# Group Law for an Elliptic curve

I was reading this book "Rational points on Elliptic curves" by J.Silverman, and J.Tate, 2 prominent figures in Number theory and was very intrigued after reading the first couple of pages.

The connection between Algebra and Geometry is displayed in a professional manner in that book. One can generally ask this question:

It's clear that the Mathematicians had to develop some laws in order to make the points on an Elliptic curve to a group. The first axioms of adding 2 points on an elliptic curve is clear. But i would like to know how does one come up with the mechanism of the remaining axioms(like associativity) which are actually intricate in nature. What is the motivation behind it. Can we define an axiom in an other way so that the point on the elliptic curve still forms a group? Also why to define the group axioms only on for this type of curves.

A very much related question was asked in MO link: https://mathoverflow.net/questions/6870/why-is-an-elliptic-curve-a-group but i actually expect more about the mechanism of the intricate axioms.

• At MO there were eight detailed answers, by some excellent mathematicians (and me) but you still want more .... sigh! – Robin Chapman Sep 21 '10 at 19:09
• @Qiacho Yuan: Also it's worth discussing these things in a more elementary manner! So that other enjoy the true beauty of Mathematics. – anonymous Sep 21 '10 at 19:21
• It's a bit sad how "what is a four sided shape called" has more upvotes than this.. – anon Sep 22 '10 at 11:22
• @muad: This phenomenon is known as the bikeshed problem, and the most constructive way to change it is to share this question (and others you think deserve more love) with people who might be interested in it. – Larry Wang Sep 25 '10 at 18:20
• @muad: IIRC Moron gave a link to a meta.stackoverflow thread discussing the bikeshed problem Kaestur speaks of; you might want to search for it. As I said then, "there is no justice in this world". ;) – J. M. is a poor mathematician Sep 26 '10 at 12:05

The group law on an elliptic curve was not discovered in a vacuum. It came up in the context of abelian integrals.

Let $y^2 = f(x)$, where $f(x)$ is a cubic in $x$ be an elliptic curve; call it $E$.

Elliptic integrals are integrals of the form $$\int_{a}^x dx/y = \int_a^x \frac{d x}{\sqrt{ f(x)}}.$$ (Here $a$ is some fixed base-point.) They come up (in a slightly transformed manner) when computing the arclength of an ellipse (whence their name).

If was realized at some point (in the 1600s or 1700s) (at least in special cases) that if you apply certain substitutions to $x$, you can double the value of the integral, or that if you apply certain substitusions of the form $x = \phi(x_1,x_2)$, the integral you compute is the sum of the individual integrals for $x_1$ and $x_2$.

Real understanding came from the work of Abel and Jacobi. (Unfortunately I don't know the precise history or attributions here.)

What they realized (in modern terms) is that, if we fix the base-point $a$ and let $b$ vary, then the elliptic integral is giving a multivalued map from the elliptic curve $E$ to $\mathbb C$, and that the formula $\phi(x_1,x_2)$ mentioned above shows us a way to add points on the elliptic curve, so that this map is a (multi-valued) group homomorphism.

Taking the inverse of this multi-valued map gives a single-valued map (which is how we are more used to thinking about it) $$\mathbb C \to E,$$ which is a homomorphism when we give $\mathbb C$ its addivite structure and $E$ the group law coming from $(x_1,x_2)\mapsto \phi(x_1,x_2)$. The kernel of this map turns out to be a lattice $\Lambda$, so that we get an isomorphism $\mathbb C/\Lambda \cong E.$

The formula $\phi(x_1,x_2)$ turns out to be precisely the formula describing addition on the elliptic curve via chords and tangents, and there are lots of theoretical explanations for it, as you can find on the linked MO page.

For a higher genus curve $C$, it turns out that there is not just the one holomorphic differential $dx/y$, but $g$ linearly independent such (if the curve has genus $g$), say $\omega_1, \ldots,\omega_g$. Furthermore, if we fix a particular differential $\omega_i$, then there is no formula $\phi(x_1,x_2)$ such that the sum of the integrals of $\omega$ for $x_1$ and $x_2$ is equal to the integral of $\omega$ for $\phi(x_1,x_2)$.

However, what Abel and Jacobi found is that, if we consider the map $$(x_1,\ldots,x_g) \mapsto (\sum_{i = 1}^g \int_a^{x_i} \omega_1, \ldots,\sum_{i = 1}^g \int_a^{x_i} \omega_g),$$ which gives a multi-valued map $$Sym^g C \to \mathbb C^g$$ (here $Sym^g C$ denotes the $g$th symmetric power of $C$, so it is the product of $g$ copies of $C$, modulo the action of the symmetric group on the $g$ factors), then we can find a formula $\phi(x_{1,1},\ldots,x_{1,g},x_{2,1},\ldots,x_{2,g})$ such that $\phi$ defines a group law on $Sym^g C$ (at least generically) and such that this map is a homomorphism.

Again, this map becomes well-defined and (generically) single valued if we quotient out the target by an appropriate lattice $\Lambda$ (the period lattice), to get a birational map $$Sym^g C \to \mathbb C^g /\Lambda.$$

The target here is called the Jacobian of $C$, and can be identified with $Pic^0(C)$.

In summary, to generalize the addition law on an elliptic curve to higher genus curves, you have to consider unordererd $g$-tuples of points (where $g$ is the genus), and add those (not just individual points).

(The relationship with $Pic^0(C)$ is that if $x_1,\ldots,x_g$ are $g$ points on $C$, then $x_1 + \ldots + x_g - g a$ is a degree zero divisor on $C$, and every degree zero divisor is linearly equivalent to a divisor of this form, and, generically, to a unique such divisor.)

I agree that from the chord-and-tangent definition of the group law it is far from clear why associativity should hold. This definition is the one presented in Silverman and Tate because all the other ways you might define the group law require much more background; however, these are the definitions from which associativity makes more sense.

In one approach an elliptic curve is a group of the form $\mathbb{C}/\Lambda$ where $\Lambda$ is a lattice, e.g. a discrete subgroup of $\mathbb{C}$ isomorphic to $\mathbb{Z}^2$. (The motivation for looking at such quotients comes basically from the uniformization theorem). Such a quotient forms a compact Riemann surface, topologically a torus, hence it admits no nonconstant holomorphic functions; therefore we would like to describe the meromorphic functions. A natural way to do this is to write down a function and then try to average over $\Lambda$, which (if you do it right) will lead you to the definition of the Weierstrass elliptic function $\wp(z)$. By examining its poles and the poles of its derivative $\wp'(z)$ we can deduce the differential equation

$$\wp'(z)^2 = 4 \wp(z)^3 - g_2 \wp(z) - g_3$$

where $g_2, g_3$ are certain constants associated to $\Lambda$. In fact the map from $\mathbb{C}/\Lambda$ to the elliptic curve $y^2 = 4x^3 - g_2 x - g_3$ given by $z \mapsto (\wp(z), \wp'(z))$ is an isomorphism. This forms the connection between the complex-analytic picture and the algebraic picture in terms of Weierstrass normal forms. The group law here is just regular addition, e.g. the sum of the points $(\wp(a), \wp'(a))$ and $(\wp(b), \wp'(b))$ is just $(\wp(a+b), \wp'(a+b))$, and so it is obvious that associativity holds. The fact that if $a + b + c = 0$ then the corresponding points are collinear is then a relatively simple computation.

(Historically, this is not how the first group laws on elliptic curves were discovered. For the elliptic-function perspective I recommend Stevenhagen's notes on the subject.)

In another approach an elliptic curve (over $\mathbb{C}$, for simplicity) is a smooth projective curve of genus $1$. The category of smooth projective curves over $\mathbb{C}$ is known to be equivalent to the category of compact Riemann surfaces, which is part of the connection between this definition and the above definition. To any smooth projective curve $C$ one can associate its Jacobian variety, which is a group of the form $\mathbb{C}^g/\Lambda$ where $g$ is the genus which naturally occurs when one thinks about integration over such a curve. The Abel-Jacobi theorem asserts that the Jacobian variety of a curve is isomorphic to its Picard group (the group of divisors modulo principal divisors), and the points of the Picard group of a curve of genus $1$ can be put into natural bijection with the curve itself (once one chooses an identity), so the group law on the Jacobian variety (which is perfectly natural) then gives a group law on the original curve (again once one chooses an identity). The connection to collinear points comes from the fact that lines determine principal divisors, which are zero in the Picard group.

As for your last question, elliptic curves are, as it turns out, the only projective curves which can be given the structure of algebraic groups; see the Wikipedia article on abelian varieties.

This is a failed attempt at constructing the group law with associativity built in, It is still interesting to consider though - I will explain why at the end.

Every line intersects 3 points on an elliptic curve, call them $P,Q,R$.

We can pick some designated point $\mathcal O$ as the identity on the curve and then set the ternary relation $P+Q+R = \mathcal O$ to hold for all triples which lie on a line (N.B. I could just write this $C(P,Q,R)$ but I use the suggestive notation of $+$ and $=$ instead).

Inspired by the group axioms we have $P + \mathcal O + -P = \mathcal O$, so we know how to compute the inverse of a point.

Given any two points $P,Q$ we could also find a third $Q$ easily, so that $P + Q + R = \mathcal O$. We can now define the binary operation of addition as $P + Q = -R$.

Now it is possible to reduce the proof of associativity of the group law to a purely combinatoric statement.

• $(P + Q) + R$ means that $P + Q + -PQ = \mathcal O$ and $PQ + R + -PQR = \mathcal O$

• $P + (Q + R)$ means that $Q + R + -QR = \mathcal O$ and $P + QR + -PQR' = \mathcal O$

(and also the extra relations between positive and negative terms)

These relations define an incidence structure:

{(P,Q,-PQ),(PQ,O,-PQ),(PQ,R,-PQR),(PQR,O,-PQR),(Q,R,-QR),(QR,O,-QR),(P,QR,-PQR'),(PQR',O,-PQR')}

Now for the interesting bit! We would hope that a Fano plane style situation would force PQR to be equal to PQR' but it doesn't happen. So we didn't get any proof out of this, but we do get a sense of the difficulty of this associativity problem: There is something special about the shape of the elliptic curve which forces these points to be equal. That implies that any proof or construction of this group law must use the geometric properties of the curve in an essential way.

• The statement P + Q + R = 0 doesn't make sense without parentheses until you've proven associativity. – Qiaochu Yuan Sep 21 '10 at 20:43
• Yes, as you probably know, the key point is that two cubic equations passing through 8 common points (in general position) necessarily pass through a uniquely determined 9th points (uniquely determined by the first 8 points). This is the geometric fact about plane cubics that underlies associativity. The fact that $9 - 8 = 1$ reflects the fact that elliptic curves have genus one; see my post here: math.stackexchange.com/questions/1609/… – Matt E Sep 21 '10 at 20:46
• Qiaochu Yuan, it is purely a formal notation - replace P+Q+R=O with C(P,Q,R) throughout if you like. – anon Sep 21 '10 at 20:47