244|537|673|336|319|601|463|803|487|168|961|769|270|757|573|821|859|853|707}}''x'' + {{gaps|961|710|182|053|183|034|546|222|979|258|806|817|743|270|682|028|964|434|238|957|830|989|898|438|151|121|499|931}}

It has rank 20, found by [[Noam Elkies]] and Zev Klagsbrun in 2020. Curves of rank higher than 20 have been known since 1994, with lower bounds on their ranks ranging from 21 to 29, but their exact ranks are not known and in particular it is not proven which of them have higher rank than the others or which is the true "current champion".<ref>{{cite web|url=http://web.math.pmf.unizg.hr/~duje/tors/rankhist.html|title=History of elliptic curves rank records|last=Dujella|first=Andrej|author-link=Andrej Dujella|publisher = University of Zagreb}}</ref>

As for the groups constituting the [[torsion subgroup]] of ''E''('''Q'''), the following is known:<ref>{{Harvard citations|author=Silverman|year=1986|nb=yes|loc=Theorem 7.5}}</ref> the torsion subgroup of ''E''('''Q''') is one of the 15 following groups ([[Mazur's torsion theorem|a theorem]] due to [[Barry Mazur]]): '''Z'''/''N'''''Z''' for ''N'' = 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, or 12, or '''Z'''/2'''Z''' × '''Z'''/2''N'''''Z''' with ''N'' = 1, 2, 3, 4. Examples for every case are known. Moreover, elliptic curves whose Mordell–Weil groups over '''Q''' have the same torsion groups belong to a parametrized family.<ref>{{Harvard citations|author=Silverman|year=1986|nb=yes|loc=Remark 7.8 in Ch. VIII}}</ref>

===The Birch and Swinnerton-Dyer conjecture===
{{Main|Birch and Swinnerton-Dyer conjecture}}
The ''Birch and Swinnerton-Dyer conjecture'' (BSD) is one of the [[Millennium problem]]s of the [[Clay Mathematics Institute]]. The conjecture relies on analytic and arithmetic objects defined by the elliptic curve in question.

At the analytic side, an important ingredient is a function of a complex variable, ''L'', the [[Hasse–Weil zeta function]] of ''E'' over '''Q'''. This function is a variant of the [[Riemann zeta function]] and [[Dirichlet L-function]]s. It is defined as an [[Euler product]], with one factor for every [[prime number]] ''p''.

For a curve ''E'' over '''Q''' given by a minimal equation
:<math>y^2 + a_1xy + a_3y = x^3 + a_2x^2 + a_4x + a_6</math>

with integral coefficients <math>a_i</math>, reducing the coefficients [[Modular arithmetic|modulo]] ''p'' defines an elliptic curve over the [[finite field]] '''F'''<sub>''p''</sub> (except for a finite number of primes ''p'', where the reduced curve has a [[Mathematical singularity|singularity]] and thus fails to be elliptic, in which case ''E'' is said to be of [[bad reduction]] at ''p'').

The zeta function of an elliptic curve over a finite field '''F'''<sub>''p''</sub> is, in some sense, a [[generating function]] assembling the information of the number of points of ''E'' with values in the finite [[field extension]]s '''F'''<sub>''p<sup>n</sup>''</sub> of '''F'''<sub>''p''</sub>. It is given by<ref>The definition is formal, the exponential of this [[power series]] without constant term denotes the usual development.</ref>
:<math>Z(E(\mathbf{F}_p), T) = \exp\left(\sum_{n=1}^\infty \# \left[E({\mathbf F}_{p^n})\right]\frac{T^n}{n}\right)</math>

The interior sum of the exponential resembles the development of the [[logarithm]] and, in fact, the so-defined zeta function is a [[rational function]] in ''T'':
:<math>Z(E(\mathbf{F}_p), T) = \frac{1 - a_pT + pT^2}{(1 - T)(1 - pT)},</math>
where the 'trace of Frobenius' term<ref>see for example {{cite web |title=An Introduction to the Theory of Elliptic Curves |first=Joseph H. |last=Silverman |date=2006 |work=Summer School on Computational Number Theory and Applications to Cryptography |publisher=University of Wyoming |url=https://www.math.brown.edu/~jhs/Presentations/WyomingEllipticCurve.pdf }}</ref> <math>a_p</math> is defined to be the difference between the 'expected' number <math>p+1</math> and the number of points on the elliptic curve <math>E</math> over <math>\mathbb{F}_p</math>, viz.
:<math>
a_p = p + 1 - \#E(\mathbb{F}_p)
</math>

or equivalently,

:<math>
\#E(\mathbb{F}_p) = p + 1 - a_p
</math>.

We may define the same quantities and functions over an arbitrary finite field of characteristic <math>p</math>, with <math>q = p^n</math> replacing <math>p</math> everywhere.

The [[Hasse–Weil zeta function#Example:_elliptic_curve_over_Q|L-function]] of ''E'' over '''Q''' is then defined by collecting this information together, for all primes ''p''. It is defined by

:<math>L(E(\mathbf{Q}), s) = \prod_{p\not\mid N} \left(1 - a_p p^{-s} + p^{1 - 2s}\right)^{-1} \cdot \prod_{p\mid N} \left(1 - a_p p^{-s}\right)^{-1}</math>

where ''N'' is the [[Conductor_of_an_elliptic_curve|conductor]] of ''E'', i.e. the product of primes with bad reduction <math>(\Delta (E\mod p)=0</math>),<ref>{{cite web | url=https://www.lmfdb.org/knowledge/show/ec.bad_reduction | title=LMFDB - Bad reduction of an elliptic curve at a prime (Reviewed) }}</ref> in which case ''a<sub>p</sub>'' is defined differently from the method above: see Silverman (1986) below.

For example <math>E:y^2=x^3+14x+19</math> has bad reduction at ''17'', because <math>E\mod17:y^2=x^3-3x+2</math> has <math>\Delta=0</math>.

This product [[absolute convergence|converges]] for Re(''s'') > 3/2 only. Hasse's conjecture affirms that the ''L''-function admits an [[analytic continuation]] to the whole complex plane and satisfies a [[functional equation]] relating, for any ''s'', ''L''(''E'', ''s'') to ''L''(''E'', 2 − ''s''). In 1999 this was shown to be a consequence of the proof of the Shimura–Taniyama–Weil conjecture, which asserts that every elliptic curve over ''Q'' is a [[modular curve]], which implies that its ''L''-function is the ''L''-function of a [[modular form]] whose analytic continuation is known. One can therefore speak about the values of ''L''(''E'', ''s'') at any complex number ''s''.

At ''s=1'' (the conductor product can be discarded as it is finite), the L-function becomes

:<math>L(E(\mathbf{Q}), 1) = \prod_{p\not\mid N} \left(1 - a_p p^{-1} + p^{-1}\right)^{-1} = \prod_{p\not\mid N} \frac{p}{p - a_p + 1} = \prod_{p\not\mid N}\frac{p}{\#E(\mathbb{F}_p)}</math>

The ''Birch and Swinnerton-Dyer conjecture'' relates the arithmetic of the curve to the behaviour of this ''L''-function at ''s''&nbsp;= 1. It affirms that the vanishing order of the ''L''-function at ''s''&nbsp;= 1 equals the rank of ''E'' and predicts the leading term of the Laurent series of ''L''(''E'', ''s'') at that point in terms of several quantities attached to the elliptic curve.

Much like the [[Riemann hypothesis]], the truth of the BSD conjecture would have multiple consequences, including the following two:
* A [[congruent number]] is defined as an odd [[square-free integer]] ''n'' which is the area of a right triangle with rational side lengths. It is known that ''n'' is a congruent number if and only if the elliptic curve <math>y^2 = x^3 - n^2x</math> has a rational point of infinite order; assuming BSD, this is equivalent to its ''L''-function having a zero at ''s''&nbsp;= 1. [[Tunnell's theorem|Tunnell]] has shown a related result: assuming BSD, ''n'' is a congruent number if and only if the number of triplets of integers (''x'', ''y'', ''z'') satisfying <math>2x^2 + y^2 + 8z^2 = n</math> is twice the number of triples satisfying <math>2x^2 + y^2 + 32z^2 = n</math>. The interest in this statement is that the condition is easy to check.<ref>{{Harvard citations|author=Koblitz|year=1993|nb=yes}}</ref>
*In a different direction, certain analytic methods allow for an estimation of the order of zero in the center of the [[critical strip]] for certain ''L''-functions. Admitting BSD, these estimations correspond to information about the rank of families of the corresponding elliptic curves. For example: assuming the [[generalized Riemann hypothesis]] and BSD, the average rank of curves given by <math>y^2=x^3+ax+b</math> is smaller than 2.<ref>{{cite journal |first=D. R. |last=Heath-Brown |title=The Average Analytic Rank of Elliptic Curves |journal=Duke Mathematical Journal |volume=122 |issue=3 |pages=591–623 |year=2004 |doi=10.1215/S0012-7094-04-12235-3 |arxiv=math/0305114 |s2cid=15216987 }}</ref>

==Elliptic curves over finite fields==
{{Further|Arithmetic of abelian varieties}}

[[File:Elliptic curve on Z61.svg|thumb|right|upright=1.2|Set of affine points of elliptic curve ''y''<sup>2</sup> = ''x''<sup>3</sup> − ''x'' over finite field '''F'''<sub>61</sub>.]]

Let ''K'' = '''F'''<sub>''q''</sub> be the [[finite field]] with ''q'' elements and ''E'' an elliptic curve defined over ''K''. While the precise [[Counting points on elliptic curves|number of rational points of an elliptic curve]] ''E'' over ''K'' is in general difficult to compute, [[Hasse's theorem on elliptic curves]] gives the following inequality:
:<math>|\# E(K) - (q + 1)| \le 2\sqrt{q}</math>

In other words, the number of points on the curve grows proportionally to the number of elements in the field. This fact can be understood and proven with the help of some general theory; see [[local zeta function]] and [[étale cohomology#An_application_to_curves|étale cohomology]] for example.

[[File:Elliptic curve on Z89.svg|thumb|upright=1.2|Set of affine points of elliptic curve ''y''<sup>2</sup> = ''x''<sup>3</sup> − ''x'' over finite field '''F'''<sub>89</sub>.]]

The set of points ''E''('''F'''<sub>''q''</sub>) is a finite abelian group. It is always cyclic or the product of two cyclic groups. For example,<ref>See {{Harvard citations|last=Koblitz|year=1994|nb=yes|loc=p. 158}}</ref> the curve defined by
:<math>y^2 = x^3 - x</math>

over '''F'''<sub>71</sub> has 72 points (71 [[Affine space#Affine coordinates|affine points]] including (0,0) and one [[point at infinity]]) over this field, whose group structure is given by '''Z'''/2'''Z''' × '''Z'''/36'''Z'''. The number of points on a specific curve can be computed with [[Schoof's algorithm]].

[[File:Elliptic curve on Z71.svg|thumb|right|upright=1.5|Set of affine points of elliptic curve ''y''<sup>2</sup> = ''x''<sup>3</sup> − ''x'' over finite field '''F'''<sub>71</sub>.]]

Studying the curve over the [[field extension]]s of '''F'''<sub>''q''</sub> is facilitated by the introduction of the local zeta function of ''E'' over '''F'''<sub>''q''</sub>, defined by a generating series (also see above)
:<math>Z(E(K), T) = \exp \left(\sum_{n=1}^{\infty} \# \left[E(K_n)\right] {T^n\over n} \right)</math>

where the field ''K<sub>n</sub>'' is the (unique up to isomorphism) extension of ''K'' = '''F'''<sub>''q''</sub> of degree ''n'' (that is,  <math>K_n=F_{q^n}</math>).

The zeta function is a rational function in ''T''. To see this, consider the integer <math>a</math> such that

:<math>\#E(K) = 1 - a + q</math>

There is a complex number <math>\alpha</math> such that

:<math> 1 - a + q = (1 - \alpha)(1 - \bar\alpha)</math>

where <math>\bar\alpha</math> is the [[complex conjugate]], and so we have

:<math>\alpha+\bar\alpha = a</math>
:<math>\alpha\bar\alpha = q</math>

We choose <math>\alpha</math> so that its [[absolute value]] is <math>\sqrt{q}</math>, that is <math>\alpha = q^{\frac12}e^{i\theta}, \bar\alpha = q^{\frac12}e^{-i\theta}</math>, and that <math>\cos \theta=\frac{a}{2\sqrt q}</math>. Note that <math>|a|\le2\sqrt{q}</math>.

<math>\alpha</math> can then be used in the local zeta function as its values when raised to the various powers of {{math|n}} can be said to reasonably approximate the behaviour of <math>a_n</math>, in that

:<math>\#E(K_n) = 1 - a_n + q^n</math>

Using the [[List_of_logarithmic_identities#Series_representation|Taylor series for the natural logarithm]],

:<math>
\begin{alignat}{2} 
Z(E(K),T) & = \exp \left(\sum_{n=1}^{\infty}  \left(1 - \alpha^n - \bar\alpha^n + q^n\right){T^n\over n} \right) \\ 
& = \exp \left(\sum_{n=1}^{\infty} {T^n\over n} - \sum_{n=1}^{\infty}\alpha^n{T^n\over n} - \sum_{n=1}^{\infty}\bar\alpha^n{T^n\over n} + \sum_{n=1}^{\infty}q^n{T^n\over n} \right) \\ 
& = \exp \left(-\ln(1-T) + \ln(1-\alpha T) + \ln(1-\bar\alpha T) - \ln(1-qT) \right) \\ 
& = \exp \left(\ln\frac{(1-\alpha T)(1-\bar\alpha T)}{(1-T)(1-qT)} \right) \\ 
& =\frac{(1-\alpha T)(1-\bar\alpha T)}{(1-T)(1-qT)} \\ 
\end{alignat}
</math>

Then <math>(1 - \alpha T)(1 - \bar\alpha T)  = 1 - aT + qT^2</math>, so finally

:<math>Z(E(K), T) = \frac{1 - aT + qT^2}{(1 - qT)(1 - T)}</math>

For example,<ref>{{Harvard citations|last=Koblitz|year=1994|nb=yes|loc=p. 160}}</ref> the zeta function of ''E'' : ''y''<sup>2</sup> + ''y'' = ''x''<sup>3</sup> over the field '''F'''<sub>2</sub> is given by
:<math>\frac{1 + 2T^2}{(1 - T)(1 - 2T)}</math>

which follows from:
:<math> \left| E(\mathbf{F}_{2^r}) \right| = \begin{cases} 2^r + 1 & r \text{ odd} \\ 2^r + 1 - 2(-2)^{\frac{r}{2}} & r \text{ even} \end{cases} </math>

as <math>q=2</math>, then <math>|E|=2^1+1=3=1-a+2</math>, so <math>a=0</math>.

The [[functional equation]] is

:<math>Z \left(E(K), \frac{1}{qT} \right) = \frac{1 - a\frac{1}{qT} + q\left(\frac{1}{qT}\right)^2}{(1 - q\frac{1}{qT})(1 - \frac{1}{qT})}= \frac{q^2T^2 - aqT + q}{(qT - q)(qT - 1)} = Z(E(K), T)</math>

As we are only interested in the behaviour of <math>a_n</math>, we can use a reduced zeta function

:<math>Z(a, T) = \exp \left(\sum_{n=1}^{\infty} -a_n {T^n\over n} \right)</math>

:<math>Z(a, T) = \exp \left(\sum_{n=1}^{\infty} -\alpha^n {T^n\over n} - \bar\alpha^n {T^n\over n} \right)</math>

and so

:<math>Z(a, T) = \exp \left(\ln(1-\alpha T) + \ln(1-\bar\alpha T)\right)</math>

which leads directly to the local L-functions

:<math>L(E(K), T) = 1 - aT + qT^2</math>

The [[Sato–Tate conjecture]] is a statement about how the error term <math>2\sqrt{q}</math> in Hasse's theorem varies with the different primes ''q'', if an elliptic curve E over '''Q''' is reduced modulo q. It was proven (for almost all such curves) in 2006 due to the results of Taylor, Harris and Shepherd-Barron,<ref>{{cite journal |first1=M. |last1=Harris |first2=N. |last2=Shepherd-Barron |first3=R. |last3=Taylor |title=A family of Calabi–Yau varieties and potential automorphy |journal=[[Annals of Mathematics]] |volume=171 |issue=2 |pages=779–813|year=2010 |doi=10.4007/annals.2010.171.779 |doi-access=free }}</ref> and says that the error terms are equidistributed.

Elliptic curves over finite fields are notably applied in [[cryptography]] and for the [[factorization]] of large integers. These algorithms often make use of the group structure on the points of ''E''. Algorithms that are applicable to general groups, for example the group of invertible elements in finite fields, '''F'''*<sub>''q''</sub>, can thus be applied to the group of points on an elliptic curve. For example, the [[discrete logarithm]] is such an algorithm. The interest in this is that choosing an elliptic curve allows for more flexibility than choosing ''q'' (and thus the group of units in '''F'''<sub>''q''</sub>). Also, the group structure of elliptic curves is generally more complicated.

==Elliptic curves over a general field==
Elliptic curves can be defined over any [[field (mathematics)|field]] ''K''; the formal definition of an elliptic curve is a non-singular projective algebraic curve over ''K'' with [[genus (mathematics)|genus]] 1 and endowed with a distinguished point defined over ''K''.

If the [[characteristic (algebra)|characteristic]] of ''K'' is neither 2 nor 3, then every elliptic curve over ''K'' can be written in the form
:<math>y^2 = x^3 - px - q</math>

after a linear change of variables. Here ''p'' and ''q'' are elements of ''K'' such that the right hand side polynomial ''x''<sup>3</sup> − ''px'' − ''q'' does not have any double roots. If the characteristic is 2 or 3, then more terms need to be kept: in characteristic 3, the most general equation is of the form
:<math>y^2 = 4x^3 + b_2 x^2 + 2b_4 x + b_6</math>

for arbitrary constants ''b''<sub>2</sub>, ''b''<sub>4</sub>, ''b''<sub>6</sub> such that the polynomial on the right-hand side has distinct roots (the notation is chosen for historical reasons).  In characteristic 2, even this much is not possible, and the most general equation is

:<math>y^2 + a_1 xy + a_3 y = x^3 + a_2 x^2 + a_4 x + a_6</math>

provided that the variety it defines is non-singular. If characteristic were not an obstruction, each equation would reduce to the previous ones by a suitable linear change of variables.

One typically takes the curve to be the set of all points (''x'',''y'') which satisfy the above equation and such that both ''x'' and ''y'' are elements of the [[algebraic closure]] of ''K''. Points of the curve whose coordinates both belong to ''K'' are called '''''K''-rational points'''.

Many of the preceding results remain valid when the field of definition of ''E'' is a [[number field]] ''K'', that is to say, a finite [[field extension]] of '''Q'''. In particular, the group ''E(K)'' of ''K''-rational points of an elliptic curve ''E'' defined over ''K'' is finitely generated, which generalizes the Mordell–Weil theorem above. A theorem due to [[Loïc Merel]] shows that for a given integer ''d'', there are ([[up to]] isomorphism) only finitely many groups that can occur as the torsion groups of ''E''(''K'') for an elliptic curve defined over a number field ''K'' of [[degree of a field extension|degree]] ''d''. More precisely,<ref>{{cite journal |first=L. |last=Merel | author-link=Loïc Merel | title=Bornes pour la torsion des courbes elliptiques sur les corps de nombres | language=fr | journal=[[Inventiones Mathematicae]] |volume=124 |year=1996 |issue=1–3 |pages=437–449 | zbl=0936.11037 | doi=10.1007/s002220050059 |bibcode=1996InMat.124..437M |s2cid=3590991 }}</ref> there is a number ''B''(''d'') such that for any elliptic curve ''E'' defined over a number field ''K'' of degree ''d'', any torsion point of ''E''(''K'') is of [[order (group theory)|order]] less than ''B''(''d''). The theorem is effective: for ''d'' > 1, if a torsion point is of order ''p'', with ''p'' prime, then
:<math>p < d^{3d^2}</math>

As for the integral points, Siegel's theorem generalizes to the following: Let ''E'' be an elliptic curve defined over a number field ''K'', ''x'' and ''y'' the Weierstrass coordinates. Then there are only finitely many points of ''E(K)'' whose ''x''-coordinate is in the [[ring of integers]] ''O''<sub>''K''</sub>.

The properties of the Hasse–Weil zeta function and the Birch and Swinnerton-Dyer conjecture can also be extended to this more general situation.

==Elliptic curves over the complex numbers==
{{Further|Complex multiplication}}
[[Image:Lattice torsion points.svg|right|thumb|upright=1.2|An elliptic curve over the complex numbers is obtained as a quotient of the complex plane by a lattice {{math|Λ}}, here spanned by two fundamental periods {{math|''ω''<sub>1</sub>}} and {{math|''ω''<sub>2</sub>}}. The four-torsion is also shown, corresponding to the lattice {{math|{{sfrac|1|4}}Λ}} containing {{math|Λ}}.]]
The formulation of elliptic curves as the embedding of a [[torus]] in the [[complex projective plane]] follows naturally from a curious property of [[Weierstrass's elliptic functions]].  These functions and their first derivative are related by the formula

:<math>\wp'(z)^2 = 4\wp(z)^3 -g_2\wp(z) - g_3</math>

Here, {{math|''g''<sub>2</sub>}} and {{math|''g''<sub>3</sub>}} are constants; {{math|℘(''z'')}} is the [[Weierstrass elliptic function]] and {{math|℘{{prime}}(''z'')}} its derivative. It should be clear that this relation is in the form of an elliptic curve (over the [[complex number]]s). The Weierstrass functions are doubly periodic; that is, they are [[fundamental pair of periods|periodic]] with respect to a [[Lattice_(group)|lattice]] {{math|Λ}}; in essence, the Weierstrass functions are naturally defined on a torus  {{math|1=''T'' = '''C'''/Λ}}. This torus may be embedded in the complex projective plane by means of the map

:<math>z \mapsto \left[1 : \wp(z) : \tfrac12\wp'(z)\right]</math>

This map is a [[group isomorphism]] of the torus (considered with its natural group structure) with the chord-and-tangent group law on the cubic curve which is the image of this map.  It is also an isomorphism of [[Riemann surface]]s from the torus to the cubic curve, so topologically, an elliptic curve is a torus.  If the lattice {{math|Λ}} is related by multiplication by a non-zero complex number {{mvar|c}} to a lattice {{math|''c''Λ}}, then the corresponding curves are isomorphic. Isomorphism classes of elliptic curves are specified by the [[j-invariant|{{mvar|j}}-invariant]].

The isomorphism classes can be understood in a simpler way as well. The constants {{math|''g''<sub>2</sub>}} and {{math|''g''<sub>3</sub>}}, called the [[j-invariant|modular invariant]]s, are uniquely determined by the lattice, that is, by the structure of the torus. However, all real polynomials factorize completely into linear factors over the complex numbers, since the field of complex numbers is the [[algebraic closure]] of the reals. So, the elliptic curve may be written as

:<math>y^2 = x(x - 1)(x - \lambda)</math>

One finds that
:<math>\begin{align}
g_2' &= \frac{\sqrt[3]4}{3} \left(\lambda^2 - \lambda + 1\right) \\[4pt]
g_3' &= \frac{1}{27} (\lambda + 1)\left(2\lambda^2 - 5\lambda + 2\right)
\end{align}</math>

and

:<math>j(\tau) = 1728\frac{{g_2'}^3}{{g_2'}^3 - 27{g_3'}^2} = 256\frac{ \left(\lambda^2 - \lambda + 1\right)^3}{\lambda^2\left(\lambda - 1\right)^2}</math>

with [[J-invariant|{{mvar|j}}-invariant]] {{math|''j''(''τ'')}} and {{math|''λ''(''τ'')}} is sometimes called the [[modular lambda function]]. For example, let {{math|1=''τ'' = 2''i''}}, then {{math|1=''λ''(2''i'') = (−1 + {{sqrt|2}})<sup>4</sup>}} which implies {{math|''g''{{prime}}<sub>2</sub>}}, {{math|''g''{{prime}}<sub>3</sub>}}, and therefore {{math|''g''{{prime}}<sub>2</sub>{{su|p=3}} − 27''g''{{prime}}<sub>3</sub>{{su|p=2}}}} of the formula above are all [[algebraic numbers]] if {{mvar|τ}} involves an [[imaginary quadratic field]]. In fact, it yields the integer {{math|1=''j''(2''i'') = 66<sup>3</sup> = {{val|287496}}}}. 

In contrast, the [[modular discriminant]]
:<math>\Delta(\tau) = g_2(\tau)^3 - 27g_3(\tau)^2 = (2\pi)^{12}\,\eta^{24}(\tau)</math>
is generally a [[transcendental number]]. In particular, the value of the [[Dedekind_eta_function#Special_values|Dedekind eta function]] {{math|''η''(2''i'')}} is

:<math>\eta(2i)=\frac{\Gamma \left(\frac14\right)}{2^\frac{11}{8} \pi^\frac34}</math>

Note that the [[uniformization theorem]] implies that every [[Compact space|compact]] Riemann surface of genus one can be represented as a torus. This also allows an easy understanding of the [[torsion subgroup|torsion points]] on an elliptic curve: if the lattice {{math|Λ}} is spanned by the fundamental periods {{math|''ω''<sub>1</sub>}} and {{math|''ω''<sub>2</sub>}}, then the {{mvar|n}}-torsion points are the (equivalence classes of) points of the form
:<math> \frac{a}{n} \omega_1 + \frac{b}{n} \omega_2</math>

for integers {{mvar|a}} and {{mvar|b}} in the range {{math|0 ≤ (''a'', ''b'') < ''n''}}.

If

:<math>E : y^2=4(x-e_1)(x-e_2)(x-e_3)</math>

is an elliptic curve over the complex numbers and

:<math>a_0=\sqrt{e_1-e_3}, \qquad b_0=\sqrt{e_1-e_2}, \qquad c_0=\sqrt{e_2-e_3},</math>

then a pair of fundamental periods of {{mvar|E}} can be calculated very rapidly by

:<math>\omega_1=\frac{\pi}{\operatorname{M}(a_0,b_0)}, \qquad \omega_2=\frac{\pi}{\operatorname{M}(c_0,ib_0)}</math>

{{math|M(''w'', ''z'')}} is the [[arithmetic–geometric mean]] of {{mvar|w}} and {{mvar|z}}. At each step of the arithmetic–geometric mean iteration, the signs of {{mvar|z<sub>n</sub>}} arising from the ambiguity of geometric mean iterations are chosen such that {{math|{{abs|''w<sub>n</sub>'' − ''z<sub>n</sub>''}} ≤ {{abs|''w<sub>n</sub>'' + ''z<sub>n</sub>''}}}} where {{mvar|w<sub>n</sub>}} and {{mvar|z<sub>n</sub>}} denote the individual arithmetic mean and geometric mean iterations of {{mvar|w}} and {{mvar|z}}, respectively. When {{math|1={{abs|''w<sub>n</sub>'' − ''z<sub>n</sub>''}} = {{abs|''w<sub>n</sub>'' + ''z<sub>n</sub>''}}}}, there is an additional condition that {{math|Im<big>(</big>{{sfrac|''z<sub>n</sub>''|''w<sub>n</sub>''}}<big>)</big> > 0}}.<ref>{{Cite web|url=http://etheses.whiterose.ac.uk/20887/1/Final.pdf|title=The Arithmetic-Geometric Mean and Periods of Curves of Genus 1 and 2|last=Wing Tat Chow|first=Rudolf|date=2018|website=White Rose eTheses Online|page=12}}</ref>

Over the complex numbers, every elliptic curve has nine [[inflection point]]s. Every line through two of these points also passes through a third inflection point; the nine points and 12 lines formed in this way form a realization of the [[Hesse configuration]].

==The Dual Isogeny==

Given an [[isogeny]]

:<math> f : E \rightarrow E' </math>

of elliptic curves of degree <math>n</math>, the '''dual isogeny''' is an isogeny

:<math>\hat{f} : E' \rightarrow E</math>

of the same degree such that

:<math>f \circ \hat{f} = [n].</math>

Here <math>[n]</math> denotes the multiplication-by-<math>n</math> isogeny  <math>e\mapsto ne</math> which has degree <math>n^2.</math>

===Construction of the Dual Isogeny===

Often only the existence of a dual isogeny is needed, but it can be explicitly given as the composition

:<math> E'\rightarrow \mbox{Div}^0(E')\to\mbox{Div}^0(E)\rightarrow E\,</math>

where  <math>{\mathrm{Div}}^0</math> is the group of [[Divisor (algebraic geometry)|divisors]] of degree 0. To do this, we need maps  <math>E \rightarrow {\mbox{Div}}^0(E)</math> given by  <math>P\to P - O</math> where <math>O</math> is the neutral point of <math>E</math> and  <math>{\mbox{Div}}^0(E) \rightarrow E\,</math> given by  <math>\sum n_P P \to \sum n_P P.</math>

To see that  <math>f \circ \hat{f} = [n]</math>, note that the original isogeny <math>f</math> can be written as a composite

:<math> E \rightarrow {\mbox{Div}}^0(E)\to {\mbox{Div}}^0(E')\to E'\,</math>

and that since <math>f</math> is [[Wikt:finite|finite]] of degree <math>n</math>, <math>f_* f^*</math> is multiplication by <math>n</math> on  <math>{\mbox{Div}}^0(E').</math>

Alternatively, we can use the smaller [[Picard group]]  <math>{\mathrm{Pic}}^0</math>, a [[factor group|quotient]] of  <math>{\mbox{Div}}^0.</math> The map  <math>E\rightarrow {\mbox{Div}}^0(E)</math> descends to an [[isomorphism]],  <math>E\to{\mbox{Pic}}^0(E).</math> The dual isogeny is

:<math> E' \to {\mbox{Pic}}^0(E')\to {\mbox{Pic}}^0(E)\to E\,</math>

Note that the relation  <math>f \circ \hat{f} = [n]</math> also implies the conjugate relation  <math>\hat{f} \circ f = [n].</math> Indeed, let  <math>\phi = \hat{f} \circ f.</math> Then  <math>\phi \circ \hat{f} = \hat{f} \circ [n] = [n] \circ \hat{f}.</math> But <math>\hat{f}</math> is [[surjection|surjective]], so we must have  <math>\phi = [n].</math>

==Algorithms that use elliptic curves==
Elliptic curves over finite fields are used in some [[cryptography|cryptographic]] applications as well as for [[integer factorization]]. Typically, the general idea in these applications is that a known [[algorithm]] which makes use of certain finite groups is rewritten to use the groups of rational points of elliptic curves. For more see also:
* [[Elliptic curve cryptography]]
** [[Elliptic-curve Diffie–Hellman]] key exchange (ECDH)
** [[Supersingular isogeny key exchange]]
** [[Elliptic Curve Digital Signature Algorithm|Elliptic curve digital signature algorithm]] (ECDSA)
** [[EdDSA]] digital signature algorithm
** [[Dual EC DRBG]] random number generator
* [[Lenstra elliptic-curve factorization]]
* [[Elliptic curve primality proving]]

==Alternative representations of elliptic curves==
* [[Hessian form of an elliptic curve|Hessian curve]]
* [[Edwards curve]]
* [[Twists of curves|Twisted curve]]
* [[Twisted Hessian curves|Twisted Hessian curve]]
* [[Twisted Edwards curve]]
* [[Doubling-oriented Doche–Icart–Kohel curve]]
* [[Tripling-oriented Doche–Icart–Kohel curve]]
* [[Jacobian curve]]
* [[Montgomery curve]]

==See also==
* [[Arithmetic dynamics]]
* [[Elliptic algebra]]
* [[Elliptic surface]]
* [[Comparison of computer algebra systems]]
* [[Isogeny]]
* [[j-line]]
* [[Level structure (algebraic geometry)]]
* [[Modularity theorem]]
* [[Moduli stack of elliptic curves]]
* [[Nagell–Lutz theorem]]
* [[Riemann–Hurwitz formula]]
* [[Wiles's proof of Fermat's Last Theorem]]

==Notes==
{{Reflist|30em}}

==References==
[[Serge Lang]], in the introduction to the book cited below, stated that "It is possible to write endlessly on elliptic curves. (This is not a threat.)" The following short list is thus at best a guide to the vast expository literature available on the theoretical, algorithmic, and cryptographic aspects of elliptic curves.
* {{cite book
 | author = Ian Blake |author2=Gadiel Seroussi |author3=Nigel Smart | author-link3=Nigel Smart (cryptographer)
 | year = 2000
 | title = Elliptic Curves in Cryptography
 | series=LMS Lecture Notes
 | publisher = Cambridge University Press
 | isbn=0-521-65374-6
 }}
* {{cite journal |title=Three Fermat Trails to Elliptic Curves |first=Ezra |last=Brown | author-link1=Ezra Brown |s2cid=5591395 |journal=The College Mathematics Journal |volume=31 |issue=3 |year=2000 |pages=162–172 |doi=10.1080/07468342.2000.11974137 }}, winner of the MAA writing prize the [[George Pólya Award]]
* {{cite book
 | author = Richard Crandall
 |author2=Carl Pomerance 
 | year = 2001
 | title = Prime Numbers: A Computational Perspective
 | publisher = Springer-Verlag
 | edition = 1st
 | isbn=0-387-94777-9
 | chapter = Chapter 7: Elliptic Curve Arithmetic
 | pages = 285–352
 |author2-link=Carl Pomerance 
 |author-link=Richard Crandall 
 }}
* {{cite book
 | first=John | last=Cremona
 | year = 1997 | edition=2nd
 | title = Algorithms for Modular Elliptic Curves
 | publisher = Cambridge University Press
 | url = http://www.warwick.ac.uk/staff/J.E.Cremona//book/fulltext/index.html
 | isbn=0-521-59820-6
 }}
*{{cite book
 |    author = Darrel Hankerson, [[Alfred Menezes]] and [[Scott Vanstone]]
 |      year = 2004
 |     title = Guide to Elliptic Curve Cryptography
 | publisher = [[Springer Science+Business Media|Springer]]
 |        isbn = 0-387-95273-X
 |       url = http://www.cacr.math.uwaterloo.ca/ecc/
 }}
* {{Hardy and Wright}}  Chapter XXV
* {{Cite book | last1=Hellegouarch | first1=Yves | title=Invitation aux mathématiques de Fermat-Wiles | publisher=Dunod | location=Paris | isbn=978-2-10-005508-1 | year=2001 }}
* {{cite book
 | first=Dale | last=Husemöller
 | author-link=Dale Husemoller
 | year = 2004
 | title = Elliptic Curves
 | edition = 2nd
 | series = [[Graduate Texts in Mathematics]]
 | volume=111
 | publisher = Springer
 | isbn=0-387-95490-2
 }}
* {{cite book
 | author1= Kenneth Ireland 
 |author2=Michael I. Rosen | author-link2 =Michael Rosen (mathematician)
 | year = 1998
 | title = A Classical Introduction to Modern Number Theory
 | volume=84 | series=Graduate Texts in Mathematics
 | publisher = Springer
 | edition = 2nd revised
 | chapter = Chapters 18 and 19
 | isbn=0-387-97329-X
 }}
* {{cite book
 | first = Anthony W. |last=Knapp | author-link = Anthony W. Knapp
 | orig-year = 1992 |year=2018 |url=https://books.google.com/books?id=Xf9ZDwAAQBAJ
 | title = Elliptic Curves
 | series = Mathematical Notes | volume=40
 | publisher = Princeton University Press |isbn=9780691186900
 }}
* {{Cite book
 | last = Koblitz |first=Neal | author-link = Neal Koblitz
 | year = 1993 | edition=2nd
 | title = Introduction to Elliptic Curves and Modular Forms
 | series = Graduate Texts in Mathematics
 | volume=97
 | publisher = Springer-Verlag
 | isbn=0-387-97966-2
 }}
* {{Cite book
 | last = Koblitz |first = Neal | author-link = Neal Koblitz
 | year = 1994
 | title = A Course in Number Theory and Cryptography
 | series = Graduate Texts in Mathematics
 | volume=114
 | publisher = Springer-Verlag
 | edition = 2nd
 | isbn = 0-387-94293-9
 | chapter = Chapter 6
 }}
* {{cite book | author=Serge Lang | author-link=Serge Lang | title=Elliptic curves: Diophantine analysis | series=Grundlehren der mathematischen Wissenschaften | volume=231 | publisher=Springer-Verlag | year=1978 | isbn=3-540-08489-4 }}
* {{cite book|author1=Henry McKean | author-link1=Henry McKean |author2=Victor Moll|author-link2=Victor Hugo Moll
 |title=Elliptic curves: function theory, geometry and arithmetic
 |publisher=Cambridge University Press|isbn=0-521-65817-9|year=1999}}
* {{cite book | author1=Ivan Niven | author-link1=Ivan M. Niven | author2=Herbert S. Zuckerman | author3=Hugh Montgomery | author-link3=Hugh Montgomery (mathematician) | title=An introduction to the theory of numbers | chapter-url=https://archive.org/details/introductiontoth0000nive | chapter-url-access=registration | edition=5th | publisher=John Wiley | year=1991 | isbn=0-471-54600-3 | chapter=Section 5.7}}
* {{Cite book
 | last = Silverman | first=Joseph H. | author-link=Joseph H. Silverman
 | year = 1986
 | title = The Arithmetic of Elliptic Curves
 | series = Graduate Texts in Mathematics
 | volume=106
 | publisher = Springer-Verlag
 | isbn=0-387-96203-4
 }}
* {{cite book
 | author = Joseph H. Silverman | author-link=Joseph H. Silverman
 | year = 1994
 | title = Advanced Topics in the Arithmetic of Elliptic Curves
 | series = Graduate Texts in Mathematics
 | volume=151
 | publisher = Springer-Verlag
 | isbn=0-387-94328-5
 }}
* {{cite book
 | author = Joseph H. Silverman | author-link=Joseph H. Silverman
 |author2=John Tate 
 | year = 1992
 | title = Rational Points on Elliptic Curves
 | publisher = Springer-Verlag
 | isbn=0-387-97825-9
 | author2-link=John Tate (mathematician)
 }}
* {{cite journal | author=John Tate | author-link=John Tate (mathematician) | title=The arithmetic of elliptic curves | journal=[[Inventiones Mathematicae]] | volume=23 | pages=179–206 | year=1974 | doi=10.1007/BF01389745 | issue=3–4 | bibcode=1974InMat..23..179T | s2cid=120008651 }}
* {{cite book
 | author = Lawrence Washington | author-link=Lawrence C. Washington | year = 2003
 | title = Elliptic Curves: Number Theory and Cryptography
 | url = https://archive.org/details/ellipticcurvesnu0000wash | url-access = registration | publisher = Chapman & Hall/CRC
 | isbn=1-58488-365-0
 }}

==External links==
{{commons}}
{{wikiquote}}
* [http://www.lmfdb.org/EllipticCurve/Q/ LMFDB: Database of Elliptic Curves over Q]
* {{springer|title=Elliptic curve|id=p/e035450}}
* {{MathWorld | title = Elliptic Curves | urlname = EllipticCurve }}
* [https://planetmath.org/thearithmeticofellipticcurves The Arithmetic of elliptic curves] from PlanetMath
* [http://danher6.100webspace.net/ecc#ER_interactivo Interactive elliptic curve over R] and [http://danher6.100webspace.net/ecc#EFp_interactivo over Zp] – web application that requires HTML5 capable browser.

{{Algebraic curves navbox}}

{{PlanetMath attribution|id=3206|title=Isogeny}}

{{Authority control}}

{{DEFAULTSORT:Elliptic Curve}}
[[Category:Elliptic curves| ]]
[[Category:Analytic number theory]]
[[Category:Group theory]]