research38 min studyLesson 595 in Mathematics

Reduction modulo primes and Hasse's bound

Count points on a smooth finite-field reduction and distinguish singular equations, local models and intrinsic bad reduction.

On this page

What you’ll understand

  • Test good reduction on an integral model while respecting local minimality.
  • Count affine points and the point at infinity over a finite field.
  • Apply Hasse's bound and distinguish Frobenius trace from group structure.

Reducing coefficients modulo a prime converts rational arithmetic into a finite counting problem, provided the reduced curve stays smooth. The count is constrained by a square-root error bound around q+1, not arbitrary among all possible integers. Yet reduction is sensitive to the equation being used: a needlessly scaled model can have singular reduction even when the original elliptic curve has a smooth local model. The geometry of the special fiber and the arithmetic of its finite group must both be checked.

Good reduction belongs to the curve

Over Q_p, choose an integral Weierstrass equation. A discriminant that is a p-adic unit gives a smooth projective special fiber, hence good reduction. Conversely, good reduction means that such a smooth integral model exists; it does not require every integral equation for the curve to remain smooth. A locally minimal integral Weierstrass equation has discriminant of minimal valuation. For that model, a positive discriminant valuation characterizes bad reduction.

For example, at an odd prime p the equations y²=x³−x and y²=x³−p⁴x define isomorphic curves over Q_p after scaling x and y by p² and p³. The second equation has discriminant 64p¹² and singular displayed reduction, but the first has unit discriminant and proves good reduction. At genuinely bad reduction the minimal special fiber is singular; multiplicative reduction is associated with a node and additive reduction with a cusp in its Weierstrass cubic, with splitness requiring a further residue-field check.

p∤Δintegral ⟹ good reduction,good reduction ⟺ vp(Δmin⁡)=0p\nmid\Delta_{\mathrm{integral}}\ \Longrightarrow\ \text{good reduction},\qquad \text{good reduction}\ \Longleftrightarrow\ v_p(\Delta_{\min})=0
The first condition is sufficient for the displayed integral model. The equivalence uses a minimal integral Weierstrass model; a nonminimal discriminant can be divisible by p even at good reduction.↔ Scroll wide equations horizontally.

A finite-field count includes infinity

Let the residue field have odd cardinality q and consider a smooth short equation. For each x, its cubic value contributes one y if it is zero, two if it is a nonzero square, and none if it is a nonsquare. The unique projective point O contributes one more. Equivalently, the count is q+1 plus the sum of the quadratic character of the cubic, taking the character of zero to be zero. Forgetting O shifts every inferred Frobenius trace by one.

Write a_q=q+1−#E(F_q). Hasse's theorem bounds its absolute value by two square roots of q. This is a theorem for any elliptic curve over a finite field, including characteristics where a general Weierstrass model is required. It is not a bound on the number of rational points over Q. One proof uses the degree form on endomorphisms and the q-power Frobenius map; an arbitrary cubic with a singularity does not satisfy the theorem's elliptic-curve hypothesis.

#E(Fq)=q+1−aq,∣aq∣≤2q,#E(Fq2)=q2+1−(aq2−2q)\#E(\mathbb F_q)=q+1-a_q,\qquad |a_q|\le2\sqrt q,\qquad \#E(\mathbb F_{q^2})=q^2+1-(a_q^2-2q)
The extension-field formula follows from the two Frobenius roots, whose sum is a_q and product is q. Its trace differs from the prime-square coefficient of a Dirichlet L-series.↔ Scroll wide equations horizontally.

Counting does not identify every group element

The group E(F_q) is finite abelian and has at most two cyclic factors. Its cardinality alone does not decide those factors, and a cyclic toy model of the same size need not represent its group law. Rational two-torsion can immediately exclude cyclicity: if all three distinct cubic roots lie in the field, the group contains a copy of two cyclic factors of order two. Determining group structure requires additional point orders or structural information.

At a good prime, reduction is compatible with addition. Prime-to-p torsion injects into the reduced group because the formal reduction kernel has no torsion of order prime to p. This supplies useful torsion restrictions but says little directly about the free rank: infinitely many rational points can share a finite residue class. Local counts become coefficients of the global L-function later, where their relation to rank is subtler than identifying a single finite group.

Count a smooth reduction with full rational two-torsion

Count E(F₅) for y²=x³−x, calculate its Frobenius trace, and infer whether the group is cyclic.

  1. The discriminant is 64, a unit modulo five. The cubic values at x=0,1,2,3,4 are 0,0,1,4,0 modulo five.

  2. These give respectively 1,1,2,2,1 affine y-solutions. Their sum is seven; adding O gives eight points. Thus a₅=6−8=−2, inside Hasse's interval.

  3. The three y-zero points are distinct rational two-torsion points. A cyclic group of order eight has only one nonidentity point killed by two, so this group is not cyclic. Its two-factor structure is Z/2Z times Z/4Z.

The result

The point count is eight and the trace is minus two. The count together with torsion structure, rather than the count alone, identifies the group.

Explore the model

Interactive lab

Interactive lab · modular

Compare cardinality with the order of one element

Pause and reset, then set both controls to m = 8 and a = 1. Predict a cyclic orbit of period eight. For a fresh comparison, pause and reset, then set m = 8 and a = 2; predict period four. This instrument is Z/8Z. The worked elliptic group also has eight elements but has no element of order eight, so the first orbit cannot model that group. Use the comparison to distinguish group size from element order.

Compare cardinality with the order of one elementAddition modulo m starts at zero: rₙ = na mod m. Playback advances two additions per second. The orbit has period m/gcd(m,a), including period one for a = 0. This is not a cryptographic security test or a primality algorithm. Current readings: Residue r0: 0; Orbit period · m/gcd(m,a): 12; Distinct residues visited: 1 of 12. All parameters are adjustable with the labeled controls below.Repeated addition modulo 12: the current residue is 0, and the orbit period is 12.01234567891011+ 5mod 12An additive orbitn = 0rₙ = 0Period = 12Cycle starts at 0:0 → 5 → 10 → 3 →8 → 1 → 6 → 11 →4 → 9 → 2 → 7 → 0Exact residues · two additions per second
Additive orbitCurrent residue / next edge
Residue r0
0
Orbit period · m/gcd(m,a)
12
Distinct residues visited
1 of 12
t = 0 s

Addition modulo m starts at zero: rₙ = na mod m. Playback advances two additions per second. The orbit has period m/gcd(m,a), including period one for a = 0. This is not a cryptographic security test or a primality algorithm. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.

Look forTwo groups of the same cardinality can have different torsion and element orders.

Check your understanding

What follows if a nonminimal integral Weierstrass equation has discriminant divisible by p?

Try it yourself

Suppose the smooth reduction of y²=x³−x modulo seven has eight points. Find a₇ and the number of points over F₄₉. Separately explain why the scaled equation y²=x³−5⁴x does not prove bad reduction at five.

Take a moment to make a prediction or work it out on paper. Open a hint when you need one.

Give me a hint

Square the sum of Frobenius roots and subtract twice their product. For the second question, undo the scaling over Q₅.

Compare with the solution

The trace is seven plus one minus eight, hence zero. The squared-root trace over F₄₉ is a₇²−14=−14, so the count is 49+1−(−14)=64. For the scaled equation, substituting x=25x′ and y=125y′ yields y′²=x′³−x′. That equation has discriminant 64, a five-adic unit. Thus the curve has good reduction at five even though the scaled displayed model has a discriminant divisible by 5¹².

Take it with you

  • Use a smooth integral model or the minimal discriminant to classify reduction.
  • Point counts include O and satisfy Hasse's finite-field bound.
  • Finite-group cardinality, element orders and global rational rank are distinct invariants.

Read further

Original sources and deeper explanations to follow at your own pace.

Optional progress, saved in this browser when available. Revisit any lesson at any time.

Lesson not marked complete.