COMPUTING THE CASSELS-TATE PAIRING ON 3-ISOGENY SELMER GROUPS VIA CUBIC NORM EQUATIONS

MONIQUE VAN BEEK AND TOM FISHER

Abstract. We explain a method for computing the Cassels-Tate pairing on the 3-isogeny Selmer groups of an elliptic curve. This improves the upper bound on the rank of the elliptic curve coming from a descent by 3-isogeny, to that coming from a full 3-descent. One ingredient of our work is a new algorithm for solving cubic norm equations, that avoids the need for any S-unit computations. As an application, we show that the elliptic curves with torsion subgroup of order 3 and rank at least 13, found by Eroshkin, have rank exactly 13.

Introduction

Let E be an elliptic curve over a number field K. By the Mordell-Weil theorem, the rational points E(K) form a finitely generated abelian group. The number of points needed to generate the non-torsion part of E(K) is called the rank. Determining the rank is a non-trivial problem, and indeed there is no known algorithm that will compute it in all cases.

We may however bound the rank by following the proof of the Mordell-Weil theorem. For each integer n ≥ 2, the n-Selmer group S^{(n)}(E/K) classifies the n-coverings of E that have points everywhere locally. This group is finite and effectively computable. Since E(K)/nE(K) injects into S^{(n)}(E/K), computing the n-Selmer group gives an upper bound for the rank. This process is known as (full) n-descent. In view of the short exact sequence

(1)  0 ⟶ E(K)/nE(K) ⟶ S^{(n)}(E/K) ⟶ � (E/K)[n] ⟶ 0

the rank bound coming from n-descent may be improved whenever the Tate-Shafarevich group � (E/K) contains non-trivial n-torsion.

Cassels [Cas62] defined an alternating pairing (now known as the Cassels-Tate pairing)

� (E/K) × � (E/K) ⟶ ℚ/ℤ

with the property that � (E/K)[n] and n� (E/K) are exact annihilators. One consequence is that if � (E/K) is finite (as conjectured by Tate and Shafarevich) then its order is a square. Another consequence is that we can sometimes use the pairing to detect non-trivial elements of � (E/K). Specifically, computing the pairing on S^{(n)}(E/K) improves the rank bound coming from n-descent, to that coming from n^{2}-descent. Thus, for example, Cassels used the pairing in [Cas98] to turn a 2-descent into a 4-descent, and to some extent this has been generalised in [SD13], [FN14], [Don15].

Date: 7th November 2017.

2010 Mathematics Subject Classification. 11G05, 11Y40.

Key words and phrases. elliptic curves, Cassels-Tate pairing, descent, norm equations.

Descent calculations become very much more tractable in the case that our elliptic curve admits a rational p-isogeny for some prime p. This is the situation we consider in this paper. We write ϕ : E → E′ for the p-isogeny, and ϕ̂: E′ → E for its dual. Since ϕ̂ ∘ ϕ is multiplication-by-p, there is an exact sequence

0 ⟶E(K)[ϕ] ⟶ E(K)[p] ⟶^{ϕ} E′(K)[ϕ̂]
⟶ E′(K)/ϕE(K) \underrightarrow{ϕ̂} E(K)/pE(K) ⟶ E(K)/ϕ̂E′(K) ⟶ 0,

from which we deduce that

p^{rank E(K)} = \frac{|E(K)/pE(K)|}{|E(K)[p]|} = \frac{|E′(K)/ϕE(K)| · |E(K)/ϕ̂E′(K)|}{|E(K)[ϕ]| · |E′(K)[ϕ̂]|}.

Analogous to (1) there are exact sequences

0 ⟶ E′(K)/ϕE(K) ⟶ S^{(ϕ)}(E/K) ⟶ � (E/K)[ϕ_{∗}] ⟶ 0,

and

0 ⟶ E(K)/ϕ̂E′(K) ⟶ S^{(ϕ̂)}(E′/K) ⟶ � (E′/K)[ϕ̂_{∗}] ⟶ 0.

Computing the Selmer groups S^{(ϕ)}(E/K) and S^{(ϕ̂)}(E′/K) gives an upper bound for the rank. This process is known as descent by p-isogeny, and is described for example in [Top93, DeL02, Fis01, Fis03, SS04, FG08, MS13].

There is a commutative diagram with exact rows

[figure: E′(K)[ϕ̂]; E′(K)/ϕE(K); E(K)/pE(K); E(K)/ϕ̂E′(K); E′(K)[ϕ̂]; S^{(ϕ)}(E/K); S^{(p)}(E/K); S^{(ϕ̂)}(E′/K)]

where the final map in the second row need not be surjective. Instead its image is the kernel of the Cassels-Tate pairing

(2)  ⟨ , ⟩_{CT} : S^{(ϕ̂)}(E′/K) × S^{(ϕ̂)}(E′/K) → ℚ/ℤ.

This pairing is the lift of the one on � (E′/K)[ϕ̂_{∗}]. Computing the pairing (2) allows us to turn a descent by p-isogeny into a full p-descent. If the pairing is non-zero then this improves our upper bound for the rank.

The case p = 2 is treated in [Fis17], so from now on we take p an odd prime. In the first of his series of papers on elliptic curves, Cassels [Cas59] showed how to compute the pairing (2) when p = 3 and E′ takes the form x^{3} + y^{3} = k. The case where p = 3 or 5 and E[p] ≅ μ_{p} × ℤ/pℤ was treated in [Fis03].

We describe a method for computing the pairing (2) in the cases where E[ϕ] is isomorphic (as a Galois module) to either μ_{p} or ℤ/pℤ. In both cases the global part of our method requires us to solve a norm equation N_{L/K}(ξ) = a where L/K is a field extension of degree p. Moreover, when p = 3 and E[ϕ] ≅ ℤ/3ℤ, we have L = K(\sqrt[3]{b}) for some b ∈ K. In the case K = ℚ we give an algorithm for solving such norm equations, that avoids the need for any S-unit computations. This enables us to apply our methods to elliptic curves with large discriminant.

One particular computational challenge is to find elliptic curves over ℚ of large rank with a given torsion subgroup. The current records are listed on Dujella’s website [Duj17]. Between 2007 and 2009, Y.G. Eroshkin found the following five elliptic curves with torsion subgroup ℤ/3ℤ and rank at least 13.

y^{2} + 10154960719xy − 66798078951809458114391930400y = x^{3}  17
y^{2} + 8412073331xy + 7384158420201525518270114400y = x^{3}  13
y^{2} + 19223749711xy − 435665346791890005577936749600y = x^{3}  13
y^{2} + 8589423667xy − 30679410326232604531989794400y = x^{3}  17
y^{2} + 35429815349xy − 169064164426703584254124708800y = x^{3}  15

The number on the right is the upper bound for the rank obtained by descent by 3-isogeny. By computing the Cassels-Tate pairing we were able to verify that each of these curves has rank exactly 13. This is the largest known rank for an elliptic curve with torsion subgroup ℤ/3ℤ.

We have also used the methods of this paper to find new examples of elliptic curves with torsion subgroup ℤ/9ℤ and ranks 3 and 4 (see [vB15, Duj17]). In contrast, when we searched for elliptic curves with torsion subgroup ℤ/12ℤ and rank 4 we could not find any examples beyond the one already known. For both of these torsion subgroups the largest known rank is 4.

In Section 1 we recall the definition of the Cassels-Tate pairing that is relevant to our work. In Section 2 we give an explicit description of the long exact sequence

(3)  H^{1}(K, E[ϕ]) → H^{1}(K, E[p]) → H^{1}(K, E′[ϕ̂]) → H^{2}(K, E[ϕ])

in terms of étale algebras, and explain how lifting an element of H^{1}(K, E′[ϕ̂]) to H^{1}(K, E[p]) comes down to solving a norm equation. As indicated above, we concentrate on the cases where E[ϕ] ≅ μ_{p} or E[ϕ] ≅ ℤ/pℤ. Since it is always possible to reduce to one of these two cases by making a field extension of degree coprime to p, this is perhaps not such a severe restriction.

In Section 3 we present our new algorithm for solving norm equations for pure cubic extensions ℚ(\sqrt[3]{b})/ℚ. It is based on the Legendre-type method for solving conics in [CR03]. When applied to suitably large examples, our algorithm performs much better than the standard approach using S-units, as described for example in [Coh00, Section 7.5], [Sim02].

In Section 4 we give three examples computing the pairing (2) in the case K = ℚ with E[ϕ] ≅ μ_{3} or E[ϕ] ≅ ℤ/3ℤ. The first two examples are small, and so do not require any special methods to solve the norm equations. In the third example, where we consider one of Eroshkin’s curves with torsion subgroup ℤ/3ℤ, we are entirely reliant on the methods in Section 3.

It is interesting to remark that if we solve norm equations by the method in Section 3, then the simplest case is when E[ϕ] ≅ ℤ/3ℤ. However, if we solve norm equations by trivialising the corresponding cyclic algebra (using the method in [CFO^{+}15]) then the simplest case is when E[ϕ] ≅ μ_{3}. For a general 3-isogeny we may reduce to either one of these two simplest cases at the expense of making a quadratic extension to our base field.

An alternative approach to improving a descent by p-isogeny to a full p-descent is described in [CM12]. The method there does however require a rigorous computation of S-units in a degree p extension of K. In contrast, we are free to solve norm equations by any method we like, since once a solution is found it is straightforward to verify it is correct.

The following notation will be used throughout. For K a field, we write \overline{K} for its separable closure and G_{K} = Gal(\overline{K}/K) for its absolute Galois group. The Galois cohomology group H^{i}(G_{K}, −) is abbreviated as H^{i}(K, −), and we write Hom(G_{K}, −) for the continuous homomorphisms. The unit group of a ring R is denoted R^{×}. We write μ_{p} for the group of pth roots of unity, and ζ_{p} for a generator.

The calculations in Section 4 were carried out using Magma [BCP97]. This paper is based on the first author’s PhD thesis [vB15].

1. The Cassels-Tate pairing

In this section, we define the global Cassels-Tate pairing (2). The definition is given as a sum of local pairings, so we define these first. Let K_{v} denote the localisation of K at a place v. The Weil pairing e_{ϕ} : E[ϕ] × E′[ϕ̂] → μ_{p} induces by cup product a pairing

∪ : H^{1}(K_{v}, E[ϕ]) × H^{1}(K_{v}, E′[ϕ̂]) → H^{2}(K_{v}, μ_{p}).

It terms of cocycles we have (ξ ∪ η)_{σ,τ} = e_{ϕ}(ξ_{σ}, σ(η_{τ})). Since H^{2}(K_{v}, μ_{p}) ≅ Br(K_{v})[p] we can then apply the invariant map inv_{K_{v}} : Br(K_{v}) → ℚ/ℤ, from local class field theory, to obtain the local Tate pairing:

(4)  ⟨ , ⟩_{v,e_{ϕ}} : H^{1}(K_{v}, E[ϕ]) × H^{1}(K_{v}, E′[ϕ̂]) → ℚ/ℤ.

1.1. The global pairing. Taking Galois cohomology of the short exact sequences

[figure: 0; E[ϕ]; ι; E[p]; ϕ; E′[ϕ̂]; 0; 0; E[ϕ]; E; ϕ; E′; 0]

we obtain a commutative diagram with exact rows

(5)  \xymatrix{H^{1}(K, E[p]) \ar[r]^{ϕ_{∗}} \ar[d] & H^{1}(K, E′[ϕ̂]) \ar[r] \ar[d] & H^{2}(K, E[ϕ]) \ar[d] \\ ∏_{v} H^{1}(K_{v}, E) \ar[r] & ∏_{v} H^{1}(K_{v}, E′) \ar[r] & ∏_{v} H^{2}(K_{v}, E[ϕ]).}

Lemma 1.1. Any element x ∈ S^{(ϕ̂)}(E′/K) can be lifted to x_{1} ∈ H^{1}(K, E[p]) with ϕ_{∗}(x_{1}) = x.

Proof. The Selmer group S^{(ϕ̂)}(E′/K) is by definition the kernel of the middle vertical map in (5). By a diagram chase, it suffices to show that the right hand vertical map is injective. Making a finite extension L/K of degree coprime to p, we may ensure that E[ϕ] ≅ μ_{p} over L, and so H^{2}(L, E[ϕ]) ≅ Br(L)[p]. Let v be a place of K. Then we have the following commutative diagram.

\xymatrix{H^{2}(K, E[ϕ]) \ar[r]^{Res} \ar[d]_{_{loc_{1}}} & H^{2}(L, E[ϕ]) \ar[d]_{_{loc_{2}}} \ar[r]^{Cor} & H^{2}(K, E[ϕ]) \ar[d]_{_{loc_{1}}} \\ H^{2}(K_{v}, E[ϕ]) \ar[r]^{Res} & ⊕_{w|v}H^{2}(L_{w}, E[ϕ]) \ar[r]^{Cor} & H^{2}(K_{v}, E[ϕ])}

By global class field theory, the following exact sequence holds for any number field L.

0 ⟶ Br(L) ⟶ ⨁_{w} Br(L_{w}) \underrightarrow{∑ inv_{w}} ℚ/ℤ ⟶ 0

Thus the map ∏_{v} loc_{2} is injective. By [GS06, Proposition 3.3.7] the composite Cor ∘ Res is multiplication by n = [L : K]. The kernel of ∏_{v} loc_{1} is now both p-torsion and n-torsion. Since p and n are coprime, it follows that ∏_{v} loc_{1} is injective as required. □

The Kummer exact sequences for [p] : E → E and ϕ̂: E′ → E give the rows of the following commutative diagram

(6)  [figure: H^{1}(K, E[ϕ]); ι_{∗}; E(K); p; ϕ; E(K); δ_{p}; H^{1}(K, E[p]); ϕ_{∗}; E′(K); ϕ̂; E(K); δϕ̂; H^{1}(K, E′[ϕ̂]).]

The right hand column is the long exact sequence (3). We also consider the analogue of this diagram with K replaced by K_{v}. In the terminology of [PS99], the following is the “Weil pairing definition” of the Cassels-Tate pairing.

Definition 1.2 (Definition of the Cassels-Tate pairing). Let x, y ∈ S^{(ϕ̂)}(E′/K). By Lemma 1.1 there exists x_{1} ∈ H^{1}(K, E[p]) with ϕ_{∗}(x_{1}) = x. We write x_{v}, y_{v}, x_{1,v} for the localisations of x, y, x_{1} at a place v. For each place v we pick P_{v} ∈ E(K_{v}) with δϕ̂(P_{v}) = x_{v}. Then x_{1,v} − δ_{p}(P_{v}) = ι_{∗}(ξ_{v}) for some ξ_{v} ∈ H^{1}(K_{v}, E[ϕ]). The Cassels-Tate pairing is defined as

⟨x, y⟩_{CT} = ∑_{v}⟨ξ_{v}, y_{v}⟩_{v,e_{ϕ}}

where the sum is over all places v of K, and ⟨ , ⟩_{v,e_{ϕ}} is the local Tate pairing (4).

It may be shown that the pairing is independent of the choice of global lift x_{1} and the choices of local points P_{v}. For further details, and properties of the pairing, see for example [Cas62, Mil06, McC88, PS99, Fis03].

As we describe in the next section, the local Tate pairing is closely related to the Hilbert norm residue symbol. It can therefore be computed using standard techniques. A more serious problem is that of computing a global lift x_{1} of x. In Section 2 we explain how this may be reduced to solving a norm equation. This then motivates our work on norm equations in Section 3.

1.2. Computing the local pairing. Let p be a prime. Let ϕ : E → E′ be a p-isogeny of elliptic curves defined over a number field K. We fix L/K a finite Galois extension of degree coprime to p, such that all points in the kernels of ϕ and ϕ̂ are defined over L. By properties of the Weil pairing we have μ_{p} ⊂ L. We may therefore fix isomorphisms E[ϕ] ≅ μ_{p} and E′[ϕ̂] ≅ μ_{p} over L. These maps induce, by restriction and the Kummer isomorphism, injective group homomorphisms

\overline{w}_{ϕ} : H^{1}(K, E[ϕ]) ⟶ L^{×}/(L^{×})^{p},

and

\overline{w}ϕ̂ : H^{1}(K, E′[ϕ̂]) ⟶ L^{×}/(L^{×})^{p}.

We also write \overline{w}_{ϕ} and \overline{w}ϕ̂ for the local analogues of these maps.

Lemma 1.3. There exists a primitive pth root of unity ζ_{p} ∈ L such that for all places v of K the local Tate pairing (4) is given by

(7)  ⟨x, y⟩_{v,e_{ϕ}} = \frac{1}{[L_{w} : K_{v}]}Ind_{ζ_{p}}(\overline{w}_{ϕ}(x), \overline{w}ϕ̂(y))_{w}

where w is any place of L dividing v,

( , )_{w} : L_{w}^{×}/(L_{w}^{×})^{p} × L_{w}^{×}/(L_{w}^{×})^{p} → μ_{p}

is the Hilbert norm residue symbol, and Ind_{ζ_{p}} : μ_{p} → \frac{1}{p}ℤ/ℤ is the isomorphism sending ζ_{p} ↦ \frac{1}{p}.

Proof. We first treat the case L = K. The pairing

(8)  μ_{p} × μ_{p} → μ_{p}; (ζ_{p}^{a}, ζ_{p}^{b}) ↦ ζ_{p}^{ab}

induces by cup product, the Kummer isomorphism and the local invariant map, a pairing

\{ , \}_{v} : K_{v}^{×}/(K_{v}^{×})^{p} × K_{v}^{×}/(K_{v}^{×})^{p} → \frac{1}{p}ℤ/ℤ.

The Hilbert norm residue symbol is (x, y)_{v} = ζ_{p}^{p{x,y}_{v}}. By [Ser79, Prop. XIV.2.6] it is independent of the choice of ζ_{p}.

If we make an appropriate choice of ζ_{p} then our identifications E[ϕ] ≅ μ_{p} and E′[ϕ̂] ≅ μ_{p} identify the Weil pairing e_{ϕ} : E[ϕ] × E′[ϕ̂] → μ_{p} with (8). This proves (7). The general case, with L ≠ K, follows by standard properties of the cup product and the local invariant map under restriction, for which we refer to [CF10, Proposition IV.7.9(iii)] and [CF10, Theorem VI.1.3]. □

Remark 1.4. In practice we are happy to compute the Cassels-Tate pairing up to an overall scaling. Therefore the choice of ζ_{p} in Lemma 1.3 does not matter, provided that the same global choice is used in all our local calculations.

We now suppose that μ_{p} ⊂ K_{v} and describe some methods for computing the Hilbert norm residue symbol. In fact the symbol may be defined with p replaced by any integer m ≥ 2, and we now work in this generality.

Proposition 1.5. Assume that μ_{m} ⊂ K_{v}. The Hilbert norm residue symbol

( , )_{v} : K_{v}^{×}/(K_{v}^{×})^{m} × K_{v}^{×}/(K_{v}^{×})^{m} → μ_{m}

has the following properties.

(i) (a, b)_{v}(a, c)_{v} = (a, bc)_{v} (ii) (a, b)_{v} = 1 if b is a norm for the extension K_{v}( \sqrt[m]{a})/K_{v}. In particular

(a, −a)_{v} = (a, 1 − a)_{v} = 1.

(iii) (a, b)_{v}(b, a)_{v} = 1 (iv) If v = 𝔭 is a prime not dividing m and v_{𝔭}(a) = 0 then

(a, b)_{v} = (\frac{a}{𝔭})^{v_{𝔭}(b)} where (\frac{a}{𝔭}) ≡ a^{\frac{N𝔭−1}{m}} (mod 𝔭).

Proof. See [CF10, Exercise 2] or [Gra03, Proposition II.7.1.1]. □

Proposition 1.5 can be used to compute (a, b)_{v} whenever v ∤ m∞. Taking m = p an odd prime, the following will suffice for our purposes in the case v | p. Let K = ℚ(ζ_{p}). Then λ = 1 − ζ_{p} generates the unique prime of K lying over p. It is shown in [CF10, Exercise 2.13] that K_{v}^{×}/(K_{v}^{×})^{p} has basis λ, η_{1}, …, η_{p} where η_{i} = 1 − λ^{i}, and an explicit recipe is given for computing the Hilbert norm residue symbol. In the case p = 3 this works out as

(9)  \begin{aligned}& λ & η_{1} & η_{2} & η_{3} \\ λ & 0 & 0 & 0 & ζ_{3}^{2} \\ η_{1} & 0 & 0 & ζ_{3} & 0 \\ η_{2} & 0 & ζ_{3}^{2} & 0 & 0 \\ η_{3} & ζ_{3} & 0 & 0 & 0 \end{aligned}

2. Galois cohomology

In this section, we give an explicit description of the long exact sequence (3) in terms of étale algebras. As explained in Section 1 this will enable us to compute the Cassels-Tate pairing.

2.1. Etale algebras. Following [SS04] we interpret the Galois cohomology groups in (3) in terms of étale algebras. This makes the groups more amenable for practical computation. We work over a field K of characteristic 0.

Let Φ be a finite set with G_{K}-action. The étale algebra D associated to Φ is the set of all G_{K}-equivariant maps Φ → \overline{K}. This is a K-algebra under pointwise operations. If P_{1}, …, P_{n} ∈ Φ are representatives for the G_{K}-orbits then evaluation at these points gives an isomorphism

D ≅ K(P_{1}) × … × K(P_{n}).

In particular D is a product of finite field extensions of K. We also write \overline{D} = D ⊗_{K} \overline{K}. This is the \overline{K}-algebra of all maps Φ → \overline{K}.

We fix p an odd prime. Let ψ : E → E′ be an isogeny of elliptic curves with E[ψ] ⊂ E[p], and let ψ̂ be its dual. Let D be the étale algebra of E′[ψ̂]. Let

w_{ψ} : E[ψ] ⟶ μ_{p}(\overline{D})
P ⟼ (Q ↦ e_{ψ}(P, Q)),

be the map induced by the Weil pairing e_{ψ}. This induces a map on H^{1}’s that on composing with the Kummer isomorphism gives a group homomorphism

\overline{w}_{ψ} : H^{1}(K, E[ψ]) ⟶ D^{×}/(D^{×})^{p}.

Now let ϕ : E → E′ be a p-isogeny. The Weil pairings e_{ϕ}, e_{p} and eϕ̂ are compatible in the sense that they give an isomorphism between the exact sequence

(10)  0 ⟶ E[ϕ] ⟶^{ι} E[p] ⟶^{ϕ} E′[ϕ̂] ⟶ 0.

and the exact sequence of Cartier duals. Let A_{1}, A_{2} and A be the étale algebras of E′[ϕ̂], E[ϕ] and E[p]. By the compatibility of the Weil pairings, we obtain a commutative diagram

(11)  \xymatrix{H^{1}(K, E[ϕ]) \ar[d]_{_{\overline{w}_{ϕ}}} \ar[r]^{ι_{∗}} & H^{1}(K, E[p]) \ar[d]_{_{\overline{w}_{p}}} \ar[r]^{ϕ_{∗}} & H^{1}(K, E′[ϕ̂]) \ar[d]_{_{\overline{w}ϕ̂}} \\ A_{1}^{×}/(A_{1}^{×})^{p} \ar[r]^{ϕ^{∗}} & A^{×}/(A^{×})^{p} \ar[r]^{ι^{∗}} & A_{2}^{×}/(A_{2}^{×})^{p}}

where the first row is (3), i.e. the long exact sequence associated to (10). The maps in the second row (which is not exact) are the pull backs by ϕ and ι.

It is shown in [SS04, Section 5] that the vertical maps in (11) are injective, and their images are described as follows. We fix g a primitive root mod p, and let σ_{g} be the automorphism of A_{1}, A_{2} or A given by (σ_{g}α)(P) = α(gP). By [SS04, Lemma 5.2] we have

(12)  H^{1}(K, E[ϕ]) ≅ ker(g − σ_{g} : A_{1}^{×}/(A_{1}^{×})^{p} → A_{1}^{×}/(A_{1}^{×})^{p})

and likewise for H^{1}(K, E′[ϕ̂]). The corresponding description of H^{1}(K, E[p]) involves the set Λ of affine lines in E[p] that do not pass through the origin O. Let B be the étale algebra of Λ. Then the map

u : μ_{p}(\overline{A}) → μ_{p}(\overline{B}); α ↦ (ℓ ↦ ∏_{P ∈ℓ} α(P))

induces a map on H^{1}’s, and so by the Kummer isomorphism gives us a group homomorphism \overline{u} : A^{×}/(A^{×})^{p} ⟶ B^{×}/(B^{×})^{p}.

Theorem 2.1 (Schaefer-Stoll [SS04, Corollary 5.9]).

H^{1}(K, E[p]) ≅ ker(g − σ_{g} : A^{×}/(A^{×})^{p} → A^{×}/(A^{×})^{p}) ∩ ker(\overline{u}).

In fact we have A ≅ K × A′ where A′ is the étale algebra of E[p] \ {O}, and in Theorem 2.1 we are free to replace A by A′. This description of H^{1}(K, E[p]) can sometimes be simplified using the following lemma.

Lemma 2.2. Let α ∈ Im(\overline{w}_{p}) ⊂ A^{×}/(A^{×})^{p}. If S, T ∈ E[p] then

\frac{α(S)α(T)}{α(S + T)} ∈ (K(S, T)^{×})^{p}.

Proof. See [CFO^{+}08, Lemma 3.8]. □

Let E/K be an elliptic curve and G the image of the mod p Galois representation \overline{ρ}_{E,p} : G_{K} → GL(E[p]). Fixing a basis S, T for E[p], this is a subgroup of GL_{2}(ℤ/pℤ). In the next two sections we consider two specific possibilities for G, which we call the μ_{p}-nonsplit and ℤ/pℤ-nonsplit cases. The case where E[p] splits as μ_{p} × ℤ/pℤ is significantly easier, as described in [McC88], [Fis03].

2.2. μ_{p}-nonsplit case. We consider E/K an elliptic curve whose mod p Galois representation has image

G = \{(\begin{matrix}∗ & ∗ \\ 0 & 1 \end{matrix})\} ⊂ GL_{2}(ℤ/pℤ)

generated by σ = ( \begin{matrix}1 & 1 \\ 0 & 1 \end{matrix} ) and τ = ( \begin{matrix}g & 0 \\ 0 & 1 \end{matrix} ) where g is a primitive root mod p. Thus we have a basis S, T of E[p] such that

σ(S) = S  τ(S) = gS
σ(T) = S + T  τ(T) = T.

Note that τσ = σ^{g}τ. Let L_{1} = K(S) = K(ζ_{p}), L_{2} = K(T) and M = K(E[p]).

[figure: M; ⟨σ⟩; ⟨τ⟩; C_{p}; L_{1}; p−1; L_{2}; p; K; G]

Recall that p is an odd prime. Let χ_{cyc} : G_{K} → (ℤ/pℤ)^{×} be the cyclotomic character. Then for N a (ℤ/pℤ)[G_{K}]-module we write N^{(i)} for the eigenspace where G_{K} acts as χ_{cyc}^{i}.

Theorem 2.3. We have H^{1}(K, E[p]) ≅ H, where H is the group of pairs (a, b) ∈ (L_{1}^{×}/(L_{1}^{×})^{p})^{(1)} × L_{2}^{×}/(L_{2}^{×})^{p} satisfying N_{L_{2}/K}(b) ∈ (K^{×})^{p} and σ(b)/(ab) ∈ (M^{×})^{p}.

Proof. We use the description of H^{1}(K, E[p]) in Theorem 2.1 as the intersection of ker(g − σ_{g}) and ker(\overline{u}).

There are p orbits for the action of G_{K} on E[p] \ {O}, with representatives S and iT for i ∈ {1, …, p − 1}. Therefore H^{1}(K, E[p]) ⊂ A^{′×}/(A^{′×})^{p} where

A′ ≅ L_{1} × \underbrace{L_{2} × … × L_{2}}_{p−1} .

Moreover (a, b_{1}, b_{2}, …, b_{p−1}) ∈ A^{′×}/(A^{′×})^{p} belongs to ker(g − σ_{g}) if and only if a ∈ (L_{1}^{×}/(L_{1}^{×})^{p})^{(1)} and b_{i} ≡ b_{1}^{i} mod (L_{2}^{×})^{p} for all i ∈ {1, …, p − 1}. Accordingly we represent elements of H^{1}(K, E[p]) as pairs (a, b) where b = b_{1}.

We consider the action of G_{K} on the set Λ of affine lines in E[p] missing the origin. There are p − 1 orbits of one line each, given by ℓ_{1}, …, ℓ_{p−1} where

ℓ_{i} = {iT, S + iT, 2S + iT, …, (p − 1)S + iT },

and just one further orbit of size p^{2} − p represented by

m = {S, S + T, S + 2T, …, S + (p − 1)T }.

Thus the étale algebra B associated to Λ is given by

B ≅ \underbrace{K × ⋯ × K}_{p−1} ×M.

A pair (a, b) corresponding to α ∈ A^{×} represents an element in ker(\overline{u}) if and only if

N_{L_{2}/K}(b)^{i} ≡ ∏_{P ∈ℓ_{i}} α(P) ≡ 1 mod (K^{×})^{p}

for all i ∈ {1, 2, …, p − 1}, and

(13)  a ∏_{i=1}^{p−1} σ^{i^{−1}}(b)^{i} ≡ ∏_{P ∈m} α(P) ≡ 1 mod (M^{×})^{p}

where inverses are taken in (ℤ/pℤ)^{×}. This proves the theorem when p = 3.

In general (13) may be simplified as follows. First Lemma 2.2 tells us that for an element in the image of H^{1}(K, E[p]) we have

(14)  \frac{σ(b)}{ab} = \frac{α(S + T)}{α(S)α(T)} ∈ (M^{×})^{p}.

Conversely, if we assume (14) then (13) follows by an easy calculation. □

Let ϕ : E → E′ be the isogeny with kernel generated by S. The first row of the following diagram is the long exact sequence (3). Since E[ϕ] ≅ μ_{p} as Galois modules, we have H^{1}(K, E[ϕ]) ≅ K^{×}/(K^{×})^{p} and H^{2}(K, E[ϕ]) ≅ Br(K)[p]. The other two vertical maps are given by Theorem 2.3 and (12).

(15) \xymatrix{H^{1}(K, E[ϕ]) \ar[d]^{≅} \ar[r]^{ι_{∗}} & H^{1}(K, E[p]) \ar[d]^{≅} \ar[r]^{ϕ_{∗}} & H^{1}(K, E′[ϕ̂]) \ar[d]^{≅} \ar[r]^{δ_{2}} & H^{2}(K, E[ϕ]) \ar[d]^{≅} \\ K^{×}/(K^{×})^{p} \ar[r]^{f} & H \ar[r]^{g} & (L_{1}^{×}/(L_{1}^{×})^{p})^{(1)} \ar[r]^{Δ} & Br(K)[p]}

The maps f, g and Δ are defined so that this diagram commutes. We now describe these maps explicitly.

Lemma 2.4. We have f : b ↦ (1, b) and g : (a, b) ↦ a.

Proof. The second rows in (11) and (15) differ in that we have applied projection maps

A_{1} → K  A → L_{1} × L_{2}  A_{2} → L_{1}
α ↦ α(ϕT)  α ↦ (α(S), α(T))  α ↦ α(S)

From this it is easy to see that the maps f and g in the statement of the lemma do indeed correspond to pull back by ϕ and ι. □

Our description of Δ will be in terms of cyclic algebras, so we introduce these first. Let χ ∈ Hom(G_{K}, ℤ/pℤ) and b ∈ K^{×}. If χ is non-trivial then it factors via an isomorphism Gal(L/K) ≅ ℤ/pℤ; γ ↦ 1, for some degree p cyclic extension L/K. The cyclic algebra A = A(χ, b) is the K-algebra {∑_{i=0}^{p−1} a_{i}v^{i} : a_{i} ∈ L} with multiplication determined by v^{p} = b and

(16)  vx = γ(x)v

for all x ∈ L. This is a central simple algebra of dimension p^{2}. We write (χ, b) for its class in Br(K). This construction is compatible with the cup product, in the sense that the following diagram commutes.

(17)  \xymatrix{H^{1}(K, ℤ/pℤ) × H^{1}(K, μ_{p}) \ar[d]|{≅} \ar[r]^{∪} \ar[d]^{≅} & H^{2}(K, μ_{p}) \ar[d]^{≅} \\ Hom(G_{K}, ℤ/pℤ) × K^{×}/(K^{×})^{p} \ar[r]^{( , )} & Br(K)[p].}

The next two lemmas are well known. See for example [GS06, Section 4.7]. We include the proofs since they are needed for our algorithms.

Lemma 2.5. Let A = A(χ, b) be a cyclic algebra. Then A ≅ Mat_{p}(K) if and only if b is a norm for L/K.

Proof. If x ∈ L then by (16) we have (xv)^{p} = N_{L/K}(x)v^{p}. So if b is a norm then A(χ, b) ≅ A(χ, 1). We then have the trivialisation

A(χ, 1) ≅ End_{K}(L) ≅ Mat_{p}(K)
∑ a_{i}v^{i} ↦ (x ↦ ∑ a_{i}γ^{i}(x)).

Conversely, suppose we are given an isomorphism ι : A ≅ Mat_{p}(K). We fix a non-zero vector e_{1} ∈ K^{p}. Since L is a field, the map of K-vector spaces L → K^{p}; x ↦ ι(x)e_{1} is injective. By a dimension count it is also surjective. Making this identification, we now have ι : A ≅ End_{K}(L) with ι(x)y = xy for all x, y ∈ L. Let v_{1} ∈ A with ι(v_{1}) = γ. Since (16) is satisfied by both v and v_{1} it follows that ξ = v_{1}^{−1}v commutes with every element of L, and hence is in L. Finally N_{L/K}(ξ) = (v_{1}ξ)^{p} = v^{p} = b. □

Lemma 2.6. Let 𝕂 be a field containing a primitive pth root of unity ζ_{p}. Let a, b ∈ 𝕂^{×} and let A be the 𝕂-algebra generated by x and y subject to the relations x^{p} = a, y^{p} = b and xy = ζ_{p}yx. Then the following are equivalent.

(i) a is a norm for 𝕂(\sqrt[p]{b})/𝕂.

(ii) b is a norm for 𝕂(\sqrt[p]{a})/𝕂.

(iii) A ≅ Mat_{p}(𝕂).

Proof. The equivalence of (ii) and (iii) is a special case of Lemma 2.5. By symmetry this also gives the equivalence of (i) and (iii). □

We also need the following fact about cup products.

Lemma 2.7. Let 0 → A_{1} → A_{2} → ℤ/pℤ → 0 be a short exact sequence of (ℤ/pℤ)[G_{K}]-modules. Then the connecting maps in the long exact sequence

ℤ/pℤ ⟶^{δ_{1}} H^{1}(K, A_{1}) → H^{1}(K, A_{2}) → H^{1}(K, ℤ/pℤ) ⟶^{δ_{2}} H^{2}(K, A_{1})

are related by δ_{2}(b) = δ_{1}(1) ∪ b.

Proof. Let b be represented by a cocycle (b_{σ}). Let x ∈ A_{2} with x ↦ 1. Then

δ_{2}(b)_{στ} = σ(b_{τ}x) − b_{στ}x + b_{σ}x = b_{τ}(σx − x) = (δ_{1}(1) ∪ b)_{στ}.

Alternatively, this is [GS06, Proposition 3.4.8] with A_{3} = B = ℤ/pℤ. □

We are now ready to describe the map Δ in (15). We have E′(K)[ϕ̂] ≅ ℤ/pℤ generated by ϕ(T). The image of ϕ(T) under the connecting map in the long exact sequence associated to (10) is an element β ∈ H^{1}(K, E[ϕ]) ≅ K^{×}/(K^{×})^{p}. This is a Kummer generator for the extension M/L_{1}. We write χ_{a} ↦ a for the natural isomorphism (depending on a choice of primitive pth root of unity)

(18)  Hom(G_{K}, ℤ/pℤ) ≅ (L_{1}^{×}/(L_{1}^{×})^{p})^{(1)}.

By Lemma 2.7 and (17), the map Δ in (15) is given by Δ : a ↦ (χ_{a}, β), at least up to multiplication by a fixed element of (ℤ/pℤ)^{×}, which we have no need to make explicit.

Since the diagram (15) commutes, and the first row is exact, the second row is also exact. In particular, if a ∈ (L_{1}^{×}/(L_{1}^{×})^{p})^{(1)} with Δ(a) = 0 then there exists b ∈ L_{2}^{×}/(L_{2}^{×})^{p} such that (a, b) ∈ H. We show that making the lift from H^{1}(K, E′[ϕ̂]) to H^{1}(K, E[p]) explicit comes down to solving a norm equation.

Theorem 2.8. Let E/K be an elliptic curve with p-torsion of type μ_{p}-nonsplit. Let a ∈ (L_{1}^{×}/(L_{1}^{×})^{p})^{(1)}. If Δ(a) = 0 then there exists ξ ∈ M satisfying N_{M/L_{1}}(ξ) = a, and we may lift a to (a, b) ∈ H where

b = N_{M/L_{2}} (∏_{i=1}^{p−1} σ^{i}(ξ)^{i}) .

Proof. Let χ_{a} ↦ a under the isomorphism (18), and let F be the fixed field of the kernel of χ_{a}. In other words, F/K is the degree p subextension of L_{1}(\sqrt[p]{a})/K.

[figure: L_{1}(\sqrt[p]{a}); p; p−1; L_{1} = K(ζ_{p}); p−1; F; p; K]

If Δ(a) = 0 then Lemma 2.5 tells us that β is a norm for F/K, and hence for L_{1}(\sqrt[p]{a})/L_{1}. It follows by Lemma 2.6 that a is a norm for M/L_{1}.

Now let ξ and b be as in the statement of the theorem. We show that (a, b) ∈ H by checking the conditions in Theorem 2.3. First we compute

N_{L_{2}/K}(b) = N_{M/K} (∏_{i=1}^{p−1} σ^{i}(ξ)^{i}) = N_{L_{1}/K}(a)^{p(p−1)/2}.

Since p is odd this gives N_{L_{2}/K}(b) ∈ (K^{×})^{p}. Since τσ = σ^{g}τ we have

σ(b) ≡ ∏_{r=0}^{p−2} τ^{r} ∏_{i=0}^{p−1} σ^{i+g^{−r}}(ξ)^{i} ≡ ∏_{r=0}^{p−2} τ^{r} ∏_{i=0}^{p−1} σ^{i}(ξ)^{i−g^{−r}} mod (M^{×})^{p}.

Then since N_{M/L_{1}}(ξ) = a and τ(a) ≡ a^{g} mod (L_{1}^{×})^{p} we have

b/σ(b) ≡ ∏_{r=0}^{p−2} τ^{r}N_{M/L_{1}}(ξ)^{g^{−r}} ≡ ∏_{r=0}^{p−2}(τ^{r}a)^{g^{−r}} ≡ a^{−1} mod (M^{×})^{p}.

Therefore σ(b)/(ab) ∈ (M^{×})^{p} as required. □

2.3. ℤ/pℤ-nonsplit case. We consider E/K an elliptic curve whose mod p Galois representation has image

G = \{(\begin{matrix}1 & ∗ \\ 0 & ∗ \end{matrix})\} ⊂ GL_{2}(ℤ/pℤ)

generated by σ = ( \begin{matrix}1 & 1 \\ 0 & 1 \end{matrix} ) and τ = ( \begin{matrix}1 & 0 \\ 0 & g \end{matrix}) where g is a primitive root mod p. Thus we have a basis S, T of E[p] such that

σ(S) = S  τ(S) = S
σ(T) = S + T  τ(T) = gT

Note that τσ^{g} = στ. Let L_{1} = K(ζ_{p}) and M = K(T) = K(E[p]). Let L_{2} be the subfield of M fixed by τ. The diagram of fields is the same as in Section 2.2.

Theorem 2.9. We have H^{1}(K, E[p]) ≅ H, where H is the group of pairs (a, b) ∈ K^{×}/(K^{×})^{p} × M^{×}/(M^{×})^{p} satisfying b^{g}/τ(b) ∈ (M^{×})^{p}, N_{M/L_{1}}(b) ∈ (L_{1}^{×})^{p} and σ(b)/(ab) ∈ (M^{×})^{p}.

Proof. Again we use the description of H^{1}(K, E[p]) in Theorem 2.1 as the intersection of ker(g − σ_{g}) and ker(\overline{u}).

There are p orbits for the action of G_{K} on E[p] \ {O}, with representatives iS for i ∈ {1, …, p − 1}, and T. Therefore H^{1}(K, E[p]) ⊂ A^{′×}/(A^{′×})^{p} where

A′ ≅ \underbrace{K × ⋯ × K}_{p−1} ×M.

Moreover (a_{1}, a_{2}, …, a_{p−1}, b) ∈ A^{′×}/(A^{′×})^{p} belongs to ker(g − σ_{g}) if and only if a_{i} ≡ a_{1}^{i} mod (K^{×})^{p} for all i ∈ {1, …, p − 1}, and b^{g}/τ(b) ∈ (M^{×})^{p}. Accordingly we represent elements of H^{1}(K, E[p]) as pairs (a, b) where a = a_{1}.

We consider the action of G_{K} on the set Λ of affine lines in E[p] missing the origin. There is one orbit of size p − 1 represented by the line

ℓ = {T, S + T, 2S + T, …, (p − 1)S + T },

and p − 1 orbits of size p, represented by the lines m_{1}, …, m_{p−1} where

m_{i} = {iS, iS + T, iS + 2T, …, iS + (p − 1)T }.

Thus the étale algebra B associated to Λ is given by

B ≅ L_{1} × \underbrace{L_{2} × ⋯ × L_{2}}_{p−1} .

A pair (a, b) corresponding to α ∈ A^{×} represents an element in ker(\overline{u}) if and only if

N_{M/L_{1}}(b) ≡ ∏_{P ∈ℓ} α(P) ≡ 1 mod (L_{1}^{×})^{p}

and

(19)  a^{i}N_{M/L_{2}}(σ^{i}(b)) ≡ ∏_{P ∈m_{i}} α(P) ≡ 1 mod (L_{2}^{×})^{p}

for all i ∈ {1, 2, …, p − 1}.

The condition (19) may be simplified as follows. First Lemma 2.2 tells us that for an element in the image of H^{1}(K, E[p]) we have

(20)  \frac{σ(b)}{ab} = \frac{α(S + T)}{α(S)α(T)} ∈ (M^{×})^{p}.

Conversely, if we assume (20) then σ^{i}(b) ≡ a^{i}b mod (M^{×})^{p}. If in addition b^{g}/τ(b) ∈ (M^{×})^{p} then by taking norms from M down to L_{2} it follows that

a^{i}N_{M/L_{2}}(σ^{i}(b)) ≡ N_{M/L_{2}}(b) ≡ 1 mod (L_{2}^{×})^{p}.  □

Let ϕ : E → E′ be the isogeny with kernel generated by S. The first row of the following diagram is the long exact sequence (3). Since E[ϕ] ≅ ℤ/pℤ over K, we have E[ϕ] ≅ μ_{p} over L_{1} and hence H^{1}(L_{1}, E[ϕ]) ≅ L_{1}^{×}/(L_{1}^{×})^{p} and H^{2}(L_{1}, E[ϕ]) ≅ Br(L_{1})[p]. The first and last vertical maps are then obtained by the inflation-restriction exact sequence. Since E′[ϕ̂] ≅ μ_{p} over K we have H^{1}(K, E′[ϕ̂]) ≅ K^{×}/(K^{×})^{p}. The remaining vertical map is given by Theorem 2.9.

(21)  \xymatrix{H^{1}(K, E[ϕ]) \ar[d]^{≅} \ar[r]^{ι_{∗}} & H^{1}(K, E[p]) \ar[d]^{≅} \ar[r]^{ϕ_{∗}} & H^{1}(K, E′[ϕ̂]) \ar[d]^{≅} \ar[r]^{δ_{2}} & H^{2}(K, E[ϕ]) \ar[d]^{≅} \\ (L_{1}^{×}/(L_{1}^{×})^{p})^{(1)} \ar[r]^{f} & H \ar[r]^{g} & K^{×}/(K^{×})^{p} \ar[r]^{Δ} & Br(L_{1})[p]^{(1)}}

Again we define the maps f, g and Δ so that this diagram commutes. We now describe these maps explicitly.

Lemma 2.10. We have f : b ↦ (1, b) and g : (a, b) ↦ a.

Proof. The proof is almost identical to that of Lemma 2.4. □

Let β be a Kummer generator for M/L_{1}. We write χ_{a} ↦ a for the Kummer isomorphism H^{1}(L_{1}, μ_{p}) ≅ L_{1}^{×}/(L_{1}^{×})^{p}. Then exactly as in Section 2.2, the map Δ is given by Δ : a ↦ (χ_{a}, β). Again we show that making the lift from H^{1}(K, E′[ϕ̂]) to H^{1}(K, E[p]) explicit comes down to solving a norm equation.

Theorem 2.11. Let E/K be an elliptic curve with p-torsion of type ℤ/pℤ-nonsplit. Let a ∈ K^{×}/(K^{×})^{p}. If Δ(a) = 0 then there exists ξ ∈ L_{2} satisfying N_{L_{2}/K}(ξ) = a, and we may lift a to (a, b) ∈ H where

b = ∏_{i=1}^{p−1} σ^{i}(ξ)^{p−i}.

Proof. If Δ(a) = 0 then Lemma 2.5 tell us that β is a norm for L_{1}(\sqrt[p]{a})/L_{1}. It follows by Lemma 2.6 that a is a norm for M/L_{1}, and hence for L_{2}/K.

We show that (a, b) ∈ H by checking the conditions in Theorem 2.9. Since τσ^{g} = στ and τ(ξ) = ξ we have

τ(b) ≡ ∏_{i=1}^{p−1} σ^{g^{−1}i}(ξ)^{−i} ≡ ∏_{i=1}^{p−1} σ^{i}(ξ)^{−gi} ≡ b^{g} mod (M^{×})^{p}.

Since Gal(M/L_{1}) = ⟨σ⟩ and p is odd, we have N_{M/L_{1}}(b) = a^{p(p−1)/2} ∈ (K^{×})^{p}, and σ(b)/b ≡ N_{M/L_{1}}(ξ) ≡ a mod (M^{×})^{p}. □

Remark 2.12. It can be shown that β ∈ (L_{1}^{×}/(L_{1}^{×})^{p})^{(2)}. In particular, if p = 3 then β ∈ K^{×}/(K^{×})^{p} and L_{2} = K(\sqrt[3]{β}) is a pure cubic extension of K. Norm equations for extensions of this form are the subject of the next section.

3. Solving norm equations

In this section, we present a new algorithm for solving norm equations in pure cubic extensions of the rationals. It is based on the Legendre-type method for solving conics in [CR03].

3.1. Diagonal cubic surfaces. Let K be a number field with ring of integers O_{K}. Let L = K(\sqrt[3]{b}) for some b ∈ K not a cube. We may represent any element ξ = A + B\sqrt[3]{b} + C\sqrt[3]{b}^{2} in L in the form

ξ = \frac{α + β\sqrt[3]{b}}{γ + δ\sqrt[3]{b}}. (22)

Indeed this is clear if B = C = 0, and otherwise we put

α = AB − C^{2}b  β = B^{2} − AC
γ = B  δ = −C.

Taking norms in (22) we see that solving the norm equation N_{L/K}(ξ) = a is equivalent to find a K-rational point on the diagonal cubic surface

V_{a,b} = {x_{1}^{3} + ax_{2}^{3} + bx_{3}^{3} + abx_{4}^{3} = 0} ⊂ ℙ^{3}.

Theorem 3.1. Let a, b ∈ K. Then the following are equivalent (i) a is a norm for K(\sqrt[3]{b})/K. (ii) b is a norm for K(\sqrt[3]{a})/K. (iii) a^{2}b is a norm for K(\sqrt[3]{a + b})/K. (iv) a^{2}b is a norm for K(\sqrt[3]{a − b})/K.

(v) V_{a,b}(K) ≠ ∅.

Proof. We may assume that a and b are not cubes, otherwise conditions (i), (ii) and (v) are trivially satisfied. We have already shown that (i) and (v) are equivalent. The symmetry in (v) also shows that (ii) and (v) are equivalent.

We now prove that (ii) and (iii) are equivalent. Suppose that b is a norm for K(\sqrt[3]{a})/K. Then b/a is a norm for K(\sqrt[3]{a})/K, and so by the equivalence of (i) and (ii), a is a norm for K(\sqrt[3]{b/a})/K. But then a + b = a(1 + b/a) is a norm for K(\sqrt[3]{b/a})/K, and again by the equivalence of (i) and (ii), b/a is a norm for K(\sqrt[3]{a + b})/K. The converse is proved by reversing these steps. The same argument, with b replaced by −b, shows that (ii) and (iv) are equivalent. □

As observed by Selmer [Sel53], it follows from the equivalence of (i) and (v) in Theorem 3.1, and the Hasse norm theorem, that the surfaces V_{a,b} satisfy the Hasse principle. We now turn this into an algorithm for solving norm equations, at least in the case K = ℚ. First we record an easy lemma.

Lemma 3.2. Let a, b ∈ O_{K}. If the surface V_{a,b} is locally soluble at a prime 𝔭 and v_{𝔭}(b) ≢ 0 (mod 3) then a is a cube mod 𝔭.

Proof. Working in the completion K_{𝔭} we may assume that v_{𝔭}(b) = 1 or 2. Let (x_{1} : …: x_{4}) be a local point with min v_{𝔭}(x_{i}) = 0. Then x_{1}^{3} + ax_{2}^{3} ≡ 0 (mod 𝔭). If a is not a cube mod 𝔭 then x_{1} ≡ x_{2} ≡ 0 (mod 𝔭). But then x_{3}^{3} + ax_{4}^{3} ≡ 0 (mod 𝔭), and we likewise deduce that x_{3} ≡ x_{4} ≡ 0 (mod 𝔭). This contradicts that min v_{𝔭}(x_{i}) = 0. Therefore a must be a cube mod 𝔭. □

We suppose as above that a, b ∈ O_{K}, and that V_{a,b} is everywhere locally soluble. If K has class number 1 then we may assume that (b) is cube-free, and indeed write (b) = 𝔟_{1}𝔟_{2}^{2} where 𝔟_{1} and 𝔟_{2} are coprime and square-free. Then by Lemma 3.2 and the Chinese Remainder Theorem there exists c ∈ O_{K} such that a ≡ c^{3} (mod 𝔟_{1}). Writing 𝔟_{1} = (b_{1}) for some b_{1} ∈ O_{K} it follows that the binary cubic form

F (X, Y) = \frac{1}{b_{1}} ((cX + b_{1}Y)^{3} − aX^{3}) (23)

has coefficients in O_{K}. This form has discriminant Δ(F) = −27a^{2}b_{1}^{2}.

We seek to find u, v ∈ O_{K}, not both zero, such that F (u, v) is small. In the next section we explain how to do this in the case K = ℚ.

3.2. Reduction of binary cubic forms. Let G in ℝ[X, Y] be a binary quadratic form, and Δ(G) its discriminant:

G(X, Y) = aX^{2} + bXY + cY^{2},
Δ(G) = b^{2} − 4ac.

The group SL_{2}(ℤ) acts on ℝ[X, Y] via

G(X, Y) · (\begin{matrix}α & β \\ γ & δ \end{matrix}) = G(αX + βY, γX + δY)

and the discriminant is invariant under this action.

Definition 3.3. A positive definite binary quadratic form G(X, Y) = aX^{2} + bXY + cY^{2} is reduced if |b| ≤ a ≤ c. Equivalently, G is reduced if the root of G(X, 1) = 0 in the upper half plane H lies in the fundamental region

F = \{z | z ∈ H, |z| ≥ 1, −\frac{1}{2} ≤ Re(z) ≤ \frac{1}{2}\} .

Consider now the general binary cubic form and its discriminant

(24)  f(X, Y) = aX^{3} + bX^{2}Y + cXY^{2} + dY^{3}
Δ(f) = b^{2}c^{2} − 4ac^{3} − 4b^{3}d − 27a^{2}d^{2} + 18abcd.

If Δ(f) < 0, then f has one real root and a pair of complex conjugate roots β, \overline{β}. We associate to f the binary quadratic form Q(f) = (X − βY)(X − \overline{β}Y). (25)

There are other forms we could choose, some of which are discussed in [Cre99], however this is the simplest option, and is sufficient for our purposes.

Definition 3.4. A binary cubic form (24) is Minkowski-reduced if the positive definite form Q(f) in (25) is reduced in the sense of Definition 3.3.

We use the following result from the geometry of numbers [Cas97, II.5.4].

Theorem 3.5 (Davenport [Dav45]). If f in ℤ[X, Y] is a binary cubic form with discriminant Δ = Δ(f) < 0, then there are integers (u, v) ≠ (0, 0) such that

|f(u, v)| ≤ |\frac{Δ}{23}|^{1/4} .

If, further, f is Minkowski-reduced in the sense of Definition 3.4, then

min\{|f(1, 0)|, |f(0, 1)|, |f(1, ±1)|, |f(1, ±2)|\} ≤ |\frac{Δ}{23}|^{1/4} ,

with equality only when f(X, ±Y) = A(X^{3} + X^{2}Y + 2XY^{2} + Y^{3}).

The second part of the theorem, together with the well known algorithm for reducing positive definite binary quadratic forms, gives an algorithm for finding integers u, v satisfying the conditions in the first part of the theorem.

3.3. An algorithm over the rationals. We now take K = ℚ. Let a and b be positive cube-free integers. We write b = b_{1}b_{2}^{2} where b_{1} and b_{2} are positive, coprime and square-free. Applying the results of Section 3.2 to the binary cubic (23), we can find u, v ∈ ℤ such that

0 < F (u, v) < (\frac{27}{23})^{1/4} (ab_{1})^{1/2}. (26)

We observe that

(27)  N_{ℚ( \sqrt[3]{a})/ℚ}(b_{2}((cu + b_{1}v) − \sqrt[3]{a}u)) = b_{1}b_{2}^{3}F (u, v) = bb_{2}F (u, v).

If we can find η ∈ ℚ(\sqrt[3]{a}) such that N_{ℚ( \sqrt[3]{a})/ℚ}(η) = b_{2}F (u, v) then, by the multiplicativity of the norm, we can find ξ ∈ ℚ(\sqrt[3]{a}) such that N_{ℚ( \sqrt[3]{a})/ℚ}(ξ) = b. Ideally, we want b_{2}F (u, v) < b, so that our norm equation is replaced by a smaller one. Unfortunately, the bound (26) isn’t quite strong enough to prove this. Our solution to this problem is to use condition (iv) in Theorem 3.1.

Algorithm 3.6. (Legendre-type algorithm for solving cubic norm equations) Input: A pair of positive integers (a, b) such that b is a norm for ℚ(\sqrt[3]{a})/ℚ. Output: A list of pairs (a, b), with b a norm for ℚ(\sqrt[3]{a})/ℚ, such that a solution to each norm equation allows us to read off a solution to the previous one.

(i) Replace a and b by their cube-free parts. If a > b then swap a and b.

(ii) If a = 0 or 1 then stop.

(iii) Write b = b_{1}b_{2}^{2} where b_{1} and b_{2} are positive, coprime and square-free. Solve

for c ∈ ℤ such that a ≡ c^{3} (mod b_{1}). (iv) Define F ∈ ℤ[X, Y] as in (23). Use reduction theory to find u, v ∈ ℤ

satisfying (26).

(v) If b_{2}F (u, v) < \frac{3}{4}b then replace (a, b) by (a, b_{2}F (u, v)) and go to Step (i). (vi) Otherwise, replace (a, b) by (b − a, a^{2}b) and go to Step (i). When the algorithm terminates, it is clear by (27) and the proof of Theorem 3.1

that we may solve the original norm equation.

Theorem 3.7. If a, b ≤ B then Algorithm 3.6 takes O((logB)^{2}) iterations.

Proof. In Step (v) we have a_{new} = a and b_{new} < \frac{3}{4}b. So if we never reach Step (vi) then the algorithm takes O(log B) iterations. If we reach Step (vi) then

\frac{3}{4}b ≤ b_{2}F (u, v) < (\frac{27}{23})^{1/4} (ab)^{1/2}

and so b < 1.93a. In this case a_{new} = b − a < 0.93a, and so the total number of applications of Step (vi) is O(log B). Moreover b_{new} = a^{2}b < 2a^{3} ≤ 2B^{3} and so Step (v) is applied O(log B) times between each application of Step (vi). □

Remark 3.8. The bottleneck in Algorithm 3.6 comes in Steps (i) and (iii), as these are the steps that involve factoring. We expect it would be possible to modify the algorithm, along the lines of [CR03, Section 2.5], so that factoring is only required on the first iteration. However we have not worked out the details.

We give two examples, the first illustrating the need for Step (vi), and the second in preparation for Example 4.3. The actual solutions to the norm equations are rather large, so we do not record them here.

Example 3.9. Let a = 5316 and b = 35685. The steps taken by Algorithm 3.6 are recorded in the rows of the following table. On the second iteration we have b_{2}F (u, v) = 5382 > b and so we reach Step (vi).

a  b  b_{1} b_{2} c  u v
5316  35685  3965 3 2521 −11 7
5316  5364  149 6 52 −2 1
48 151585867584  [take cube-free parts]
6  87723303  447 443 123 −11 3
6  6202  6202 1 2596 −43 18
6  77  77 1 41 2 −1
1  6

Example 3.10. Let a = 17 and b = 2850760453176384635894983495759. On the first iteration we have c = 2512758208506770505416151958382 and

(u, v) = (−1056910260262351, 931597016217248).

On this and subsequent iterations we have b_{1} = b and b_{2} = 1.

a  b  c  u  v
17 3227115996467513 3079766255214306 1678826 −1602171
17  69326065  67724958  −3767  3680
17  13311  [take cube-free parts]
17  493  476  −1  1
10  17  3  1  0
1  10

In [vB15, Chapter 4] we investigated analogues of Algorithm 3.6 over other number fields with small discriminant. Although we couldn’t prove that these methods always work, they seem to perform quite well in practice, at least in reducing the norm equations to ones that can be solved by traditional methods.

4. Examples

In this section, we give some examples in the case K = ℚ, showing how the results of Sections 2 and 3 may be used to compute the Cassels-Tate pairing on 3-isogeny Selmer groups. Further examples are given in [vB15].

We identify \frac{1}{3}ℤ/ℤ with ℤ/3ℤ via multiplication by 3, so that the matrices below have entries 0, 1, 2 rather than 0, \frac{1}{3}, \frac{2}{3}. We also write ⟨a_{1}, a_{2} …⟩ for the subgroup generated by a_{1}, a_{2}, . . ..

Example 4.1. Let E and E′ be the 3-isogenous elliptic curves labelled 63531c1 and 63531c2 in Cremona’s tables [Cre97].

E : y^{2} = x^{3} − 3(4x + 52)^{2}
E′ : y^{2} = x^{3} + 36^{2}(x + 543)^{2}

The Galois action on E[3] is of type μ_{3}-nonsplit. Indeed E[3] is generated by

S = (0, 52\sqrt{−3}) and T = (156/(θ − 4), 156θ/(θ − 4))

where θ = \sqrt[3]{181}. We set ζ_{3} = (−1 + \sqrt{−3})/2. As in Section 2.2 we have fields L_{1} = ℚ(ζ_{3}), L_{2} = ℚ(θ) and M = ℚ(ζ_{3}, θ). A descent by 3-isogeny (see the introduction for references) computes the Selmer groups

S^{(ϕ)}(E/ℚ) = ⟨181⟩ ⊂ ℚ^{×}/(ℚ^{×})^{3}
S^{(ϕ̂)}(E′/ℚ) = ⟨ζ_{3}, 39ζ_{3} + 52⟩ ⊂ (L_{1}^{×}/(L_{1}^{×})^{3})^{(1)} .

This gives an upper bound of 2 for the rank of E(ℚ). We seek to improve this bound by computing the Cassels-Tate pairing on S^{(ϕ̂)}(E′/ℚ).

We start by lifting a_{1} = ζ_{3} and a_{2} = 39ζ_{3} + 52 globally to H^{1}(ℚ, E[3]) ≅ H, where H ⊂ L_{1}^{×}/(L_{1}^{×})^{3} × L_{2}^{×}/(L_{2}^{×})^{3} is given by Theorem 2.3. We used the existing function NormEquation in Magma (this example is too small for the methods of Section 3 to be needed) to solve the norm equations N_{M/L_{1}}(ξ) = a_{i} for i = 1, 2, and then computed b_{i} with (a_{i}, b_{i}) ∈ H using Theorem 2.8. We used the method in [Fis08, Section 2] to find a small representative for b_{i} in L_{2}^{×}/(L_{2}^{×})^{3}. By (15) we are free to multiply b_{i} by any element in ℚ^{×}/(ℚ^{×})^{3}. In this way we obtain

(28)  \begin{aligned}b_{1} & = 7θ^{2} + 40θ + 217 & N_{L_{2}/ℚ}(b_{1}) & = 2^{6}3^{6} \\ b_{2} & = 59θ^{2} + 314θ + 3011 & N_{L_{2}/ℚ}(b_{2}) & = 2^{3}3^{12}13^{3} \end{aligned}

The connecting map δ_{3} : E(ℚ) → H^{1}(ℚ, E[3]) in (6) may be computed as described in [Sil09, Chapter X]. It is given by the tangent lines at S and T, i.e.

P ↦ (tan_{S}(P), tan_{T} (P)) where

tan_{S}(x, y) = y − 4\sqrt{−3}x − 52\sqrt{−3},
tan_{T} (x, y) = y − 2(θ + 2)x + 156(θ + 4)/(θ − 4).

The local analogue of this map is given by the same formula.

Let (a, b) = (a_{1}, b_{1}) or (a_{2}, b_{2}). Since a ∈ S^{(ϕ̂)}(E′/ℚ) there exists for each prime p a local point P_{p} ∈ E(ℚ_{p}) with tan_{S}(P_{p}) ≡ a mod (ℚ_{p}(ζ_{3})^{×})^{3}. Then (a, b) and (tan_{S}(P_{p}), tan_{T} (P_{p})) are both local lifts of a. By (15) and Lemma 2.4 it follows that b/ tan_{T} (P_{p}) ≡ ξ_{p} mod (ℚ_{p}(ζ_{3})^{×})^{3} for some ξ_{p} ∈ ℚ_{p}^{×}/(ℚ_{p}^{×})^{3}. By Definition 1.2 and Lemma 1.3 we have

(29)  ⟨a, a′⟩_{CT} = ∑_{p} \frac{1}{[ℚ_{p}(ζ_{3}) : ℚ_{p}]}Ind_{ζ_{3}}(ξ_{p}, a′)_{p}

where ( , )_{p} is the Hilbert norm residue symbol on ℚ_{p}(ζ_{3}). If p ≠ 3 is a prime of good reduction for E, and v_{𝔭}(b) ≡ 0 mod 3 for all primes 𝔭 dividing p, then p makes no contribution to the sum (29).

Returning to our example, E has minimal discriminant −3^{3} · 13^{3} · 181 and the norms of the b_{i} were recorded in (28). The Cassels-Tate pairing is therefore a sum of local pairings at the primes 2, 3, 13 and 181. Since 3 is odd, there is no contribution from the infinite place.

Contribution at p = 2. The local point P = (4, 2^{2} + 2^{6} + O(2^{8})) ∈ E(ℚ_{2}) satisfies tan_{S}(P) ≡ a_{1} ≡ a_{2} mod (ℚ_{2}(ζ_{3})^{×})^{3}. Embedding L_{2} in ℚ_{2} via θ ↦ 1 + 2^{2} + O(2^{3}) we find that tan_{T} (P) ≡ b_{1} ≡ b_{2} ≡ 1 mod (ℚ_{2}^{×})^{3}. Therefore the local pairing at p = 2 is trivial.

Contribution at p = 3. The local points

P_{1} = (4, 2 + 3 + 2.3^{2} + O(3^{5})) ∈ E(ℚ_{3})
P_{2} = (3^{−2}, 3^{−3} + 1 + 3^{2} + O(3^{5})) ∈ E(ℚ_{3})

satisfy tan_{S}(P_{i}) ≡ a_{i} mod (ℚ_{3}(ζ_{3})^{×})^{3} for i = 1, 2. Embedding L_{2} in ℚ_{3} via θ ↦ 1 + 2.3 + 3^{3} + O(3^{4}) we compute

b_{1}/ tan_{T} (P_{1}) ≡ 3 mod (ℚ_{3}(ζ_{3})^{×})^{3}
b_{2}/ tan_{T} (P_{2}) ≡ 6 mod (ℚ_{3}(ζ_{3})^{×})^{3}

We recall from Section 1.2 that ℚ_{3}(ζ_{3})^{×}/(ℚ_{3}(ζ_{3})^{×})^{3} has basis λ, η_{1}, η_{2}, η_{3} where λ = 1 − ζ_{3} and η_{i} = 1 − λ^{i}. In terms of this basis we have

3 ≡ λ^{2}η_{1}^{2} mod (ℚ_{3}(ζ_{3})^{×})^{3}  a_{1} ≡ η_{1} mod (ℚ_{3}(ζ_{3})^{×})^{3}
6 ≡ λ^{2}η_{1}^{2}η_{2}^{2}η_{3}^{2} mod (ℚ_{3}(ζ_{3})^{×})^{3}  a_{2} ≡ η_{3}^{2} mod (ℚ_{3}(ζ_{3})^{×})^{3}

Using (9) to compute the Hilbert norm residue symbol, and not forgetting the factor [ℚ_{3}(ζ_{3}) : ℚ_{3}] = 2 in (29), the local pairing at p = 3 is as given in (30).

Contribution at p = 13. We embed L_{1} = ℚ(ζ_{3}) in ℚ_{13} via ζ_{3} ↦ 3+11.13+O(13^{2}). The local points

P_{1} = (6, 10 + 4.13 + 12.13^{2} + O(13^{3})) ∈ E(ℚ_{13})
P_{2} = (13, 4.13 + 3.13^{2} + 5.13^{3} + O(13^{4})) ∈ E(ℚ_{13})

satisfy tan_{S}(P_{i}) ≡ a_{i} mod (ℚ_{13}^{×})^{3} for i = 1, 2. Embedding L_{2} = ℚ(θ) in ℚ_{13} via θ ↦ 4 + 13 + 7.13^{2} + O(13^{3}) we compute

b_{1}/ tan_{T} (P_{1}) ≡ 1 mod (ℚ_{13}^{×})^{3}  a_{1} ≡ 2 mod (ℚ_{13}^{×})^{3}
b_{2}/ tan_{T} (P_{2}) ≡ 2 mod (ℚ_{13}^{×})^{3}  a_{2} ≡ 13^{2} mod (ℚ_{13}^{×})^{3}

By Proposition 1.5(iv) we have (2, 13)_{13} = ζ_{3}. The local pairing at p = 13 is now given by the second matrix in (30).

Contribution at p = 181. We embed L_{1} = ℚ(ζ_{3}) in ℚ_{181} via ζ_{3} ↦ 48 + O(181). We find that a_{1} ≡ a_{2} ≡ 1 mod (ℚ_{181}^{×})^{3} and hence the local pairing at p = 181 is trivial.

Adding together the local pairings at p = 3 and 13 gives the (global) Cassels-Tate pairing on S^{(ϕ̂)}(E′/ℚ) = ⟨a_{1}, a_{2}⟩ ⊂ L_{1}^{×}/(L_{1}^{×})^{3}.

Local pairing at p = 3 Local pairing at p = 13 Global pairing

(30)  \begin{aligned}& a_{1} & a_{2} \\ a_{1} & 0 & 1 \\ a_{2} & 2 & 1 \end{aligned}  \begin{aligned}& a_{1} & a_{2} \\ a_{1} & 0 & 0 \\ a_{2} & 0 & 2 \end{aligned}  \begin{aligned}& a_{1} & a_{2} \\ a_{1} & 0 & 1 \\ a_{2} & 2 & 0 \end{aligned}

Since the pairing is non-degenerate, it follows that E(ℚ) has rank 0. Moreover the 3-primary parts of � (E/ℚ) and � (E′/ℚ) are 0 and (ℤ/3ℤ)^{2}.

Example 4.2. Let E and E′ be the 3-isogenous elliptic curves labelled 24060f1 and 24060f2 in Cremona’s tables [Cre97].

E : y^{2} = x^{3} + (x + 15)^{2}
E′ : y^{2} = x^{3} − 3 (x + 401/9)^{2}

The Galois action on E[3] is of type ℤ/3ℤ-nonsplit. Indeed E[3] is generated by

S = (0, 15) and T = (−90/(θ + 2), −15\sqrt{−3}θ/(θ + 2))

where θ = \sqrt[3]{802}. We set ζ_{3} = (−1 + \sqrt{−3})/2. As in Section 2.3 we have fields L_{1} = ℚ(ζ_{3}), L_{2} = ℚ(θ) and M = ℚ(ζ_{3}, θ). A descent by 3-isogeny computes the Selmer groups

S^{(ϕ)}(E/ℚ) = {1} ⊂ (L_{1}^{×}/(L_{1}^{×})^{3})^{(1)}
S^{(ϕ̂)}(E′/ℚ) = ⟨2, 3, 5⟩ ⊂ ℚ^{×}/(ℚ^{×})^{3}.

This gives an upper bound of 2 for the rank of E(ℚ). We seek to improve this bound by computing the Cassels-Tate pairing on S^{(ϕ̂)}(E′/ℚ).

We start by lifting a_{1} = 2, a_{2} = 3 and a_{3} = 5 globally to H^{1}(ℚ, E[3]) ≅ H, where H ⊂ K^{×}/(K^{×})^{3} × M^{×}/(M^{×})^{3} is given by Theorem 2.9. We used the existing function in Magma (again this example is too small for the methods of Section 3 to be needed) to solve the norm equations N_{L_{2}/K}(ξ) = a_{i} for i = 1, 2, 3, and then computed b_{i} with (a_{i}, b_{i}) ∈ H using Theorem 2.11. Replacing b_{i} by a small representative for its coset in M^{×}/(M^{×})^{3} we obtain

b_{1} = \frac{1}{3}(5ζ_{3} + 5)θ^{2} + \frac{1}{3}(11ζ_{3} − 4)θ + \frac{1}{3}(41ζ_{3} + 290)
b_{2} = \frac{5}{3}ζ_{3}θ^{2} − \frac{7}{3}ζ_{3}θ − \frac{1}{3}(490ζ_{3} + 213)
b_{3} = \frac{1}{3}(7ζ_{3} + 34)θ^{2} + \frac{1}{3}(66ζ_{3} + 317)θ + \frac{1}{3}(308ζ_{3} + 2991)

It may be checked that these elements satisfy the conditions in Theorem 2.9.

The minimal discriminant of E is −2^{4} · 3^{3} · 5^{3} · 401. We find that v_{𝔭}(b_{i}) ≡ 0 (mod 3) for all primes 𝔭 of M not dividing 30. The Cassels-Tate pairing is therefore a sum of local pairings at the primes 2, 3, 5 and 401.

Contribution at p = 2. We have tan_{S}(−S) = −30 ≡ 2 mod (ℚ_{2}^{×})^{3}. We compute

b_{1}/ tan_{T} (−S) ≡ ζ_{3}^{2} mod (ℚ_{2}(ζ_{3}, θ)^{×})^{3}  a_{1} ≡ 2 mod (ℚ_{2}^{×})^{3}
b_{2} ≡ 1 mod (ℚ_{2}(ζ_{3}, θ)^{×})^{3}  a_{2} ≡ 1 mod (ℚ_{2}^{×})^{3}
b_{3} ≡ 1 mod (ℚ_{2}(ζ_{3}, θ)^{×})^{3}  a_{3} ≡ 1 mod (ℚ_{2}^{×})^{3}

The local pairing at 2 is therefore given by the first matrix in (31).

Contribution at p = 3. Let P = (−5/2, 2.3 + 2.3^{2} + 3^{3} + O(3^{8})) ∈ E(ℚ_{3}). Then tan_{S}(P) ≡ 2 ≡ 5^{−1} mod (ℚ_{3}^{×})^{3} and tan_{S}(−S) ≡ 3 mod (ℚ_{3}^{×})^{3}. We embed L_{2} in ℚ_{3} via θ ↦ 1 + 2.3 + 2.3^{2} + O(3^{4}). We recall that ℚ_{3}(ζ_{3})^{×}/(ℚ_{3}(ζ_{3})^{×})^{3} has basis λ, η_{1}, η_{2}, η_{3} where λ = 1 − ζ_{3} and η_{i} = 1 − λ^{i}. We compute

b_{1}/ tan_{T} (P) ≡ η_{1}^{2}η_{3} mod (ℚ_{3}(ζ_{3})^{×})^{3}  a_{1} ≡ η_{2}^{2}η_{3}^{2} mod (ℚ_{3}(ζ_{3})^{×})^{3}
b_{2}/ tan_{T} (−S) ≡ η_{1}^{2} mod (ℚ_{3}(ζ_{3})^{×})^{3}  a_{2} ≡ λ^{2}η_{1}^{2} mod (ℚ_{3}(ζ_{3})^{×})^{3}
b_{3}/ tan_{T} (−P) ≡ η_{1}η_{3}^{2} mod (ℚ_{3}(ζ_{3})^{×})^{3}  a_{3} ≡ η_{2}η_{3} mod (ℚ_{3}(ζ_{3})^{×})^{3}

Using (9) to compute the Hilbert norm residue symbol, the local pairing at 3 is given by the second matrix in (31).

Contribution at p = 5. We have tan_{S}(−S) = −30 ≡ 5 mod (ℚ_{5}^{×})^{3}. We embed L_{2} in ℚ_{5} via θ ↦ 3 + 3.5^{2} + 5^{4} + O(5^{5}) and compute

b_{1} ≡ ζ_{3} mod (ℚ_{5}(ζ_{3})^{×})^{3}  a_{1} ≡ 1 mod (ℚ_{5}^{×})^{3}
b_{2} ≡ 1 mod (ℚ_{5}(ζ_{3})^{×})^{3}  a_{2} ≡ 1 mod (ℚ_{5}^{×})^{3}
b_{3}/ tan_{T} (−S) ≡ ζ_{3} mod (ℚ_{5}(ζ_{3})^{×})^{3}  a_{3} ≡ 5 mod (ℚ_{5}^{×})^{3}

The local pairing at 5 is therefore given by the third matrix in (31).

Contribution at p = 401. Since 401 ≡ 2 (mod 3) we have 2, 3, 5 ∈ (ℚ_{401}^{×})^{3}, and so the local pairing at p = 401 is trivial.

Adding together the local pairings at p = 2, 3 and 5 gives the (global) Cassels-Tate pairing on S^{(ϕ̂)}(E′/ℚ) = ⟨2, 3, 5⟩ ⊂ ℚ^{×}/(ℚ^{×})^{3}.

p = 2  p = 3  p = 5  Global pairing

(31)  2 3 5 2 1 0 0 3 0 0 0 5 0 0 0  2 3 5 2 2 1 1 3 2 0 1 5 1 2 2  2 3 5 2 0 0 1 3 0 0 0 5 0 0 1  2 3 5 2 0 1 2 3 2 0 1 5 1 2 0

This again shows that rank E(ℚ) = 0, and the 3-primary parts of � (E/ℚ) and � (E′/ℚ) are 0 and (ℤ/3ℤ)^{2}.

As described in the introduction, Eroshkin found five examples of elliptic curves E/ℚ with torsion subgroup ℤ/3ℤ and rank at least 13. We now consider the first of these examples. The other examples are similar, and are treated in detail in [vB15, Section 6.1].

Example 4.3. Let E/ℚ be the elliptic curve y^{2} + A_{1}xy + A_{3}y = x^{3} where A_{1} = 10154960719 and A_{3} = −66798078951809458114391930400. The primes of bad reduction for E are those appearing in the following prime factorisations.

A_{3} = −2^{5} · 3^{3} · 5^{2} · 7^{2} · 11 · 13 · 17 · 19 · 23 · 29 · 31 · 37 · 41 · 43 · 47 · 53 · 59 · 61 · 113,
A_{1}^{3} − 27A_{3} = 197 · 317 · 3313949 · 2831657657 · 4864617187.

The Galois action on E[3] is of type ℤ/3ℤ-nonsplit. Indeed E[3] is generated by S = (0, 0) and T = (3A_{3}/(θ −A_{1}), A_{3}(ζ_{3}θ −A_{1})/(θ −A_{1})) where θ = \sqrt[3]{A_{1}^{3} − 27A_{3}}.

Let ϕ : E → E′ be the 3-isogeny with kernel generated by S. A descent by 3isogeny [Fis03, Proposition 1.2] shows that

S^{(ϕ̂)}(E′/ℚ) = \{x ∈ ℚ^{×}/(ℚ^{×})^{3}| \begin{matrix}v_{p}(x) ≡ 0 (mod 3) & for all p ∤ A_{3} \\ x ∈ (ℚ_{p}^{×})^{3} & for all p | (A_{1}^{3} − 27A_{3}) \end{matrix} \} .

Noting that only one of the prime factors of A_{1}^{3} − 27A_{3} is congruent to 1 mod 3, we find that S^{(ϕ̂)}(E′/ℚ) is the 18-dimensional 𝔽_{3}-vector space with basis

(32)  \begin{aligned}2, 5, 11, 17, & 31, 47, 53, 3^{2} · 7, 3 · 13, 3 · 19, 3 · 23, \\ & 3 · 29, 3 · 37, 3 · 41, 3 · 43, 3 · 59, 3^{2} · 61, 3 · 113. \end{aligned}

By the analogue (for n = 3) of [Fis01, Theorem 1], or by Cassels’ formula [Cas65], it follows that S^{(ϕ)}(E/ℚ) is trivial. This gives an upper bound of 17 for the rank of E(ℚ). We improve this bound by computing the Cassels-Tate pairing on the subspace of S^{(ϕ̂)}(E′/ℚ) generated by the first 5 basis elements in (32), say a_{1}, …, a_{5}.

As in Section 2.3 we have fields L_{1} = ℚ(ζ_{3}), L_{2} = ℚ(θ) and M = ℚ(ζ_{3}, θ). In Example 3.10 we solved one of the norm equations N_{L_{2}/ℚ}(ξ) = a_{i}. The other cases are similar. We then used Theorem 2.11 to compute b_{i} ∈ M with (a_{i}, b_{i}) ∈ H, where H is as defined in Theorem 2.9. So that they could sensibly be recorded in the paper, we went to some effort to simplify the b_{i}, both by multiplying by elements of (L_{1}^{×}/(L_{1}^{×})^{3})^{(1)} and by finding small representatives modulo cubes.

b_{1} = 80506656009θ^{2} − 1176048899716052084841θ

− 14935178208744640295856847246416ζ_{3} − 15036024242599209733354645439703,

b_{2} = 14726363049θ^{2} − 79874874765966026529θ
+ 8657187467761497385350294134040ζ_{3} − 8434480171840925245748610923511,
b_{3} = 218823372684θ^{2} − 4630953487853681932716θ

+ 34676125489353056066296086569091ζ_{3} + 60807466313987014328526766460838,

b_{4} = 286372386666θ^{2} − 1448511948608043607524θ

− 57528276376283017594756117712901ζ_{3} − 38980928584242432627609103951923,

b_{5} = 332611290882θ^{2} + 1168159925437207764516θ

− 67751649380200776098612752578639ζ_{3} + 71449768157279254278949836738165

We find that v_{𝔭}(b_{i}) ≡ 0 (mod 3) for all primes 𝔭 of M not dividing a_{i}. Therefore only the bad primes for E contribute to the Cassels-Tate pairing. The local conditions used to compute S^{(ϕ̂)}(E′/ℚ) show that its elements are locally trivial at the primes dividing A_{1}^{3} − 27A_{3}. So we only need to compute the local pairings at the primes dividing A_{3}.

Let P_{1}, …, P_{13} be the known independent points of infinite order in E(ℚ), as listed on Dujella’s website [Duj17].

For the primes p with p ≡ 1 mod 3 we find that tan_{S}(P_{j}) generates ℤ_{p}^{×}/(ℤ_{p}^{×})^{3} where j = 6, 4, 1, 1, 2, 2, 7 for p = 7, 13, 19, 31, 37, 43, 61. Moreover tan_{T} (P_{j}) is a unit mod cubes at the primes dividing p. So we only need to consider the primes that additionally divide one of the a_{i}. The only such prime is 31. Embedding M in ℚ_{31} via ζ_{3} ↦ 5 + 14.31 + O(31^{2}) and θ ↦ 1 − 2.31^{2} + O(31^{4}), we compute

b_{1} ≡ 5^{2} mod (ℚ_{31}^{×})^{3}  a_{1} ≡ 1 mod (ℚ_{31}^{×})^{3}
b_{2}/ tan_{T} (−P_{1}) ≡ 1 mod (ℚ_{31}^{×})^{3}  a_{2} ≡ 5 mod (ℚ_{31}^{×})^{3}
b_{3}/ tan_{T} (−P_{1}) ≡ 1 mod (ℚ_{31}^{×})^{3}  a_{3} ≡ 5 mod (ℚ_{31}^{×})^{3}
b_{4}/ tan_{T} (P_{1}) ≡ 1 mod (ℚ_{31}^{×})^{3}  a_{4} ≡ 5^{2} mod (ℚ_{31}^{×})^{3}
b_{5}/ tan_{T} (P_{6}) ≡ 31^{2} mod (ℚ_{31}^{×})^{3}  a_{5} ≡ 31 mod (ℚ_{31}^{×})^{3}

This gives the local pairing at p = 31 as recorded below.

For the primes p with p ≡ 2 mod 3 the group ℤ_{p}^{×}/(ℤ_{p}^{×})^{3} is trivial. So we only need to consider those primes p that additionally divide one of a_{1}, …, a_{5}. We find that tan_{S}(P_{j}) ≡ p mod (ℚ_{p}^{×})^{3} where j = 5, 2, 1, 5 for p = 2, 5, 11, 17. The unique embedding of L_{2} in ℚ_{p} determines an embedding of M in ℚ_{p}(ζ_{3}). Then b_{i}/ tan_{T} (P_{j})^{v_{p}(a_{i})} takes the following values mod (ℚ_{p}(ζ_{3})^{×})^{3}.

p = 2 p = 5 p = 11 p = 17
i = 1 1  1  ζ_{3}^{2} (ζ_{3} + 3)^{2}
i = 2 1  1  1  1
i = 3 ζ_{3}  1  1 (ζ_{3} + 3)^{2}
i = 4 ζ_{3}^{2}  1  ζ_{3}^{2}  1
i = 5 ζ_{3}^{2}  ζ_{3}^{2}  ζ_{3}  ζ_{3} + 3

This gives the local pairings at p = 2, 5, 11, 17 as recorded below.

Finally, when p = 3, we find that tan_{S}(P_{8}) ≡ 2 mod (ℚ_{3}^{×})^{3}, whereas the elements b_{1}, …, b_{5} and tan_{T} (P_{8}) all belong to the subgroup of ℚ_{3}(ζ_{3})^{×}/(ℚ_{3}(ζ_{3})^{×})^{3} generated by η_{3} = 1 − (1 − ζ_{3})^{3}. The local pairing at p = 3 is therefore trivial.

Adding together the local pairings gives the (global) Cassels-Tate pairing on the 5-dimensional subspace ⟨2, 5, 11, 17, 31⟩ of S^{(ϕ̂)}(E′/ℚ) ⊂ ℚ^{×}/(ℚ^{×})^{3}. The fact we obtain an alternating matrix provides some check on our calculations.

Local pairing at p = 2  Local pairing at p = 5  Local pairing at p = 11

2 5 11 17 31 2 0 0 0 0 0 5 0 0 0 0 0 11 2 0 0 0 0 17 1 0 0 0 0 31 1 0 0 0 0 2 5 11 17 31 2 0 0 0 0 0 5 0 0 0 0 0 11 0 0 0 0 0 17 0 0 0 0 0 31 0 2 0 0 0 2 5 11 17 31 2 0 0 1 0 0 5 0 0 0 0 0 11 0 0 0 0 0 17 0 0 1 0 0 31 0 0 2 0 0

Local pairing at p = 17  Local pairing at p = 31  Global pairing

2 5 11 17 31 2 0 0 0 2 0 5 0 0 0 0 0 11 0 0 0 2 0 17 0 0 0 0 0 31 0 0 0 1 0  2 5 11 17 31 2 0 0 0 0 2 5 0 0 0 0 0 11 0 0 0 0 0 17 0 0 0 0 0 31 0 1 1 2 0  2 5 11 17 31 2 0 0 1 2 2 5 0 0 0 0 0 11 2 0 0 2 0 17 1 0 1 0 0 31 1 0 0 0 0

Since the Cassels-Tate pairing on this 5-dimensional subspace of S^{(ϕ̂)}(E′/ℚ) has rank 4, it follows that rank E(ℚ) = 13. Moreover the 3-primary parts of � (E/ℚ) and � (E′/ℚ) are 0 and (ℤ/3ℤ)^{4}. The 18 × 18 matrix (still of rank 4) giving the Cassels-Tate pairing on all of S^{(ϕ̂)}(E′/ℚ) is recorded in [vB15, Example 6.1.2].

References

[BCP97] W. Bosma, J. Cannon, and C. Playoust. The Magma algebra system. I. The user language. J. Symbolic Comput., 24(3-4):235–265, 1997.

[Cas59] J.W.S. Cassels. Arithmetic on curves of genus 1. I. On a conjecture of Selmer. J. reine angew. Math., 202:52–99, 1959.

[Cas62] J.W.S. Cassels. Arithmetic on curves of genus 1. IV. Proof of the Hauptvermutung. J. reine angew. Math., 211:95–112, 1962.

[Cas65] J.W.S. Cassels. Arithmetic on curves of genus 1. VIII. On conjectures of Birch and Swinnerton-Dyer. J. reine angew. Math., 217:180–199, 1965.

[Cas97] J.W.S. Cassels. An introduction to the geometry of numbers. Classics in Mathematics. Springer-Verlag, Berlin, 1997. Corrected reprint of the 1971 edition.

[Cas98] J.W.S. Cassels. Second descents for elliptic curves. J. reine angew. Math., 494:101– 127, 1998.

[CF10] J.W.S. Cassels and A. Fröhlich, editors. Algebraic number theory. London Mathematical Society, London, 2010.

[CFO^{+}08] J.E. Cremona, T.A. Fisher, C. O’Neil, D. Simon, and M. Stoll. Explicit n-descent on

elliptic curves. I. Algebra. J. reine angew. Math., 615:121–155, 2008.

[CFO^{+}15] J.E. Cremona, T.A. Fisher, C. O’Neil, D. Simon, and M. Stoll. Explicit n-descent on

elliptic curves. III. Algorithms. Math. Comp., 84(292):895–922, 2015.

[CM12] B. Creutz and R.L. Miller. Second isogeny descents and the Birch and Swinnerton-Dyer conjectural formula. J. Algebra, 372:673–701, 2012.

[Coh00] H. Cohen. Advanced topics in computational number theory, volume 193 of Graduate Texts in Mathematics. Springer-Verlag, New York, 2000.

[CR03] J.E. Cremona and D. Rusin. Efficient solution of rational conics. Math. Comp., 72(243):1417–1441, 2003.

[Cre97] J.E. Cremona. Algorithms for modular elliptic curves. Cambridge University Press,

Cambridge, 1997. See also http://www.warwick.ac.uk/~masgaj/ftp/data/.

[Cre99] J.E. Cremona. Reduction of binary cubic and quartic forms. LMS J. Comput. Math., 2:64–94, 1999.

[Dav45] H. Davenport. The reduction of a binary cubic form. II. J. London Math. Soc., 20:139– 147, 1945.

[DeL02] M. DeLong. A formula for the Selmer group of a rational three-isogeny. Acta Arith., 105(2):119–131, 2002.

[Don15] S. Donnelly. Algorithms for the Cassels-Tate pairing. preprint, 2015.

[Duj17] A. Dujella. High rank elliptic curves with prescribed torsion. https://web.math.

pmf.unizg.hr/~duje/tors/tors.html, 2017.

[FG08] E.V. Flynn and C. Grattoni. Descent via isogeny on elliptic curves with large rational torsion subgroups. J. Symbolic Comput., 43(4):293–303, 2008.

[Fis01] T.A. Fisher. Some examples of 5 and 7 descent for elliptic curves over Q. J. Eur. Math. Soc., 3(2):169–201, 2001.

[Fis03] T.A. Fisher. The Cassels-Tate pairing and the Platonic solids. J. Number Theory, 98(1):105–155, 2003.

[Fis08] T.A. Fisher. Some improvements to 4-descent on an elliptic curve. In Algorithmic number theory, volume 5011 of Lecture Notes in Comput. Sci., pages 125–138. Springer, Berlin, 2008.

[Fis17] T.A. Fisher. Higher descents on an elliptic curve with a rational 2-torsion point. Math. Comp., 86(307):2493–2518, 2017.

[FN14] T.A. Fisher and R.D. Newton. Computing the Cassels-Tate pairing on the 3-Selmer group of an elliptic curve. Int. J. Number Theory, 10(7):1881–1907, 2014.

[Gra03] G. Gras. Class field theory. Springer Monographs in Mathematics. Springer-Verlag, Berlin, 2003.

[GS06] P. Gille and T. Szamuely. Central simple algebras and Galois cohomology, volume 101 of Cambridge Studies in Advanced Mathematics. Cambridge University Press, Cambridge, 2006.

[McC88] W.G. McCallum. On the Shafarevich-Tate group of the Jacobian of a quotient of the Fermat curve. Invent. Math., 93(3):637–666, 1988.

[Mil06] J.S. Milne. Arithmetic duality theorems. BookSurge, LLC, Charleston, SC, second edition, 2006.

[MS13] R.L. Miller and M. Stoll. Explicit isogeny descent on elliptic curves. Math. Comp., 82(281):513–529, 2013.

[PS99] B. Poonen and M. Stoll. The Cassels-Tate pairing on polarized abelian varieties. Ann. of Math. (2), 150(3):1109–1149, 1999.

[SD13] H.P.F. Swinnerton-Dyer. 2^{n}-descent on elliptic curves for all n. J. Lond. Math. Soc. (2), 87(3):707–723, 2013.

[Sel53] E.S. Selmer. Sufficient congruence conditions for the existence of rational points on certain cubic surfaces. Math. Scand., 1:113–119, 1953.

[Ser79] J.-P. Serre. Local fields, volume 67 of Graduate Texts in Mathematics. Springer-Verlag, New York-Berlin, 1979.

[Sil09] J.H. Silverman. The arithmetic of elliptic curves, volume 106 of Graduate Texts in Mathematics. Springer, Dordrecht, second edition, 2009.

[Sim02] D. Simon. Solving norm equations in relative number fields using S-units. Math. Comp., 71(239):1287–1305, 2002.

[SS04] E.F. Schaefer and M. Stoll. How to do a p-descent on an elliptic curve. Trans. Amer. Math. Soc., 356(3):1209–1231, 2004.

[Top93] J. Top. Descent by 3-isogeny and 3-rank of quadratic fields. In Advances in number theory (Kingston, ON, 1991), Oxford Sci. Publ., pages 303–317. Oxford Univ. Press, New York, 1993.

[vB15] M. van Beek. Computing the Cassels-Tate Pairing. PhD thesis, University of Cam-

         bridge, 2015. https://www.repository.cam.ac.uk/handle/1810/252852.

Canons Village 1, 46, Global edu-ro 145beon-gil, Daejeong-eup, Seogwipo-si, Jeju-do, 63644, Rep. of Korea

  E-mail address: moniquevanbeek@gmail.com

University of Cambridge, DPMMS, Centre for Mathematical Sciences, Wilberforce Road, Cambridge CB3 0WB, UK

  E-mail address: T.A.Fisher@dpmms.cam.ac.uk