TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM
SPENCER DEMBNER

Abstract. We discuss several results about rational torsion points on elliptic
curves. First, we outline the proof of the Mordell-Weil Theorem, a fundamental
result which ensures the subgroup is finite. Next, we explain how to computethe torsion of a specific elliptic curve using local methods. Finally, we discuss
modular curves, which make it possible to study torsion points of every elliptic
curve at once. This allows us to state (but not prove) Mazur’s celebrated
torsion theorem, which says that only 15 specific groups can occur as rational
torsion subgroups of elliptic curves.

Contents
1. Introduction
2. Basic Theory
3. Local Fields, and a Result on Torsion
4. Galois Cohomology
5. Selmer Groups and the Mordell-Weil Theorem
6. Two Examples
7. Modular Curves
7.1. Elliptic Curves as Riemann Surfaces
7.2. The Action of SL2 (Z)7.3. Modular Curves and Mazur’s Theorem
Acknowledgments
References

1
3
6
8
12
16
19
20
22
25
27
27

1. Introduction
Our focus in this paper will be on elliptic curves, which are smooth, projective
algebraic curves of genus one over a field. The fundamental fact about elliptic
curves is that they admit a group law: given an elliptic curve E, there is a map ofalgebraic varieties + : E × E → E which gives E the structure of an Abelian group.
The group operation makes sense for any field, so for instance if the elliptic curve
E is defined over Q, the points on E with complex coordinates form a group, andthe points with rational coordinates form a subgroup.
In 1922, Louis Mordell proved that given any elliptic curve E defined over Q, its
group E(Q) of rational points is a finitely generated abelian group. In 1928, Andre
Weil proved the Mordell-Weil Theorem, which shows that the same holds for any
finite extension K of Q. By the classification of finitely generated Abelian groups,
Date: August 19, 2019.
1

2

SPENCER DEMBNER

we find that E(Q) ∼= Zr × F , where F is some finite Abelian group and r is therank of the group E(Q), also known as the rank of the curve E.
This immediately poses two additional questions: first, what are the possible
ranks r? Second, what can we say about the finite torsion subgroup F ? The firstquestion turns out to be very difficult, and little is known: in fact, it is unknown
whether there are elliptic curves whose rank grows arbitrarily large. The Birch and
Swinnerton-Dyer Conjectures, still unproven, would establish a connection between
the ranks of elliptic curves and certain L-functions.
The second question is much more tractable. In 1978, Barry Mazur proved thefollowing elegant result, which completely settles it, at least over Q:
Theorem 1.1. Let E be an elliptic curve defined over Q. The possible torsion
subgroups of E(Q) are:
(1) Z/N Z, where 1 ≤ N ≤ 10, or N = 12.
(2) Z/2Z × Z/2N Z, where N = 1, 2, 3, 4.1
In this paper, we develop some of the general theory of torsion on elliptic curves
in order to put Mazur’s Theorem in context. In the first few sections, we state
fundamental results on elliptic curves, skipping all but the simplest proofs. In
the next few sections, we outline the proof of Mordell-Weil in some detail, paying
special attention to local considerations and the role of Galois cohomology. Then,in order to make the argument in the proof of Mordell-Weil more explicit, we
discuss how to calculate the group of rational points on a specific curve, as well
as how these methods can fail. In the final sections, we develop the basic theoryof modular curves. These are (roughly) curves whose points correspond to elliptic
curves with specified torsion points. Studying them provides an effective way toanswer questions about torsion across all elliptic curves, and they played a central
role in the proof of Mazur’s Theorem. The proof of the full theorem is far beyond
our scope, but we discuss proofs of several specific cases.
In general, we work over an arbitrary number field for the proof of Mordell-Weil.
For the rest of the paper, we specialize to elliptic curves defined over Q, wherefinding possible torsion subgroups is much easier. In the final section, we briefly
consider elliptic curves defined over C rather than a number field.
In general, we assume the reader has seen the basic theory of algebraic curves,at the level of [4] or the first two chapters of [16]; in particular, a couple of results
which we quote without proof depend on the Riemann-Roch theorem for curves.
We also assume a solid knowledge of Galois theory, and familiarity with some basic
notions from algebraic number theory. In the final sections, we will occasionallyneed basic facts from complex analysis, and these sections use very little from therest of the paper.
We don’t assume any prior exposure to elliptic curves, although some basic
results will be quoted without proof. Most of these results come from [16], and canalso be found in [10].

1The fact that every torsion subgroup is either of the form Z/N Z or Z/N Z × Z/2Z follows fromthe structure of E(R), which will either be S1 or S1 × Z/2Z, depending on the discriminant. Fora discussion, see Chapter V of [15].

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

3

2. Basic Theory
For the purposes of this paper, all curves considered will be projective, unlessstated otherwise. We will need a couple of basic results from the theory of algebraic
curves, which we state here for reference.
Theorem 2.1 (Bézout’s Theorem). : Let C, C 0 be projective plane curves of degreem and n respectively. Then C, C 0 intersect with total multiplicity mn.
Proof. See Chapter 5 of [4].

Theorem 2.2 (Degree-genus formula). Let C be a smooth projective plane curve
defined by an equation of degree d, with genus g. Suppose further that C is definedover a field of characteristic 0. Then:g=(d − 1)(d − 2)2

Proof. This is a consequence of the Riemann-Hurwitz formula, which states that
if φ : C1 → C2 is a degree n map between smooth curves C1 , C2 of genus g1 , g2
respectively, both defined over a field K with char(K) = 0, then:X
2g1 − 2 = n(2g2 − 2) +(eφ (P ) − 1)P ∈C1Here, eφ (P ) is the ramification index of φ at P , which is one for all but finitely
many P . For a proof of this formula, see Chapter II of [16]. In order to provethe degree-genus formula, pick a line L ⊂ P2 which is not tangent to C, and let
φ : C → L be the projection map. The line L is isomorphic to P1 , and hence
has genus 0 (the genus of P1 can be calculated from the Riemann-Roch theorem,
discussed in Chapter 8 of [4]). The map φ will have degree d, by Bézout’s Theorem.
Likewise, by Bézout’s Theorem, since L is not tangent to C, L ∩ C will consist of ddistinct points, which are the ramification points of the map, and each such point
will ramify to degree d. Thus, we have:2g(C) − 2 = −2d + d(d − 1)
Rearranging terms, we find that g(C) = (d−1)(d−2), as desired.
2First, we give the general definition of an elliptic curve:
Definition 2.3. Let K be any field. An elliptic curve defined over K is a pair
(E, O), where:(1) E is a projective algebraic curve of genus one, defined over K.
(2) O is a point on E with coordinates in K (a ‘K-rational point’).
Note that the point O is part of the definition. In particular, if a curve has an
equation with coefficients in K but has no K-rational points, then the curve is not
an elliptic curve defined over K. When we give the curve E a group law, O will be
its identity element. For ease of notation, however, we will usually just call a curve
E, allowing the point O to be understood. We will also write E/K to indicate that
E is defined over the field K.
In order to simplify proofs, it helps to introduce a more explicit description of
elliptic curves. This motivates the following definition:

4

SPENCER DEMBNER

Definition 2.4. A Weierstrass equation is an equation of the form:(2.5)

Y 2 + a1 XY + a3 Y = X 3 + a2 X 2 + a4 X + a6

where a1 , a2 , a3 , a4 , a6 are contained in some field K. Working in homogenous
projective coordinates, this corresponds to the equation:
Y 2 Z + a1 XY Z + a3 Y Z 2 = X 3 + a2 X 2 Z + a4 XZ 2 + a6 Z 3Every Weierstrass equation defines a plane curve, C. The equation has an associated number ∆, called the discriminant, whose definition we give in a special
case below. The discriminant ∆ is nonzero if, and only if, the associated curve C
is nonsingular (for more details on this, see Chapter III of [16]). Note that if C is
nonsingular, then C can be made into an elliptic curve defined over K. Indeed, by
the degree-genus formula, C will have genus one, so we only need to check that C
contains a K-rational point O. For this, note that the point [0 : 1 : 0] is K-rational,
and is the unique point at infinity contained on the curve C. By convention, if acurve C is defined by a Weierstrass equation, we always take the point O to be thepoint at infinity.
What is less clear is that the converse is true. That is, an elliptic curve canalways be written in Weierstrass form:
Lemma 2.6. Let E/K be an elliptic curve. There are functions x, y ∈ K(E) suchthat the map φ : E → P2 given by:φ(P ) = [x(P ), y(P ), 1]
is an isomorphism.
Proof. See [16], Proposition III.3.1.



In particular, we now know that every elliptic curve is a plane curve.
Over a field of characteristic 0, such as Q, we can change coordinates to write
any Weierstrass equation in the simpler form:
y 2 = x3 + Ax + B
We will usually work with Weierstrass equations of this form. In this case, thediscriminant is given by:∆ = −16(4A3 + 27B 2 )We also associate another quantity, called the j-invariant, and defined by:(4A)3∆
The j-invariant will become important in the final section when we study modular
curves. This is because of the following fact:j = −1728

Fact 2.7. Suppose K is algebraically closed. Then two elliptic curve E, E 0 are
isomorphic over K if and only if they have the same j-invariant.
Elliptic curves have a group law which is compatible with their algebraic structure. More formally, we have:
Theorem 2.8. Let (E, O) be an elliptic curve. Then there exists a map + : E×E →E, such that:(1) E is an Abelian group with the binary operation +, with identity elementO.

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

4 y

5y 2 = x3 − x + 1

3
2
Q
1
P
−2

x
−1

1

2

3

4

−1
−2
P +Q
−3
−4
Figure 1. An illustration of the group law on the elliptic curvey 2 = x3 − x + 1(2) The map + is a morphism of varieties.
Proof. By the above discussion, we may take E to be a plane curve, allowing us toapply Bézout’s Theorem. The group law on E is given by the following algorithm:
given two points A, B ∈ E, the line between A and B intersects E at a unique third
point P , by Bézout’s Theorem (if A = B, take the tangent line). The line between
P and O likewise intersects at a unique third point P 0 , and we define A + B = P 0 .
A proof that this gives an Abelian group law, via the Riemann-Roch theorem, isgiven in Chapter III of [16]. For a different argument, see Chapter 5 of [4].

We now define maps between elliptic curves. An elliptic curve is compatibly botha group and an algebraic variety, so it makes sense to require that maps preserveboth structures. Thus, we define an isogeny to be a map f : E → E 0 between
elliptic curves which is a morphism of varieties and also a group homomorphism.
It turns out that a weaker condition is enough:Proposition 2.9. Suppose f : E → E 0 is a morphism of varieties and maps O ∈ E
to O0 ∈ E 0 . Then f is an isogeny.
Proof. See [16], Theorem III.4.8.

Every elliptic curve E has corresponding isogenies [m] : E → E, mapping P to
mP . Many basic properties of elliptic curves can be verified by carefully considering
these maps. Here is one example:

6

SPENCER DEMBNER

Lemma 2.10. Let E/K be an elliptic curve, pick m ∈ Z>0 , let E[m] be the subgroup of E(K) consisting of m-torsion points, and suppose K is algebraically closedof characteristic 0. Then E[m] ∼= (Z/mZ)2 .
Proof. The kernel of the isogeny [m] has size m2 for all m ([16], Theorem III.6.2),
and this kernel is exactly E[m]. If n divides m, then E[n] ⊂ E[m]. Writing
G = E[m], this means that for every n dividing m, the n-torsion subgroup of G has
size n2 . But the only Abelian group of size m2 with this property is (Z/mZ)2 . 
Remark 2.11. A version of this statement is true in characteristic p, but we won’t
need it. See [16], Corollary III.6.4.
3. Local Fields, and a Result on Torsion
For the proof of the Mordell-Weil Theorem, we will need several basic facts about
local fields and elliptic curves defined over them. We state them here for reference.
For proofs of the basic facts on local fields and definitions of terminology (absolutevalue, completion, Qp local field, and so on), see any standard book on algebraic
number theory such as [12] or [14]Let K be a finite extension of Q (a number field ). Given an absolute value v on
K (which we always assume to be nontrivial), we will often want to consider thecompletion Kv of v with respect to K. If v is Archimedean, Kv will be isomorphic
either to R or to C. Otherwise. Kv will be isomorphic to a finite extension of Qp
for some prime p, and hence will be a local field. We will often make use of thefollowing result, which characterizes the set of absolute values on K.
Theorem 3.1 (Ostrowski). Let K be a number field.
(1) The only fields complete with respect to an Archimedean absolute value are
R and C. In particular, the Archimedean absolute values on K correspondto real embeddings of K or conjugate pairs of complex embeddings.
(2) The non-Archimedean absolute values on K are exactly the p-adic absolutevalues, where p is a prime ideal in the ring of integers OK . The completions
with respect to non-Archimedean absolute values are finite extensions of Qp
for some prime p.
Proof. See [2].

Let K be a local field. The absolute value on K corresponds to a unique normalized discrete valuation, mapping elements of K to Z ∪ {∞}; this is because K
is the fraction field of the ring R of elements with absolute value at most 1, andthe ring R is a discrete valuation ring. We always assume discrete valuations arenormalized, which means that the minimum positive valuation of any element is
1. We will need the fact that valuations extend to algebraic extensions, and that
finite extensions of local fields are local.
Lemma 3.2. Let K be local. If E/K is an algebraic extension, the discrete valuation on K extends uniquely to a valuation on E. If E is assumed to be finite, thenthe valuation on E will be discrete, making E into a local field as well.
Proof. See Chapter II, §3 of [14].

Let E/K be a finite extension of local fields. Suppose that π ∈ K is an elementof valuation 1 in K. We define the ramification degree of the extension, necessarily
a positive integer, to be the valuation of π in E.

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

7Now, suppose that L/K is a Galois extension of number fields, not necessarily
finite, and let v be a valuation on K. The valuation v may have multiple extensions
to L, since K is not complete with respect to v. It turns out that Gal(L/K) actson the set of valuations extending v by sending the valuation w to w ◦ σ. For fixedw, we define the decomposition group Gw ⊂ Gal(L/K) to be the stabilizer of thevaluation w. In general, not all the decomposition groups above a given valuation
will be the same, but they will be conjugate, since the action of the Galois groupis transitive. Given a choice of valuation w extending v, we have a corresponding
extension Lw /Kv of complete fields.
Theorem 3.3. The extension Lw /Kv is Galois, with Galois group Gal(Lw /Kv ) =Gw .
Proof. See [14], Chapter II, §3.

Given a Galois extension of local fields L/K, there is a corresponding extensionof finite residue fields L̃/K̃, and the Galois group Gal(L/K) maps into Gal(L̃/K̃).
In the case discussed above, we define the inertia group Iv ⊂ Gv to be the kernelof the reduction map on Galois groups. The inertia group will be trivial if andonly if the extension is unramified (has ramification degree 1). Furthermore, thereduction map on Galois groups is surjective, so unramified extensions of local fields
correspond to extensions of the residue field.
Next, we consider elliptic curves defined over local fields. let K be a local field
and let E/K be an elliptic curve. By changing coordinates if necessary, we canfind a Weierstrass equation for E all of whose coordinates are integral (that is,have nonnegative valuation); in this case, the discriminant, which is a polynomialin the coefficients, will also be integral. If the valuation of the discriminant isminimal across all Weierstrass equations with integral coefficients, we say that theWeierstrass equation is minimal. Given any point [x : y : z] ∈ P2 , we can rescale
coordinates so that all three are integral, and so that at least one has valuation
zero. Since at least one reduced point will be nonzero, reducing these coordinates
modulo the maximal ideal (π) gives a map:
E(K) → Ẽ(K̃)
Here, K̃ is the finite residue field of K, and Ẽ is the curve whose equation is the
reduced form of the equation for E. The discriminant of the equation corresponding
to Ẽ will be nonzero in K̃ if, and only if, the valuation of the original discriminant
was zero.
Definition 3.4. Let E/K be an elliptic curve over a local field, and pick a minimal
Weierstrass equation for E. We say that E has good reduction if the reduced curveẼ is nonsingular. This is equivalent to requiring the discriminant of the minimal
Weierstrass equation for E to have valuation 0, and does not depend on which
minimal Weierstrass equation is chosen.
Usually, we will be interested in elliptic curves over a number field K. Given
some E/K, we can interpret it as an elliptic curve over Kv for every valuation v on
K. We say E has good reduction at v if the corresponding curve E/Kv has good
reduction. For example, given an elliptic curve defined over Q, we will often reduce
its coefficients mod p, where p is a prime number.

8

SPENCER DEMBNER

By studying how the coordinates of Weierstrass equations transform, we canshow that the discriminant only changes by 12th powers. This gives the following
result:Proposition 3.5 ([16], Remark VII.1.1). Let E be an elliptic curve over a local
field K given by a Weierstrass equation. If the Weierstrass equation has integral
coefficients, and the discriminant has valuation less than 12, then the Weierstrassequation is minimal.
For example, if an elliptic curve E/Q has discriminant ∆, and ∆ is not divisibleby p12 for any prime p, then the corresponding Weierstrass equation is minimal
at every prime p. In particular, E has good reduction at exactly the primes notdividing ∆.
The following result, which tells us how torsion points transform under reduction,is crucial in the proof of the Mordell-Weil Theorem:
Lemma 3.6. Suppose E/K is an elliptic curve defined over a local field K, andsuppose E has good reduction. Let p be the characteristic of its residue field. If m
is coprime to p, then reduction gives an injective map:
E(K)[m] → Ẽ(K̃)
In other words, the reduction map is injective on m-torsion, for m coprime to p.
Proof. See [16], Proposition VII.3.1.



4. Galois Cohomology
Let E be an elliptic curve defined over the field K, and pick σ ∈ Gal(K̄/K).
The map σ acts on projective space by acting on its coordinates, sending [x : y : z]to [σ(x) : σ(y) : σ(z)]. Let E σ be defined by letting σ act on the coefficients ofa Weierstrass equation for E. Then E σ is an elliptic curve, and σ sends E(K̄) to
E σ (K̄). In particular, if E is defined over K, then σ induces a group automorphismof E(K̄), although the map will not in general be a morphism of varieties.
The main technical apparatus in the proof of the Mordell-Weil Theorem is theanalysis of Gal(K̄/K)-actions, especially this one. In this section, we briefly summarize the facts about Galois cohomology, which is a way to frame and simplify
many facts about Galois actions. All facts quoted without proof in this section arefrom the appendix to [16]. For many more details, see the article [20].
Let K be a number field. The Galois group Gal(K̄/K) has a natural topology
as a profinite group, known as the Krull topology, which has the property that the
subgroup Gal(K/F ), for F a finite Galois extension, form a neighborhood basis
around the identity (for more details, see [17]). An Abelian group M endowed withan action of Gal(K̄/K) is called a Gal(K̄/K)-module if the action is continuous.
That is, the corresponding map f : Gal(K̄/K) × M → M is a continuous map of
topological spaces, where M is always taken with the discrete topology.
Proposition 4.1. An action of Gal(K̄/K) on an Abelian group M is continuous
if, and only if, the stabilizer of any element m ∈ M is an open subgroup of finite
index.
Proof. A standard fact about profinite groups is that the open subgroups are exactly
the closed subgroups of finite index. Therefore, it’s enough to prove an action iscontinuous if an only if all stabilizers are open.

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

9First, suppose the action is continuous, and pick m ∈ M . The stabilizer of m is
the set {σ ∈ Gal(K̄/K) : σ(m) = m}; since M has the discrete topology, this will
be open in Gal(K̄/K) if and only if P = {(σ, m) ∈ Gal(K̄/K) : σ(m) = m} is open
in Gal(K̄/K) × M . However, P = f −1 (m) ∩ {(x, m) : m ∈ M }, and the second set
is open since M is discrete, so we conclude the stabilizer of m is open.
Conversely, suppose that for every m ∈ M , the stabilizer of m is open. We willshow that the action map f : Gal(K̄/K) × M → M is continuous. Since M has thediscrete topology, it’s enough to show that for every m ∈ M , f −1 ({m}) is open.
We have:f −1 ({m}) = (σ, n) : σ(n) = m}
For any a ∈ M , set Ba := f −1 ({m}) ∩ (Gal(K̄/K) × {a}) = {(σ, a) : σ(a) = m}.
It’s enough to show that each Ba is open in the product, since f −1 ({m}) is theunion of these sets. Since M is discrete, we find that Ba will be open in the productif and only if
Ca := {σ : σ(a) = m} ⊂ Gal(K̄/K)
is open in Gal(K̄/K). If Ca is empty, then it’s clearly open. Otherwise, pick some
τ with τ (a) = m. Then τ −1 (m) = a. It follows that for any σ, σ(a) = m if andonly if τ (σ(a)) = a. But then Ca is just the stabilizer of a, translated by τ . It
follows from our assumption, along with the fact that Gal(K̄/K) is a topologicalgroup, that Ca is open. This completes the proof.
Given a Gal(K̄/K)-module M , the most basic question we can ask is what its
fixed points are. Write:
M Gal(K̄/K) = {x ∈ M : σ(x) = x, for all σ ∈ Gal(K̄/K)}
We also write M Gal(K̄/K) = H 0 (Gal(K̄/K), M ), for reasons which will soon become
clear.
Example 4.2. By the definition of Gal(K̄/K), it acts on the Abelian group K̄.
This action is continuous: indeed, the stabilizer of any element x is just the kernelof the map Gal(K̄/K) → Gal(F/K), where F is the Galois closure of K(x). By
Galois theory, this kernel is exactly Gal(K/F ), which is open by the definition of
the Krull topology.
In this case, Galois theory says that the fixed points are exactly the elements ofK. By almost the same argument, H 0 (Gal(K̄/K), E(K̄)) = E(K).
Suppose we have a short exact sequence of Gal(K̄/K)-modules:
0

A

f

B

g

C

0

This means that A, B and C are Gal(K̄/K)-modules, and that the maps f andg commute with the action of Gal(K̄/K). It follows that there are corresponding maps f : H 0 (Gal(K̄/K), A) → H 0 (Gal(K̄/K), B) and g : H 0 (Gal(K̄/K), B) →H 0 (Gal(K̄/K), C), where we use the same letter by abuse of notation. The restriction of f will still be injective, and the kernel of the restriction of g will be theimage of the restriction of f , so we can form a corresponding sequence:0H 0 (Gal(K̄/K), A)f

H 0 (Gal(K̄/K), B)g

H 0 (Gal(K̄/K), C)

If g were surjective, then H 0 would preserve exact sequences. Constructions which
preserve exact sequences are immensely helpful, because having an exact sequence

10

SPENCER DEMBNER

often allows us to describe unfamiliar objects as quotients of ones we understand.
Unfortunately, g need not be surjective. This suggests we should find a construction
called H 1 which makes the following result true:
Theorem 4.3. Let A, B, C be as above. Then there exists a natural map δ forwhich we have the following exact sequence:0H 0 (Gal(K̄/K), A)

H 0 (Gal(K̄/K), B)

H 1 (Gal(K̄/K), A)

H 1 (Gal(K̄/K), B)m

H 0 (Gal(K̄/K), C)m

H 1 (Gal(K̄/K), C)δLuckily for us, such a construction exists, although its definition is not immediately intuitive. The following definition is from [16].
Definition 4.4. Let M be a Gal(K̄/K)-module. The group of continuous 11(Gal(K̄/K), M ), is the groupcocycles from Gal(K̄/K) to M , denoted by Zcont
of maps ξ : Gal(K̄/K) → M which are continuous with respect to the discrete
topology on M , and which satisfy the condition:
ξ(στ ) = (ξ(τ ))σ + ξ(τ )For any m ∈ M , the map σ 7→ mσ − m is a continuous cocycle. The group of1(Gal(K̄/K), M ) consisting
coboundaries B 1 (Gal(K̄/K), M ) is the subgroup of Zcontof elements of this form. The first cohomology group of M is the quotient:
H 1 (Gal(K̄/K), M ) =1(Gal(K̄/K), M )Zcont
B 1 (Gal(K̄/K), M )Note that when M is equipped with a trivial Gal(K̄/K)-action, the group
H 1 (Gal(K̄/K), M ) will just be Hom(Gal(K̄/K), M ), the group of continuous homomorphisms. Indeed, in this case a cocycle is just a continuous homomorphism,and every coboundary is trivial. When working with (possibly infinite) Galois
groups, the homomorphisms we consider will always be continuous homomorphisms.
With this definition, Theorem 4.3 becomes true. The required map δ is definedin the following way: pick c ∈ H 0 (Gal(K̄/K), C). Applying exactness at C, pickb ∈ B such that g(b) = c. Then we define ξ : Gal(K̄/K) → B by:
ξ(σ) = bσ − bThis function lands in the image of the mapping A → B, which allows us to interpretξ as an element of H 1 (Gal(K̄/K), A).
In later sections, we will occasionally omit the Galois group Gal(K̄/K) to save
space, when it is clear which group is acting.
There are two additional facts about Galois cohomology which we’ll need. First,
suppose we have a finite Galois extension L/K. Then if M is a Gal(K̄/K)-module,
M is also a module for Gal(L̄/L) = Gal(K̄/L), by restricting the Galois action toa subgroup. This gives a restriction map
Res : H 1 (Gal(K̄/K), M ) → H 1 (Gal(K̄/L), M ),sending each cocycle to its restriction to the smaller group.

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

11

By Galois theory, Gal(L/K) ∼= Gal(K̄/K)/ Gal(K̄/L). Thus, the submoduleM
can be turned into a Gal(L/K)-module.2 Furthermore, if
Gal(K̄/L)ξ : Gal(L/K) → M Gal(K̄/L)
is a cocycle, we can turn it into a cycle for Gal(K̄/K) by composition:
Gal(K̄/K)

Gal(L/K)ξ

M Gal(K̄/L) ⊂ M

This is called an inflation map. We have the following:
Lemma 4.5 (Inflation-restriction sequence). With notation as above, there is anexact sequence0

H 1 (Gal(L/K), M Gal(K̄/L) )Inf

H 1 (Gal(K̄/K), M )Res

H 1 (Gal(K̄/L, M )The only other specific fact we will need about Galois cohomology is this one:
Theorem 4.6 (Hilbert’s Theorem 90). We have:
H 1 (Gal(K̄/K), K̄ ∗ ) = 1
Proof. For a discussion of several proofs, see [19].

Example 4.7. As a first demonstration of the power of Galois cohomology, we
give a quick proof of Kummer theory, which says that if a number field K contains
all mth roots of unity, then any Galois extension L/K with Galois group Z/mZ isof the form L = K(a1/m ) for some a ∈ K. We have the following exact sequenceof Gal(K̄/K)-modules (using multiplicative notation):
1µm

K̄ ∗ z7→z

m

K̄ ∗

1

Taking Galois cohomology yields a long exact sequence, from which we pull thefollowing:K ∗ z7→zmK∗δ

H 1 (Gal(K̄/K), µm )H 1 (Gal(K̄/K), K̄ ∗ )By Hilbert’s Theorem 90, the final term is zero. This, along with exactness atthe second term, implies that:
H 1 (Gal(K̄/K), µm ) ∼= K ∗ /(K ∗ )m
Since we assumed that µm ⊂ K, we have:
H 1 (Gal(K̄/K), µm ) = Hom(Gal(K̄/K), µm ) = Hom(Gal(K̄/K), Z/mZ)
In this case, the map δ is defined as follows: given x ∈ K ∗ , pick y ∈ K̄ ∗ suchthat y n = x — in other words, take y = x1/n . Then define ξ by ξ(σ) = y σ − y. The
kernel of this map will evidently be Gal(K̄/K(x1/m )).
Suppose L/K is Galois with Galois group Z/mZ. Then there is a surjective
homomorphism f : Gal(K̄/K) → Z/mZ, whose kernel is Gal(K̄/L). But by what
we wrote above the kernel must be of the form Gal(K̄/K(x1/m )) for some x ∈ K ∗ ,with x defined up to mth powers. By Galois theory, we conclude L = K(x1/m ).
2The astute reader will complain that we only defined Galois cohomology for absolute Galois
groups. However, a finite group is profinite with the discrete topology, and likewise all otherdefinitions carry over without difficulty; this is because what we’re doing is an (important) special
case of the general study of group cohomology.

12

SPENCER DEMBNER

5. Selmer Groups and the Mordell-Weil Theorem
In this section, we outline the proof of the following result, mostly following
chapters VIII and X of [16]:Theorem 5.1 (Mordell-Weil). Suppose E/K is an elliptic curve defined over anumber field K. Then its group of K-rational points E(K) is a finitely-generated
Abelian group.
As we said in the introduction, this means that E(K) ∼= Zr × F , where r is anonnegative integer and F is some finite group.
At the highest level, the proof of Mordell-Weil proceeds in two steps. First, we
prove the Weak Mordell-Weil Theorem, which says that the group E(K)/mE(K)is finite, for every m > 1. This condition certainly holds of any finitely generated
Abelian group, but the converse doesn’t hold; for instance Q/mQ is trivial, eventhough Q isn’t finitely-generated.
To bridge this gap, one introduces an object called a height function. Roughly
speaking, this measures the complexity of a point with algebraic coordinates. Usually, we require that the height function transforms in predictable ways under summing of points, and that only finitely many points have height below a given bound;along with the Weak Mordell-Weil Theorem, these conditions force E(K) to havea finite set of generators. However, we won’t discuss height functions in any detailand instead refer the reader to [16].
To start, we consider the isogeny [m] : E → E. Letting E[m] denote all m-torsion
points of E defined over K̄, we have the following exact sequence:
0

E[m]

E

[m]

E

0

In fact, this is an exact sequence of Gal(K̄/K)-modules, since all the maps aredefined over K. Taking Galois cohomology gives us the following exact sequence:
0

E(K)[m]E(K)H 1 (E[m])H 1 (E)

m

E(K)

m

H 1 (E)δ

Here, we leave the Galois group Gal(K̄/K) out from our notation to save space.
From the middle, we extract the following:
0

E(K)/mE(K)δ

H 1 (E[m])H 1 (E)[m]0Here, H 1 (E)[m] denotes the m-torsion subgroup of H 1 (E). We call H 1 (E) =H (Gal(K̄/K), E) the Weil-Châtelet group, and write:1

H 1 (Gal(K̄/K), E) = W C(E/K)
Note that this depends on a choice of the field K.
Remark 5.2. The group W C(E/K) has a fairly natural interpretation as a groupof homogeneous spaces, which are curves isomorphic to E over K̄, modulo isomorphisms defined over K. We won’t discuss this: for more details see section X.3 of[16].

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

13This sequence looks promising, since it injects E(K)/mE(K) into another group
we might hope to directly prove is finite. However, the middle term need not be
finite: indeed, if E[m] ⊂ E(K), then H 1 (Gal(K̄/K), E) = Hom(Gal(K̄/K), E),
which is not finite. To fix this, we repeat the same procedure with respect to local
completions and combine the results. Let MK denote a complete set of inequivalentabsolute values on K: that is, MK contains exactly one representative of each
equivalence class of absolute values. The elements of MK are also called places,
and a place is called finite if it corresponds to a non-Archimedean absolute value.
Given any v ∈ MK , we can extend v (non-uniquely) to K̄, by Lemma 3.2. This
allows us to define a completion K̄v , into which K̄ naturally embeds. By abuseof notation, we let v denote the valuation on K̄, chosen arbitrarily to extend thevaluation on K. Then we have a decomposition group Gv ⊂ Gal(K̄/K), which is
the group of elements σ ∈ Gal(K̄/K) that preserve the valuation. By Theorem 3.3,
Gv = Gal(K̄v /Kv ).
The group Gv , in its guise as Gal(K̄v /Kv ), acts on E(K̄v ) in the obvious way.
Indeed, since the previous argument used no facts about the field K, we can once
again use Galois cohomology to construct an analogous sequence in the local case:
(5.3)
0

δ

E(Kv )/mE(Kv )H 1 (Gv , E[m])H 1 (Gv , E)[m]0

Note also that the last term is equal to W C(E/Kv )[m]. Combining all the local
diagrams, we have the following commutative diagram:
(5.4)
0

0

E(K)/mE(K)Yv∈MK

E(Kv )/mE(Kv )δ

H 1 (Gal(K̄/K), E[m])δY

H 1 (Gv , E[m])v∈MK

W C(E/K)[m]

0

Y

0

W C(E/Kv )v∈MKHere, the first vertical arrow comes from inclusion (modulo the appropriate quotient), and the other two come from restriction of a cocycle to the subgroup Gv .
One can check directly from the definitions that this commutes.
By (5.4), the Weak Mordell-Weil Theorem exactly says that the kernel of themap H 1 (Gal(K̄/K), E[m]) → W C(E/K)[m] is finite. We will in fact show slightly
more.
Definition 5.5. The m-Selmer group of E/K is the kernel of the map
Y
H 1 (Gal(K̄/K), E[m]) →W C(E/Kv ),v∈MKdefined in (5.4). By commutativity, either path defines the same map.
We also define the
Q Shafarevich-Tate group, X(E/K), to be the kernel of themap W C(E/K) → W C(E/Kv ).3
We will show the m-Selmer group is finite; as (5.4) makes clear, this is stronger
than showing the kernel of the map H 1 (Gal(K̄/K), E[m]) → W C(E/K)[m] isfinite. The technical heart of this proof is the following. For its proof, which ismostly an exercise in algebraic number theory, see Proposition VIII.1.6 of [16].
3An open conjecture states that X(E/K) is always finite.

14

SPENCER DEMBNER

Proposition 5.6. Let K be a number field, let S ⊂ MK be a finite set of places
containing all the infinite places, and pick an integer m ≥ 2. Let L/K be themaximal abelian extension such that:(1) L has exponent m: that is, every element of Gal(L/K) has order dividingm.
(2) L/K is unramified outside of S.
Then L/K is finite.
To see how Proposition 5.6 will help us, we will state a couple of additional
definitions.
Definition 5.7. Let M be any set which admits an action by Gal(K̄/K), and letv be a finite place. We say M is unramified at v if Iv ⊂ Gal(K̄/K) acts triviallyon M . Now, suppose M is an Abelian group. We say ξ ∈ H 1 (Gal(K̄/K), M ) is
unramified at v if the restriction of ξ to H 1 (Iv , M ) is trivial (recall that ξ is a map
from Gal(K̄/K) to M ).
Remark 5.8. We can motivate this definition in the following way: let L/K be a finite Galois extension of number fields, and define M = Gal(L/K). Since Gal(L/K)
is a quotient of Gal(K̄/K), it admits a natural action. The extension L/K will beunramified at the prime corresponding to v if and only if the inertia group Iv ⊂ L/K
is trivial. But this will hold if and only if the inertia subgroup of the absolute Galois
group acts trivially on L.
Now, let S ⊂ MK be any finite set of places, assumed to contain all the infinite
places. We define:HS1 (Gal(K̄/K), M ) = {ξ ∈ H 1 (Gal(K̄/K), M ) : ξ is unramified at all v ∈/ S}.
Remark 5.9. The group HS1 (Gal(K̄/K), M ) is often also called a Selmer group,
and its definition more or less corresponds to doing cohomology “subject to local
restrictions.” The key fact is that these restricted cohomology groups are always
finite.
Lemma 5.10. Let M be a finite abelian group with an action of Gal(K̄/K),
and let S ⊂ MK be a finite set of places containing all infinite places. Then
HS1 (Gal(K̄/K), M ) is always finite.
Proof. We verified in Section 4 that since Gal(K̄/K) acts continuously, the stabilizer of any given element is an open subgroup of finite index. Since M is finite,
this means that the set of elements fixing all of M is an open subgroup of finite
index, and in particular closed. By Galois theory, this subgroup will be of the form
Gal(K̄/K 0 ) = Gal(K̄ 0 /K 0 ), for some finite extension K 0 /K. Applying inflationrestriction (Lemma 4.5), we have the following exact sequence:00

0 → H 1 (Gal(K 0 /K), M Gal(K̄ /K ) ) → H 1 (Gal(K̄/K), M ) → H 1 (Gal(K̄ 0 /K 0 ), M )One can check that this sequence passes to Selmer groups, giving the following:00

0 → HS1 (Gal(K 0 /K), M Gal(K̄ /K ) ) → HS1 (Gal(K̄/K), M ) → HS1 (Gal(K̄ 0 /K 0 ), M )00The lefthand group is finite since both Gal(K 0 /K) and M Gal(K̄ /K ) are finite.
Therefore, to show the middle group is finite it’s enough to show that the righthandgroup is. Replacing K with K 0 , we may assume Gal(K̄/K) acts trivially on M .

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

15

Suppose m has exponent M , where m ≥ 2 (in other words, that mx = 0 for allx ∈ M ). As in Proposition 5.6, define L/K to be the maximal Abelian extension of
exponent m which is unramified outside of S. Then we know L/K is finite. From
inflation-restriction, we have an inflation map:
HomS (Gal(L/K), M ) → HomS (Gal(K̄/K), M )In particular, we can see that pre-composition takes unramified cohomology classes
to unramified cohomology classes. Recall that the first cohomology group corresponding to a trivial action is just a group of homomorphisms; thus it makes sense
to consider HomS , even though we originally only defined the group HS1 . To show
the righthand group is finite, it’s enough to show that the restriction map
HomS (Gal(K̄/K), M ) → HomS (Gal(L̄/L), M )is trivial.
To prove this, consider any f ∈ HomS (Gal(K̄/K), M ). The kernel of f will bean open subgroup of Gal(K̄/K) of finite index, hence also closed, and thus will be of
the form Gal(K̄/F ), where F/K is a finite Galois extension. The extension F musthave exponent m: indeed, by Galois theory Gal(F/K) = Gal(K̄/K)/ Gal(K̄/F ).
Given any x ∈ Gal(K̄/K), f (mx) = mf (x) = 0 ∈ M , so mx ∈ ker(f ) = Gal(K̄/F ),and this proves F has exponent m.
Furthermore, the extension F is unramified outside of S. Indeed, by assumption,
the map f is unramified outside of S, so for all v ∈/ S, f (Iv ) = 0 (since all group
actions considered here are trivial). But this means that for any such v, Iv ⊂Gal(K̄/F ), so Iv is mapped to 0 in Gal(F/K), which exactly means that F isunramified at v.
Now, however, we know that F ⊂ L, since it’s an extension of exponent m,
unramified outside S. This means ker(f ) = Gal(K̄/F ) ⊃ Gal(L̄/L). But thismeans that f is in the kernel of the restriction map described above. Thus, therestriction map is trivial, and by our discussion above this completes the proof. 
Lemma 5.11. With notation as above, the m-Selmer group S m (E/K) is finite.
Proof. Recall that S m (E/K) ⊂ H 1 (Gal(K̄/K), E[m]). Let S be a finite set ofplaces containing all infinite places, all places v such that v(m) > 0, and all placesv such that E/K does not have good reduction at v. By the previous lemma, it’senough to show that any ξ ∈ S m (E/K) is unramified outside S.
Pick some such ξ, and pick any v ∈/ S. Let Iv be the inertia group for v, containedin the decomposition group Gv . By the definition of the Selmer group as a kernel,
we know that ξ maps to 0 in W C(E/Kv ). By the exact sequence (5.3), this means
the restriction of ξ to Gv is in the image of the connecting map δ : E(Kv )/mE(Kv ).
By the definition of the connecting map, this means for some P ∈ E(K̄v ), we have:ξ(σ) = {P σ − P }Recall that Iv is the kernel of the reduction map:
Gal(K̄/K) → Gal(K̃¯ /K̃ )v

v

Thus, if σ ∈ Iv , then letting Ẽv be the reduction of E with respect to v (which isan elliptic curve since E has good reduction at v), we know that σ acts trivially on
Ẽv . In particular, we have:σ − P = P̃ σ − P̃ = Õ.
P^16

SPENCER DEMBNER

Furthermore, since ξ ∈ H 1 (Gal(K̄/K), E[m]), ξ(σ) = P σ − P ∈ E[m] for every σ.
By definition of S, v(m) = 0, so in particular m is coprime to the characteristic of
the residue field. Applying Lemma 3.6, we find that E(K)[m] is mapped injectively
into Ẽv by the reduction map Thus, since the reduction of P σ − P is trivial, we
must have P σ = P for any σ ∈ Iv , so ξ is trivial restricted to Iv . This proves that
ξ is unramified outside of S, which completes the proofNow, we are ready to prove our main result for this section.
Proof of the Weak Mordell-Weil Theorem. It follows from (5.4) that E(K)/mE(K)bijects with the kernel of the map H 1 (Gal(K̄/K), E[m]) → W C(E/K)[m]. However, the kernel of this map is clearly contained in the kernel of the map
Y
W C(E/Kv )[m],
H 1 (Gal(K̄/K), E[m]) →v∈MKsince the second map factors through the first. This latter kernel is exactly them-Selmer group, which we have verified is finite.
The remainder of the proof of the Mordell-Weil Theorem is based on the ideaof a height function, as we said above, and is laid out in detail in Chapter VIII of[16].
Remark 5.12. In fact, the full Mordell-Weil Theorem says more than we stated
here: given any Abelian variety A over a number field K, the group A(K) is finitely
generated. The proof of this stronger result has the same basic structure: first prove
the Weak Mordell-Weil Theorem, then introduce a notion of height to finish theargument. However, the details are significantly more complicated. For a proof,
see Yuri Manin’s appendix to [11].
6. Two Examples
In this section, we illustrate the proof of the Mordell-Weil Theorem with two
specific examples. First, we apply techniques described in Chapter X of [16] tocompute the rational points (the Mordell-Weil group) of a specific elliptic curve.
Then, in order to illustrate some of the possible difficulties, we discuss a harderand more pathological example which will end up being important in our study ofmodular curves.
The computational strategy we will describe works with curves all of whose 2torsion points are rational (recall that by Lemma 2.10, there are four 2-torsion
points over an algebraic closure, including the identity). It can also be extended tocurves which only have one 2-torsion point aside from the identity. However, as our
second example will indicate, things can very quickly become difficult when neither
assumption holds.
Here is an outline of what we do, omitting most of the proofs. Let E/K (where
K for us will usually be Q) be an elliptic curve defined by an equationy 2 = x3 + Ax2 + Bx + C.
The first step is to compute the K-rational torsion on E. For simplicity, assume
that K = Q. By changing coordinates, we may always assume that the equation for
E is integral. Then except for finitely many bad primes dividing the discriminant,the reduction Ẽ of this curve mod p will be an elliptic curve over Fp , and according
to Lemma 3.6, whenever m is coprime to p this map will be injective on m-torsion.

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

17

By reducing modulo several different small primes and computing the resulting
group Ẽ(Fp ), we can easily bound the size of the torsion group, and then we only
need to find generators for the torsion points whose existence we can’t exclude.
For example, suppose we reduce a curve mod 2 and find that it has 5 points, andthen reduce it mod 5 and find that it has 5 points. Then we know the m-torsion form coprime to 2 is a subgroup of Z/5Z by the first reduction, and we likewise know
by the second reduction that the 2-torsion is trivial. It follows that the torsion
subgroup of E(Q) is either 0 or Z/5Z, and if the first case holds then we should be
able to verify the torsion subgroup is trivial by reducing modulo additional primes.
Once we know the torsion subgroup F , the harder task is to determine the rankr of the curve, giving a decomposition E(Q) ∼= Zr × F . To determine the rank, it’senough to determine the size of the group E(Q)/2E(Q).4 Indeed, once we know
the group F , we know how large F/2F is, and the group E(Q)/2E(Q) will havesize 2r · |F/2F |.
Therefore, it’s enough to compute the size of E(Q)/2E(Q). Since the procedure
is not much more complicated in general, we describe it over an arbitrary number
field K. Furthermore, we assume that all four 2-torsion points on E are K-rational.
We observe from its equation (given above) that E is symmetric over the x-axis.
Since the origin is O = [0 : 1 : 0], this means that for every P = (x, y) ∈ E(C),
we have −P = (x, −y). Thus, the 2-torsion points, aside from the origin, are thepoints for which y = 0. These are exactly the roots of the righthand side of thedefining equation, which tells us that it factors:
x3 + Ax2 + Bx + C = (x − e1 )(x − e2 )(x − e3 ), e1 , e2 , e3 ∈ K
We will let S ⊂ MK be a finite set of “bad places” (recall that MK is a complete
set of absolute values on K). In this case, S will contain the infinite places, theplaces corresponding to primes that divide 2, and all places corresponding to primes
at which E has bad reduction. We define:K(S, 2) = {x ∈ K ∗ /(K ∗ )2 : v(x) ≡ 0 mod 2, for all v ∈/ S}
By the fundamental theorem of Kummer Theory, we find that:∼ H 1 (Gal(K̄/K), {±1})K(S, 2) =S

In particular, an element ξ of the cohomology group is unramified at a given v ∈/Sif, and only if, the corresponding x ∈ K ∗ /(K ∗ )2 satisfies v(x) ≡ 0 mod 2. This
isomorphism tells us that the group K(S, 2) is finite, by the results proved in theprevious section.
Recall that the group E[2] of 2-torsion points on an elliptic curve is isomorphic to
Z/2Z × Z/2Z as a group. Furthermore, since all 2-torsion points on E are assumed
rational, the Galois action is trivial, so this isomorphism is also an isomorphism oftrivial Gal(K̄/K)-modules. One checks once again that the conditions imposed forplaces v ∈/ S line up appropriately, and then we have:1∼ H 1 (Gal(K̄/K), {±1}) × H 1 (Gal(K̄/K), {±1})H (Gal(K̄/K), E[2]) =
S

S

S

∼
= K(S, 2) × K(S, 2)
Recall that the Selmer group S 2 (E/K) is a subgroup of HS1 (Gal(K̄/K), E[2]), andthat E(K)/2E(K) embeds into S 2 (E/K). By composition, this gives an injective
4However, finding specific generators for the group E(Q) is harder, and this is not a problem
we will deal with.

18

SPENCER DEMBNER

homomorphism E(K)/2E(K) ,→ K(S, 2) × K(S, 2). By tracing through the definitions, we can explicitly determine what this map is, and then computing the sizeof E(K)/2E(K) reduces to computing the size of its image in K(S, 2) × K(S, 2).
It turns out that determining whether a given element is in the image amounts tofinding rational solutions to a pair of polynomial equations.
Theorem 6.1 ([16], Proposition X.1.4). Let E/K, S, and K(S, 2) be as above.
Then there is an injective homomorphism
E(K)/2E(K) → K(S, 2) × K(S, 2)
defined by(x − e1 , x − e2 ) if x 6= e1 , e2 ,
 e1 −e3 , e1 − e2
if x = e1 ,e −e
P = (x, y) 7→  1 2 e −e e2 − e1 , e22 −e31
if x = e2 ,
(1, 1)
if P = O
Suppose (b1 , b2 ) ∈ K(S, 2) × K(S, 2) is not the image of O, (e1 , 0), or (e2 , 0).
Then (b1 , b2 ) is in the image of the mapping if and only if the equations:b1 z12 − b2 z22 = e2 − e1b1 z12 − b1 b2 z32 = e3 − e1have a solution (z1 , z2 , z3 ) ∈ K ∗ × K ∗ × K.
If we get lucky, then given each pair (b1 , b2 ), we can either find a point thatmaps to it, or show that the corresponding system of equations is insoluble oversome completion of K . However, it can happen that a given system of equations
is “locally” solvable in every completion of K, but not solvable in K itself. This is
one reason why the procedure describes does not give a guaranteed algorithm tocompute the Mordell-Weil group.
Example 6.2. We illustrate the procedure described above, by computing theMordell-Weil group on the curve
E : y 2 = x3 − 3x2 + 2x = x(x − 1)(x − 2)
It is clear from the equation that E has all 2-torsion rational, and computing its
discriminant we find that it has good reduction at all primes except 2. Reducing
mod 3, we find that the curve contains the four points O, (0, 0), (0, 1) and (0, 2).
Therefore, the torsion subgroup of E(Q) is either (Z/2Z)2 × Z/3Z, or (Z/2Z)2 . To
exclude the first possibility, we reduce mod 5: the resulting curve has 8 points, so
there cannot be any 3-torsion. Therefore, the torsion subgroup of E(Q) is (Z/2Z)2 .
Since E has good reduction away from 2, S will contain only the infinite places
and the prime 2. This allows us to explicitly compute:¯ −2}¯Q(S, 2) = {1̄, 2̄, −1,
Here, the bars denote equivalence classes. It remains only to check which elementsof K(S, 2) × K(S, 2) are in the image. The points (1, 1), (2, 1), (1, −1), and (0, 0)
come from O, (2, 0), (1, 0) and (0, 0) respectively. By considering the first equation,
we can eliminate all four possibilities where b1 < 0, b2 > 0: in this case both b1 z12and −b2 z22 will be non-positive, and hence the equation has no solutions in R. A
similar argument eliminates the four cases where b1 < 0, b2 > 0, leaving only fourcases to check.

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

19

In fact, we only need to check one more case, namely (1, −2). This is because
the map in question is a homomorphism, and hence its image is a subgroup: if anyof the points (1, 2), (2, 2) or (2, −2) were in the image, then multiplying by otherelements of the image would give that (1, −2) is as well. So we are reduced to
studying the equations:z12 + 2z22 = 1, z12 + 2z32 = 2
We will show these equations have no solution in Q2 . Indeed, from the first equation
we find that v(1) = 0 = v(z12 + 2z 2 ) = min(2v(z1 ), 2v(z2 ) + 1). The final equality
follows because the two valuations are necessarily different — one is even, the other
odd — in which case a basic fact about Qp is that their sum will take the smaller
valuation. Since 0 is even, we find v(z1 ) = 0, v(z2 ) ≥ 0. However, the second
equation givesv(2) = 1 = min(2v(z1 ), 1 + 2v(z3 )) = min(0, 1 + 2v(z3 )) = 0,
where the final equality follows from the same basic fact. This is a contradiction,
so the equations have no 2-adic solutions.
It follows that the image of E(Q)/2E(Q) has size 4, which means that the group
E(Q)/2E(Q) itself has size 4. We conclude that the rank is 0, which gives:
E(Q) ∼= (Z/2Z)2In this case, computing the Mordell-Weil group proved not to be very hard.
However, as we said, no general method is known. Here is an important example
of a curve E for which the group E(Q) is not so easy to compute.
Example 6.3. Consider the elliptic curve E : y 2 + y = x3 − x2 Using the proceduredescribed above, we can easily compute the torsion subgroup of E(Q), which turns
out to be Z/5Z. However, with the methods described in this section it will bedifficult to go much further, since none of this curve’s 2-torsion points are rational.
The procedure described above is known as 2-descent. As we said above, asomewhat more complicated version, called descent by 2-isogeny, can be used when
only one two-torsion point is rational. We can also generalize the procedure tom 6= 2, but for larger m the process becomes significantly more complicated andthe equations become much harder to work with.
Alternatively, we could pass to a finite extension K/Q such that E[2] ⊂ E(K),and directly apply the procedure applied above. However, this raises its own difficulties. In particular, it may be difficult to determine how much larger the group
E(K) is, compared to the group E(Q).
With more work, one can overcome these issues; it turns out that this curve has
rank 0, so the Mordell-Weil group is Z/5Z (this curve is indexed as 11.a3 in the
database [18]).
7. Modular Curves
We now change direction substantially, in order to discuss the following question:
Question 7.1. Let E be an elliptic curve defined over Q. What are the possible
torsion subgroups (necessarily finite) of the group E(Q)?
On the basis of the theory we’ve developed so far, this is a very difficult question
to answer. As the examples developed in the previous section show, computing
the torsion subgroup of a specific curve is not difficult, and by applying a little

20

SPENCER DEMBNER

ingenuity we can often determine the full group of rational points. But these results
say nothing about which torsion subgroups could potentially occur across all elliptic
curves.
The solution to this problem is called a modular curve, and can be thoughtof as a quotient of the upper half plane which parameterizes classes of elliptic
curves along with additional structure. In order to define modular curves, we first
discuss the analytic theory of elliptic curves over the complex numbers, skipping
most proofs. For the rest of the paper, we assume basic background in complex
analysis, including the definitions of holomorphic and meromorphic functions andthe statement of Liouville’s Theorem. However, analysis is not our focus and thosewilling to take things on faith should be able to follow along.

7.1. Elliptic Curves as Riemann Surfaces. Let E/C be any elliptic curve defined over the complex numbers (which includes those defined over Q). Any nonsingular algebraic curve over C can be given the structure of a one-dimensional
complex manifold, or Riemann surface. This is a consequence of the holomorphic
implicit function theorem ([5], Chapter 0), and in any case fits well with our intuition that smooth curves are smooth.
In the case of elliptic curves, we can say much more: it turns out that every
elliptic curve is isomorphic to a quotient of C. First, some terminology. We saythat an additive subgroup Λ ⊂ C is a lattice if Λ is generated by two complex
numbers α, β which are not R-linearly dependent. In this case, we observe that thequotient C/Λ is compact and topologically isomorphic to a torus. Furthermore,C/Λ is an Abelian group, since it’s the quotient of C by a subgroup. The group law
is given by addition of complex numbers, modulo the equivalence relation definedby the lattice. The fundamental parallelogram spanned by α and β surjects onto
C/Λ, giving rise to the following topology and group structure:

x

y

x+y

=

In complex analysis, a function which is periodic with respect to two R-linearly
independent periods α, β is called doubly periodic, or (for reasons that will soon
become clear) elliptic. It is not hard to see that any nonconstant elliptic function
cannot be everywhere holomorphic. Indeed, if it were, then the image of C would
be the same as the image of the fundamental parallelogram, and hence compact.
In particular, the function would be bounded, and thus constant by Liouville’s
Theorem. As a result, elliptic functions are only required to be meromorphic rather
than holomorphic.
Given a lattice Λ = hα, βi, we could ask for a nice description of the elliptic
functions which are periodic with respect to Λ. It turns out that such a description
exists in terms of what are called Weierstrass ℘-functions.

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

21

Definition 7.2. Let Λ ⊂ C be a lattice. The Weierstrass ℘-function relative to Λis defined by

X 
1
1
1
−
.
℘(z; Λ) = 2 +z(z − ω)2ω2ω∈Λ,ω6=0

Theorem 7.3. Let Λ ⊂ C be a lattice. Then all elliptic functions are rational
combinations of ℘(z; Λ) and its derivative, ℘0 (z; Λ).
Proof. See [16], Theorem VI.3.2.



We will give no details on the theory of elliptic functions; for an introduction,
see Chapter I of [15]. For our purposes, what makes ℘-functions interesting is thatthey give the Riemann surface C/Λ the structure of an elliptic curve, by acting as
coordinate functions. Remarkably, this allows us to identify the group structure on
C/Λ with the group structure on the corresponding elliptic curve.
Theorem 7.4. Given a lattice Λ, there exists an elliptic curve E/C, such that themap φ : C/Λ → P2 defined byz 7→ [℘(z) : ℘0 (z) : 1]
is an isomorphism both of Riemann surfaces and of groups onto E(C).
Proof. See [16], Theorem VI.3.6.

An even more remarkable fact is that we can go in the opposite direction. Combined, these two results will allow us to study complex elliptic curves by studying
equivalence classes of lattices.
Theorem 7.5 (Uniformization theorem for elliptic curves). Let E/C be an elliptic
curve. Then there exists a lattice Λ ⊂ C, such that the map φ defined above identifies
C/Λ with E.
Proof. See [15], Chapter I, Corollary 4.3.

This looks promising: lattices look easier to study than elliptic curves, and indeed
they are. For instance, given lattices Λ, Λ0 , all the maps between them are given
by linear functions.
Proposition 7.6. Let Λ, Λ0 be lattices. Then:(a) Every holomorphic map C/Λ → C/Λ0 is of the form φ(z +Λ) = mz +b+Λ0 ,where m, b ∈ C and mΛ ⊂ Λ0 .
(b) If φ is also a group homomorphism, then we may take b = 0. In particular,C/Λ ∼= C/Λ0 as complex Lie groups if and only if Λ = γΛ0 for some γ ∈ C∗ .
In this case, we say the two lattices are homothetic.
Proof. For the proof of (a), see Proposition 1.3.2 in [3]; the trick is to lift the map
φ to the complex plane, and analyze it there. To prove (b), suppose φ is a grouphomomorphism. This means in particular that φ sends the equivalence class of 0
to the equivalence class of 0. But φ(0) = b, so we must have b ∈ Λ0 , and up to
the quotient we obtain the same map by taking b = 0. Finally, if φ(z) = mz, φ isclearly invertible if and only if m 6= 0, which shows the final statement.
22

SPENCER DEMBNER

7.2. The Action of SL2 (Z). In this section we define a specific modular curvein detail. Everything we do will extend to the case of general modular curves,discussed in the next section.
Following [3], call a quotient C/Λ a complex torus. We now know that to study
elliptic curves over C, we only need to study complex tori, and to study complex
tori, we only need to study lattices over C up to homothety. To do this, let’s pick abasis hα, βi for the lattice over Z. Further, let’s assume that the basis is positively
oriented, or in other words that β/α has positive imaginary part (it should beclear that we can always pick a basis with this property by reversing the order ifnecessary).
Since we are free to rescale the lattice, we divide by α. This gives rise to a basisof the form h1, τ i, and since hα, βi was positively oriented, we find that Im(τ ) > 0.
We write H for the set of complex numbers x + iy with y > 0.
Question 7.7. Given two numbers τ, τ 0 ∈ H when are h1, τ i and h1, τ 0 i bases forthe same lattice?
Define SL2 (Z) to be the following group:



a b
SL2 (Z) =: a, b, c, d ∈ Z, ad − bc = 1
c d
We will also use the notation Γ(1) = SL2 (Z). For now, the number 1 only exists tocreate a sense of mystery; later, we’ll define groups Γ(N ) for all N . SL2 (Z) has anatural action on the upper half plane, given by:aτ + ba b·τ =c dcτ + dOne can check ([15], Chapter I, Lemma 1.1) that this maps the upper half plane toitself.
If we want, we can view this as a special case of an action of SL2 (C) on the complex projective line, whose definition is the same as the one given above. The corresponding automorphisms are called fractional linear transformations; in general,
the automorphisms of the projective line over a field k are given by the fractional
linear tranformations corresponding to elements of SL2 (k). In our case, the actionof the overall group SL2 (C) does not preserve the upper half plane, but the actionof SL2 (R) ⊂ SL2 (C) does preserve it, so SL2 (Z) does as well. A version of this idea
will come up later, when we discuss cusps.
For another perspective, observe that lattices are free Z-modules (that is, Abeliangroups) of rank 2. A group automorphism of Z2 exactly corresponds to an invertible
2 × 2 matrix with integer entries. In our specific setting, we require that thedeterminant be positive in order to preserve orientation, which suggests that we
consider elements of SL2 (Z) (the only units in Z are ±1). In order to make things
look more familiar, we temporarily reverse
 the order of the basis to hτ, 1i, anda bidentify τ = (1, 0), 1 = (0, 1). Given A =∈ SL2 (Z), we compute:c d
AT ((1, 0)) = (a, b), AT ((0, 1)) = (c, d)Since we are free to rescale, this corresponds to the choice of oriented basis:aτ + b1,.
cτ + dTORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

23

Figure 2. An illustration of the action of SL2 (Z) on the upper
half plane. Image due to Wikimedia user Kilom691.
This suggests the action of SL2 (Z) is really just a change of basis in disguise.
Writing Λτ for the lattice spanned by 1 and τ , we have the following:
Proposition 7.8. Given τ, τ 0 ∈ H, the lattices Λτ and Λτ 0 are homothetic if, andonly if, there exists some φ ∈ SL2 (Z) such that φ(τ ) = τ 0 .
Proof. In one direction, suppose that τ 0 = φ(τ ) for some φ ∈ SL2 (Z). By the discussion above, this means that 1, τ 0 are a basis for the same lattice, up to rescaling.
Conversely, suppose Λτ 0 = γΛτ , where γ ∈ C∗ . This means that γ, γτ form abasis (necessarily positively-oriented) for the lattice which is also spanned by 1, τ 0 .
By our remark above about automorphismsof Z2 , we know that 1 = c(γτ ) + dγ,a bτ 0 = a(γτ ) + bγ for some A =∈ SL2 (Z). Dividing, we find as expectedc dthat A(τ ) = τ 0 .

It turns out, although we won’t
 need to use this fact,
 that the group SL2 (Z) is
1 1
0 1
generated by the matrices σ =,τ =. Both of these matrices act
0 1−1 0
in visually intuitive ways: the first translates τ 7→ τ + 1, while the second maps1
τ 7→ −1
τ , which amounts to reflection in the circle S followed by reflection over they-axis.
We now know that the orbits of the Γ(1)-action on H correspond to the isomorphism classes of elliptic curves over C. This makes it natural to define
Y (1) = Γ(1)\H,
the quotient of the upper half plane by the action of Γ(1).5 The quotient Y (1) has
a natural quotient topology. In fact, although this is not obvious, more is true:
Fact 7.9. With an appropriate choice of charts, Y (1) is a Riemann surface.
Let π : H → Y (1) be the projection map. At most points π(x) ∈ Y (1), theRiemann surface structure is easy to define, because no element of Γ(1) fixes π(x)aside from ±I, both of which act trivially. Thus, we just take π(U ) for a sufficiently
small neighborhood U of x, to obtain a local chart. However, there are two points
for which this condition fails: i and the third root of unity ω3 . We call these points
5Since multiplying a matrix by ±1 does not change its action on H, some authors instead let
the action be that of the quotient group SL2 (Z)/{±I}.

24

SPENCER DEMBNER

elliptic points; a bit more work is required to define the Riemann surface structure
at these points, but it can be done.
Our ultimate hope is to apply tools from algebraic geometry in order to findrational points on modular curves such as Y (1). The basis for this approach is thefollowing theorem.
Theorem 7.10. Every compact Riemann surface is an algebraic curve.
Proof. See [5], among others.



We can’t immediately use Theorem 7.10, because the curve Y (1) is not compact.
To fix this, we will add finitely many rational points called cusps, which do notcorrespond to elliptic curves. This makes the resulting object worse at classifying
curves, but far better behaved.
To see how to proceed, consider Figure 2. The shaded area, D, is called afundamental domain for the group action, roughly because its translations under
the group action form a tiling of H. If D were compact, then its image under thequotient, which is Y (1), would be as well. In fact, D fails to be compact; after
making the appropriate identifications, we see that D becomes compact when the
point ∞ = [1 : 0] on the Riemann sphere is added to it.
However, we cannot just add the point ∞, since we also need to consider thegroup action. Reflection in the unit circle sends the fundamental domain D to awedge which tapers to the point 0, suggesting that this reflection should send ∞ to
0. In fact, for every q ∈ Q, there is an element of the group which sends ∞ to q.
One way to see this is to recall that SL2 (Z) is really acting on the Riemannsphere by fractional linear transformations. In this case, the action is of the formaa·1+b·0=∞ 7→
c·1+d·yc
where ad − bc = 1. By picking a fraction q = ac in lowest terms and using basic
facts about principal ideal domains, we can always find an element of SL2 (Z) whose
action is of the form given above.
This motivates the following initially bizarre-looking definition:
Definition 7.11. The modular curve X(1) is the quotient of H ∪ {∞} ∪ Q ⊂ C,
under the action of Γ(1) by fractional linear transformations.
Points coming from Q ∪ {∞} are called cusps. In the case we’re currently dealing
with, the group action will actually collapse all the added points into a single orbit,
as we just verified. However, we will soon deal with other modular curves whichhave multiple cusps.
Fact 7.12. X(1) can be made into a compact Riemann surface, and thus is analgebraic curve.
Proof. See Chapter 2 of [3].

A final issue, which will become much more important in the next section, is thequestion of fields of definition. Suppose E, E 0 /Q are isomorphic over C: then they
are also isomorphic over Q̄. Indeed, by Fact 2.7, the curves will be isomorphic overan algebraically closed field if, and only if, they have the same j-invariant. Sinceboth fields are algebraically closed, the result follows. However, the isomorphism
need not be defined over Q, and it need not preserve structure relative to Q. For

TORSION ON ELLIPTIC CURVES AND MAZUR’S THEOREM

25

instance, two elliptic curves defined over Q may have different groups of rational
torsion points, despite being isomorphic over C (equivalently Q̄).
In our case, it turns out that if a point on X(1) is rational then there is someE/Q contained in the corresponding isomorphism class. However, since multiple
such curves may have different rational torsion structure, we want to be able todistinguish between them.
7.3. Modular Curves and Mazur’s Theorem. In order to solve the problem
just described, we now consider the action of a subgroup Γ ⊂ SL2 (Z).6 The resulting
modular curves will “remember more information” about the underlying curves,
giving a finer classification. Three special classes of subgroups show up most often:
Definition 7.13. Pick N ≥ 1. Then:



 


a b
a b
1 0
Γ(N ) =∈ SL2 (Z) :
≡
mod N
c d
c d
0 1



 


a b
a b
1 ∗
Γ1 (N ) =∈ SL2 (Z) :
≡
mod N
c d
c d
0 1



 


a b
a b
∗ ∗
Γ0 (N ) =∈ SL2 (Z) :
≡
mod N
c d
c d
0 ∗
Note that for all N , Γ(N ) ⊂ Γ1 (N ) ⊂ Γ0 (N ). Likewise, note that
Γ(1) = Γ1 (1) = Γ0 (1) = SL2 (Z),which explains our notation from the previous section.
Just as with Γ(1), we can construct a corresponding modular curve. We call thecorresponding curves Y (N ), Y1 (N ), and Y0 (N ) respectively. Likewise, we can compactify these curves, arriving at compact Riemann surfaces X(N ), X1 (N ), X0 (N ).
However, the compactified curve may now have multiple cusps, depending on how{∞} ∪ Q decomposes into orbits. Knowing exactly how many cusps there are becomes critical for classifying torsion, because showing there is no rational n-torsion
for some n amounts to showing that on some modular curve, the only rational
points are the finitely many cusps which were added. Once we give our surfaces
the structure of algebraic curves, the question of which cusps are rational becomeseven more difficult, and depends on which algebraic curve model is used; for moredetails on this, see the discussion in [13].
It turns out that the orbits of the above subgroups correspond to information
about torsion on curves.
Proposition 7.14. Pick N ≥ 1.
(a) Points of Y0 (N ) correspond to pairs (E, G), where E is an elliptic curveand G ⊂ E is a cyclic subgroup of order N . Two such pairs (E, G), (E 0 , G0 )are identified when there is an isomorphism of E onto E 0 taking G to G0 .
(b) Points of Y1 (N ) correspond to pairs (E, P ), where E is an elliptic curveand P ∈ E is a point of exact order N . Two such pairs (E, P ), (E 0 , P 0 ) are
identified when there is an isomorphism of E onto E 0 taking P to P 0 .
6One usually requires the subgroup to be a congruence subgroup, or in other words to contain
Γ(N ) for some N . However, all subgroups we consider will satisfy this condition.

26

SPENCER DEMBNER(c) Points of Y (N ) correspond to triples (E, P, Q), where E is an elliptic curveand P, Q are two points which generate group E[N ] of N -torsion points.
Two triples (E, P, Q), (E 0 , P 0 , Q0 ) are identified when there is an isomorphism of E onto E 0 taking P to P 0 and Q to Q0 .
Now that we have added additional structure, issues around fields of definition
become even more subtle. For instance, it turns out that rational points of Y0 (N )need not correspond to actual rational torsion points: if a given cyclic subgroup
G ⊂ E is invariant under the Galois group, then G will be defined over Q even
if none of its nontrivial points are, and the point corresponding to (E, G) will be
rational. However, when studying the family of curves X1 (N ), we get lucky.
Theorem 7.15. Suppose N ≥ 4, and suppose (E, P ), (E 0 , P 0 ) are pairs corresponding to rational points on Y1 (N ). The two pairs correspond to the same point if, andonly if, there is an isomorphism f : E → E 0 defined over Q which sends P to P 0 .
Proof. This is a hard result. For a discussion, see [21], and for more details see
Chapter 7 of [3].

Thus, determining whether there are rational N -torsion points on elliptic curves
defined over Q is equivalent to determining whether the curve X1 (N ) has rational
points which are not cusps.
We are now in a position to say something about the statement of Theorem 1.1.
It’s not very hard to compute the genus of the modular curve X1 (N ) for various
N (for example, see Theorem 3.1.1 of [3]). Doing so, one finds that X1 (N ) has
genus 0 for 1 ≤ N ≤ 10 and N = 12, genus 1 for N = 11, 14, 15, and genus ≥ 2
for all other N . Observe that the genus 0 cases are exactly the possible torsion
orders, according to the statement of Mazur’s Theorem. This is not surprising:
every modular curve has at least one rational cusp, and every genus 0 curve witha rational point is isomorphic over Q to the projective line, so in particular every
such curve has infinitely many rational points.
In 1973, Andrew Ogg conjectured in [13] that these cases are the only possible cases — in other words, that there is a rational elliptic curve with a rational
N -torsion point if, and only if, X1 (N ) has genus 0. Barry Mazur proved thisconjecture, in two papers ([9],[7]) published in 1977 and 1978.
By a famous result known as Faltings’s Theorem, any curve defined over Q ofgenus at least 2 has only finitely many rational points. This immediately gives thefollowing step toward Mazur’s theorem.
Theorem 7.16. Suppose N ≥ 16. Then there are only finitely many isomorphismclasses of elliptic curves defined over Q with a rational N -torsion point.
However, this does not provide a uniform bound, and thus does not prove thefull theorem. In any case, Faltings’s Theorem was proved after Mazur’s Theorem,
and its proof is at least as difficult.
Example 7.17. As a special case of Mazur’s Theorem, consider the modular curveX1 (11). This is a compact Riemann surface, hence an algebraic curve. In fact, it isof genus one and has a a rational point, so X1 (11) is an elliptic curve over Q. One
possible Weierstrass equation for X1 (11) is:y 2 + y = x3 − x2

REFERENCES

27

This is an equation we’ve seen before: as discussed in Example 6.3, its group ofrational points is Z/5Z, of size 5. But one can check that the curve has 5 rational
cusps. Therefore, Y1 (11) contains no rational points, and we conclude that there
are no rational 11-torsion points on elliptic curves defined over Q.
For more details on this example from the perspective of modular curves, see thenotes [21]. This fact can also be proven much more directly, by using the definitionof addition on an elliptic curve and several changes of coordinates: see the classic
paper [1], where the result was first proven, or the discussion in [22].
One can carry out a similar analysis on the other cases where X1 (N ) is an elliptic
curve, and show that all rational points are cusps. Several other special cases werealready known before Mazur’s Theorem was proved: for example, see [8], which
deals with the case N = 13, and [6], which bounds pn -torsion for a fixed prime p.
Acknowledgments
Thanks to my mentor, Karl Schaefer, for answers to many, many questions, aswell as fascinating discussions about elliptic curves, number theory, and many otheradjacent areas of mathematics. Thanks to Matthew Emerton for a very enlightening
conversation about modular forms, and to Brian Lawrence for helpful answers tosome questions about line bundles. Thanks to Joseph Silverman, David Roberts,
and Chris Wuthrich for helpful answers to questions on MathOverflow. Finally,
thanks to Peter May for running a fantastic REU program.
References
[1]
[2]

[3]
[4]

[5]

[6]
[7]
[8]
[9]

[10]

Billing, G. and K. Mahler. “On exceptional points on cubic curves”. In: J.
London Math. Soc. 15 (1940), pp. 32–43.
Conrad, Keith. Ostrowski for number fields. url: https://kconrad.math.
uconn . edu / blurbs / gradnumthy / ostrowskinumbfield . pdf (visited on
08/19/2019).
Diamond, Fred and Jerry Shurman. A First Course in Modular Forms. SpringerVerlag, New York, 2005.
Fulton, William. Algebraic Curves. An introduction to algebraic geometry,
Notes written with the collaboration of Richard Weiss, Reprint of 1969 original. 2008. url: http://www.math.lsa.umich.edu/~wfulton/CurveBook.
pdf.
Griffiths, Phillip and Joseph Harris. Principles of Algebraic Geometry. Wiley
Classics Library. Reprint of the 1978 original. John Wiley & Sons, Inc., New
York, 1994.
Manin, Ju. I. “The p-torsion of elliptic curves is uniformly bounded”. In: Izv.
Akad. Nauk SSSR Ser. Mat. 33 (1969), pp. 459–465.
Mazur, B. “Rational isogenies of prime degree (with an appendix by D. Goldfeld)”. In: Invent. Math. 44.2 (1978), pp. 129–162.
Mazur, B. and J. Tate. “Points of order 13 on elliptic curves”. In: Invent.
Math. 22 (1973), pp. 41–49.
Mazur, Barry. “Modular curves and the Eisenstein ideal”. In: Inst. Hautes
Études Sci. Publ. Math. 47 (1977). With an appendix by Mazur and M.
Rapoport, 33–186 (1978). url: http://www.numdam.org/item?id=PMIHES_
1977__47__33_0.
Milne, J. S. Elliptic Curves. BookSurge Publishers, Charleston, SC, 2006.

28

[11]

[12]

[13]

[14]
[15]
[16]

[17]
[18]
[19]
[20]

[21]
[22]

REFERENCES

Mumford, David. Abelian Varieties. With appendices by C. P. Ramanujam
and Yuri Manin, Corrected reprint of the second (1974) edition. Tata Instituteof Fundamental Research, 2008.
Neukirch, Jürgen. Algebraic number theory. Translated from the 1992 German
original and with a note by Norbert Schappacher, With a foreword by G.
Harder. Springer-Verlag, Berlin, 1999.
Ogg, Andrew P. “Rational points on certain elliptic modular curves”. In: Analytic number theory (Proc. Sympos. Pure Math., Vol XXIV, St. Louis Univ.,
St. Louis, Mo., 1972). 1973, pp. 221–231.
Serre, Jean-Pierre. Local fields. Translated from the French by Marvin Jay
Greenberg. Springer-Verlag, New York-Berlin, 1979.
Silverman, Joseph H. Advanced Topics in the Arithmetic of Elliptic Curves.
Springer-Verlag, New York, 1994.
Silverman, Joseph H. The Arithmetic of Elliptic Curves. Second. Vol. 106.
Graduate Texts in Mathematics. Springer, Dordrecht, 2009. url: https ://doi.org/10.1007/978-0-387-09494-6.
Szamuely, Tamás. Galois groups and fundamental groups. Cambridge University Press, Cambridge, 2009.
The LMFDB Collaboration. The L-functions and Modular Forms Database.
http://www.lmfdb.org. Online; accessed 19 August 2019.
Various. Motivation for the proof of Hilbert’s Theorem 90. url: https://mathoverflow.net/q/73077/140821 (visited on 08/20/2019).
Washington, Lawrence C. “Galois cohomology”. In: Modular forms and Fermat’s last theorem (Boston, MA, 1995). Springer, New York, 1997, pp. 101–
120.
Weston, Tom. The modular curves X0 (11) and X1 (11). 1999. url: http://people.math.umass.edu/~weston/oldpapers/mc.ps (visited on 08/08/2019).
Woodbury, Michael Carter. Finite groups on elliptic curves. url: https://www.math.utah.edu/~woodbury/research/files/ellipticwriteup.pdf(visited on 08/21/2019).