The Basic Theory - Elliptic Curves: Number Theory and Cryptography - page 57

Suppose there are constants c α 1 ,c α 2 su ch that

R α 1 ( x )
S α 1 ( x )

R α 2 ( x )
S α 2 ( x )

= c α 1 , = c α 2 .

Then

R α 3 ( x )
S α 3 ( x )

= c α 1 + c α 2 .

PROOF

Let ( x 1 ,y 1 )and( x 2 ,y 2 )bevariablepointson E .Write

( x 3 ,y 3 )=( x 1 ,y 1 )+( x 2 ,y 2 ) ,

where

( x 1 ,y 1 )= α 1 ( x, y ) , ( x 2 ,y 2 )= α 2 ( x, y ) .

Then x 3 and y 3 are rational functions of x 1 ,y 1 ,x 2 ,y 2 ,whichinturnare
rational functions of x, y . By Lemma 2.24, with ( u, v )=( x 2 ,y 2 ),

∂x 3

∂x 1 + ∂x 3

dy 1
dx 1

= y 3

y 1 . ∂y 1

Similarly,

∂x 3

∂x 2 + ∂x 3

dy 2
dx 2

= y 3

y 2 .

∂y 2

By assumption,

dx j
dx

= c α j y j

y

for j =1 , 2. By the chain rule,

dx 3
dx

∂x 3
∂x 1

dx 1
dx

+ ∂x 3
∂y 1

dy 1
dx 1

dx 1
dx

+ ∂x 3
∂x 2

dx 2
dx

+ ∂x 3
∂y 2

dy 2
dx 2

dx 2
dx

=

y 3
y 1

y 1

y c α 1 + y 3

y 2

=

y c α 2

y 2

=( c α 1 + c α 2 ) y 3

y .

Dividing by y 3 /y yields the result.

REMARK 2.27 In terms of differentials (see the previous Remark), we
have ( dx/y ) ◦α is a translation-invariant differential on E . Therefore it must be
a scalar multiple c α dx/y of dx/y . It follows that every nonzero endomorphism
α satisfies the hypotheses of Lemma 2.26.