Arithmetic and number theory

Arithmetic geometry

The study of solutions to polynomial equations using tools from algebraic geometry and number theory together.

IntuitionTwo lenses on the same points

Take a curve given by a polynomial equation, such as $y^2 = x^3 + ax + b$ . A geometer sees a shape: a smooth curve winding through the plane, with a well-defined tangent line at every point. A number theorist asks a much narrower question: which points on that shape have coordinates that are whole numbers or fractions — $E(\mathbb{Q})$ , the rational points? Arithmetic geometry is the discipline that refuses to separate the two questions. It uses the geometric shape (its genus, its symmetries, the way curves sit inside higher-dimensional spaces) to control the arithmetic: how many rational points there are, and how they are organized.

The cubic

y=(x-1)^3=x^3-3x^2+3x-1

: a single algebraic identity turns into a curve you can rotate, zoom and trace point by point.

SchoolFrom integer puzzles to shapes of curves

Long before the word geometry entered the picture, school mathematics already asks arithmetic-geometry questions in disguise: which right triangles have whole-number sides (Pythagorean triples), or which integers are the area of a right triangle with rational sides (the congruent number problem). Both questions turn out to be about counting rational points on a specific cubic curve. The leap that arithmetic geometry makes is to treat every polynomial equation this way: attach to it a geometric object (a curve, or a higher-dimensional variety), and read off arithmetic answers from geometric invariants like the genus — a whole number that measures, roughly, how many holes the curve's set of complex solutions has when drawn as a surface.

Definition: Rational points of an elliptic curve

An elliptic curve over $\mathbb{Q}$ is a smooth cubic curve given by a Weierstrass equation $y^2 = x^3 + ax + b$ with $a,b\in\mathbb{Q}$ , together with one extra point $O$ at infinity. Its set of rational points $E(\mathbb{Q})$ consists of $O$ plus every pair of rational numbers satisfying the equation. Remarkably, $E(\mathbb{Q})$ carries a natural abelian group structure: three points sum to $O$ exactly when they are collinear, with $O$ acting as the identity element.

y^2 = x^3 + ax + b

Here $x,y$ are the coordinates of a point on the curve, and $a,b\in\mathbb{Q}$ are fixed rational coefficients that determine which cubic curve is being studied, subject to the mild condition that $x^3+ax+b$ has no repeated root, which keeps the curve smooth.

E(\mathbb{Q}) \cong E(\mathbb{Q})_{\mathrm{tors}} \oplus \mathbb{Z}^r

This is the Mordell–Weil theorem: $E(\mathbb{Q}) \cong E(\mathbb{Q})_{\mathrm{tors}} \oplus \mathbb{Z}^r$ . It says the group of rational points, however it looks at first, is always built from a finite piece $E(\mathbb{Q})_{\mathrm{tors}}$ (the torsion subgroup, points of finite order) plus finitely many independent points of infinite order, whose count $r$ is called the rank.

How genus controls the size of the rational-point set
Genus	Typical equation	Rational points
$g=0$	a conic, e.g. $x^2+y^2=1$	either none, or infinitely many described by one rational parametrization
$g=1$	an elliptic curve, e.g. $y^2 = x^3 + ax + b$	a finitely generated group $E(\mathbb{Q})$ , possibly infinite but always described by finitely many generators
$g \ge 2$	a Fermat curve, e.g. $x^5 + y^5 = 1$	finite, $\|C(\mathbb{Q})\| < \infty$ (Faltings' theorem)

UndergraduateTwo theorems that shape the field

Theorem: Mordell–Weil theorem

For an elliptic curve $E$ over $\mathbb{Q}$ , the group $E(\mathbb{Q})$ is finitely generated: $E(\mathbb{Q}) \cong E(\mathbb{Q})_{\mathrm{tors}} \oplus \mathbb{Z}^r$ for some integer $r\ge 0$ , the rank of $E$ .

Why is it true?

Rational points could in principle accumulate in an arbitrarily complicated way; the theorem says the opposite happens — the whole infinite set, if infinite, is completely controlled by finitely many chosen points combined by the group law.

Proof

Step 1 (weak Mordell–Weil). First show the quotient group $E(\mathbb{Q})/2E(\mathbb{Q})$ is finite. For a point $P\in E(\mathbb{Q})$ that is not twice a rational point, Kummer theory attaches to $P$ a class in the Galois cohomology group $H^1(\mathrm{Gal}(\overline{\mathbb{Q}}/\mathbb{Q}), E[2])$ ; this class is unramified outside the finitely many primes dividing $2$ and the discriminant of $E$ . Hermite–Minkowski's finiteness theorem says there are only finitely many extensions of $\mathbb{Q}$ of bounded degree unramified outside a fixed finite set of primes, which forces the image of this map — and hence $E(\mathbb{Q})/2E(\mathbb{Q})$ — to be finite.

Step 2 (height functions). Define a height $h(P)$ on points by taking the logarithm of the largest numerator or denominator appearing in the $x$ -coordinate of $P$ (written in lowest terms). Two facts about $h$ drive the argument: it grows like $h(2P) = 4h(P) + O(1)$ under doubling, and for any bound $H$ there are only finitely many rational points with $h(P) \le H$ , since only finitely many fractions have numerator and denominator below a given size.

Step 3 (descent). Fix coset representatives $Q_1,\dots,Q_n$ for the finite group $E(\mathbb{Q})/2E(\mathbb{Q})$ found in Step 1. Given any $P\in E(\mathbb{Q})$ , some $Q_i$ satisfies $P - Q_i = 2P_1$ for a rational point $P_1$ , and the height estimates of Step 2 show $h(P_1) \le \tfrac14 h(P) + C$ for a constant $C$ depending only on $E$ . Repeating this — replace $P$ by $P_1$ , then $P_2$ , and so on — the height keeps shrinking by a factor close to $\tfrac14$ each time, so after finitely many steps it drops below the fixed bound $C'=\tfrac{4C}{3}$ . This expresses every $P$ as a combination of the finitely many $Q_i$ and a point of height at most $C'$ , of which there are only finitely many.

Step 4 (conclusion). Steps 1–3 show $E(\mathbb{Q})$ is generated by a finite set. A finitely generated abelian group is, by the structure theorem, a direct sum of a finite torsion part and a free part, giving exactly $E(\mathbb{Q}) \cong E(\mathbb{Q})_{\mathrm{tors}} \oplus \mathbb{Z}^r$ .

Theorem: Faltings' theorem (Mordell conjecture)

If $C$ is a smooth projective curve over $\mathbb{Q}$ of genus $g \ge 2$ , then $|C(\mathbb{Q})| < \infty$ : the curve has only finitely many rational points.

Why is it true?

Genus 0 curves can have infinite parametrized families of rational points, and genus 1 curves can have infinite but finitely-generated groups of them; genus $g \ge 2$ curves are geometrically rigid enough (they admit no non-constant maps from the projective line, and their universal cover is the hyperbolic disk) that rational points cannot accumulate.

Proof

Step 1 (from curves to abelian varieties). Attach to $C$ its Jacobian $J$ , an abelian variety of dimension $g$ that contains $C$ (via the Abel–Jacobi embedding, once one rational point is fixed). A rational point of $C$ corresponds to a rational point of $J$ , and Parshin's construction (1968) turns a hypothetical infinite sequence of distinct rational points on $C$ into infinitely many pairwise non-isomorphic abelian varieties of dimension $g$ defined over $\mathbb{Q}$ , all with good reduction outside one fixed finite set of primes $S$ that depends only on $C$ .

Step 2 (Shafarevich's finiteness conjecture). Shafarevich conjectured, for fixed $g$ and fixed finite $S$ , that only finitely many isomorphism classes of principally polarized abelian varieties of dimension $g$ over $\mathbb{Q}$ have good reduction outside $S$ . Faltings proves this using Arakelov theory: he constructs a height function on the moduli space of such abelian varieties (the Faltings height), shows this height changes in a controlled way under isogeny, and bounds it using the finiteness of number fields unramified outside $S$ together with estimates from the theory of heights and semistable reduction. Bounded height in a fixed-dimensional moduli space forces finiteness.

Step 3 (contradiction closes the argument). Step 1 produced infinitely many non-isomorphic abelian varieties under the false assumption that $C$ has infinitely many rational points; Step 2 shows that only finitely many such abelian varieties can exist. This contradiction is only avoided if the original assumption was wrong, so $C$ has only finitely many rational points: $|C(\mathbb{Q})| < \infty$ .

UndergraduateReal-World Applications and Worked Examples

The same chord-and-tangent group law that organizes rational points on $y^2 = x^3 + ax + b$ also works when the coordinates are reduced modulo a large prime $p$ . In that finite-field setting, adding a point to itself $k$ times ( $2P$ and higher multiples $kP$ ) is fast, while recovering $k$ from $P$ and $kP$ — the elliptic-curve discrete logarithm problem — is computationally infeasible for well-chosen curves. This asymmetry secures TLS handshakes across the web, SSH keys, and digital signatures in payment and blockchain systems. Closer to pure number theory, Hasse–Weil $L$ -functions $L(E,s)$ package the point counts of $E$ modulo every prime $p$ into a single analytic function; the Birch and Swinnerton-Dyer conjecture predicts $\operatorname{ord}_{s=1} L(E,s) = r$ , reading the global rank $r$ of rational points directly from the order of vanishing of $L(E,s)$ at $s=1$ .

Example: Integer points on the Mordell curve y² = x³ − 2

Find all integer solutions to the Mordell equation $y^2 = x^3 - 2$ .

Solution

Step 1 (factor in a quadratic ring). Rewrite $y^2 = x^3 - 2$ as $x^3 = y^2 + 2 = (y+\sqrt{-2})(y-\sqrt{-2})$ inside the ring $\mathbb{Z}[\sqrt{-2}]$ , which is a unique factorization domain (it has a Euclidean algorithm, just like the ordinary integers).

Step 2 (coprimality of the two factors). Any common divisor $\delta$ of $y+\sqrt{-2}$ and $y-\sqrt{-2}$ also divides their difference $2\sqrt{-2} = -(\sqrt{-2})^3$ . If $\sqrt{-2}$ divided both factors, then $2$ would divide $y^2+2 = x^3$ , forcing $x$ and hence $y$ to be even; but then $x^3$ is a multiple of $8$ while $y^2+2 \equiv 2 \pmod 4$ , impossible. Thus $y+\sqrt{-2}$ and $y-\sqrt{-2}$ are coprime in $\mathbb{Z}[\sqrt{-2}]$ .

Step 3 (each factor is a cube). Since their product is the cube $x^3$ and the units of $\mathbb{Z}[\sqrt{-2}]$ are $\pm 1$ (both already cubes), unique factorization forces $y+\sqrt{-2} = (u+v\sqrt{-2})^3$ for some integers $u,v$ . Expanding the cube gives $y+\sqrt{-2} = (u^3-6uv^2) + (3u^2v - 2v^3)\sqrt{-2}$ .

Step 4 (read off the integer solutions). Comparing coefficients of $\sqrt{-2}$ gives $1 = v(3u^2-2v^2)$ . Because $u,v$ are integers, $v = \pm 1$ ; only $v=1$ makes $3u^2-2 = 1$ solvable, giving $u = \pm 1$ . Substituting back yields $y = u^3 - 6uv^2 = \pm 5$ and $x = u^2+2v^2 = 3$ , so the only integer points on $y^2 = x^3 - 2$ are $(x,y) = (3, \pm 5)$ . (Notice that $E(\mathbb{Q})$ itself is still infinite here: repeatedly applying the chord-and-tangent law to $(3,5)$ produces infinitely many rational points with growing denominators, such as $(\tfrac{129}{100}, \pm\tfrac{383}{1000})$ .)

Example: Doubling a point in elliptic-curve cryptography

On the elliptic curve $y^2 = x^3 + 2x + 3 \pmod{97}$ , compute the doubled point $2P$ for $P = (3,6)$ .

Solution

Step 1 (check $P$ is on the curve and find the tangent slope). Substitute $P=(3,6)$ into $y^2 = x^3 + 2x + 3 \pmod{97}$ : the left side is $6^2 = 36$ , and the right side is $3^3 + 2\cdot 3 + 3 = 36$ , so $P$ lies on the curve. Implicit differentiation of $y^2 = x^3+ax+b$ gives the tangent slope at $P=(x_1,y_1)$ as $\lambda \equiv \frac{3x_1^2+a}{2y_1} \pmod{97}$ . With $a=2$ and $(x_1,y_1)=(3,6)$ , the numerator is $3\cdot 9 + 2 = 29$ and the denominator is $2\cdot 6 = 12$ .

Step 2 (invert the denominator modulo $97$ ). Because $12\cdot 8 = 96 \equiv -1 \pmod{97}$ , the modular inverse of $12$ modulo $97$ is $-8 \equiv 89 \pmod{97}$ . Thus $\lambda \equiv 29\cdot(-8) = -232 \equiv 59 \pmod{97}$ .

Step 3 (intersect the tangent with the curve and reflect). The chord-and-tangent formula gives the coordinates $(x_3,y_3)$ of $2P$ by $x_3 \equiv \lambda^2 - 2x_1 \pmod{97}$ and $y_3 \equiv \lambda(x_1 - x_3) - y_1 \pmod{97}$ . Computing: $x_3 \equiv 59^2 - 6 = 3475 = 35\cdot 97 + 80 \equiv 80 \pmod{97}$ , and $y_3 \equiv 59(3-80) - 6 = -4549 = -47\cdot 97 + 10 \equiv 10 \pmod{97}$ , so $2P = (80,10)$ .

Historical note

Fermat's method of infinite descent in the 1640s — showing, for example, that $y^2=x^4-1$ has no non-trivial rational solutions — was the ancestor of Step 3 of the Mordell–Weil proof. Poincaré (1901) noticed that $E(\mathbb{Q})$ forms a group and asked whether it is always finitely generated; Mordell proved this in 1922 for elliptic curves over $\mathbb{Q}$ , and Weil extended it in 1928 to abelian varieties over number fields. Starting in the late 1950s, Grothendieck rebuilt algebraic geometry around schemes, putting equations over $\mathbb{Q}$ and over finite fields $\mathbb{F}_p$ on a single geometric footing. That language made possible Faltings' 1983 proof of the Mordell conjecture ( $|C(\mathbb{Q})| < \infty$ for $g \ge 2$ ) and Wiles' 1995 proof of the modularity theorem for semistable elliptic curves, which settled Fermat's Last Theorem.

Pierre de Fermat Alexander Grothendieck Andrew Wiles

Research frontier as of 2026

As of 2026, two flagship problems organize much of current research. First, the Birch and Swinnerton-Dyer conjecture $\operatorname{ord}_{s=1} L(E,s) = r$ — one of the seven Clay Millennium Prize Problems — is proved in general only when $\operatorname{ord}_{s=1} L(E,s) \in \{0,1\}$ (by work of Gross–Zagier 1986 and Kolyvagin 1988, combined with modularity), while for higher vanishing order it remains open; on the statistical side, Bhargava and Shankar (2015) proved unconditionally that the average rank of elliptic curves over $\mathbb{Q}$ is strictly less than $1$ , and that a positive proportion satisfy BSD. Second, making Faltings' theorem effective — turning the abstract finiteness $|C(\mathbb{Q})| < \infty$ for $g \ge 2$ into an actual list of rational points — is driven by the Chabauty–Coleman method and Kim's non-abelian Chabauty program; the quadratic Chabauty method of Balakrishnan, Dogra, Müller, Tuitman and Vonk (2019) famously determined all rational points on the cursed modular curve $X_s(13)$ of genus $3$ . It is also still open whether the rank $r$ of elliptic curves over $\mathbb{Q}$ is bounded (the largest known exact rank is $r=20$ , with a curve of rank at least $28$ found by Elkies in 2006).

In the Mordell–Weil theorem $E(\mathbb{Q}) \cong E(\mathbb{Q})_{\mathrm{tors}} \oplus \mathbb{Z}^r$ , what does the integer $r$ represent?

Elliptic-curve cryptography, used in TLS and blockchain signatures, relies on which structure studied in arithmetic geometry?

By Faltings' theorem, a smooth projective curve $C/\mathbb{Q}$ of genus $g \ge 2$ has:

The Birch and Swinnerton-Dyer conjecture predicts that the rank $r$ of $E(\mathbb{Q})$ equals:

References

Joseph H. Silverman (2009). The Arithmetic of Elliptic Curves
Gerd Faltings (1983). Endlichkeitssätze für abelsche Varietäten über Zahlkörpern · DOI:10.1007/BF01388432
Marc Hindry, Joseph H. Silverman (2000). Diophantine Geometry: An Introduction
Manjul Bhargava, Christopher Skinner, Wei Zhang (2014). A majority of elliptic curves over Q satisfy the Birch and Swinnerton-Dyer conjecture · arXiv:1407.1826 [preprint, not peer-reviewed]