1 Definition and basic forms
1.1 General Weierstrass equation
An elliptic curve over a field is typically presented as a non-singular plane cubic curve together with a specified rational point. In general coordinates, it is described by a Weierstrass equation of the form \[ y^2 + a_1xy + a_3y = x^3 + a_2x^2 + a_4x + a_6, \] where the coefficients \(a_i\) lie in the chosen field. This model is flexible: by completing squares and shifting variables, many other cubic models can be transformed into this shape, provided the curve is not singular.
1.2 Short Weierstrass form
When the field has characteristic different from \(2\) and \(3\), a change of variables can often simplify the equation to the short Weierstrass form \[ y^2 = x^3 + Ax + B. \] Here \(A\) and \(B\) summarize the essential invariants of the curve in this normalization. Even though the appearance is simpler, the curve’s arithmetic and geometry remain the same up to isomorphism over the base field (or over a suitable extension, depending on coefficients).
1.3 Non-singularity condition
A plane cubic is called an elliptic curve model when it is non-singular, meaning it has no cusps or self-intersections over an algebraic closure. For short Weierstrass form \(y^2=x^3+Ax+B\), non-singularity is equivalent to the condition \[ \Delta = -16(4A^3+27B^2)\neq 0, \] where \(\Delta\) is the discriminant of the cubic. In the general Weierstrass case, the discriminant is expressed in terms of the coefficients \(a_i\); the key role is still to prevent common zeros of the defining polynomial and its partial derivatives from occurring.
1.4 Projective form and points at infinity
For geometric clarity, one works in projective coordinates \((X:Y:Z)\). The short Weierstrass equation becomes a homogeneous cubic, and the “point at infinity” arises naturally as the unique point on the projective closure where \(Z=0\). This point is used as the distinguished identity element for the group law. In projective form, the curve becomes a compact algebraic curve, and the behavior near infinity is encoded without special-case coordinate computations.
2 Geometry and group law
2.1 Chord-and-tangent construction
A distinctive feature of elliptic curves is the existence of an intrinsic group operation on their rational points. Over an algebraically closed field, the construction is geometric: given two points \(P\) and \(Q\) on the curve, the line through them meets the cubic in a third point \(R\). The sum \(P+Q\) is defined using the reflection of \(R\) across the appropriate axis (for short Weierstrass form, reflection sends \((x,y)\) to \((x,-y)\)). When \(P=Q\), the line is replaced by the tangent at \(P\), again producing a third intersection point that determines the doubled point.
2.2 Identity element
The point at infinity, often denoted \(O\), acts as the identity for the group law. Under the chord-and-tangent rule, \(O\) corresponds to the behavior of lines that become “vertical” in affine coordinates. Algebraically, the identity property is consistent with the projective model: adding a point to \(O\) leaves the other point unchanged.
2.3 Inverses and point addition
In short Weierstrass coordinates, the inverse of a point \(P=(x,y)\) is \(-P=(x,-y)\). This comes directly from the geometric reflection used in defining sums. Point addition then becomes a deterministic operation: compute the slope (from the chord or tangent), obtain the third intersection, and reflect to get the resulting point. When working over fields where denominators may vanish, one typically uses homogeneous formulas or local checks to keep the definition valid.
2.4 Doubling a point
Doubling \(P\) requires the tangent line at \(P\). For \(P=(x,y)\) on \(y^2=x^3+Ax+B\) in characteristic not \(2\), the slope of the tangent is determined by the derivative relation. The resulting explicit formulas produce \(2P\) as another point on the curve, provided the tangent is not vertical. If the tangent is vertical (which occurs for certain points), the result is the identity \(O\), aligning with the geometric rule.
3 Algebraic properties
3.1 Field of definition
An elliptic curve may be defined over different fields, and its points likewise form sets depending on the chosen base field. If coefficients of the defining equation lie in a field \(K\), one can consider \(K\)-rational points, meaning points whose coordinates satisfy the curve equation and lie in \(K\). Extending the field can create new points and can change group structure. Many invariants, such as discriminant and \(j\)-invariant, are compatible with base change.
3.2 Isomorphisms and changes of variables
Two elliptic curves are considered isomorphic over a field if there is a bijection between their points that respects the group law and is given by a suitable change of variables. Over a field where \(2\) and \(3\) are invertible, transformations typically take the form \[ x = u^2 x',\quad y = u^3 y' \] together with translations that remove certain coefficients in the general model. Such operations preserve non-singularity while modifying \(A\) and \(B\). Isomorphism classes capture the essential geometry, whereas specific equations are merely models.
3.3 Discriminant and j-invariant
The discriminant \(\Delta\) measures singularity and varies predictably under change of variables. The \(j\)-invariant is a rational function in the coefficients (for short Weierstrass form, \(j= -1728\cdot (4A^3)/\Delta\), equivalently \(j = 1728\cdot 4A^3/(4A^3+27B^2)\)). The value of \(j\) classifies elliptic curves over an algebraically closed field up to isomorphism. In particular, two curves over such a field are isomorphic if and only if they share the same \(j\)-invariant.
3.4 Singular and nonsingular curves
If the discriminant vanishes, the cubic has a singularity; the resulting curve is not an elliptic curve in the standard sense because the group law cannot be defined consistently on all smooth points in a way that extends the intended structure. Singular models may still be studied (for example, in degenerations), but the classical theory of elliptic curves—especially the group law on a non-singular cubic—requires non-singularity as a core assumption.
4 Rational points and arithmetic
4.1 Points over the rationals
When the curve is given with rational coefficients, one considers rational points \(E(\mathbb{Q})\). These points form an abelian group under the chord-and-tangent rule. The question of determining \(E(\mathbb{Q})\) is central in arithmetic geometry, but explicit computation is often difficult because it involves deep properties of the curve and the arithmetic of its coefficients.
4.2 Torsion points
Torsion points are points of finite order in the group \(E(K)\). They form a finite subgroup, denoted \(E(K)_{\mathrm{tors}}\). For \(K=\mathbb{Q}\), the torsion subgroup is strongly constrained by deep classification results. Conceptually, torsion points correspond to solutions of the curve equation that repeat under repeated addition, and they can often be detected using reduction modulo primes and modular constraints.
4.3 Rank of an elliptic curve
The Mordell–Weil theorem states that \(E(K)\) is finitely generated when \(K\) is a number field. Thus \[ E(K) \cong E(K)_{\mathrm{tors}} \oplus \mathbb{Z}^r, \] where the integer \(r\ge 0\) is the rank. The rank measures the size of the “free” part and governs how many independent infinite-order points exist. Determining \(r\) is a major unsolved problem in general, though there are effective algorithms and theoretical bounds.
4.4 Mordell’s theorem
Mordell’s theorem (often viewed as a foundational step toward the full Mordell–Weil statement) asserts finiteness properties for rational points on elliptic curves. In broad terms, it implies that rational points do not form a wild infinite set with uncontrolled growth; instead, they organize into a finitely generated group. This theorem underlies the later decomposition into torsion and free parts and justifies the centrality of rank computations.
4.5 L-functions and conjectures
Elliptic curves are connected to analytic objects through their \(L\)-functions. The Birch and Swinnerton-Dyer conjecture relates the rank of \(E\) to the order of vanishing of the \(L\)-function at a special point. In addition, conjectures predict precise links between arithmetic invariants (such as the size of certain cohomological groups and regulators) and the leading coefficient of the \(L\)-function’s Taylor expansion. Although not fully proven in general, this framework guides much of modern research.
5 Elliptic curves over finite fields
5.1 Point counting
Over a finite field \(\mathbb{F}_q\), the set \(E(\mathbb{F}_q)\) of rational points is finite, and its cardinality is denoted \(\#E(\mathbb{F}_q)\). A key computational problem is counting points efficiently. Various methods exist, ranging from explicit formulas in special cases to algorithms that use reductions and algebraic geometry. The group structure is again abelian, making \(E(\mathbb{F}_q)\) a finite abelian group.
5.2 Hasse’s theorem
Hasse’s theorem provides a sharp estimate for \(\#E(\mathbb{F}_q)\). In simplified form, it states that \[
| \left | \#E(\mathbb{F}_q) - (q+1) \right | \le 2\sqrt{q}. |
|---|
\] This bound, fundamental for both theory and practice, restricts how far the point count can deviate from the “expected” value \(q+1\). It also supports the feasibility of algorithms that compute point counts by narrowing possible traces of Frobenius.
5.3 Frobenius endomorphism
Over \(\mathbb{F}_q\), the Frobenius map raises coordinates to the \(q\)th power. This map induces an endomorphism of the elliptic curve defined over \(\mathbb{F}_q\). Its action on the curve’s points and on associated cohomological structures encodes the arithmetic of the reduction. The endomorphism is central to understanding how the curve behaves across field extensions.
5.4 Trace of Frobenius
The trace of Frobenius is an integer \(t\) determined by the point count via \[ \#E(\mathbb{F}_q) = q + 1 - t. \]
| Equivalently, \(t\) is related to the eigenvalues of Frobenius acting on appropriate modules. The number \(t\) satisfies the same Hasse bound \( | t | \le 2\sqrt{q}\). Knowledge of \(t\) is crucial in cryptographic contexts because it affects the group order used in elliptic curve arithmetic. |
|---|
6 Complex and analytic theory
6.1 Elliptic functions and lattices
Over \(\mathbb{C}\), elliptic curves can be described using complex tori obtained from lattices. A lattice \(\Lambda \subset \mathbb{C}\) is a discrete subgroup generated by two \(\mathbb{C}\)-linearly independent complex numbers. Meromorphic functions that are periodic with respect to \(\Lambda\) form the classical theory of elliptic functions, which can be used to produce explicit formulas for the curve and its group structure.
6.2 Complex tori
Given a lattice \(\Lambda\), the quotient \(\mathbb{C}/\Lambda\) is a complex torus. This space supports a natural group structure by addition modulo \(\Lambda\). Under suitable identification, \(\mathbb{C}/\Lambda\) is analytically isomorphic to an elliptic curve in projective space. Points correspond to equivalence classes of complex numbers, and addition on the torus matches the elliptic curve group law.
6.3 Uniformization
Uniformization provides the analytic parameterization of elliptic curves: every complex elliptic curve is isomorphic to a torus \(\mathbb{C}/\Lambda\) for some lattice \(\Lambda\). This correspondence explains how geometric data of the curve translates into analytic data of periods. It also yields complex analytic tools, such as differential equations and transformation formulas, for understanding the curve.
6.4 Weierstrass ℘-function
The Weierstrass \(\wp\)-function is a central elliptic function associated to a lattice \(\Lambda\). Its defining series generates a doubly periodic meromorphic function with a second-order pole at the origin. The curve can be realized explicitly by expressing \(x\) and \(y\) coordinates in terms of \(\wp(z)\) and \(\wp'(z)\), producing an equation of the form \(y^2=x^3+Ax+B\) after identifying the lattice invariants. This gives a concrete bridge between complex analysis and the algebraic geometry of elliptic curves.
7 Modular and arithmetic connections
7.1 Modular forms
Modular forms are complex analytic functions with transformation properties under the action of modular groups, and they encode arithmetic information. In the elliptic curve setting, one studies modular forms of weight \(2\) that correspond to the curve via their Fourier coefficients. These coefficients reflect deep arithmetic data, including how the curve behaves under reduction at primes.
7.2 Modularity theorem
The modularity theorem asserts that elliptic curves over \(\mathbb{Q}\) are associated to modular forms of weight \(2\). As a result, many arithmetic invariants of an elliptic curve can be compared to analytic quantities derived from the associated modular form. This connection provides both conceptual understanding and practical computational methods.
7.3 Galois representations
Elliptic curves give rise to representations of the absolute Galois group of \(\mathbb{Q}\) on torsion points of the curve. These Galois representations reflect how algebraic field extensions generated by torsion points act on the arithmetic of the curve. The relationship between modular forms and Galois representations is a guiding principle in establishing deep links between analysis and number theory.
7.4 Elliptic curves over number fields
The modular picture extends beyond \(\mathbb{Q}\) but becomes more intricate. For general number fields, one studies how elliptic curves relate to automorphic forms and how associated Galois representations behave. While theorems analogous to the \(\mathbb{Q}\) case require additional hypotheses and technical frameworks, the overarching theme remains: arithmetic geometry of elliptic curves is intertwined with automorphic and representation-theoretic objects.
8 Applications
8.1 Elliptic curve cryptography
Elliptic curve cryptography (ECC) uses the group law on rational points over finite fields to build secure cryptographic primitives. The security relies on the hardness of the elliptic curve discrete logarithm problem in appropriately chosen groups. Practical systems typically select curves with good arithmetic properties and ensure that the group order has a suitable large prime factor to prevent attacks.
8.2 Digital signatures
Digital signature schemes can be implemented using elliptic curves by combining scalar multiplication with hashing and verification steps. The underlying security is connected to the difficulty of problems like computing a private scalar from public information. Elliptic curve-based signatures offer shorter key sizes and efficient operations compared with older integer-based systems, though the exact performance depends on implementation choices.
8.3 Pseudorandom generation
Elliptic curve operations can be used to construct pseudorandom outputs via deterministic mappings from seeds, typically in combination with cryptographic hash functions and standardized protocols. In such designs, the curve’s arithmetic contributes to producing outputs that are computationally indistinguishable from random under standard assumptions, provided the scheme is implemented correctly and parameters are selected responsibly.
8.4 Cryptographic protocols
Beyond signatures and encryption-like tasks, elliptic curves appear throughout protocol design. Key exchange mechanisms, authentication flows, and secure channel establishment can rely on the group law and its algebraic structure. Many standardized protocols use elliptic curves because they balance efficiency with strong security properties when the parameters and threat model match the intended use.
9 Related topics
9.1 Elliptic surfaces
Elliptic surfaces generalize elliptic curves by letting the coefficients vary over a base curve. Instead of a single elliptic curve over a field, one studies a family of elliptic curves parameterized by another geometric object. This framework enables techniques from algebraic geometry to relate global geometric features (like singular fibers) to arithmetic phenomena.
9.2 Isogenies
An isogeny is a non-constant morphism between elliptic curves that is also a group homomorphism with finite kernel. Isogenies preserve much structure and relate the arithmetic of different curves. They play a central role in advanced cryptographic constructions as well as in theoretical investigations of how elliptic curves can be interconnected through their torsion subgroups.
9.3 Descent methods
Descent methods aim to determine rational points or the rank of an elliptic curve by reducing the problem to computations in simpler algebraic settings. These approaches often involve covering spaces and local-global principles, translating global information into local constraints and cohomological data. Descent is a major toolkit in the study of ranks and in the formulation of effective algorithms.
9.4 Selmer and Tate–Shafarevich groups
Selmer groups provide intermediate objects between the curve’s rational points and its associated cohomology. They help bound the rank and detect obstructions to certain local-to-global principles. The Tate–Shafarevich group measures failures of the Hasse principle for principal homogeneous spaces under the elliptic curve. Together, these groups appear prominently in arithmetic formulas and conjectures that relate algebraic and analytic invariants.