Defining the Elliptic Curve

Elliptic Curves, Definition

Definition

Let F be a field, such as the reals, and let a and b be elements of F such that a and b are not both zero.  The elliptic curve G, determined by a and b, is the set of points x,y such that y2 = x3+ax+b.  (The formula is different when F has characteristic 2; we'll get to that later.)  I use the letter G because the points of the elliptic curve form a group; we'll see this in the next section.

In addition to the aforementioned relation on F cross F defined by our cubic equation, G includes ω, the point at infinity.  Note, ω is the last letter in the Greek alphabet, and is often used for the point at infinity - something beyond the natural world.  Thus ω is not in the xy plane.  Travel in any direction, out to infinity, and find the point ω.  If the xy plane curled up into a sphere, with the origin at the south pole, ω would be the north pole.  As we shall see, G needs ω to become a group.  In fact ω is the identity element.  For this reason, some books refer to this element as O or E.

Zeros

where does the curve cross the x axis?  In other words, when is y equal to 0?  This occurs whenever x is a root of our cubic polynomial p(x) = x3+ax+b.  This will depend on the field F.  For instance, if p is irreducible over F, then y is never equal to 0.

Suppose p has the root r with multiplicity 3.  Thus p = (x-r)3.  This produces the term 3rx2, which is not present in p.  Thus there is no triple root.

Actually we need to be a bit careful here.  If F has characteristic 3 then p could be x3-r3, which is (x-r)3.  If b is a cube in F, we require a to be nonzero.  Thus there is no triple root.  (A triple root would violate the group structure of G; that's why we try to avoid it.)

Other possibilities are three distinct roots, a root and a double root, or a root and an irreducible quadratic.

When p(x) is nonzero, and a square, x can be paired with y or -y.  Thus the elliptic curve is symmetric about y = 0.  Within the xy plane, the elliptic curve is reflected through the x axis, like a mirror.

The Reals

Set F = R1, the reals, and look at the elliptic curve in the xy plane.  When x approaches positive infinity, y increases as x to the 3/2 power.  The curve is more than linear, and less than quadratic.  It arcs upward towards infinity, while its lower half, reflected through the x axis, arcs downward towards -infinity.

As x goes negative, p(x) becomes negative, and y2 cannot equal p(x).  The curve has a definite left edge where p(x) first equals 0.

Here is a way to visualize the curve.  Graph y = p(x), keep only the sections that lie above the x axis, take the square root, and reflect the result through the x axis.  This is the elliptic curve in the xy plane.

Given a and b, when is p(x) ≥ 0?  If p is monotonically increasing, i.e. a ≥ 0, then p(x) remains positive after its first root, which is its only root.  Take the square root and the result is still monotonically increasing, up to infinity.

If p dips down to a local minimum before arcing back up to infinity, i.e. a < 0, it may cross the x axis at 1 2 or 3 places.  Use x3-3x+b as a model for p.  The local maximum is at -1 and the local minimum is at 1.  For large b, p crosses the x axis at a low negative number and remains positive thereafter.  It bends down and then up again near the y axis, then arcs on up to infinity.  Taking the square root doesn't change the overall shape of this cubic curve; it still has a dip just to the right of the y axis.

Next, lower the cubic curve until the local minimum rests on the x axis.  This is accomplished by setting b = 2.  Take the square root, and the elliptic curve still has one continuous branch, but its local minimum rests on the x axis at x = 1.  If we include the reflection, the two halves just kiss each other at x = 1.

Lower the curve some more, by setting b = 0, and there are two separate branches separated by a gap.  These range from -sqrt(3) to 0, and from +sqrt(3) to infinity.

Lower b down to -2, and the first branch shrinks to a point at x = -1, where the local maximum just touches the x axis from below.  Meantime the second branch has shifted to the right.  Smaller values of b cause the first branch to disappear completely, leaving only the second branch.

When y is positive, calculus can be used to differentiate the elliptic curve.  In fact it is infinitely differentiable.  The first derivative is p′/2y.  This will be 0 only when p′ is 0, in two places.  The elliptic curve has the same local maximum and minimum as p, assuming these points lie above the x axis.

When y = 0 we have to run the difference quotient by hand.  Let r be a root of p(x) and take the limit of sqrt(p(r+h)) over h.  Apply l'hopital's rule, giving p′(r+h) over 2sqrt(p(r+h)).  If we are not at a local maximum or minimum, the top is nonzero, and the bottom is zero, giving a ratio that approaches infinity.  The elliptic curve is perfectly vertical at this point.  If we include the reflection, the upper and lower curves meet at this point and form one large smooth branch.

On the other hand, r could be a double root, whence p attains a local minimum at r.  Go back to the difference quotient and square it.  Since square root is a continuous function, the square root of the limit gives the limit of the original difference quotient.  Evaluate p(r+h) over h2 using l'hopital's rule.  This gives p′(r+h) over 2h, which is still zero over zero, so apply the rule again, giving p′′(r+h) over 2.  The limit is 3r, hence the difference quotient approaches sqrt(3r).  There is no triple root over the reals, so 3r is nonzero.  This looks like a contradiction, a function with a local minimum and a nonzero derivative.  However, we must remember that the difference quotient was really a one sided limit.  To the right of r, when h was positive, we were evaluating sqrt(p(r+h)) over h.  To the left of r, the elliptic curve remains positive, hence the one sided limit has to be -sqrt(p(r+h)) over h (for h < 0).  The one sided derivatives are ħsqrt(3r).  Thus G strikes the x axis at an angle, and like a mirror, it bounces back up at the same angle, on its way to infinity.  So if G has a local minimum, the dip is smooth, unless it rests on the x axis, whence it makes a sharp point similar to the letter V.

An Additional Constraint

The sharp corner described above, that looks like the letter V, causes trouble; it messes up the structure of the group.  We can't allow this.  Include an additional constraint on a and b:

4a3 ≠ -27b2

This certainly prevents a and b from being 0, which was a previous requirement.  It also prevents a from being 0 when F has characteristic 3.  Therefore this constraint supersedes the prior constraints.

Suppose x is a root of p(x), and a root of p′(x).  In the reals, this creates the sharp corner on the x axis, which we don't want.  The roots of p′ are ħsqrt(-a/3).  One of these roots is also a root of p(x).  Substitute in for p and find this. 

(-a×sqrt(-a))/(3×sqrt(3)) + a×sqrt(-a/3) + b = 0

2/sqrt(27) × a×sqrt(-a) = -b

Square both sides and clear denominators to produce the forbidden relation on a and b.  Therefore there is no double root.

Again, we must treat characteristic 3 as a special case.  Note that 3x2+a = a, which is nonzero.  The "derivative" is always nonzero.  If p has a double root at r, the theory of formal derivatives tells us p′ would be divisible by x-r; yet p′ is a constant.  There is no double root.

The Complex Numbers

For any x, p(x) splits in the complex numbers.  In other words, p has 3 complex roots, and these roots are distinct, thanks to the constraint given above.  When x is one of these roots, y = 0.  Every other value of x produces two values of y, with ħ symmetry.  It would be difficult to describe this elliptic curve, a 2 dimensional surface swirling about in 4 space, so I'm not going to try.  We may investigate certain cross sections later, e.G. when x is real, or pure imaginary.

Subsequent sections will explore other fields as well, such as Q and Zp.