# Elliptic Loops

Massimiliano Sala1 Daniele Taufer2

( 1University of Trento -<EMAIL_ADDRESS>
2KU Leuven -<EMAIL_ADDRESS>111Corresponding author. Postal address:
Celestijnenlaan 200A, B-3001 Leuven (Belgium)
March 2023)

###### Abstract

Given a local ring $(R,\mathfrak{m})$ and an elliptic curve
$E(R/\mathfrak{m})$, we define its _elliptic loop_ as the points of
$\mathbb{P}^{2}(R)$ projecting to $E$ under the canonical
modulo-$\mathfrak{m}$ reduction, endowed with an operation that extends the
curve’s addition. While its subset of points satisfying the curve’s
Weierstrass equation is a group, this larger object is proved to be a power-
associative abelian algebraic loop, which is seldom completely associative.
When an elliptic loop has no points of order $3$, its affine part is obtained
as a stratification of a one-parameter family of elliptic curves defined over
$R$, which we call _layers_. Stronger associativity properties are established
when $\mathfrak{m}^{e}$ vanishes for small values of $e\in\mathbb{Z}$. When
the underlying ring is $R=\mathbb{Z}/p^{e}\mathbb{Z}$, the infinity part of an
elliptic loop is generated by two elements, the group structure of layers may
be established and the points with the same projection and same order possess
a geometric description.

MSC 2020: 11G07, 14H52, 14L10, 20N05

Keywords: Elliptic Curves, Lifts, Elliptic Loops, Layers, Addition Laws.

##  1 Introduction

Elliptic curves have been proving to be a field of intense research and
fruitful applications. They were born as smooth plane projective cubics with
(at least) a rational point defined over a field, but they have been
generalized over arbitrary base schemes as proper smooth curves with
geometrically connected genus-one fibers, with a prescribed zero section.

Their main interest resides in the possibility of endowing these objects with
an abelian group structure [9, Theorem 2.1.2], so that they constitute the
abelian varieties of minimal positive dimension. When the underlying structure
is a ring with prescribed properties, these objects may be embedded in a
projective plane and their addition law may be explicitly determined [10].
Among the several research lines offered by these objects, their lifting has
played a crucial role both from theoretical [13] and applied [17, 20] purview.

In the literature, lifts of elliptic curves over fields are usually
investigated under several strong (classical) assumptions, including: lifting
to integral domains, having a prescribed characteristic and enjoying certain
levels of topological separation (usually, Hausdorff). With such requirements,
the resulting lifts may still be proven to be abelian varieties [13].
Moreover, there are typically multiple lifts of a given curve, which are
considered individually. Apart from the canonical lift [5], the others are
often indistinguishable and their interplay has not been deeply investigated.

In this work, we relax these assumptions by investigating large objects made
of all the projective points reducing to a given base curve. They are globally
non-associative, yet they contain the usual lifts as associative sections.
This way, we are not selecting special lifts of the base curve, but we are
considering all of them at once.

Precisely, we study the projective points over a local ring $(R,\mathfrak{m})$
with $6\in R^{*}$ that project to an elliptic curve of odd order defined by a
short Weierstrass model over $R/\mathfrak{m}$, namely we define the set

$\mathcal{L}_{A,B}(R)=\\{(X:Y:Z)\in\mathbb{P}^{2}(R)\ |\
X^{3}+AXZ^{2}+BZ^{3}-Y^{2}Z\in\mathfrak{m}\\}.$

We call these objects _elliptic loops_ , as we prove they are power-
associative abelian algebraic loops (Proposition 3.6 and Proposition 5.3).
This result follows by establishing a sufficient criterion to ensure triples
associativity in terms of the rank of a prescribed matrix (Theorem 5.2).

Elliptic loops are not the first occurrence of quasigroups arising from
operations between the points of cubics [6]. Elliptic curves may also be
obtained as sections of cubic hypersurfaces, which were proved to be
commutative Moufang loops [11] that are not necessarily groups [8]. The loops
defined in the present paper have weaker associativity properties, since they
do not need to satisfy the Moufang identities. However, they are usually
larger objects that appear to be natural candidates for investigating the
lifts of the given curve, as they are proved to have a notably ordered
geometric structure.

The affine part of elliptic loops is completely described in terms of a new
family of elliptic curves, which are defined over $R$ by non-invertible linear
combinations of the Weierstrass polynomial and its Hessian polynomial, namely
for every $t\in\mathfrak{m}$ by the equation

$x^{3}+Axz^{2}+Bz^{3}-y^{2}z-t(3Ax^{2}z+3xy^{2}+9Bxz^{2}-A^{2}z^{3})=0.$

Those projective cubics are again abelian varieties, which we call _layers_
since in absence of points of order $3$ they are proved to stratify the affine
part of $\mathcal{L}_{A,B}(R)$ (Proposition 6.3). For $t=0$, this construction
agrees with the standard definition of elliptic curves over the ring $R$.

The infinity part of $\mathcal{L}_{A,B}(R)$ exhibits a different behavior:
layers may have a non-trivial intersection at infinity when $R$ has zero-
divisors (Proposition 7.3). Moreover, layers do not necessarily cover the
whole infinity part: if the base ring is Hausdorff with a discrete valuation
$\mathrm{v}$, we show that layers never contain non-zero points at infinity
$(X:1:Z)$ with $\mathrm{v}(Z)\leq\mathrm{v}(X)$ (Lemma 7.2).

If the base ring is Hausdorff and $\mathfrak{m}$ has a non-zero integer
generator (e.g. a Cohen ring), the loop at infinity behaves similarly to the
additive group of $\mathfrak{m}$ (Proposition 7.1). When $R$ is a discrete
valued ring, this is consistent with the known structure of formal groups
constructed over large powers of $\mathfrak{m}$, which can be made explicit
via the discrete logarithm map [19, Theorem IV.6.4].

When $\mathfrak{m}^{\mathcal{N}}\neq\langle 0\rangle$ for small values of
$\mathcal{N}\in\mathbb{Z}_{>0}$, we can explicitly exhibit triples of non-
associative points of elliptic loops (Section 8.1). Conversely, if
$\mathfrak{m}^{\mathcal{N}}=\langle 0\rangle$ for small values of
$\mathcal{N}\in\mathbb{Z}_{>0}$, then special families of triples may be
proved associative (Section 8.2).

When $R$ is Hausdorff and $\mathfrak{m}^{2}=\langle 0\rangle$, the points with
any given finite torsion lying over the same base point $P$ may be obtained
via the additive action of a group at infinity (Theorem 9.1), therefore they
are proved to be projectively collinear, and if $\mathfrak{m}$ is a principal
$\mathbb{Z}$-module, then they precisely are all the points of such line
projecting to $P$ (Proposition 9.2).

When the underlying ring is $\mathbb{Z}/p^{e}\mathbb{Z}$, the infinity part of
elliptic loops is generated (as a loop) by the points $(p:1:0)$ and $(0:1:p)$,
which have both order $p^{e-1}$ (Theorem 10.1). These generators play
different roles with respect to elliptic curves defined over the same ring, as
the group $\langle(0:1:p)\rangle$ is proved to be a forbidden locus for layers
(Lemma 10.2). Moreover, there are several other groups at infinity of the same
order, namely the infinity part of layers, which is also proved to be a cyclic
group of order $p^{e-1}$ (Proposition 10.3). As a consequence, if we let $E$
be the projected elliptic curve over $\mathbb{F}_{p}$, every layer is
isomorphic to either $\mathbb{Z}/p^{e-1}\mathbb{Z}\times E$ or to
$\mathbb{Z}/p^{e}\mathbb{Z}$.

###  1.1 Paper organization

This paper is organized as follows.

  * •

In Section 2, we recall the known definitions and results that we employ
throughout the work.

  * •

Section 3 is devoted to defining elliptic loops and proving that they are
abelian algebraic loops.

  * •

Novel properties of the Hessian of a Weierstrass polynomial are presented in
Section 4.

  * •

The power-associativity of elliptic loops is proved in Section 5.

  * •

In Section 6, we define layers and we prove that they stratify the affine
points of elliptic loops.

  * •

Several properties of the infinity loop are examined in Section 7. From this
section, the base ring is often required to be Hausdorff.

  * •

In Section 8, we exhibit further associativity properties: although elliptic
loops are proved to be almost never associative, weak forms of associativity
are established under certain conditions.

  * •

When the above conditions are met, we characterize in Section 9 the geometry
of points with order dividing a prescribed integer.

  * •

Noteworthy structure results hold when the underlying ring is
$R=\mathbb{Z}/N\mathbb{Z}$, which is examined in Section 10.

  * •

Finally, conclusions and further work are proposed in Section 11.

The Magma [1] code for verifying the symbolic computations involved in this
work may be found in [24]. For the sake of readability, the several formal
verifications involved in the proofs of the current paper are omitted, but the
reader can straightforwardly verify them by running the corresponding Magma
code, which contains precise references to the related results.

##  2 Preliminaries

In this paper, $R$ is always a local commutative ring with unity and $6\in
R^{*}$, and its maximal ideal is denoted by $\mathfrak{m}$. We let $\pi:R\to
R/\mathfrak{m}$ be the canonical projection into the residue field, and to
simplify the notation we also denote every componentwise or coefficientwise
projection by $\pi$, i.e. for every $n\in\mathbb{Z}_{\geq 1}$ we write

$\pi\big{(}(X_{i})_{1\leq i\leq n}\big{)}=\big{(}\pi(X_{i})\big{)}_{1\leq
i\leq n}\in(R/\mathfrak{m})^{n}\quad{\rm
and}\quad\pi\left(\sum_{d=0}^{n}f_{d}x^{d}\right)=\sum_{d=0}^{n}\pi(f_{d})x^{d}\in(R/\mathfrak{m})[x].$

Given some elements $u_{1},\dots,u_{s}$ of a ring $\mathcal{R}$, we denote by
$\langle u_{1},\dots,u_{s}\rangle$ the ideal they generate in $\mathcal{R}$.
In the context of the present paper, $\mathcal{R}$ will be either the local
ring $R$ or a polynomial ring with coefficients in $R$.

A tuple in $(X_{0},\dots,X_{n})\in R^{n+1}$ is called _primitive_ if $\langle
X_{0},\dots,X_{n}\rangle=R$, which for local rings is equivalent to having at
least one entry $X_{i}$ not in $\mathfrak{m}$. The group of units
$R^{*}=R\setminus\mathfrak{m}$ acts on the primitive $(n+1)$-tuples by
componentwise multiplication, and its quotient by this action is the
_projective $n$-space_ over $R$, denoted by $\mathbb{P}^{n}(R)$. The orbit of
an element $(X_{0},\dots,X_{n})$ is denoted by $(X_{0}:\dots:X_{n})$. We say
that a point is _affine_ if its last coordinate does not belong to
$\mathfrak{m}$, otherwise we say it is _at infinity_.

Let $n,m\in\mathbb{Z}_{\geq 1}$ and $A\in M_{n\times m}(R)$. For every integer
$1\leq t\leq\min\\{n,m\\}$, the _t-minor ideal_ $I_{t}(A)$ is defined as the
ideal generated by the $t$-th minor determinants of $A$, namely the ideal
generated by all the determinants of the $t\times t$ submatrices of $A$. By
convention we set $I_{0}(A)=R$, and for every $t>\min\\{n,m\\}$ we set
$I_{t}(A)=\langle 0\rangle$. We also recall [3, Chapter 4] that the rank of
$A$ is defined by

$\textnormal{rk}\,A=\max_{t\in\mathbb{Z}_{\geq 0}}\\{I_{t}(A)\neq\langle
0\rangle\\}.$

This notion of rank over rings provides us with a practical way of testing if
two projective points are equal [15, Lemma 6]:

$(X_{0}:\dots:X_{n})=(Y_{0}:\dots:Y_{n})\in\mathbb{P}^{n}(R)\quad\iff\quad\textnormal{rk}\,\begin{bmatrix}X_{0}&\dots&X_{n}\\\
Y_{0}&\dots&Y_{n}\end{bmatrix}=1.$

Given a homogeneous polynomial $F\in R[x_{0},\dots,x_{n}]$, its evaluation on
a given projective point $P=(X_{0}:\dots:X_{n})\in\mathbb{P}^{n}(R)$ is unique
modulo $R^{*}$, and we equivalently denote it by $F(P)$ or
$F(X_{0},\dots,X_{n})$.

In this work, we only consider the _projective plane_ $\mathbb{P}^{2}(R)$.
Irreducible projective plane cubics with a rational point are called _elliptic
curves_. Since $6\in R^{*}$, it is well-known [19, Section III.1] that, up to
a change of coordinates, they all arise from zero-sets of short Weierstrass
polynomials, i.e. there are $A,B\in R$ such that

$\Delta_{A,B}=-(4A^{3}+27B^{2})\in R^{*},$

and such that the elliptic curve is given by

$E_{A,B}(R)=\\{(X:Y:Z)\in\mathbb{P}^{2}(R)\ |\
X^{3}+AXZ^{2}+BZ^{3}-Y^{2}Z=0\\}.$

Lenstra has proved [10, Section 3] that these objects have a group structure,
which arises from a combination of different addition laws [2, Section 4].
Whenever the projected curve $E_{A,B}(R/\mathfrak{m})$ has no $2$-torsion
points, this operation may be entirely described by the addition law
corresponding to $(0:1:0)$. Since this is a slight assumption in the
computational practice (e.g. for ordinary curves employed in cryptographic
applications), we assume that it is always the case. We recall here for
convenience the explicit formulation of this addition law, with the minor
correction pointed out in [23, Section 2.11]:

$(X_{1}:Y_{1}:Z_{1})+_{(0:1:0)}(X_{2}:Y_{2}:Z_{2})=(T_{1}:T_{2}:T_{3}),$

where

$\displaystyle T_{1}=\ $ $\displaystyle
Y_{1}Y_{2}(X_{1}Y_{2}+X_{2}Y_{1})-AX_{1}X_{2}(Y_{1}Z_{2}+Y_{2}Z_{1})-A(X_{1}Y_{2}+X_{2}Y_{1})(X_{1}Z_{2}+X_{2}Z_{1})$
$\displaystyle-3B(X_{1}Y_{2}+X_{2}Y_{1})Z_{1}Z_{2}-3B(X_{1}Z_{2}+X_{2}Z_{1})(Y_{1}Z_{2}+Y_{2}Z_{1})+A^{2}(Y_{1}Z_{2}+Y_{2}Z_{1})Z_{1}Z_{2},$
$\displaystyle T_{2}=\ $ $\displaystyle
Y_{1}^{2}Y_{2}^{2}+3AX_{1}^{2}X_{2}^{2}+9BX_{1}X_{2}(X_{1}Z_{2}+X_{2}Z_{1})-A^{2}X_{1}Z_{2}(X_{1}Z_{2}+2X_{2}Z_{1})$
$\displaystyle-A^{2}X_{2}Z_{1}(2X_{1}Z_{2}+X_{2}Z_{1})-3ABZ_{1}Z_{2}(X_{1}Z_{2}+X_{2}Z_{1})-(A^{3}+9B^{2})Z_{1}^{2}Z_{2}^{2},$
$\displaystyle T_{3}=\ $ $\displaystyle
3X_{1}X_{2}(X_{1}Y_{2}+X_{2}Y_{1})+Y_{1}Y_{2}(Y_{1}Z_{2}+Y_{2}Z_{1})+A(X_{1}Y_{2}+X_{2}Y_{1})Z_{1}Z_{2}$
$\displaystyle+A(X_{1}Z_{2}+X_{2}Z_{1})(Y_{1}Z_{2}+Y_{2}Z_{1})+3B(Y_{1}Z_{2}+Y_{2}Z_{1})Z_{1}Z_{2}.$

The following lemma provides us with a clean and computationally efficient way
of evaluating the above addition law.

######  Lemma 2.1.

Let $Q_{1},Q_{2},Q_{3},Q_{4}\in R[X_{i},Y_{i},Z_{i}]_{i\in\\{1,2\\}}$ be the
homogeneous polynomials of bidegree $(1,1)$ defined by

$\displaystyle Q_{1}$
$\displaystyle=-AX_{1}Z_{2}-AX_{2}Z_{1}-3BZ_{1}Z_{2}+Y_{1}Y_{2},$
$\displaystyle Q_{2}=A^{2}Z_{1}Z_{2}-AX_{1}X_{2}-3BX_{1}Z_{2}-3BX_{2}Z_{1},$
$\displaystyle Q_{3}$ $\displaystyle=AZ_{1}Z_{2}+3X_{1}X_{2},$ $\displaystyle
Q_{4}=AX_{1}Z_{2}+AX_{2}Z_{1}+3BZ_{1}Z_{2}+Y_{1}Y_{2}.$

By defining

$\displaystyle T_{1}$
$\displaystyle=(X_{1}Y_{2}+X_{2}Y_{1})Q_{1}+(Z_{1}Y_{2}+Z_{2}Y_{1})Q_{2},$
$\displaystyle T_{2}$ $\displaystyle=Q_{1}Q_{4}-Q_{2}Q_{3},$ $\displaystyle
T_{3}$
$\displaystyle=(X_{1}Y_{2}+X_{2}Y_{1})Q_{3}+(Z_{1}Y_{2}+Z_{2}Y_{1})Q_{4},$

we have

$(T_{1}:T_{2}:T_{3})=(X_{1}:Y_{1}:Z_{1})+_{(0:1:0)}(X_{2}:Y_{2}:Z_{2}).$

###### Proof.

Straightforward computation. ∎

###  2.1 Discrete valued ring

Let $\mathbb{Z}\cup\\{\infty\\}$ be the ordered additive monoid obtained from
$(\mathbb{Z},+,\leq)$ by adding the element $\infty$, such that for every
$\gamma\in\mathbb{Z}\cup\\{\infty\\}$ it satisfies

$\infty+\gamma=\infty,\quad\text{and}\quad\infty\geq\gamma.$

When the map

$\mathrm{v}:R\to\mathbb{Z}\cup\\{\infty\\},\quad
X\mapsto\mathrm{v}(X)=\sup_{i\in\mathbb{Z}}\\{X\in\mathfrak{m}^{i}\\},$

satisfies, for every $X,Y\in R$,

$\mathrm{v}(XY)=\mathrm{v}(X)+\mathrm{v}(Y),$

it is called the _$\mathfrak{m}$ -adic valuation_ of $R$, and it turns this
ring into a _discrete valued ring_ , which corresponds to the classical
_discrete valuation ring_ (DVR) when $R$ is a domain. Sometimes $\mathrm{v}$
is required to be surjective [12], but we remark that this is not the case
here, as we are mainly interested in proper subsets of
$\mathbb{Z}\cup\\{\infty\\}$.

It is easy to see that $R^{*}=\\{X\in R\ |\ \mathrm{v}(X)=0\\}$, and
$\mathfrak{m}=\\{X\in R\ |\ \mathrm{v}(X)\geq 1\\}$. Moreover, for every
$i\in\mathbb{Z}_{\geq 0}$ the ideal $\mathfrak{m}^{i}$ is $\mathrm{v}$-closed,
namely

$X\in\mathfrak{m}^{i},\ \mathrm{v}(Y)\geq\mathrm{v}(X)\implies
Y\in\mathfrak{m}^{i}.$

Finally, for any integer $n\in\mathbb{Z}$, we denote the valuation of
$n$-times the unity of $R$ by $\mathrm{v}(n)=\mathrm{v}(n\cdot 1_{R})$.

###  2.2 Hausdorff rings

Many results about points at infinity will require the considered ring $R$ to
be _Hausdorff_ , namely its $\mathfrak{m}$-topology is Hausdorff, i.e.

$\bigcap_{i\in\mathbb{Z}_{\geq 0}}\mathfrak{m}^{i}=\langle 0\rangle.$

For Hausdorff rings we may define the _nilpotency_ of $\mathfrak{m}$ as

$\mathcal{N}=\inf_{i\in\mathbb{Z}_{\geq 1}}\big{\\{}\mathfrak{m}^{i}=\langle
0\rangle\big{\\}}.$

We remark that a Hausdorff ring may have $\mathfrak{m}^{i}\neq\langle
0\rangle$ for every $i\in\mathbb{N}$, e.g. if $R=\mathbb{Z}_{p}$ is the ring
of $p$-adic integers. In such cases, we have
$\mathcal{N}=\inf\emptyset=\infty$.

In Hausdorff rings, the inclusion sequence

$R=\mathfrak{m}^{0}\supset\mathfrak{m}\supset\dots\supset\mathfrak{m}^{\mathcal{N}}=\langle
0\rangle$

is strictly decreasing until it stabilizes to $\langle 0\rangle$.

If $R$ is a Hausdorff discrete valued ring, then $0$ is the unique element of
maximal (infinite) valuation. There are many examples of such rings. As an
instance, when the maximal ideal is principal
$\mathfrak{m}=\langle\mathcal{\mu}\rangle$, we call its generator
$\mathcal{\mu}$ the _uniformizer_ of $R$, and it is well known that the
following are equivalent.

  * •

$R$ is Noetherian,

  * •

$R$ is Hausdorff,

  * •

either $R$ is a DVR, or there exists $n\in\mathbb{Z}_{\geq 1}$ such that the
ideals of $R$ are precisely $\\{\mathfrak{m}^{i}\\}_{0\leq i\leq n}$.

The ring $R$ is a DVR precisely when $\mathcal{N}=\infty$. If $\mathcal{N}$ is
finite, it coincides with the $n$ of the above equivalence. Moreover, $R$ is a
field precisely when $\mathcal{N}=1$, and in this case the $\mathfrak{m}$-adic
valuation of $R$ is the trivial valuation, namely for every $X\neq 0$ we have
$\mathrm{v}(X)=0$. When this is not the case, for every non-zero element $X\in
R$ there are uniquely determined $u\in R^{*}$ and
$e_{X}\in\\{0,\dots,\mathcal{N}-1\\}$ such that

$X=u\mathcal{\mu}^{e_{X}}.$

In this case, the $\mathfrak{m}$-adic valuation of $R$ is the map
$\mathrm{v}(X)=e_{X}$.

###  2.3 Finite rings

When the ring $R$ is local and finite, we have convenient enumerative
properties [7], which we recall here: $\mathfrak{m}$ is a nilpotent ideal, the
residue field is a finite field $R/\mathfrak{m}\simeq\mathbb{F}_{q}$ for some
prime power $q=p^{t}$, and every $\mathfrak{m}^{i}/\mathfrak{m}^{i+1}$ is a
finite-dimensional $\mathbb{F}_{q}$-vector space, so there is a positive
$e\in\mathbb{Z}_{>0}$ such that

$|R|=q^{e},\quad|\mathfrak{m}|=q^{e-1}.$

One can explicitly count the points in projective spaces by observing that
affine elements may be assumed to have the last entry equal to $1$, while the
infinity part of $\mathbb{P}^{n}(R)$ may be realized by $|\mathfrak{m}|$
copies of $\mathbb{P}^{n-1}(R)$. Hence, we inductively have

$|\mathbb{P}^{n}(R)|=\sum_{i=0}^{n}|R|^{n-i}|\mathfrak{m}|^{i}=q^{en}\left(1+\frac{1}{q}+\dots+\frac{1}{q^{n}}\right)=\frac{q^{en+1}-(q^{n})^{e-1}}{q-1}.$

###  2.4 Non-associative structures

We recall some basic definitions and results about non-associative algebraic
structures [18].
A _magma_ $\mathcal{M}$ is a set equipped with a (closed) binary operation
$+:\mathcal{M}\times\mathcal{M}\to\mathcal{M}$.
A _quasigroup_ $\mathcal{Q}$ is a magma satisfying the _Latin square property_
, i.e.

$\forall P,Q\in\mathcal{Q}\ \exists!\ X,Y\in\mathcal{Q}\ :\
\begin{cases}P+X=Q,\\\ Y+P=Q.\end{cases}$

A _loop_ $\mathcal{L}$ is a quasigroup with _identity_ , i.e. there is
$\mathcal{O}\in\mathcal{L}$ such that

$\forall P\in\mathcal{L}\ :\ P+\mathcal{O}=\mathcal{O}+P=P.$

A magma (resp. quasigroup, loop) is called _abelian_ if its operation $+$ is
commutative.

An abelian loop $\mathcal{L}$ is called

  * •

_alternative loop_ , if $\forall P,Q\in\mathcal{L}\ :\ P+(P+Q)=(P+P)+Q$,

  * •

_Jordan loop_ , if $\forall P,Q\in\mathcal{L}\ :\
(P+P)+(P+Q)=P+\big{(}Q+(P+P)\big{)}$,

  * •

_Moufang loop_ (or _Bol loop_), if $\forall P,Q,R\in\mathcal{L}\ :\
\big{(}P+(Q+R)\big{)}+R=\big{(}(P+R)+R\big{)}+Q$,

  * •

_power-associative loop_ , if the subloop generated by any element is
associative,

  * •

_diassociative loop_ , if the subloop generated by any subset of size at most
two is associative.

Finally, we observe that diassociative clearly implies power-associative,
while it can be shown that Moufang implies both alternative and dissociative.

##  3 Elliptic Loops

######  Definition 3.1 (Elliptic Loop).

Let $A,B\in R$ be elements defining an elliptic curve
$E_{A,B}(R/\mathfrak{m})$ without points of even order. We define its
_Elliptic Loop_ as the set

$\mathcal{L}_{A,B}(R)=\\{(X:Y:Z)\in\mathbb{P}^{2}(R)\ |\
X^{3}+AXZ^{2}+BZ^{3}-Y^{2}Z\in\mathfrak{m}\\},$

endowed with the operation $+_{(0:1:0)}$, simply referred to as $+$. When the
coefficients and the underlying ring are understood, we simply denote it by
$\mathcal{L}$. The polynomial $x^{3}+Axz^{2}+Bz^{3}-y^{2}z\in R[x,y,z]$ is
referred to as the _defining polynomial of_ $\mathcal{L}$.

######  Remark 3.2.

The operation $+$ always depends on the considered $A,B\in R$. Moreover, as
recalled in the previous section, the absence of points of order $2$ in
$E(R/\mathfrak{m})$ guarantees that the operation $+$ is always well-defined
between points of $\mathcal{L}$.

Elliptic loops canonically project on their underlying elliptic curve via
$\pi$, and it is easy to see that when $R$ is finite this is a
$|\mathfrak{m}|^{2}$-covering of the curve. We define their _affine_ (resp.
_infinity_) _points_ $\mathcal{L}^{a}$ (resp. $\mathcal{L}^{\infty}$) as those
projecting to affine points of $E_{A,B}(\mathbb{F}_{q})$ (resp. to
$\mathcal{O}$), namely

$\mathcal{L}^{a}=\\{(X:Y:Z)\in\mathcal{L}\ |\
Z\not\in\mathfrak{m}\\},\quad\mathcal{L}^{\infty}=\\{(X:1:Z)\\}_{X,Z\in\mathfrak{m}}.$

We remark that, as a set, $\mathcal{L}^{\infty}=\pi^{-1}(\mathcal{O})$ is
independent of the considered curve parameters $A,B\in R$, so it is common to
all the elliptic loops over the same ring $R$, but its operation depends on
the coefficients of the underlying curve.

The elliptic loop constructed over $E=E_{A,B}(R/\mathfrak{m})$ contains (set-
theoretically) the points of every possible lift of $E$ over $R$. The next
lemma shows that its affine part is precisely made of the affine points of
classical elliptic curves over $R$ that project on $E$.

######  Lemma 3.3.

Let $\mathcal{L}=\mathcal{L}_{A,B}(R)$ be an elliptic loop and
$P\in\mathcal{L}^{a}$ be one of its affine points. For every
$\alpha\in\mathfrak{m}$ there exists $\beta\in\mathfrak{m}$ such that $P\in
E_{A+\alpha,B+\beta}(R)$.

###### Proof.

Since $P$ is affine, we may assume $P=(X:Y:1)$. For every
$\alpha\in\mathfrak{m}$, we define

$\beta=Y^{2}-X^{3}-(A+\alpha)X-B.$

We immediately verify that $P$ satisfies the Weierstrass equation of
$E_{A+\alpha,B+\beta}(R)$. Since $\alpha X\in\mathfrak{m}$ and by definition
of elliptic loop $Y^{2}-X^{3}-AX-B\in\mathfrak{m}$, then also
$\beta\in\mathfrak{m}$. ∎

Unlike the affine component, the infinity part $\mathcal{L}^{\infty}$ usually
contains more points than those arising from elliptic curves over $R$, such as
$\\{(0:1:\alpha)\\}_{\alpha\in\mathfrak{m}\setminus\\{\mathcal{O}\\}}$.

We now show that the name is well-given, i.e. $\mathcal{L}$ is always an
algebraic loop. We begin by proving that it is a set with a well-defined
commutative binary operation, namely an abelian magma.

######  Proposition 3.4.

Every elliptic loop $\mathcal{L}=\mathcal{L}_{A,B}(R)$ is an abelian magma
with identity $\mathcal{O}=(0:1:0)$. Moreover, every element
$(X:Y:Z)\in\mathcal{L}$ has a unique inverse

$-(X:Y:Z)=(X:-Y:Z).$

###### Proof.

The addition law $+$ is symmetric in the two addenda, hence it is commutative.
Moreover, it is defined by polynomial relations in their entries, hence it
commutes with $\pi$, so for every $P_{1},P_{2}\in\mathcal{L}$ we have

$\pi(P_{1}+P_{2})=\pi(P_{1})+\pi(P_{2})\in E_{A,B}(R/\mathfrak{m}).$

This shows that $P_{1}+P_{2}\in\mathcal{L}$, hence $+$ is a well-defined
binary operation on $\mathcal{L}$.

To show that $\mathcal{O}$ acts as identity, we explicitly compute

$(X:Y:Z)+(0:1:0)=(XY:Y^{2}:YZ).$

Since $E(R/\mathfrak{m})$ has no points of order $2$, the latter needs to be a
proper projective point, hence we have $Y\not\in\mathfrak{m}$ and we conclude
$(XY:Y^{2}:YZ)=(X:Y:Z)\in\mathbb{P}^{2}(R)$.

To show that $(X:-Y:Z)$ is an inverse of $(X:Y:Z)$, we compute

$(X:Y:Z)+(X:-Y:Z)=(0:3AX^{4}+18BX^{3}Z-6A^{2}X^{2}Z^{2}-6ABXZ^{3}+Y^{4}+(-A^{3}-9B^{2})Z^{4}:0),$

and since the operation is well-defined, the result equals $\mathcal{O}$.

As for the uniqueness part, let $P_{1}=(X_{1}:Y_{1}:Z_{1})$ and
$P_{2}=(X_{2}:Y_{2}:Z_{2})$ be two points of $\mathcal{L}$ such that

$(T_{1}:T_{2}:T_{3})=P_{1}+P_{2}=\mathcal{O}\in\mathbb{P}^{2}(R).$

We observe that, as polynomials in $R[X_{i},Y_{i},Z_{i}]_{i\in\\{1,2\\}}$, we
have

$(X_{1}Y_{2}+X_{2}Y_{1})T_{2}\in\langle
T_{1},T_{3}\rangle,\quad(Y_{1}Z_{2}+Y_{2}Z_{1})T_{2}\in\langle
T_{1},T_{3}\rangle.$

hence $(T_{1}:T_{2}:T_{3})=\mathcal{O}$ implies
$X_{1}Y_{2}+X_{2}Y_{1}=Y_{1}Z_{2}+Y_{2}Z_{1}=0$. Since the base curve has odd
order, we have $Y_{1},Y_{2}\not\in\mathfrak{m}$, hence we conclude

$(X_{2}:Y_{2}:Z_{2})=\left(-\frac{Y_{1}}{Y_{2}}X_{2}:-\frac{Y_{1}}{Y_{2}}Y_{2}:-\frac{Y_{1}}{Y_{2}}Z_{2}\right)=(X_{1}:-Y_{1}:Z_{1}),$

i.e. the unique inverse of $(X_{1}:Y_{1}:Z_{1})$ is $(X_{1}:-Y_{1}:Z_{1})$. ∎

If elliptic loops were associative, they would be groups. Although this is
almost never the case (Section 8.1), a weak form of associativity always
holds.

######  Lemma 3.5.

Let $P,Q\in\mathcal{L}$ be two points of an elliptic loop. Then

$P+(-P+Q)=Q.$

###### Proof.

Let $Q=(Q_{1}:Q_{2}:Q_{3})$. We can directly compute by means of an algebraic
calculator

$(T_{1}:T_{2}:T_{3})=P+(-P+Q),$

and we symbolically verify that

$I_{2}\left(\begin{bmatrix}T_{1}&T_{2}&T_{3}\\\
Q_{1}&Q_{2}&Q_{3}\end{bmatrix}\right)=\langle 0\rangle,$

which means $(T_{1}:T_{2}:T_{3})=Q\in\mathbb{P}^{2}(R)$. ∎

From Lemma 3.5 we can show that elliptic loops satisfy the Latin square
property, so they are quasigroups with identity, i.e. algebraic loops.

######  Proposition 3.6.

Every elliptic loop $\mathcal{L}$ is an abelian algebraic loop.

###### Proof.

By Proposition 3.4 we know that $\mathcal{L}$ is an abelian magma with
identity, hence it is sufficient to show that for every $P,Q\in\mathcal{L}$
there is a unique $R\in\mathcal{L}$ such that $P+R=Q$. By Lemma 3.5 a solution
is $R=Q-P$, and it is unique because if $R_{2}\in\mathcal{L}$ satisfies the
same equation, by the same lemma we have

$R_{2}=-P+(P+R_{2})=-P+Q,$

which implies $R=R_{2}$. ∎

One may check that even for relatively simple rings (such as
$R=\mathbb{Z}/p^{e}\mathbb{Z}$, see Section 10) elliptic loops need not be
alternative loops, Jordan loops or diassociative loops, hence neither Moufang
loops. However, in Section 5 we will prove that they are necessarily power-
associative loops.

##  4 The Hessian of an elliptic curve

Given a projective degree-$d$ hypersurface in $\mathbb{P}^{n}(R)$, we may
construct its Hessian as the hypersurface of degree $(d-2)(n+1)$ defined by
the vanishing of its Hessian matrix. We refer to [4] for a general treatment
of such surfaces. In this work we are primarily interested in the Hessian
polynomial, i.e. the polynomial defining the Hessian hypersurface: given a
homogeneous degree-$d$ polynomial $F\in R[x_{0},\dots,x_{n}]$, its _Hessian_
(polynomial) is defined by

$\mathcal{H}_{F}=\det(\partial_{x_{i}}\partial_{x_{j}}F)_{0\leq i,j\leq n}\in
R[x_{0},\dots,x_{n}].$

It is easy to see that the surfaces defined by a polynomial and its Hessian
lie in the same projective space precisely in the following cases:

  * •

$d=3,n=2$: the curves defined by $F$ and $\mathcal{H}_{F}$ are plane
projective cubics.

  * •

$d=4,n=1$: they are quartics defined on a projective line.

Here we only consider the first case: the Hessian polynomial of a short
Weierstrass polynomial $F=x^{3}+Axz^{2}+Bz^{3}-y^{2}z\in R[x,y,z]$ is

$\mathcal{H}_{F}=-8(3Ax^{2}z+3xy^{2}+9Bxz^{2}-A^{2}z^{3})\in R[x,y,z].$

As we are interested in the zeroes of $\mathcal{H}_{F}$ over rings with $2\in
R^{*}$, we can neglect the factor $-8$. We also recall that the Hessian of an
elliptic curve of non-zero $j$-invariant defines another elliptic (hence non-
singular) curve [4, Proposition 5.11].

Regardless of their smoothness, the curves defined by $F$ and
$\mathcal{H}_{F}$ over $R$ lie in the same ambient space, so we may
investigate their intersection properties. In particular, the following lemma
extends [19, Exercise III.3.9], and it shows that they may intersect only on
lifts of $3$-torsion points.

######  Lemma 4.1.

Let $P\in\mathcal{L}$ be a point of the elliptic loop with defining polynomial
$F$. Then

$3\pi(P)=\mathcal{O}\quad\iff\quad\mathcal{H}_{F}(P)\in\mathfrak{m}.$

###### Proof.

We formally compute the polynomials $D_{1},D_{2},D_{3},T_{1},T_{2},T_{3}\in
R[x,y,z]$ such that

$(D_{1}:D_{2}:D_{3})=(x:y:z)+(x:y:z),\quad(T_{1}:T_{2}:T_{3})=(x:y:z)+(D_{1}:D_{2}:D_{3}).$

We straightforwardly verify that

$T_{2}\mathcal{H}_{F}\in\langle
F,D_{2}z+D_{3}y,D_{1}z-D_{3}x,D_{1}y+D_{2}x\rangle.$

If $3\pi(P)=\mathcal{O}$, then $T_{2}(P)\in R^{*}$ and
$\pi(2P)=\pi(-P)\in\mathbb{P}^{2}(R/\mathfrak{m})$, hence for each $P=(X:Y:Z)$
we have

$I_{2}\left(\begin{bmatrix}D_{1}(P)&D_{2}(P)&D_{3}(P)\\\
X&-Y&Z\end{bmatrix}\right)\subseteq\mathfrak{m}.$

Moreover, since $P\in\mathcal{L}$ then $F(P)\in\mathfrak{m}$, therefore we
conclude $\mathcal{H}_{F}(P)\in\mathfrak{m}$.

On the other side, we symbolically verify the ideal inclusion

$\langle T_{1},T_{3}\rangle\subseteq\langle F,\mathcal{H}_{F}\rangle.$

Since $F(P)\in\mathfrak{m}$ by definition of $\mathcal{L}$, then
$\mathcal{H}_{F}(P)\in\mathfrak{m}$ implies
$T_{1}(P),T_{3}(P)\in\mathfrak{m}$, from which we conclude that
$3\pi(P)=\mathcal{O}$. ∎

We now observe that the addition law $+$ respects linear combinations of $F$
and $\mathcal{H}_{F}$.

######  Lemma 4.2.

Let $F$ be the defining polynomial of an elliptic loop $\mathcal{L}$, and
$\alpha,\beta\in R$. For every $P_{1},P_{2}\in\mathbb{P}^{2}(R)$ such that

$(\alpha F+\beta\mathcal{H}_{F})(P_{1})=0=(\alpha
F+\beta\mathcal{H}_{F})(P_{2}),$

we have

$(\alpha F+\beta\mathcal{H}_{F})(P_{1}+P_{2})=0.$

###### Proof.

We define $T_{\alpha,\beta}=\alpha F+\beta\mathcal{H}_{F}\in R[x,y,z]$ and we
symbolically verify that in the polynomial ring
$R[x_{i},y_{i},z_{i}]_{i\in\\{1,2\\}}$ we have

$T_{\alpha,\beta}\big{(}(x_{1}:y_{1}:z_{1})+(x_{2}:y_{2}:z_{2})\big{)}\in\langle
T_{\alpha,\beta}(x_{1},y_{1},z_{1}),T_{\alpha,\beta}(x_{2},y_{2},z_{2})\rangle.$
(1)

Thus, for every pair of points $P_{1},P_{2}\in\mathbb{P}^{2}(R)$ such that
$T_{\alpha,\beta}(P_{1})=0=T_{\alpha,\beta}(P_{2})$, we always have
$T_{\alpha,\beta}(P_{1}+P_{2})=0$. ∎

######  Remark 4.3.

Lemma 4.2 does not ensure that $P_{1}+P_{2}$ is a proper projective point. As
an instance, if the elliptic curve defined by $F$ has $2$-torsion points, this
operation may produce points with all entries in $\mathfrak{m}$. However, this
lemma may be extended to other addition laws defined in [2], which may also be
proved to projectively agree with a few more assumptions [21]. This way, this
result holds also if the elliptic curve defined by $F$ has points of even
order.

##  5 Power-Associativity

Even for non-associative loops, one may define a notion of _multiple_ for a
given point $P$ recursively: for every $n\in\mathbb{Z}$, we set

$0P=\mathcal{O},\quad(-n)P=n(-P),\quad(n+1)P=nP+P.$

We denote the set of multiples of a given point $P$ by

$\langle P\rangle=\\{nP\\}_{n\in\mathbb{Z}}.$

If the loop operation is associative when restricted to the multiples of every
given point, then we say that the loop is _power-associative_. Equivalently,
the multiples of an element in power-associative loops form a group, i.e. for
every $n,m\in\mathbb{Z}$ we have

$(n+m)P=nP+mP.$

Those loops are computationally friendly, since fast-multiplication techniques
may be applied to evaluate $nP$ in at most $O(\log n)$ point additions.

In this section, we prove that elliptic loops are power-associative. To show
that, we employ the following objects.

######  Definition 5.1 (Associativity matrix).

Let $\mathcal{L}$ be an elliptic loop. Given $n$ points
$P_{1},\dots,P_{n}\in\mathcal{L}$, we define their _associativity matrix_ as

$\mathbb{A}(P_{1},\dots,P_{n})=\begin{bmatrix}F(P_{1})&\dots&F(P_{n})\\\
\mathcal{H}_{F}(P_{1})&\dots&\mathcal{H}_{F}(P_{n})\end{bmatrix}\in M_{2\times
n}(R).$

The following theorem shows that a sub-maximal rank of the associativity
matrix is a sufficient condition for establishing points associativity.

######  Theorem 5.2.

Let $P_{1},P_{2},P_{3}\in\mathcal{L}$ be points of an elliptic loop.

  1. $(i)$

We have

$\textnormal{rk}\,\mathbb{A}(P_{1},P_{2}+P_{3})\leq\textnormal{rk}\,\mathbb{A}(P_{1},P_{2},P_{3}).$

  2. $(ii)$

If $\textnormal{rk}\,\mathbb{A}(P_{1},P_{2},P_{3})\leq 1$, then the triple is
associative, i.e. $(P_{1}+P_{2})+P_{3}=P_{1}+(P_{2}+P_{3})$.

###### Proof.

Let $F$ be the defining polynomial of $\mathcal{L}$.

$(i)$ It is sufficient to show that for $i\in\\{1,2\\}$ we have
$I_{i}\big{(}\mathbb{A}(P_{1},P_{2}+P_{3})\big{)}\subseteq
I_{i}\big{(}\mathbb{A}(P_{1},P_{2},P_{3})\big{)}$.

Since the $1$-minor ideal of a matrix is the ideal generated by its entries,
the case $i=1$ follows from the inclusion (1) of Lemma 4.2, by considering
$T_{1,0}$ and $T_{0,1}$. As for the $2$-minors, we formally compute in
$R[x_{i},y_{i},z_{i}]_{i\in\\{1,2,3\\}}$ the sum

$T=(x_{2}:y_{2}:z_{2})+(x_{3}:y_{3}:z_{3}),$

and we explicitly verify that

$F(x_{1},y_{1},z_{1})\mathcal{H}_{F}(T)-F(T)\mathcal{H}_{F}(x_{1},y_{1},z_{1})\in
I_{2}\Big{(}\mathbb{A}\big{(}(x_{1}:y_{1}:z_{1}),(x_{2}:y_{2}:z_{2}),(x_{3}:y_{3}:z_{3})\big{)}\Big{)}.$

We observe that
$\big{(}F(x_{1},y_{1},z_{1})\mathcal{H}_{F}(T)-F(T)\mathcal{H}_{F}(x_{1},y_{1},z_{1})\big{)}(P_{1},P_{2},P_{3})$
is the unique generator of $I_{2}\big{(}\mathbb{A}(P_{1},P_{2}+P_{3})\big{)}$,
from which the inclusion between the $2$-minor ideals follows.

$(ii)$ We explicitly compute $S_{1},S_{2},S_{3},T_{1},T_{2},T_{3}\in
R[x_{i},y_{i},z_{i}]_{i\in\\{1,2,3\\}}$ such that

$\displaystyle(S_{1}:S_{2}:S_{3})$
$\displaystyle=\big{(}(x_{1}:y_{1}:z_{1})+(x_{2}:y_{2}:z_{2})\big{)}+(x_{3}:y_{3}:z_{3}),$
$\displaystyle(T_{1}:T_{2}:T_{3})$
$\displaystyle=(x_{1}:y_{1}:z_{1})+\big{(}(x_{2}:y_{2}:z_{2})+(x_{3}:y_{3}:z_{3})\big{)}.$

We straightforwardly verify that

$I_{2}\left(\begin{bmatrix}S_{1}&S_{2}&S_{3}\\\
T_{1}&T_{2}&T_{3}\end{bmatrix}\right)\subseteq
I_{2}\Big{(}\mathbb{A}\big{(}(x_{1}:y_{1}:z_{1}),(x_{2}:y_{2}:z_{2}),(x_{3}:y_{3}:z_{3})\big{)}\Big{)},$

hence when $\textnormal{rk}\,\mathbb{A}(P_{1},P_{2},P_{3})\leq 1$ we have
$I_{2}\big{(}\mathbb{A}(P_{1},P_{2},P_{3})\big{)}=\langle 0\rangle$, so we
conclude

$\displaystyle(P_{1}+P_{2})+P_{3}$
$\displaystyle=\big{(}S_{1}(P_{1},P_{2},P_{3}):S_{2}(P_{1},P_{2},P_{3}):S_{3}(P_{1},P_{2},P_{3})\big{)}$
$\displaystyle=\big{(}T_{1}(P_{1},P_{2},P_{3}):T_{2}(P_{1},P_{2},P_{3}):T_{3}(P_{1},P_{2},P_{3})\big{)}=P_{1}+(P_{2}+P_{3}),$

namely the addition law on $P_{1},P_{2},P_{3}$ is associative. ∎

By means of Theorem 5.2, we show that every elliptic loop is power-
associative.

######  Proposition 5.3.

Let $P\in\mathcal{L}$ be a point of an elliptic loop. Then $\langle P\rangle$
is a group.

###### Proof.

Let $F$ be the defining polynomial of $\mathcal{L}$. By part $(ii)$ of Theorem
5.2 it is sufficient to show that for every $n,m\in\mathbb{Z}$ we have

$\textnormal{rk}\,\begin{bmatrix}F(mP)&F(nP)\\\
\mathcal{H}_{F}(mP)&\mathcal{H}_{F}(nP)\end{bmatrix}\leq 1.$ (2)

Since $F(\mathcal{O})=\mathcal{H}_{F}(\mathcal{O})=0$, $F(P)=F(-P)$ and
$\mathcal{H}_{F}(P)=\mathcal{H}_{F}(-P)$, we may assume without losing of
generality that $n\geq m\geq 1$. Moreover, we observe that the case $m=n$ is
trivial, since

$I_{2}\left(\begin{bmatrix}F(nP)&F(nP)\\\
\mathcal{H}_{F}(nP)&\mathcal{H}_{F}(nP)\end{bmatrix}\right)=\langle
F(nP)\mathcal{H}_{F}(nP)-\mathcal{H}_{F}(nP)F(nP)\rangle=\langle 0\rangle.$
(3)

We prove by extended induction on $n\in\mathbb{Z}_{\geq 1}$ that the
inequality (2) holds for every $1\leq m\leq n$.
$[n=1]$: There is only one possible $m$, that is $m=n=1$.
$[1,\dots,n-1\to n]$: By part $(i)$ of Theorem 5.2 we have

$\textnormal{rk}\,\begin{bmatrix}F(mP)&F(nP)\\\
\mathcal{H}_{F}(mP)&\mathcal{H}_{F}(nP)\end{bmatrix}\leq\textnormal{rk}\,\begin{bmatrix}F(mP)&F\big{(}(n-1)P\big{)}&F(P)\\\
\mathcal{H}_{F}(mP)&\mathcal{H}_{F}\big{(}(n-1)P\big{)}&\mathcal{H}_{F}(P)\end{bmatrix}.$

When $m=n$ the inequality (2) holds by (3), while if $m<n$ then by inductive
hypothesis

${\rm rk}\begin{bmatrix}F(mP)&F\big{(}(n-1)P\big{)}\\\
\mathcal{H}_{F}(mP)&\mathcal{H}_{F}\big{(}(n-1)P\big{)}\end{bmatrix}\leq 1,\
{\rm rk}\begin{bmatrix}F\big{(}(n-1)P\big{)}&F(P)\\\
\mathcal{H}_{F}\big{(}(n-1)P\big{)}&\mathcal{H}_{F}(P)\end{bmatrix}\leq 1,\
{\rm rk}\begin{bmatrix}F(mP)&F(P)\\\
\mathcal{H}_{F}(mP)&\mathcal{H}_{F}(P)\end{bmatrix}\leq 1.$

Thus, we obtain

$\textnormal{rk}\,\begin{bmatrix}F(mP)&F\big{(}(n-1)P\big{)}&F(P)\\\
\mathcal{H}_{F}(mP)&\mathcal{H}_{F}\big{(}(n-1)P\big{)}&\mathcal{H}_{F}(P)\end{bmatrix}\leq
1,$

which concludes the inductive step. ∎

##  6 Layers

######  Definition 6.1.

Let $\mathcal{L}$ be an elliptic loop with defining polynomial $F$. For every
$t\in\mathfrak{m}$, we define the $t$-_layer_ of $\mathcal{L}$ as

$L_{t}=\\{P\in\mathbb{P}^{2}(R)\ |\ (F-t\mathcal{H}_{F})(P)=0\\}.$

By definition $t\in\mathfrak{m}$, then $L_{t}\subseteq\mathcal{L}$. Moreover,
the elliptic curve $E_{A,B}(R)$ is the $0$-layer of $\mathcal{L}_{A,B}(R)$,
hence there is a projective abelian variety lying inside such a loop. The
following proposition shows that this actually holds for every layer.

######  Proposition 6.2.

Let $\mathcal{L}$ be an elliptic loop and $t\in\mathfrak{m}$. Then $L_{t}$ is
a subloop of $\mathcal{L}$, which is a group with the addition law of
$\mathcal{L}$.

###### Proof.

The addition law of $\mathcal{L}$ is closed on $L_{t}\subseteq\mathcal{L}$ by
Lemma 4.2, and they have the same unity $\mathcal{O}\in L_{t}$, so we only
need to show that this operation is associative on $L_{t}$. Let
$P_{1},P_{2},P_{3}\in L_{t}$, then for every $i\in\\{1,2,3\\}$ we have

$F(P_{i})=t\mathcal{H}_{F}(P_{i}).$

Thus, we have

$\mathbb{A}(P_{1},P_{2},P_{3})=\begin{bmatrix}t\mathcal{H}_{F}(P_{1})&t\mathcal{H}_{F}(P_{2})&t\mathcal{H}_{F}(P_{3})\\\
\mathcal{H}_{F}(P_{1})&\mathcal{H}_{F}(P_{2})&\mathcal{H}_{F}(P_{3})\end{bmatrix},$

which has vanishing $2$-minors. Hence,
$\textnormal{rk}\,\mathbb{A}(P_{1},P_{2},P_{3})\leq 1$, so $P_{1},P_{2},P_{3}$
associate by part $(ii)$ of Theorem 5.2. ∎

We denote the affine (resp. infinity) points of $L_{t}$ by

$L_{t}^{a}=L_{t}\cap\mathcal{L}^{a},\quad
L_{t}^{\infty}=L_{t}\cap\mathcal{L}^{\infty}.$

As shown by the following proposition, in absence of $3$-torsion points, the
affine part of an elliptic loop is stratified by the affine parts of its
layers.

######  Proposition 6.3.

Let $\mathcal{L}$ be an elliptic loop without points of order $3$. Then
$\mathcal{L}^{a}$ is given by the disjoint union

$\mathcal{L}^{a}=\bigsqcup_{t\in\mathfrak{m}}L_{t}^{a}.$

###### Proof.

Since $\mathcal{L}$ does not have points of order $3$, by Lemma 4.1 for every
$P\in\mathcal{L}^{a}$ we have $\mathcal{H}_{F}(P)\in R^{*}$. Therefore, we may
define

$n_{P}=F(P)\big{(}\mathcal{H}_{F}(P)\big{)}^{-1}\in\mathfrak{m},$

so we have $P\in L_{n_{P}}$. As for the disjointness, we observe that $P\in
L_{s}\cap L_{t}$ implies

$(s-t)\mathcal{H}_{F}(P)=0,$

but $\mathcal{H}_{F}(P)\in R^{*}$, so we conclude $s=t$. ∎

We observe that for Weierstrass polynomials defining ordinary curves of
cryptographic interest, the absence of $3$-torsion points is a standard
assumption.

The group structure of layers $L_{t}\subseteq\mathcal{L}$ depends on the exact
sequence of groups

$0\to L_{t}^{\infty}\to L_{t}\xrightarrow{\pi}E_{A,B}(R/\mathfrak{m})\to 0,$
(4)

which generalizes the usual reduction sequence of elliptic curves [19,
Proposition VII.2.1]. Determining the group structure of $L_{t}^{\infty}$ may
be challenging, depending on the properties of the underlying ring. For
instance, in Section 10 we prove that this group is cyclic if the underlying
ring is $\mathbb{Z}/p^{e}\mathbb{Z}$, but this result heavily relies on the
special properties of this ring.

##  7 The infinity part

In this section, we outline some general properties of the infinity parts of
elliptic loops.

######  Proposition 7.1.

Let $\mathcal{L}$ be an elliptic loop and
$(X_{1}:1:Z_{1}),(X_{2}:1:Z_{2})\in\mathcal{L}^{\infty}$ be two of its points
adding to

$(X:1:Z)=(X_{1}:1:Z_{1})+(X_{2}:1:Z_{2}).$

If $e\in\mathbb{Z}_{\geq 1}$ is such that
$X_{1},Z_{1},X_{2},Z_{2}\in\mathfrak{m}^{e}$, then the following hold.

  1. $(i)$

We have

$X\equiv X_{1}+X_{2}\bmod\mathfrak{m}^{3e},\quad Z\equiv
Z_{1}+Z_{2}\bmod\mathfrak{m}^{3e}.$

  2. $(ii)$

For every $f\geq e$ and $\delta_{X},\delta_{Z}\in\mathfrak{m}^{f}$, if

$(X_{m}:1:Z_{m})=(X_{1}+\delta_{X}:1:Z_{1}+\delta_{Z})+(X_{2}:1:Z_{2}),$

then

$X_{m}\equiv X+\delta_{X}\bmod\mathfrak{m}^{f+2e},\quad Z_{m}\equiv
Z+\delta_{Z}\bmod\mathfrak{m}^{f+2e}.$

  3. $(iii)$

If $R$ is a discrete valued ring and $n\in\mathbb{Z}$ is an integer with
$\mathrm{v}(n)\leq 2e$, then for every $f\in\mathbb{Z}_{\geq 1}$ the
$n^{f}$-th multiple

$(X_{f}:1:Z_{f})=n^{f}(X_{1}:1:Z_{1}),$

satisfies

$X_{f}\equiv n^{f}X_{1}\bmod\mathfrak{m}^{3e+(f-1)\mathrm{v}(n)},\quad
Z_{f}\equiv n^{f}Z_{1}\bmod\mathfrak{m}^{3e+(f-1)\mathrm{v}(n)}.$

  4. $(iv)$

If $R$ is Hausdorff and it has a non-zero integer uniformizer, then for every
$\alpha\in\mathbb{Z}$ we have

$(X_{\alpha}:1:Z_{\alpha})=\alpha(X_{1}:1:Z_{1}),$

with

$X_{\alpha}\equiv\alpha X_{1}\bmod\mathfrak{m}^{3e+\mathrm{v}(\alpha)-1},\quad
Z_{\alpha}\equiv\alpha Z_{1}\bmod\mathfrak{m}^{3e+\mathrm{v}(\alpha)-1}.$

###### Proof.

By Lemma 2.1 there are homogeneous polynomials $H_{1},H_{2},H_{3}\in
R[x_{i},z_{i}]_{i\in\\{1,2\\}}$ of degrees $\deg(H_{1})=\deg(H_{3})=3$ and
$\deg(H_{2})=4$ such that

$\textnormal{rk}\,\begin{bmatrix}X&1&Z\\\
X_{1}+X_{2}+H_{1}(X_{1},Z_{1},X_{2},Z_{2})&1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})&Z_{1}+Z_{2}+H_{3}(X_{1},Z_{1},X_{2},Z_{2})\end{bmatrix}\leq
1,$

which implies

$\displaystyle\big{(}1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})\big{)}X$
$\displaystyle=X_{1}+X_{2}+H_{1}(X_{1},Z_{1},X_{2},Z_{2}),$
$\displaystyle\big{(}1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})\big{)}Z$
$\displaystyle=Z_{1}+Z_{2}+H_{3}(X_{1},Z_{1},X_{2},Z_{2}).$

$(i)$ Since $X_{1},Z_{1},X_{2},Z_{2}\in\mathfrak{m}^{e}$ and the $H_{i}$’s are
homogeneous of degree at least $3$, the above equations imply that both
$X-(X_{1}+X_{2})$ and $Z-(Z_{1}+Z_{2})$ belong to $\mathfrak{m}^{3e}$.

$(ii)$ Since the $H_{i}$’s are homogeneous of degree at least $3$ and $f\geq
e$, the factors $\delta_{X}$ and $\delta_{Z}$ always appear multiplied by some
element of $\mathfrak{m}^{2e}$, hence for every $1\leq i\leq 3$ we have

$H_{i}(X_{1},Z_{1},X_{2},Z_{2})\equiv
H_{i}(X_{1}+\delta_{X},Z_{1}+\delta_{Z},X_{2},Z_{2})\bmod\mathfrak{m}^{f+2e}.$
(5)

By using again Lemma 2.1 we have

$\textnormal{rk}\,\begin{bmatrix}X_{m}&1\\\
X_{1}+\delta_{X}+X_{2}+H_{1}(X_{1}+\delta_{X},Z_{1}+\delta_{Z},X_{2},Z_{2})&1+H_{2}(X_{1}+\delta_{X},Z_{1}+\delta_{Z},X_{2},Z_{2})\end{bmatrix}\leq
1$

which by (5) implies

$\big{(}1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})\big{)}X_{m}\equiv
X_{1}+\delta_{X}+X_{2}+H_{1}(X_{1},Z_{1},X_{2},Z_{2})\bmod\mathfrak{m}^{f+2e}.$

Since
$\delta_{X}\big{(}1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})\big{)}\equiv\delta_{X}\bmod\mathfrak{m}^{f+2e}$,
we conclude

$\displaystyle\big{(}1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})\big{)}(X_{m}-\delta_{X})$
$\displaystyle\equiv X_{1}+X_{2}+H_{1}(X_{1},Z_{1},X_{2},Z_{2})$
$\displaystyle\equiv\big{(}1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})\big{)}X\bmod\mathfrak{m}^{f+2e},$

from which $X_{m}\equiv X+\delta_{X}$ follows by inverting
$1+H_{2}(X_{1},Z_{1},X_{2},Z_{2})$ modulo $\mathfrak{m}^{f+2e}$. The analogous
result on $Z_{m}$ follows in the same way.

$(iii)$ We do it by induction on $f\geq 1$.

[$f=1$] It follows by applying $n$ times part $(i)$.

[$f\to f+1$] Since $\mathcal{L}$ is power-associative (Proposition 5.3), we
can compute $n^{f+1}(X_{1}:1:Z_{1})$ as $n\big{(}n^{f}(X_{1}:1:Z_{1})\big{)}$.
By inductive hypothesis there are
$\delta_{X},\delta_{Z}\in\mathfrak{m}^{3e+(f-1)\mathrm{v}(n)}$ such that

$(X_{f+1}:1:Z_{f+1})=n(X_{f}:1:Z_{f})=n(n^{f}X_{1}+\delta_{X}:1:n^{f}Z_{1}+\delta_{Z}).$

Since $\mathrm{v}(n)\leq 2e$, we have $f\mathrm{v}(n)+e\leq
3e+(f-1)\mathrm{v}(n)$, which implies

$n^{f}X_{1}+\delta_{X}\in\mathfrak{m}^{e+f\mathrm{v}(n)},\quad
n^{f}Z_{1}+\delta_{Z}\in\mathfrak{m}^{e+f\mathrm{v}(n)}.$

Thus, by applying $n$ times part $(i)$, we get

$X_{f+1}\equiv
n^{f+1}X_{1}+n\delta_{X}\bmod\mathfrak{m}^{3\big{(}e+f\mathrm{v}(n)\big{)}},\quad
Z_{f+1}\equiv
n^{f+1}Z_{1}+n\delta_{Z}\bmod\mathfrak{m}^{3\big{(}e+f\mathrm{v}(n)\big{)}}.$

We notice that both $n\delta_{X}$ and $n\delta_{Y}$ belong to
$\mathfrak{m}^{3e+f\mathrm{v}(n)}$, and that $3e+f\mathrm{v}(n)\leq
3\big{(}e+f\mathrm{v}(n)\big{)}$, hence

$X_{f+1}\equiv n^{f+1}X_{1}\bmod\mathfrak{m}^{3e+f\mathrm{v}(n)},\quad
Z_{f+1}\equiv n^{f+1}Z_{1}\bmod\mathfrak{m}^{3e+f\mathrm{v}(n)}.$

$(iv)$ Let $\mathfrak{m}=(p)$ with $p\in\mathbb{Z}$. Since $\mathfrak{m}$ is
maximal, then $p$ is prime and write $\alpha=up^{f}$ with $\gcd(u,p)=1$ and
$f=\mathrm{v}(\alpha)$. By the power-associativity of $\mathcal{L}$
(Proposition 5.3) we have

$(X_{\alpha}:1:Z_{\alpha})=u\big{(}p^{f}(X_{1}:1:Z_{1})\big{)}.$

As $\mathrm{v}(p)=1\leq 2e$, by part $(iii)$ we have

$p^{f}(X_{1}:1:Z_{1})=(X_{f}:1:Z_{f}),\text{ with }\begin{cases}X_{f}\equiv
p^{f}X_{1}\bmod\mathfrak{m}^{3e+f-1},\\\ Z_{f}\equiv
p^{f}Z_{1}\bmod\mathfrak{m}^{3e+f-1}.\end{cases}$

Since $\mathrm{v}(u)=0$ and $X_{f},Z_{f}\in\mathfrak{m}^{f+e}$, by applying
again part $(iii)$ we have

$u(X_{f}:1:Z_{f})=(X_{\alpha}:1:Z_{\alpha}),\text{ with
}\begin{cases}X_{\alpha}\equiv uX_{f}\bmod\mathfrak{m}^{3(e+f)},\\\
Z_{\alpha}\equiv uZ_{f}\bmod\mathfrak{m}^{3(e+f)}.\end{cases}$

The conclusion follows by observing that $3e+f-1\leq 3(e+f)$. ∎

Proposition 7.1 is rather technical, and will be employed in the proofs of the
next sections. In particular, its parts $(iii)$ and $(iv)$ give sufficient
conditions to establish when the characteristic of the base ring equals the
order or points at infinity, which does not hold in general (e.g. see [16,
Example 11.1]).

The following results show that, differently from the affine case (Proposition
6.3), the layers of an elliptic loop $\mathcal{L}$ do not cover the whole
$\mathcal{L}^{\infty}$, and they may have a non-trivial intersection at
infinity, e.g. when $R$ has zero-divisors.

######  Lemma 7.2.

Let $R$ be a Hausdorff discrete valued ring, and let $L_{t}$ be a layer of an
elliptic loop $\mathcal{L}_{A,B}(R)$. Then for every $(X:1:Z)\in
L_{t}^{\infty}$, either $Z=X=0$ or

$\mathrm{v}(Z)>\mathrm{v}(X).$

###### Proof.

Since $(X:1:Z)$ satisfies the layer equation, we have

$\mathrm{v}(Z)\geq\min\\{\mathrm{v}(X^{3}),\mathrm{v}(AXZ^{2}),\mathrm{v}(BZ^{3}),\mathrm{v}(3AtX^{2}Z),\mathrm{v}(3tX),\mathrm{v}(9BtXZ^{2}),\mathrm{v}(A^{2}tZ^{3})\\}.$

Since $X,Z,t\in\mathfrak{m}$, they have all a positive valuation. If $Z=0$,
since $R$ is Hausdorff either $X=0$ or $\mathrm{v}(Z)>\mathrm{v}(X)$. If
$Z\neq 0$, the above inequality gives

$\mathrm{v}(Z)\geq\min\\{3\mathrm{v}(X),\mathrm{v}(t)+\mathrm{v}(3X)\\},$

which implies $\mathrm{v}(Z)>\mathrm{v}(X)$. ∎

######  Proposition 7.3.

Let $R$ be a Hausdorff discrete valued ring, and let $\mathcal{L}_{A,B}(R)$ be
an elliptic loop. Then

$\bigcap_{t\in\mathfrak{m}}L_{t}^{\infty}=\begin{cases}\\{\mathcal{O}\\}&\text{if
}\mathcal{N}\in\\{1,\infty\\},\\\
\\{(X:1:0)\\}_{X\in\mathfrak{m}^{\mathcal{N}-1}}&\text{otherwise}.\end{cases}$

###### Proof.

The case $\mathcal{N}=1$ is trivial, since when $R$ is a field there is only
one layer $L_{0}=E_{A,B}(R)$, for which $\mathcal{O}$ is the unique point at
infinity.

When $R$ is not a field, the chain
$\\{\mathfrak{m}^{i}\\}_{i\in\mathbb{Z}_{\geq 0}}$ cannot stabilize at
$\mathfrak{m}\neq\langle 0\rangle$, hence there is an element
$t\in\mathfrak{m}\setminus\mathfrak{m}^{2}$. An infinity point $P=(X:1:Z)$
that belongs to both $L_{t}$ and $L_{2t}$ needs to satisfy both their layer
equations, namely

$\begin{cases}F(P)=t\mathcal{H}_{F}(P),\\\
F(P)=2t\mathcal{H}_{F}(P),\end{cases}\implies\begin{cases}F(P)=0,\\\
t\mathcal{H}_{F}(P)=0,\end{cases}\implies\begin{cases}Z=X^{3}+AXZ^{2}+BZ^{3},\\\
3tX=tAZ^{3}-3tAX^{2}Z-9tBXZ^{2}.\end{cases}$

By Lemma 7.2 we have $\mathrm{v}(Z)\geq\mathrm{v}(X)$, which by means of the
second equation implies

$\displaystyle\mathrm{v}(tX)$
$\displaystyle=\mathrm{v}(tAZ^{3}-3tAX^{2}Z-9tBXZ^{2})\geq\min\\{\mathrm{v}(tAZ^{3}),\mathrm{v}(3tAX^{2}Z),\mathrm{v}(9tBXZ^{2}),\mathcal{N}\\}$
$\displaystyle\geq\min\\{\mathrm{v}(tX)+\mathrm{v}(AZ^{2}),\mathrm{v}(tX)+\mathrm{v}(AXZ),\mathrm{v}(tX)+\mathrm{v}(BZ^{2}),\mathcal{N}\\}.$

This is only possible if $1+\mathrm{v}(X)=\mathrm{v}(tX)=\infty$, i.e. $tX=0$.

If $\mathcal{N}=\infty$, then $\mathrm{v}(X)=\infty$, so the above relations
imply $X=Z=0$, hence $P=\mathcal{O}$.

If $\mathcal{N}$ is finite, then $1+\mathrm{v}(X)=\infty$ implies
$\mathrm{v}(X)\geq\mathcal{N}-1$, i.e. $X\in\mathfrak{m}^{\mathcal{N}-1}$. By
Lemma 7.2 we also have $\mathrm{v}(Z)=\mathcal{N}$, which implies $Z=0$. On
the other side, it is easy to see that if $X\in\mathfrak{m}^{\mathcal{N}-1}$,
then for every $t\in\mathfrak{m}$ both $F(X:1:0)=X^{3}$ and
$t\mathcal{H}_{F}(X:1:0)=3tX$ belong to $\mathfrak{m}^{\mathcal{N}}=\langle
0\rangle$, hence $(X:1:0)$ belongs to every layer of $\mathcal{L}_{A,B}(R)$. ∎

######  Remark 7.4.

By Proposition 7.1-$(i)$, the set
$\\{(X:1:0)\\}_{X\in\mathfrak{m}^{\mathcal{N}-1}}$ endowed with the loop
addition law is actually a group. Thus, in absence of $3$-torsion points and
with a finite nilpotency of $\mathfrak{m}$, the intersection of all layers
consists of a group at infinity, which is isomorphic to
$(\mathfrak{m}^{\mathcal{N}-1},+)$.

##  8 More on associativity

In this section, we present special results about associativity with
additional hypotheses on the base ring. First, we show that complete
associativity may almost never occur among all the points of an elliptic loop.
Afterward, we show that weak forms of associativity hold if the underlying
ring has small nilpotency.

###  8.1 Non-group guarantee

Here we certify that elliptic loops are never groups if $\mathcal{N}\geq 3$,
or if $\mathcal{N}\geq 2$ and they have at least one point of order coprime to
$3$. We require a technical condition on the base ring, namely it needs to
have at least one element whose power ideals do not immediately stabilize.
This is a very broad assumption for general rings, but we remark that it is
never the case if $R$ is a field. This is not surprising, as elliptic loops
over fields agree with their underlying elliptic curves, which are
associative.

######  Lemma 8.1.

Let $R$ be a ring with an element $p\in R$ such that $p^{2}\not\in\langle
p^{3}\rangle$, let $\mathcal{L}=\mathcal{L}_{A,B}(R)$ be an elliptic loop and
$P\in\mathcal{L}^{a}$. Then

$\big{(}P+(p:1:p)\big{)}+(0:1:p)\neq P+\big{(}(p:1:p)+(0:1:p)\big{)}.$

###### Proof.

Let $P=(X:Y:1)$, and compute

$(S_{1}:S_{2}:S_{3})=\big{(}P+(p:1:p)\big{)}+(0:1:p),\quad(T_{1}:T_{2}:T_{3})=P+\big{(}(p:1:p)+(0:1:p)\big{)}.$

Let us assume by contradiction that they are equal, then
$S_{i}T_{j}-S_{j}T_{i}=0$ for every $1\leq i\neq j\leq 3$, hence the ideal

$I=\langle
p^{3},S_{1}T_{2}-S_{2}T_{1},S_{1}T_{3}-S_{3}T_{1},S_{2}T_{3}-S_{3}T_{2}\rangle$

is equal to $\langle p^{3}\rangle$. However, we can symbolically verify that

$2(4A^{3}+27B^{2})^{2}p^{2}Y^{3}\in I.$

Since the three quantities $2$, $\Delta_{A,B}=4A^{3}+27B^{2}$ and $Y$ are
invertible in $R$ by definition of $\mathcal{L}$, it follows that
$p^{2}\in\langle p^{3}\rangle$, contradicting the hypothesis. ∎

######  Lemma 8.2.

Let $R$ be a ring with an element $p\in R$ such that $p\not\in\langle
p^{2}\rangle$. Let also $\mathcal{L}=\mathcal{L}_{A,B}(R)$ be an elliptic loop
and $P=(X:Y:1)\in\mathcal{L}^{a}$ such that $3\pi(P)\neq\mathcal{O}$. Then

$\big{(}P+(X:Y+p:1)\big{)}+(0:1:p)\neq P+\big{(}(X:Y+p:1)+(0:1:p)\big{)}.$

###### Proof.

We straightforwardly compute

$(S_{1}:S_{2}:S_{3})=\big{(}P+(X:Y+p:1)\big{)}+(0:1:p),\quad(T_{1}:T_{2}:T_{3})=P+\big{(}(X:Y+p:1)+(0:1:p)\big{)}.$

By inspecting the $2$-minors $S_{i}T_{j}-S_{j}T_{i}$ modulo $p^{2}$, we notice
that they remarkably have many common factors. In fact, by denoting

$\displaystyle F_{1}$ $\displaystyle=A^{2}-3AX^{2}-9BX-3XY^{2},$
$\displaystyle F_{2}$
$\displaystyle=A^{3}+6A^{2}X^{2}+6ABX-3AX^{4}+9B^{2}-18BX^{3}-Y^{4},$
$\displaystyle G_{1}$
$\displaystyle=10A^{4}X+9A^{3}B+2A^{3}Y^{2}-30A^{2}BX^{2}+6A^{2}X^{5}+6A^{2}X^{2}Y^{2}+45AB^{2}X+45ABX^{4}$
$\displaystyle\quad+9ABXY^{2}+54B^{3}+135B^{2}X^{3}+18B^{2}Y^{2}-9BX^{3}Y^{2},$
$\displaystyle G_{2}$
$\displaystyle=2A^{4}-15A^{2}BX+30A^{2}X^{4}+6A^{2}XY^{2}+9AB^{2}+90ABX^{3}+3ABY^{2}-6AX^{3}Y^{2}+135B^{2}X^{2}$
$\displaystyle\quad-27BX^{5}-27BX^{2}Y^{2},$

we computationally verify that

$S_{1}T_{2}-S_{2}T_{1}\equiv 2pY^{2}F_{1}F_{2}G_{1}\bmod\langle
p^{2}\rangle,\quad S_{2}T_{3}-S_{3}T_{2}\equiv
2pY^{2}F_{1}F_{2}G_{2}\bmod\langle p^{2}\rangle.$

Therefore, if $(S_{1}:S_{2}:S_{3})=(T_{1}:T_{2}:T_{3})$, one of the following
should hold:

$(\text{I})\ F_{1}\in\mathfrak{m},\quad(\text{II})\
F_{2}\in\mathfrak{m},\quad(\text{III})\ G_{1},G_{2}\in\mathfrak{m}.$

Let $F$ be the defining polynomial of $\mathcal{L}$. We prove that none of the
above cases may occur.

[Case I] We compute

$(X_{3}:Y_{3}:Z_{3})=3P$

and we verify that

$X_{3},Z_{3}\in\langle F(P),F_{1}\rangle.$

Since $F(P)\in\mathfrak{m}$ by definition of $\mathcal{L}$, if
$F_{1}\in\mathfrak{m}$ then $\pi(3P)=\mathcal{O}$, contradicting the
hypothesis.

[Case II] We compute

$(X_{4}:Y_{4}:Z_{4})=4P$

and we verify that

$X_{4},Z_{4}\in\langle F(P),F_{2}\rangle.$

Since $F(P)\in\mathfrak{m}$, and $\mathcal{L}$ does not have points of even
order by definition, then $F_{2}\not\in\mathfrak{m}$.

[Case III] We straightforwardly verify that

$864Y^{10}(X^{3}-Y^{2}),\ 288Y^{8}(B-2X^{3}+2Y^{2})\in\langle
F(P),G_{1},G_{2}\rangle,$

therefore if both $G_{1},G_{2}\in\mathfrak{m}$, then we would have

$B,\,AX\in\langle
X^{3}-Y^{2},B-2X^{3}+2Y^{2},X^{3}+AX+B-Y^{2}\rangle\subseteq\mathfrak{m}.$

This may not happen, since both $X$ and $\Delta_{A,B}$ are units of $R$. ∎

The points at infinity tend to associate more, as their $X$ and $Z$ entries
are non-units. However, the next lemma shows that they do not associate as
soon as $\mathcal{N}\geq 6$.

######  Lemma 8.3.

Let $R$ be a ring with an element $p\in R$ such that $p\not\in\langle
p^{5}\rangle$, and let $\mathcal{L}=\mathcal{L}_{A,B}(R)$ be an elliptic loop.
Then

$\big{(}(p:1:0)+(0:1:p)\big{)}+(0:1:p)\neq(p:1:0)+\big{(}(0:1:p)+(0:1:p)\big{)}.$

###### Proof.

We compute

$(S_{1}:S_{2}:S_{3})=\big{(}(p:1:0)+(0:1:p)\big{)}+(0:1:p),\quad(T_{1}:T_{2}:T_{3})=(p:1:0)+\big{(}(0:1:p)+(0:1:p)\big{)},$

and we define

$I=\langle
p^{6},S_{1}T_{2}-S_{2}T_{1},S_{1}T_{3}-S_{3}T_{1},S_{2}T_{3}-S_{3}T_{2}\rangle.$

We notice that

$972p^{5}B^{3}(B-2),\ 36p^{5}B(4A-9B^{2}+24B),\ 6p^{5}A(2A+3B)\in I.$

If we had $(S_{1}:S_{2}:S_{3})=(T_{1}:T_{2}:T_{3})$, then $I=\langle
p^{6}\rangle$. This would imply

$B(B-2),\ B(4A-9B^{2}+24B),\ A(2A+3B)\in\mathfrak{m},$

which is not possible since $\Delta_{A,B}\in R^{*}$ by definition of
$\mathcal{L}$. ∎

###  8.2 Low nilpotency

We now examine associativity properties that hold over Hausdorff rings with
low values of $\mathcal{N}$.

######  Lemma 8.4.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 5$ and $\mathcal{L}$ be an
elliptic loop. Then $\mathcal{L}^{\infty}$ is an abelian group.

###### Proof.

Given three points
$\\{(X_{i}:1:Z_{i})\\}_{i\in\\{1,2,3\\}}\subseteq\mathcal{L}^{\infty}$, we
explicitly compute

$\displaystyle(S_{1}:S_{2}:S_{3})$
$\displaystyle=\big{(}(X_{1}:1:Z_{1})+(X_{2}:1:Z_{2})\big{)}+(X_{3}:1:Z_{3}),$
$\displaystyle(T_{1}:T_{2}:T_{3})$
$\displaystyle=(X_{1}:1:Z_{1})+\big{(}(X_{2}:1:Z_{2})+(X_{3}:1:Z_{3})\big{)},$

and we verify that

$I_{2}\left(\begin{bmatrix}S_{1}&S_{2}&S_{3}\\\
T_{1}&T_{2}&T_{3}\end{bmatrix}\right)\subseteq\mathfrak{m}^{5},$

which concludes the proof since $\mathcal{N}\leq 5$ implies
$\mathfrak{m}^{5}=\langle 0\rangle$. ∎

By virtue of Lemma 8.3, the associativity provided by Lemma 8.4 is the best
result we can achieve on $\mathcal{L}^{\infty}$ in terms of $\mathcal{N}$. For
even smaller values of $\mathcal{N}$, this group is isomorphic to two copies
of the additive group of $\mathfrak{m}$.

######  Lemma 8.5.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 3$ and $\mathcal{L}$ be an
elliptic loop. Then

$\mathcal{L}^{\infty}\to(\mathfrak{m},+)^{2},\quad(X:1:Z)\to(X,Z),$

is a well-defined group isomorphism.

###### Proof.

Since $\mathfrak{m}^{3}=\langle 0\rangle$, it immediately follows by
Proposition 7.1-$(i)$. ∎

We now provide a family of weak associativity results, which only hold for
$\mathcal{N}\leq 2$.

######  Lemma 8.6.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 2$ and $\mathcal{L}$ be an
elliptic loop. For every $P\in\mathcal{L}$ and $Q,R\in\mathcal{L}^{\infty}$,
we have

$P+(Q+R)=(P+Q)+R.$

###### Proof.

We formally compute

$(S_{1}:S_{2}:S_{3})=P+(Q+R),\quad(T_{1}:T_{2}:T_{3})=(P+Q)+R,$

and we verify that all the terms of

$I_{2}\left(\begin{bmatrix}S_{1}&S_{2}&S_{3}\\\
T_{1}&T_{2}&T_{3}\end{bmatrix}\right)$

are divisible by dregree-$2$ terms in the $X,Z$-entries of $Q$ and $R$, hence
they belong to $\mathfrak{m}^{2}=\langle 0\rangle$. ∎

######  Lemma 8.7.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 2$ and $\mathcal{L}$ be an
elliptic loop. For every $P,Q\in\mathcal{L}$ such that $\pi(P)=\pi(Q)$ and
every $R_{1},R_{2}\in\mathcal{L}^{\infty}$, we have

$(P+R_{1})-(Q+R_{2})=(P-Q)+(R_{1}-R_{2}).$

###### Proof.

By hypothesis there are
$m_{1},m_{2},m_{3},X_{1},Z_{1},X_{2},Z_{2}\in\mathfrak{m}$ such that if
$P=(X:Y:Z)$, then

$Q=(X+m_{1}:Y+m_{2}:Z+m_{3}),\quad R_{1}=(X_{1}:1:Z_{1}),\quad
R_{2}=(X_{1}:1:Z_{2}).$

By computing

$(S_{1}:S_{2}:S_{3})=(P+R_{1})-(Q+R_{2}),\quad(T_{1}:T_{2}:T_{3})=(P-Q)+(R_{1}-R_{2}),$

we straightforwardly verify that

$I_{2}\left(\begin{bmatrix}S_{1}&S_{2}&S_{3}\\\
T_{1}&T_{2}&T_{3}\end{bmatrix}\right)\subseteq\langle
m_{1},m_{2},m_{3},X_{1},Z_{1},X_{2},Z_{2}\rangle,$

from which the thesis follows by observing that $\langle
m_{1},m_{2},m_{3},X_{1},Z_{1},X_{2},Z_{2}\rangle^{2}\subseteq\mathfrak{m}^{2}=\langle
0\rangle$. ∎

######  Lemma 8.8.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 2$ and $\mathcal{L}$ be an
elliptic loop. For every $P,Q,R\in\mathcal{L}$ such that
$\pi(P)=\pi(Q)=\pi(R)$, we have

$(P+Q)-R=P+(Q-R).$

###### Proof.

By hypothesis there are $m_{1},m_{2},m_{3},m_{4},m_{5},m_{6}\in\mathfrak{m}$
such that if $P=(X:Y:Z)$, then

$Q=(X+m_{1}:Y+m_{2}:Z+m_{3}),\quad R=(X+m_{4}:Y+m_{5}:Z+m_{6}).$

We compute

$(S_{1}:S_{2}:S_{3})=(P+Q)-R,\quad(T_{1}:T_{2}:T_{3})=P+(Q-R),$

and we verify that

$I_{2}\left(\begin{bmatrix}S_{1}&S_{2}&S_{3}\\\
T_{1}&T_{2}&T_{3}\end{bmatrix}\right)\subseteq\langle
m_{1},m_{2},m_{3},m_{4},m_{5},m_{6}\rangle^{2},$

and since $\langle
m_{1},m_{2},m_{3},X_{1},Z_{1},X_{2},Z_{2}\rangle^{2}\subseteq\mathfrak{m}^{2}=\langle
0\rangle$, then the triple $P,Q,-R$ is associative. ∎

######  Remark 8.9.

In the setting of Lemma 8.8 we can avoid useless parentheses: as the result is
independent of the association order, we simply denote it by $P+Q-R$.

######  Proposition 8.10.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 2$ and $\mathcal{L}$ be an
elliptic loop. For every $P_{1},P_{2},P_{3},Q_{1},Q_{2},Q_{3}\in\mathcal{L}$
such that $\pi(P_{1})=\pi(P_{2})=\pi(P_{3})$ and
$\pi(Q_{1})=\pi(Q_{2})=\pi(Q_{3})$, we have

$(P_{1}+P_{2}-P_{3})+(Q_{1}+Q_{2}-Q_{3})=(P_{1}+Q_{1})+(P_{2}+Q_{2})-(P_{3}+Q_{3}).$

###### Proof.

Since $\mathcal{L}$ has no even-order points, we may assume
$P_{1}=(X_{1}:1:Z_{2})$, $Q_{1}=(X_{2}:1:Z_{2})$ and we can consider
$m_{1},m_{2},m_{3},m_{4},m_{5},m_{6},m_{7},m_{8}\in\mathfrak{m}$ such that

$\displaystyle P_{2}=(X_{1}+m_{1}:1:Z_{1}+m_{2}),$ $\displaystyle
P_{3}=(X_{1}+m_{3}:1:Z_{1}+m_{4}),$ $\displaystyle
Q_{2}=(X_{2}+m_{5}:1:Z_{2}+m_{6}),$ $\displaystyle
Q_{3}=(X_{2}+m_{7}:1:Z_{2}+m_{8}).$

We formally compute

$(S_{1}:S_{2}:S_{3})=(P_{1}+P_{2}-P_{3})+(Q_{1}+Q_{2}-Q_{3}),\quad(T_{1}:T_{2}:T_{3})=(P_{1}+Q_{1})+(P_{2}+Q_{2})-(P_{3}+Q_{3}).$

An intensive computation shows that

$I_{2}\left(\begin{bmatrix}S_{1}&S_{2}&S_{3}\\\
T_{1}&T_{2}&T_{3}\end{bmatrix}\right)\subseteq\langle
m_{1},m_{2},m_{3},m_{4},m_{5},m_{6},m_{7},m_{8}\rangle^{2},$

which concludes the proof since $\langle
m_{1},m_{2},m_{3},m_{4},m_{5},m_{6},m_{7},m_{8}\rangle^{2}\subseteq\mathfrak{m}^{2}=\langle
0\rangle$. ∎

As a consequence of Proposition 8.10, we observe that scalar multiplication is
distributive on the associative triples of Lemma 8.8.

######  Lemma 8.11.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 2$ and $\mathcal{L}$ be an
elliptic loop. For every triple $P_{1},P_{2},P_{3}\in\mathcal{L}$ such that
$\pi(P_{1})=\pi(P_{2})=\pi(P_{3})$ and every $m\in\mathbb{Z}$, we have

$m(P_{1}+P_{2}-P_{3})=mP_{1}+mP_{2}-mP_{3}.$

###### Proof.

We prove it by induction on $m$.

[$m=1$] There is nothing to prove.

[$m\to m+1$] By inductive hypothesis we have

$(m+1)(P_{1}+P_{2}-P_{3})=(P_{1}+P_{2}-P_{3})+(mP_{1}+mP_{2}-mP_{3}).$

Since $\pi(mP_{1})=\pi(mP_{2})=\pi(mP_{2})=m\pi(P_{1})$, then the thesis
follows by Proposition 8.10. ∎

##  9 Finite order in the same fiber

In this section, we employ the results of Section 8.2 for characterizing the
torsion elements of elliptic loops when $\mathcal{N}\leq 2$.

For every integer $q\in\mathbb{Z}$ and elliptic loop $\mathcal{L}$, we denote
the points of $\mathcal{L}$ annihilated by the multiplication-by-$q$ map as

$\mathcal{L}_{q}=\\{P\in\mathcal{L}\ |\ qP=\mathcal{O}\\}.$

In other terms, the set $\mathcal{L}_{q}$ is made of the points of
$\mathcal{L}$ whose order is finite and divides $q$. Moreover, given a point
$P\in\mathcal{L}_{q}$, we denote the points of $\mathcal{L}_{q}$ lying over
$\pi(P)$ by

$\mathcal{L}_{q/P}=\\{Q\in\mathcal{L}_{q}\ |\ \pi(Q)=\pi(P)\\},$

and we denote the set of their differences by

$\mathcal{D}_{q/P}=\\{P_{1}-P_{2}\\}_{P_{1},P_{2}\in\mathcal{L}_{q/P}}.$

######  Theorem 9.1.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 2$ and $\mathcal{L}$ be an
elliptic loop. For every $q\in\mathbb{Z}$ and $P\in\mathcal{L}$ we have that
$\mathcal{D}_{q/P}$ is a subgroup of $\mathcal{L}^{\infty}$, and

$\mathcal{L}_{q/P}=P+\mathcal{D}_{q/P}.$

###### Proof.

By Lemma 8.4 we know that $\mathcal{L}^{\infty}$ is an abelian group, which
clearly contains $\mathcal{D}_{q/P}$. Moreover, by Lemma 8.7, for every
$P_{1},P_{2},P_{3},P_{4}\in\mathcal{L}_{q/P}$ we have

$(P_{1}-P_{2})+(P_{3}-P_{4})=(P_{1}+P_{3}-P_{4})-P_{2},$

and $P_{1}+P_{3}-P_{4}\in\mathcal{L}_{q/P}$ by Lemma 8.11. Hence the addition
law is closed on $\mathcal{D}_{q/P}$, and since
$\mathcal{O}=P_{1}-P_{1}\in\mathcal{D}_{q/P}$ and
$-(P_{1}-P_{2})=P_{2}-P_{1}\in\mathcal{D}_{q/P}$, then $\mathcal{D}_{q/P}$ is
a subgroup of $\mathcal{L}^{\infty}$.

The inclusion $\mathcal{L}_{q/P}\subseteq P+\mathcal{D}_{q/P}$ is clear, since
every $Q\in\mathcal{L}_{q/P}$ may be written as $Q=P+(Q-P)$ by Lemma 3.5. On
the other side, for every $P_{1},P_{2}\in\mathcal{L}_{q/P}$, by Lemma 8.11 we
have

$q(P+P_{1}-P_{2})=qP+qP_{1}-qP_{2}=0,$

and since $\pi$ is linear, also $\pi(P+P_{1}-P_{2})=\pi(P)$. Thus, we conclude
$P+P_{1}-P_{2}\in\mathcal{L}_{q/P}$. ∎

######  Proposition 9.2.

Let $R$ be a Hausdorff ring with $\mathcal{N}\leq 2$ and
$\mathcal{L}=\mathcal{L}_{A,B}(R)$ be an elliptic loop. For every
$q\in\mathbb{Z}$ and $P\in\mathcal{L}$, if $\mathcal{D}_{q/P}$ is cyclic then
there is a projective line $L\subseteq\mathbb{P}^{2}(R)$ such that

$\mathcal{L}_{q/P}\subseteq L.$

Moreover, if also $\mathfrak{m}$ is a principal $\mathbb{Z}$-module, then
there is a projective line $L^{\prime}\subseteq\mathbb{P}^{2}(R)$ such that

$\mathcal{L}_{q/P}=L^{\prime}\cap\pi^{-1}\big{(}\pi(P)\big{)}.$

###### Proof.

Let $(X:1:Z)\in\mathcal{L}_{q/P}$ and $(m_{x}:1:m_{z})\in\mathcal{L}^{\infty}$
be a generator of $\mathcal{D}_{q/P}$. By Lemma 8.5 and Theorem 9.1, there is
$(m_{x}:1:m_{z})\in\mathcal{D}_{q/P}$ such that

$\mathcal{L}_{q/P}=\\{(X:1:Z)+(km_{x}:1:km_{z})\\}_{k\in\mathbb{Z}}.$

By defining

$\displaystyle\alpha$
$\displaystyle=A^{2}Z^{2}m_{z}-AX^{2}m_{z}-2AXZm_{x}-6BXZm_{z}-3BZ^{2}m_{x}+m_{x},$
$\displaystyle\beta$
$\displaystyle=2AXZm_{z}+AZ^{2}m_{x}+3BZ^{2}m_{z}+3X^{2}m_{x}+m_{z}.$

we can straightforwardly verify that, since $\mathfrak{m}^{2}=\langle
0\rangle$, then

$(X:1:Z)+(km_{x}:1:km_{z})=(X+k\alpha:1:Z+k\beta).$

Hence, all the points of $\mathcal{L}_{q/P}$ belong to the projective line $L$
defined by

$-\beta x+(\beta X-\alpha Z)y+\alpha z=0.$

As for the moreover part, we notice that both $\alpha,\beta\in\mathfrak{m}$,
hence if $\mathfrak{m}=\mathcal{\mu}\mathbb{Z}$, then we can write
$\alpha=\alpha^{\prime}\mathcal{\mu},\ \beta=\beta^{\prime}\mathcal{\mu}$ and
check that again we have

$-\beta^{\prime}x+(\beta^{\prime}X-\alpha^{\prime}Z)y+\alpha^{\prime}z=0,$

so $\mathcal{L}_{q/P}$ is contained in the line $L^{\prime}$ defined by the
above equation (and in $\pi^{-1}\big{(}\pi(P)\big{)}$ by definition). On the
other side, for every $Q\in\pi^{-1}\big{(}\pi(P)\big{)}$ there are
$s_{x},s_{z}\in\mathbb{Z}$ such that
$Q=(X+s_{x}\mathcal{\mu}:1:Z+s_{z}\mathcal{\mu})$. If also $Q\in L^{\prime}$,
then

$0=-\beta^{\prime}(X+s_{x}\mathcal{\mu})+(\beta^{\prime}X-\alpha^{\prime}Z)+\alpha^{\prime}(Z+s_{z}\mathcal{\mu})=-\beta^{\prime}s_{x}\mathcal{\mu}+\alpha^{\prime}s_{z}\mathcal{\mu}.$

If $\alpha^{\prime},\beta^{\prime}\in\mathfrak{m}$, then
$Q=P\in\mathcal{L}_{q/P}$. Otherwise, one of them is invertible, without
losing of generality $\alpha^{\prime}\in R^{*}$. In this case we have

$X+s_{x}\mathcal{\mu}=X+\frac{s_{x}}{\alpha^{\prime}}\alpha^{\prime}\mathcal{\mu}=X+\frac{s_{x}}{\alpha^{\prime}}\alpha,\quad
Z+s_{z}\mathcal{\mu}=Z+\frac{s_{x}}{\alpha^{\prime}}\beta^{\prime}\mathcal{\mu}=Z+\frac{s_{x}}{\alpha^{\prime}}\beta.$

Hence, by defining $k=\frac{s_{x}}{\alpha^{\prime}}\in\mathbb{Z}$, we conclude

$Q=(X+k\alpha:1:Z+k\beta)=(X:1:Z)+k(m_{x}:1:m_{z})\in\mathcal{L}_{q/P},$

which proves the second inclusion. ∎

##  10 The $\mathbb{Z}/p^{e}\mathbb{Z}$-case

In this section, we consider an integer prime $p$ and a positive integer $e$,
and we examine elliptic loops over the ring $R=\mathbb{Z}/p^{e}\mathbb{Z}$,
whose maximal ideal is $\mathfrak{m}=\langle p\rangle$. The
$\mathfrak{m}$-adic discrete valuation of this ring is usually referred to as
the $p$-adic valuation, and it is denoted by $\mathrm{v}_{p}$.

An elliptic loop $\mathcal{L}$ over this ring projects to an elliptic curve
$E$ defined over $\mathbb{F}_{p}$, whose possible group structures are known
[14, 22], although they may be difficult to be effectively computed.

We denote by $q=|E|$ the size of the underlying curve. In this setting, $\pi$
is a $p^{2(e-1)}$-covering, thus we have

$|\mathcal{L}^{\infty}|=p^{2(e-1)},\quad|\mathcal{L}^{a}|=(q-1)p^{2(e-1)}.$

By Proposition 3.6 and 5.3 we know that such $\mathcal{L}$ is a power-
associative abelian algebraic loop, while by Lemma 8.1 and 8.2 we also know
that it is not a group if one of the following conditions hold:

$(\text{A})\ e\geq 3\quad(\text{B})\ e\geq 2\text{ and }p\geq 17.$

In fact, when $p\geq 17$ the base curve always has a point of order other than
$3$, since it needs to have at least $10$ elements by the Hasse Theorem [23,
Theorem 4.2] and its group of points has rank at most $2$ [23, Theorem 4.1].

By testing every existent elliptic curve defined over a prime field
$\mathbb{F}_{p}$ (with $p\leq 17$) with a group of points isomorphic to either
$\mathbb{Z}/3\mathbb{Z}$ or
$\mathbb{Z}/3\mathbb{Z}\times\mathbb{Z}/3\mathbb{Z}$, one may verify [21] that
there are precisely $6$ elliptic loops over local quotients of $\mathbb{Z}$
that are actual groups, namely

$\displaystyle\mathcal{L}_{4,2}(\mathbb{Z}/25\mathbb{Z})\simeq\mathcal{L}_{4,3}(\mathbb{Z}/25\mathbb{Z})$
$\displaystyle\simeq\mathbb{Z}/5\mathbb{Z}\times\mathbb{Z}/15\mathbb{Z},$
$\displaystyle\mathcal{L}_{0,4}(\mathbb{Z}/49\mathbb{Z})$
$\displaystyle\simeq\mathbb{Z}/7\mathbb{Z}\times\mathbb{Z}/21\mathbb{Z},$
$\displaystyle\mathcal{L}_{0,2}(\mathbb{Z}/49\mathbb{Z})$
$\displaystyle\simeq\mathbb{Z}/21\mathbb{Z}\times\mathbb{Z}/21\mathbb{Z},$
$\displaystyle\mathcal{L}_{0,3}(\mathbb{Z}/169\mathbb{Z})\simeq\mathcal{L}_{0,10}(\mathbb{Z}/169\mathbb{Z})$
$\displaystyle\simeq\mathbb{Z}/39\mathbb{Z}\times\mathbb{Z}/39\mathbb{Z}.$

We also know that $\mathcal{L}^{a}$ is (set-theoretically) made of all the
affine points of elliptic curves lifting $E(\mathbb{F}_{p})$ (Lemma 3.3), and
when $3\nmid q$ it is stratified by the layers of $\mathcal{L}$ (Proposition
6.3).

Over these special rings, the results of Section 7 lead to a complete
characterization of the infinity part $\mathcal{L}^{\infty}$.

######  Theorem 10.1.

Let $\mathcal{L}=\mathcal{L}_{A,B}(\mathbb{Z}/p^{e}\mathbb{Z})$ be an elliptic
loop. Then

  1. $(i)$

$\langle(p:1:0)\rangle\cap\langle(0:1:p)\rangle=\\{\mathcal{O}\\}$.

  2. $(ii)$

$|\langle(p:1:0)\rangle|=|\langle(0:1:p)\rangle|=p^{e-1}$.

  3. $(iii)$

For every $P\in\mathcal{L}^{\infty}$ there are uniquely determined integers
$0\leq\alpha,\beta\leq p^{e-1}-1$, such that

$P=\alpha(p:1:0)+\beta(0:1:p).$

###### Proof.

$(i)$ By Proposition 7.1-$(iv)$, every $(X:1:Z)=\alpha(p:1:0)$ satisfies

$Z\equiv 0\mod p^{3\mathrm{v}_{p}(X)-1}\implies X=Z=0\text{ or
}\mathrm{v}_{p}(Z)>\mathrm{v}_{p}(X).$

Similarly, if the same point may also be written as $\beta(0:1:p)$, then

$X\equiv 0\mod p^{3\mathrm{v}_{p}(Z)-1}\implies X=Z=0\text{ or
}\mathrm{v}_{p}(X)>\mathrm{v}_{p}(Z).$

The unique point satisfying both the above conditions is
$(X:1:Z)=\mathcal{O}$.

$(ii)$ By Proposition 7.1-$(iv)$ we know that if $(X:1:Z)=\alpha(p:1:0)$, then

$X\equiv\alpha p\bmod p^{\mathrm{v}_{p}(\alpha)+2},$

hence the lowest possible $\alpha\in\mathbb{Z}_{\geq 1}$ such that $X=0$ is
$\alpha=p^{e-1}$, which is therefore the order of the group
$\langle(p:1:0)\rangle$. In the same way, we prove the analogous result on
$\langle(0:1:p)\rangle$.

$(iii)$ The case $e=1$ is trivial since
$\mathcal{L}_{A,B}(\mathbb{F}_{p})=E_{A,B}(\mathbb{F}_{p})$ has a unique point
at infinity, hence we may assume $e\geq 2$. Since
$|\mathcal{L}^{\infty}|=|\ker\pi|=p^{2(e-1)}$, it is sufficient to prove that
for every $\alpha_{1},\alpha_{2},\beta_{1},\beta_{2}\in\mathbb{Z}$ and every
$2\leq\epsilon\leq e$ we have

$\alpha_{1}(p:1:0)+\beta_{1}(0:1:p)=\alpha_{2}(p:1:0)+\beta_{2}(0:1:p)\implies\begin{cases}\alpha_{1}\equiv\alpha_{2}\bmod
p^{\epsilon-1},\\\ \beta_{1}\equiv\beta_{2}\bmod p^{\epsilon-1}.\end{cases}$

We prove it by induction on $\epsilon\in\mathbb{Z}_{\geq 2}$.

[$\epsilon=2$] It follows from Proposition 7.1-$(i)$.

[$\epsilon\to\epsilon+1$] By inductive hypotheses there are
$\alpha,\beta\in\mathbb{Z}$ such that we have $\alpha_{2}=\alpha_{1}+\alpha
p^{\epsilon-1}$ and $\beta_{2}=\beta_{1}+\beta p^{\epsilon-1}$. Since
$\mathcal{L}$ is power-associative, we can write

$\alpha_{2}(p:1:0)+\beta_{2}(0:1:p)=\big{(}\alpha_{1}(p:1:0)+\alpha
p^{\epsilon-1}(p:1:0)\big{)}+\big{(}\beta_{1}(0:1:p)+\beta
p^{\epsilon-1}(0:1:p)\big{)}.$

Moreover, if we define

$(\delta_{1}:1:\delta_{2})=\alpha
p^{\epsilon-1}(p:1:0),\quad(\delta_{3}:1:\delta_{4})=\beta
p^{\epsilon-1}(0:1:p),$

by Proposition 7.1-$(iv)$ we have

$\delta_{1}\equiv\alpha p^{\epsilon}\bmod
p^{\epsilon+1},\quad\delta_{2}\equiv\delta_{3}\equiv 0\bmod
p^{\epsilon+1},\quad\delta_{4}\equiv\beta p^{\epsilon}\bmod p^{\epsilon+1}.$

Furthermore, by defining

$(X_{\alpha}:1:Z_{\alpha})=\alpha_{1}(p:1:0),\
(X_{\beta}:1:Z_{\beta})=\beta_{1}(0:1:p),\
(X:1:Z)=(X_{\alpha}:1:Z_{\alpha})+(X_{\beta}:1:Z_{\beta})$

and

$(X_{1}:1:Z_{1})=(X_{\alpha}:1:Z_{\alpha})+(\delta_{1}:1:\delta_{2}),\quad(X_{2}:1:Z_{2})=(X_{\beta}:1:Z_{\beta})+(\delta_{3}:1:\delta_{4}),$

by Proposition 7.1-$(ii)$ we have

$X_{1}\equiv X_{\alpha}+\alpha p^{\epsilon},\quad Z_{1}\equiv Z_{\alpha},\quad
X_{2}\equiv X_{\alpha},\quad Z_{2}\equiv Z_{\alpha}+\beta p^{\epsilon}.$

Thus, $\alpha_{2}(p:1:0)+\beta_{2}(0:1:p)$ is equal to

$(X_{f}:1:Z_{f})=(X_{1}:1:Z_{1})+(X_{2}:1:Z_{2}),$

where by Proposition 7.1-$(ii)$ we have

$X_{f}\equiv X+\alpha p^{\epsilon},\quad Z_{f}\equiv Z+\beta p^{\epsilon}.$

In conclusion, if we have $(X:1:Z)=(X_{f}:1:Z_{f})$, then $p|\alpha$ and
$p|\beta$, which implies $\alpha_{1}\equiv\alpha_{2}\bmod p^{\epsilon}$ and
$\beta_{1}\equiv\beta_{2}\bmod p^{\epsilon}$. ∎

Theorem 10.1 shows that $\mathcal{L}^{\infty}$ may be set theoretically
thought of as

$\mathcal{L}^{\infty}\longleftrightarrow\langle(p:1:0)\rangle\times\langle(0:1:p)\rangle.$

However, we remark that the above correspondence does not preserve the
addition law, as the sum in $\mathcal{L}^{\infty}$ is not necessarily the
product-sum of these subloops, unless $e\leq 5$ (Lemma 8.4).

The next lemma shows that $\langle(0:1:p)\rangle$ has a trivial intersection
with every layer.

######  Lemma 10.2.

Let $\mathcal{L}=\mathcal{L}_{A,B}(\mathbb{Z}/p^{e}\mathbb{Z})$ be an elliptic
loop. For every $t\in p\mathbb{Z}/p^{e}\mathbb{Z}$, we have

$L_{t}\cap\langle(0:1:p)\rangle=\\{\mathcal{O}\\}.$

###### Proof.

By Proposition 7.1 every non-zero multiple $(X:1:Z)=\alpha(0:1:p)$ satisfies

$X\equiv 0\bmod p^{\mathrm{v}_{p}(\alpha)+2},\quad Z\equiv\alpha p\bmod
p^{\mathrm{v}_{p}(\alpha)+2}.$

Hence, we have $\mathrm{v}_{p}(X)\geq\mathrm{v}_{p}(Z)$. If also $(X:1:Z)\in
L_{t}$, then by Lemma 7.2 we conclude $(X:1:Z)=\mathcal{O}$. ∎

Not only the infinity part of the loop may be characterized, but also the
infinity part of its layers can be established. Indeed, all the $p^{e-1}$
layers $L_{t}$ of $\mathcal{L}$ have a cyclic infinity part.

######  Proposition 10.3.

Let $\mathcal{L}=\mathcal{L}_{A,B}(\mathbb{Z}/p^{e}\mathbb{Z})$ be an elliptic
loop. For every $t\in p\mathbb{Z}/p^{e}\mathbb{Z}$ there is a unique $Z_{t}\in
p\mathbb{Z}/p^{e}\mathbb{Z}$ such that

$L_{t}^{\infty}=\langle(p:1:Z_{t})\rangle.$

###### Proof.

We consider the polynomial $F-t\mathcal{H}_{F}(p,1,z)\in\mathbb{Z}[z]$. Since
$F-t\mathcal{H}_{F}(p,1,z)(p,1,0)\equiv 0\bmod p$ and its derivative in $z=0$
is constantly $-1$, by the Hensel Lemma there is a unique $Z_{t}\in
p\mathbb{Z}/p^{e}\mathbb{Z}$ such that $(p:1:Z_{t})\in L_{t}$. Since
$\pi|_{L_{t}}$ is a $p^{e-1}$-covering of the base curve, it is sufficient to
show that the order of $(p:1:Z_{t})$ is $p^{e-1}$. For a given
$\alpha\in\mathbb{Z}$, if we define

$(X_{\alpha}:1:Z_{\alpha})=\alpha(p:1:Z_{t}),$

then by proposition 7.1-$(iv)$ we have

$X_{\alpha}\equiv\alpha p\bmod p^{\mathrm{v}_{p}(\alpha)+2},\quad
Z_{\alpha}\equiv\alpha Z_{t}\bmod p^{\mathrm{v}_{p}(\alpha)+2}.$

Thus, the minimal positive $\alpha$ that makes
$(X_{\alpha}:1:Z_{\alpha})=\mathcal{O}$ is $\alpha=p^{e-1}$. ∎

When the size $q$ of the underling curve is coprime to $p$, the short exact
sequence (4) splits, thus Proposition 10.3 provides the group structure of
layers:

$L_{t}\simeq\mathbb{Z}/p^{e-1}\mathbb{Z}\times E_{A,B}(\mathbb{F}_{p}).$

We also remark that the entry $Z_{t}$ in the generator of $L_{t}^{\infty}$ may
be explicitly computed by truncating to the correct exponent of the classical
series [19, Chapter IV]. This result extends the group classification of
elliptic curves over $\mathbb{Z}/N\mathbb{Z}$ [15, Theorem 17] to every layer
of $\mathcal{L}$.

Finally, we observe that over such rings, the group $\mathcal{D}_{q/P}$ of
Section 9 is almost always cyclic, hence Proposition 9.2 applies: there is a
projective line that locates the points lying over the same base point that
have $q$-torsion.

######  Proposition 10.4.

Let $\mathcal{L}=\mathcal{L}_{A,B}(\mathbb{Z}/p^{2}\mathbb{Z})$ be an elliptic
loop, and let $P\in\mathcal{L}$ be a point of order $q$, such that
$\gcd(3p,q)=1$. Then

$\begin{cases}\mathcal{D}_{q/P}=\\{\mathcal{O}\\}&\text{if
}P\in\mathcal{L}^{\infty},\\\
\mathcal{D}_{q/P}\simeq\mathbb{Z}/p\mathbb{Z}&\text{if
}P\in\mathcal{L}^{a}.\end{cases}$

###### Proof.

By Theorem 9.1 we know that $\mathcal{D}_{q/P}$ is a subgroup of
$\mathcal{L}^{\infty}$, hence by Theorem 10.1 it is a subgroup of
$\mathbb{Z}/p\mathbb{Z}\times\mathbb{Z}/p\mathbb{Z}$.

If $P\in\mathcal{L}^{\infty}$, then its order is divisible by both $p$ and
$q$, hence $P=\mathcal{O}$.

Conversely, if $P\in\mathcal{L}^{a}$ then $\pi(P)\in E_{A,B}(\mathbb{F}_{p})$
is an affine point of order coprime to $3$. Since $\gcd(p,q)=1$, by
Proposition 10.3 all the layers $L_{t}$ of $\mathcal{L}$ have the same
structure, namely

$L_{t}\simeq\mathbb{Z}/p\mathbb{Z}\times E_{A,B}(\mathbb{F}_{p}).$

Hence, $\mathcal{L}_{q/P}$ intersects the every layer $L_{t}$ in precisely one
point $P_{t}$, i.e. the point corresponding to $\big{(}0,\pi(P)\big{)}$ under
the above group isomorphism. Different layers never intersect over points with
order coprime to $3$, as proved in Proposition 6.3. Therefore, all the
$P_{t}$’s are different, and the group

$\mathcal{D}_{q/P}=\\{P_{t}-P_{s}\\}_{s,t\in p\mathbb{Z}/p^{2}\mathbb{Z}}$

contains at least $p$ different points, but it cannot have size $p^{2}$ since
some elements are repeated (e.g. $P_{t}-P_{t}=P_{s}-P_{s}$). Thus, we must
have $|\mathcal{D}_{q/P}|=p$. ∎

##  11 Conclusions and open problems

We presented the construction of a new family of power-associative abelian
loops with a canonical projection on an elliptic curve $E$ defined over the
residue field of a given local ring $(R,\mathfrak{m})$.

When $\mathfrak{m}=\langle 0\rangle$ (i.e. $R$ is a field), the results of
this paper coincide with known results of elliptic curves over fields, but
when $\mathfrak{m}$ is non-trivial this construction simultaneously encodes
all the lifts of the base curve. In particular, layers appear to correspond
1-1 to elliptic curves over $R$ with a canonical projection on $E$, but the
identification of the element $t\in\mathfrak{m}$ that gives rise to the layer
$L_{t}$ corresponding to the canonical lift of $E$ is still open.

Determining the structure of elliptic loops over rings different from
$\mathbb{Z}/p^{e}\mathbb{Z}$ is also considered a challenging research line,
as it is deeply connected to determining the structure of the formal group
associated with elliptic curves over local rings. Besides, we identified large
associative structures over $\mathbb{Z}/p^{e}\mathbb{Z}$, but it is still only
conjectured that layers and groups of size $p^{e-1}$ at infinity are the
largest possible subgroups of an elliptic loop.

Finally, the investigation of the abelian varieties admitting a loop sup-
structure is open, as well as the few cases excluded from the present paper
($6\in\mathfrak{m}$ or points with order not coprime to $6$).

## Acknowledgments

This paper has been supported by the European Union’s H2020 Programme under
grant agreement number ERC-669891 and by the Research Foundation - Flanders
(FWO), project 12ZZC23N. The authors thank Igor Semaev, Francesco Pappalardi,
Michael Kinyon and the anonymous reviewers for their precious observations,
and Nicolò Cangiotti for his support on the computational part.

## Statements and Declarations

Authors declare that there are no financial or non-financial interests that
are directly or indirectly related to the work submitted for publication.
Data sharing is not applicable to this article as no datasets were generated
or analyzed during the current study.
On behalf of all authors, the corresponding author states that there is no
conflict of interest.

## References

  * [1] W. Bosma, J. Cannon, C. Playoust, _The Magma algebra system. I. The user language_ , J. Symbolic Comput. 24, 1997, pp. 235–265.
  * [2] W. Bosma, H. W. Lenstra, _Complete Systems of Two Addition Laws for Elliptic Curves_ , J. Number Theory 53, 1995, pp. 229–240.
  * [3] W. C. Brown, _Matrices over commutative rings_ , Marcel Dekker, 1986.
  * [4] C. Ciliberto, G. Ottaviani, _The Hessian map_ , Int. Math. Res. Not., 2020, pp. 5781–5817.
  * [5] M. Deuring, _Die typen der multiplikatorenringe elliptischer funktionenköper_ , Abh. Math. Sem. Univ. Hamburg 14, 1941, pp. 197–272.
  * [6] I. M. H. Etherington, _Quasigroups and cubic curves_ , Proc. Edinburgh Math. Soc. 14, 1964, pp. 273–291.
  * [7] G. Ganske, B. R. McDonald, _Finite Local Rings_ , Rocky Mt. J. Math. 3, 1973, pp. 521–540.
  * [8] D. Kanevsky, _An example of a non-associative Moufang loop of point classes on a cubic surface_ , arXiv:2104.05118, 2021.
  * [9] N. M. Katz, B. Mazur, _Arithmetic Moduli of Elliptic Curves_ , Ann. Math. Studies 108, Princeton University Press, 1985.
  * [10] H. W. Lenstra, _Elliptic curves and number-theoretic algorithms_ , Proc. International Congress of Mathematicians, 1986, pp. 99–120.
  * [11] Yu. I. Manin, _Cubic Forms_ , North Holland, 1986.
  * [12] M. E. Manis, _Valuations on a Commutative Ring_ , Proc. Am. Math. Soc. 20, 1969, pp. 193–198.
  * [13] P. Norman, _Lifting abelian varieties_ , Invent. Math. 64, 1981, pp. 431–443.
  * [14] H. G. Rück, _A Note on Elliptic Curves Over Finite Fields_ , Math. Comp. 49, 1987, pp. 301–304.
  * [15] M. Sala, D. Taufer, _The group structure of elliptic curves over $\mathbb{Z}/N\mathbb{Z}$_, arXiv:2010.15543, 2020.
  * [16] M. Sala, D. Taufer, _A survey on the group of points arising from elliptic curves with a Weierstrass model over a ring_ , Int. J. Group Theory 12, 2023, pp. 177–196.
  * [17] T. Satoh, K. Araki, _Fermat quotients and the polynomial time discrete log algorithm for anomalous elliptic curves_ , Commentarii Math. Univ. St. Pauli. 47, 1998, pp. 81–92.
  * [18] R. D. Schafer, _An introduction to nonassociative algebras_ , Academic Press, 1966.
  * [19] J. H. Silverman, _The Arithmetic of Elliptic Curves, 2nd Edition_ , Springer, 2016.
  * [20] N. Smart, _The discrete logarithm on elliptic curves of trace one_ , J. Cryptology 12, 1999, pp. 193–196.
  * [21] D. Taufer, _Elliptic Loops_ , University of Trento, 2020. Available at https://iris.unitn.it/handle/11572/265846.
  * [22] J. F. Voloch, _A note on elliptic curves over finite fields_ , Bull. Soc. Math. France 116, 1988, pp. 455–458.
  * [23] L. C. Washington, _Elliptic curves, number theory and cryptography_ , Chapman & Hall / CRC, 2008.
  * [24] The magma code for formal verification and computational testing is available on Github: https://github.com/DTaufer/Elliptic-Loops.