The modularity theorem for elliptic curves over Q is the engine of Wiles's proof of Fermat's Last Theorem, and the arithmetic of elliptic curves motivates the BSD and abc conjectures. Elliptic-curve cryptography secures a large share of today's internet traffic.
Curves defined by simple cubic equations whose points can be added together like numbers.
1A cubic curve, drawn as points
2Chord and tangent rule adds points
3Point sets form a group with a rank
4Used for Fermat's theorem and encryption
An elliptic curve over a field K (not of characteristic 2 or 3) is the set of solutions (x,y) of together with a 'point at infinity' , where the discriminant is nonzero (which makes the curve smooth, with no cusps or self-crossings). Over the complex numbers, an elliptic curve is a torus (a doughnut surface); over the rationals and finite fields it is a rich arithmetic object.
Go deeper
The full technical text.
Definition
An elliptic curve over a field K (of characteristic not 2 or 3) is the set of solutions of
y2=x
together with a point at infinity . The nonvanishing discriminant ensures the curve is smooth. Over such a curve is a torus ; over and finite fields it is a source of deep arithmetic.
Group law. Three points on the curve that lie on a line sum to O. Using this rule one defines P+Q as the reflection of the third intersection point. Its properties (associativity, an identity O, inverses) make the rational points E(K) an abelian group.
Mordell–Weil theorem. For a number field K, the group E(K) is finitely generated: E(K)≅Zr⊕E(K)tors, where r is the rank and the torsion part is a finite group. Mazur (1977) classified all possible torsion groups over Q: there are 15. Nobody knows an algorithm proven to always compute the rank. The standard method, descent, is guaranteed to finish only if the Tate–Shafarevich groupШ(E/Q) is finite, which is conjectured but unproven.
Counting points mod p. Over a finite field Fp, Hasse's bound says the number of points is p+1 up to an error of at most 2p. Schoof's algorithm counts points in polynomial time. These counts are packaged into an L-functionL(E,s).
Birch and Swinnerton-Dyer conjecture (a Clay Millennium Prize Problem): the order of vanishing of L(E,s) at s=1 equals the rank r, and the leading coefficient is given by a precise formula involving the size of Ш, a regulator and other invariants. When the vanishing order is 0 or 1 it is known that the rank equals that order and that Ш is finite (Gross–Zagier, Kolyvagin); the exact leading-coefficient formula is known only in part even there, and nothing comparable is known for order 2 or more.
Modularity and Fermat. Every elliptic curve over Q is modular, meaning its L-function comes from a modular form (Wiles, Taylor–Wiles, and Breuil–Conrad–Diamond–Taylor). Wiles's proof of a special case in 1994 completed Fermat's Last Theorem: a hypothetical solution would give an elliptic curve that cannot be modular.
Cryptography. In elliptic-curve cryptography the hard problem is the discrete logarithm: given P and kP (the point P added to itself k times), find k. Curves over finite fields give security comparable to older systems with much smaller keys, which is why they are widely deployed.
3
+
ax+
b,4a3+
27b2=
0,
O
C
C/Λ
Q
The group law
Chords and tangents define an addition: three collinear points sum to O. This makes the set E(K) of K-rational points an abelian group.
Mordell–Weil theorem. For a number field K, E(K)≅Zr⊕E(K)tors with r finite, the rank. Mazur (1977) classified the possible torsion subgroups over Q (15 groups). No algorithm is proven to compute the rank in general; the standard descent method is guaranteed to terminate only if the Tate–Shafarevich group is finite, which is conjectured but unproven.
Counting points modulo every prime packages into the Hasse–Weil L-function L(E,s)=∏pLp(E,p−s)−1. The modularity theorem (Wiles and Taylor–Wiles for semistable curves, 1995; Breuil, Conrad, Diamond and Taylor in general, 2001) says every elliptic curve over Q corresponds to a weight-2 modular form, which proves that L(E,s) has an analytic continuation and functional equation. A "Frey curve" built from a hypothetical solution of ap+bp=cp with p≥5 prime would be non-modular (Ribet), which is the link to Fermat's Last Theorem (Frey, Serre, Ribet, then Wiles).
Open questions at the centre of the subject
BSD conjecture: the order of vanishing of L(E,s) at s=1 equals the rank, with a precise formula for the leading coefficient.
Rank distribution: whether ranks are unbounded (a curve of rank at least 29 was found by Elkies and Klagsbrun in 2024, exactly 29 assuming GRH) and whether half of all curves have rank 0 and half rank 1 (Goldfeld and Katz–Sarnak heuristics). Bhargava, Shankar, Skinner and collaborators proved that positive proportions have rank 0 and rank 1, and A. Smith's work establishes the predicted behaviour of 2-power Selmer groups in many families of quadratic twists.
Szpiro's conjecture bounds the minimal discriminant by the conductor, ∣ΔE∣≪εNE6+ε. It follows from the abc conjecture, and a modified form of it is equivalent to abc.
Cryptography and computation
Elliptic-curve groups over finite fields are used because the best known attacks on the discrete logarithm for well-chosen curves are generic, about n operations for a group of order n, whereas for the multiplicative group of a finite field faster index-calculus methods exist. This allows 256-bit curves (for example Curve25519, NIST P-256) to match the security of roughly 3072-bit RSA keys. Shor's quantum algorithm would break them, which motivates post-quantum standards. Lenstra's elliptic-curve method is also a standard integer-factoring tool. Supersingular isogeny key exchange (SIDH) was broken classically in 2022 (Castryck and Decru), an example of how number-theoretic structure can undermine a proposed scheme.
Two positive whole numbers raised to the same power greater than 2 never add up to a third number raised to that power.
Elkies and Klagsbrun find an elliptic curve over Q with rank at least 29 (exactly 29 under GRH), breaking Elkies's 2006 record of 28. Month as reported; day not asserted.
Distribution of 2-power Selmer groups in quadratic twists
Alexander Smith proves the predicted distribution of 2∞-Selmer groups in quadratic-twist families of curves with full rational 2-torsion and no rational cyclic 4-isogeny, so that twists of rank at least two number o(N) among ∣d∣<N, supporting Goldfeld's conjecture.
A positive proportion of elliptic curves have rank one
Bhargava and Skinner prove that a positive proportion of elliptic curves over Q, ordered by height, have algebraic and analytic rank one, so the average rank is strictly positive.
Modularity of semistable elliptic curves and Fermat's Last Theorem
Wiles, with Taylor, proves the semistable case of modularity, which suffices for Fermat's Last Theorem. The paper appeared in the Annals in 1995 (issue 141(3), May).
What to read before Elliptic curves (left), and what builds on it: entries that depend on it and the open problems it hosts (right). Every box links to its page.