A LEISURELY INTRODUCTION TO FORMAL GROUPS AND ELLIPTIC CURVES Antonia W. Bluher

The purpose of this paper is twofold: to explain in an elementary way how to associate a formal group law to an elliptic curve (in Parts I and II) and to discuss some theorems related to work of Couveignes [C] (in Part III). The subject of formal groups is enormous, and the subject of elliptic curves is even larger. In Parts I and II we content ourselves with presenting just enough background to see how the two subjects are interconnected. Many (in fact, most) interesting topics relating elliptic curves and formal groups are not mentioned, for instance the connections of formal groups and elliptic curves with L-functions and the applications of formal groups to lifting ordinary abelian varieties from characteristic p to characteristic zero. The reader who is interested in these topics can consult the bibliography of [H]. This exposition should be accessible to people with no background in elliptic curves or formal groups.

We treat curves defined over arbitrary fields, including fields of characteristic two or three. Some standard theorems are stated without proof; in those cases precise references are given. For instance, it is not proved that the group law for an elliptic curve is associative. The paper is divided into three parts: (I) Formal group laws; (II) Elliptic curves and their associated formal group laws; and (III) Further results on formal group laws. Each part is divided into several sections. Cross references to theorems, propositions, lemmas, examples, equations within a part are given in parentheses, for example (3.2). Cross references from within one part to another part are preceded by the appropriate roman numeral, for example (I.3.2). Apart from some results in §III.3, none of the material is original. I would like to thank Al Laing for a very careful reading of the original manuscript and many suggestions for improvement.

Contents

PART I: FORMAL GROUPS 1. Definition and construction of formal group laws

2. A formal semigroup law is automatically a formal group law

3. Homomorphisms of formal group laws

4. Heights

PART II. ELLIPTIC CURVES AND THEIR ASSOCIATED FORMAL GROUPS 1. Background on elliptic curves

2. The affine plane Y ≠ 0

3. Function fields, local rings, and uniformizers

4. Power series expansions

5. Isogenies

6. Constructing the formal group law of an elliptic curve

7. Homomorphisms of formal group laws arising from isogenies

8. Height of an elliptic curve

PART III. FURTHER RESULTS ON FORMAL GROUPS 1. Some theorems of Couveignes

2. Hom(F, F′) as a Z-module or Z_{p}-module

3. Consequences of Couveignes’ theorems

PART I: FORMAL GROUPS

§I.1. Definition and construction of formal group laws

Let R be a commutative ring with a multiplicative identity 1. A formal power series over R is a symbol ∑_{n=0}^{∞} a_{n}τ^{n}, where a_{n} ∈ R and τ is a dummy variable. The set of power series can be made into a ring R[[τ]] by defining

∑ a_{i}τ^{i} + ∑ b_{i}τ^{i} = ∑(a_{i} + b_{i})τ^{i}

(∑ a_{i}τ^{i})(∑ b_{i}τ^{i}) = ∑ c_{i}τ^{i}, where c_{i} = ∑_{j=0}^{i} a_{j}b_{i−j}.

In other words, addition and multiplication are defined by extending the usual addition and multiplication rules for polynomials. One can recursively define R[[X, Y]] = R[[X]][[Y]], R[[X, Y, Z]] = R[[X, Y]][[Z]], and so on.

In general it is not possible to compose two power series in a meaningful way. For example, if we tried to form the composition f ∘ g with f = 1 + τ + τ^{2} + τ^{3} + ⋯ and g = 1 + τ we would get

f ∘ g = 1 + (1 + τ) + (1 + τ)^{2} + (1 + τ)^{3} + ⋯

The constant term is 1 + 1 + 1 + ⋯, which makes no sense. But there are some cases where f ∘ g does make sense, namely when f is a polynomial or when the constant term of g is zero. Let R[[X, Y]] = R[[X]][[Y]], the ring of formal power series in two variables. If F ∈ R[[X, Y]] and g, h ∈ τR[[τ]] then

F (g, h) makes sense and belongs to R[[τ]].

To see this, we must show that only finitely many terms of F (X, Y) contribute to the nth coefficient of F (g, h). Let F (X, Y) = ∑ f_{ij}X^{i}Y^{j}. If g = ∑_{i=1}^{∞} g_{i}τ^{i} and h = ∑_{i=1}^{∞} h_{i}τ^{i} then g^{i}h^{j} = g_{1}h_{1}τ^{i+j}+ higher order terms, so if i + j > n then f_{ij}g^{i}h^{j} does not contribute to the nth coefficient of F (g, h). Since there are a finite number of terms X^{i}Y^{j} with i + j ≤ n, it follows that F (g, h) is defined. Notice that if the constant term of F vanishes then F (g, h) ∈ τR[[τ]].

A one dimensional (commutative) formal group law over R is a power series F ∈ R[[X, Y]] with zero constant term such that the “addition” rule on τR[[τ]] given by

g ⊕_{F} h = F (g, h)

makes τR[[τ]] into an abelian group with identity 0. In other words, for every g, h we must have (f ⊕_{F} g) ⊕_{F} h = f ⊕_{F} (g ⊕_{F} h) (associative law), f ⊕_{F} g = g ⊕_{F} f (commutative law), f ⊕_{F} 0 = f (0 is identity), and for each f ∈ τR[[τ]] there exists g ∈ τR[[τ]] such that f ⊕_{F} g = 0 (inverses). Denote this group by C(F).

The following proposition gives a general method to construct formal group laws.

Proposition 1.1. Let G be an abelian group, 0_{G} its identity element, and write its multiplication law additively. Suppose there is a one-to-one map T : τR[[τ]] → G such that T (0) = 0_{G}, and a power series F ∈ R[[X, Y]] with zero constant term such that

T (g) + T (h) = T (F (g, h))  (1.1)

for all g, h ∈ τR[[τ]]. Then F defines a formal group law.

The nontrivial part of the proof is the existence of inverses. The proof will be given in the next section. Here we give three examples of the construction. The first two are warm-up examples, and the third is the construction of the formal group law associated to an elliptic curve.

Example 1.2. Let G = R[[τ]] under usual addition. Let T : τR[[τ]] → R[[τ]] be the inclusion. Then the equation (1.1) may be written as g + h = F (g, h). Thus X ⊕_{F} Y = F (X, Y) = X + Y. This is called the additive formal group law.

Example 1.3. Assume R is a ring with a unit. The units of R[[τ]] are the power series whose constant term is a unit in R; see Lemma 1.4 below.

Let T : τR[[τ]] → R[[τ]]^{×} be given by

T (g) = 1 + g.

Then

T (g)T (h) = (1 + g)(1 + h) = 1 + g + h + gh = T (g + h + gh).

Thus we are led to the multiplicative formal group law

X ⊕_{F} Y = F (X, Y) = X + Y + XY.

Lemma 1.4. The units of the ring R[[X_{1}, …, X_{n}]] are the power series whose constant term is a unit in R.

PROOF. Let R_{j} = R[[X_{1}, …, X_{j}]] for 1 ≤ j ≤ n, and let R_{0} = R. If j > 0 then R_{j} = R_{j−1}[X_{j}] by definition. Let M_{j} denote the ideal of R_{j} generated by X_{1}, X_{2}, …, X_{j} when j > 0, and let M_{0} = { 0 }. We make the inductive hypothesis that R_{j}^{×} = R^{×} + M_{j} for all j < n. This holds trivially when n = 1. Let n > 1, and let ∑ a_{i}X_{n}^{i} ∈ R_{n} be a power series whose inverse we wish to compute, where a_{i} ∈ R_{n−1}. Then ∑ a_{i}X_{n}^{i} ∑ b_{i}X_{n}^{i} = 1 iff

a_{0}b_{0} = 1
a_{0}b_{1} + a_{1}b_{0} = 0
⋯
a_{0}b_{m} + a_{1}b_{m−1} + ⋯ + a_{m−1}b_{1} + a_{m}b_{0} = 0
⋯

This infinite system of equations has a solution with b_{i} in R_{n−1} iff a_{0} is a unit in R_{n−1}. Thus

R_{n}^{×} = R_{n−1}^{×} + X_{n}R_{n}.

By induction hypothesis, R_{n−1}^{×} + X_{n}R_{n} = R^{×} + M_{n−1} + X_{n}R_{n}, and this equals R^{×} + M_{n}, since M_{n} = M_{n−1} + X_{n}R_{n}. □

Example 1.5. Those not familiar with elliptic curves should read this example after reading §II.1. Let R be a domain and let L be the quotient field of R[[τ]]. Let E be an elliptic curve with equation of the form

Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} = X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3},

where the a_{i} belong to R. Since R ⊂ L, one can consider E(L), the solutions to the above equation which lie in P^{2}(L). In Part II we will show that E(L) is a group (provided the projective curve is nonsingular), explicitly give a one-to-one map T : τR[[τ]] → E(L), and find a power series F such that T (g) + T (h) = T (F (g, h)). F will be called the formal group law associated to the elliptic curve E.

§I.2. A formal semigroup law is automatically a formal group law

Let R be a commutative ring with a multiplicative identity which we denote by 1. In the preceding section we defined a commutative formal group law to be a power series in two variables which makes τR[[τ]] into an abelian group with identity 0. The more customary definition is as follows: a (commutative) formal group law over R is a power series F (X, Y) ∈ R[[X, Y]] such that

(i) (ii) (iii) \begin{matrix}F (X, 0) = X; \\ F (X, Y) = F (Y, X) \\ F (F (X, Y), Z) = F (X, F (Y, Z)) \end{matrix}  (Additive Identity) (Commutative Law) (Associative Law).  (2.1)

We will show in Proposition 2.3 that this definition is equivalent to our earlier one. The first property implies that F has the form X + Y H(X, Y). By symmetry in X and Y, it must therefore be of the form

F (X, Y) = X + Y + XY G(X, Y),  G ∈ R[[X, Y]].  (2.2)

First we should check that (iii) makes sense; that is, that F (F (X, Y), Z) and F (X, F (Y, Z)) are well defined power series in X, Y, and Z. This follows from the following lemma.

Lemma 2.1. Let F, g be power series in two variables and let h be a power series in one variable. Suppose that g and h have zero constant term. Then F (g(X, Y), h(Z)) is a well defined power series in R[[X, Y, Z]].

PROOF. If F is a polynomial then the result is clear. Let F = ∑ F_{ab}X^{a}Y^{b}. Observe that g(X, Y)^{a}h(Z)^{b} consists only of terms c_{ijk}X^{i}Y^{j}Z^{k} such that i + j + k ≥ a + b. In other words, if i + j + k = N then only the terms of F with a + b ≤ N contribute to the coefficient of X^{i}Y^{j}Z^{k} in F (g, h). The important point is that there are only finitely many such a and b. This proves that F (g, h) is well defined. □

Lemma 2.2. Let F be a power series satisfying the three conditions above. There exists a power series ι(τ) ∈ τR[[τ]] such that

F (g, ι ∘ g) = 0 for all g ∈ τR[[τ]].

PROOF. Let ι^{(1)} = −τ. By (2.2)

F (τ, ι^{(1)}) ≡ τ − τ ≡ 0 mod τ^{2}.

Now assume inductively that ι^{(N)} ∈ τR[[τ]] satisfies F (τ, ι^{(N)}) ≡ 0 mod τ^{N+1} and ι^{(N)} ≡ ι^{(N−1)} mod τ^{N}. Then there is a ∈ R such that

F (τ, ι^{(N)}) ≡ aτ^{N+1} mod τ^{N+2}.

Let ι^{(N+1)} = ι^{(N)} − aτ^{N+1}. By (2.2)

F (ι^{(N)}, −aτ^{N+1}) ≡ ι^{(N)} − aτ^{N+1} = ι^{(N+1)} mod τ^{N+2}.

Thus

\begin{aligned}F (τ, ι^{(N+1)}) & ≡ F (τ, F (ι^{(N)}, −aτ^{N+1})) = F (F (τ, ι^{(N)}), −aτ^{N+1}) \\ & ≡ F (τ, ι^{(N)}) − aτ^{N+1} ≡ 0 mod τ^{N+2}. \end{aligned}

This completes the induction. Let ι ∈ τR[[τ]] be the power series such that ι ≡ ι^{(N)} mod τ^{N+1} for all N. Then F (τ, ι(τ)) = 0, and hence F (x, ι(x)) = 0 for all x ∈ τR[[τ]]. □

Proposition 2.3. Let F be a power series in two variables with coefficients in R such that F (0, 0) = 0. The following are equivalent.

(1) The three conditions in (2.1) hold;

(2) The binary operation on τR[[τ]] defined by f ⊕_{F} g = F (f, g) makes τR[[τ]] into an abelian group with identity 0; (3) The binary operation on τR[[τ]] defined by f ⊕_{F} g = F (f, g) makes τR[[τ]] into an abelian semigroup with identity 0.

PROOF. We will show (1) ⇒ (2) ⇒ (3) ⇒ (1). Assume (1) holds. Define a binary operation on τR[[τ]] by f ⊕_{F} g = F (f, g) for f, g ∈ τR[[τ]]. The three conditions immediately imply f ⊕_{F} 0 = f, f ⊕_{F} g = g ⊕_{F} f, and (f ⊕_{F} g) ⊕_{F} h = f ⊕_{F} (g ⊕_{F} h) for f, g, h ∈ τR[[τ]]. Lemma 2.2 implies f ⊕_{F} ι(f) = 0. This proves (2). It is obvious that (2) implies (3).

Now assume (3) holds. We will prove condition (iii) of (2.1) holds; the other conditions in (2.1) can be proved similarly. Let G(X, Y, Z) = F (F (X, Y), Z) − F (X, F (Y, Z)). We must show G = 0. By hypothesis, if a, b, c are any positive integers then

G(τ^{a}, τ^{b}, τ^{c}) = (τ^{a} ⊕_{F} τ^{b}) ⊕_{F} τ^{c} − τ^{a} ⊕_{F} (τ^{b} ⊕_{F} τ^{c}) = 0

as an element of R[[τ]]. We must show that every coefficient of G is zero. Write

G = ∑_{i,j,k≥0} g_{ijk}X^{i}Y^{j}Z^{k}.

Since the Nth coefficient of G(τ^{a}, τ^{b}, τ^{c}) is zero we have

∑_{{ i,j,k∈Z_{≥0} | (a,b,c)·(i,j,k)=N }} g_{ijk} = 0  (2.3)

for all positive integers a, b, c, N. We need to show each g_{ijk} = 0. Suppose not. Among all i, j, k for which g_{ijk} is nonzero, consider those for which N_{1} = i + j + k is minimal. Among all i, j, k with g_{ijk} ≠ 0 and i + j + k = N_{1}, consider those for which N_{2} = i + j is minimal. Finally, among all i, j, k with g_{ijk} ≠ 0, i + j + k = N_{1}, and i + j = N_{2} select the one for which N_{3} = i is minimal. Call this triple (i_{0}, j_{0}, k_{0}); that is, i_{0} + j_{0} + k_{0} = N_{1}, i_{0} + j_{0} = N_{2}, i_{0} = N_{3}. Choose integers M_{1}, M_{2}, M_{3} such that

M_{3} ≥ 1, M_{2} > M_{3}N_{3}, M_{1} > M_{2}N_{2} + M_{3}N_{3}.

Let

(a, b, c) = (M_{1} + M_{2} + M_{3}, M_{1} + M_{2}, M_{1}), N = M_{1}N_{1} + M_{2}N_{2} + M_{3}N_{3}.

We will obtain a contradiction by showing that

∑_{{ i,j,k∈Z_{≥0} | (a,b,c)·(i,j,k)=N }} g_{ijk} = g_{i_{0},j_{0},k_{0}} ≠ 0.  (2.4)

Suppose g_{ijk} ≠ 0 and (a, b, c) · (i, j, k) = N. The equality can be written

M_{1}(i + j + k) + M_{2}(i + j) + M_{3}i = N.  (2.5)

Now i + j + k ≥ N_{1} by the minimality of N_{1}. Strict inequality cannot hold, since otherwise

M_{1}(i + j + k) + M_{2}(i + j) + M_{3}i ≥ M_{1}(N_{1} + 1) > N.

Thus i + j + k = N_{1}. By minimality of N_{2} we know i + j ≥ N_{2}. Again strict inequality cannot hold, since otherwise

M_{1}(i + j + k) + M_{2}(i + j) + M_{3}i ≥ M_{1}N_{1} + M_{2}(N_{2} + 1) > N.

Thus i + j = N_{2}. Now the equality (2.5) shows i = N_{3}. This establishes (2.4) and completes the proof. □

Proof of Proposition 1.1: The hypothesis of Proposition 1.1 is that there is an injective map T from τR[[τ]] into an abelian group G such that T (0) = 0_{G}, and there is a power series F (X, Y) with zero constant term such that

T (g) + T (h) = T (F (g, h))

for all g, h ∈ τR[[τ]]. We need to show that F gives an abelian group law on τR[[τ]]. By the preceding proposition, it suffices to show F makes τR[[τ]] into an abelian semigroup with identity 0; that is, if f, g, h ∈ τR[[τ]] then

f ⊕_{F} (g ⊕_{F} h) = (f ⊕_{F} g) ⊕_{F} h, f ⊕_{F} g = g ⊕_{F} h, f ⊕_{F} 0 = f.

Now T (f ⊕_{F} (g ⊕_{F} h)) = T (f) + T (g ⊕_{F} h) = T (f) + T (g) + T (h) and similarly T ((f ⊕_{F} g) ⊕_{F} h) = T (f) + T (g) + T (h). This proves the first identity, since T is one-to-one. The other two identities are proved similarly. □

§I.3. Homomorphisms of formal group laws

If F is a formal group law then write C(F) for the group it determines. That is, C(F) = τR[[τ]] as a set, and the group law is given by g ⊕_{F} h = F (g, h). If F, F′ are two formal group laws then a homomorphism from F to F′ is defined as a power series U(τ) ∈ τR[[τ]] with zero constant term such that g ↦ U(g) defines a homomorphism from C(F) into C(F′). Explicitly,

U ∘ (x ⊕_{F} y) = (U ∘ x) ⊕_{F′} (U ∘ y)

for all x, y ∈ τR[[τ]]. In terms of power series this can be written

U(F (X, Y)) = F′(U(X), U(Y)).  (3.1)

The reason that U has zero constant term is that U must take τR[[τ]] into itself. An example of a homomorphism from F to itself is the multiplication by n map, denoted [n] or [n]_{F}, which is defined by the rules:

[0] = 0, [1] = τ, [n + 1]τ = [n]τ ⊕_{F} τ = F ([n]τ, τ) if n > 0, [n] = ι ∘ [−n] if n < 0.  (3.2)

Let G_{1}, G_{2} be abelian groups, and let T_{i} : τR[[τ]] → G_{i} (i = 1, 2) be one-to-one maps such that T_{i}(0) is the identity element of G_{i}. Let F_{i} be power series with zero constant term such that

T_{i}(g) ⊕_{G_{i}} T_{i}(h) = T_{i}(g ⊕_{F_{i}} h), i = 1, 2,

where ⊕_{G_{i}} denotes addition on the group G_{i} and g ⊕_{F_{i}} h = F_{i}(g, h). We showed that F_{i} is a formal group law, and the above equation simply states that T_{i} is a group homomorphism from C(F_{i}) into G_{i}.

Lemma 3.1. Let G_{i}, T_{i}, F_{i}, C(F_{i}) be as above. Suppose there is a group homomorphism ψ : G_{1} → G_{2} and a power series U with zero constant term such that

ψ(T_{1}(g)) = T_{2}(U(g))  (3.3)

for all g ∈ τR[[τ]]. Then U is a homomorphism between the formal group laws defined by F_{1} and F_{2}.

PROOF. It suffices to show that U is a homomorphism from C(F_{1}) to C(F_{2}). By hypothesis there is a commutative diagram

C(F_{1}) ⟶^{T_{1}} G_{1}

U ↓  ↓ ψ

C(F_{2}) ⟶^{T_{2}} G_{2}

Here T_{1}, T_{2}, ψ are homomorphisms and T_{1}, T_{2} are injective. It follows by diagram chasing that U is a homomorphism, as claimed. □

As a special case, let G_{1} = G_{2} = G, T_{1} = T_{2} = T, F_{1} = F_{2} = F, and ψ(g) = ng, where n ∈ Z. Then U = [n], which was defined by (3.2). The power series for [n] may either be computed from the recursion (3.2) or from the formula (3.3), which in this context reads

nT (g) = T ([n](g))  for g ∈ τR[[τ]].  (3.4)

For the additive formal group law we have T = inclusion of τR[[τ]] into R[[τ]] and the formula reads ng = [n](g). So in that case,

[n](τ) = nτ (Additive Formal Group)

For the multiplicative formal group law we have G = R[[τ]]^{×} and T (g) = 1 + g, so the formula reads (1 + g)^{n} = 1 + [n](g). Thus for the multiplicative formal group law the coefficients of [n] are given by the binomial coefficients:

[n](g) = ∑_{i=1}^{n} \binom{n}{i}τ^{i} (Multiplicative Formal Group).

In the special case where n = p = the characteristic of R with p > 0 we have (1 + g)^{p} = 1 + g^{p}, and therefore

[p](τ) = τ^{p} (Multiplicative Formal Group).

§I.4. Heights

If R has characteristic p then the height of a homomorphism U, written ht(U), is the largest integer h such that U(τ) = V (τ^{p^{h}}) for some power series V, or ∞ if U = 0. The height of the formal group law is defined as the height of the homomorphism [p]. For the additive formal group law of Example 2.2 defined by F (X, Y) = X + Y we have [p](τ) = pτ = 0, so the height of F is ∞. For the multiplicative formal group law of Example 2.3 given by F (X, Y) = X +Y +XY we have [p](τ) = τ^{p}, therefore the multiplicative formal group law has height one.

Example 4.1. Let F = ∑ f_{ij}X^{i}Y^{j} be a formal group law over an integral domain R of characteristic p > 0. Let F^{(p)} = ∑ f_{ij}^{p}X^{i}Y^{j}. We claim that F^{(p)} is a formal group law, and ϕ = X^{p} is a homomorphism (evidently of height 1) from F to F^{(p)}. For the first assertion, replace X, Y, Z by X^{1/p}, Y^{1/p}, Z^{1/p} in the relation (2.1) then take the pth power. This yields the corresponding relations for F^{(p)}. For the second assertion, note that

F^{(p)}(ϕ(X), ϕ(Y)) = F (X, Y)^{p} = ϕ(F (X, Y)).

Observe that ϕ^{k} : F → F^{(p^{k})}.

Proposition 4.2. Let F_{1}, F_{2} be formal group laws over an integral domain R of characteristic p. Let U(τ) = ∑ u_{i}τ^{i} be a homomorphism from F_{1} to F_{2} of height k. Then the first nonzero coefficient of U is u_{p^{k}}. Moreover, there is a homomorphism V : F_{1}^{(p^{k})} → F_{2} such that U = V ∘ ϕ^{k}.

PROOF. If k = 0 then u_{j} ≠ 0 for some j which is prime to p, therefore U′(τ) = ∑_{m} mu_{m}τ^{m−1} is nonzero. Differentiate the equation U(F_{1}(X, Y)) = F_{2}(U(X), U(Y)) with respect to Y and then set Y = 0. We obtain

U′(F_{1}(X, 0))\frac{∂F_{1}}{∂Y} (X, 0) = \frac{∂F_{2}}{∂Y} (U(X), U(0)) U′(0).

Since F_{i}(X, Y) = X + Y + XY G_{i}(X, Y) for i = 1, 2, this becomes

U′(X)(1 + XG_{1}(X, 0)) = (1 + G_{2}(U(X), 0)) u_{1}.

The left side is nonzero, therefore u_{1} ≠ 0.

Now let k ≥ 1 and set q = p^{k}. By definition of height, there is a power series V (τ) ∈ τR[[τ]] such that U(τ) = V (τ^{q}). Now V′ is nonzero, since otherwise V would be a function of τ^{p}, so that q could be replaced by pq. We claim V is a homomorphism from F_{1}^{(q)} to F_{2}. We have to show V (F_{1}^{(q)}(X, Y)) = F_{2}(V (X), V (Y)). The left side is V (F_{1}(X^{1/q}, Y^{1/q})^{q}) = U(F_{1}(X^{1/q}, Y^{1/q})). The right side is F_{2}(U(X^{1/q}), U(Y^{1/q})). These two are equal because U is a homomorphism from F_{1} to F_{2}. Since V′ ≠ 0, V has height zero. It follows from the case k = 0 that the first coefficient of V is nonzero. Thus the coefficient of τ^{q} in U is nonzero. □

Example 4.3 Suppose F = ∑ f_{ij}X^{i}Y^{j} is a formal group law over an integral domain R of characteristic two. Then

[2]_{F} = [1]_{F} ⊕_{F} [1]_{F} = F (τ, τ) = ∑_{n=1}^{∞} τ^{n} ∑_{i+j=n} f_{ij}.

Since F is symmetric, f_{ij} + f_{ji} = 0. Thus the terms in ∑ f_{ij} with i < j cancel the terms with i > j. The only surviving terms are f_{ii}, where 2i = n. Thus

[2] = ∑_{n=1}^{∞} f_{nn}τ^{2n}.

Proposition 4.2 asserts that the smallest n for which f_{nn} ≠ 0 is a power of two, say 2^{k}, and the height of F is k + 1.

Corollary 4.4. If F, F′, F′′ are formal group laws over an integral domain R, U : F → F′, and V : F′ → F′′, then

ht(V ∘ U) = ht(V) + ht(U).

PROOF. Define the degree of a nonzero power series ∑ a_{i}τ^{i} to be the smallest i such that a_{i} ≠ 0. Proposition 4.2 asserts that if U is a nonzero homomorphism of formal group laws then deg(U) = p^{ht(U)}. The degrees of power series multiply when they are composed, therefore p^{ht(V ∘U)} = p^{ht(V)}p^{ht(U)} = p^{ht(V)+ht(U)}. □

If F, F′ are formal group laws over an integral domain R and U_{1}, U_{2} : F → F′, define U_{1} ⊕_{F′} U_{2} = F′(U_{1}, U_{2}). U_{1} ⊕_{F′} U_{2} is a homomorphism from F to F′.

Corollary 4.5. ht(U_{1} ⊕_{F′} U_{2}) ≥ inf{ ht(U_{1}), ht(U_{2}) }. If ht(U_{1}) < ht(U_{2}) then ht(U_{1} ⊕_{F′} U_{2}) = ht(U_{1}).

PROOF. Write F′(X, Y) = X+Y +XY G′(X, Y). Then U_{1}⊕_{F′} U_{2} = F′(U_{1}, U_{2}) = U_{1}+U_{2}+U_{1}U_{2}G′(U_{1}, U_{2}). The corollary is therefore true when the word “degree” is substituted for the word “height”. Since ht(U_{i}) = log_{p}(deg(U_{i})), the corollary follows. □

Corollary 4.6. If F, F′ are formal group laws defined over an integral domain R and if there is a nonzero homomorphism U from F to F′ then F and F′ have the same height.

PROOF. Certainly [p]_{F′} ∘ U = U ∘ [p]_{F}, so [p]_{F} and [p]_{F′} have the same height by Corollary 4.4. □

It is a theorem of M. Lazard ([F], [H]) that if R is a separably closed field of characteristic p then two formal group laws F, F′ defined over R are isomorphic iff they have the same height; this gives a partial converse to Corollary 4.6. We will see that the height of the formal group law associated to an elliptic curve E defined over a field R of characteristic p is one or two according as E is ordinary or supersingular. Thus Lazard’s Theorem implies that the formal group laws of any two ordinary elliptic curves (or any two supersingular elliptic curves) are isomorphic over the algebraic closure of R. On the other hand, the condition that two elliptic curves over R be isomorphic is much more restrictive (the two curves must have the same j-invariant; see [S, p. 47-50]) This means that isomorphisms of formal group laws are far more abundant than isomorphisms of elliptic curves.

Corollary 4.7. Every formal group F over a ring of characteristic p has height at least one.

PROOF. We claim that for any n ∈ Z,

[n]_{F} = nτ + τ^{2}(⋯).  (4.1)

This is true if n = 0 or 1 since [0]_{F} = 0 and [1]_{F} = τ. Let n > 1, and assume the claim is true for n − 1. Then it is true for n also, since

[n]_{F} = F ([n − 1]_{F} , τ) = [n − 1]_{F} + τ + τ^{2}(⋯).

The claim is true for negative integers because [−n]_{F} = ι ∘ [n]_{F} where ι = [−1]_{F}, and the first term of ι is −τ by the proof of Lemma 2.2. This proves the claim. Now [p]_{F} = pτ + ⋯, and pτ = 0. Thus [p]_{F} cannot have height zero by Proposition 4.2. □

Corollary 4.8. Suppose R is an integral domain of characteristic p > 0 and F is a formal group law over R. If n = ap^{t} with (a, p) = 1 then ht([n]_{F}) = t ht(F).

PROOF. ht([n]_{F}) = ht([a]_{F})+t ht([p]_{F}) by Corollary 4.4. The height of [a]_{F} is zero by (4.1), and ht([p]_{F}) = ht(F) by definition. □

Proposition 4.9. Let F, F′ be formal group laws of finite height h over a finite field K of characteristic p and let v, v′ be the first nonzero coefficient of the power series [p]_{F} , [p]_{F′}, respectively. Let L be the compositum of K and F_{q}, where q = p^{h}. If there is a nonzero homomorphism U from F into F′ then N_{L/F_{q}}(v) = N_{L/F_{q}}(v′).

PROOF. Let K have cardinality p^{n}. Write n = n′d, h = h′d, where (n′, h′) = 1. Then L has cardinality p^{n′h′d} = q^{n′}. By Proposition 4.2, [p]_{F} = V ∘ ϕ^{h}, [p]_{F′} = V′ ∘ ϕ^{h}. Here V is a homomorphism of height zero from F^{(q)} into F, and similarly for V′. The first term of V is vτ. Now ϕ^{k} ∘ V = V^{(p^{k})} ∘ ϕ^{k}, where V^{(p^{k})} is the homomorphism from F^{(p^{k+h})} into F^{(p^{k})} obtained by raising the coefficients of V to the p^{k}th power. Thus

[p^{n′}]_{F} = (V ∘ ϕ^{h})^{n′} = V ∘ V^{(q)} ∘ V^{(q^{2})} ∘ ⋯ ∘ V^{(q^{n′−1})} ∘ ϕ^{hn′}.  (4.2)

Denote V ∘ V^{(q)} ∘ ⋯ ∘ V^{(q^{n′−1})} by N(V). The first term of N(V) is

( ∏_{i=0}^{n′−1} v^{q^{i}})τ = N_{L/F_{q}}(v)τ.

Since U, V, V′ have coefficients in K and a^{p^{n}} = a for a ∈ K, ϕ^{hn′} = ϕ^{nh′} commutes with U, V, and V′. Thus the equality [p^{n′}]_{F′} ∘ U = U ∘ [p^{n′}]_{F} implies N(V′) ∘ U = U ∘ N(V). If U has height j then the coefficient of τ^{p^{j}} in the above equality is N_{L/F_{q}}(v′)u_{p^{j}} = u_{p^{j}}N_{L/F_{q}}(v), and u_{p^{j}} ≠ 0 by Proposition 4.2. Thus N_{L/F_{q}}(v) = N_{L/F_{q}}(v′). □

PART II. ELLIPTIC CURVES AND THEIR ASSOCIATED FORMAL GROUPS

§II.1. Background on elliptic curves

If K is a field then the 2-dimensional projective space ℙ^{2}(K) is the set of triples (X, Y, Z) ∈ K × K × K such that X, Y, Z are not all zero, modulo the equivalence (X, Y, Z) ≅ (λX, λY, λZ) for all 0 ≠ λ ∈ K. Three points (X_{i}, Y_{i}, Z_{i}) (i = 1, 2, 3) in ℙ^{2}(K) are said to be colinear if there exist λ, μ, ν ∈ K, not all zero, such that λX_{i} + μY_{i} + νZ_{i} = 0 for i = 1, 2, 3. In particular, if Z_{i} ≠ 0 for all i then the colinearity of the three points (X_{i}, Y_{i}, Z_{i}) in ℙ^{2}(K) is equivalent to the colinearity of the points (x_{i}, y_{i}) in the affine plane, where x_{i} = X_{i}/Z_{i} and y_{i} = Y_{i}/Z_{i}. This follows from the equation λx_{i} + μy_{i} + ν = 0 for all i.

A Weierstrass equation is a cubic equation W (X, Y, Z) = 0, where

W (X, Y, Z) = Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} − (X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3}),  (1.1)

a_{i} ∈ K. Since this equation is homogeneous, we can think of its solutions as lying in ℙ^{2}(K). A singular point is a point P ∈ ℙ^{2}(\overline{K}) such that W (P) = ∂W/∂X(P) = ∂W/∂Y (P) = ∂W/∂Z(P) = 0, where \overline{K} denotes the algebraic closure of K. It can be shown that the Weierstrass equation has no singular points iff Δ ≠ 0, where Δ is a certain polynomial in the a_{i}; see [S, p. 46]. Let us assume Δ ≠ 0. Then the set of solutions to (1.1) in ℙ^{2}(\overline{K}) is called an elliptic curve. The elements of the elliptic curve are called points. If L is any field containing all the Weierstrass coefficients a_{i} then E(L) is defined to be the set of solutions to (1.1) in ℙ^{2}(L). The Weierstrass equation can often be simplified. For example, in characteristic zero a linear change of coordinates puts the Weierstrass equation into the form Y^{2}Z = X^{3} + a_{4}XZ^{2} + a_{6}Z^{3}. See [S, Appendix A].

The only point on the elliptic curve which intersects the line Z = 0 is the point (0, 1, 0). This is called the point at infinity and is often denoted by O_{E}. In contrast, the “finite” points of E(K) are the points (X, Y, 1) which satisfy the above equation, and it is customary to identify these points with the points (X, Y) in the affine plane K × K such that

Y^{2} + a_{1}XY + a_{3}Y = X^{3} + a_{2}X^{2} + a_{4}X + a_{6}.  (1.2)

E(K) can be made into an abelian group with additive identity equal to O_{E} by insisting that any three colinear points on E(K) (counting multiplicities) sum to O_{E}. The proof that this group law is associative can be found in [K] using Bézout’s Theorem or in [S] using the Picard group. In this context, the phrase “counting multiplicities” means to count the multiplicities of the roots of the cubic which results when one variable is eliminated from the Weierstrass equation by using the equation of the intersecting line. We give several examples which should make this clear.

Example 1.1: Lines through the origin. The equation of a line through (0, 1, 0) has the form λX+νZ = 0, where λ, ν ∈ K are not both zero. If λ = 0 then the line is Z = 0, and the Weierstrass equation becomes simply 0 = W (X, Y, 0) = X^{3}. This has one solution X = 0 with multiplicity three. Thus (0, 1, 0) intersects Z = 0 with multiplicity three. This gives 3(0, 1, 0) = (0, 1, 0), which is consistent with the fact that (0, 1, 0) is the identity. If λ ≠ 0 then X = cZ, where c = −ν/λ. The Weierstrass equation becomes

W (cZ, Y, Z) = Y^{2}Z + (a_{1}c + a_{3})Y Z^{2} − (c^{3} + a_{2}c^{2} + a_{4}c + a_{6})Z^{3} = 0.

This factors as

Z(Y^{2} + (a_{1}c + a_{3})Y Z − (c^{3} + a_{2}c^{2} + a_{4}c + a_{6})Z^{2}) = Z(Y − y_{1}Z)(Y − y_{2}Z)

where y_{1}, y_{2} belong to a quadratic extension of K and satisfy y_{1}+y_{2} = −(a_{1}c+a_{3}), y_{1}y_{2} = −(c^{3}+a_{2}c^{2}+a_{4}c+ a_{6}). The intersection of E with the line is {(0, 1, 0), (c, y_{1}, 1), (c, y_{2}, 1)}, hence (0, 1, 0)+(c, y_{1}, 1)+(c, y_{2}, 1) = (0, 1, 0). In other words, if (c, y_{1}, 1) lies on E then −(c, y_{1}, 1) = (c, y_{2}, 1), where y_{1} + y_{2} = −(a_{1}c + a_{3}). This gives the inversion formula:

−(x, y, 1) = (x, −(y + a_{1}x + a_{3}), 1).  (1.3)

If it happens that y = −(y + a_{1}x + a_{3}), that is, 2y = −(a_{1}x + a_{3}), then (x, y, 1) is a two-torsion point.

Example 1.2: Lines which miss the origin. The equation of a line which misses (0, 1, 0) is λX + μY + νZ = 0, where μ ≠ 0. Since (0, 1, 0) is the only point on E which intersects Z = 0, the intersection points of the line with the elliptic curve all have a nonzero Z-coordinate. Let m = −λ/μ, b = −ν/μ, y = Y/Z, x = X/Z. Then the three intersection points (x_{i}, y_{i}, 1), i = 1, 2, 3, satisfy the Weierstrass equation and y_{i} = mx_{i} + b. Another way to view this is: suppose (x_{1}, y_{1}, 1) and (x_{2}, y_{2}, 1) are two points on the elliptic curve such that x_{1} ≠ x_{2}, and define m = (y_{1} − y_{2})/(x_{1} − x_{2}), b = y_{1} − mx_{1}. Substitute y = mx + b into the affine form of the Weierstrass equation to get a cubic equation in x of the form x^{3} + Bx^{2} + Cx + D = 0, where the coefficients explicitly depend on the a_{i} and on m and b. Explicitly, B = −m^{2} − a_{1}m + a_{2}. Two roots of this cubic equation are x_{1} and x_{2}. Let x_{3} denote the third root. Then

x^{3} + Bx^{2} + Cx + D = (x − x_{1})(x − x_{2})(x − x_{3}) = x^{3} − (x_{1} + x_{2} + x_{3})x^{2} + (⋯)x + (⋯),

so that x_{3} = −x_{1} − x_{2} − B. This yields the addition formula

(x_{1}, y_{1}, 1) + (x_{2}, y_{2}, 1) = (x_{3}, −(y_{3} + a_{1}x_{3} + a_{3}), 1) if x_{1} ≠ x_{2},
x_{3} = −x_{1} − x_{2} + m^{2} + a_{1}m − a_{2}, m = (y_{1} − y_{2})/(x_{1} − x_{2}),
y_{3} = mx_{3} + y_{1} − mx_{1}.

Example 1.3: Duplication formula. How do we compute P + P? Assume P = (x_{1}, y_{1}, 1) is not a two-torsion point, that is, 2y_{1} ≠ −(a_{1}x + a_{3}). Then −(P + P) is the point (x_{2}, y_{2}, 1) on the curve such that 2(x_{1}, y_{1}, 1) + (x_{2}, y_{2}, 1) = (0, 1, 0). Let λX + μY + νZ be the line which passes through these points with correct multiplicity. It misses the origin, so μ ≠ 0. Thus the line has the form y − y_{1} = m(x − x_{1}), where y = Y/Z, x = X/Z. First we will find m, then we will find x_{2}, y_{2}. When y is replaced by m(x − x_{1}) + y_{1} in the Weierstrass equation, we get a cubic x^{3} + Bx^{2} + Cx + D, and it should equal (x − x_{1})^{2}(x − x_{2}). Here B = a_{2} − m^{2} − a_{1}m, C = m^{2}(2x_{1}) + m(−2y_{1} + a_{1}x_{1} − a_{3}) + (a_{4} − a_{1}y_{1}). If we differentiate the cubic and set x = x_{1} we are supposed to get zero. Hence 3x_{1}^{2} + 2Bx_{1} + C = 0. We can solve for m in this relation; in fact m will just be the slope of the tangent line to the curve E at P, namely m = (dy/dx)(P). It turns out

m = (3x_{1}^{2} + 2a_{2}x_{1} + a_{4} − a_{1}y_{1})/(a_{1}x_{1} + 2y_{1} + a_{3}).

Since (x − x_{1})^{2}(x − x_{2}) = x^{3} + Bx^{2} + Cx + D,

x_{2} = −2x_{1} − B = −2x_{1} − a_{2} + m^{2} + a_{1}m, y_{2} = m(x_{2} − x_{1}) + y_{1}.

Finally,

2(x_{1}, y_{1}, 1) = −(x_{2}, y_{2}, 1) = (x_{2}, −(y_{2} + a_{1}x_{2} + a_{3}), 1).

§II.2. The affine plane Y ≠ 0

It turns out that the image of the map T : τR[[τ]] → E(L) which was alluded to in Example I.1.4 will be contained in the set of points (X, Y, Z) for which Y ≠ 0. For this reason we will need some addition formulas for points in this region. In principle, such addition formulas could be deduced from formulas in the preceding section by using a change of variables, however this method is cumbersome to the point that it will crash Mathematica on a workstation. The better method is to introduce new affine coordinates (X, Y, Z) = (t, −1, s) and calculate addition by intersecting the curve with various lines.

There are three points (X, Y, Z) on E (counting multiplicities) such that Y = 0. Suppose λX +μY +νZ is a line which misses these three points. Then λ and ν are not both zero. If ν ≠ 0 then the line misses the three points iff (−λ/ν, 0, 1) ∉ E; that is, iff −λ/ν is not a root of the equation X^{3} + a_{2}X^{2} + a_{4}X + a_{6} = 0. If λ ≠ 0 then the line misses the three points iff (1, 0, −ν/λ) ∉ E iff −ν/λ is not a root of the equation 1 + a_{2}Z + a_{4}Z^{2} + a_{6}Z^{3} = 0.

If Y ≠ 0 then (X, Y, Z) = (t, −1, s), where s = −Z/Y, t = −X/Y. The point (t, −1, s) lies on the line λX + μY + νZ = 0 iff λt + νs = μ. The Weierstrass equation can be written as

s = t^{3} + a_{1}ts + a_{2}t^{2}s + a_{3}s^{2} + a_{4}ts^{2} + a_{6}s^{3}.  (2.1)

The next proposition summarizes addition formulas of the form (t_{1}, −1, s_{1}) + (t_{2}, −1, s_{2}) + (t_{3}, −1, s_{3}) = (0, 1, 0).

Proposition 2.1. Let P_{i} = (t_{i}, −1, s_{i}) for i = 1, 2.

(a) Suppose t_{1} ≠ 0 and let m = s_{1}/t_{1}. If 1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3} ≠ 0 then

−P_{1} = (\frac{−t_{1}}{1 − a_{1}t_{1} − a_{3}s_{1}} , −1, \frac{−s_{1}}{1 − a_{1}t_{1} − a_{3}s_{1}} ) .  (2.2)

(b) Suppose t_{1} ≠ t_{2} and let m = (s_{1} − s_{2})/(t_{1} − t_{2}), b = s_{1} − mt_{1}, A = 1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3}. If A ≠ 0 then

P_{1} + P_{2} = −(t_{3}, −1, mt_{3} + b),
t_{3} = −t_{1} − t_{2} − \frac{a_{1}m + a_{2}b + a_{3}m^{2} + 2a_{4}mb + 3a_{6}m^{2}b}{A}.  (2.3)

(c) Suppose 1 − a_{1}t_{1} − 2a_{3}s_{1} − a_{2}t_{1}^{2} − 2a_{4}t_{1}s_{1} − 3a_{6}s_{1}^{2} ≠ 0. Let

m = \frac{a_{1}s_{1} + 3t_{1}^{2} + 2a_{2}s_{1}t_{1} + a_{4}s_{1}^{2}}{1 − a_{1}t_{1} − 2a_{3}s_{1} − a_{2}t_{1}^{2} − 2a_{4}t_{1}s_{1} − 3a_{6}s_{1}^{2}} .

Suppose 1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3} ≠ 0. Then

[2]P_{1} = P_{1} + P_{1} = −(t_{3}, −1, mt_{3} − mt_{1} + s_{1}),

t_{3} = −2t_{1} − \frac{a_{1}m + a_{3}m^{2} + (a_{2} + 2a_{4}m + 3a_{6}m^{2})(s_{1} − mt_{1})}{1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3}}.

PROOF. (b) P_{1}, P_{2} lie on the line mX − bY − Z = 0. Let P_{3} be the third point of intersection of this line with the elliptic curve. Write P_{3} = (x_{3}, y_{3}, z_{3}). If y_{3} = 0 then P_{3} = (1, 0, m). From the Weierstrass equation (1.1), 1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3} = 0, contrary to the hypothesis. Thus y_{3} ≠ 0, and hence P_{3} can be written P_{3} = (t_{3}, −1, mt_{3} + b). Likewise P_{i} = (t_{i}, −1, mt_{i} + b) for i = 1, 2. When (t, −1, mt + b) is substituted for (X, Y, Z) in the Weierstrass equation, the result must be of the form A(t − t_{1})(t − t_{2})(t − t_{3}) with A ≠ 0. Hence

\begin{aligned}−(mt + b) & + a_{1}t(mt + b) + a_{3}(mt + b)^{2} + t^{3} + a_{2}t^{2}(mt + b) + a_{4}t(mt + b)^{2} + a_{6}(mt + b)^{3} \\ & = A(t − t_{1})(t − t_{2})(t − t_{3}). \end{aligned}

The left side is of the form

(1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3})t^{3} + (a_{1}m + a_{3}m^{2} + a_{2}b + 2a_{4}mb + 3a_{6}m^{2}b)t^{2} + (⋯)t + (⋯)

and the right side is of the form At^{3} − A(t_{1} + t_{2} + t_{3})t^{2} + · · ·. Now (b) follows immediately.

(a) Let P_{2} = (0, 1, 0), m = s_{1}/t_{1}, A = 1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3}. Since A ≠ 0, (b) implies that P_{1} + (0, 1, 0) + (t_{3}, −1, mt_{3}) = (0, 1, 0), where t_{3} = −t_{1} − (a_{1}m + a_{3}m^{2})/A. Thus −P_{1} = (t_{3}, −1, mt_{3}). Now

t_{1}^{3}A = t_{1}^{3} + a_{2}t_{1}^{2}s_{1} + a_{4}t_{1}s_{1}^{2} + a_{6}s_{1}^{3} = s_{1} − a_{1}t_{1}s_{1} − a_{3}s_{1}^{2},

thus

\begin{aligned}t_{3} & = −t_{1} − \frac{a_{1}m + a_{3}m^{2}}{A} = \frac{−t_{1}(t_{1}^{3}A) − (a_{1}t_{1}^{2}s_{1} + a_{3}t_{1}s_{1}^{2})}{t_{1}^{3}A} \\ & = \frac{−t_{1}s_{1}}{s_{1} − a_{1}t_{1}s_{1} − a_{3}s_{1}^{2}} = \frac{−t_{1}}{1 − a_{1}t_{1} − a_{3}s_{1}} . \end{aligned}

(c) From equation (2.1) one computes that (ds/dt)(P_{1}) = m. Thus s = mt+(s_{1}−mt_{1}) is the line which is tangent to the elliptic curve at P_{1}. In (X, Y, Z)-coordinates this line has the equation mX+(mt_{1}−s_{1})Y −Z. Let P_{3} = (x_{3}, y_{3}, z_{3}) be the other point on the curve which intersects this line. The only point on the line with y = 0 is (1, 0, m). Since we assume 1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3} ≠ 0, (1, 0, m) does not lie on the curve. Thus y_{3} ≠ 0, so P_{3} = (t_{3}, −1, s_{3}). Substitute (t, −1, mt + b) with b = s_{1} − mt_{1} into the Weierstrass equation to get

(1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3})t^{3} + (a_{1}m + a_{3}m^{2} + a_{2}b + 2a_{4}mb + 3a_{6}m^{2}b)t^{2} + (⋯)t + (⋯)
= (constant)(t − t_{1})^{2}(t − t_{3}).

Now solve for t_{3} to get the result. □

§II.3. Function fields, local rings, and uniformizers

Let K be any field, and let C = C(X, Y, Z) be a curve in ℙ^{2}(\overline{K}). This means that C is an irreducible homogeneous polynomial with coordinates in \overline{K}. Assume the coefficients of C belong to K, and let C(K) = \{ P ∈ ℙ^{2}(K) | C(P) = 0 \}. A point in C(\overline{K}) is called nonsingular if ▽_{P} C ≠ 0, where

▽_{P} C = (\frac{∂}{∂X} C(P), \frac{∂}{∂Y} C(P), \frac{∂}{∂Z} C(P)) .

The function field K(C) of C over K is the set of all quotients p(X, Y, Z)/q(X, Y, Z), where p and q are homogeneous polynomials of the same degree with coefficients in K such that C does not divide q, modulo the equivalence: p/q ≅ p′/q′ iff pq′ − qp′ is divisible by C. The addition and multiplication in K(C) are defined in the same way as for rational functions. Equivalently, if we set x = X/Z and y = Y/Z then K(C) is the quotient field of the integral domain

K[x, y]/(C(x, y, 1)).

This field has transcendence degree 1, thus any two elements of the function field satisfy some algebraic relation. Notice that p(λX, λY, λZ)/q(λX, λY, λZ) = p(X, Y, Z)/q(X, Y, Z) because of the homogeneity, so p(P)/q(P) makes sense for P ∈ C(\overline{K}) provided q(P) ≠ 0. A function f ∈ K(C) is said to be defined at a point P ∈ C(\overline{K}) if there exists p/q in the equivalence class of f such that q(P) ≠ 0. If f is defined at P then the value of f at P, denoted f(P), is defined as p(P)/q(P) for any (hence every) p/q which is in the equivalence class of f and for which q(P) ≠ 0. If P ∈ C(K) and f ∈ K(C) is defined at P then f(P) ∈ K.

As an example, let us show that for the Weierstrass equation, Z/X is defined at (0, 1, 0). Since Z(Y^{2} + a_{3}Y Z − a_{6}Z^{2}) = X(−a_{1}Y Z + X^{2} + a_{2}XZ + a_{4}Z^{2}),

Z/X = \frac{−a_{1}Y Z + X^{2} + a_{2}XZ + a_{4}Z^{2}}{Y^{2} + a_{3}Y Z − a_{6}Z^{2}} .

Now Y^{2} + a_{3}Y Z − a_{6}Z^{2} does not vanish at (0, 1, 0), so Z/X is indeed defined at (0, 1, 0).

For the remainder of this section assume P ∈ C(K). Let Ω_{P} be the ring of functions in K(C) which are defined at P, and let M_{P} be the ideal of Ω_{P} consisting of functions which take the value zero at P. Ω_{P} is called the local ring of C at P. If we identify the set of constant functions with K then

Ω_{P} = K ⊕ M_{P}  (3.1)

(internal direct sum) because f = f(P) + (f − f(P)).

Lemma 3.1. Ω_{P} − M_{P} = Ω_{P}^{×}. M_{P} is the unique maximal ideal of Ω_{P}.

PROOF. If f ∈ Ω_{P} − M_{P} then f can be written as F (X, Y, Z)/G(X, Y, Z), where F, G are homogeneous polynomials of the same degree and F, G do not vanish at P. Since 1/f can be written G/F, 1/f ∈ Ω_{P}.

This shows that Ω_{P} − M_{P} ⊂ Ω_{P}^{×}. The reverse inclusion is also true, for if f ∈ Ω_{P}^{×} then there is g ∈ Ω_{P} with fg = 1. Then f(P)g(P) = 1, so f(P) is a unit in K. In particular, f is not in M_{P}. We have proved the first statement. For the second statement, let I be any proper ideal of Ω_{P}. Then I ∩ Ω_{P}^{×} = ∅; otherwise I would equal Ω_{P}. Thus I misses the complement of M_{P} completely; equivalently, I ⊂ M_{P}. □

Our next goal is to show that if P is a nonsingular point (that is, ▽_{P} C ≠ 0) then M_{P} is principal. First we need some lemmas. These lemmas are true in more generality than we state them.

Lemma 3.2 (Nakayama’s Lemma). If A is a finitely generated Ω_{P} -module and M_{P} A = A then A = { 0 }.

PROOF. Let u_{1}, …, u_{n} be a set of generators for A with n as small as possible. Since u_{1} ∈ A = M_{P} A, there exist μ_{i} ∈ M_{P} such that u_{1} = ∑ μ_{i}u_{i}. Now 1 − μ_{1} ∈ Ω_{P}^{×}, so we can solve for u_{1} in terms of u_{2}, …, u_{n}. This contradicts the minimality of n. □

Corollary 3.3. ∩_{n=1}^{∞}M_{P}^{n} = { 0 }. Thus M_{P} ⊋ M_{P}^{2} .

PROOF. Let A = ∩M_{P}^{n}. A is finitiely generated by the Hilbert Basis Theorem [Fu, p. 13], so A = { 0 } by Nakayama’s Lemma. □

Lemma 3.4. If P is a nonsingular point of C then M_{P} /M_{P}^{2} is isomorphic to K.

PROOF. Observe that M_{P} /M_{P}^{2} is an Ω_{P} /M_{P} -vector space, and Ω_{P} /M_{P} is canonically isomorphic to K by (3.1). We just have to prove this vector space is one-dimensional, or equivalently that its dual is onedimensional. So let λ : M_{P} /M_{P}^{2} → K be a K-linear map. Since Ω_{P} = K + M_{P}, we can think of λ as a K-linear map from Ω_{P} into K which is trivial on M_{P}^{2} + K.

We will construct a K-linear map ϑ : Ω_{P} → K which is trivial on K + M_{P}^{2} , and we will prove that λ is proportional to ϑ. Fix coordinates for P: P = (X_{0}, Y_{0}, Z_{0}). Fix R ∈ K^{3} such that R · P = 1. Let C(X, Y, Z) = 0 be the equation of the curve. Let ▽_{P} C = (∂C/∂X(P), ∂C/∂Y (P), ∂C/∂Z(P)), the gradient of C at P. We claim ▽_{P} C and R are linearly independent. First observe ▽_{P} C ≠ 0 since the curve is nonsingular at P by hypothesis. By Euler’s identity (X∂/∂X + Y ∂/∂Y + Z∂/∂Z)C = deg(C)C. (The proof of Euler’s identity is that for any monomial X^{a}Y^{b}Z^{c}, we have (X∂/∂X + Y ∂/∂Y + Z∂/∂Z)(X^{a}Y^{b}Z^{c}) = (a + b + c)X^{a}Y^{b}Z^{c}.) Evaluating Euler’s identity at P gives P · ▽_{P} C = dec(C) C(P) = 0. Since P · R ≠ 0, this shows ▽_{P} C is linearly independent from R. It follows that the space of vectors which are orthogonal to R and ▽_{P} C is one-dimensional, spanned by a vector T.

Define ϑ : Ω_{P} → K by

ϑ(f) = T · ▽_{P} (f).

We claim ϑ is well-defined, K-linear, and surjective. To prove it is well-defined, it suffices to show T · ▽_{P} (F/G) = 0 if F vanishes identically on the curve and G(P) ≠ 0. In that case, C divides F. Let h = F/(CG). Then

T · ▽_{P} (F/G) = C(P)T · ▽_{P} h + h(P)T · ▽_{P} C = 0 + 0

as required. The map ϑ is certainly K-linear. If S is any vector in K^{3} such that S · P = 0 but S · T ≠ 0 then

T · ▽_{P} (S · (X, Y, Z)/R · (X, Y, Z)) = \frac{T · S}{R · P} − \frac{(T · R)(S · P)}{(R · P)^{2}} = \frac{T · S}{R · P} ≠ 0,  (3.1)

so the map is nontrivial. Any nontrivial K-linear map into K is surjective. Let us show that the kernel contains K + M_{P}^{2} . Certainly T · ▽_{P} annihilates the constants K. If f, g ∈ M_{P} then ▽_{P} (fg) = 0 by the product rule, so M_{P}^{2} is in the kernel also.

It remains to show that an arbitrary linear map λ : Ω_{P} → K which is trivial on K + M_{P}^{2} coincides with a multiple of ϑ. The map λ obeys a product rule, for if f = f(P) + f_{1}, g = g(P) + g_{1} where f, g ∈ Ω_{P} then f_{1}, g_{1} ∈ M_{P}, and fg = f(P)g + g(P)f − f(P)g(P) + f_{1}g_{1}, so

λ(fg) = f(P)λ(g) + g(P)λ(f).

It follows that λ is completely determined by its values at X/ρ, Y/ρ, and Z/ρ, where ρ = R · (X, Y, Z). Denote these by values by α, β, γ. We claim (α, β, γ) is proportional to T. This will imply there is a onedimensional space of such λ; in particular λ must be proportional to ϑ. We must show (α, β, γ) is orthogonal to both R and ▽_{P} C. Let R = (R_{1}, R_{2}, R_{3}) and ρ = R_{1}X + R_{2}Y + R_{3}Z. Then

\begin{aligned}R · (α, β, γ) & = R_{1}λ(X/ρ) + R_{2}λ(Y/ρ) + R_{3}λ(Z/ρ) \\ & = λ((R_{1}X + R_{2}Y + R_{3}Z)/ρ) = λ(1) = 0, \end{aligned}

▽_{P} C · (α, β, γ) = λ(C(X/ρ, Y/ρ, Z/ρ)) = λ(C(X, Y, Z)/ρ^{deg(C)}) = 0.
□

Corollary 3.5. Supose P is nonsingular. Let u ∈ M_{P}, and let R, T be nonzero vectors in K^{3} such that R · P ≠ 0, T · R = 0, and T · ▽_{P} C = 0. Then u ∈ M_{P} − M_{P}^{2} iff T · ▽_{P} u ≠ 0. Also, if S · P = 0 but S · T ≠ 0 then S · (X, Y, Z)/R · (X, Y, Z) belongs to M_{P} − M_{P}^{2} .

PROOF. In the notation of the preceding proof, the hypothesis states that ϑ(u) ≠ 0. Since ϑ induces an isomorphism of M_{P} /M_{P}^{2} with K, we know u ∉ M_{P}^{2} iff ϑ(u) ≠ 0. The last statement follows from (3.1). □

Proposition 3.6. Suppose P is nonsingular. Then M_{P} is a principal ideal of Ω_{P}. In fact, if u ∈ M_{P} then M_{P} = uΩ_{P} ⟺ u ∉ M_{P}^{2} .

PROOF. M_{P} ≠ M_{P}^{2} by Lemma 3.2. Let u ∈ M_{P} − M_{P}^{2} . Then

K ≅ \frac{Ω_{P}}{M_{P}} ≅ \frac{uΩ_{P}}{uM_{P}} → \frac{uΩ_{P}}{M_{P}^{2}} .

The image of 1 in this composite map is u mod M_{P}^{2} , which is nonzero. Thus the kernel of the projection map from uΩ_{P} /uM_{P} into uΩ_{P} /M_{P}^{2} has to be trivial. This shows uM_{P} = M_{P}^{2} .

Also, M_{P} = uK + M_{P}^{2} because M_{P} /M_{P}^{2} is a one-dimensional K-vector space by Lemma 3.4. Thus

uΩ_{P} = u(K + M_{P}) = uK + uM_{P} = uK + M_{P}^{2} = M_{P} .
□

Corollary 3.7. Suppose P is nonsingular. Let 0 ≠ f ∈ K(C), u ∈ M_{P} − M_{P}^{2} . There is a unique integer v(f) such that f = u^{v(f)}g with g ∈ Ω_{P}^{×}. This integer does not depend on the choice of u.

PROOF. Write f = F/G with F, G homogeneous of degree m. Choose R ∈ K^{3} so that P · R ≠ 0. Let ρ be the homogeneous polynomial ρ = R · (X, Y, Z). Then f = f_{1}/f_{2}, where f_{1} = F/ρ^{m} and f_{2} = G/ρ^{m}. Note that f_{1}, f_{2} ∈ Ω_{P}. By Corollary 3.3,

Ω_{P} − {0} = ⊔_{n=0}^{∞}(M_{P}^{n} − M_{P}^{n+1}),

where M_{P}^{0} = Ω_{P}. Clearly M_{P}^{n} − M_{P}^{n+1} = u^{n}Ω_{P}^{×}, since M = uΩ_{P}. Define n_{1}, n_{2} by f_{i} ∈ M_{P}^{n_{i}} − M_{P}^{n_{i}+1}, and let n = n_{1} − n_{2}. Then fu^{−n} = f_{1}u^{−n_{1}}/(f_{2}u^{−n_{2}}) ∈ Ω_{P}^{×}. □

Ω_{P} is called the local ring at P. If P is nonsingular, then a uniformizer is an element of M_{P} such that M_{P} = uΩ_{P}; equivalently it is an element of M_{P} − M_{P}^{2} . The integer v(f) is called the valuation of f at P. If v(f) > 0, f has a zero of order v(f) at P; if v(f) < 0, f has a pole of order −v(f) at P. If v(f) = 0, we say f is finite and nonvanishing at P.

Example 3.8 Let C = W be given by the Weierstrass equation (1.1). Let us show that X/Y is a uniformizer at (0, 1, 0). In Corollary 3.5 we take R = P = (0, 1, 0) and compute from (1.1) that ▽_{P} W = (0, 0, 1). Thus T = (1, 0, 0). Now X/Y vanishes at P, and T ·▽_{P} (X/Y) = ∂/∂X(X/Y)|_{P} = 1 ≠ 0. So X/Y is a uniformizer by Corollary 3.5.

Example 3.9 Let us compute v(Z/X) at the point P = (0, 1, 0) on an elliptic curve. By (1.1), ZV = X^{3}, with

V = Y^{2} + a_{1}XY + a_{3}Y Z − a_{2}X^{2} − a_{4}XZ − a_{6}Z^{2}.

Then Z/X = X^{2}/V = (X/Y)^{2}(Y^{2}/V). Since Y^{2}/V ∈ Ω_{P}^{×} and X/Y is a uniformizer, we see that v(Z/X) = 2. Thus x = X/Z has a pole of order 2 at the origin. Since Y/Z = (Y/X)(X/Z), y = Y/Z has a pole of order 3 at the origin.

§II.4. Power series expansions

Lemma 4.1. Let C = C(X, Y, Z) be a projective curve over \overline{K} which is nonsingular at P. Suppose C has coefficients in K and P ∈ C(K). Let u ∈ K(C) be a uniformizer at P. If f is a nonzero function in K(C) and v(f) = a then there exist unique constants f_{j} ∈ K for j ≥ a such that for any N ≥ a,

f − ∑_{j=a}^{N} f_{j}u^{j} has a zero of order at least N + 1.

Moreover, f_{a} ≠ 0.

PROOF. Let g = u^{−a}f ∈ Ω_{P}^{×}, f_{a} = g(P). This is the only constant for which g − f_{a} ∈ M_{P}, so it is the only constant for which v(f − u^{a}f_{a}) = v(u^{a}(g − f_{a})) > a. From this observation, the lemma may be easily proved by induction. □

Corollary 4.2. A choice of uniformizer u at P determines a one to one homomorphism of rings

Ψ_{u} : Ω_{P} ↪ K[[τ]].

If 0 ≠ V = ∑ v_{i}τ^{i} ∈ K[[τ]], define deg(V) to be the smallest integer n such that v_{n} ≠ 0, and define deg(0) = ∞. If one puts metrics on Ω_{P} and on K[[τ]] by the rules |f| = c^{v_{P} (f)} for f ∈ Ω_{P}, |V | = c^{deg(V)} for V ∈ K[[τ]], where 0 < c < 1, then Ψ_{u} is an isometry. In particular, Ψ_{u} is continuous with respect to the topologies on Ω_{P}, K[[τ]] which are induced by the above metrics. The image of Ψ_{u} is dense in K[[τ]].

PROOF. The homomorphism Ψ_{u} is defined by: Ψ_{u}(f) = ∑ f_{j}τ^{j}, where the f_{j} are as in Lemma 4.1. It is easy to see (using the uniqueness of the coefficients f_{j}) that Ψ_{u} is a ring homomorphism. Ψ_{u} is an isometry because v_{P} (f) = a implies f_{a} is the first nonzero coefficient. If Ψ_{u}(f) = 0 then |f| = |Ψ_{u}(f)| = |0| = 0, so f ∈ ∩M_{P}^{n}. By Corollary 3.3, f must be zero; thus Ψ_{u} is one to one. If g is any polynomial with coefficients in K then g(u) ∈ Ω_{P} and Ψ_{u}(g(u)) = g(τ). This shows Ψ_{u}(Ω_{P}) is dense in K[[τ]]. □

Let E be an elliptic curve determined by a nonsingular Weierstrass equation (1.1). Define functions s, t ∈ K(E) by the formulas: s = −Z/Y, t = −X/Y, as in §2. These have zeroes at the identity of orders 3 and 1, respectively, by Examples 3.8 and 3.9. By dividing through the Weierstrass equation by Y^{3} we see that s and t satisfy the equation (2.1). If O is the additive identity of E then s(O) = t(O) = 0. Moreover, t is a uniformizer at O since it has a simple zero there, thus we can formally express s as a power series in t in the sense that we can find an infinite power series

S(τ) = ∑_{i=3}^{∞} s_{i}τ^{i}

with the property that for any N ≥ 3, the function s − ∑_{3}^{N} s_{i}t^{i} has a zero of order at least N + 1 at the additive identity. The series S can be computed by recursively substituting approximations for s into the right hand side of (2.1) and expanding to get improved approximations. We start with the approximation s = O(t^{3}) to obtain

\begin{aligned}s & = t^{3} + a_{1}t O(t^{3}) + a_{2}t^{2}O(t^{3}) + a_{3}(O(t^{3}))^{2} + a_{4}t(O(t^{3}))^{2} + a_{6}(O(t^{3}))^{3} \\ & = t^{3} + O(t^{4}). \end{aligned}

On the next round substitute t^{3} + O(t^{4}) for s in the right side of the equation to obtain

s = t^{3} + a_{1}t(t^{3} + O(t^{4})) + O(t^{5}) = t^{3} + a_{1}t^{4} + O(t^{5}).

The next round yields

\begin{aligned}s & = t^{3} + a_{1}t(t^{3} + a_{1}t^{4} + O(t^{5})) + a_{2}t^{2}(t^{3} + O(t^{4})) + O(t^{6}) \\ & = t^{3} + a_{1}t^{4} + (a_{1}^{2} + a_{2})t^{5} + O(t^{6}). \end{aligned}

This procedure yields the general rule:

s_{0} = s_{1} = s_{2} = 0,  s_{3} = 1,  and if n ≥ 4 then

s_{n} = a_{1}s_{n−1} + a_{2}s_{n−2} + a_{3} ∑_{i+j=n} s_{i}s_{j} + a_{4} ∑_{i+j=n−1} s_{i}s_{j} + a_{6} ∑_{i+j+k=n} s_{i}s_{j}s_{k}.  (4.1)

Lemma 4.3. Let W be the Weierstrass equation (1.1), where a_{i} ∈ R and R is an integral domain. Let s_{i} ∈ R be defined by the recursion (4.1) and let S = ∑ s_{i}τ^{i} ∈ τR[[τ]]. Then W (τ, −1, S) = 0 in R[[τ]]. If f, g ∈ τR[[τ]] and W (f, −1, g) = 0 then g = S ∘ f.

Remark. Since the Weierstrass equation is cubic in the variable Z, it follows that for fixed f ∈ τR[[τ]], the equation W (f, −1, g) = 0 has three solutions for g in the algebraic closure of the quotient field of R[[τ]]. The lemma asserts that exactly one of these solutions lies in τR[[τ]].

PROOF. Let K be the quotient ring of R and let E be the elliptic curve over K with equation W. As usual, let t = −X/Y, s = −Z/Y ∈ K(E). Then t is a uniformizer at the origin, so Ψ_{t} : Ω_{O} → K[[τ]] can be defined. Moreover, ψ_{t}(t) = τ, Ψ_{t}(s) = S. Now W (t, −1, s) = 0, so

0 = Ψ_{t} (W (t, −1, s)) = W (τ, −1, S).

From this it follows that W (f, −1, S ∘ f) = 0 for any f ∈ τK[[τ]].

Now suppose f, g ∈ τR[[τ]] and W (f, −1, g) = 0. Let h = S ∘ f. Then

\begin{aligned}0 & = W (f, −1, h) − W (f, −1, g) \\ & = (g − h) (−1 + a_{1}f + a_{2}f^{2} + a_{3}(g + h) + a_{4}f(g + h) + a_{6}(g^{2} + gh + h^{2})) . \end{aligned}

Since −1 + a_{1}f + ⋯ is a unit in R[[τ]] by Lemma I.1.4, g − h must be zero. □

§II.5. Isogenies

A reference for this section is [S]. Let E, E′ be two elliptic curves defined over the same field K. An algebraic map from E to E′ is a function α : E(\overline{K}) → E′(\overline{K}) such that for each P ∈ E there exist homogeneous polynomials f_{1}, f_{2}, f_{3} of the same degree and not all vanishing at P such that for all but finitely many Q ∈ E(\overline{K}),

α(Q) = (f_{1}(Q), f_{2}(Q), f_{3}(Q)).

An example of an algebraic map from E to itself is the translation by P map τ_{P} (Q) = P +Q for P, Q ∈ E. The algebraic map is said to be defined over a field K if E, E′ are defined over K and if all the coefficients of f_{1}, f_{2}, f_{3} can be chosen to belong to K. It is a theorem [S, p. 75] that every nonconstant algebraic map from E into E′ which takes the origin to the origin is a group homomorphism. Such an algebraic map is called an isogeny. If τ : E → E′ and −Q = τ(0, 1, 0) ∈ E′ then τ_{Q} ∘ τ takes the origin of E into the origin of E′. Thus every nonconstant algebraic map is the composition of an isogeny with a translation. Two curves E, E′ are called isogenous over K if there exists an isogeny defined over K from E into E′. The endomorphism ring of E, written End_{K}(E), is the set of isogenies over K from E to itself, together with the constant zero map, with the addition and multiplication laws:

(α + β)(P) = α(P) + β(P), αβ = α ∘ β.

Note that Z ⊂ End_{K}(E). If K is the finite field with q elements then the Frobenius endomorphism φ_{q}, is defined by φ_{q}(X, Y, Z) = (X^{q}, Y^{q}, Z^{q}). Since φ_{q} coincides with the Galois action, it commutes with any endomorphism of E which is defined over K. In particular, φ_{q} commutes with Z.

If α : E → E′ is an isogeny, define α^{∗}K(E′) = { f ∘ α | f ∈ K(E′) }; this is a subfield of K(E). The degree of an isogeny α : E → E′ is the index of α^{∗}K(E′) in K(E). This number is finite because both fields have transcendence degree 1 and α is a nonconstant map. If K has characteristic p then the Frobenius isogeny φ_{p}(X, Y, Z) = (X^{p}, Y^{p}, Z^{p}) from E into E^{(p)} has degree p. Here E^{(p)} is the curve whose Weierstrass equation is obtained from that of E by raising the coefficients to the pth power.

Every isogeny α : E → E′ has a dual isogeny α̂ : E′ → E. The dual isogeny is characterized by the property that α ∘ α̂ = [deg(α)]_{E′} and α̂ ∘ α = [deg(α)]_{E}, where [n]_{E} denotes multiplication by n. If E = E′, then there is an integer a(α), called the trace of α, such that α + α̂ = [a(α)]_{E}. The endomorphism α satisfies the quadratic equation

α^{2} − [a(α)]α + [deg(α)] = 0 in End(E).

In particular, if K has q elements then there is t ∈ Z such that

φ_{q}^{2} − [t]φ_{q} + [q] = 0.

The integer t is called the trace of Frobenius. It is well known ([S, Ch. 5]) that |t| ≤ 2\sqrt{q} and the cardinality of E(K) is q + 1 − t.

§II.6. Constructing the formal group law of an elliptic curve

Consider an elliptic curve E with Weierstrass equation given by equation (1.1) over an arbitrary field K. Let L be the quotient field of K[[τ]]. Since K ⊂ L, we can consider the points in E(L). Let R be a subring of K (possibly R = K) containing 1 and all the Weierstrass coefficients a_{i}. We will construct a formal group law by embedding τR[[τ]] into E(L) and “stealing” the group law from E(L).

Consider points of the form (t, −1, s) in E(K). Then t can be regarded as the function −X/Y ∈ K(E), and it is a uniformizer at the origin. Let S be the formal power series constructed in §4. If f ∈ τR[[τ]] then (f, −1, S(f)) ∈ E(L) by Lemma 4.3, so there is an embedding T : τR[[τ]] → E(L) given by

T (f) = (f, −1, S(f)).  (6.1)

Recall Proposition I.1.1, which guarantees that if we can find a power series F in two variables with the properties that F (0, 0) = 0 and T (f) + T (g) = T (F (f, g)) then F will be a formal group law. We now show such an F can be found.

Theorem 6.1. There is a power series F (t_{1}, t_{2}) ∈ R[[X, Y]] with zero constant term such that for f, g ∈ τR[[τ]],

T (f) + T (g) = T (F (f, g)).  (6.2)

Therefore F is a formal group law.

PROOF. Consider Proposition 2.1, but treat t_{1}, t_{2} as indeterminates and substitute S(t_{1}), S(t_{2}) for s_{1}, s_{2}. In other words, we are working over the field L′ = the quotient field of R[[t_{1}, t_{2}]]. We need to show t_{3} of equation (2.3) is a power series in t_{1}, t_{2}. Let M be the ideal of R[[t_{1}, t_{2}]] generated by t_{1} and t_{2}. In other words, M is the set of elements μ ∈ R[[t_{1}, t_{2}]] for which μ(0, 0) = 0. If μ ∈ M and u is a unit of R then u + μ is a unit in R[[t_{1}, t_{2}]] by Lemma I.1.4. Now

m = \frac{S(t_{1}) − S(t_{2})}{t_{1} − t_{2}} = ∑_{i=3}^{∞} \frac{s_{i}(t_{1}^{i} − t_{2}^{i})}{t_{1} − t_{2}}

= ∑_{i=3}^{∞} s_{i}(t_{1}^{i−1} + t_{1}^{i−2}t_{2} + ⋯ + t_{1}t_{2}^{i−1} + t_{2}^{i−1})

= s_{3}(t_{1}^{2} + t_{1}t_{2} + t_{2}^{2}) + s_{4}(t_{1}^{3} + t_{1}^{2}t_{2} + t_{1}t_{2}^{2} + t_{2}^{3}) + ⋯

so m belongs to M^{2}. Then A = 1 + a_{2}m + a_{4}m^{2} + a_{6}m^{3} is a unit in R[[t_{1}, t_{2}]], since A is the sum of a unit in R and an element of M. In particular, A ≠ 0, so Proposition 2.1(b) applies. Also b = S(t_{1}) − mt_{1} ∈ M^{3}. Now (2.3) shows that t_{3} ∈ M. Thus we can write t_{3} = G(t_{1}, t_{2}), G ∈ M. Certainly t_{3} ≠ 0, because G ≡ −t_{1}−t_{2} mod M^{2}. We have (t_{1}, −1, S(t_{1}))+(t_{2}, −1, S(t_{2})) = −(t_{3}, −1, s_{3}) in E(L′), where s_{3} = mt_{3}+b ∈ M^{3}. By Proposition 2.1(a), the right side is

(\frac{−t_{3}}{1 − a_{1}t_{3} − a_{3}s_{3}} , −1, \frac{−s_{3}}{1 − a_{1}t_{3} − a_{3}s_{3}} ) .

Let

F (t_{1}, t_{2}) = \frac{−t_{3}}{1 − a_{1}t_{3} − a_{3}s_{3}} ∈ M.

If we substitute t_{1} = f(τ), t_{2} = g(τ) for f, g ∈ τR[[τ]] we get a homomorphism R[[t_{1}, t_{2}]] → R[[τ]], which induces a homomorphism E(L′) → E(L). It follows that

(f, −1, S(f)) + (g, −1, S(g)) = (F (f, g), −1, (∗∗)),

where (∗∗) is the result of substituting f, g into the power series s_{3} ∈ M^{3}. In particular, (∗∗) ∈ τR[[τ]], so by Lemma 4.3 (∗∗) = S(F (f, g)). This proves (6.2). The fact that F is a formal group law follows from Proposition I.1.1. □

The first few terms of F are:

F (X, Y) = X + Y − a_{1}XY − a_{2}(X^{2}Y + XY^{2}) − (2a_{3}X^{3}Y + (3a_{3} − a_{1}a_{2})X^{2}Y^{2} + 2a_{3}XY^{3}) + ⋯ §II.7. Homomorphisms of formal group laws arising from isogenies

We claim that an isogeny of elliptic curves over K gives rise to a homomorphism of the corresponding formal group laws over K. Indeed, let

I(X, Y, Z) = (f_{1}(X, Y, Z), f_{2}(X, Y, Z), f_{3}(X, Y, Z))

be an isogeny between elliptic curves E, E′ over K. Here f_{1}, f_{2}, f_{3} are homogeneous polynomials of the same degree, say d, and f_{1}, f_{2}, f_{3} do not simultaneously vanish at the origin. Since the origin of E is carried to the origin of E′, f_{1} and f_{3} vanish at (0, 1, 0) but f_{2}(0, 1, 0) ≠ 0. Thus f_{1}/Y^{d} ∈ M and f_{2}/Y^{d} ∈ Ω^{×}, where M = M_{(0,1,0)} and Ω = Ω_{(0,1,0)}. Now f_{1}/Y^{d} = f_{1}(X/Y, 1, Z/Y) = f_{1}(−t, 1, −s) = (−1)^{d}f_{1}(t, −1, s) ∈ M and similarly f_{2}/Y^{d} = (−1)^{d}f_{2}(t, −1, s) ∈ Ω^{×}. Thus

f_{1}(X, Y, Z)/f_{2}(X, Y, Z) = f_{1}(t, −1, s)/f_{2}(t, −1, s) ∈ M.

Let U(τ) = ∑_{i=1}^{∞} u_{i}τ^{i} denote the expansion of f_{1}/f_{2} with respect to t. Practically speaking, U can be obtained by expanding s as a power series S and then computing

f_{1}(τ, −1, S(τ))/f_{2}(τ, −1, S(τ))

in the ring K[[τ]]. Note that f_{2}(τ, −1, S(τ)) is invertible since its constant term is nonzero.

Proposition 7.1. Let E, E′, E′′ be elliptic curves over K and let F, F′, F′′ denote the associated formal group laws over K. If I : E → E′ is an isogeny then the power series U constructed above belongs to Hom(F, F′). The map I ↦ U is a one to one group homomorphism from Isog(E, E′) ↪ Hom(F, F′). If I′ : E′ → E′′ and I′ corresponds to U′ ∈ Hom(F′, F′′) then I′ ∘ I corresponds to U′ ∘ U ∈ Hom(F, F′′).

PROOF. Let L be the quotient field of K[[τ]]. Since I is defined over K, it is a priori defined over L. As usual, let t = −X/Y, s = −Z/Y. The discussion above shows that I can be written in a neighborhood of the origin as

I(X, Y, Z) = (\frac{f_{1}(t, −1, s)}{f_{2}(t, −1, s)}, −1, \frac{f_{3}(t, −1, s)}{f_{2}(t, −1, s)}) .

Let T : τK[[τ]] → E(L) and T′ : τK[[τ]] → E′(L) be the embeddings (6.1). Substitute (X, Y, Z) → T (f) = (f, −1, S(f)) ∈ E(L), where f ∈ τK[[τ]]. Then t = −X/Y changes to f and s = −Z/Y changes to S ∘ f. Thus

I(T (f)) = (U(f), −1, V (f)),

where

U(τ) = f_{1}(τ, −1, S(τ))/f_{2}(τ, −1, S(τ)) ∈ τK[[τ]]

and V (τ) = f_{3}(τ, −1, S(τ))/f_{2}(τ, −1, S(τ)) ∈ τK[[τ]]. By Lemma 4.3, V = S′ ∘ U, where S′(t) is the power series expansion for −Z/Y in the curve E′. Thus

I(T (f)) = T′(U(f)).  (7.1)

By Lemma I.3.1, this equation proves that U is a homomorphism of formal group laws.

If I_{1}, I_{2} ∈ Isog(E, E′), and if U_{1}, U_{2} ∈ Hom(F, F′) are the corresponding homomorphisms of formal group laws then on the elliptic curve E(L),

(I_{1} + I_{2})(τ, −1, S(τ)) = I_{1}(τ, −1, S) + I_{2}(τ, −1, S) = T′(U_{1}) + T′(U_{2}) = T′(F′(U_{1}, U_{2})) by definition of I_{1} + I_{2}

by (7.1)
by (6.2).

On the other hand, if I_{1} + I_{2} corresponds to U_{3} then

(I_{1} + I_{2})(τ, −1, S) = T′(U_{3})

by (6.2). Since T′ is one to one, U_{3} = F′(U_{1}, U_{2}) = U_{1} ⊕_{F′} U_{2}. This shows that the map I ↦ U is a group homomorphism.

Finally, if I : E → E′, I′ : E′ → E′′ correspond to U, U′, respectively, then since U is the unique solution in τK[[τ]] to I ∘ T = T′ ∘ U,

I′ ∘ I ∘ T = I′ ∘ T′ ∘ U = T′′ ∘ U′ ∘ U,

whence I′ ∘ I corresponds to U′ ∘ U. □

Example 7.2: Let F be the formal group law over R associated to an elliptic curve E with Weierstrass equation (1.1), where the coefficients a_{i} ∈ R, and R is an integral domain. We will compute [−1]_{F} and [−2]_{F}. Let g ∈ τR[[τ]]. By Proposition 2.1(a),

[−1]_{E}T (g) = [−1]_{E}(g, −1, S ∘ g) = (\frac{−g}{1 − a_{1}g − a_{3}S ∘ g} , −1, \frac{−S ∘ g}{1 − a_{1}g − a_{3}S ∘ g} )

The right side is T (−g/(1 − a_{1}g − a_{3}S ∘ g)) by Lemma 4.3. Now Lemma I.3.1 implies

[−1]_{F} = \frac{−τ}{1 − a_{1}τ − a_{3}S} = −τ ∑_{n=0}^{∞}(a_{1}τ + a_{3}S)^{n}.

The calculation of [−2]_{E} is similar. By Proposition 2.1(c),

[−2]_{E}T (g) = [−2]_{E}(g, −1, S ∘ g) = (t_{3}(g), −1, m(g)t_{3}(g) − gm(g) + S ∘ g),

where

\begin{matrix}m(τ) & = (a_{1}S(τ) + 3τ^{2} + 2a_{2}τS(τ) + a_{4}S(τ)^{2}) \\ · & ∑_{n=0}^{∞} (a_{1}τ + 2a_{3}S(τ) + a_{2}τ^{2} + 2a_{4}τS(τ) + 3a_{6}S(τ)^{2})^{n} , \end{matrix}

\begin{aligned}t_{3}(τ) & = −2τ − (a_{1}m(τ) + a_{3}m(τ)^{2} + (a_{2} + 2a_{4}m(τ) + 3a_{6}m(τ)^{2})(S(τ) − τm(τ)) \\ & · ∑_{n=0}^{∞}(−1)^{n} (a_{2}m(τ) + a_{4}m(τ)^{2} + a_{6}m(τ)^{3})^{n}. \end{aligned}

Again, Lemma 4.3 implies [2]_{E}T (g) = T (t_{3}(g)) and Lemma I.3.1 implies

[−2]_{F} = t_{3}(τ).

Obviously [2]_{F} = [−1]_{F} ∘ [−2]_{F}. □

An isogeny I : E → E′ is called separable if it has the property: if t′ is a uniformizer at the origin of E′ then I ∘ t′ is a uniformizer at the origin of E. This definition does not depend on the choice of uniformizer t′. An isogeny which is not separable is called inseparable. In characteristic zero, all isogenies are separable. In characteristic p, the Frobenius is not separable, since it carries uniformizers into pth powers of uniformizers. It is a theorem [S, II.2.12] that every isogeny can be factored as φ_{p}^{k} from E into E^{(q)} (q = p^{k}) composed with a separable isogeny from E^{(q)} into E′.

Lemma 7.3. Let I be an isogeny from E to E′ and let U(τ) = ∑ u_{i}τ^{i} be the corresponding homomorphism between the formal group laws. I is separable iff u_{1} ≠ 0.

PROOF. Let t′ be the function −X/Y ∈ K(E′). U is the power series expansion of t′ ∘ I. Thus t′ ∘ I is not a uniformizer iff t′ ∘ I ∈ M_{(0,1,0)}^{2} iff u_{1} = 0. □

Example 7.4. Let E be an elliptic curve over a field K of characteristic p > 0, and let F be its associated formal group law. Then φ_{p} : E → E^{(p)} corresponds to the homomorphism of formal group laws ϕ = τ^{p} : F → F^{(p)}.

§II.8. Height of an elliptic curve

The height of a formal group law was defined in §I.4. Naturally, the height of an elliptic curve is defined to be the height of the associated formal group law.

Proposition 8.1. An elliptic curve over a field of characteristic p has height one or two.

PROOF. Let φ_{p} : E → E^{(p)} be the pth power Frobenius and φ̂_{p} : E^{(p)} → E its dual. Let F be the formal group law associated to E, and let V (τ) = ∑ v_{i}τ^{i} : F^{(p)} → F be the homomorphism of formal group laws associated to φ̂_{p}. Then [p]_{F} = V (τ^{p}). If φ̂_{p} is separable then v_{1} ≠ 0, so E has height one. If φ̂_{p} is inseparable, it can be written as a composition of a power of φ_{p} and a separable isogeny ([S, Corollary II.2.12]). Since the degree of φ̂_{p} equals the degree of φ_{p}, only one power of φ_{p} can occur in this decomposition. Thus φ̂_{p} = α∘φ_{p} with α an isomorphism. Let A = ∑ a_{i}τ^{i} be the power series corresponding to α and let A′ be the power series corresponding to α^{−1}. Then [p]_{E} = A(τ^{p^{2}}) = a_{1}τ^{p^{2}} + ⋯, and a_{1} ≠ 0 because A ∘ A′(τ) = τ. In this case E has height two. □

An elliptic curve in characteristic p of height one is called ordinary. An elliptic curve in characteristic p of height 2 is called supersingular. The next lemma gives another characterization of supersingular and ordinary curves when the underlying field is finite. Recall that the trace of Frobenius was defined in §5.

Proposition 8.2. An elliptic curve E over a finite field K with q = p^{n} elements is supersingular iff p divides the trace of Frobenius iff |E(K)| ≡ 1 mod p. If E is supersingular and n is even then |E(K)| = q + 1 + m\sqrt{q}, m ∈ { −2, −1, 0, 1, 2 }. If E is supersingular, n is odd, and p ≥ 5, then |E(K)| = q + 1. If E is supersingular, n is odd, and p ≤ 3 then |E(K)| = q + 1 + m\sqrt{pq}, where m ∈ \{ −1, 0, 1 \}.

For a more precise statement about which values of |E(K)| can occur, the reader may consult [W, Theorem 4.1]. PROOF. As above, let F be the formal group law corresponding to E and V : F^{(p)} → F the homomorphism of formal group laws corresponding to φ̂_{p}. In other words, V is defined by [p]_{F} = V (τ^{p}). Recall that E^{(p)} denotes the elliptic curve whose Weierstrass equation is obtained by taking the pth powers of the Weierstrass coefficients for E, and we use similar notation for isogenies. Now φ̂^{(p^{k})} : E^{(p^{k+1})} → E^{(p^{k})} is the dual of the map φ_{p} : E^{(p^{k})} → E^{(p^{k+1})}, so

φ̂_{p} ∘ φ̂_{p}^{(p)} ∘ ⋯ ∘ φ̂_{p}^{(p^{n−1})}

is the dual of φ_{p}^{n}. The corresponding formal group law homomorphism is

N(V) = V ∘ V^{(p)} ∘ ⋯ ∘ V^{(p^{n−1})}.

Let t be the trace of Frobenius (§5), so that |E(K)| = q + 1 − t. Since [t]_{E} is the sum of φ_{p}^{n} and its dual in End(E), it follows that

[t]_{F} = N(V) ⊕_{F} τ^{p^{n}} = F (N(V), τ^{p^{n}}).

If E is supersingular then V has height one, so N(V) has height n. In that case, [t]_{F} has height at least n, so [t^{2}]_{F} has height at least 2n. Since the height of F is two in this case, Corollary I.4.8 implies t^{2} is divisible by p^{n}. Since |t| ≤ 2\sqrt{q} (see §5) and q|t^{2}, we deduce that t^{2} ∈ \{ 0, q, 2q, 3q, 4q \}. Since t ∈ Z, we find t ∈ \{ 0, ±q^{1/2}, ±2q^{1/2} \} if n is even; t = 0 if n is odd and p > 3; t ∈ \{ 0, ±\sqrt{2q} \} if n is odd and p = 2, t ∈ \{ 0, ±\sqrt{3q} \} if n is odd and p = 3. Since |E(K)| = q + 1 − t, the cardinality of E(K) must be of the form stated.

Next suppose E is ordinary. Then N(V) has height zero, so [t]_{F} has height zero. In that case Corollary I.4.8 implies t is prime to p. □

Proposition 8.3. If E is an ordinary elliptic curve defined over a field K of cardinality p^{n} and F is its associated formal group law then the trace of the Frobenius endomorphism is equal mod p to the norm from K to F_{p} of the first nonzero coefficient of [p]_{F}.

PROOF. Let |K| = p^{n} = q. The homomorphism of F associated to φ_{q}^{2} + [−t]_{E}φ_{q} + [q]_{E} is zero, thus each of its coefficients is zero. Now φ_{q} corresponds to the power series τ^{q}, and [−t]_{E} corresponds to a power series of the form −tτ + τ^{2}(⋯), therefore φ_{q}^{2} + [−t]_{E} ∘ φ_{q} corresponds to F (τ^{q^{2}}, −tτ^{q} + τ^{2q}(⋯)), which is of the form −tτ^{q} + τ^{2q}(⋯). Finally, we evaluate [q]_{F}. Equation (I.4.2) reads

[q]_{F} = (V ∘ ϕ)^{n} = V ∘ V^{(p)} ∘ ⋯ ∘ V^{(p^{n−1})} ∘ ϕ^{n} = (N_{K/F_{p}}(v)τ + (⋯)τ^{2}) ∘ τ^{q},

so [q]_{F} = N_{K/F_{p}}(v)τ^{q} + (τ^{2q})(⋯). Thus

0 = F (−tτ^{q} + τ^{2q}(⋯), N_{K/F_{p}}(v)τ^{q} + τ^{2q}(⋯)) = (−t + N_{K/F_{p}}(v))τ^{q} + τ^{2q}(⋯).
□

PART III. FURTHER RESULTS ON FORMAL GROUPS

§III.1. Some theorems of Couveignes

Let R be an integral domain of characteristic p. Let F_{p} ⊂ R be the field with p elements if p is prime, and F_{p} = Z if p = 0. Let F = ∑_{i,j} f_{ij}X^{i}Y^{j}, F′ = ∑_{i,j} f′_{ij}X^{i}Y^{j} be two formal group laws over R, and let U(τ) = ∑_{i=1}^{∞} u_{i}τ^{i} ∈ τR[[τ]] be a homomorphism from F to F′. Couveignes proved with an elementary argument in his PhD thesis that the coefficients u_{i} satisfy some simple relations over R.

Theorem 1.1. Let i be a positive integer which is not a power of p. If p = 0 assume \binom{i}{m} is a unit in R for some 1 ≤ m < i. There is a polynomial C_{i} in several variables with coefficients in F_{p} such that for each F, F′, U as above we have

u_{i} = C_{i}(u_{j}, f_{kl}, f′_{kl} | 1 ≤ j < i, 1 ≤ k + ℓ ≤ i).

PROOF. Let A be transcendental and work in the integral domain R[A]. Since U is a homomorphism,

U(F (τ, Aτ)) = F′(U(τ), U(Aτ)).

By (I.2.2) there are power series G, G′ ∈ R[[X, Y]] such that F (X, Y) = X +Y +XY G(X, Y) and F′(X, Y) = X + Y + XY G′(X, Y). Therefore

∑ u_{j}(τ + Aτ + Aτ^{2}G(τ, Aτ))^{j} = ∑ u_{j}τ^{j} + ∑ u_{j}(Aτ)^{j} + U(τ)U(Aτ)G′(U(τ), U(Aτ)).

This can be rewritten

\begin{aligned}0 = & ∑ u_{j}τ^{j}\{(1 + A + AτG(τ, Aτ))^{j} − (1 + A^{j})\} \\ & − Aτ^{2}(∑_{j=0}^{∞} u_{j+1}τ^{j})(∑_{j=0}^{∞} u_{j+1}(Aτ)^{j})G′(∑_{j=1}^{∞} u_{j}τ^{j}, ∑_{j=1}^{∞} u_{j}(Aτ)^{j}). \end{aligned}

The coefficient of τ^{i} is of the form u_{i}{(1+A)^{i}−(1+A^{i})}+M_{i}, where M_{i} is a polynomial in A, u_{1}, u_{2}, …, u_{i−1} and in some of the coefficients of G, G′. This gives the relation

u_{i}{(1 + A)^{i} − (1 + A^{i})} − M_{i} = 0.

The hypothesis that i is not a power of p implies (1+A)^{i} ≠ 1+A^{i}. If p = 0 choose m such that \binom{i}{m} is a unit in R, and if p > 0 let m be a positive integer such that the coefficient of A^{m} is nonzero in the polynomial (1 + A)^{i} − (1 + A^{i}). In characteristic p this coefficient is a unit in R because it is a nonzero element of the prime field F_{p}. Since A is transcendental, the coefficient of A^{m} in our relation must be identically zero. This coefficient gives our desired formula for u_{i} in terms of the u_{j} and the coefficients of F and F′. □

The next theorem accounts for the u_{i} when i is a power of p. It was proved by Couveignes for formal group laws associated to ordinary elliptic curves, but his argument generalizes easily to formal group laws of any height.

Theorem 1.2. Let i be a power of a prime p and let h > 0. There is a polynomial C_{i} in several variables with coefficients in F_{p} such that: if F = ∑ f_{kℓ}X^{k}Y^{ℓ} and F′ = ∑ f′_{jℓ}X^{j}Y^{ℓ} are formal group laws of height h over a domain R of characteristic p and U = ∑ u_{j}τ^{j} : F → F′ a homomorphism then

v′_{1}u_{i}^{q} − v_{1}^{i}u_{i} = C_{i}(u_{j}, f_{kℓ}, f′_{kℓ} | j < i, k + ℓ ≤ qi)

where q = p^{h} and v_{1}, v′_{1} are the first nonzero coefficients of the power series [p]_{F}, [p]_{F′}, respectively.

PROOF. By Proposition I.4.2 we can write [p]_{F} (τ) = V ∘ ϕ^{h}(τ) = V (τ^{q}), where V (τ) = ∑ v_{j}τ^{j} is a homomorphism of height zero from F^{(q)} to F′. It is easy to show by induction on n that for n > 0 the jth coefficient of [n]_{F} is a polynomial in the f_{kℓ} with k + ℓ ≤ j. Since v_{j} is the jqth coefficient of [p]_{F}, v_{j} is a polynomial in the f_{kℓ} with k + ℓ ≤ jq. Similarly [p]_{F′} = V′ ∘ ϕ^{h}, V′(τ) = ∑ v′_{j}τ^{j}, and v′_{j} is a polynomial in the f′_{kℓ} with k + ℓ ≤ jq. Since [p]_{F′} ∘ U = U ∘ [p]_{F},

V′(U(τ)^{q}) = U(V (τ^{q})).

Let σ = τ^{q}. The left side is

v′_{1}(∑_{j=1}^{∞} u_{j}^{q}σ^{j}) + v′_{2}(∑_{j=1}^{∞} u_{j}^{q}σ^{j})^{2} + ⋯,

and the coefficient of σ^{i} is of the form v′_{1}u_{i}^{q} plus terms involving u_{j} for j < i and v′_{j} for j ≤ i. The right side is

u_{1}(∑_{j} v_{j}σ^{j}) + u_{2}(∑_{j} v_{j}σ^{j})^{2} + ⋯ + u_{i}(∑_{j} v_{j}σ^{j})^{i} + · · · .

This time the coefficient of σ^{i} is of the form u_{i}(v_{1})^{i} plus terms involving u_{j} for j < i and v_{j} for j ≤ i. By equating the two sides we get v′_{1}u_{i}^{q} − v_{1}^{i}u_{i} equals a polynomial in the u_{j} for 1 ≤ j < i and the v_{j}, v′_{j} for 1 ≤ j ≤ i. □

Example 1.3. When i = p^{0} Couveignes’ relation is simply

v′_{1}u_{1}^{q} − v_{1}u_{1} = 0.

If p = 2 and i = 2 then

v′_{1}u_{2}^{q} − v_{1}^{2}u_{2} = v_{2}u_{1} + v′_{2}u_{1}^{2q}.

§III.2. Hom(F, F′) as a Z-module or Z_{p}-module

Let F, F′ be two formal group laws over an integral domain R of characteristic p. Let Hom(F, F′) denote the group of homomorphisms from F to F′, where the addition is defined as in Corollary I.4.5. Write End(F) = Hom(F, F). If λ ∈ End(F), μ ∈ End(F′), U, V ∈ Hom(F, F′) then μ ∘ U ∘ λ ∈ Hom(F, F′). In particular, Z acts on Hom(F, F′) by

n · U = [n]_{F′} ∘ U = U ∘ [n]_{F} (n ∈ Z).

We will show that if p > 0 then the action of Z can be extended to an action of Z_{p}, the p-adic integers. By definition, Z_{p} is the completion of Z with respect to the p-adic metric |ap^{r}|_{p} = p^{−r} for ap^{r} ∈ Z, (p, a) = 1. For nonzero a ∈ Z_{p} we define v_{p}(a) = r, where r is the integer such that a = p^{r}b, b ∈ Z_{p}^{×}; thus |a|_{p} = p^{−v(a)}.

Lemma 2.1. If U ∈ Hom(F, F′) and the height of F′ is not ∞ then n · U = 0 only if n = 0 or U = 0.

PROOF. n · U = [n]_{F′} ∘ U. Since R is a domain, the composition of two power series A, B ∈ τR[[τ]] is zero iff A = 0 or B = 0. Thus n · U = 0 iff U = 0 or [n]_{F′} = 0. Now [n]_{F′} = 0 iff n = 0 by Corollaries I.4.8 and I.4.7. □

We put a topology on Hom(F, F′) by decreeing that U and V are close iff U ⊖_{F′} V has a large height. In other words, the topology on Hom(F, F′) is induced from the height metric |U| = c^{ht(U)}, where 0 < c < 1.

Proposition 2.2. If R is a domain of characteristic p > 0 and U ∈ Hom(F, F′) then the map Z × Hom(F, F′) → Hom(F, F′) given by (n, U) ↦ n · U is continuous with respect to the p-adic metric on Z and the height metric on Hom(F, F′).

PROOF. We must show that if n = m + ap^{t} with t large and if U, V ∈ Hom(F, F′) are close then n · U is close to m · V. But

n · U ⊖_{F′} m · V = [n]_{F′} ∘ (U ⊖_{F′} V) ⊕_{F′} [ap^{t}]_{F′} ∘ V.

The height of [n]_{F′} ∘ (U ⊖_{F′} V) is ≥ ht(U ⊖_{F′} V). The height of [ap^{t}]_{F′} ∘ V is ≥ t. Both these heights are large, so the height of the sum is large by Corollary I.4.5. □

Corollary 2.3. If R is an integral domain of characteristic p > 0 then Hom(F, F′) is a Z_{p}-module. If the height of F′ is finite and a ∈ Z_{p}, U ∈ Hom(F, F′) then a · U = 0 only if a = 0 or U = 0.

PROOF. The first sentence is immediate from Proposition 2.2. Since in particular End(F′) is a Z_{p}-module, we can define [a]_{F′} = a · [1]_{F′} ∈ End(F′) when a ∈ Z_{p}. Then a · U = [a]_{F′} ∘ U. This can equal zero only if [a]_{F′} = 0 or U = 0. Suppose [a]_{F′} = 0. Let n be an integer such that |a − n|_{p} < |a|_{p}, thus n = a + p^{k}b, b ∈ Z_{p}, and p^{k} does not divide a. Then ht([n]_{F′}) < k ht(F′), ht([p^{k}b]_{F′}) ≥ k ht(F′), so by Corollary I.4.5, ht([a]_{F′}) = ht([n]_{F′}) < ∞. This shows [a]_{F′} ≠ 0, as required. □

§III.3. Consequences of Couveignes’ theorems

Fix the following notation throughout this section. Let R be an integral domain of characteristic p > 0, F and F′ formal group laws of height h over R, and q = p^{h}. Let C_{1}, C_{2}, … denote Couveignes’ relations given in §1 evaluated at the coefficients of F, F′ but leaving the u_{i} as indeterminates; thus C_{i} ∈ R[X_{1}, …, X_{i}] and C_{i} = X_{i}+ a certain polynomial in X_{1}, …, X_{i−1} if i is not a power of p; C_{i} = v′_{1}X_{i}^{q} − v_{1}^{i}X_{i}+ a certain polynomial in X_{1}, …, X_{i−1} if i is a power of p. Here the v_{i} and v′_{i} lie in R, since they are polynomials in the coefficients of F and F′, respectively. Couveignes’ theorems assert that if ∑ u_{i}τ^{i} ∈ Hom(F, F′) then C_{i}(u_{1}, …, u_{i}) = 0 for all i. Let K denote the separable algebraic closure of the quotient field of R.

Lemma 3.1. There are exactly q^{n} solutions (u_{1}, …, u_{p^{n}−1}) with u_{i} ∈ K to the first p^{n} −1 of Couveignes’ relations.

PROOF. For each solution (v_{1}, …, v_{i−1}) to the first i−1 of Couveignes’ equations over K there are q values or 1 value of v_{i} such that (v_{1}, …, v_{i}) is a solution to the ith relation, according as i is or is not a power of p. (To see that the q solutions for v_{i} are distinct when i is a power of p, note that the derivative with respect to X_{i} of C_{i} is v_{1}^{i}, which is nonzero.) The lemma now follows easily by induction on n. □

Theorem 3.2. If u_{1}, u_{2}, … is a solution to Couveignes’ relations then ∑ u_{i}τ^{i} ∈ Hom(F, F′).

PROOF. Without loss of generality we can replace R by K. In [F, III, §2] it is shown that Hom(F, F′) is free over Z_{p} of rank h^{2} and p^{n}Hom(F, F′) is the set of homomorphisms with height ≥ nh. (In fact, it is shown that Hom(F, F′) is the maximal order of a central division algebra over Q_{p} of rank h^{2} and invarianat 1/h, but we do not need this here.) It follows that a complete set of Z_{p}-module generators U_{1}, …, U_{h^{2}} can be found such that the height of each generator is less than h, and if ∑ c_{i}U_{i} has height ≥ nh for some c_{i} ∈ Z_{p} then each c_{i} is divisible by p^{n}. If U, U′ ∈ Hom(F, F′) and U ≡ U′ mod deg q^{n} (meaning that the ith coefficient of U and U′ coincide for all i ≤ q^{n}) then

0 = F′(U′, [−1]_{F′} ∘ U′) ≡ F′(U, [−1]_{F′} ∘ U′) = U ⊖_{F′} U′ mod deg q^{n},

so U ⊖_{F′} U′ has height ≥ nh, and it is therefore divisible by p^{n}. Thus ∑ c_{i}U_{i} ≡ ∑ c′_{i}U_{i} mod deg q^{n} (c_{i}, c′_{i} ∈ Z_{p}) implies c_{i} ≡ c′_{i} mod p^{n}. This shows that the number of distinct elements ∑_{i=1}^{q^{n}−1} u_{i}τ^{i} which are truncations of power series in Hom(F, F′) is the cardinality of (Z/p^{n}Z)^{h^{2}}, which is q^{nh}. Each truncation gives rise to a solution (u_{1}, …, u_{q^{n}−1}) of the first q^{n} − 1 of Couveignes’ relations. Since this coincides with the total number of solutions, each solution of Couveignes’ relation arises from Hom(F, F′). □

Corollary 3.3. If h = 1 and if Hom(F, F′) contains a homomorphism (with coefficients in R) of height k then all the solutions (v_{1}, v_{2}, …) in K to Couveignes’ relations for which v_{i} = 0 for i < p^{k} actually lie in R.

PROOF. Let U be the homomorphism of height k and Z_{p} · U = { c · U | c ∈ Z_{p} }. As mentioned in the previous proof, Hom(F, F′) ≅ Z_{p}, and it is generated by a homomorphism U_{0} of height zero. Find a ∈ Z_{p} such that U = a · U_{0}. Since ht(a · U_{0}) = v_{p}(a), v_{p}(a) = k. Thus Z_{p} · U = Z_{p}a · U_{0} = p^{k}Z_{p} · U_{0}. Since U is defined over R, so is c · U for each c ∈ Z_{p}. Thus every element of p^{k}Z_{p} · U_{0} has coefficients in R. The coefficients of such elements are precisely the solutions (v_{1}, v_{2}, …) to Couveignes’ relations which have v_{i} = 0 for all i < p^{k} − 1. □

Bibliography

[C] J. P. Couveignes, Quelques calculs en theorie des nombres, Ph.D. thesis, Bourdeaux, 1995

[F] A. Frohlich, Formal Groups, Lect. Notes in Math. 74, Springer-Verlag, 1968

[Fu] W. Fulton, Algebraic Curves, Addison-Wesley, 1969

[H] M. Hazewinkel, Formal Groups and Applications, Academic Press, New York, 1978

[K] A. W. Knapp, Elliptic Curves, Math. Notes 40, Princeton University Press, Princeton, New Jersey, 1992

[LM] R. Lercier and F. Morain, Counting the number of points on elliptic curves over F_{p^{n}} using Couveignes’ algorithm, Research report LIX/RR/95/09, Ecole Polytechnique-LIX, September 1995

[S] J. H. Silverman, The Arithmetic of Elliptic Curves, Springer-Verlag, New York, 1986

[W] W. C. Waterhouse, Abelian varieties over finite fields, Ann. scient. Éc. Norm. Sup. 2 1969, 521-560