18.

783 Elliptic Curves Spring 2022

Lecture #24 05/4/2022

24 Modular forms and L-functions

As we will prove in the next lecture, Fermat’s Last Theorem is a corollary of the following
theorem for elliptic curves over Q [19, 20].

Theorem 24.1 (Taylor-Wiles). Every semistable elliptic curve E/Q is modular.

In fact, as a result of subsequent work [4], we now have the following stronger result.

Theorem 24.2 (Breuil-Conrad-Diamond-Taylor). Every elliptic curve E/Q is modular.

In this lecture we will explain what it means for an elliptic curve over Q to be modular
(we will also define the term semistable).
This requires us to delve briefly into the theory of modular forms. Our goal in doing so
is simply to understand the definitions and the terminology; we will omit all but the most
straight-forward proofs.

24.1 Modular forms

Definition 24.3. A holomorphic function f : H → C is a weak modular form of weight k
for a congruence subgroup Γ if

f (γτ ) = (cτ + d)k f (τ )

for all γ = a b


c d ∈ Γ.

Example 24.4. The j-function j(τ ) is a weak modular form of weight 0 for SL2 (Z), and
j(N τ ) is a weak modular form of weight 0 for Γ0 (N ). For an example of a weak modular
form of positive weight, recall the Eisenstein series
X 1
Gk (τ ) := Gk ([1, τ ]) := ,
(m + nτ )k
m,n∈Z
(m,n)6=(0,0)

which, for k ≥ 3, is a weak modular form of weight k for SL2 (Z). To see this, recall that
SL2 (Z) is generated by the matrices S = 01 −1 and = ( 10 11 ), and note that


0 T

X 1 X τk
Gk (Sτ ) = Gk (−1/τ ) = = = τ k Gk (τ ),
(m − nτ )k (mτ − n)k
m,n∈Z m,n∈Z
(m,n)6=(0,0) (m,n)6=(0,0)

Gk (T τ ) = Gk (τ + 1) = Gk (τ ) = 1k G(τ ).

If Γ contains −I, than any weakly modular form f for Γ must satisfy f (τ ) = (−1)k f (τ ),
since −I acts trivially and cτ +d = −1; this implies that when −I ∈ Γ the only weak modular
form of odd weight is the zero function. We are specifically interested in the congruence
subgroup Γ0 (N ), which contains −I, so we will restrict our attention to modular forms of
even weight, but we should note that for other congruence subgroups such as Γ1 (N ) that
do not contains −1 (for N > 2) there are interesting modular forms of odd weight.
As we saw with modular functions (see Lecture 19), if Γ is a congruence
subgroup of
level N , meaning that it contains Γ(N ), then Γ contains the matrix T N = 10 N1 , and every

Lecture by Andrew Sutherland

weak modular form f (τ ) for Γ must satisfy f (τ + N ) = f (τ ) for τ ∈ H, since for T N we
have (cτ + d)k = 1k = 1. It follows that f (τ ) has a q-expansion of the form
∞
X
f (τ ) = f ∗ (q 1/N ) = an q n/N (q := e2πiτ ).
n=−∞

We say that f is holomorphic at ∞ if f ∗ is holomorphic at 0, equivalently, an = 0 for n < 0.

We say that f is holomorphic at the cusps if f (γτ ) is holomorphic at ∞ for all γ ∈ SL2 (Z).
As with modular functions, we only need to check this condition at a (finite) set of cusp
representatives for Γ (if f is holomorphic at a particular cusp in P1 (Q) then it is necessarily
holomorphic at every Γ-equivalent cusp). We should note that a weak modular form of
positive weight is not Γ-invariant, so even when it is holomorphic on a cusp orbit, it may
take on different values at cusps in the same orbit (but if it vanishes at a particular cusp
then it vanishes at every Γ-equivalent cusp; this is relevant to the cusp forms defined below).
Definition 24.5. A modular form f is a weak modular form that is holomorphic at the
cusps. Equivalently, f is a weak modular form that extends to a holomorphic function on
the extended upper half plane H∗ = H ∪ P1 (Q).
If Γ is a congruence subgroup that contains the matrix ( 10 11 ) then every modular form
for Γ has a q-series expansion at ∞ (or any cusp) of the form
X
f (τ ) = f ∗ (q) = an q n
n≥0

that contains only integer powers of q, regardless of the level N . This includes the congruence
subgroups Γ0 (N ) and Γ1 (N ) of interest to us. The coefficients an in the q-series for f are
also referred to as the Fourier coefficients of f .
The only modular forms of weight 0 are constant functions. This is the main motivation
for introducing the notion of weight, it allows us to generalize modular functions in an
interesting way, by strengthening their analytic properties (holomorphic on H∗ , not just
meromorphic) at the expense of weakening their congruence properties (modular forms of
positive weight are not Γ-invariant due to the factor (cτ + d)k ).
The j-function is not a modular form, since it has a pole at ∞, but the Eisenstein
functions Gk (τ ) are nonzero modular forms of weight k for SL2 (Z) for all even k ≥ 4. For
Γ = SL2 (Z) there is only one cusp to check and it suffices to note that
∞
X 1 X 1
lim Gk (τ ) = lim = 2 = 2ζ(k) < ∞,
im τ →∞ im(τ )→∞ (m + nτ )k nk
m,n∈Z n=1
(m,n)6=(0,0)

(recall that the series converges absolutely, which justifies rearranging its terms).
Definition 24.6. A modular form is a cusp form if it vanishes at all the cusps. Equivalently,
its q-expansion at every cusp has constant coefficient a0 = 0
Example 24.7. For even k ≥ 4 the Eisenstein series Gk (τ ) is not a cusp forms, but the
discriminant function
∆(τ ) = g2 (τ )3 − 27g3 (τ )2 ,
with g2 (τ ) = 60G4 (τ ) and g3 (τ ) = 140G6 (τ ), is a cusp form of weight 12 for SL2 (Z); to see
that it vanishes ∞, note that j(τ ) = g2 (τ )3 /∆(τ ) has a pole at ∞ and g2 (τ ) does not, so
∆(τ ) must vanish (see the proof of Theorem 15.11).

18.783 Spring 2022, Lecture #24, Page 2

 The set of modular forms of weight k for Γ is closed under addition and multiplication by
constants λ ∈ C and thus forms a C-vector space Mk (Γ) that contains the cusp forms Sk (Γ)
as a subspace. We also note that if f1 ∈ Mk1 (Γ) and f2 ∈ Mk2 (Γ) then f1 f2 ∈ Mk1 +k2 (Γ),
but we will not use this fact.
Remarkably, the dimensions of the vector spaces Mk (Γ) and Sk (Γ) are finite, and can be
explicitly computed in terms of invariants of the corresponding modular curve X(Γ) = H∗ /Γ.
As in Problem Set 10, let ν2 (Γ) count the number of Γ-inequivalent SL2 (Z)-translates of
i fixed by some γ ∈ Γ other than ±I (elliptic points of period 2), and similarly define ν3 (Γ)
in terms of ρ = e2πi/3 (elliptic points of period 3). Let ν∞ denote the number of cusp orbits,
and let g(Γ) be the genus of X(Γ).
Theorem 24.8. Let Γ be a congruence subgroup. For k = 0 we have dim Mk (Γ) = 1 and
dim Sk (Γ) = 0. For any even integer k > 0 we have
   
k k k
dim Mk (Γ) = (k − 1)(g(Γ) − 1) + ν2 + ν3 + ν∞ ,
4 3 2
and if k > 2 we also have
     
k k k
dim Sk (Γ) = (k − 1)(g(Γ) − 1) + ν2 + ν3 + − 1 ν∞ .
4 3 2
For k = 2 we have dim Sk (Γ) = g(Γ).
Proof. See [6, Thm. 3.5.1]

We are specifically interested in the vector space S2 (Γ0 (N )) of dimension g(Γ0 (N )).
Remark 24.9. Those who know a bit of algebraic geometry may suspect that there is a
relationship between the space of cusp forms S2 (Γ0 (N )) and the space of regular differentials
for the modular curve X0 (N ), since their dimensions coincide; this is indeed the case.

24.2 Hecke operators

In order to understand the relationship between modular forms and elliptic curves we want
to construct a canonical basis for S2 (Γ0 (N )). To help with this, we now introduce the Hecke
operators Tn on Mk (Γ0 (N )); these are linear operators that fix the subspace Sk (Γ0 (N )).1
In order to motivate the definition of the Hecke operators on modular forms, we first
define them in terms of lattices, following the presentation in [13, VII.5.1]. As in previous
lectures, a lattice (in C) is an additive subgroup of C that is a free Z-module of rank 2
containing an R-basis for C.
For each positive integer n, the Hecke operator Tn sends each lattice L = [ω1 , ω2 ] to the
formal sum of its index-n sublattices.
X
Tn L := L0 . (1)
[L:L0 ]=n

Here we are working in the free abelian group Div L generated by the setP
L of all P
lattices;
we extend Tn linearly to an an endomorphism of Div L (this means Tn L := Tn L).
Another family of endomorphisms of Div L are the homethety operators Rλ defined by
Rλ L := λL, (2)
1
One can define Hecke operators more generally on Mk (Γ1 (N )), which contains Mk (Γ0 (N ), but the
definition is more involved and not needed here.

18.783 Spring 2022, Lecture #24, Page 3

for any λ ∈ C× . This setup might seem overly abstract, but it allows one to easily prove
some essential properties of the Hecke operators that are applicable in many settings. When
defined in this generality the Hecke operators are also sometimes called correspondences.

Remark 24.10. Recall that if E/C is the elliptic curve isomorphic to the torus C/L, the
index-n sublattices of L correspond to n-isogenous elliptic curves. The fact that the Hecke
operators average over sublattices is related to the fact that the relationship between modular
forms and elliptic curves occurs at the level of isogeny classes.

Theorem 24.11. The operators Tn and Rλ satisfy the following:

(i) Tn Rλ = Rλ Tn and Rλ Rµ = Rλµ .

(ii) Tmn = Tm Tn for all m ⊥ n.
(iii) Tpr+1 = Tpr Tp − pTpr−1 Rp for all primes p and integers r ≥ 1.

Proof. (i) is clear, as is (ii) if we note that for m ⊥ n there is a bijection between index-mn
sublattices L00 of L and pairs (L0 , L00 ) with [L : L0 ] = n and [L0 : L00 ] = m. For (iii), the first
term on the RHS counts pairs (L0 , L00 ) with [L : L0 ] = p and [L0 : L00 ] = pr , and the second
term corrects for over counting; see [13, Prop. VII.10] for details.

Corollary 24.12. The subring of End(Div(L)) generated by {Rp , Tp : p prime} is commu-

tative and contains all the Hecke operators Tn .

Proof. By recursively applying (iii) we can reduce any Tpr to a polynomial in Tp and Rp ,
and any two such polynomials commute (since Tp and Rp commute, by (i)). Moreover,
(i) and (ii) imply that for distinct primes p and q, polynomials in Tp , Rp commute with
polynomials in Tq , Rq . Using (ii) and (iii) we can reduce any Tn to a product of polynomials
in Tpi , Rpi for distinct primes pi and the corollary follows.

Any function F : L → C extends linearly to a function F : Div(L) → C to which we may

apply any operator T ∈ End(Div(L)), yielding a new function T F : Div(L) → C defined by
T F : D 7→ F (T (D); restricting T F to L ⊆ Div(L) then gives a function T F : L → C that we
regard as the transform of our original function F by T . This allows us to apply the Hecke
operators Tn and homethety operators Rλ to any function that maps lattices to complex
numbers. We will work this out explicitly for the Hecke operators acting on modular forms
for SL2 (Z) in the next section.

24.3 Hecke operators for modular forms of level one

We now define the action of the Hecke operators Tn on Mk (SL2 (Z) = Mk (Γ0 (1)). The case
Mk (Γ0 (N )) is analogous, but the details are more involved, so let us assume N = 1 for the
sake of presentation and address N > 1 in remarks.
Let f : H → C be a modular form of weight k. We can view f (τ ) as a function on lattices
[1, τ ], which we extend to arbitrary lattices L = [ω1 , ω2 ] by defining

f ([ω1 , ω2 ]) := f (ω1−1 [1, ω2 /ω1 ]) := ω1−k f ([1, ω2 /ω1 ]),

we assume ω1 and ω2 are ordered so that ω2 /ω1 is in the upper half plane. Conversely, any
function F : L → C on lattices induces a function τ 7→ F ([1, τ ]) on the upper half plane.
Viewing our modular form f as a function L → C, we can transform this function by any

18.783 Spring 2022, Lecture #24, Page 4

T ∈ End(Div(L)) as described above, thereby obtaining a new function L → C that induces
a function T f : H → C on the upper half plane. In general the function T f need not be a
modular form, but for f ∈ Mk (Γ0 (1)) it is (we will verify this in the cases of interest to us).
Motivated by the discussion above, for f ∈ Mk (Γ0 (1)) we define
Rλ f (τ ) := f (λ[1, τ ]) = λ−k f (τ ),
which clearly lies in Mk (Γ0 (1)), and if f is a cusp form then so is Rλ f .
We define Tn f similarly, but introduce a scaling factor of nk−1 that simplifies the formulas
that follow. An easy generalization of Lemma 20.2 shows that for each integer n ≥ 1, the
index n sublattices of [1, τ ] are given by
n o
[d, aτ + b] : ad = n, 0 ≤ b < d ;

see [13, Lem. VII.5.2], for example. If we rescale by d−1 to put them in the form [1, ω], we
have ω = (aτ + b)/d. For f ∈ Mk (Γ0 (1)) we thus define Tn f as
 
k−1
X
k−1
X
−k aτ + b
Tn f (τ ) := n f (L) = n d f ,
d
[[1,τ ]:L]=n ad=n, 0≤b<d

which is also clearly an element of Mk (Γ0 (1)), and if f is a cusp form, so is Tn f . It is

clear from the definition that Tn acts linearly, so it is a linear operator on the vector spaces
Mk (Γ0 (1)) and Sk (Γ0 (1)). Theorem 24.11 then yields the following corollary.
Corollary 24.13. The Hecke operators Tn for Mk (Γ0 (1)) satisfy Tmn = Tm Tn for m ⊥ n
and Tpr+1 = Tpr Tp − pk−1 Tpr−1 for p prime.
Proof. The first equality is clear; the second term on the RHS of the second equality arises
from the fact that pTpr−1 Rp f = pk−1 Tpr−1 f .

The corollary implies that we may restrict our attention to the Hecke
P operators Tp for
p prime. Let us compute the q-series expansion of Tp f , where f (τ ) = ∞ a
n=1 n q n is a cusp

form of weight k for Γ0 (1). We have

 
k−1
X
−k aτ + b
Tp f (τ ) = p d f
d
ad=p
0≤b<d
p−1  
k−1 −1
X τ +b
=p f (pτ ) + p f
p
b=0
∞
X p−1 X
X ∞
= pk−1 an e2πinp + p−1 an e2πin(τ +b)/p
n=1 b=0 n=1
∞
X p−1
XX ∞
= pk−1 an q np + p−1 an ζpbn q n/p
n=1 b=0 n=1
∞ ∞ p−1
!
X X X
= pk−1 an/p q n + p−1 an ζpbn q n/p
n=1 n=1 b=0
∞ 
X 
= anp + pk−1 an/p q n ,
n=1

18.783 Spring 2022, Lecture #24, Page 5

where ζp = e2πi/p and an/p is defined to be 0 when p - n. This calculation yields the
following theorem and corollary, in which we use an (f ) to denote the coefficient of q n in the
q-expansion of f .
Theorem 24.14. For any f ∈ Sk (Γ0 (1)) and prime p we have
(
anp (f ) if p - n,
an (Tp f ) = k−1
anp (f ) + p an/p (f ) if p | n.
Corollary 24.15. For any modular form f ∈ Sk (Γ0 (1)) and integers m ⊥ n we have
am (Tn f ) = amn (f ); in particular, a1 (Tn f ) = an (f ).
Proof. The corollary follows immediately from Theorem 24.14 for n prime. For composite n
(and any m ⊥ n), we proceed by induction on n. If n = cd with c ⊥ d both greater than 1,
then by Theorem 24.14 and the inductive hypothesis we have
am (Tn f ) = am (Tc Td f ) = amc (Td f ) = amcd = amn .
For n = pr+1 , applying Theorem 24.14, Corollary 24.13, and the inductive hypothesis yields
am (Tpr+1 f ) = am (Tpr Tp f ) − pk−1 am (Tpr−1 f )
= ampr (Tp f ) − pk−1 ampr−1 (f )
= ampr+1 (f ) + pk−1 ampr−1 (f ) − pk−1 ampr−1 (f )
= amn (f ),
as desired.

Remark 24.16. All the results in this section hold for f ∈ Sk (Γ0 (N )) if we restrict to Hecke
operators Tn with n ⊥ N , which is all that we require, and the key result a1 (Tn f ) = an (f )
holds in general. For p|N the definition of Tp (and Tn for p|n) needs to change and the
formulas in Corollary 24.13 and Theorem 24.14 must be modified. The definition of the
Hecke operators is more complicated (in particular, it depends on the level N ), but some of
the formulas are actually simpler (for example, for p|N we have Tpr = Tpr ).

24.4 Eigenforms for the Hecke operators

The Hecke operators Tn defined in the previous section form an infinite family of linear
operators on the vector space Sk (Γ0 (1). We are interested in the elements f ∈ Sk (Γ0 (1))
that are simultaneous eigenvectors for all the Hecke operators; this means that for every
n ≥ 1 we have Tn f = λn f for some eigenvalue λn ∈ C of Tn . When such an f also satisfies
a1 (f ) = 1, we call it a (normalized) eigenform. It is not immediately obvious that such f
exist, but we will prove that they do, and that they provide a canonical basis for Sk (Γ0 (1)).
Given an eigenform f , we can read off the corresponding Hecke eigenvalues λn from its
an q n : if Tn f = λn f then we must have
P
q-expansion f =
λn = λn a1 = a1 (Tn f ) = an (f ) = an ,
by Corollary 24.15. Corollary 24.13 implies that the an then satisfy
amn = am an (m ⊥ n), (3)
apr = ap apr−1 − p k−1
apr−2 (p prime).
In particular, the coefficients an are completely determined by the values ap at primes p.

18.783 Spring 2022, Lecture #24, Page 6

Remark 24.17. For k = 2 the recurrence for apr should look familiar: it is the same
recurrence satisfied by the Frobenius traces apr := pr + 1 − #E(Fpr ) of an elliptic curve
E/Fp , as shown in Problem Set 7.

Our goal in this section is to construct a basis of eigenforms for Sk (Γ0 (1)), and prove
that it is unique. In order to do so, we need to introduce the Petersson inner product, which
defines a Hermitian form
on the C-vector spaces Sk (Γ) (for any2 congruence subgroup Γ).
Recall that for γ = c d ∈ SL2 (Z), we have im γτ = im τ /|cτ +d| , thus for any f, g ∈ Sk (Γ)
a b

we have
 k
im τ
f (γτ )g(γτ )(im γτ )k = (cτ + d)k f (τ )(cτ̄ + d)k g(τ ) = f (τ )g(τ )(im τ )k .
|cτ + d|2

The function f (τ )g(τ )(im τ )k is thus Γ-invariant. If we parameterize the upper half-plane
H with real parameters x = re τ and y = im τ , so τ = x + iy, it is straight-forward to check
that the measure ZZ
dxdy
µ(U ) = 2
U y
is SL2 (Z)-invariant (hence Γ-invariant), that is, µ(γU ) = µ(U ) for all measurable sets U ⊆
H. This motivates the following definition.

Definition 24.18. The Petersson inner product on Sk (Γ) is defined by

Z
hf, gi = f (τ )g(τ )y k−2 dxdy, (4)
F

where the integral ranges over points τ = x + yi in a fundamental region F ⊆ H for Γ. It

is easy to check that hf, gi is a positive definite Hermitian form: it is bilinear in f and g,
it satisfies hf, gi = hg, f i, and hf, f i ≥ 0 with equality only when f = 0. It thus defines an
inner product on the C-vector space Sk (Γ).

One can show that the Hecke operators for Sk (Γ0 (1)) are self-adjoint with respect to
the Petersson inner product, that is, they satisfy hf, Tn gi = hTn f, gi. The Tn are thus
Hermitian (normal) operators, and we know from Corollary 24.13 that they all commute
with each other. This makes it possible to apply the following form of the Spectral Theorem.

Lemma 24.19. Let V be a finite-dimensional C-vector space equipped with a positive definite
Hermitian
L form, and let α1 , α2 , . . . be a sequence of commuting Hermitian operators. Then
V = i Vi , where each Vi is an eigenspace of every αn .

Proof. The matrix for α1 is Hermitian, therefore diagonalizable, 2 so we can decompose V

as a direct sum of eigenspaces for α1 , writing V = i V (λi ), where the λi are the distinct
L
eigenvalues of α1 . Because α1 and α2 commute, α2 must fix each subspace V (λi ), since
for each v ∈ V (λi ) we have α1 α2 v = α2 α1 v = α2 λi v = λi α2 v, and therefore α2 v is an
eigenvector for α1 with eigenvalue λi , so α2 v ∈ V (λi ). Thus we can decompose each V (λi )
as a direct sum of eigenspaces for α2 , and may continue in this fashion for all the αn .

By Lemma 24.19, we may decomposePSk (Γ0 (1)) = i Vi as a direct sum of eigenspaces

L
for the Hecke operators Tn . Let f (τ ) = an q n be a nonzero element of Vi . We then have
a1 (Tn f ) = an , by Corollary 24.13, and also Tn f = λn f , for some eigenvalue λn of Tn which
2
This fact is also sometimes called the Spectral Theorem and proved in most linear algebra courses.

18.783 Spring 2022, Lecture #24, Page 7

is determined by Vi , so an = λn a1 . This implies a1 6= 0, since otherwise f = 0, and if we
normalize f so that a1 = 1 (which we can do, since f is nonzero and Vi is a C-vector space),
we then have an = λn for all n ≥ 1, and f completely determined by the sequence of Hecke
eigenvalues λn for Vi . It follows that every element of Vi is a multiple of f , so dim Vi = 1
and the eigenforms in Sk (Γ0 (1)) form a basis.

Theorem 24.20. The space of cusp forms Sk (Γ0 (1)) is a direct sum of one-dimensional
eigenspaces for the Hecke operators Tn and has a unique basis of eigenforms f (τ ) = an q n ,
P
where each an is the eigenvalue of Tn on the one-dimensional subspace spanned by f .

The analog of Theorem 24.20 fails for Sk (Γ0 (N )) for two reasons, both of which are
readily addressed. First, as in Remark 24.16, we need to restrict our attention to the Hecke
operators Tn with n ⊥ N (when n and N have a common factor Tn is not necessarily a
Hermitian operator with respect to the Petersson inner product). We can then proceed as
above to decompose Sk (Γ0 (N )) into eigenspaces for the Hecke operators Tn with n ⊥ N . We
then encounter the second issue, which is that these eigenspaces need not be one-dimensional.
In order to obtain a decomposition into one-dimensional eigenspaces we must restrict our
attention to a particular subspace of Sk (Γ0 (N )).
Note that for any M |N the space Sk (Γ0 (M ) is a subspace of Sk (Γ0 (N )) (since Γ0 (M )-
invariance implies Γ0 (N )-invariance for M |N ). We say that a cusp form f ∈ Sk (Γ0 (N )) is
old if it also lies in the subspace Sk (Γ0 (M )) for some M properly dividing N . The oldforms
in Sk (Γ0 (N )) generate a subspace Skold (Γ0 (N )), and we define Sknew (Γ0 (N )) as the orthogonal
complement of Skold (Γ0 (N )) in Sk (Γ0 (N ) (with respect to the Petersson inner product), so
that
Sk (Γ0 (N )) = Skold (Γ0 (N )) ⊕ Sknew (Γ0 (N )),
and we call the eigenforms in Sknew (Γ0 (N )) newforms (normalized so a1 = 1). One can show
that the Hecke operators Tn with n ⊥ N preserve both Skold (Γ0 (N )) and Sknew (Γ0 (N )). If we
then decompose Sknew (Γ0 (N )) into eigenspaces with respect to these operators, the resulting
eigenspaces are all one-dimensional, moreover, each is actually generated by an eigenform (a
simultaneous eigenvector for all the Tn , not just those with n ⊥ N that we used to obtain
the decomposition); this is a famous result of Atkin and Lehner [3, Thm. 5]. Note that
Sknew (Γ0 (1)) = Sk (Γ0 (1)), and we thus have the following generalization of Theorem 24.20.

Theorem 24.21. The space Sknew (Γ0 (N )) is a direct sum of one-dimensional eigenspaces for
an q n , where each an
P
the Hecke operators Tn and has a unique basis of newforms f (τ ) =
is the eigenvalue of Tn on the one-dimensional subspace spanned by f .

24.5 The L-function of a modular form

Our interest in cusp forms is that each has an associated L-function, which is defined in
terms of a particular Dirichlet series.

Definition 24.22. A Dirichlet series is a series of the form

X
L(s) = an n−s ,
n≥1

where the an are complex numbers and s is a complex variable. Provided the an satisfy
a polynomial growth bound of the form |an | = O(nσ ) (as n → ∞), then the series L(s)
converges locally uniformly in the right half plane Re(s) > 1 + σ and defines a holomorphic

18.783 Spring 2022, Lecture #24, Page 8

function in this region (which may extend to a holomorphic or meromorphic function on a
larger region).
Example 24.23. The most famous Dirichlet series is the Riemann zeta function
∞
X
ζ(s) = n−s .
n=1

which converges locally uniformly to a holomorphic function on re(s) > 1. It has three
properties worth noting:
• analytic continuation: ζ(s) extends to a meromorphic function on C (with a simple
pole at s = 1 and no other poles);
• functional equation: the completed zeta function 3 ζ̂(s) = π −s/2 Γ(s/2)ζ(s) satisfies
ζ̂(s) = ζ̂(1 − s);

• Euler product: we can write ζ(s) as a product over primes (for re(s) > 1) via
Y Y ∞
X
ζ(s) = (1 − p−s )−1 = (1 + p−s + p−2s + . . . ) = n−s .
p p n=1
P∞
Definition 24.24. The L-function (or L-series) of a cusp form f (τ ) = n=1 an q
n of
weight k is the complex function defined by the Dirichlet series
∞
X
L(f, s) := an n−s ,
n=1

which converges locally uniformly to a holomorphic function on re(s) > 1 + k/2.

Theorem 24.25 (Hecke). Let f ∈ Sk (Γ0 (N )). The L-function L(f, s) extends analytically
to a holomorphic function on C, and the normalized L-function
L̃f (s) = N s/2 (2π)−s Γ(s)L(f, s).
satisfies the functional equation
L̃f (s) = ±L̃f (k − s).
Remark 24.26. There are more explicit versions of this theorem that also determine the
sign in the functional equation above.
For newforms we also get an Euler product.
Theorem 24.27. Let f ∈ Sknew (Γ0 (N )). The L-function L(f, s) has the Euler product
∞
X Y
L(f, s) = an n−s = (1 − ap p−s + χ(p)pk−1 p−2s )−1 , (5)
n=1 p

where χ(p) = 0 for p|N and χ(p) = 1 otherwise.

The function χ in Theorem 24.27 is the principal Dirichlet character of conductor N ,
a periodic function Z → C supported on (Z/N Z)× that defines a group homomorphism
(Z/N Z)× → C (the adjective “principal” indicates that the homomorphism is trivial).
R∞
3
Here Γ(s) := 0
e−t ts−1 dt is Euler’s gamma function.

18.783 Spring 2022, Lecture #24, Page 9

24.6 The L-function of an elliptic curve
What does all this have to do with elliptic curves? Like eigenforms, elliptic curves over Q
also have an L-function with an Euler product. In fact, with elliptic curves, we use the Euler
product to define the L-function.
Definition 24.28. The L-function of an elliptic curve E/Q is given by the Euler product
Y Y
−1
L(E, s) = Lp (p−s )−1 = 1 − ap p−s + χ(p)pp−2s , (6)
p p

where χ(p) is 0 if E has bad reduction at p, and 1 otherwise.4 For primes p where E has
good reduction (all but finitely many), ap := p + 1 − #Ep (Fp ) is the trace of Frobenius,
where Ep denotes the reduction of E modulo p. Equivalently, Lp (T ) is the numerator of the
zeta function
∞
!
X Tn 1 − ap T + pT 2
Z(Ep ; T ) = exp #Ep (Fpn ) = ,
n (1 − T )(1 − pT )
n=1

that appeared in the special case of the Weil conjectures that you proved in Problem Set 7.
For primes p where E has bad reduction, the polynomial Lp (T ) is defined by

if E has additive reduction at p.


1

Lp (T ) = 1 − T if E has split mulitiplicative reduction at p.
1 + T if E has non-split multiplicative reduction at p.



according to the type of bad reduction E that has at p, as explained in the next section.
This means that ap ∈ {0, ±1} at bad primes.
The L-function L(E, s)(s) converges to a holomorphic function on re(s) > 3/2.

24.7 The reduction type of an elliptic curve

When computing L(E, s)(s), it is important to use a minimal Weierstrass equation for E,
one that has good reduction at as many primes as possible. To see why this is necessary,
note that if y 2 = x3 + Ax + B is a Weierstrass equation for E, then, up to isomorphism, so is
y 2 + u4 Ax + u6 B, for any integer u, and this equation will have bad reduction at all primes
p|u. Moreover, even though the equation y 2 = x3 + Ax + B always has bad reduction at 2,
there may be an equation for E in general Weierstrass form that has good reduction at 2.
For example, the elliptic curve defined by y 2 = x3 + 16 is isomorphic to the elliptic curve
defined by y 2 + y = x3 (replace x by 4x, divide by 64, and then replace y by y + 1/2), which
does have good reduction at 2.
Definition 24.29. Let E/Q be an elliptic curve. A (global) minimal model for E is an
integral Weierstrass equation

y 2 + a1 xy + a3 y = x3 + a2 x2 + a4 x + a6 ,

with a1 , a2 , a3 , a4 , a6 ∈ Z that defines an elliptic curve that isomorphic to E and whose

discriminant ∆min (E) divides the discriminant of every integral Weierstrass equation for E.
4
As explained in §24.7, this assumes we are using a minimal Weierstrass equation for E.

18.783 Spring 2022, Lecture #24, Page 10

 It is not immediately obvious that minimal models necessarily exist, but for elliptic
curves over Q this is so; see [14, Prop. VII.1.3].5 One can construct a minimal model in
Sage using E.minimal_model(); see [9] for an explicit algorithm.
We now address the three types of bad reduction. To simplify the presentation, we will
ignore the prime 2, but the three cases described below also occur at 2. For any odd prime p
of bad reduction we can represent the singular curve Ep /Fp by an equation of the form
y 2 = f (x), for some cubic f ∈ Fp [x] that has a repeated root r. The repeated root r is
necessarily rational, and by replacing x with x − r we can assume r = 0, so y 2 = x3 + ax2 for
some a ∈ Fp . The projective curve y 2 z = x3 + ax2 z has exactly one singular point (0 : 0 : 1)
and is smooth elsewhere (including the point (0 : 1 : 0) at infinity).
If we exclude the singular point (0 : 0 : 1), the standard formulas for the group law on
Ep (Fp ) still make sense, and the set

Epns (Fp ) := Ep (Fp ) − {(0 : 0 : 1)}

of non-singular points of Ep (Fp ) is closed under the group operation.6 Thus Epns (Fp ) is a
finite abelian group. We now define

ap := p − #Epns (Fp ).

This is analogous to the good reduction case in which ap = p + 1 − #Ep (Fp ); we have
removed the (necessarily rational) singular point, so we reduce ap by one.
There are two cases to consider, depending on whether f (x) has a double or triple root
at 0; these two cases give rise to three possibilities for the group Epns (Fp ).

• Case 1: triple root (y 2 = x3 )

We have the projective curve zy 2 = x3 . After removing the singular point (0 : 0 : 1),
every other projective point has non-zero y coordinate, so we can fix y = 1, and work
with the affine curve z = x3 . There are p-solutions to this equation (including x = 0
and z = 0, which corresponds to the projective point (0 : 1 : 0) at infinity. It follows
that Epns (Fp ) is a cyclic group of order p, which is necessarily isomorphic to the additive
group of Fp ; see [16, §2.10] for an explicit isomorphism. In this case we have ap = 0
and say that E has additive reduction at p.
• Case 2: double root (y 2 = x3 + ax2 , a 6= 0).
We have the projective curve zy 2 = x3 +ax2 z, and the point (0 : 1 : 0) at infinity is the
only non-singular point on the curve whose x or z coordinate is zero. Excluding the
point at infinity for the moment, let us divide both sides by x2 , introduce the variable
t = y/x, and fix z = 1. This yields the affine curve t2 = x + a, and the number of
5
For an elliptic curve E over a number field K one defines ∆min (E) as the OK -ideal generated by the
discriminants of all integral models for E (with a1 , a2 , a3 , a4 , a6 ∈ OK ); if the class number of OK is greater
than one this ideal need not be a principal ideal, in which case E cannot have a minimal model over K.
6
To this geometrically, note that any line in P2 intersecting a plane cubic in two non-singular points
cannot also intersect it in a singular point; when we count intersections with multiplicity the total must be
three, by Bezout’s theorem, but singular points contribute multiplicity greater than one.

18.783 Spring 2022, Lecture #24, Page 11

 points with x 6= 0 is
X 
x+a
 X  
x+a
   
a
1+ = 1+ − 1+
p x
p p
x6=0
    
X x a
= 1+ −1−
x
p p
 
a
=p−1−
p
 
where ap is the Kronecker symbol. If we now add the point at infinity into our total
we get p − ap , so ap = p − (p − ap ) = ap = ±1. In this case we say that E has

multiplicative reduction at p, and distinguish the cases ap = 1 and ap = −1 as split and

non-split respectively. One can show that in the split case Epns (Fp ) is isomorphic to the
multiplicative group F×p , and in the non-split case it is isomorphic to the multiplicative
subgroup of Fp2 = Fp [x]/(x2 − a) consisting of the norm 1 elements; see [16, §2.10].

To sum up, there are three possibilities for ap = p − #Epns (Fp ):

additive reduction,

0

ap = +1 split multiplicative reduction,
non-split multiplicative reduction.

−1


It can happen that the reduction type of E changes when we consider E as an elliptic
curve over a finite extension K/Q (in which case we are then talking about reduction modulo
primes p of K lying above p). It turns out that this can only happen when E has additive
reduction at p, which leads to the following definition.

Definition 24.30. An elliptic curve E/Q is semi-stable if it does not have additive reduction
at any prime.

As we shall see in the next lecture, for the purposes of proving Fermat’s Last Theorem,
we can restrict our attention to semi-stable elliptic curves.

24.8 L-functions of elliptic curves versus L-functions of modular forms

Although we defined the L-function of an elliptic curve using an Euler product, we can
always expand this product to obtain a Dirichlet series
∞
Y
−1 X
L(E, s) = 1 − ap p−s + χ(p)pp−2s = an n−s .
p n=1

We now observe that the integer coefficients an in the Dirichlet series for L(E, s) satisfy
the recurrence relations listed in (3) for an eigenform of weight k = 2. We have a1 = 1,
amn = am an for m ⊥ n, and apr+1 = ap apr − papr−1 for all primes p of good reduction, as
you proved on Problem Set 7. For the primes of bad reduction we have ap ∈ {0, ±1} and it
easy to check that apr = arp , which applies to the coefficients of an eigenform in Sknew (Γ0 (N ))
when p|N (see Remark 24.16).

18.783 Spring 2022, Lecture #24, Page 12

 So it now makes sense to ask, given an elliptic curve E/Q, is there
P∞a modular form f for
which L(E, s) = L(f, s)? Or, to put it more simply, let L(E, s) = n=1 an n , and define
−s

∞
X
fE (τ ) = an q n (q := e2πiτ )
n=1

Our question then becomes: is fE (τ ) a modular form?

It’s clear from the recurrence relation for apr that if fE (τ ) is a modular form, then it
must be a modular form of weight 2; but there are additional constraints. For k = 2 the
equations (5) and (6) both give the Euler product
Y
−1
1 − ap p−s + χ(p)pp−2s ,
p

and it is essential that χ(p) is the same in both cases. For newforms f ∈ Sknew (Γ0 (N )) we
have χ(p) = 0 for primes p|N , while for elliptic curves E/Q we have χ(p) = 0 for primes
p|∆min (E). No elliptic curve over Q has good reduction at every prime, so we cannot use
eigenforms of level 1, we need to consider newforms of some level N > 1.
This suggests we take N to be the product of the prime divisors of ∆min (E), but note
that any N with the same set of prime divisors would have the same property, so this doesn’t
uniquely determine N . For semi-stable elliptic curves, it turns out that taking the product
of the prime divisors of ∆min (E) is the correct choice, and this is all we need for the proof
of Fermat’s Last Theorem.

Definition 24.31. Let E/Q be a semi-stable elliptic curve with minimal discriminant
∆min (E). The conductor NE of E is the product of the prime divisors of ∆min (E).

In general, the conductor NE of an elliptic curve E/Q is always divisible by the product
of the primes p|∆min (E), and NE is squarefree if and only if E is semi-stable. For primes
p where E has multiplicative reduction (split or non-split) p|NE but p2 - NE , and when E
has additive reduction at p then p2 |NE and if p > 3 then p3 - NE . The primes 2 and 3
require special treatment (as usual): the maximal power of 2 dividing NE may be as large
as 28 , and the maximal power of 3 dividing NE may be as large as 35 , see [15, IV.10] for the
details, which are slightly technical.
We can now say precisely what it means for an elliptic curve over Q to be modular.

Definition 24.32. An elliptic curve E/Q is modular if fE is a modular form.

If E/Q is modular, the modular form fE is necessarily a newform in S2new (Γ0 (NE )) with
an integral q-expansion; this follows from the Eichler-Shimura Theorem (see Theorem 24.37).

Theorem 24.33 (Modularity Theorem). Every elliptic curve E/Q is modular.

Proof. This is proved in [4], which extends the results in [19, 20] to all elliptic curve E/Q.

Prior to its proof, the conjecture that every elliptic curve E/Q is modular was variously
known as the Shimura-Taniyama-Weil conjecture, the Taniyama-Shimura-Weil conjecture,
the Taniyama-Shimura conjecture, the Shimura-Taniyama conjecture, the Taniyama-Weil
conjecture, or the Modularity Conjecture, depending on the author. Thankfully, everyone
is now happy to call it the Modularity Theorem!

18.783 Spring 2022, Lecture #24, Page 13

24.9 BSD and the parity conjecture
When E is modular, the L-function of E if necessarily the L-function of a modular form, and
this implies that L(E, s) has an analytic continuation and satisfies a functional equation,
since this holds for the L-function of a modular form, by Theorem 24.25. Prior to the proof
of the modularity theorem, this was an open question known as the Hasse-Weil conjecture;
we record it here as a corollary to the Modularity Theorem.

Corollary 24.34. Let E be an elliptic curve over Q. Then L(E, s) has an analytic contin-
uation to a holomorphic function on C, and the normalized L-function
s/2
L̃E (s) := NE (2π)−s Γ(s)L(E, s)

satisfies the functional equation

L̃E (s) = wE L̃E (2 − s),

where wE = ±1.

The sign wE in the functional equation is called the root number of E. If wE = −1 then
the functional equation implies that L̃E (s), and therefore L(E, s), has a zero at s = 1; in
fact it is easy to show that wE = 1 if and only if L(E, s) has a zero of even order at s = 1.
The conjecture of Birch and Swinnerton-Dyer (BSD) relates the order of vanishing of
L(E, s) at s = 1 to the rank of E(Q). Recall that

E(Q) ' E(Q)tor × Zr ,

where E(Q)tor denotes the torsion subgroup of E(Q) and r is the rank of E.

Conjecture 24.35 (Weak BSD). Let E/Q be an elliptic curve of rank r. Then L(E, s) has
a zero of order r at s = 1.

The strong version of the BSD conjecture makes a more precise statement that expresses the
leading coefficient of the Taylor expansion of L(E, s) at s = 1 in terms of various invariants
of E. A proof of even the weak form of the BSD conjecture is enough to claim the Millennium
Prize offered by the Clay Mathematics Institute. There is also the Parity Conjecture, which
simply relates the root number wE in the functional equation for L(E, s) to the parity of r
as implied by the BSD conjecture.

Conjecture 24.36 (Parity Conjecture). Let E/Q be an elliptic curve of rank r. Then the
root number is given by wE = (−1)r .

24.10 Modular elliptic curves

The relationship between elliptic curves and modular forms is remarkable and not at all
obvious. It is reasonable to ask why people believed the modular conjecture in the first
place. Probably the most compelling reason is that every newform of weight 2 with an
integral q-series gives rise to an elliptic curve E/Q.

Theorem 24.37 (Eichler-Shimura, Carayol). Let f = an q n ∈ S2new (Γ0 (N )) be a newform

P
with an ∈ Z. There exists an elliptic curve E/Q of conductor N for which fE = f .

18.783 Spring 2022, Lecture #24, Page 14

See [10, V.6] and for an overview of how to construct the elliptic curve given by the theorem,
which was known long before the modularity theorem was proved.7 For a more detailed (but
still very accessible) exposition, see [12].
The elliptic curve E whose existence is guaranteed by the Eichler-Shimura theorem is
determined only up to isogeny.8 This is due to the fact that isogenous elliptic curves E
and E 0 over Q necessarily have the same L-function, which implies fE = fE 0 . If E and E 0
are isogenous over Q then the there reductions modulo any prime p where they both have
good reduction are necessarily isogenous, and as you showed on Problem Set 7, they must
have the same trace of Frobenius ap ; it turns out that in fact E and E 0 must have the same
reduction type at every prime so their L-function are actually identical. The converse also
holds; in fact, something even stronger is true; this follows from work begun by Tate and
completed by Faltings in 1983 [7]; see [10, Thm. V.4.1] for further details.
Theorem P 24.38 (Faltings-Tate). Let
P E0 and E 0 be elliptic curves over Q with L-function
L(E, s) = −s 0
an n and L(E , s) = an n , respectively. If ap = a0p for sufficiently many
−s

primes p of good reduction for E and E 0 , then E and E 0 are isogenous.

What “sufficiently many” means depends on E and E 0 , but it is a finite number. In
particular, all but finitely many is always enough, which is all we need for the next lecture.
Corollary 24.39. Elliptic curves E, E 0 /Q are isogenous if and only if L(E, s) = L(E 0 , s),
equivalently, if and only if Ep and Ep0 are isogenous modulo sufficiently many good primes p.
The fact that isogenous elliptic curves have the same L-functions while distinct newforms
have distinct L-functions means that the correspondence between elliptic curves and weight-
2 newforms with an ∈ Z is many-to-one, not one-to-one; there can be up to 8 isomorphism
classes of elliptic curves E/Q in the same isogeny class (but no more than 8, this is a result
of Kenku [8]). But the modularity theorem implies that there is a one-to-one correspondence
between isogeny classes of elliptic curves over Q and weight-2 newforms with an ∈ Z.
For any given value of N , one can effectively enumerate the newforms in S2new (Γ0 (N ))
with integral q-expansions; this is a finite list. It is also possible (but not easy)9 to determine
the isogeny classes of all elliptic curves of a given conductor N for suitable values of N ,
without assuming these elliptic curves are modular; this is also a finite list. When this was
done for many small values of N , it was found that the two lists always matched perfectly.
It was this matching that made the modularity conjecture truly compelling. Much of this
matching was done before Theorems 24.37 and 24.38 had been completely proved, but they
were both conjectured (and partially proved) much earlier.

References
[1] M. K. Agrawal, John H. Coates, David C. Hunt, Alfred J. van der Poorten, Elliptic
curves of conductor 11, Math. Comp. 35 (1980), 991-1002.

[2] Amod Agashe, Kenneth Ribet, and William A. Stein, The Manin constant, Pure and
Applied Mathematics Quarterly 2 (2006), 617–636.
7
The original results of Eichler and Shimura [17] proved ap (E) = ap (f ) only for primes of good reduction
and did not address the correspondence between the level and the conductor. The correspondence between
the level and conductor was conjectured by Weil but not rigorously proved until 1986 by Carayol [5, §0.8].
8
But there is an optimal representative for each isogeny class; see John Cremona’s appendix to [2].
9
This requires enumerating all solutions to certain Diophantine equations; see [1] and [11] for examples.

18.783 Spring 2022, Lecture #24, Page 15

[3] A.O.L. Atkin and J. Lehner, Hecke operators on Γ0 (m), Mathematische Annalen 185
(1970), 134–160.

[4] Christophe Breuil, Brian Conrad, Fred Diamond, and Richard Taylor, On the modularity
of elliptic curves over Q: wild 3-adic exercises, Journal of the AMS 14 (2001), 843–939.

[5] Henri Carayol, Sur les représentations l-adiques associées aux formes modulaires de
Hilbert, Ann. Sci. École Norm. Sup. (4) 19 (1986), 409–468.

[6] Fred Diamond and Jerry Shurman, A first course in modular forms, Springer, 2005.

[7] Gerd Faltings, Finiteness theorems for abelian varieties over number fields, Inventiones
73 (1983), 349–366.

[8] M. A. Kenku, On the number of Q-isomorphism classes of elliptic curves in each Q-

isogeny class, Journal of Number Theory 15 (1982), 199–202.

[9] Michael Laska, An algorithm for finding a minimal Weierstrass equation for an elliptic
curve, Mathematics of Computation 38 (1982), 257-260.

[10] J. S. Milne, Elliptic curves, BookSurge Publishers, 2006.

[11] Andrew P. Ogg, Abelian curves of small conductor , J. Reine Angew. Math. 224 (1967),
204–215.

[12] Corentin Perent-Gentil, Associating abelian varieties to weight-2 modular forms: the
Eichler-Shimura construction, Master’s thesis, EPF Lausanne, 2014.

[13] Jean-Pierre Serre, A course in arithmetic, Springer, 1973.

[14] Joseph H. Silverman, The arithmetic of elliptic curves, second edition, Springer, 2009.

[15] Joseph H. Silverman, Advanced topics in the arithmetic of elliptic curves, Springer,
1994.

[16] Lawrence C. Washington, Elliptic curves: Number theory and cryptography, second
edition, Chapman and Hall/CRC, 2008.

[17] Goro Shimura, Correspondances modulaires et les fonctions ζ de courbes algébriques,

Journal of the Mathematical Society of Japan, 10 (1958), 1–28.

[18] Goro Shimura, Introduction to the arithmetic theory of automorphic functions, Publi-
cations of the Mathematical Society of Japan 11, 1971.

[19] Richard Taylor and Andrew Wiles, Ring-theoretic properties of certain Hecke algebras,
Annals of Mathematics 141 (1995), 553–572.

[20] Andrew Wiles, Modular elliptic curves and Fermat’s last theorem, Annals of Mathe-
matics 141 (1995), 443-551.

18.783 Spring 2022, Lecture #24, Page 16