# Why is an elliptic curve a group?

Consider an elliptic curve $y^2=x^3+ax+b$. It is well known that we can (in the generic case) create an addition on this curve turning it into an abelian group: The group law is characterized by the neutral element being the point at infinity and the fact that $w_1+w_2+w_3=0$ if and only if the three points $w_j$ are the intersections (with multiplicity) of a line and the elliptic curve.

Groups can be hard to work with, but in most cases proving that the group is in fact a group is easy. The elliptic curve is an obvious exception. Commutativity is easy, but associativity is hard, at least to this non-algebraist: The proof looks like a big calculation, and the associativity seems like an algebraic accident rather than something that ought to be true.

So this is my question, then: Why is the group law on an elliptic curve associative? Is there some good reason for it? Is the group perhaps a subgroup or a quotient of some other group that is easier to understand? Or can it be constructed from other groups in some fashion?

I gather that historically, the group law was discovered via the addition law for the Weierstrass $\wp$-function. The addition law is itself not totally obviuos, plus this approach seems limited to the case where the base field is $\mathbb{C}$. In any case, I'll elaborate a bit on this shortly, in a (community wiki) answer.

-
To be fair, the main reason "proving a group is a group is easy" is that the vast majority of groups people work with are defined by functions/morphisms/whatever, so you get associativity for free. Get away from that (or, I guess, from generators and relations, where you also get associativity for free) and demonstrating associativity is usually tedious at best. – Harrison Brown Nov 26 '09 at 7:33
"plus this approach seems limited to the case where the base field is $\mathbb{C}$" Actually, you should be able to prove the general case from the complex case, using the Lefschetz principle. – David Corwin Sep 1 '10 at 0:45
Interesting thought. But the Lefschetz principle only applies to fields of characteristic zero, right? – Harald Hanche-Olsen Sep 1 '10 at 7:20
From a purely geometric point of view, the associativity of the group law is a consequence of the Cayley-Bacharach theorem: en.wikipedia.org/wiki/Cayley%E2%80%93Bacharach_theorem terrytao.wordpress.com/2011/07/15/… – Terry Tao Jun 5 '14 at 16:37

Everything I am writing below is carried out explicitly in Chapter III of Silverman's book on elliptic curves. In the earlier chapters, he defines the Picard group.

For any curve over any field, algebraic geometers are interested in an associated group called the Picard group. It is a certain quotient of the free abelian group on points of the curve. It consists of formal sums of points on the curve modulo those formal sums that come from looking at the zeroes and poles of rational functions. It is a very important tool in the study of algebraic curves.

The very special thing about elliptic curves, as opposed to other curves, is that they turn out to be in natural set-theoretic bijection with their own Picard groups (or actually, the subgroup $Pic^0(E)$). The bijection is as follows: let O be the point at infinity. Then send a point P on the elliptic curve to the formal sum of points [P] - [O]. (It is not obvious that this is a bijection, but the work to prove it is all "pure geometric reasoning" with no computations.) So there is automatically a group law on the points of E. Then it requires no messy formulas to show that under this group law, the sum of three collinear points is O. So for free, you also get that this group law is the same as the one you defined in the question and that the one you defined is associative!

-
Hmm. I still have some work to do in order to get to the bottom of this, but now I know where to look. Thanks! – Harald Hanche-Olsen Nov 26 '09 at 18:26
Quick comment: the Picard group is defined as the quotient of the free abelian group on points by the subgroup of principal divisors, i.e. those coming from writing out the poles and zeroes of an element of the function field. The reason the Picard group has anything to do with drawing lines is that the equation of a line automatically determines an element of the function field whose associated divisor is principal (by definition), so every line determines a relation in the Picard group. – Qiaochu Yuan Jan 8 '10 at 22:13

A proof I like is that the group of points on the curve is the classgroup of the ring $R=k[x,\sqrt{x^3+Ax+B}]$ where $k$ is the field you're working over. Set $y=\sqrt{x^3+Ax+B}\in R$ and let $K$ denote the field of fractions of $R$. Define ideals $I_P$ of $R$ for each point $P$ on the curve as follows. For $P=O$, the point at infinity, set $I_O=R$. For $P=(u,v)$ let $I_{P}=\langle x-u,y-v \rangle$. There's an equivalence relation $\sim$ on the nonzero ideals of $R$ defined by $I\sim J$ if $J= \alpha I$ where $\alpha\in K^*$. The equivalence classes of ideals form a monoid via $[I][J]=[IJ]$, which I'll call the class monoid of $R$.

Then you can prove by explicit calculation that

1. For points $P$ and $Q$ on the curve, if $T=P+Q$ then $[I_P][I_Q]=[I_T]$.

2. For points $P$ and $Q$ on the curve, $[I_p]=[I_Q]$ if and only if $P=Q$.

From this it's apparent that the group operation on the curve is associative, and that the set of classes of the form $[I_P]$ form a subgroup of the class monoid of $R$, isomorphic to the group of the elliptic curve. With a bit more effort you can show that every element of the class monoid has the form $[I_P]$ and that $R$ is a Dedekind domain.

(I should say that this argument is a simple-minded variant of the Picard group proof as expounded earlier by Hunter.)

-

This was too long for a comment.

To elaborate on Hunter's response, there is something you can associate to any curve called its Jacobian variety, whose points can be identified with degree 0 line bundles (these can be identified with formal linear combinations of closed points on the curve whose sum of coefficients is 0, modulo a certain equivalence relation). There is a group operation on the Jacobian variety given by tensoring line bundles (or adding linear combinations), and its dimension is the genus of the curve. Since elliptic curves are genus 1 curves, one might hope that the Jacobian variety is isomorphic to the elliptic curve, and indeed this is the case. So this sort of gives a reason why a group law exists on the elliptic curve.

The catch is that there isn't a canonical isomorphism from an elliptic curve to its Jacobian variety. There is a way to specify an isomorphism once you single out a closed point on the elliptic curve (this is like picking an identity element). So elliptic curves don't really have a group law, it's elliptic curves with a choice of a rational point which do.

(I learned this stuff from Chapter IV of Hartshorne's Algebraic Geometry)

-
An elliptic curve is generally defined to be a genus one curve equipped with a distinguished point, rather than a plain genus one curve. – S. Carnahan Nov 28 '09 at 1:28
To elaborate: an elliptic curve over a scheme S is a scheme E, a morphism f: E -> S, and a morphism g: S -> E, such that fg is the identity on S, and the geometric fibers of f are genus one curves. The canonical embedding of an elliptic curve into its Jacobian is an isomorphism. This is one of several places where Hartshorne disagrees with the rest of the universe. – S. Carnahan Nov 28 '09 at 1:44

Short answer: because it's a complex torus. Explanation below would take as through many topics.

### Topological covers

The curve should be considered over complex numbers, where it can be seen as a Riemann surface, therefore a two-dimensional oriented closed variety. How to find out whether this particular one is a sphere, torus or something else? Just consider a two-fold covering onto $x$-axis and count the Euler characteristics as $-2 \cdot 2 + 4 = 0$ (don't forget the point at infinity.)

### Complex tori

So this is a torus; now a torus with complex structure can be always defined as a quotient $\mathbb C/\Lambda$, where $\Lambda$ is the lattice of periods. It can be written as integrals $\int_\gamma \omega$ of any differential form $\omega$ over all elements $\gamma \in \pi_1$. The choice of differential form is unique up to $\lambda \in \mathbb C$.

A complex map of a torus into itself that leaves lattice $\Lambda$ fixed can be only given by a shift. Once you select a base point, these shifts are in one-to-one correspondence with points of $E$. We have unique distinguished point — infinity — so let's choose it as the base point. It follows that we now have an addition map $(u, v) \to u\oplus v$, though defined purely algebraically so far.

### Geometric meaning

Now let's stop and ask ourselves: how to see this addition geometrically? For a start, consider map that sends $u$ to the third point of intersection with the line containing both $u$ and 0 (the infinity point). It's not hard to see that we fix 0 but change every class $\gamma$ in a fundamental group into $-\gamma$, so we must have the map $u\mapsto -u$ here.

### Group theory laws

What would happen if you took a line through $u$ and $v$? By temporarily changing coordinates so that $u$ becomes the infinity point, one writes down that map as $(u, v) \mapsto -(u+v)$. Now if you took three points, there would be two different ways to add them; those would lead to $(u+v)+w$ and $u+(v+w)$ as complex numbers, which we know to be associative.

### Logically proven

In the above, we worked over complex numbers, but we proved associativity which is a formal theorem about substitution of some rational expressions into others. Since it works over complex fields, it is required to work over all fields.

(In any case, the big discovery of mid-20th century was that you actually can take all of the intuition described above and apply it to the case of elliptic curves over arbitrary field)

### Analytic computations (bonus)

Consider a line that passes through points $u$, $0$ and $-u$. This line is actually vertical, and $y$ is a well-defined function there which has two zeroes and one double pole at infinity. After a shift and multiplication of several such functions we'll be getting a meromorphic function on a complex torus with poles $p_i$ and zeroes $z_i$ having the property $\sum p_i = \sum z_i$. This method can give all such functions and only them; it's not hard to see that only meromorphic functions with this property are allowed on elliptic curve.

For example, $\wp'$-functions are the ones that have triple pole at 0 and single zeroes at points $\frac12w_1, \frac12w_2, \frac12(w_1+ w_2)$ where $w_1, w_2$ are generators of $\Lambda$.

### Jacobian of a curve (bonus 2)

The formula above describes what types of functions are allowed on our curve. It is a good idea to organize this information into a curve: in this case, the information is that a single expression $p_1 + p_2 + \cdots + p_n - z_1 - \cdots - z_n$, considered a point of the curve, must vanish. For curves of higher genus, more relations are necessary; for $\mathbb C\mathbb P^1$, no relations beyond number of poles = number of zeroes are necessary. Those are relations in the group of classes of divisors (= Jacobian of a curve) mentioned in other answers.

In particular, elliptic curves coincide with their Jacobian and that's another explanation for the additive law.

-
You missed the whole central idea which the the deepest: The Riemann-Roch theorem gives the group law. – Anweshi Jan 8 '10 at 22:30
Well, if you are sure that the poster is familiar with elliptic curves, line bundles and sheaf cohomology (which I doubt), then, yes, Riemann-Roch theorem would give the group law. But why exactly this is more profound than curve being a complex torus? – Ilya Nikokoshev Jan 8 '10 at 22:46
Riemann-Roch would tell you why there is a group law precisely on curves of genus 1. Also, Riemann-Roch is obvious more profound than just looking at a torus or Weierstrass elliptic functions on the complex plane. – Anweshi Jan 8 '10 at 23:20
Not to mention that Riemann-Roch would give the group law over any field/ring/scheme. You have done some handwaving with the the Lefschetz principle for transporting to over other fields. This is not quite enough. Riemann-Roch is much neater. – Anweshi Jan 8 '10 at 23:22
Also I have referred to the simpler books of Miranda and Narasimhan, with the questioner in mind. These books use only complex analysis of one variable, and the definition of genus from topology. – Anweshi Jan 8 '10 at 23:52

Consider an additive subgroup $\Lambda$ of $\mathbb{C}$ so that $\mathbb{C}/\Lambda$ is compact (indeed, a torus). The corresponding Weierstrass $\wp$-function satisfies the ODE $\wp'(z)^2=4\wp(z)^3-g_2z-g_3$, and so if we write $x=\wp(z)$ and $y=\wp'(z)$ then $(x,y)$ lies on the elliptic curve $y^2=4z^3-g_2z-g_3$ (indeed, this parametrizes the entire curve). Addition in $\mathbb{C}/\Lambda$ is well defined, of course, and the addition theorem states that if $z_1+z_2+z_3=0$ then the corresponding $(x_j,y_j)$ satisfy $$\begin{vmatrix}x_1&y_1&1\\\\x_2&y_2&1\\\\x_3&y_3&1\end{vmatrix}=0,$$ i.e., the three points $(x_j,y_j)$ lie on a line. Thus the map $z\mapsto(x,y)$ maps the usual addition on $\mathbb{C}/\Lambda$ to the elliptic curve addition on the curve.

-
this is all very nice and cute in the complex number field. But what is amazing is why an elliptic curve over some arbitrary field is a group. Which makes me wonder, how did mathematicians realized elliptic curve is a group, I believe they suspected that way before the weierstrass p-function was used to consider e.c. over the complex. Like the last poster suggested, I think it all started with the picard groups. Though, I think its easier to defined e.c. over the complex fields to a beginner on the subject. – Jose Capco Nov 26 '09 at 9:04
Elliptic functions were originally introduced as the inverse functions to certain integrals, by the same procedure with which you can construct the exponential and trigonometric functions. Everybody knew that these functions have addition laws, so it is quite natural to expect ellitic functions also have one. – Mariano Suárez-Alvarez Nov 26 '09 at 12:12
The point is that the group law you get from the Weierstrass function can be written in terms of rational functions. This is an obvious conjecture to make if you think of elliptic functions as analogous to trigonometric functions, and it's also natural to think of the function field of C/Lambda as one-dimensional, so p(nz) should lie in C(p(z), p'(z)) for all n. Once you get rational functions of course the extension to all fields is clear. – Qiaochu Yuan Jan 8 '10 at 22:05
I meant to say this, but I forgot to: it certainly did not start with the Picard groups. Euler and Gauss both wrote down group laws for specific curves before anyone had written down elliptic functions. – Qiaochu Yuan Jan 8 '10 at 22:44

A few days ago in my algebraic geometry class we saw a pretty nice "geometric" argument for why the group law is associative. Unfortunately I'm at home for the Thanksgiving break and don't have access to my notes, but as best as I can remember it went like this:

Start with three points P, Q, R, plus the distinguished point 0 that's the identity; we want to show (P+Q)+R = P+(Q+R). Denote by (P#Q) the third point of your curve collinear with P, Q. Basically we start drawing lines everywhere; we end up with I think a total of 10 points, which are:

0, P, Q, R, (P#Q), (Q#R), P+Q, Q+R, (P+Q)#R, P#(Q+R).

Of course secretly those are just 9 points, but that's what we're trying to prove...

Now it turns out that I think 9 of these points -- all but P#(Q+R) -- lie on the union of 3 lines. Same construction, all but (P+Q)#R lie on the union of 3 different lines. Using either Bezout's theorem or a slightly stronger generalization thereof, we can show that the 9th point of intersection of these two plane cubics is in fact P#(Q+R) or (P+Q)#R, so they're the same.

There's probably at least one place where I horribly misremembered the argument, though -- if you happen to know what it is, let me know and I'll happily fix it.

-
This is exactly the proof in Silverman & Tate's book chapter 1. I guess this is not what OP's asking for though. – Ho Chung Siu Nov 26 '09 at 9:15
I'm not entirely clear on what exactly is being asked for. IIRC, there's a purely algebraic version of the argument that works for I think any algebraically closed field, although (hopefully!) this shouldn't be all that obvious. – Harrison Brown Nov 26 '09 at 18:02
Well my guess is that OP looks for a conceptual reason for there to the group law to be associative (since when you try to define a group law like that you probably have some intuition why it really defines a group, in particular, why conceptually should the associative law holds) – Ho Chung Siu Nov 27 '09 at 6:59

An elementary proof using Lamé's theorem, a classic result: If 3 lines cut a non-singular cubic on points A1 A2 A3, B1 B2 B3 and C1 C2 C3 and if A1 B1 C1 and A2 B2 C2 are both colinear, then A3 B3 C3 are also colinear (i. e. belong to a same rigth line). 1)A, B and -(A+B) are colinear 2)0,C and -C are colinear 3)-A,-(B+C) and S = A+(B+C) are colinear 4) As A, 0 and -A as well as B, C and -(B+C) are colinear this is so for -(A+B), -C and S because of Lame' theorem. Consequently S = (A+B)+C then A+B+C makes sens (This is associativity!!)

-

The drawing of lines as you have explained, gives a group law only in the case of genus $1$ curves. This does not work for any other genus.

The reason is that the Riemann-Roch theorem gives the third point, under the composition, and it works out only in the case of genus $1$. Riemann-Roch is the most important theorem in the study of Riemann surfaces, or algebraic curves. When you set up the situation in terms of divisors and apply Riemann-Roch, you kind of get associativity "for free". This seems the most natural explanation to me. This is also much the same as the Jacobian explanation given earlier.

This is given in Silverman's AEC. But it is a bit algebraic.

See the proof of the group law in J. W. S. Cassels, Lectures on Elliptic Curves. First the proof given by Harrison Brown is explained, and then this "conceptual" explanation using Riemann-Roch is given.

However since your approach is complex analytic, it will be very instructive to look into Rick Miranda's book on Riemann surfaces. Also Raghavan Narasimhan's ETH lecture notes give the complex analytic construction of the Jacobian variety, referred to by other people in earlier answers.

The more advanced(and definitive) volume on complex algebraic geometry is of Griffiths and Harris.

-
If you replace lines by parabolas or cubics, the geometric interpretation of the group law also works for certain curves of higher genus. – Franz Lemmermeyer Apr 7 '10 at 12:38

Let S be the set of all homogeneous algebraic functions of order 3 with 3 variables. Putting f(x)=0 gives 10 terms with 9 degrees of freedom because all functions are projective. An elliptic function E belongs to S. a,b and c are 3 points in E.

f1 contains 3 lines with points (a,b,-(a+b)), (c,0,-c),(-(b+c),-a)

f2 contains 3 lines with points (b,c,-(b+c)),(a,0,-a),(-(a+b),-c)

Functions f1 and f2 also belong to S. Define x as the point where the lines (-(b+c),-a) and (-(a+b),-c) meet. If x lies on E, then associativity is proved as x is then another name for (a+b)+c and a+(b+c).

If the 8 points of E are all distinct, then functions which pass through all 8 points in S have only one degree of freedom remaining. Hence E must be a linear combination of functions f1 and f2. Since f1 and f2 are both zero at the point x, then E must also be zero at x.

This proof is a variation of the proof which uses Lame's Theorem (I couldnt find it on the web), but uses only basic algebra.

-