On Monday night, I kid you not, I dreamt of the Birch and Swinnerton-Dyer conjecture. It was only by name, a fleeting mention in a heated conversation I was having with a friend. I’m not sure who spoke it or why.
When I woke up, I looked it up, and found that it’s one of the Millennium Prize problems — one of seven unsolved mathematical problems for each of whose correct solutions the Clay Mathematical Institute offers an award of $1 million.
I’m vaguely familiar with these problems’ names, and the substance of only three, so after the dream, I resolved to understand the conjecture and why it remains unsolved. Here goes.
Let’s start at high-school maths.
The equation y = 2x + 1 is a straight line on a graph.
For any given value of x, there’s only one corresponding value for y.
Similarly, in high school, you’d have learnt that the equation for a circle is: x2 + y2 = 1.
If you look for points on this circle where x and y are fractions, i.e. where they’re rational, you’ll find plenty.
For example, (⅗, ⅘) is such a point on the circle because (⅗)2 + (⅘)2 = 1.
The Birch and Swinnerton-Dyer conjecture is about elliptic curves rather than circles.
Despite the name, these curves aren’t ellipses. An elliptic curve is defined by an equation that looks like this:
y2 = x3 + Ax + B
Let’s say A = -1 and B = 1. The equation becomes: y2 = x3 – x + 1
If you plot this equation on a graph, you’ll get a smooth, flowing curve.
Mathematicians are obsessed with finding the rational points on these curves, i.e. points where both x and y are fractions.
For some elliptic curves, there are only a few rational points. For other elliptic curves, there are infinitely many.
The question is: how can we tell, just by looking at the equation, how many rational points it has?
A fascinating property of elliptic curves is that you can add points together.
If you take two rational points on the curve, called P and Q, draw a line through them, and see where that line hits the curve a third time, that third point — after reflecting it across the x-axis — will also be a rational point.
Mathematicians call this point P + Q.
This is how elliptic curves have a ‘rank’.
If a curve has rank = 0, there are only a finite number of rational points on the curve. You can add them all day but you’ll keep finding the same few spots again and again.
If a curve has rank ≥ 1, it has infinitely many rational points. You can generate them by adding the rational points together to travel all over the curve.
The Birch and Swinnerton-Dyer conjecture an attempt to calculate this rank using a completely different part of maths.
To solve a difficult problem, mathematicians often try a simpler version first.
For example, in order to calculate the rank of an elliptic curve, mathematicians looked for solutions in modular arithmetic.
Consider a clock, whose numbers are modulo 12. In normal counting, 10 + 5 = 15. But on a clock, 10 + 5 = 3. This is because once the count hits 12, it resets. Since 10 + 5 = 10 + 2 + 3 = 12 + 3, you’re left with 3.
This is what modulo 12 means.
You can do the same thing with an elliptic curve equation.
You pick a prime number p (like 2, 3, 5, 7, 11…) and ask: how many integer solutions are there if we only care about the remainder when divided by p?
For instance, let’s use the elliptic curve y2 = x3 – x + 1 with p = 5.
We want to find all solutions (x, y) where the values of x are picked from the set {0, 1, 2, 3, 4} — since these are the possible remainders when divided by 5 — and the equation holds modulo 5.
This means:
1. Pick a value of x from {0, 1, 2, 3, 4}
2. Calculate y2 = x3 – x + 1 using normal arithmetic
3. Find the remainder when you divide that result (y2) by 5
4. Now find a y from {0, 1, 2, 3, 4} such that y2 has that same remainder when divided by 5
So let’s check each possible value of x:
- x = 0 so y2 = 1. Is there a y in {0, 1, 2, 3, 4} whose square equals 1 mod 5? 1 or 4
- x = 1 so y2 = 1. Is there a y in {0, 1, 2, 3, 4} whose square equals 1 mod 5? 1 or 4
- x = 2 so y2 = 7. Is there a y in {0, 1, 2, 3, 4} whose square equals 7 mod 5? None.
- x = 3 so y2 = 0. Is there a y in {0, 1, 2, 3, 4} whose square equals 0 mod 5? 0
- x = 4 so y2 = 61. Is there a y in {0, 1, 2, 3, 4} whose square equals 61 mod 5? 1 or 4
So when p = 5, the elliptic curve y2 = x3 – x + 1 had seven solutions.
Now, let Np be the number of solutions for a specific prime p. Because there are only p possible values for x and y in this scenario, finding Np is easy.
Let’s use the same example.
Since we’re working with modulo 5, both x and y can only be from {0, 1, 2, 3, 4}. That’s only five possible values each.
And for each x, we only had to check at most five values of y. That’s at most 25 checks in all — which is very easy for a computer.
Studying the curve modulo p, for many different values of p, yields information about the original curve over the rational numbers.
Specifically,finding all the rational points on the curve y2 = x3 – x + 1, e.g. (0,1), (1,1), (-1,-1), etc., is extremely difficult. There could be infinitely many and they could involve large numerators and denominators.
But for each prime p, counting how many solutions exist modulo p is easy: you just need to check all p2 possibilities.
Notice also how for any given p, there are also around a p number of solutions on average.
The number of solutions per possibility contains information about the rank of the elliptic curve.
This connection happens via the L-function.
In the 1960s, Bryan Birch and Peter Swinnerton-Dyer had a radical idea. They wondered if the number of solutions Np for various values of p could reveal the rank of the curve.
They created the L-function to hold this information, written L(E, s). This is a complex function built using all the Np values for every prime number p.
If a curve has many rational points, i.e. a high rank, we’d expect it to also have a high value of Np. If the curve has few rational points, Np should also be low.
L(E, s) is a function of the variable s.
Birch and Swinnerton-Dyer used a computer — then a room-sized machine called EDSAC 2 at the University of Cambridge — to calculate these values.
They noticed a stunning pattern.
Recall that for a given p, there are around a p number of solutions on average.
If Np > p, the curve was said to have more solutions than average for that prime.
If Np < p, the curve was said to have fewer solutions than average for that prime.
Birch and Swinnerton-Dyer checked what happened when they multiplied these results together for thousands of primes. Their product looked like this:
In words, this formula asks: across all the prime numbers up to a certain limit X, is the elliptic curve consistently producing more solutions than average or fewer?
When they plotted this formula on a graph, they noticed a clear divergence based on the rank of the curve.
If a curve had only a finite number of rational points, the product fluctuated a bit but remained relatively small and stable.
If the curve had infinite rational points, the product started to grow. The more primes they included in the calculation, the larger the product became.
Here’s a visual.
In the top graph, the blue curve has rank 0, so you see the product fluctuate but stay relatively small and bounded. The red curve has rank 1, so the product grows significantly larger.
The bottom graph shows the same curves on a logarithmic scale, revealing the pattern over a larger range of values. The blue curve stays relatively flat with small oscillations while the red curve continues to surge upwards.
Overall, Birch and Swinnerton-Dyer noticed that curves with finite rational points, i.e. rank 0, had a relatively bounded product. And curves with infinite rational points, i.e. rank ≥ 1, had a boundless product.
Ergo, higher rank means faster growth.
The product that Birch and Swinnerton-Dyer computed is closely related to the L-function.
How?
For each prime number p, they defined a variable ap = p + 1 – Np
ap measures how Np differs from the expected value p + 1.
If Np = p + 1, then ap = 0, i.e. it’s exactly average.
If Np > p + 1, then ap < 0, i.e. there are more solutions than average.
If Np < p + 1, then ap > 0, i.e. there are fewer solutions than average.
The L-function makes use of the ap value thus:
In sum, the behaviour of the product as X grows is mathematically related to whether L(E, s) has a zero at s = 1.
If you plug s = 1 into the L-function and get 0, the corresponding elliptic curve E has at least some infinite points.
But if the L-function hugs the zero very closely, the rank of the elliptic curve E is higher.
Thus, Birch and Swinnerton-Dyer conjectured: the rank of an elliptic curve is equal to the order of the zero of its L-function at s = 1.
When a function equals zero at some point, the ‘order’ says how strongly it touches zero.
If the order is 0, the function doesn’t actually equal 0 at that point. If the order is 1, the function crosses through 0 normally. If the order is 2, the function touches 0 and bounces back (e.g. y = x2 when x = 0). If the order is 3 or more, the function hugs zero closely before leaving.
If the function L(E, s) has a zero of order r at s = 1, it means:
- L(1) = 0
- L‘(1) = 0 (the first derivative is also zero)
- L”(1) = 0 (the second derivative is also zero)
- … continuing through the (r-1)th derivative
- But Lr(1) ≠ 0 (the r-th derivative is not zero)
The conjecture states that this order r equals the rank of the elliptic curve.
So if the L-function has a zero of order 2 at s = 1, the curve should have rank 2 — meaning it has infinitely many rational points that can be generated from 2 independent base points (like P and Q earlier).
While the rank is generally the most interesting part of the conjecture, the full version goes further to provide an exact formula for how the function behaves when s = 1.
Here’s the conjecture in mathematical terms:
The terms on the right side represent different properties of the curve:
— called the regulator, it measures how spread out the rational points are
— the Shafarevich-Tate group, which measures how much the curve ‘cheats’ by having solutions that look real but aren’t (this is a very hard part to calculate)
— factors related to the shape and size of the curve.
In effect, the right side of the conjecture is about analysis because it’s concerned with the analytic property of the L-function at s = 1.
The left side of the conjecture is about algebra and geometry because it depicts the rank of the elliptic curve.
Mathematically, these are such different types of objects that proving they’re always equal is extraordinarily difficult.
There’s currently no algorithm that’s guaranteed to find the rank of an arbitrary elliptic curve.
Mathematicians can find some rational points and make educated guesses but proving “that’s all of the points” or that “these points will generate all the rest” is very difficult.
The L-function is defined as an infinite product over all prime numbers.
Proving that it even converges to a particular value or that it behaves in a predictable way requires some heavy-duty mathematics.
While mathematicians know that counting the number of solutions an elliptic curve equation has modulo p can determine the structure of rational solutions, they don’t know why.
This is called the local to global principle and it’s an unsolved problem in its own right.
Mathematicians have proven the conjecture for specific families of elliptic curves — but proving it for all possible elliptic curves requires many techniques that mathematicians don’t even possess.
It’s like finding that the number of ways you can rearrange furniture in your house is secretly determined by the prime factorisation of your door number. You could check millions of houses and see the pattern holds, but why would such different things be related?
And how do you prove that this must always be true?
This is why the Birch and Swinnerton-Dyer conjecture remains unsolved.
Elliptic curves are a backbone of modern security. They’re used to secure websites, cryptocurrency transactions, app-based messaging, and so forth.
Remember that ‘adding’ two rational points P and Q could lead you to a third rational point R? Elliptic curve cryptography exploits this fact.
Choose a public elliptic curve, i.e. an elliptic curve whose equation is public, and a point G on it.
Pick a random secret number k — your private key.
Compute k.G, i.e. add G to itself k number of times. Let’s call the result Q. This is your public key.
As with all cryptography, you can share the public key (Q) but you must protect the private key (k).
Given G and Q, the task of finding k is called the elliptic curve discrete logarithm problem.
Even extremely powerful computers struggle to crack it. There’s no known efficient algorithm to solve it.
This is why understanding the distribution of rational points on elliptic curves is the foundation of how we’re keeping secrets in the digital age.
The same difficulty that makes the conjecture so hard to solve is what makes elliptic curve cryptography secure.
Mathematicians have proven the conjecture for when the rank is 0 or 1 and only for certain curves. For rank 2 or higher and for all curves, the Birch and Swinnerton-Dyer conjecture remains one of the greatest unsolved problems in mathematics.
