Elliptic curves

A point $(x_0, 0)$ where the cubic has a repeated root is exactly where the curve pinches into a cusp or crosses itself, because the tangent direction becomes undefined there — precisely the geometric flaw that would break the chord-and-tangent group law.

The point $(x_0,y_0)$ is singular iff $F=y^2-x^3-ax-b=0$, $\partial F/\partial y = 2y_0 = 0$, and $\partial F/\partial x = -3x_0^2-a=0$ all hold. The second equation forces $y_0=0$, so $x_0$ must be a root of $x^3+ax+b$; the third equation forces $3x_0^2+a=0$, i.e. $x_0$ is also a root of the derivative $3x^2+a$. A polynomial and its derivative share a common root exactly at a repeated root of the polynomial, so $E$ is singular iff $x^3+ax+b$ has a repeated root. The classical discriminant of the depressed cubic $x^3+ax+b$ is $-4a^3-27b^2$, which vanishes exactly when the cubic has a repeated root; multiplying by the normalization constant $-16$ gives $\Delta = -16(4a^3+27b^2)$, so $E$ is nonsingular iff $\Delta \neq 0$.

The quantity $a_p := p+1-\#E(\mathbb{F}_p)$ measures the 'error term' of the naive guess that a random cubic should have about $p$ solutions plus the point at infinity; Hasse's bound says this error can never be more than about $2\sqrt{p}$, an astonishingly small deviation compared to the trivial bound of size $p$, and it is what makes $\#E(\mathbb{F}_p)$ usable as a reliable, predictable group order in cryptographic constructions.

Consider the Frobenius endomorphism $\varphi: E(\overline{\mathbb{F}_p}) \to E(\overline{\mathbb{F}_p})$, $\varphi(x,y) = (x^p, y^p)$. Its fixed points are exactly $E(\mathbb{F}_p)$, and one shows $\#E(\mathbb{F}_p) = \deg(\varphi - 1) = p+1-t$ where $t = \varphi + \hat\varphi$ is the trace of Frobenius acting on the endomorphism ring. The degree map on endomorphisms of $E$ is a positive-definite integer-valued quadratic form (it satisfies $\deg(m\varphi+n) \ge 0$ for all integers $m,n$, with equality only when $m\varphi+n=0$), and $\deg\varphi = p$. Expanding $\deg(m\varphi+n) = m^2 p + mnt + n^2 \ge 0$ as a quadratic form in $m,n$ forces its discriminant to be non-positive: $t^2 - 4p \le 0$, i.e. $|t|\le 2\sqrt p$. Since $\#E(\mathbb{F}_p) - (p+1) = -t$, this is exactly the claimed bound.

This theorem is the arithmetic payoff of the group law: it says that however intricate the set of rational points looks, it is always controlled by finitely many 'seed' points — a finite generating set — from which every other rational point is reached by repeated chord-and-tangent addition.

The proof combines two ingredients. Weak Mordell–Weil: one shows $E(\mathbb{Q})/2E(\mathbb{Q})$ is a finite group, by embedding it (via Galois cohomology, using the $2$-descent map $P \mapsto (x(P)-e_1, x(P)-e_2, x(P)-e_3)$ for the roots $e_i$ of the cubic) into a group built from the class group and unit group of a related number field, both of which are known to be finite. Height descent: one attaches to each point a canonical height $\hat h(P) \ge 0$, a real-valued measure of arithmetic complexity satisfying $\hat h(2P) = 4\hat h(P)$ and for which only finitely many points have height below any given bound. Combining a finite set of coset representatives for $E(\mathbb{Q})/2E(\mathbb{Q})$ with the fact that repeatedly halving the height of any point (via the parallelogram law for heights) eventually lands in a bounded-height region shows every point is a $\mathbb{Z}$-combination of the finitely many representatives and finitely many bounded-height points — hence $E(\mathbb{Q})$ is finitely generated.

This is a striking rigidity statement: among infinitely many abstractly possible finite abelian groups, only these $15$ ever occur as the torsion of a rational elliptic curve — a torsion subgroup of order, say, $11$ or $16$ is simply impossible.

Mazur's 1977 proof translates the existence of a rational point of exact order $N$ on $E$ into the existence of a non-cuspidal rational point on the modular curve $X_1(N)$, which classifies pairs $(E, P)$ with $P$ of order $N$. The strategy studies the Jacobian $J_0(N)$ of the related modular curve $X_0(N)$ and the Eisenstein ideal $\mathcal{I}$ — the ideal in the Hecke algebra generated by $T_\ell - \ell - 1$ for primes $\ell \nmid N$ — acting on it. By analyzing the Eisenstein quotient of $J_0(N)$ and its reduction modulo auxiliary primes, Mazur shows that for $N$ outside the allowed list, $X_1(N)(\mathbb{Q})$ consists only of cusps, so no elliptic curve over $\mathbb{Q}$ can have a rational point of that exact order; explicit constructions (for instance using the curves $y^2=x^3+ax$ and $y^2=x^3+b$) exhibit examples realizing each of the $15$ permitted groups.

Modularity turns every elliptic curve into a modular form in disguise, transferring the powerful analytic machinery available for modular forms (analytic continuation, functional equations) to elliptic curves, and — crucially for Fermat's Last Theorem — it means a curve that cannot be modular cannot exist.

Wiles proved modularity for semistable elliptic curves over $\mathbb{Q}$ in 1994–95 (with the final step, a numerical criterion for isomorphism between deformation rings and Hecke algebras — the '$R=T$ theorem' — established jointly with Richard Taylor). The strategy shows that the Galois representation on the $\ell$-adic Tate module of $E$, and the corresponding representation attached to a candidate modular form, live in the same deformation space; proving the deformation ring $R$ and the Hecke algebra $T$ acting on modular forms coincide forces every allowed Galois representation — in particular $E$'s — to come from a modular form. Since every semistable curve suffices to rule out a counterexample to Fermat's equation (any solution $a^n+b^n=c^n$ would yield a semistable Frey curve $y^2=x(x-a^n)(x+b^n)$ that Kenneth Ribet had shown, via his 1990 proof of $\varepsilon$-conjecture, cannot be modular), this proved Fermat's Last Theorem. The semistability restriction was later removed entirely, extending modularity to all elliptic curves over $\mathbb{Q}$, by Christophe Breuil, Brian Conrad, Fred Diamond, and Richard Taylor in 2001.