Hasse’s bound, Riemann hypothesis for elliptic curves

The goal of this article is to prove the Riemann hypothesis for elliptic curves over finite fields in a concrete algebraic way. More precisely, we will prove Hasse’s bound for a nonsingular cubic curve over a finite field . If denotes the number of -points on the curve, including the point at infinity, then the theorem says

This is the elliptic-curve analogue of the Riemann hypothesis: the main term is , and the error term is forced to have square-root size. At first, this looks like a problem about cancellation in a character sum. Indeed, for odd , the number of solutions to can be written using the quadratic character , and the error term becomes

So the theorem becomes . A naive estimate gives only , because the summands are usually or . The question is: where does the cancellation come from? We will not prove the bound by directly rearranging or pairing the terms of this sum. Instead, we will give the sum a new meaning.

The main idea is to turn the character sum into a coefficient of a quadratic polynomial that cannot be negative. The elliptic curve has an addition law, defined by explicit chord-and-tangent formulas. This allows us to build algebraic self-maps of the curve, such as multiplication-by- maps and the Frobenius map . Each nonconstant self-map has a degree, which we will define concretely as the number of preimages of a generic point, counted with multiplicity. In other words, degree is a root count. Since root counts cannot be negative, degrees give positivity. The proof will show that, for every pair of integers , the degree of the map is

This is the whole mechanism. The middle coefficient is the character sum , while the whole expression is a degree and therefore must be nonnegative for every . Once we know this, the bound follows by elementary algebra: a quadratic form can be nonnegative for all only if .

So the proof has two layers. The visible arithmetic problem is cancellation in the sum . The hidden algebraic structure is positivity of degree. The purpose of what follows is to understand that structure rather than merely quote it. We will spend some time asking why a cubic has an addition law at all, how the same addition appears as geometry, rational algebra, and bookkeeping of zeros and poles, why the degree of doubling is four rather than two, and why the Frobenius map is such an unusual map: it has degree even though it has only one distinct geometric preimage of a typical point. We will then build the degree identity carefully enough to see where every multiplicity comes from. At the end, the estimate for the character sum will be almost the least mysterious part of the argument.

Point Counts via character sums

Let , where is prime. We work with

The restriction on the characteristic makes the familiar short Weierstrass form available; elliptic curves in characteristics two and three require slightly different equations, not a different fundamental idea. Assume

Why this particular expression? If the polynomial has a repeated root , then . Since , these equations give and then . Consequently . Conversely, the vanishing of is the discriminant condition for a repeated root. It is worth checking exactly what repeated roots would do geometrically. For the polynomial defining our affine curve, both partial derivatives would vanish at a singular point:

Because the characteristic is not two, singularity forces , followed by . Thus the discriminant condition is precisely what prevents a cusp or a node. Later we will see that a singular cubic still admits some kind of algebraic addition, but its structure degenerates. The nonsingular cubic has the particularly rich degree-two, degree-four, and Frobenius arithmetic that we need.

For each fixed , how many solve ? Let be the quadratic character, with , for nonzero squares, and for nonsquares. There are exactly possible values of : respectively two, one, or zero. Once we include the point at infinity, therefore,

The has a very straightforward origin: there is one baseline solution for each of the choices of , plus the point at infinity. The character sum measures how often a fiber has two points rather than zero. Square-root cancellation would be quite natural if the values behaved like independent random signs; a random walk of length typically fluctuates by about . But they are not independent signs, and a probabilistic analogy is not a proof. We must uncover a constraint, invisible from the individual values, that prevents their sum from being very large.

There are two questions that will guide us. First, can we reinterpret itself as the number of solutions of some equation of algebraic maps? Second, can we place that map inside a family of maps whose degrees form a nonnegative quadratic expression? Both answers will come from the same source: the addition law on the cubic.

Point at Infinity

The affine equation is only one chart of the curve. Introduce homogeneous coordinates and the projective equation

When , we normalize and recover , . When , the equation forces . Hence there is exactly one projective point at infinity,

Why should we want this point? Try to draw a vertical line . It meets the affine curve at the points and , when these are defined. But a projective line meets a projective cubic in three points counted with multiplicity. Its third intersection is . The same phenomenon occurs algebraically: if we write the vertical line projectively as , then the two finite intersections together with account for its cubic intersection. Thus is the missing point that makes lines interact uniformly with the curve. It will also be the identity for the group law.

A second reason to keep in view is that rational functions acquire poles there. We will later calculate that has a pole of order two and a pole of order three. That is already a striking hint: what makes the cubic into a group is closely related to the arithmetic of the integers two and three, as encoded by the functions and .

Addition Law, Chord Construction

Take two affine points and with . The line joining them has equation

Substitute this equation into . We obtain

We already know two roots, and . Call the third . Since the coefficient of is , Vieta’s formula says

The third intersection is . We define , where negation means reflecting the point across the -axis. The actual coordinate formulas are therefore

It is helpful to notice just how little geometry is left in these formulas. We can work over , where there is no picture of a real secant line, and obtain exactly the same formulas. Every step only uses field addition, multiplication, and division. The geometry discovered the operation; the algebra makes it meaningful over any field of characteristic different from two or three.

Why the reflection? Without it, the third intersection operation would not have the ordinary identity and inverse conventions. The natural algebraic rule is that three collinear points should satisfy

The reflection translates this symmetric three-point relation into an ordinary two-variable addition law. There is no separate claim that three points on a line literally add as vectors in the plane. The sum takes place in the new group structure we are defining on the curve itself.

There are two special cases. If the line is vertical, its two affine intersection points are and , and its third intersection is . We therefore set . If one of our points is already , we set . These are not arbitrary patches: both rules are exactly what the projective chord construction gives when the intersection at infinity is included.

For a repeated point , the secant is replaced by the tangent. Differentiate algebraically:

At a point with , the tangent slope is

The tangent meets the cubic twice at and once at another point; the same Vieta calculation gives

It is worthwhile to carry the first formula all the way through. Substituting the tangent slope and using , we find

Thus the very concrete rational function

will later tell us that the doubling map has degree four. At a point with , the tangent is vertical, so . Because at such a point, this is exactly what a group law would demand.

Let us see one actual finite-field addition. Consider over . The points and lie on the curve because and modulo five. Their secant slope is , so and . Hence

The right-hand point is a two-torsion point, so adding to itself gives . This sort of calculation is important: we are not using any abstract group theory to manufacture the coordinates. We can actually perform addition with modular arithmetic.

There are several ways to think about the addition operation.

First viewpoint: a line is a relation among three points. Instead of regarding the chord construction as a recipe for finding , one can regard it as saying that the three intersections of every line satisfy one relation, . From this viewpoint, is whatever point makes the relation true. This is a useful way of anticipating associativity: if collinear triples are relations, we ought to be able to add and subtract those relations without changing their meaning. It also suggests that rational functions, whose zeros and poles likewise satisfy additive bookkeeping rules, will be the right language. Second viewpoint: coordinates are a computational representation of a group. The points of are not vectors in the affine plane. In general, the coordinatewise sum of two solutions of is not another solution. The chord rule gives a different, highly nonlinear representation of a group. For example, is a group homomorphism, even though its first coordinate is the rational function of degree four displayed above. This is already one of the themes of algebraic geometry: a simple operation on an abstract space need not look linear in the coordinates used to display that space. Third viewpoint: addition is a statement about zeros and poles. This will be our most useful algebraic interpretation. A line intersects the cubic at three points, and the restriction of that line to the curve is a rational function with zeros at those three intersections. Meanwhile, the projective point controls its poles. The relation expresses the fact that these zeros and poles balance. In a moment, we will formulate this without assuming any geometric picture. Fourth viewpoint: near the identity, addition is ordinary addition to first order. The whole curve may be nonlinear, but it has a local coordinate near such that

This is the beginning of the formal group law of the elliptic curve. It is the infinitesimal version of the chord rule. It will later distinguish separable maps, such as , from inseparable maps, such as Frobenius. Rather than regard this as a new advanced object, we will calculate the needed local facts directly from , , and the chord formulas. A fifth viewpoint, useful but not needed in the proof: a complex elliptic curve is a torus. Over , an elliptic curve can be parametrized by a quotient , where is a lattice. The parametrization uses the Weierstrass functions and , after suitable normalization. The group law becomes exactly modulo the lattice. The frightening rational addition formulas are therefore identities expressing in terms of , , and their derivatives. This viewpoint explains intuitively why the curve should be a group: it is a torus written in algebraic coordinates. But using the analytic parametrization to prove the finite-field result would conceal the arithmetic. It is more illuminating here to reconstruct the group directly from the cubic.

What is special about a cubic? A line generically meets a plane curve of degree in points. For a cubic, knowing two of them leaves exactly one unknown third point. That makes a binary operation possible. For a quartic, a line through two points generally has two further intersections, with no canonical choice between them. Even among cubics, nonsingularity matters: it is what turns this construction into the group of a genus-one curve rather than a degeneration resembling the additive or multiplicative group. The precise algebraic reason for the clean group law will become clearer through divisors.

Before claiming that the chord rule is associative, it is worth stopping to understand the very concrete algebraic structure behind it. We can do this without appealing to the theory of Jacobians or to the Riemann–Roch theorem. We need a modest language for recording zeros and poles of rational functions. The central principle will simply be that every nonzero rational function on our complete cubic has equally many zeros and poles, counted with their appropriate orders. We will prove the principle directly from the equation . Work temporarily over an algebraic closure . We do this so that polynomials split and so that we may count all geometric points, not just points defined over the original finite field. A rational function on the curve is an expression in and , subject to the relation . As a result, every rational function has a unique representation

Existence is immediate: divide every polynomial or rational expression by the relation to eliminate higher powers of , then rationalize any remaining denominator of the form by multiplying numerator and denominator by . For uniqueness, note that is not a square in : at each simple root of , its order of vanishing is one, whereas a rational square must vanish to even order. Therefore , so are linearly independent over . What does it mean to count a zero with multiplicity? Near an ordinary affine point with , we may use as a local coordinate. The defining equation determines as a power series in , with constant term . We expand in powers of ; if its first nonzero term is , we say it has order at . Positive order means a zero; negative order means a pole. At a point , we instead use , because lets us solve for as a power series in . This distinction is important: at , the function vanishes to order two, not one.

We should similarly calculate a local coordinate at infinity instead of treating formally. In the projective patch , write and . The equation becomes

At we have , and the coefficient of in the left-hand side minus the right-hand side is one. Thus is determined by as a power series, beginning with . A particularly convenient local parameter is

The advantage of this choice is that negation sends to exactly. We can also calculate the expansions of and . Because , the curve equation gives

Introduce . After replacing by , this becomes

We look for a solution beginning with . Substituting repeatedly gives , and therefore

The two leading pole orders are now explicit:

We will use these expansions several times. They are not merely a technical exercise. The double pole of is the reason that the map has degree two. The triple pole of reflects the cubic equation. And the fact that is an even Laurent series will later let us factor at a point where both maps hit infinity.

Here is the zero-pole principle. If is nonzero, define its conjugate by

Then

An ordinary rational function of the -coordinate has as many zeros as poles on the cubic. To check this, factor into terms and their inverses. Each has two zeros counted with multiplicity, at and , and a double pole at . If , the two zeros coincide and the single point has order two; the total is still two. The same count works for a quotient of products of these factors.

The involution merely permutes the points of the curve, so and have equal total zero-minus-pole counts. But has total zero-minus-pole count zero. Therefore twice the corresponding count for is zero. We conclude

Only finitely many terms are nonzero. This is the concrete version, for our cubic, of the assertion that a principal divisor has degree zero. A divisor is just a finite formal sum of points with integer coefficients. The divisor records the orders of all zeros and poles of . The word principal means precisely that it comes from a rational function. We can add and subtract divisors coefficientwise, since . Two divisors differing by a principal divisor are called equivalent. This is a very modest piece of algebra, but it makes the chord rule almost inevitable.

Addition in terms of Divisor Classes

Let a projective line meet our cubic at three points , counting repeated intersections. The quotient is a rational function on the cubic: it has zeros at the intersections with and poles at the intersections with . Since the line at infinity meets our cubic with multiplicity three at , we have

This equality remains true when points coincide, as for a tangent line: we simply record their multiplicities. For a vertical line through and , the rational function is , giving

Subtracting the second relation from the first, with , yields

This is the algebraic content of the chord rule . Instead of thinking about a reflection in a picture, we could say: the sum is the unique point such that the divisor is principal. The line and vertical-line calculations show how to find that point;

The next question is why it is unique. Here we need one small fact that is genuinely characteristic of a nonsingular cubic: a nonconstant rational function cannot have just one simple pole and no other poles. It is useful to understand why, because it is also a way of seeing that this curve cannot be parametrized by a single rational parameter. We can prove it explicitly with the differential

At an affine point where , this expression is regular and nonzero because is a local coordinate. At a point where , differentiate the defining equation to get , and rewrite

Since nonsingularity gives there, this is also regular and nonzero. Finally, substitute our expansions near . We obtain

So is a nonzero differential with no pole anywhere on the projective curve. Now suppose some rational function had exactly one simple pole. Then the equation would have exactly one root counted with multiplicity for a generic , by the zero-pole principle applied to . In other words, would be a rational coordinate on the curve: its rational function field would be . In that coordinate, our differential would have the form for a rational function . Being regular at every finite value of would force to be a polynomial. But if is the coordinate near infinity, then , so necessarily has a pole there unless . This contradicts the nonvanishing of . Hence no such exists.

Now suppose the two divisors and are equivalent. Their difference would be the divisor of a rational function. If , that function would have exactly one simple pole, at , which is impossible. Thus the map

from points of the curve to equivalence classes of degree-zero divisors is injective. This is the one place where the absence of a rational parametrization matters directly. Together with our line calculations, the injectivity gives a particularly satisfying proof of associativity.

Write . The chord and vertical-line identities say, exactly,

Here the addition on the right is only addition of formal divisor classes, which is automatically associative and commutative: we are literally adding integer coefficients at points. Therefore

Injectivity now gives

This proof explains something that an enormous coordinate simplification would not. Associativity is not a lucky algebraic coincidence in the formulas for slopes. The three-point relation cut out by a line becomes ordinary additive bookkeeping of zeros and poles, and that bookkeeping is associative. The rational formulas are simply the coordinate realization of the relation. We now legitimately have an abelian group with identity and inverse .

For an integer , define by repeated addition, with and . Our maps satisfy the familiar algebraic identities

They are not linear maps of affine coordinates, but they behave like multiplication maps in an abelian group. That is exactly the bridge from the geometry of the cubic to the arithmetic of algebraic maps.

Let us return to the parameter at . Since the addition map is given by rational functions, there is a formal power series describing the parameter of a sum of two nearby points:

We will need only a few basic features of this power series, and each has an elementary origin. Because and , the two identities

hold exactly. In particular, the constant term is zero and the terms of total degree one are . Thus

For the short Weierstrass equation with this standard parameter, one can in fact compute that the first nonlinear terms occur considerably later; their precise form is unnecessary here. The point is that the differential of addition at the identity is ordinary addition. Similarly, because negation sends exactly to , subtraction has parameter , which begins with .

There is a stronger, and very useful, factorization. Since identically, the formal power series is divisible by . Its quotient has constant term one. Likewise, is divisible by , again with a quotient that is a unit. In symbols,

A unit here means a power series with nonzero constant term; it cannot create a zero or pole. This factorization is the exact algebraic version of the informal statement that, near the identity, occurs when , and when . It remains valid when the first nonzero term of a particular map has very high order, which is precisely what can happen in positive characteristic.

Notice one last point. If is a group homomorphism, then translating a point of the domain by translates its image by :

Translation by a fixed point is an invertible rational operation. Consequently, the multiplicity of a fiber of is the same at each point of that fiber. In particular, we can study how a group homomorphism behaves over the identity and transport the answer to other fibers. This will become important when counting the points fixed by Frobenius.

Rational Maps and Degree

Now we can ask a seemingly different question. Suppose is a map whose coordinate functions are rational expressions in and . How many points solve an equation for a given target point ? We expect to be able to count such solutions by polynomial algebra, but it is important to decide in advance how to treat repeated roots. The answer will be a number , the degree of the map. Our proof of Hasse’s theorem rests on the elementary fact that this number cannot be negative.

We are interested specifically in rational group homomorphisms , meaning maps satisfying

These include multiplication by any integer, , and soon Frobenius. We can add two such maps pointwise:

and take their negatives and differences. Thus the maps themselves form an abelian group. The sum is not the sum of their coordinate expressions: we apply the elliptic-curve addition formulas to the two output points. One must distinguish , which means , from ordinary addition of polynomials in and .

Here is a simplification particular to elliptic-curve homomorphisms. Any such obeys . Since , we have

Recall that every rational function on has a unique form . The displayed invariance sends this expression to . Because the characteristic is odd, the term must be zero. Therefore the first coordinate of a group homomorphism is a rational function of alone:

This is a substantial simplification. We have turned a map of a cubic curve into an ordinary rational function of one variable for the purposes of degree counting. Define, for any nonzero (hence nonconstant) group homomorphism,

The zero homomorphism is assigned degree zero. Why does a nonzero homomorphism have a nonconstant first coordinate? If were constant, its image would lie in a set of at most two points ; the irreducibility of our curve forces a rational map into that finite set to be constant, and the homomorphism condition then forces the constant to be .

Let us check carefully why the definition really counts roots. Take a generic target point with . The equation is

For a generic , this polynomial has degree . It has that many roots in , counting multiplicity. For a generic root , there are two points and of our curve. Their images are negatives of each other. Thus one maps to and the other maps to . Exactly one member of each pair contributes to the fiber over , with the same multiplicity as its root of the polynomial. Consequently a generic fiber of consists of points counted with multiplicity. We have not merely named an invariant; we have reduced it to the degree of a polynomial equation.

The word generic matters. A special target might lead to repeated roots, or to a fiber with fewer distinct points. But a polynomial of degree still has roots when multiplicity is included. This is how degree remains stable. When we later study Frobenius, the difference between distinct roots and roots counted with multiplicity will be dramatic, not cosmetic.

There is also a very useful algebraic proof that degrees multiply under composition:

To see why, first examine an ordinary reduced rational function with . Regard as an indeterminate. The equation is . This polynomial is irreducible in : indeed, as a polynomial in the two variables , it is linear in , and any nontrivial factor independent of would divide both and , contrary to coprimality. Therefore the function-field extension has degree exactly . Apply this twice to the tower

Degrees of these finite field extensions multiply, giving the claimed composition rule. This argument includes repeated and inseparable roots automatically; it does not rely on distinctness of generic preimages.

For example, , so . Negation changes the sign of but leaves unchanged, so . More generally, composition with negation leaves degree unchanged:

Our calculation of doubling was

There is one detail that we must not skip: are numerator and denominator coprime? Let be any root of the denominator, so . Modulo that equation, the numerator can be rewritten as

Since and nonsingularity forbids , this is nonzero. Thus no cancellation is possible, the numerator has degree four, and we get Notice a second explanation of the same four. Over , the cubic has three distinct roots . The points with are exactly

There are four of them. In characteristic different from two, the parameter of near the identity begins with , so these are four simple points in the kernel. A generic fiber of the doubling map is a translate of this kernel; thus the degree-four rational-function computation agrees with the fourfold group-theoretic covering. We are seeing three versions of the same fact: a quartic equation in , a four-element kernel, and a degree-four map.

Frobenius Map

Define the -power Frobenius by

It maps the curve to itself because , , and the -power map respects sums and products:

It also respects the elliptic-curve group law. For instance, if is a secant slope, then its Frobenius transform is

Substitute this into to see that ; the coordinate follows from the companion formula. Tangents and the exceptional cases are handled the same way. Hence

Now the degree calculation is almost embarrassingly simple: , so

But what are we actually counting? Fix . The equation has only one distinct solution in the algebraic closure, since raising to a -th power is bijective on . If , however, then

The one root appears with multiplicity . Thus Frobenius is purely inseparable: as a map of geometric points it is bijective, but as an algebraic map it has degree . This is a good place to remember why our definition of degree used multiplicity rather than simply counting distinct solutions. Had we used distinct points, Frobenius would have degree one, the eventual quadratic form would have the wrong leading coefficient, and the proof could never know where the factor should come from.

The map is also a little deceptive on itself. Every satisfies , so for every rational point . But is not the identity map on the algebraic curve. Over the algebraic closure, most points do not have their coordinates fixed by the -power operation. That distinction is the key to converting the point count into a degree.

Parallelogram Law

We now reach the structural identity on which everything rests:

It is tempting to say that it is obvious because degree resembles a squared length. But that would only rename the phenomenon we are trying to explain. We want to see why the addition formulas, the poles of , and the zero-pole principle actually imply it. This is the portion of the argument where it is easiest to skip an important detail, especially when two maps take a point to simultaneously. We will do the local bookkeeping explicitly.

First suppose and are both nonzero and , . Consider the rational function on

Our assumptions ensure that is not identically zero. Indeed, if the two -coordinates agreed identically, their -coordinates would agree up to one fixed sign, since each satisfies the same quadratic equation. We would then have or as rational maps.

If neither nor equals , the equation says that the two image points have the same first coordinate. This is equivalent to

or, in group language,

So the zeros naturally come from the kernels of and . But we have to count correctly when both equations hold: that happens when the common image is a two-torsion point. We must also handle poles at places where one or both images equal . A convenient way to keep track of all cases is to introduce a local multiplicity.

For any nonzero homomorphism , and any point , set

Here is our local parameter at the target identity. The positive integer , when , is the multiplicity with which belongs to the kernel of . Since has a double pole at , the rational function has a pole of order at each such point. The total pole order of is , because is a rational function of degree in , and each pole on the -line pulls back to two poles counted with multiplicity on . Therefore

This is the precise statement that the kernel has size equal to degree when kernel points are counted with multiplicity. In a separable case every local multiplicity is one. In an inseparable case a small number of points may carry much larger multiplicities.

Let us now calculate the order of point by point. We claim the exact local identity

There are four cases, and seeing them separately is worthwhile.

Case 1: neither image is at infinity, and the common image is not a two-torsion point. If , both sides of the displayed identity are zero. If with , then is an ordinary local coordinate near . Thus the vanishing order of is exactly the order to which the two image points coincide. Subtracting one point from the other is an invertible local change of coordinates, and its parameter at differs from the difference of these local -coordinates by a unit. Therefore this order is . The term vanishes, since . The case is identical, except that replaces .

Case 2: the common image is a nonzero point of order two. Write the point as , so and . Near , use as a local coordinate. Since , solving for gives an even power series

In particular, when two points approach , the difference factors exactly as

where is a power series with nonzero constant term . The factor measures the order of , while measures the order of , because negation sends to . Thus both multiplicities appear and add. This is precisely the case that would be missed by counting only distinct zeros of .

Case 3: exactly one image is . Suppose and . Then has a pole of order and is regular, so has pole order exactly . Neither nor vanishes at , because each has image . Hence our identity reads , exactly as required. The opposite situation is symmetric.

Case 4: both images are . This is the delicate case: both terms of have poles, and their leading parts might cancel. Let and denote the corresponding local power series as approaches . Our expansion at infinity shows that is an even Laurent series:

Every even Laurent series of this form can be viewed as a Laurent series in . Consequently, is divisible, in the appropriate Laurent-series ring, by . More precisely, separating the leading poles shows

where . The quotient is a unit; hence it has neither zero nor pole. But our formal-group factorization says that is times a unit and is times a unit. Taking orders in the preceding factorization gives exactly

This is why the naive slogan “the zeros are the kernels and the poles are twice the two individual kernels” needs care. Where those supports overlap, we do not simply add pole orders blindly. We first factor the difference of rational functions. The two factors and record exactly how the cancellations modify the zeros and poles. Our equality handles the overlaps without any assumption that the maps are separable.

We can now finish the proof of the identity. Sum the local formula over all points . The left side is zero because is a nonzero rational function and we proved that every rational function has equally many zeros and poles. On the right, the sums of the are the degrees of the corresponding maps. Thus

which gives

We assumed only to ensure that was not identically zero. The exceptional cases are easy once we know and multiplicativity of degrees. If , the required identity reduces to , which follows from . The same argument treats . If either map is zero, the identity becomes . So the parallelogram law is established for all homomorphisms, including inseparable ones.

The mathematical shape of this result is remarkable. We began with a root count, something that does not look quadratic at all. Yet when we add and subtract homomorphisms using the elliptic curve’s group law, their root counts obey the same parallelogram identity as squared Euclidean lengths. The reason is not a pre-existing inner product: it is the factorization of , together with the balancing of zeros and poles. This is the hidden positivity principle behind the square-root cancellation.

Degree of mutliplication maps

Let us put the parallelogram law to work before bringing in Frobenius again. Denote , using the letter to emphasize that we expect something quadratic. For any homomorphism and any integer , apply the parallelogram identity to and . Since their sum is and their difference is , we obtain

Let . Then

This is a second-difference equation. If we set , it says . Since , induction gives . Summing these first differences yields

The argument for negative follows from . Therefore

Set . Since , we get

We knew that from an explicit quartic rational function. The parallelogram law tells us that the same quadratic behavior persists for every integer. It predicts , , and so forth, without requiring us to expand the increasingly monstrous rational expressions for . This is a good example of how an abstract-looking identity can save rather than replace concrete algebra: we did one nontrivial coordinate calculation, proved a structural relation among degree counts, and then obtained infinitely many further coordinate degrees for free.

There is a second way to interpret the same square. Over the complex numbers, multiplication by on takes to . Modulo the lattice, a generic point has preimages, corresponding to the pairs of residues modulo in two independent lattice directions. Our algebraic calculation shows that the same count, interpreted with multiplicities, remains true over finite fields. The geometry over offers a mental picture; the zero-pole proof explains why it is still true in positive characteristic, even when multiplication by is inseparable.

Degree and the quadratic form

The statement that obeys a parallelogram law suggests that it should have a mixed term. Let us derive that mixed term rather than simply invoke a theorem from linear algebra. Define

By the parallelogram identity, the same number can be written

It is symmetric, since and . In fact, additivity can already be extracted directly from the parallelogram identity. Using and applying the parallelogram identity first to and then to , one obtains

Interchanging and and using gives the companion relation

Adding the two equalities, and dividing by two in the ordinary integers, yields . Symmetry gives additivity in the other argument, so really is an integer-valued bilinear pairing. There is no division by two inside the finite field here: the values of are ordinary integers recording degrees. To see its bilinear behavior explicitly, let be fixed and consider for integers . Fix and apply the parallelogram law to and :

For fixed , its second difference as a function of is constant. Consequently is a quadratic polynomial in , with leading coefficient . Its value at is . Evaluating at determines the remaining coefficient:

Now run the same second-difference argument in for . Since its value at is and at is , we find

Substitute this back into the expression for . Everything simplifies to

This is exactly the form of a quadratic polynomial in two integer variables. We have derived it using nothing deeper than a repeated finite-difference calculation and our zero-pole proof of the parallelogram identity. The mixed coefficient tells us how the two maps interfere when their outputs are added on the elliptic curve. It is an algebraic analogue of the dot product term in the identity .

There is a useful conceptual reversal here. In elementary Euclidean geometry we start with an inner product, define a norm, and discover the parallelogram identity. Here we started with a root count, discovered the parallelogram identity by examining a rational function, and recovered a bilinear pairing afterward. The positivity of this pairing is not an additional theorem: it is inherited from the fact that every is a nonnegative integer. Once we identify the mixed term for Frobenius and the identity, Cauchy–Schwarz will be forced upon us.

Rational Points and Frobenius

We have two particularly natural homomorphisms: the identity , whose degree is one, and the -power Frobenius , whose degree is . What can we say about the mixed term ? We have not calculated it directly. But the difference map

has a beautifully concrete kernel. It vanishes exactly when . For a finite point , this is the pair of equations

Over the algebraic closure , the roots of are precisely the elements of . This can be seen directly: every element of satisfies the equation, these are distinct roots, and the polynomial has degree . The point is also fixed. Therefore

It would be very tempting to conclude immediately that . But remember what happened with Frobenius itself: the number of distinct points in a kernel need not equal its degree. We must prove that every fixed point occurs with multiplicity one. Fortunately this is where the local parameter at does exactly the calculation we need.

Since , Frobenius acts on the local parameter by

Write . By the formal-group law, subtraction near is expressed as . The terms of total degree one give . Furthermore, because , every nonlinear correction here contains the factor as well as a positive power of . Thus

The coefficient of the first-order term is , which is nonzero in every characteristic. Thus is a simple point of the kernel of . If is any other fixed point, then for near we can translate by and calculate

because . Translation is an invertible local change of coordinates, so the multiplicity at equals that at , namely one. Every kernel point is simple. Our earlier kernel-degree formula therefore gives

This is the conceptual pivot of the proof. What began as a sum of values of a quadratic character is now the degree of a perfectly explicit map. In fact, the character sum itself is obtained by subtracting the elementary terms :

We have converted a counting problem over the finite field into a degree calculation over the algebraic closure. It is important that we used the algebraic closure only to interpret fibers and multiplicities; the fixed points of themselves turned out to be exactly the original -rational points.

Recall our notation and

The parallelogram identity also gives

Set and . Since , , and , we get

Therefore

It is common to introduce the integer , called the trace of Frobenius. In our notation,

The terminology trace is quite natural. In linear algebra, the norm of a two-dimensional vector or a matrix often comes with a bilinear cross-term. The integer plays exactly that role for Frobenius. We will eventually see that the same becomes the middle coefficient of a quadratic polynomial whose roots govern point counts over all extension fields.

For the moment, substitute the mixed term into our general quadratic formula:

Thus

It is worth unpacking what this formula actually says. The map on the left sends to . To calculate it from coordinates, one would first raise the coordinates of to the -th power, add the resulting point to itself times, add to itself times, and finally apply the chord-and-tangent formulas to add those outputs. This produces an intricate rational expression. Nevertheless, without expanding that expression, we know its generic root count exactly: it is the quadratic polynomial . The quantity is not an arbitrary number attached afterward. It is the interaction term between the two natural maps.

This is where we should reconsider the word cancellation. We had wanted to show that a signed sum of terms cannot be too large. The map by itself has degree , and the identity has degree one. If their mixed term were very large, some integer linear combination would have a negative degree. But a negative generic root count is impossible. The square-root bound is the algebraic compatibility condition between these three facts: Frobenius has degree , the identity has degree one, and all maps have nonnegative degree.

Hasse’s Bound

Every map has nonnegative degree, including the zero map, to which we assigned degree zero. Hence for all integers ,

One can finish with the usual discriminant argument. For , divide by and set . We find

for every rational , hence also for every real by continuity. The minimum of this quadratic occurs at and equals . Its nonnegativity gives .

But there is an even more concrete way to avoid any discussion of real numbers or density of the rationals. Since itself is an integer, take the actual algebraic map

Our degree formula, with and , reads

This is a nonnegative integer, since it is the degree of a map. So immediately,

We conclude . Since , this is This proves Hasse’s theorem.

I find the second ending especially useful for understanding what was accomplished. The final inequality is not merely a consequence of optimizing some abstract quadratic form. We can point to a particular map, , whose degree is exactly the defect in the proposed inequality. If Hasse’s bound failed, this explicit algebraic map would have a negative number of generic preimages. That is the contradiction. No probabilistic independence assumption and no delicate direct cancellation of signs is involved.

In terms of the trace , the same special map is , and the corresponding identity is

The right-hand side is the negative of the discriminant of . Already we are being invited to associate a quadratic equation to the Frobenius map. We will return to this in the discussion of the zeta function, and we will actually derive the quadratic equation rather than assume it.

Example:

Let over . The squares in are . Calculate for all five possible values of :

There are affine points, and including gives . The sum of quadratic characters is , while the trace is . Thus

We can now rewrite the right side without any abstract argument:

The quadratic form is visibly nonnegative. Choosing gives

And we indeed have . The point of the example is not that we needed a sophisticated proof to count eight points. We obviously did not. It is that the same point count becomes the cross-term in a family of degrees, and the family imposes the sharp general restriction. If we change the curve, the integer changes, but the leading coefficients and remain determined by Frobenius and the identity. The algebraic positivity continues to constrain their interaction.

One can also see the difference between geometry and arithmetic in this example. Over the algebraic closure, the three nonzero points of order two are , and here they all happen to be rational over . The doubling map has degree four, just as predicted. Meanwhile the Frobenius map has degree five, despite acting as the identity on the eight rational points we just listed. Finally, the map has degree eight; its eight simple zeros are exactly those eight rational points. These are different maps with different degrees, and the relation among their degrees is precisely what the proof exploits.

We have proved the Hasse bound, so in one sense our task is complete. But the degree viewpoint gives us more, and it would be a pity to stop at the inequality. The same ideas can explain why the zeta function of an elliptic curve has a quadratic numerator and why the point counts over different finite extensions satisfy a two-term linear recurrence. This connection is particularly satisfying because it shows that the quadratic polynomial has not appeared merely as a convenient inequality. Frobenius itself satisfies a quadratic equation inside the ring of algebraic maps of the curve.

Let us use . We already know

We will prove the identity of maps

Here is the -power Frobenius, means multiplication by after Frobenius, and is multiplication by on the elliptic-curve group. The right side is the zero homomorphism. To prove an equality of maps, we can try to show that their difference has degree zero: a nonzero homomorphism has strictly positive degree, so degree zero forces the zero map.

We need only a few degree calculations. First, composition gives

Second, the identity is valid because both factors are polynomials in the same commuting map . Therefore multiplicativity of degree gives

Since , apply this with and :

Third, observe that . Hence

Subtracting the two diagonal degrees gives

Now expand the degree of using the quadratic formula and the bilinear pairing. Every term is known:

Therefore is the zero homomorphism, which is precisely

This is an important strengthening of the point-counting argument. We have not used the zeta function or any abstract theory of eigenvalues to obtain it. We derived the identity directly from the same root-counting degree, its composition law, and its parallelogram law. The entire trace–determinant picture of Frobenius is encoded in those algebraic operations.

Notice also why the integer occupies the position of the constant coefficient. The degree of Frobenius is , just as the determinant of a linear transformation measures its scaling of two-dimensional area. The middle coefficient was recovered from the mixed degree pairing with the identity, just as a trace measures a linear transformation through a first-order cross-term. We have not literally identified a two-dimensional linear representation, but the identities explain why such representations naturally appear in more advanced treatments using Tate modules and étale cohomology.

Extension Fields

Now let us count points over rather than only . Write

A point is defined over precisely when its coordinates are fixed by raising to the -th power. Thus

Exactly the same local calculation as before shows that has derivative in the local parameter at the identity: Frobenius to the -th power sends to , so

Every fixed point is consequently simple, by translation. Therefore

Since by composition, the same mixed-degree calculation gives

Define for . For , the map is , and

For , we have . Now compose the Frobenius quadratic equation with , for any . We get an identity of homomorphisms,

The degree pairing is additive in its first argument, so pairing the identity with gives the recurrence

Here we can see the advantage of proving the map identity, rather than only the numerical Hasse bound: the map identity forces the point counts over all extensions to follow one common recurrence. For example,

Therefore

There is no fresh character-sum analysis required over the larger fields once we know and the single integer . All extension counts are already encoded in the Frobenius map over the base field.

Let be the complex roots of

Thus and . Both sequences and satisfy the recurrence , because and likewise for . Their sum has initial values and . By uniqueness of the recurrence solution,

This is the familiar formula for elliptic-curve point counts, but now we have obtained it by a chain of computations starting with the chord-and-tangent operation and root-counting degrees. In particular, we did not need to assume that Frobenius has two eigenvalues. We obtained a quadratic relation and then introduced the two complex roots as a convenient way of solving its recurrence.

For our running example over , we found . Thus , and the first few values are

All these point counts come from the same trace . The arithmetic of the infinitely many extension fields is constrained by a single quadratic recurrence.

The zeta function, and the finite-field Riemann hypothesis

The zeta function packages the entire sequence of point counts into one formal power series:

The definition may initially look somewhat artificial. Why exponentiate, and why divide by ? There is an analogy with the Euler product of the Riemann zeta function. A closed point of a curve over corresponds to a finite orbit under Frobenius. If an orbit has length , it contributes points to exactly when divides . If denotes the number of Frobenius orbits of length , then

Substitute this into the logarithm of and rearrange the formal series:

Exponentiating gives the Euler-product form

Thus the zeta function really is a generating function built from the prime-like closed points of the curve, just as the classical zeta function is built from ordinary prime numbers. The logarithmic derivative counts rational points over successive extensions, much as logarithmic derivatives of Euler products count primes and prime powers. This is a useful conceptual connection for analytic number theory: in one setting the basic dynamics is multiplication of integers by primes; in the other it is iteration of Frobenius on algebraic points.

Now substitute our point-count formula . We use the formal identity . Then

Exponentiating and using , , we obtain the rational expression

So the rationality of the elliptic-curve zeta function is not a separate mysterious assertion in our development. It follows from the quadratic equation of Frobenius, which we derived from degree. The denominator records the elementary terms ; the numerator records the arithmetic error . The zeta function is a compressed record of the very same cancellation problem with which we began.

Now where is the Riemann hypothesis? Recall that our positivity argument gave . Since is real and , the roots of are either a complex-conjugate pair or, at equality, the repeated real root . In the conjugate case, and . At equality, . Therefore in all cases

The numerator of vanishes at and , so all its zeros lie on the circle

This is the finite-field Riemann hypothesis for our elliptic curve. The point-counting formulation and the location-of-zeros formulation are two consequences of the same positivity of degree. Indeed, the former bounded , and the latter is exactly what that bound says about the roots of a quadratic polynomial with constant term .

The extension-field estimate is now immediate and slightly more informative than an isolated application of Hasse’s theorem. From and , we obtain

The exponent has therefore emerged from iterating two algebraic numbers of modulus . Again, the same phenomenon can be viewed in three ways: square-root cancellation in character sums, positivity in a quadratic degree form, or the absolute value of the inverse zeros of a zeta function.

Remarks: There are a few mathematical connections worth making explicit before finishing. They are not extra ingredients needed to complete the proof; they are ways of organizing the ideas and of anticipating their generalizations.

One is to regard as something like a squared length in the abelian group of endomorphisms. The formula

is a binary quadratic form with matrix

Its diagonal terms are fixed by the degrees of the two maps, and the off-diagonal term measures their interaction. Nonnegativity implies the determinant is nonnegative: . This is literally the same algebra that proves the Cauchy–Schwarz inequality from the nonnegativity of . The elliptic curve supplies a remarkable example in which the squared length is not originally defined geometrically or analytically but as a number of solutions of polynomial equations.

A second connection is to the norm from a quadratic algebra. After the Hasse bound, the two roots of satisfy . We can rewrite the degree formula as

In other words, once the theorem has been proved, our mysterious degree quadratic form looks exactly like the complex absolute-value norm on the lattice generated by and . This is suggestive of the theory of complex multiplication and of the endomorphism algebra of an elliptic curve. Importantly, we did not use this complex norm as an input: it is an interpretation made possible by the positivity proof. That is the right logical direction if our purpose is to discover the origin of the square-root bound rather than hide it behind an assumed complex embedding.

A third connection concerns the equality case. Suppose . Then , and our special map has degree zero:

Therefore the map itself vanishes: . Since is an integer and , equality can occur only when is a square. Write and . Then the quadratic formula also gives

with the sign chosen to match . Hence . The extreme point-counting error corresponds to a very strong algebraic degeneracy: Frobenius itself is simply an integer multiplication map. Thus sharpness of Hasse’s inequality has a structural interpretation, not just a numerical one.

A fourth connection is to what makes genus one special. The addition law above relies on the fact that every degree-zero divisor class on a nonsingular genus-one curve with a chosen base point can be represented by a unique point minus that base point. We proved the injection directly and used the chord construction to see closure under addition. On a curve of larger genus, a single point is no longer enough to represent a general degree-zero divisor class. One instead forms the Jacobian, whose points are degree-zero divisor classes. The Jacobian is an abelian variety, so the same basic philosophy survives: use algebraic addition to make Frobenius part of a positive quadratic or Hermitian structure, and extract bounds on its eigenvalues. The higher-genus Riemann hypothesis is much more involved than what we have proved here, but one can already recognize the ingredients—Frobenius, divisors, positivity, and degree in this concrete genus-one model.

Finally, there is a broader way to think about cancellation. Direct estimates of exponential sums usually search for oscillation by transforming, differencing, or correlating the terms. Those are powerful methods, but they are not the only possible route to square-root cancellation. Sometimes an oscillatory quantity is the trace or mixed term of an algebraic object that has a positivity theorem. The cancellation is then not produced by a pairing of positive and negative terms in the original sum; it is forced because a suitable norm, intersection number, or degree cannot be negative. The present proof is a particularly transparent instance of that phenomenon, precisely because its norm is ultimately a count of roots of explicit rational equations.

Conclusion:

Let us return to the original sum and trace the chain of ideas one more time, without suppressing the reason each step was possible. We wanted to estimate

The elementary count of solutions of told us . The first new structure came from the fact that a line meets a cubic at three points. Substituting a line into the equation gave explicit rational formulas for adding two points, and recording zeros and poles of the line and of vertical lines explained why the operation is associative. These were not disconnected geometric and algebraic descriptions; they were two versions of the same relation among three intersection points. Next, the addition law let us construct homomorphisms such as and . The first coordinate of any homomorphism was a rational function of alone, so its degree could be defined as the larger of its numerator and denominator degrees. This was a concrete generic root count, not an arbitrary abstract number. We checked that doubling had degree four, and that Frobenius had degree , despite having only one distinct geometric preimage of a general point. That was our first encounter with the indispensability of multiplicities. The key calculation then took the rational function and analyzed its zeros and poles. Its zeros occurred when , or equivalently when . Its poles came from the double pole of at infinity. The overlap cases required the factorization of an even Laurent series in the formal local parameters, which is what made the identity valid even for inseparable maps. Summing all local orders gave

This made degree quadratic and supplied a bilinear cross-term. The kernel of consisted exactly of the -rational points, and the local expansion showed that all those points were simple. Hence , and the cross-term between Frobenius and the identity was . The resulting degree identity was

Its nonnegativity, evaluated at the actual integer pair , gave

This established Hasse’s bound. The same quadratic degree structure then produced the identity , the recurrence for point counts over extension fields, and the rational zeta function

The inequality says that the inverse roots of the numerator have modulus , which is exactly the Riemann hypothesis for our elliptic curve.

The original question was: why should a sum of signs have error of size rather than size ? Our answer is not that we found an especially clever way to arrange the signs. We found that the sum is the mixed coefficient of a quadratic form whose values are degrees of algebraic maps. And once the sum is placed in that structure, the square-root restriction is no longer surprising. It is the same mathematical necessity that says a squared length cannot be negative.