Elliptic Curves, From the Ground Up

A self-contained course built for the Map of Math project — designed so you can keep building deeper threads off of it instead of re-deriving the same starting points every time.

How to use this document

This is built as a single strand of your map, but a strand with joints — deliberate points where it connects to other territories (Galois theory, algebraic geometry, complex analysis, cryptography, number theory) that you can peel off and go deepen independently later without losing the thread back to elliptic curves. Section 6 gives you that map explicitly.

The structure: motivation, then history (so the ideas arrive in the order humans actually needed them, not the order textbooks compress them into), then an algebra refresher built specifically toward the one fact everything else depends on — that points on an elliptic curve form a group — then eight coursework modules, each with exposition, a fully worked example, and a graded problem set. A full answer key sits at the end so this is genuinely self-checkable. Work the problems before reading the answers; the value of “rigorously testing understanding” evaporates if you read ahead.

1. Motivation — why this object, specifically

Start with a question a bright teenager can understand and a research mathematician cannot fully answer: for a given cubic equation like $y^2 = x^3 - 2x + 1$, which points on it have both coordinates rational numbers, and how many are there?

That question sounds like it should be easy. It is not. It is, in a precise sense, at the edge of what humanity currently knows how to compute in general — the relevant open problem (the Birch and Swinnerton-Dyer conjecture) is one of the seven Clay Millennium Prize Problems, worth $1,000,000, unsolved as of this writing. Elliptic curves are the smallest, simplest-looking class of objects where “find all the rational solutions” stops being solvable by any known general algorithm. Lines have easy rational-point theory (either none, one, or infinitely many, and you can always tell which). Conics (circles, ellipses, parabolas, hyperbolas) also have a complete theory — one rational point lets you find them all via a parametrization trick. Cubics are where this breaks. The moment the degree goes from 2 to 3, the rational points stop forming a describable curve of points and start forming something new: a group. That single fact — that the solution set organizes itself into a group under a geometric addition law — is the entire reason elliptic curves are not just “one more Diophantine equation” but a load-bearing structure across modern mathematics.

Four independent reasons this specific structure deserves a deep, dedicated thread in your map:

It is a genuine crossroads. Elliptic curves sit at the intersection of number theory (rational and integer solutions), algebraic geometry (they are curves — geometric objects), complex analysis (over $\mathbb{C}$ they are literally tori, built from elliptic integrals), and group theory (their points form an abelian group). Very few objects in mathematics let you walk in from four different departments and find you’re standing in the same room. That’s exactly the property you want in a map: a hub, not a leaf.

It resolved one of history’s most famous open problems. Fermat’s Last Theorem sat unsolved for 358 years until Andrew Wiles proved it in 1994–95 — not by attacking the theorem directly, but by proving a deep statement about elliptic curves (the modularity theorem) that had been shown, a decade earlier, to imply Fermat’s theorem as a corollary. The proof of a 17th-century number theory riddle turned out to run entirely through 20th-century elliptic curve theory.

It runs the internet. Every time you load an HTTPS website, unlock a modern iPhone, or move Bitcoin, elliptic curve cryptography is doing the key exchange or the signature underneath. The reason: the group law on an elliptic curve gives you a “one-way” operation — computing $nP$ (adding a point to itself $n$ times) is fast, but recovering $n$ from $P$ and $nP$ (the discrete log problem) is believed to be intractable, and unlike its cousin in $(\mathbb{Z}/p\mathbb{Z})^*$, no sub-exponential algorithm is known for the general case. Same abstract structure, one branch feeds pure number theory, the other feeds your phone’s lock screen.

It is the right size to actually master. Unlike, say, “algebraic geometry” as a whole (which can take years just to set up the language for), elliptic curves are concrete enough that you can compute with actual numbers by hand within a week, while still opening directly onto the deepest machinery in the field (Galois representations, modular forms, L-functions) once you want to go further. It’s a foundation you can stand on almost immediately and build arbitrarily high on later.

Keep this in mind as the throughline as you work: everything below is really one idea — that a cubic curve’s solution set can be given a group structure — examined from every angle mathematicians have found useful (geometric, algebraic, analytic, arithmetic, computational) over roughly 2,300 years.

2. History and intellectual lineage

Textbooks usually present elliptic curves in the logical order (definition → group law → theorems), which is the opposite of the order in which humans actually discovered why any of it mattered. Here is the real order, verified against primary and secondary historical sources.

Two threads worth sitting with, because they tell you something about how mathematics actually moves: first, the name “elliptic curve” is a historical accident — the curves aren’t ellipses, the name leaked over from elliptic integrals, which came from ellipse arc length. Second, notice how long the gap is between “beautiful pure conjecture” (Taniyama–Shimura, 1955) and “resolved” (2001) — 46 years — and that the resolution was driven by someone (Frey) noticing an unexpected bridge to a completely different 350-year-old problem. That’s the real shape of deep mathematical progress: long incubation, then a surprising connection collapses two hard problems into one.

Sources consulted for this section: Mordell–Weil theorem — Wikipedia, Wiles’s proof of Fermat’s Last Theorem — Wikipedia, Modularity theorem — Wikipedia, Neal Koblitz — Wikipedia, Breuil–Conrad–Diamond–Taylor, “On the Modularity of Elliptic Curves over Q: Wild 3-Adic Exercises,” JAMS 14 (2001), Ribet, “From the Taniyama–Shimura Conjecture to Fermat’s Last Theorem”.

3. Algebra foundations, built from scratch toward the group law

You asked specifically to rebuild this from the abstract-algebra side up, rather than take the group structure on faith. This section is the refresher — everything here is aimed at one destination: understanding, structurally, why points on a cubic curve can be added.

3.1 Groups

A group is a set $G$ together with an operation $\ast: G \times G \to G$ satisfying four axioms:

• Closure: for all $a, b \in G$, $a \ast b \in G$ (this is usually built into the definition of $\ast$ as a function into $G$, but it’s worth stating explicitly because it’s exactly the axiom that will require real work to verify for elliptic curves).
• Associativity: $(a \ast b) \ast c = a \ast (b \ast c)$ for all $a,b,c \in G$.
• Identity: there exists $e \in G$ such that $e \ast a = a \ast e = a$ for all $a$.
• Inverses: for every $a \in G$, there exists $a^{-1} \in G$ with $a \ast a^{-1} = a^{-1} \ast a = e$.

If additionally $a \ast b = b \ast a$ for all $a, b$, the group is abelian (commutative). Familiar examples: $(\mathbb{Z}, +)$, with identity $0$ and inverse $-a$; $(\mathbb{Q}^*, \times)$ (nonzero rationals under multiplication), identity $1$; $(\mathbb{Z}/n\mathbb{Z}, +)$, the integers mod $n$. A non-abelian example: the symmetric group $S_n$ of permutations of $n$ objects under composition, for $n \ge 3$.

The reason groups matter here: the closure and associativity axioms are exactly the two nontrivial facts you must prove about “adding points on a cubic curve” before you’re allowed to call it a group. Identity and inverses turn out to be easy once you set things up correctly (Module 2 will show you why). Keep closure and associativity in your peripheral vision as you go — they are the two axioms doing real work.

A subgroup $H \le G$ is a subset that is itself a group under the same operation. A homomorphism $\varphi: G \to G'$ is a map satisfying $\varphi(a \ast b) = \varphi(a) \ast' \varphi(b)$; an isomorphism is a bijective homomorphism, meaning $G$ and $G'$ are “the same group” wearing different labels. This language matters immediately: the group law you’ll build on elliptic curves is often proved correct by exhibiting an isomorphism to a group you already understand (the divisor class group, or — over $\mathbb{C}$ — the quotient group $\mathbb{C}/\Lambda$ for a lattice $\Lambda$).

3.2 Rings

A ring $R$ is a set with two operations, $+$ and $\times$, such that $(R, +)$ is an abelian group, multiplication is associative, and multiplication distributes over addition: $a(b+c) = ab + ac$. If multiplication is also commutative and there’s a multiplicative identity $1$, you have a commutative ring with unity — the kind you’ll use almost exclusively here. Examples: $\mathbb{Z}$, and the polynomial ring $\mathbb{Z}[x]$ (or $K[x]$ for a field $K$), which is where the cubic equations defining your curves actually live as objects.

The single most important ring-theoretic fact for this course: a polynomial like $f(x) = x^3 + ax + b$ over a field $K$ factors, in the ring $K[x]$, according to its roots — and whether $f$ has a repeated root is detectable purely algebraically via the discriminant $\Delta$, without ever finding the roots themselves. This is precisely the tool used in Module 1 to decide whether a given cubic is a legitimate elliptic curve (smooth) or a degenerate one (singular, with a repeated root).

3.3 Fields

A field $K$ is a commutative ring with unity in which every nonzero element has a multiplicative inverse — so you can divide by anything except $0$. $\mathbb{Q}$, $\mathbb{R}$, $\mathbb{C}$ are fields; $\mathbb{Z}$ is not (you can’t divide $1$ by $2$ and stay in $\mathbb{Z}$). For a prime $p$, $\mathbb{F}_p := \mathbb{Z}/p\mathbb{Z}$ is a field with exactly $p$ elements — this is the finite field you’ll use for both the Hasse bound module and, later, for cryptography, where all arithmetic happens modulo a large prime.

Why fields specifically, and not just rings: the formulas for adding two points on an elliptic curve involve division (a slope $=\Delta y / \Delta x$). You need to be working over a field for that division to always make sense. This is exactly why “an elliptic curve over $\mathbb{Z}$” isn’t quite the right phrase — you study elliptic curves over a field $K$ (often $\mathbb{Q}$, $\mathbb{R}$, $\mathbb{C}$, or $\mathbb{F}_p$), even when you ultimately care about integer or rational solutions.

3.4 Projective space, in one paragraph

One more piece of algebraic scaffolding you’ll need immediately: the point at infinity. When you draw $y^2 = x^3 + ax + b$ in the ordinary $(x,y)$-plane, two points with the same $x$-coordinate and vertical tangent or a vertical chord seem to have “nowhere to go” — the line shoots off to infinity without hitting a third point on the curve. The fix, due to 19th-century projective geometry, is to work in the projective plane $\mathbb{P}^2$, where a single extra point $\mathcal{O}$ (“the point at infinity”) is added so that every line meets the cubic in exactly three points (counted with multiplicity — this is a special case of Bézout’s theorem: a line, degree 1, meets a cubic, degree 3, in $1 \times 3 = 3$ points). $\mathcal{O}$ turns out to be exactly the identity element of the group. You don’t need the full machinery of projective geometry to use this course — just the picture: one extra point, sitting “at the top and bottom of every vertical line at once,” that makes the geometry total instead of having awkward exceptions.

Where to go deeper on this section alone: if groups, rings, and fields are shaky, the standard rigorous reference is Dummit & Foote’s Abstract Algebra (see Resources, §5); the classic terser alternative is Artin’s Algebra.

4. Coursework

Eight modules. Each has learning objectives, exposition, one fully worked numerical example (verified by hand), and a problem set mixing computation, proof, and conceptual questions. Full solutions are in §7 — resist checking them before attempting the problems.

Module 1 — What is an elliptic curve?

Objectives: define the Weierstrass equation; determine smoothness via the discriminant; compute the $j$-invariant.

Exposition. Over a field $K$ with characteristic $\ne 2, 3$ (true for $\mathbb{Q}, \mathbb{R}, \mathbb{C}$, and all but finitely many $\mathbb{F}_p$), an elliptic curve is the set of solutions $(x,y) \in K^2$ to $$E: \; y^2 = x^3 + ax + b, \qquad a, b \in K,$$ together with one formal extra point $\mathcal{O}$ (the point at infinity, §3.4), subject to the nondegeneracy condition that the cubic $x^3+ax+b$ has no repeated roots. That condition is captured by the discriminant $$\Delta = -16(4a^3 + 27b^2),$$ and the curve is a genuine elliptic curve (smooth, no self-intersections or cusps) exactly when $\Delta \ne 0$. Two curves are considered “the same” (isomorphic) when related by a specific rescaling of coordinates; the quantity that survives such rescaling and thus classifies curves up to isomorphism (over an algebraically closed field) is the $j$-invariant, $$j(E) = -1728 \frac{(4a)^3}{\Delta}.$$

Worked example. Let $E: y^2 = x^3 - 5x + 8$. Then $\Delta = -16(4(-5)^3 + 27(8)^2) = -16(-500 + 1728) = -16(1228) = -19648 \ne 0$, so $E$ is a genuine elliptic curve. (This is the curve we’ll use throughout Module 2.)

Problem set 1. 1. Compute the discriminant of $y^2 = x^3 - x$. Is it an elliptic curve? What are its three roots, and what do you notice geometrically about the curve $y^2 = x^3 - x$ over $\mathbb{R}$ as a result? 2. Show that $y^2 = x^3$ has $\Delta = 0$, and describe (in words or a sketch) what goes wrong with the curve at the origin. 3. For which values of $b$ does $y^2 = x^3 + b$ fail to be an elliptic curve? 4. Prove that if $\Delta \ne 0$, the cubic $x^3 + ax + b$ has three distinct roots in $\overline{K}$ (the algebraic closure), using the standard fact that the discriminant of a monic cubic vanishes iff it has a repeated root.

Module 2 — The group law

Objectives: derive the chord-and-tangent addition law geometrically; extract explicit algebraic formulas; understand (without necessarily reproving in full) why associativity holds.

Exposition. Here is the entire idea in one sentence: given two points $P, Q$ on $E$, draw the line through them; by Bézout’s theorem it meets $E$ in exactly one more point $R'$; reflect $R'$ across the $x$-axis to get $P + Q$. The reflection step is what makes $\mathcal{O}$ (rather than $R'$ itself) the identity, and is what makes the operation associative — this isn’t arbitrary, it’s forced by identifying $E$’s points with the divisor class group $\mathrm{Pic}^0(E)$ (the group of formal sums of points modulo “principal divisors,” i.e., modulo the zero sets of rational functions on $E$), via $P \mapsto [P] - [\mathcal{O}]$. That identification is manifestly a group (it’s a quotient of a free abelian group), and one checks that the chord-tangent rule reproduces exactly the addition in that quotient. That verification is the content of a full proof of associativity; it’s genuinely non-trivial (a page or two, done properly with Riemann–Roch or a direct but tedious algebraic identity), and is done in full in Silverman’s Arithmetic of Elliptic Curves, III.3. For this course, you should understand why the proof has this shape (identify with a group you already trust) even if you don’t reproduce every line.

Concretely, for $E: y^2 = x^3 + ax + b$ and points $P = (x_1,y_1)$, $Q = (x_2, y_2)$, both $\ne \mathcal{O}$:

• Identity: $\mathcal{O}$ is the identity: $P + \mathcal{O} = P$ for all $P$.
• Inverse: $-P = (x_1, -y_1)$ — the reflection of $P$ across the $x$-axis. Note $P + (-P) = \mathcal{O}$, consistent with a vertical line meeting the curve at $P$, $-P$, and $\mathcal{O}$.
• Addition ($P \ne \pm Q$): slope $m = \dfrac{y_2 - y_1}{x_2 - x_1}$; then $x_3 = m^2 - x_1 - x_2$, $\; y_3 = m(x_1 - x_3) - y_1$, and $P+Q = (x_3, y_3)$.
• Doubling ($P = Q$, using the tangent line): slope $m = \dfrac{3x_1^2 + a}{2y_1}$; same formulas for $x_3, y_3$ as above with $x_2 = x_1$.

Worked example (doubling). Take $E: y^2 = x^3 - 5x + 8$ from Module 1, and $P = (1,2)$ (check: $1 - 5 + 8 = 4 = 2^2$ ✓.) Compute $2P$: $$m = \frac{3(1)^2 - 5}{2(2)} = \frac{-2}{4} = -\frac{1}{2}.$$ $$x_3 = m^2 - 2x_1 = \frac{1}{4} - 2 = -\frac{7}{4}, \qquad y_3 = m(x_1 - x_3) - y_1 = -\frac12\left(1 + \frac74\right) - 2 = -\frac{11}{8} - 2 = -\frac{27}{8}.$$ So $2P = \left(-\frac74, -\frac{27}{8}\right)$. Verify it’s on the curve: $x_3^3 - 5x_3 + 8 = -\frac{343}{64} + \frac{35}{4} + 8 = \frac{-343 + 560 + 512}{64} = \frac{729}{64} = \left(\frac{27}{8}\right)^2 = y_3^2$. ✓.

Problem set 2. 1. Using $E: y^2 = x^3 - 5x + 8$ and $P = (1,2)$ from the worked example, compute $3P = 2P + P$. 2. Prove, directly from the reflection definition of $-P$, that $P + (-P) = \mathcal{O}$ using the “a line meets the curve in 3 points counted with multiplicity” principle (what line passes through $P$ and $-P$, and where is its third intersection point?). 3. Explain in your own words why closure — the fact that $P + Q$ always lands back on $E$ — is not obvious and requires the algebra (not just the geometric picture) to confirm. (Hint: what would go wrong if $E$ were not smooth, i.e., $\Delta = 0$?) 4. Conceptual: the group law identifies $E(K)$ with $\mathrm{Pic}^0(E)$ via $P \mapsto [P]-[\mathcal{O}]$. Using only the fact that $\mathrm{Pic}^0(E)$ is manifestly an abelian group (a quotient of a free abelian group), explain why this immediately tells you $E(K)$ is abelian — without needing to check commutativity of the chord-tangent rule by hand.

Module 3 — Elliptic curves over different fields

Objectives: understand the qualitatively different pictures $E(\mathbb{R})$, $E(\mathbb{C})$, and $E(\mathbb{F}_p)$ present, and state the Hasse bound.

Exposition.

Over $\mathbb{R}$: the real points form either one or two connected topological loops (depending on whether the cubic has one or three real roots), plus $\mathcal{O}$. Picture it: the group law is literally the geometric chord-and-tangent construction you’d draw on graph paper.

Over $\mathbb{C}$: this is where the history comes full circle. Weierstrass showed that $E(\mathbb{C})$ is isomorphic, as a group, to $\mathbb{C}/\Lambda$ for a lattice $\Lambda = \mathbb{Z}\omega_1 + \mathbb{Z}\omega_2 \subset \mathbb{C}$ — a complex torus. The isomorphism is given by the Weierstrass $\wp$-function and its derivative: $z \mapsto (\wp(z), \wp'(z))$. This is exactly the elliptic-integral/elliptic-function story from §2 landing on the algebraic curve: the group law on the curve corresponds to ordinary addition of complex numbers mod the lattice. This is the deepest sense in which “an elliptic curve is a torus.”

Over $\mathbb{F}_p$: now $E(\mathbb{F}_p)$ is a finite abelian group — you can literally list every element. The Hasse bound (Hasse, 1933) says the size is close to $p+1$: $$\big|\#E(\mathbb{F}_p) - (p+1)\big| \le 2\sqrt{p}.$$ This is what makes elliptic curve cryptography practical: you get a group of predictable, controllable size, built from ordinary modular arithmetic.

Worked example. $E: y^2 = x^3 + x + 1$ over $\mathbb{F}_5$. Squares mod 5 are $\{0,1,4\}$ (since $0^2=0,1^2=1,2^2=4,3^2=4,4^2=1$). Tabulate $f(x) = x^3+x+1 \bmod 5$:

That’s $8$ affine points plus $\mathcal{O}$: $\#E(\mathbb{F}_5) = 9$. Hasse check: $|9 - 6| = 3 \le 2\sqrt5 \approx 4.47$. ✓.

Problem set 3. 1. Compute $\#E(\mathbb{F}_7)$ for $E: y^2 = x^3 + 1$, by the same brute-force method, and verify the Hasse bound. 2. Why must $\#E(\mathbb{F}_p)$ always include the point $\mathcal{O}$ — i.e. why can the affine point count alone never be the full story? 3. Conceptual: explain, using the $\mathbb{C}/\Lambda$ picture, why $E(\mathbb{C})$ as a group is isomorphic to $(\mathbb{R}/\mathbb{Z})^2$ topologically (a torus) — what are $\omega_1, \omega_2$ doing geometrically? 4. If $p$ is large (cryptographic-size, e.g. 256-bit), explain why the Hasse bound alone — without computing $\#E(\mathbb{F}_p)$ exactly — already tells an attacker useful information about how hard the discrete log problem might be on that curve.

Module 4 — Torsion and the structure of $E(\mathbb{Q})$

Objectives: state the Nagell–Lutz theorem; understand torsion subgroups; state Mazur’s theorem.

Exposition. A point $P \in E(\mathbb{Q})$ is a torsion point if $nP = \mathcal{O}$ for some positive integer $n$; the smallest such $n$ is its order. The Nagell–Lutz theorem gives a beautifully concrete criterion for curves $y^2 = x^3+ax+b$ with $a, b \in \mathbb{Z}$: if $P=(x,y)$ is a rational torsion point (other than $\mathcal{O}$), then $x, y \in \mathbb{Z}$, and either $y = 0$ (order 2) or $y^2 \mid \Delta$. This turns “is this point torsion?” into a finite, mechanical check. Mazur’s theorem (1977) is the deep classification result: the torsion subgroup of $E(\mathbb{Q})$ is always one of exactly 15 possible groups — $\mathbb{Z}/n\mathbb{Z}$ for $n = 1,\dots,10,12$, or $\mathbb{Z}/2\mathbb{Z} \times \mathbb{Z}/2n\mathbb{Z}$ for $n=1,2,3,4$. Nothing else ever occurs, for any elliptic curve over $\mathbb{Q}$ — a remarkably rigid finiteness result.

Worked example. $E: y^2 = x^3 + 4$, $P = (0,2)$ (check: $0+4=4=2^2$ ✓). Double it: $a=0$, so $m = \frac{3(0)^2+0}{2(2)} = 0$. Then $x_3 = 0^2 - 2(0) = 0$, $y_3 = 0(0-0) - 2 = -2$. So $2P = (0,-2) = -P$. Hence $2P = -P \Rightarrow 3P = \mathcal{O}$: $P$ has order 3. Sanity check via Nagell–Lutz: $\Delta = -16(4\cdot0^3+27\cdot4^2) = -16(432) = -6912$; $y^2 = 4$ and $6912/4 = 1728$, an integer, so $y^2 \mid \Delta$ ✓ — consistent with $P$ being torsion.

Problem set 4. 1. Verify by direct computation that $3P = \mathcal{O}$ for $P=(0,2)$ on $E: y^2=x^3+4$ (i.e., compute $3P = 2P+P$ explicitly and confirm you get $\mathcal{O}$). 2. For $E: y^2 = x^3 - 2$, use Nagell–Lutz to argue that $E(\mathbb{Q})$ has no nontrivial torsion points with small $y$ (check $y \mid$ candidates dividing $\Delta$ up to a reasonable bound, e.g. $|y|\le 5$). 3. Which of the 15 groups in Mazur’s theorem is the largest in size? Which torsion structures are impossible — e.g., is $\mathbb{Z}/11\mathbb{Z}$ ever the torsion subgroup of a rational elliptic curve? Is $\mathbb{Z}/13\mathbb{Z}$? 4. Conceptual: why is it significant that Mazur’s theorem gives a uniform, finite list independent of the curve, whereas (as you’ll see in Module 5) the rank of $E(\mathbb{Q})$ is unbounded and still not fully understood? What does this tell you about which parts of “how big is $E(\mathbb{Q})$” are easy versus hard?

Module 5 — The Mordell–Weil theorem and ranks

Objectives: state the Mordell–Weil theorem precisely; understand rank; understand (at a sketch level) the descent method; state BSD informally.

Exposition. The Mordell–Weil theorem (Mordell 1922 for $\mathbb{Q}$, Weil 1928 in general): for any elliptic curve $E$ over a number field $K$, the group $E(K)$ is finitely generated. By the structure theorem for finitely generated abelian groups, this means $$E(K) \cong E(K)_{\text{tors}} \times \mathbb{Z}^r$$ for some non-negative integer $r$, the rank. Rank 0 means finitely many rational points total (all torsion); rank $\ge 1$ means infinitely many, all generated from $r$ independent “basic” points by the group law. The proof method — infinite descent, going back in spirit to Fermat himself — works roughly like this: define a homomorphism $E(K)/2E(K) \to$ (something finite and computable), show its kernel/image constraints force $E(K)/2E(K)$ to be finite, then use a “height function” (a way of measuring how arithmetically complicated a point’s coordinates are) to show that starting from any point you can keep halving down to a finite generating set — an infinite descent that must terminate.

Unlike torsion (Mazur: bounded, classified, computable), rank has no known general algorithm to compute exactly for an arbitrary curve, and it is not even known whether rank is unbounded (though curves of rank 20+ have been found). This asymmetry — torsion tame, rank wild — is one of the most important qualitative facts to internalize about $E(\mathbb{Q})$.

The Birch and Swinnerton-Dyer conjecture, discovered in the early 1960s by literally computing $\#E(\mathbb{F}_p)$ for many primes $p$ on an early computer and noticing a pattern, proposes a bridge: the rank of $E(\mathbb{Q})$ should equal the order of vanishing at $s=1$ of the curve’s L-function $L(E,s)$ (built from those same point counts — see Module 6). It remains open, and is one of the seven Clay Millennium Prize Problems.

Worked example. $E: y^2 = x^3 - 2$ has rank 1 over $\mathbb{Q}$, generated (modulo torsion, of which there is none) by $P = (3,5)$ — check: $27 - 2 = 25 = 5^2$ ✓. Every rational point on this curve is $nP$ for some integer $n$ (there is no torsion to add). This is a genuinely famous curve: it is one of the simplest with rank exactly 1, and its points relate to Bachet’s classical Diophantine problem of finding rational cubes differing from a square by exactly 2.

Problem set 5. 1. Confirm $P=(3,5)$ is on $E: y^2 = x^3-2$, then compute $2P$ using the doubling formula: $m=\frac{27}{10}$, giving $2P = \left(\frac{129}{100}, -\frac{383}{1000}\right)$ (verified to lie on the curve). 2. Explain in your own words the qualitative difference between “the torsion subgroup is one of 15 known groups” (Mazur) and “the rank is unbounded and not known to be computable in general.” Why does one part of the same finitely-generated-group structure theorem end up tame and the other wild? 3. Suppose you’re told $E$ has rank 0. What does that tell you, concretely, about the total number of rational points on $E$ (accounting for torsion)? 4. Look up (or, if you want a challenge, attempt to reason toward) what the current largest known/verified elliptic curve rank is, and note the year found, as a snapshot of where this open problem stands.

Module 6 — Elliptic curves and modular forms

Objectives: define the L-function of an elliptic curve from point counts; state the modularity theorem; connect to BSD.

Exposition. For each prime $p$ of good reduction, define $a_p = p + 1 - \#E(\mathbb{F}_p)$ (the “error term” in the Hasse bound — by Hasse, $|a_p| \le 2\sqrt p$). Package all these $a_p$ into an L-function via an Euler product, $$L(E,s) = \prod_p (\text{local factor involving } a_p, p^{-s}),$$ formally analogous to the Riemann zeta function’s Euler product over primes. The astonishing content of the modularity theorem (Taniyama–Shimura–Weil conjecture, proved in the semistable case by Wiles 1994–95 and in full generality by Breuil–Conrad–Diamond–Taylor 2001) is that this L-function, built purely from arithmetic point-counting data, exactly coincides with the L-function of a specific modular form — a highly symmetric analytic function on the upper half-plane invariant under a large group of Möbius transformations. Two objects from utterly different parts of mathematics (a curve’s arithmetic vs. an analytic function’s symmetry) turn out to encode identical information. This is the single deepest fact in this entire course, and it is precisely the fact Wiles’s proof of Fermat’s Last Theorem establishes (in the case needed).

Worked example. Using the $\#E(\mathbb{F}_5) = 9$ computation from Module 3 ($E: y^2=x^3+x+1$): $a_5 = 5 + 1 - 9 = -3$. Check Hasse: $|-3| \le 2\sqrt5 \approx 4.47$ ✓. This single number $a_5$ is one coefficient of the modularity dictionary — modularity guarantees a specific weight-2 modular form exists whose $q$-expansion coefficients reproduce exactly this sequence $a_p$ for every prime $p$.

Problem set 6. 1. Compute $a_7$ for $E: y^2=x^3+x+1$ over $\mathbb{F}_7$ (you’ll need $\#E(\mathbb{F}_7)$ first — brute force it as in Module 3): the only points are $(0,\pm1)$ and $(2,\pm2)$, so $\#E(\mathbb{F}_7)=4+1=5$, giving $a_7 = 7+1-5 = 3$ (check Hasse: $|3|\le2\sqrt7\approx5.29$ ✓). 2. Explain, in your own words, why “the L-function of the curve equals the L-function of a modular form” is a surprising statement rather than an obvious one — what are the two completely different worlds being identified? 3. Conceptual: BSD relates the rank (an algebraic/arithmetic invariant from Module 5) to the order of vanishing of $L(E,s)$ at $s=1$ (an analytic invariant defined in this module). Why does modularity need to be established first, historically and logically, before a statement like BSD is even well-posed to attack computationally (i.e., before you can compute $L(E,s)$ at all)? 4. Look up the current status of BSD (fully proved / proved in special cases / open) and summarize what is and isn’t known as of your reading.

Module 7 — Elliptic curves and Fermat’s Last Theorem

Objectives: understand the logical chain Frey → Ribet → Wiles at a conceptual level.

Exposition. Suppose, for contradiction, that Fermat’s Last Theorem is false for some prime exponent $\ell \ge 5$: $a^\ell + b^\ell = c^\ell$ with $a,b,c$ nonzero integers. Frey (1982–85) associates to this hypothetical solution the elliptic curve $$E_{\text{Frey}}: y^2 = x(x-a^\ell)(x+b^\ell),$$ and observes that this curve has extremely restrictive, almost pathological properties (it is semistable with a highly specific conductor). Ribet (1986) proves rigorously that such a curve, if it existed, could not be modular — it would violate a precise consequence of the (at the time still conjectural) Taniyama–Shimura conjecture, specifically Serre’s epsilon conjecture. So: if every semistable elliptic curve over $\mathbb{Q}$ is modular, then the Frey curve can’t exist, then no counterexample to Fermat’s Last Theorem can exist. Wiles’s job — completed with Taylor in 1994, published 1995 — was to prove modularity for exactly the class of curves (semistable) that includes every possible Frey curve. The logical chain is a textbook example of proof by an unexpected detour: instead of attacking $a^\ell+b^\ell=c^\ell$ directly (as everyone had for centuries), you attack a completely different-looking statement about elliptic curves and modular forms, and the original target falls out as a corollary.

Problem set 7. 1. Write out, in your own words and without notes, the full logical chain from “assume Fermat’s Last Theorem is false” to “contradiction,” making explicit which step uses Frey’s construction, which uses Ribet’s theorem, and which uses Wiles’s theorem. 2. Why does the Frey curve need to be semistable for the argument to work, and why was it significant that Wiles only needed to prove modularity for semistable curves rather than all elliptic curves (with the full case left to Breuil–Conrad–Diamond–Taylor in 2001)? 3. Fermat claimed to have “a truly marvelous proof” that the margin was too small to contain. Given everything you now know about the actual proof (published 1995, over 100 pages, requiring 20th-century machinery), what’s your assessment of whether Fermat’s claimed proof could plausibly have been correct and elementary? Defend your answer. 4. Research question: what is the Frey curve’s conductor, in terms of $a, b, \ell$, and why does the “epsilon conjecture” (Ribet’s theorem) specifically forbid that conductor value from being modular?

Module 8 — Elliptic curve cryptography

Objectives: understand the elliptic curve discrete logarithm problem (ECDLP); understand Diffie–Hellman key exchange on an elliptic curve; know where ECC is used in practice.

Exposition. Fix a curve $E$ over $\mathbb{F}_p$ (with $p$ a large prime, e.g. 256-bit) and a base point $G$ of large prime order $n$. The elliptic curve discrete logarithm problem (ECDLP) is: given $G$ and $Q = kG$ (i.e. $G$ added to itself $k$ times), find $k$. Computing $Q$ from $k$ and $G$ is fast (repeated doubling-and-adding, $O(\log k)$ group operations — “double and add,” directly analogous to fast exponentiation). Reversing it is believed computationally infeasible for well-chosen curves and large $n$ — and critically, no known sub-exponential algorithm solves ECDLP in general, unlike the classical discrete log problem in $(\mathbb{Z}/p\mathbb{Z})^*$, where index calculus gives a sub-exponential attack. This is precisely why 256-bit elliptic curve keys give comparable security to roughly 3072-bit RSA keys — you need far fewer bits, hence faster, smaller keys.

Elliptic Curve Diffie–Hellman (ECDH): Alice picks a random integer $a$, publishes $A = aG$. Bob picks random $b$, publishes $B=bG$. Alice computes $aB = abG$; Bob computes $bA = abG$ — same point, computed independently, without either party’s secret ever crossing the wire. An eavesdropper sees $G, A, B$ but (believed) cannot feasibly recover $abG$ without solving ECDLP.

In practice: TLS/HTTPS (curves like Curve25519 and the NIST P-256 curve secure most of the web today), Bitcoin and Ethereum (secp256k1 for signatures — ECDSA), and modern smartphone secure enclaves all run on this exact group-law arithmetic.

Worked example. Toy-scale (not remotely secure, but mechanically real): $E: y^2 = x^3+x+1$ over $\mathbb{F}_5$ from Module 3, with $G = (2,1)$. Suppose Alice’s secret is $a=2$: $A = 2G$. Using the doubling formula mod 5: $m = \frac{3(2)^2+1}{2(1)} = \frac{13}{2} \equiv \frac{3}{2} \;(\mathrm{mod}\;5)$. Since $2^{-1} \equiv 3 \;(\mathrm{mod}\;5)$ (as $2\cdot3=6\equiv1$), $m \equiv 3\cdot3=9\equiv4 \;(\mathrm{mod}\;5)$. Then $x_3 = m^2-2x_1 = 16 - 4 \equiv 12 \equiv 2\;(\mathrm{mod}\;5)$, and $y_3 = m(x_1-x_3)-y_1 = 4(2-2)-1 \equiv -1 \equiv 4 \;(\mathrm{mod}\;5)$. So $A = 2G = (2,4)$ — which checks against the table in Module 3 ✓ (it’s one of the two listed points at $x=2$).

Problem set 8. 1. Continue the toy example: if Bob’s secret is $b=3$, compute $B = 3G = 2G + G$ using $2G=(2,4)$ and $G=(2,1)$ found above. 2. Compute the shared secret $aB$ (using $a=2$ and your $B$ from problem 1) and separately $bA$ (using $b=3$ and $A=(2,4)$), and confirm they match — that’s Diffie–Hellman working end to end on a toy curve. 3. Explain in your own words why “double and add” lets you compute $kG$ in $O(\log k)$ steps rather than $k$ steps, and why this matters for using cryptographic-size $k$ (hundreds of bits). 4. Conceptual: why does ECC allow smaller key sizes than RSA for equivalent security? Tie your answer explicitly to the fact (stated in the exposition) that no sub-exponential attack is known against ECDLP, unlike classical discrete log or integer factorization.

5. Resources, organized

Textbooks — algebra refresher (§3): - David Dummit & Richard Foote, Abstract Algebra — the standard rigorous reference for groups, rings, fields; also available to borrow on the Internet Archive. - Michael Artin, Algebra — terser, more geometric alternative.

Textbooks — elliptic curves, roughly easy → hard: - Joseph Silverman & John Tate, Rational Points on Elliptic Curves — the best true starting point; assumes only undergraduate algebra. Publisher page. - Lawrence Washington, Elliptic Curves: Number Theory and Cryptography — excellent for the cryptography side specifically, still rigorous. - Joseph Silverman, The Arithmetic of Elliptic Curves — the graduate-level canonical reference (proves the group law associativity in full, among everything else). Where Module 2’s “the full proof lives here” points. - Neal Koblitz, Introduction to Elliptic Curves and Modular Forms — the natural next step toward Module 6/7 material.

Free lecture notes / courses: - Andrew Sutherland, MIT 18.783 Elliptic Curves — the single best free rigorous course available online, with full lecture notes and problem sets. Course page (Fall 2025), earlier iteration with posted notes. - William Stein’s course materials and books, including Modular Forms: A Computational Approach — leans computational (Sage-based). wstein.org notes index, Elementary Number Theory (free book). - Keith Conrad’s expository notes (number theory, widely regarded as some of the clearest short expository math writing available) — indexed at numbertheory.org. - Henrik Bachmann’s Elliptic Curves course notes (2024): henrikbachmann.com/ec_2024.html.

Primary/historical sources (for §2, if you want to read the actual papers rather than the summary): - Ken Ribet, “From the Taniyama–Shimura Conjecture to Fermat’s Last Theorem” — an accessible expository account by one of the principals. - Breuil, Conrad, Diamond, Taylor, “On the Modularity of Elliptic Curves over Q: Wild 3-Adic Exercises,” JAMS 14 (2001) — the full-generality modularity proof. - Wikipedia’s “Wiles’s proof of Fermat’s Last Theorem” and “Mordell–Weil theorem” pages are both unusually well-sourced and are good jumping-off points to primary literature.

Cryptography specifically: - Christof Paar’s cryptography lecture series (Ruhr-Universität Bochum), publicly posted on YouTube, including a dedicated ECC lecture. - Alfred Menezes’s lectures on elliptic curve cryptography (widely available, Menezes is a foundational author in the field alongside Koblitz). - “Elliptic Curve Cryptography: The Serpentine Course of a Paradigm Shift” — a well-regarded historical/technical survey.

Interactive / computational tools (highly recommended for actually building intuition — compute with real curves, not just the toy examples above): - LMFDB (L-functions and Modular Forms Database) — look up any elliptic curve over $\mathbb{Q}$, see its rank, torsion, L-function, conductor, and modularity data instantly. This is the single best “playground” for everything in Modules 4–6. - SageMath elliptic curves documentation and the thematic tutorial — free, runs in-browser via SageCell, lets you check every hand computation in this document (and go far beyond it) in seconds.

6. Connection graph — where this fits in your map

The canonical, up-to-date version of this graph now lives in map-index.md, not here — that doc is the single source of truth for the whole project (every node’s status, every edge labeled with its actual mechanism rather than just a shared word, plus a log of rejected “false friend” connections like Marden’s theorem). Keeping one copy in one place means this section can’t quietly drift out of sync with what’s actually been built since.

What’s worth keeping here, locally, is the reading of that graph specific to this course: elliptic curves are a hub, and each module above opens a door to a bigger territory. Algebraic geometry is the natural next thread if Modules 1–2 (the group law itself) were the most interesting part — it supplies the Riemann–Roch machinery behind the associativity proof this course only sketched. Modular forms and Galois representations are the thread if Modules 6–7 (the Wiles storyline) were the draw. Quadratic reciprocity — now its own complete course, quadratic-reciprocity-course.md — turned out to be a real, mechanism-level neighbor rather than a tangent: it’s what decides the splitting behavior of 2-torsion (via the discriminant-square criterion) and is the historical prototype for the whole reciprocity-law lineage that modularity itself belongs to. Cryptography is the applied thread out of Module 8. Complex analysis is the thread if the $\mathbb{C}/\Lambda$ picture in Module 3 was the most satisfying part — and it connects onward to the uniformization theorem’s spherical/flat/hyperbolic trichotomy, which is the rigorous cousin of genus 0/1/≥2 classification underlying §8’s appendix.

When you pick a stub node from map-index.md to build out next, start that new document by writing down which node you’re standing on and what you already know as a result — that’s the mechanism that turns “circling the same ideas” into “building continuously outward,” which was the stated goal for this whole project.

7. Answer key

Work the problems first. Answers are terser than the exposition above — they confirm you got the right destination, not a substitute for doing the derivation yourself.

Module 1 1. $a=-1, b=0$: $\Delta = -16(4(-1)^3+0) = -16(-4)=64 \ne 0$. Roots of $x^3-x=x(x-1)(x+1)$: $0, 1, -1$ — three distinct real roots, so over $\mathbb{R}$ the curve has two connected components (an oval and an unbounded branch). 2. $a=0,b=0 \Rightarrow \Delta=-16(0+0)=0$. At the origin $(0,0)$, both partial derivatives of $y^2-x^3$ vanish, so the curve has a cusp there — not smooth. 3. $\Delta = -16(0+27b^2) = -432b^2$; this is $0$ exactly when $b=0$. So $y^2=x^3+b$ fails to be an elliptic curve only at $b=0$. 4. Standard fact: discriminant of monic cubic is $\prod_{i<j}(r_i-r_j)^2$ over its roots $r_i$; this is $0$ iff two roots coincide. $\Delta \ne 0$ (up to the constant factor $-16$ relating it to this product) forces all three roots distinct.

Module 2 1. First get $2P=(-7/4,-27/8)$ (worked example). Then add $P=(1,2)$: $m = \frac{-27/8 - 2}{-7/4-1} = \frac{-43/8}{-11/4} = \frac{43}{22}$. Carrying this through gives $3P = \left(\frac{553}{121}, -\frac{11950}{1331}\right)$ (verified numerically to satisfy $y^2=x^3-5x+8$ — the point of this exercise is the mechanical fluency of the formulas, not a clean number). 2. The vertical line $x=x_1$ meets $E$ at $P=(x_1,y_1)$ and $-P=(x_1,-y_1)$; by the “point at infinity on every vertical line” convention (§3.4) its third intersection point is exactly $\mathcal{O}$, so by definition $P+(-P)=\mathcal{O}$. 3. If $\Delta=0$ the curve has a singular point (cusp or node); at that point the tangent line is not well-defined (or the curve has two tangent directions), so the doubling/addition formulas break down exactly there — closure can fail or the group law becomes ill-defined at the singularity. This is precisely why $\Delta \ne 0$ is required for “elliptic curve.” 4. Since $\mathrm{Pic}^0(E)$ is a quotient of a free abelian group by a subgroup, it is automatically abelian; because $P\mapsto[P]-[\mathcal O]$ is a bijection onto $\mathrm{Pic}^0(E)$ that (once proven) matches the geometric addition, $E(K)$ inherits commutativity for free, without checking the chord formulas satisfy $P+Q=Q+P$ by hand (which is in fact visually obvious from the construction, since “the line through $P,Q$” doesn’t distinguish an order — but the abstract argument is what makes associativity, the hard axiom, free too).

Module 3 1. Squares mod 7: $\{0,1,2,4\}$. $f(x)=x^3+1 \bmod 7$: $x=0\to1$(sq,2pts), $x=1\to2$(sq,2pts), $x=2\to9\equiv2$(sq,2pts), $x=3\to28\equiv0$(sq, $y=0$ only,1pt), $x=4\to65\equiv2$(sq,2pts), $x=5\to126\equiv0$(1pt), $x=6\to217\equiv0$(1pt). Total affine: $2+2+2+1+2+1+1=11$, plus $\mathcal O$: $\#E(\mathbb F_7)=12$. Hasse: $|12-8|=4 \le 2\sqrt7\approx5.29$ ✓. 2. Affine points alone don’t form a group with an identity under the chord-tangent rule (vertical lines have no third affine intersection) — you need $\mathcal O$ to be the identity element, so it must always be counted. 3. $\omega_1,\omega_2$ are two $\mathbb{R}$-linearly independent complex numbers generating the lattice $\Lambda$; $\mathbb C/\Lambda$ is literally a fundamental parallelogram with opposite sides glued, which is topologically a torus $\cong (\mathbb R/\mathbb Z)^2$, with $\omega_1,\omega_2$ as the two independent “loop” directions. 4. The Hasse bound tells the attacker the group order is within $2\sqrt p$ of $p+1$, i.e., roughly $p$-sized — so a well-chosen curve gives a discrete-log problem in a group of size comparable to $p$; since no sub-exponential attack is known, the attacker’s best generic strategy (Pollard’s rho) takes roughly $\sqrt{\#E(\mathbb F_p)} \approx \sqrt p$ steps, directly telling them how large $p$ needs to be for a target security level.

Module 4 1. From the exposition: $2P=(0,-2)$. Then $3P = 2P+P = (0,-2)+(0,2)$: this is a vertical line ($x=0$ both times), so by the reflection rule $3P=\mathcal O$ directly (it’s exactly the $P+(-P)=\mathcal O$ case, since $(0,-2)=-P$). ✓ 2. $\Delta$ for $y^2=x^3-2$ ($a=0,b=-2$): $\Delta=-16(0+27\cdot4)=-1728$. Candidates need $y^2\mid1728$ with $y\in\{1,2,3,4,5,...\}$ (excluding 0, since $x^3=2$ has no rational root so $y=0$ gives no rational point anyway): $1728=2^6\cdot3^3$; check small $y$: $y=1\Rightarrow x^3=3$, not a cube; $y=2\Rightarrow x^3=6$, no; $y=3\Rightarrow x^3=11$, no; $y=4\Rightarrow x^3=18$, no. No small torsion candidates found — consistent with this curve’s rank-1, torsion-free structure noted in Module 5. 3. Largest group in Mazur’s list by order is $\mathbb Z/12\mathbb Z$ (order 12) among the cyclic ones, and $\mathbb Z/2\mathbb Z\times\mathbb Z/8\mathbb Z$ (order 16) among the product ones — order 16 is the largest overall. $\mathbb Z/11\mathbb Z$: not in the list (only $1$–$10,12$ cyclic orders occur) — impossible. $\mathbb Z/13\mathbb Z$: also impossible for the same reason. 4. It tells you torsion is a “small, structured, finite-list” invariant (fully classified, computable, bounded independent of the curve) while rank is an “open-ended, unbounded, currently uncomputable-in-general” invariant — the finitely-generated abelian group structure theorem cleanly splits $E(\mathbb Q)$ into a tame part and a wild part, and essentially all of the deep unsolved difficulty of the subject (including BSD) lives in the rank, not the torsion.

Module 5 1. Check: $27-2=25=5^2$ ✓. Doubling: $m=\frac{3(9)}{2(5)}=\frac{27}{10}$; $x_3=m^2-2(3)=\frac{729}{100}-6=\frac{129}{100}$; $y_3=m(3-x_3)-5$ — carries through to a valid rational point (verify it satisfies $y^2=x^3-2$ as your check). 2. See Module 4 Q4 answer — same core idea, restated for this module: the structure theorem for finitely generated abelian groups splits cleanly into torsion (finite, classified) and free rank (unbounded, generally hard); nothing about the theorem’s proof forces both halves to be equally tractable, and empirically they aren’t. 3. Rank 0 means $E(\mathbb Q) = E(\mathbb Q)_{\text{tors}}$ exactly — the total number of rational points is finite and equal to the size of the torsion subgroup (one of Mazur’s 15 groups), full stop, no infinite family generated by a point of infinite order. 4. As of recent record-setting results (this changes over time — verify current state via the LMFDB or recent arXiv announcements), curves of rank in the high 20s/low 30s have been exhibited; the exact current record and whether rank is provably unbounded remain open research questions — treat any specific number you find as a snapshot, not a settled fact.

Module 6 1. Following the same brute-force method as Module 3 Q1 but for $x^3+x+1$ over $\mathbb F_7$: tabulate and count, then $a_7 = 7+1-\#E(\mathbb F_7)$. 2. One side (the L-function from $a_p$’s) is built purely from counting solutions mod every prime — arithmetic, discrete, number-theoretic. The other side (a modular form’s $q$-expansion coefficients) comes from an analytic object with continuous symmetry under a large transformation group on the upper half-plane — analysis, continuous, geometric. There’s no a priori reason these two totally different construction procedures should produce identical sequences of numbers; that they provably do is the surprise. 3. Without modularity, you don’t know $L(E,s)$ has a meaningful analytic continuation to $s=1$ at all (the naive Euler product only converges for $\mathrm{Re}(s)$ large) — modularity is exactly what supplies the analytic continuation (via the well-understood analytic continuation of modular form L-functions), making “the order of vanishing of $L(E,s)$ at $s=1$” a well-defined quantity you can even ask BSD’s question about. 4. BSD remains open in general as of this writing; partial results are known (e.g., rank 0 and rank 1 cases have partial theorems, notably work stemming from Gross–Zagier and Kolyvagin), but the full conjecture is unproved — check the Clay Mathematics Institute or LMFDB for the most current statement of partial progress when you read this.

Module 7 1. Assume $a^\ell+b^\ell=c^\ell$ has a solution for some prime $\ell\ge5$ → (Frey) build $E_{\text{Frey}}:y^2=x(x-a^\ell)(x+b^\ell)$, a semistable elliptic curve with unusual invariants → (Ribet) this curve, if it existed, would contradict the (then-conjectural) modularity theorem for semistable curves → (Wiles) modularity is in fact true for all semistable elliptic curves → contradiction → no such $a,b,c,\ell$ exist. 2. The Frey curve’s construction guarantees it’s semistable (a specific technical condition on its behavior at bad primes), so you only ever need modularity for the semistable case to complete the FLT argument — which is exactly the (still very hard, but strictly smaller) case Wiles targeted and proved, rather than needing the full generality that took until 2001 (Breuil–Conrad–Diamond–Taylor). 3. Open-ended — a reasonable, defensible answer: given that the actual proof requires deep 20th-century machinery (Galois representations, modularity, Iwasawa theory) unavailable to Fermat, most mathematicians and historians consider it very unlikely Fermat had a correct proof; he most likely had a proof of a special case (e.g. $n=4$, which he did prove) or a flawed general argument. This is a judgment question — the grading criterion is whether you defend your position with the historical facts above, not which side you take. 4. The Frey curve’s conductor works out to (up to standard normalization) the radical (product of distinct prime factors) of $abc$; Ribet’s theorem (the epsilon conjecture) shows that if such a curve were modular, the associated modular form would have to exist at a level (roughly, the conductor) that is impossible given the highly restrictive ramification structure forced by the Frey curve’s construction — i.e., “level-lowering” arguments show the required modular form can’t exist, which is the contradiction.

Module 8 1. $B=3G=2G+G=(2,4)+(2,1)$: $m=\frac{1-4}{2-2}$ — same $x$-coordinate! Since $y$-values differ ($4\ne1$ and $4\ne-1\equiv4$… check: is $(2,1)=-(2,4)$? $-(2,4)=(2,-4)=(2,1)\bmod5$ — yes! So this is exactly the $P+(-P)$ case: $B = (2,4)+(2,1) = \mathcal{O}$. (This reveals $G=(2,1)$ has order dividing 3 relative to $2G$ in a way that makes this toy example degenerate at $b=3$ — a good illustration of why real ECC uses a base point of large prime order chosen very deliberately, precisely to avoid this kind of small-order collision. Try $b=2$ instead for a non-degenerate example: $B=2G=(2,4)$ directly from the worked example.) 2. With the corrected/adjusted $B$ from Q1’s note, compute $aB$ and $bA$ using the same doubling/addition formulas mod 5 and confirm they match — this is the substance of the exercise regardless of which concrete toy value you use. 3. Double-and-add mirrors fast exponentiation: writing $k$ in binary, computing $kG$ needs only one doubling per bit and one addition per set bit — $O(\log k)$ total group operations instead of $O(k)$ repeated additions, which is the difference between practical (milliseconds) and impossible (longer than the age of the universe) for 256-bit $k$. 4. Because ECDLP has no known sub-exponential attack, an ECC key needs roughly $2\times$(security bits) — e.g. 256-bit key for 128-bit security. RSA’s security relies on integer factorization, which does have a sub-exponential attack (the general number field sieve), so RSA needs much larger keys (roughly 3072 bits for comparable 128-bit security) to stay ahead of that faster attack — same target security level, very different key sizes, because the best known attacks have different asymptotic complexity classes.

8. Appendix — how rare is the group structure, really?

A question worth sitting with once Module 2 has landed: is “the solution set forms a group” a special property of this one cubic equation, or is it a common phenomenon across mathematics that just happens to be easiest to see here? The honest answer is that it is about as rare as a structural fact in mathematics can be — not rare in the sense of “unlikely,” but rare in the sense of “there are only three of these objects in existence, period,” and elliptic curves are one of the three.

By degree/genus, the phenomenon is a narrow window, not a spectrum. The right invariant to sort curves by isn’t degree but genus — a topological measure of complexity (over $\mathbb{C}$, it’s literally the number of “handles” on the curve as a surface). Lines and conics (genus 0): the solution set, if nonempty, is either empty or in bijection with $\mathbb{P}^1$ — but $\mathbb{P}^1$ itself can never be given the structure of an algebraic group. There’s no way to define a “sum” of two points on a circle or parabola that’s algebraic, translation-consistent, and total (defined everywhere) — the obstruction is topological/algebraic, not a failure of cleverness. Smooth cubics (genus 1): this is exactly, and only, where a group structure becomes possible — a genus-1 curve with one marked point is, by definition, an elliptic curve, and “elliptic curve” and “one-dimensional abelian variety” are two names for the same object. Curves of genus $\ge 2$ (quartics and beyond, generically): Faltings’s theorem (1983, proving what had been the Mordell conjecture since 1922 — the same Mordell as Module 5) shows these curves have only finitely many rational points, full stop, for every single such curve. There isn’t even room for an interesting infinite structure to organize, let alone a group.

Why genus 1 specifically, structurally. Every smooth projective curve $C$, of any genus $g$, comes equipped with an associated abelian variety called its Jacobian, $\mathrm{Jac}(C)$, of dimension exactly $g$ — built from the group of degree-0 divisor classes, via the same $\mathrm{Pic}^0$ construction gestured at in Module 2. This exists universally, for every curve, at every genus — so in one sense, every curve is secretly glued to a group. The catch is that the Abel–Jacobi map $C \to \mathrm{Jac}(C)$ is only ever an isomorphism — the curve literally is the group, not just mapped into it — when the dimensions match, i.e. $g=1$. For $g=0$, $\mathrm{Jac}(C)$ collapses to a single point (no content). For $g \ge 2$, $\mathrm{Jac}(C)$ is a strictly higher-dimensional space and $C$ sits inside it as a proper, lower-dimensional subvariety — related to a group, but not equal to one. Elliptic curves are the unique dimension where the general machinery (which exists for every curve, unconditionally) happens to collapse onto the curve you started with.

The sharpest way to see the rarity: the objects themselves are completely classified, and there are exactly three. Independent of curves entirely, ask: over an algebraically closed field, what is a connected one-dimensional algebraic group — any variety at all, of dimension 1, with a compatible group structure? The answer (a consequence of Chevalley’s structure theorem) is a closed, finite list: the additive group $\mathbb{G}_a = (K, +)$, the multiplicative group $\mathbb{G}_m = (K^\times, \times)$, and an elliptic curve. Nothing else is possible, ever, in dimension 1. Elliptic curves aren’t an example that happens to have a group law among many curves that could plausibly have had one — they are one of exactly three total answers to “what could a one-dimensional algebraic group even be,” and the only one of the three that is also complete (compact/projective, with no points removed to infinity) — $\mathbb{G}_a$ and $\mathbb{G}_m$ are both missing points (the affine line is $\mathbb{P}^1$ minus a point; $\mathbb{G}_m$ is $\mathbb{P}^1$ minus two points) precisely because a complete one-dimensional group variety is forced to have genus exactly 1.

And you’ve already computed the other two, without realizing it. Go back to Module 1’s discriminant $\Delta = -16(4a^3+27b^2)$. When $\Delta \ne 0$ you get an honest elliptic curve — the group-law case worked through in Module 2. But look at what happens on the two ways $\Delta$ can vanish, rather than discarding them as “not elliptic curves” and moving on: a Weierstrass cubic with a node (two branches crossing at a point, e.g. $y^2=x^3+x^2$) has smooth-point-set isomorphic, as a group under the exact same chord-tangent rule, to $K^\times$ — the multiplicative group. A Weierstrass cubic with a cusp (e.g. $y^2=x^3$, from Module 1 Problem 2) has smooth-point-set isomorphic to $K$ under addition — the additive group. So the full trichotomy of every one-dimensional algebraic group that can possibly exist is sitting, visibly, inside the one family of curves you’ve been computing $\Delta$ for all along: smooth cubic $\to$ elliptic curve, nodal cubic $\to \mathbb{G}_m$, cuspidal cubic $\to \mathbb{G}_a$. Nondegenerate, one degeneration, or the other — those are the only three things that can happen, and you get all three without leaving the Weierstrass family.

One more thing worth appreciating about the history, not just the structure: Poincaré, Mordell, and Weil found the group law geometrically, by the 1920s, decades before Chevalley’s structure theorem (1950s) explained why it had to exist and be essentially unique. The “what” — cubics have a group law — came first, empirically and geometrically. The “why it’s this special and this rare” came later, as part of the general theory of algebraic groups. That’s a useful pattern to notice for how deep mathematical facts tend to arrive: a strange, specific, checkable phenomenon first, and only later the general classification that explains exactly how much room there was for that phenomenon to exist in — which in this case turns out to be very little room indeed.

Sources consulted: Faltings’s theorem — Wikipedia, Classification of connected one-dimensional algebraic groups — Groupprops, Chevalley’s structure theorem — Wikipedia, and worked notes on singular Weierstrass curves confirming the $\mathbb{G}_m$/$\mathbb{G}_a$ isomorphisms for nodal/cuspidal cubics.

Built for the Map of Math project — everything above is designed to be extended, not treated as finished. When you’re ready to go deeper on any node in §6’s graph, that’s the natural next document.