Why is an elliptic curve a group?

Question

Consider an elliptic curve $y^2=x^3+ax+b$. It is well known that we can (in the generic case) create an addition on this curve turning it into an abelian group: The group law is characterized by the neutral element being the point at infinity and the fact that $w_1+w_2+w_3=0$ if and only if the three points $w_j$ are the intersections (with multiplicity) of a line and the elliptic curve.

Groups can be hard to work with, but in most cases proving that the group is in fact a group is easy. The elliptic curve is an obvious exception. Commutativity is easy, but associativity is hard, at least to this non-algebraist: The proof looks like a big calculation, and the associativity seems like an algebraic accident rather than something that ought to be true.

So this is my question, then: Why is the group law on an elliptic curve associative? Is there some good reason for it? Is the group perhaps a subgroup or a quotient of some other group that is easier to understand? Or can it be constructed from other groups in some fashion?

I gather that historically, the group law was discovered via the addition law for the Weierstrass $\wp$-function. The addition law is itself not totally obviuos, plus this approach seems limited to the case where the base field is $\mathbb{C}$. In any case, I'll elaborate a bit on this shortly, in a (community wiki) answer.

Answer 1

Everything I am writing below is carried out explicitly in Chapter III of Silverman's book on elliptic curves. In the earlier chapters, he defines the Picard group.

For any curve over any field, algebraic geometers are interested in an associated group called the Picard group. It is a certain quotient of the free abelian group on points of the curve. It consists of formal sums of points on the curve modulo those formal sums that come from looking at the zeroes and poles of rational functions. It is a very important tool in the study of algebraic curves.

The very special thing about elliptic curves, as opposed to other curves, is that they turn out to be in natural set-theoretic bijection with their own Picard groups (or actually, the subgroup $\operatorname{Pic}^0(E)$). The bijection is as follows: let $O$ be the point at infinity. Then send a point $P$ on the elliptic curve to the formal sum of points $[P] - [O].$ (It is not obvious that this is a bijection, but the work to prove it is all "pure geometric reasoning" with no computations.) So there is automatically a group law on the points of $E.$ Then it requires no messy formulas to show that under this group law, the sum of three collinear points is $O.$ So for free, you also get that this group law is the same as the one you defined in the question and that the one you defined is associative!

Answer 2

A proof I like is that the group of points on the curve is the classgroup of the ring $R=k[x,\sqrt{x^3+Ax+B}]$ where $k$ is the field you're working over. Set $y=\sqrt{x^3+Ax+B}\in R$ and let $K$ denote the field of fractions of $R$. Define ideals $I_P$ of $R$ for each point $P$ on the curve as follows. For $P=O$, the point at infinity, set $I_O=R$. For $P=(u,v)$ let $I_{P}=\langle x-u,y-v \rangle$. There's an equivalence relation $\sim$ on the nonzero ideals of $R$ defined by $I\sim J$ if $J= \alpha I$ where $\alpha\in K^*$. The equivalence classes of ideals form a monoid via $[I][J]=[IJ]$, which I'll call the class monoid of $R$.

Then you can prove by explicit calculation that

1. For points $P$ and $Q$ on the curve, if $T=P+Q$ then $[I_P][I_Q]=[I_T]$.

2. For points $P$ and $Q$ on the curve, $[I_p]=[I_Q]$ if and only if $P=Q$.

From this it's apparent that the group operation on the curve is associative, and that the set of classes of the form $[I_P]$ form a subgroup of the class monoid of $R$, isomorphic to the group of the elliptic curve. With a bit more effort you can show that every element of the class monoid has the form $[I_P]$ and that $R$ is a Dedekind domain.

(I should say that this argument is a simple-minded variant of the Picard group proof as expounded earlier by Hunter.)

Answer 3

Short answer: because it's a complex torus. Explanation below would take as through many topics.

Topological covers

The curve should be considered over complex numbers, where it can be seen as a Riemann surface, therefore a two-dimensional oriented closed variety. How to find out whether this particular one is a sphere, torus or something else? Just consider a two-fold covering onto $x$-axis and count the Euler characteristics as $-2 \cdot 2 + 4 = 0$ (don't forget the point at infinity.)

Complex tori

So this is a torus; now a torus with complex structure can be always defined as a quotient $\mathbb C/\Lambda$, where $\Lambda$ is the lattice of periods. It can be written as integrals $\int_\gamma \omega$ of any differential form $\omega$ over all elements $\gamma \in \pi_1$. The choice of differential form is unique up to $\lambda \in \mathbb C$.

Algebraic addition

A complex map of a torus into itself that leaves lattice $\Lambda$ fixed can be only given by a shift. Once you select a base point, these shifts are in one-to-one correspondence with points of $E$. We have unique distinguished point — infinity — so let's choose it as the base point. It follows that we now have an addition map $(u, v) \to u\oplus v$, though defined purely algebraically so far.

Geometric meaning

Now let's stop and ask ourselves: how to see this addition geometrically? For a start, consider map that sends $u$ to the third point of intersection with the line containing both $u$ and 0 (the infinity point). It's not hard to see that we fix 0 but change every class $\gamma$ in a fundamental group into $-\gamma$, so we must have the map $u\mapsto -u$ here.

Group theory laws

What would happen if you took a line through $u$ and $v$? By temporarily changing coordinates so that $u$ becomes the infinity point, one writes down that map as $(u, v) \mapsto -(u+v)$. Now if you took three points, there would be two different ways to add them; those would lead to $(u+v)+w$ and $u+(v+w)$ as complex numbers, which we know to be associative.

Logically proven

In the above, we worked over complex numbers, but we proved associativity which is a formal theorem about substitution of some rational expressions into others. Since it works over complex fields, it is required to work over all fields.

(In any case, the big discovery of mid-20th century was that you actually can take all of the intuition described above and apply it to the case of elliptic curves over arbitrary field)

Analytic computations (bonus)

Consider a line that passes through points $u$, $0$ and $-u$. This line is actually vertical, and $y$ is a well-defined function there which has two zeroes and one double pole at infinity. After a shift and multiplication of several such functions we'll be getting a meromorphic function on a complex torus with poles $p_i$ and zeroes $z_i$ having the property $\sum p_i = \sum z_i$. This method can give all such functions and only them; it's not hard to see that only meromorphic functions with this property are allowed on elliptic curve.

For example, $\wp'$-functions are the ones that have triple pole at 0 and single zeroes at points $\frac12w_1, \frac12w_2, \frac12(w_1+ w_2)$ where $w_1, w_2$ are generators of $\Lambda$.

Jacobian of a curve (bonus 2)

The formula above describes what types of functions are allowed on our curve. It is a good idea to organize this information into a curve: in this case, the information is that a single expression $p_1 + p_2 + \cdots + p_n - z_1 - \cdots - z_n$, considered a point of the curve, must vanish. For curves of higher genus, more relations are necessary; for $\mathbb C\mathbb P^1$, no relations beyond number of poles = number of zeroes are necessary. Those are relations in the group of classes of divisors (= Jacobian of a curve) mentioned in other answers.

In particular, elliptic curves coincide with their Jacobian and that's another explanation for the additive law.

Answer 4

This was too long for a comment.

To elaborate on Hunter's response, there is something you can associate to any curve called its Jacobian variety, whose points can be identified with degree 0 line bundles (these can be identified with formal linear combinations of closed points on the curve whose sum of coefficients is 0, modulo a certain equivalence relation). There is a group operation on the Jacobian variety given by tensoring line bundles (or adding linear combinations), and its dimension is the genus of the curve. Since elliptic curves are genus 1 curves, one might hope that the Jacobian variety is isomorphic to the elliptic curve, and indeed this is the case. So this sort of gives a reason why a group law exists on the elliptic curve.

The catch is that there isn't a canonical isomorphism from an elliptic curve to its Jacobian variety. There is a way to specify an isomorphism once you single out a closed point on the elliptic curve (this is like picking an identity element). So elliptic curves don't really have a group law, it's elliptic curves with a choice of a rational point which do.

(I learned this stuff from Chapter IV of Hartshorne's Algebraic Geometry)

Answer 5

Consider an additive subgroup $\Lambda$ of $\mathbb{C}$ so that $\mathbb{C}/\Lambda$ is compact (indeed, a torus). The corresponding Weierstrass $\wp$-function satisfies the ODE $\wp'(z)^2=4\wp(z)^3-g_2z-g_3$, and so if we write $x=\wp(z)$ and $y=\wp'(z)$ then $(x,y)$ lies on the elliptic curve $y^2=4z^3-g_2z-g_3$ (indeed, this parametrizes the entire curve). Addition in $\mathbb{C}/\Lambda$ is well defined, of course, and the addition theorem states that if $z_1+z_2+z_3=0$ then the corresponding $(x_j,y_j)$ satisfy $$\begin{vmatrix}x_1&y_1&1\\\\x_2&y_2&1\\\\x_3&y_3&1\end{vmatrix}=0,$$ i.e., the three points $(x_j,y_j)$ lie on a line. Thus the map $z\mapsto(x,y)$ maps the usual addition on $\mathbb{C}/\Lambda$ to the elliptic curve addition on the curve.

Answer 6

A few days ago in my algebraic geometry class we saw a pretty nice "geometric" argument for why the group law is associative. Unfortunately I'm at home for the Thanksgiving break and don't have access to my notes, but as best as I can remember it went like this:

Start with three points P, Q, R, plus the distinguished point 0 that's the identity; we want to show (P+Q)+R = P+(Q+R). Denote by (P#Q) the third point of your curve collinear with P, Q. Basically we start drawing lines everywhere; we end up with I think a total of 10 points, which are:

0, P, Q, R, (P#Q), (Q#R), P+Q, Q+R, (P+Q)#R, P#(Q+R).

Of course secretly those are just 9 points, but that's what we're trying to prove...

Now it turns out that I think 9 of these points -- all but P#(Q+R) -- lie on the union of 3 lines. Same construction, all but (P+Q)#R lie on the union of 3 different lines. Using either Bezout's theorem or a slightly stronger generalization thereof, we can show that the 9th point of intersection of these two plane cubics is in fact P#(Q+R) or (P+Q)#R, so they're the same.

There's probably at least one place where I horribly misremembered the argument, though -- if you happen to know what it is, let me know and I'll happily fix it.

Answer 7

An elementary proof using Lamé's theorem, a classic result: If 3 lines cut a non-singular cubic on points A1 A2 A3, B1 B2 B3 and C1 C2 C3 and if A1 B1 C1 and A2 B2 C2 are both colinear, then A3 B3 C3 are also colinear (i. e. belong to a same rigth line). 1)A, B and -(A+B) are colinear 2)0,C and -C are colinear 3)-A,-(B+C) and S = A+(B+C) are colinear 4) As A, 0 and -A as well as B, C and -(B+C) are colinear this is so for -(A+B), -C and S because of Lame' theorem. Consequently S = (A+B)+C then A+B+C makes sens (This is associativity!!)

Answer 8

The drawing of lines as you have explained, gives a group law only in the case of genus $1$ curves. This does not work for any other genus.

The reason is that the Riemann-Roch theorem gives the third point, under the composition, and it works out only in the case of genus $1$. Riemann-Roch is the most important theorem in the study of Riemann surfaces, or algebraic curves. When you set up the situation in terms of divisors and apply Riemann-Roch, you kind of get associativity "for free". This seems the most natural explanation to me. This is also much the same as the Jacobian explanation given earlier.

This is given in Silverman's AEC. But it is a bit algebraic.

See the proof of the group law in J. W. S. Cassels, Lectures on Elliptic Curves. First the proof given by Harrison Brown is explained, and then this "conceptual" explanation using Riemann-Roch is given.

However since your approach is complex analytic, it will be very instructive to look into Rick Miranda's book on Riemann surfaces. Also Raghavan Narasimhan's ETH lecture notes give the complex analytic construction of the Jacobian variety, referred to by other people in earlier answers.

The more advanced(and definitive) volume on complex algebraic geometry is of Griffiths and Harris.

Answer 9

Let S be the set of all homogeneous algebraic functions of order 3 with 3 variables. Putting f(x)=0 gives 10 terms with 9 degrees of freedom because all functions are projective. An elliptic function E belongs to S. a,b and c are 3 points in E.

f1 contains 3 lines with points (a,b,-(a+b)), (c,0,-c),(-(b+c),-a)

f2 contains 3 lines with points (b,c,-(b+c)),(a,0,-a),(-(a+b),-c)

Functions f1 and f2 also belong to S. Define x as the point where the lines (-(b+c),-a) and (-(a+b),-c) meet. If x lies on E, then associativity is proved as x is then another name for (a+b)+c and a+(b+c).

If the 8 points of E are all distinct, then functions which pass through all 8 points in S have only one degree of freedom remaining. Hence E must be a linear combination of functions f1 and f2. Since f1 and f2 are both zero at the point x, then E must also be zero at x.

This proof is a variation of the proof which uses Lame's Theorem (I couldnt find it on the web), but uses only basic algebra.