Clay Millennium Prize (stated 2000, $1,000,000) · number theory / arithmetic geometry · conjectured early 1960s · status: OPEN
How to read this page. The central object is an elliptic curveE over the rational numbers ℚ: a cubic equation y2 = x3 + ax + b with a, b ∈ ℚ and no singular points. We write E(ℚ) for its set of rational solutions (plus a point at infinity), which forms an abelian group. Its rankr is the number of independent generators of infinite order. Attached to E is an analytic function L(E, s) of a complex variable s, the Hasse–Weil L-function. The symbol ords=1 L(E, s) means the order of vanishing of L at the point s = 1: i.e. how many derivatives are zero there: called the analytic rank. Other symbols: # = cardinality, ∏ = product, Ш = the Tate–Shafarevich group, 𝔽p = the field with p elements. Everything below is stated as honestly as the mathematics allows: what is proved is marked as proved, what is conjecture is marked as conjecture.
0 · The claim, in one line
For every elliptic curve E over ℚ, the algebraic rank equals the analytic rank:
rank E(ℚ) = ords=1 L(E, s)The number of independent rational points on the curve equals the order of vanishing of its L-function at the center of its critical strip.
and, in the strong form, the leading nonzero coefficient of L at s = 1 is given exactly by an explicit arithmetic formula (Section 2). The weak (rank) statement is the Millennium Prize problem; the strong form is what number theorists actually want.
1 · The object: what it is and why anyone cares
An elliptic curve is the simplest Diophantine shape that is not fully understood. Lines and conics (degree 1 and 2) are completely solved: the Greeks and then Hasse–Minkowski settled when they have rational points and how to list them. Jump to degree 3 (a smooth cubic) and the ground gives way. The question "does this cubic have infinitely many rational solutions, and if so how do we find them?" is open at the deepest level, and that question is the human heart of BSD.
Why does degree 3 matter and not degree 4 or 5? Because of the group law. On a smooth cubic, the chord-and-tangent construction (take two rational points, draw the line through them, it meets the curve in a third rational point) turns the solution set into an abelian group. This is the unique degree where the solutions carry a natural group structure (genus 1 with a marked point). That single fact is why elliptic curves sit at the center of:
Fermat's Last Theorem. Wiles proved FLT by proving enough of the modularity of elliptic curves: the same modularity that BSD leans on.
Cryptography. Elliptic-curve cryptography (ECC) secures a large fraction of the modern internet; its security rests on the hardness of the group's discrete logarithm.
The congruent number problem. "Which integers are the area of a right triangle with rational sides?" (a question posed in the 10th century) reduces exactly to whether a specific elliptic curve has positive rank. BSD gives a clean (conditional) answer: n is congruent iff L(En, 1) = 0.
Chase the "why" to its root and you reach this: we can list the rational points on a line in a day, and we literally do not know an algorithm guaranteed to terminate that decides whether a given cubic has infinitely many rational points. BSD is the conjectured bridge that would hand us one: it says an analytic computation (the behavior of L at s = 1) reads off a purely arithmetic invariant (the rank) that we otherwise cannot get at.
Mordell–Weil theorem (1922 / 1928): this part is a theorem, not a conjecture. Mordell (1922) proved, and Weil (1928, thesis) generalized, that E(ℚ) is a finitely generated abelian group. Hence E(ℚ) ≅ ℤr ⊕ E(ℚ)tors, with r the rank and a finite torsion part (Mazur classified the possible torsion in 1977). So the rank is a well-defined non-negative integer. BSD is about computing it: Mordell–Weil guarantees it exists and is finite, but gives no effective way to find it.
2 · The precise statement / the mathematical setup
2.1 The L-function
Reduce E modulo each prime p and count points over the finite field 𝔽p. For primes of good reduction set
ap = p + 1 − #E(𝔽p)The "error term" measuring how the point count over 𝔽ₚ deviates from the expected p + 1. By Hasse's theorem |aₚ| ≤ 2√p.
The Hasse–Weil L-function is the Euler product over all primes
L(E, s) = ∏p ∤ N (1 − ap p−s + p1−2s)−1 · ∏p | N (1 − ap p−s)−1A product over primes, with a modified factor at the finitely many bad primes dividing the conductor N. It packages the point counts over all 𝔽ₚ into one analytic object.
By Hasse's bound |ap| ≤ 2√p, this product converges only for Re(s) > 3/2. The point of interest, s = 1, lies outside the region of convergence: so the very statement of BSD presupposes that L(E, s) can be analytically continued to s = 1. For decades this continuation was itself conjectural.
Modularity (Wiles 1995; Breuil–Conrad–Diamond–Taylor 2001): theorem. Every elliptic curve over ℚ is modular: L(E, s) = L(f, s) for a weight-2 cusp newform f of level N. Wiles (with Taylor) proved this for semistable curves in 1995; Breuil, Conrad, Diamond, and Taylor completed the general case in 2001. Because modular L-functions are known to continue to the whole complex plane and satisfy a functional equation, modularity is what makes "ords=1 L(E, s)" even well-defined. This is a load-bearing input to BSD that was itself a monumental theorem.
The completed L-function Λ(E, s) = Ns/2 (2π)−s Γ(s) L(E, s) satisfies the functional equation
Λ(E, s) = w · Λ(E, 2 − s), w = ±1A reflection symmetry about the central point s = 1. The sign w (the root number) is +1 or −1; when w = −1 the function is odd about s = 1 and so must vanish there to odd order.
The symmetry axis is s = 1: exactly the point BSD interrogates. The root number w forces the parity: if w = −1, the analytic rank is odd (so ≥ 1); if w = +1, it is even. The parity conjecture (that algebraic rank has the same parity as predicted by w) is known in many cases (Nekovář, Dokchitser–Dokchitser) but the full rank equality is not.
2.2 The strong conjecture (leading coefficient)
Writing r = ords=1 L(E, s), BSD predicts not just r = rank E(ℚ) but the exact value of the first nonzero Taylor coefficient:
lims→1 L(E, s)/(s − 1)r = (ΩE · RegE · #Ш(E/ℚ) · ∏p cp) / (#E(ℚ)tors)2The leading coefficient equals the real period times the regulator (a determinant of canonical heights of the generators) times the order of the Tate–Shafarevich group times the product of Tamagawa numbers, all divided by the square of the torsion order.
The ingredients:
ΩE: the real period, the integral of the invariant differential over the real points; a transcendental analytic quantity.
RegE: the regulator, the determinant of the Néron–Tate height pairing on a basis of E(ℚ)/torsion; it "measures the volume" spanned by the generators and is where the rank enters.
cp: the Tamagawa numbers, local indices at bad primes (almost all equal 1).
#E(ℚ)tors: the (finite, known) torsion order.
#Ш(E/ℚ): the order of the Tate–Shafarevich groupШ, which classifies genus-1 curves that are "locally soluble everywhere but have no rational point." It is not even known to be finite in general.
Note the quiet scandal: the strong formula contains #Ш, a number we cannot in general prove is finite. So the strong BSD presupposes an open finiteness problem just to be stated meaningfully.
3 · Every connection: what hangs on it, what it unlocks
An effective rank algorithm. If BSD holds, you can compute L(E, s) near s = 1 numerically to read off the rank: giving the first guaranteed-to-terminate procedure for deciding whether a cubic has infinitely many rational points. This is the practical prize.
The congruent number problem. Tunnell (1983), using modularity and BSD, gave a simple criterion (counting representations by ternary quadratic forms) that decides congruence: conditionally on BSD. Unconditionally it decides non-congruence; the converse needs BSD.
Finiteness of Ш. BSD (strong form) implies Ш(E/ℚ) is finite: a central conjecture of arithmetic geometry in its own right, open in general.
The Bloch–Kato / Tamagawa number conjecture. BSD is the rank-1 motive case of a vast conjectural framework (Beilinson, Bloch–Kato, Fontaine–Perrin-Riou) predicting leading L-values of all motives in terms of regulators and Galois cohomology. Proving BSD is widely seen as the first genuinely hard test case of that program.
Iwasawa theory. The Iwasawa Main Conjecture for elliptic curves (proved in important cases by Rubin for CM curves, and by Skinner–Urban in 2014 for many non-CM curves) controls the p-part of the strong BSD formula: tying BSD to p-adic L-functions.
Langlands program. Modularity is the GL2/ℚ instance of Langlands reciprocity; BSD is the arithmetic payoff of that reciprocity for elliptic curves. Any general-field BSD would ride on far more Langlands input than is currently available.
4 · Every serious attack: and exactly how far each got
4.1 The computational origin (Birch & Swinnerton-Dyer, early 1960s)
Bryan Birch and Peter Swinnerton-Dyer, at Cambridge, used the EDSAC computer (around 1958–1965) to count points #E(𝔽p) for many primes and plot the partial products ∏p≤X #E(𝔽p)/p. They observed the product grew like (log X)r where r was the rank: the empirical seed of the conjecture, published in their 1965 papers ("Notes on elliptic curves II"). This is one of the earliest conjectures born from machine computation.
4.2 Coates–Wiles (1977)
John Coates and Andrew Wiles proved the first general theoretical case: for an elliptic curve with complex multiplication (over ℚ or an imaginary quadratic field), if E(ℚ) is infinite then L(E, 1) = 0. Contrapositive: L(E, 1) ≠ 0 ⟹ rank = 0. This established one direction of the rank-0 case for CM curves: the first time the L-function was shown to "see" the rank at all.
4.3 Gross–Zagier (1986)
Benedict Gross and Don Zagier proved a formula expressing the first derivativeL′(E, 1) as a nonzero multiple of the Néron–Tate height of a Heegner point: a specific rational-point construction coming from CM points on modular curves:
L′(E, 1) = (nonzero const) · ĥ(PK)When the L-function vanishes to exactly order 1, its derivative there equals a positive multiple of the canonical height of a Heegner point: so that point has infinite order, forcing rank ≥ 1.
Consequence: if ords=1 L = 1, the Heegner point is non-torsion, so rank E(ℚ) ≥ 1. This built the analytic-to-algebraic bridge in the rank-1 direction.
4.4 Kolyvagin (1988–1990): the current frontier
Victor Kolyvagin introduced Euler systems built from Heegner points and proved the decisive bound in the other direction: if the analytic rank is ≤ 1, then the algebraic rank equals it and Ш is finite. Combining Gross–Zagier, Kolyvagin, and modularity yields the strongest unconditional result to date:
ords=1 L(E, s) ∈ {0, 1} ⟹ rank E(ℚ) = ords=1 L(E, s) and #Ш < ∞BSD (the rank statement) is a THEOREM whenever the L-function vanishes to order 0 or 1. Everything from analytic rank 2 upward is open.
This is genuinely proved and unconditional (given modularity). But it stops dead at analytic rank 2.
4.5 Iwasawa-theoretic and converse results
Rubin (1987) proved finiteness of Ш for many CM elliptic curves of analytic rank 0, via the Iwasawa Main Conjecture for imaginary quadratic fields.
Skinner–Urban (2014) proved the Iwasawa Main Conjecture for a large class of non-CM curves, pinning down the p-part of the strong BSD formula under hypotheses: and, with converse theorems (Skinner; W. Zhang), showing rank = 1 ⟹ ords=1 L = 1 in many cases.
Statistical / average results. Bhargava and Shankar (around 2010–2015) bounded the average rank of elliptic curves; combined with the above, Bhargava, Skinner, and W. Zhang showed (2014) that a positive proportion (in fact a majority (over 66%)) of elliptic curves over ℚ satisfy BSD. This is a theorem about most curves, not all, and says nothing about any specific high-rank curve.
BSD asserts a two-way equality between an analytic invariant and an arithmetic one. The only known bridge (Heegner points and Kolyvagin's Euler system) spans the gap solely in analytic ranks 0 and 1.
5 · Why it breaks down: the honest crux
Wall 1: The rank-2 cliff: Heegner points go torsion and the Euler system collapses. Every unconditional proof of the rank statement runs through a single mechanism: a Heegner point PK on E, and the Gross–Zagier formula L′(E,1) = c·ĥ(PK). When the analytic rank is exactly 1, that derivative is nonzero, so the height is nonzero, so the point has infinite order: you have manufactured one independent rational point, exactly matching the rank. But when ords=1 L ≥ 2, the first derivative L′(E,1) is already zero, so Gross–Zagier gives ĥ(PK) = 0: the Heegner point is torsion and tells you nothing. You would need to produce two or more independent points, but the construction yields essentially one. There is no known geometric object whose height computes the second derivative L″(E,1). Kolyvagin's Euler system is built from the same Heegner points; once they degenerate, the system produces only the trivial bound. This is not a technical gap to be patched: we have no construction of rational points attached to higher-order vanishing at all. The bridge in the diagram simply does not exist above rank 1.
Wall 2: The Tate–Shafarevich group is not known to be finite. The strong BSD formula contains #Ш(E/ℚ) in its numerator. For the formula to even make sense, Ш must be finite: yet its finiteness is open for every curve of rank ≥ 2 and is itself regarded as one of the hardest conjectures in arithmetic geometry. Finiteness of Ш is known only exactly where BSD itself is known (analytic rank ≤ 1, via Kolyvagin), so it offers no independent leverage. The structural problem: Ш measures the failure of a local-to-global principle (curves with points everywhere locally but no global rational point), and we lack any general method to bound such failures. Even the p-primary part of Ш requires deep Iwasawa theory (Skinner–Urban) to control, and only under hypotheses. The leading-coefficient conjecture is thus resting a precise equality on a quantity we cannot prove is a number.
Wall 3: Analytic and algebraic ranks are defined in incommensurable worlds. The analytic rank lives in complex analysis: it is the Taylor order of a function continued from an Euler product of point-counts. The algebraic rank lives in the geometry of rational points: a dimension of a finitely generated group. There is no a priori reason these two integers should be equal: BSD is precisely the assertion that they are, and the only proofs we have (Gross–Zagier, Kolyvagin) force the match by physically constructing the points the L-function "predicts." Absent such a construction, there is no transfer principle. Even the parity version (that the two ranks at least agree mod 2) required the full force of Nekovář's and the Dokchitsers' work and is still not known unconditionally in all cases. The deep obstruction is that we understand the L-function's special value as an analytic limit, but we do not have a cohomological interpretation of its higher derivatives that outputs rational points. The general Bloch–Kato/Beilinson framework conjectures such an interpretation (a regulator map), but that framework is more open than BSD, not less.
Wall 4 (speculative / fringe): p-adic BSD and "exceptional zeros."FRINGE / ALTERNATIVE PROGRAM, clearly labelled. One sidelong attack replaces the complex L-function with a p-adic L-function Lp(E, s) (Mazur–Swinnerton-Dyer) and conjectures a p-adic analogue of BSD. Mazur, Tate, and Teitelbaum (1986) formulated a refined p-adic BSD and discovered the "exceptional zero" phenomenon, where the p-adic L-function picks up an extra order of vanishing, corrected by an ℒ-invariant (later computed by Greenberg–Stevens). Why it has not closed the problem: the p-adic story runs parallel to the complex one and is itself only fully controlled in low rank; crucially, the "exceptional zero" shows the p-adic analytic rank can differ from the complex analytic rank, so p-adic results do not directly deliver the classical rank. They constrain the p-part of the strong formula (via Iwasawa Main Conjectures) but cannot, by themselves, prove rank = ords=1 L for a single curve of rank 2. The p-adic program is serious and productive: but it reproduces, rather than escapes, the rank-2 cliff of Wall 1.
Wall 5 (speculative / fringe): random matrix and "average" evidence is not a proof.STATISTICAL / HEURISTIC, clearly labelled. Random-matrix-theory models (Katz–Sarnak philosophy; Conrey, Keating, Snaith) predict the statistical distribution of L-values and vanishing orders across families of curves, and these predictions match data beautifully. Bhargava–Shankar–Skinner–Zhang then proved BSD for a majority of curves on average. The temptation is to think "most curves satisfy BSD, so the pattern is secure." But averages and distributions are silent about any individual curve: in particular about the arithmetically interesting high-rank curves (ranks ≥ 2, with record examples of rank ≥ 28 found computationally), which are precisely the ones not covered. A statistical law over a family is evidence, not a theorem about each member; it cannot be upgraded to the universal statement BSD makes, because the hard cases are a measure-zero set that averaging washes out.
6 · Status: confirmed
The Birch & Swinnerton-Dyer Conjecture is OPEN. This is the honest, verified status as of this writing. What is actually proved, unconditionally (given the modularity theorem):
Proved: the rank statement rank E(ℚ) = ords=1 L(E, s) whenever the analytic rank is 0 or 1 (Gross–Zagier + Kolyvagin + modularity), including finiteness of Ш in those cases.
Proved: special cases of the strong (leading-coefficient) formula, and the p-part in many instances via Iwasawa theory (Rubin; Skinner–Urban).
Proved: BSD for a majority of elliptic curves in an averaged sense (Bhargava–Skinner–Zhang).
What a genuine proof of the full conjecture would still require, at minimum:
A construction of rational points (or some equivalent arithmetic object) attached to higher-order vanishing of L (analytic rank ≥ 2), replacing Heegner points, which degenerate there (Wall 1). This is the single largest obstacle.
An unconditional proof that Ш(E/ℚ) is finite in general, independent of low-rank machinery (Wall 2).
A transfer principle genuinely linking the analytic and algebraic ranks in all orders: plausibly through the full Bloch–Kato/Beilinson program, itself currently out of reach (Wall 3).
Control of the leading coefficient's archimedean and all p-adic parts simultaneously, assembling local data into the exact global formula.
No one has a credible path through the rank-2 cliff. The conjecture is believed true (the numerical and statistical evidence is overwhelming) but belief is not proof, and the mechanism that works for ranks 0 and 1 provably stops there.
Credit where it is due. The conjecture is due to Bryan Birch and Peter Swinnerton-Dyer, from their machine computations and 1965 papers at Cambridge. The theory standing on it was built by Louis Mordell and André Weil (finite generation), John Coates and Andrew Wiles (the first CM case, 1977), Benedict Gross and Don Zagier (the derivative formula, 1986), Victor Kolyvagin (Euler systems and the rank-≤-1 theorem, 1988–1990), Karl Rubin and Christopher Skinner with Eric Urban (Iwasawa theory), Wei Zhang (converse theorems), and Manjul Bhargava with Arul Shankar and collaborators (the average results): all resting on the modularity theorem of Andrew Wiles, Richard Taylor, and Breuil–Conrad–Diamond–Taylor. It is one of the seven Clay Millennium Prize Problems (stated 2000, $1,000,000). The unsolved problem is claimed by no one here: if it is ever solved, that proof is offered freely to the world.