The Birch and Swinnerton-Dyer conjecture

Q: Can you tell whether a curve has infinitely many fraction points just by counting its solutions in clock arithmetic?

Take the equation y^2 = x^3 - 2. You can find one solution in whole numbers by trying a few: x = 3, y = 5, because 27 - 2 = 25. Now ask a harder question. How many solutions are there if x and y are allowed to be fractions? A few? None more? Infinitely many? For this equation the answer is infinitely many, and a straight ruler will make them for you. But for a general equation of this shape, nobody has a method that is proved to always work. In the early 1960s two mathematicians in Cambridge, Bryan Birch and Peter Swinnerton-Dyer, ran an experiment on the EDSAC computer and noticed something strange. Curves with infinitely many fraction solutions seemed to have slightly more solutions when you did the arithmetic on a clock face. Their guess, made precise, is now one of the seven Millennium Prize Problems. The Clay Mathematics Institute will pay 1 million US dollars for a proof. Below you can replay their experiment yourself, on three real curves, and watch the pattern appear.

Q: Has the Birch–Swinnerton-Dyer problem been solved?

The Clay page lists the problem as unsolved, and no prize has been awarded. The accepted picture, in one line: BSD (rank form) is proved for every curve of analytic rank 0 or 1, and for more than 66% of curves overall (Bhargava–Skinner–Zhang, 2014), but it is not proved for a single curve of analytic rank 2 or more. That picture has not substantially changed since 2014. Recent work. On 10 November 2025 Dominik Bullach and Matthew Honnor posted a 74-page preprint claiming to prove "a substantial part" of the Mazur–Tate refinements of BSD. This is a claim, not yet refereed, and it concerns a refinement, not the prize problem itself. In September 2026 Clay ran an invitation-only workshop in Oxford on recent results, organised by Christopher Skinner and Wei Zhang. AI and big data. The 2024 "murmurations" are statistical patterns in the a_p, found with machine-learning tools and since explained by mathematicians. They are patterns, not a proof; Quanta Magazine is explicit that BSD remains unproved. The 2024 rank-29 curve of Elkies and Klagsbrun is about how large ranks can get, not about BSD. We found no credible claim that AI has proved BSD. Self-published "proofs" appear online from time to time, for example on Zenodo. None has been refereed or accepted by experts, and none changes the status above.

Can you tell whether a curve has infinitely many fraction points just by counting its solutions in clock arithmetic?

$1,000,000 · still unsolved 18 min read, with things to play with

Take the equation $y^2 = x^3 - 2$ . You can find one solution in whole numbers by trying a few: $x = 3$ , $y = 5$ , because $27 - 2 = 25$ . Now ask a harder question. How many solutions are there if $x$ and $y$ are allowed to be fractions? A few? None more? Infinitely many?

For this equation the answer is infinitely many, and a straight ruler will make them for you. But for a general equation of this shape, nobody has a method that is proved to always work. In the early 1960s two mathematicians in Cambridge, Bryan Birch and Peter Swinnerton-Dyer, ran an experiment on the EDSAC computer and noticed something strange. Curves with infinitely many fraction solutions seemed to have slightly more solutions when you did the arithmetic on a clock face.

Their guess, made precise, is now one of the seven Millennium Prize Problems. The Clay Mathematics Institute will pay 1 million US dollars for a proof. Below you can replay their experiment yourself, on three real curves, and watch the pattern appear.

1 · Play first

Replay the experiment that started it

Two tabs. Replay the 1960s experiment counts the solutions of three famous curves modulo every prime up to 20,000 and plots a running total. The curves have rank 0, 1 and 2: think of the rank as "how many independent seeds of infinitely many fraction points the curve has". Drag the slider or press sweep.

Add points lets you make new fraction points on $y^2 = x^3 - 2$ with a ruler: draw a line through two points (or a tangent at one), find where it crosses the curve again, and flip it over the $x$ -axis. The fractions are exact, so you can watch how fast they grow.

Across: primes up to x, on a log-log scale. Up: the running total of ln(N_p/p). Dashed: slopes 0, 1 and 2 drawn from x = 100.

Primes up to x = 2 (counted so far: 2)

11.a2: rank 0slope …
37.a1: rank 1slope …
389.a1: rank 2slope …

Each curve is in the LMFDB form y² + y = x³ + …; points are counted exactly mod p (point at infinity included). The primes 2, 11, 37 and 389 are skipped for the curves where they are bad. Slopes are a least-squares fit from x = 100. This is evidence, not proof: the lines wobble and only settle slowly.

What to notice

In the experiment, the three lines climb at different speeds. The fitted slopes come out near 0, 1 and 2: the ranks of the curves.
The slopes wobble at first and only settle slowly. This is what Birch and Swinnerton-Dyer saw, and it is evidence, not a proof.
In Add points, the start point $P = (3, 5)$ is simple, but $2P = (129/100, -383/1000)$ already has a 3-digit denominator. Keep doubling and the digit count roughly quadruples each time.
Every new point is still a pair of fractions. Lines through fraction points meet the curve again at fraction points.

2 · The equation, piece by piece

The conjecture links two very different things: the curve itself, and a function built from counting its points modulo primes. Tap each piece to see what it means.

\htmlClass{t0}{E:\ y^2 = x^3 + ax + b} \qquad \htmlClass{t1}{L(E,s)} = \htmlClass{t2}{\prod_{p\,\nmid\,\Delta}} \frac{1}{1 - \htmlClass{t3}{a_p}\,\htmlClass{t4}{p^{-s}} + p^{1-2s}} \qquad \htmlClass{t5}{\operatorname{ord}_{s=1} L(E,s)} = \htmlClass{t6}{\operatorname{rank} E(\mathbb{Q})}

y^2 = x^3 + ax + b

The elliptic curve E

An elliptic curve: $a$ and $b$ are fixed whole numbers, and we look for points $(x, y)$ where both are fractions. The curve must be smooth, which means $4a^3 + 27b^2 \neq 0$ . Despite the name, it is not an ellipse.

An equivalent way to say it, from the official Clay description by Andrew Wiles: near $s = 1$ , $L(E,s) = c\,(s-1)^r + \dots$ with $c \neq 0$ , and $r$ is the rank. In particular, $L(E,1) = 0$ exactly when the curve has infinitely many fraction points.

A note on conventions: Wiles writes $N_p$ for the number of solutions without the point at infinity and sets $a_p = p - N_p$ . That is the same number as $p + 1 - \#E(\mathbb{F}_p)$ . In the experiment above, $N_p$ includes the point at infinity.

3 · What's going on

1Curves, and the points we care about

An elliptic curve is the set of solutions of an equation like $y^2 = x^3 + ax + b$ . Drawn on a graph it is a smooth curve, sometimes with a separate oval. The name comes from "elliptic integrals", which are used to measure arc length on an ellipse, not from the shape.

Mathematicians care most about rational points: points where both coordinates are fractions (rational numbers), like $(3, 5)$ or $(129/100, -383/1000)$ on $y^2 = x^3 - 2$ . Finding fraction solutions to polynomial equations is one of the oldest problems in mathematics. Such equations are called Diophantine equations, after Diophantus of Alexandria.

For a straight line or a circle, the rational points are completely understood. For curves of "genus 2 or more" (wigglier ones, like $y^2 = x^6 + 1$ ), Gerd Faltings proved in 1983 that there are only finitely many. Elliptic curves sit exactly in between. They can have none, a few, or infinitely many, and that is where the mystery lives.

2A ruler that makes new points

Draw a straight line through two rational points on an elliptic curve. Because the equation is a cubic, the line crosses the curve at exactly one more point (a tangent counts twice). That third point is also rational. Reflect it in the $x$ -axis and call the result $P + Q$ . This is the chord-and-tangent rule.

Diophantus, around the 3rd century, already used a tangent to turn one solution into another. Fermat saw that repeating the trick can give infinitely many. Add one extra "point at infinity", called $O$ , to act as zero, and this addition obeys the usual rules: order does not matter, and every point has a negative (its reflection). Mathematicians say the rational points form a group.

The formulas only use $+$ , $-$ , $\times$ and $\div$ , so fractions in give fractions out. On $y^2 = x^3 - 2$ with $P = (3, 5)$ , the tangent has slope $27/10$ , and the rule gives $2P = (129/100, -383/1000)$ . You can check it: $(129/100)^3 - 2 = 146689/10^6 = (383/1000)^2$ .

\lambda=\begin{cases}\dfrac{y_2-y_1}{x_2-x_1} & P\neq Q\\[2mm] \dfrac{3x_1^2+a}{2y_1} & P=Q\end{cases}\qquad x_3=\lambda^2-x_1-x_2,\qquad y_3=\lambda(x_1-x_3)-y_1

For

P = (x_1, y_1)

and

Q = (x_2, y_2)

\lambda

is the slope of the chord (or tangent), and

P + Q = (x_3, y_3)

. If the line is vertical,

P + Q = O

3Rank: how many seeds you need

In 1922 Louis Mordell proved that every rational point can be built from a finite set of starting points using the ruler rule. Some starting points loop back to $O$ after a few steps: these form the finite torsion part. The others produce infinitely many new points.

The number of independent infinite generators is the rank $r$ . In symbols, $E(\mathbb{Q}) \cong \mathbb{Z}^r \oplus T$ , where $T$ is the finite torsion group. Rank 0 means finitely many rational points. Rank 1 means one seed, like $(3, 5)$ on $y^2 = x^3 - 2$ , spawns infinitely many. Rank 2 means you need two independent seeds.

Here is the catch. Given a curve, there is no method proved to always compute its rank. You can search for points, and you can prove upper bounds with a technique called descent. But if the search finds nothing and the bound says "at most 1", you may be stuck forever. Wiles notes that for genus 1 "no method is known" even to decide whether there is any rational point at all.

4Counting points on a clock

Arithmetic modulo a prime $p$ is clock arithmetic with $p$ hours: $5 + 4 = 2$ on a 7-hour clock. Mathematicians write $\mathbb{F}_p$ for this little number system. Any curve with whole-number coefficients can be read mod $p$ , and then it has only finitely many points, because there are only $p$ choices for $x$ and $p$ for $y$ .

Count them, add one for the point at infinity, and call the result $\#E(\mathbb{F}_p)$ . On average you expect about $p + 1$ . For example, the curve 37.a1, $y^2 + y = x^3 - x$ , has 7 points mod 3 instead of the expected 4. The difference $a_p = p + 1 - \#E(\mathbb{F}_p)$ is never larger than $2\sqrt{p}$ in size (Hasse).

The widget counts these quickly using a trick for odd $p$ : complete the square, so that the number of $y$ values for each $x$ is $1$ , $0$ or $2$ , depending on whether a certain number is zero, not a square, or a nonzero square mod $p$ . A few primes are "bad", where the curve breaks mod $p$ ; for these three curves that is 11, 37 or 389. The widget skips them, and it skips $p = 2$ , which needs separate treatment.

\#E(\mathbb{F}_p) = 1 + \#\{(x,y) : y^2 \equiv x^3+ax+b \pmod p\}, \qquad a_p = p + 1 - \#E(\mathbb{F}_p)

5The EDSAC experiment

Birch and Swinnerton-Dyer reasoned like this. A curve with many rational points should, somehow, have slightly more points mod $p$ than average for many primes. So they multiplied the ratios $N_p / p$ over all good primes up to $x$ and watched how the product grew. Here $N_p$ counts the points mod $p$ including the point at infinity.

Wiles writes that the conjecture "was found experimentally using one of the early EDSAC computers at Cambridge". The product seemed to grow like a constant times $(\log x)^r$ , where $r$ is the rank. Plot the logarithm of the product against $\log \log x$ and you get a line of slope $r$ . That is exactly the plot in the widget. With primes up to 20,000, the fitted slopes come out at about 0.0, 1.05 and 2.1 for the three curves.

The results were published as Notes on elliptic curves II in 1965. Be careful with what the plot means, though. Formally, $\prod N_p/p$ is the Euler product for $1/L(E,s)$ "evaluated at $s = 1$ ", where that product does not actually converge. So this exact growth law is a different, stronger statement than the prize conjecture. It is the experiment that inspired the conjecture, not the conjecture itself.

\prod_{p \le x} \frac{N_p}{p} \;\sim\; C\,(\log x)^{r}

The heuristic: over good primes up to

x

, the product grows like a constant

C

times

(\log x)^r

, where

r

is the rank.

6From experiment to conjecture

To turn the pattern into a sharp statement, package all the $a_p$ into one function, the L-function $L(E,s)$ , as in the equation above. Then ask how it behaves at $s = 1$ . The conjecture says that $L(E,s)$ vanishes at $s = 1$ to order exactly $r$ , the rank. The order of vanishing is called the analytic rank; the number of independent seed points is the algebraic rank. BSD says they are always equal.

There was a problem: the product for $L(E,s)$ only makes sense when the real part of $s$ is above $3/2$ . It was not even known that $L(E,s)$ could be extended to $s = 1$ for every curve until the modularity theorem was finished. Wiles, and Taylor and Wiles, proved most of it in 1995 (the work that also proved Fermat's Last Theorem), and Breuil, Conrad, Diamond and Taylor completed it in 2001.

There is also a refined version. It predicts the leading coefficient $c$ exactly, in terms of the torsion, a "regulator" measuring how big the generators are, a real period, local factors at bad primes, and a mysterious object called the Tate–Shafarevich group Ш. The prize statement in the official description is the rank form.

\frac{L^{(r)}(E,1)}{r!} = \frac{\#\text{Ш}\cdot \Omega_E \cdot R_E \cdot \prod_{p} c_p}{(\#E_{\text{tors}})^2}

The refined conjecture (stated loosely): the leading coefficient at

s = 1

equals the size of Ш times the real period

\Omega_E

, the regulator

R_E

and local factors

c_p

, divided by the torsion size squared.

7What has actually been proved

For curves whose analytic rank is 0 or 1, the conjecture is a theorem. In 1983 (published 1986) Benedict Gross and Don Zagier showed that if $L(E,1) = 0$ but its derivative is not, a special point called a Heegner point has infinite order, so the rank is at least 1. In 1989 to 1990 Victor Kolyvagin showed that analytic rank 0 gives rank 0, and analytic rank 1 gives rank 1. Combined with modularity, this covers every elliptic curve over the rationals with analytic rank 0 or 1.

Statistics went further. In 2010 Manjul Bhargava and Arul Shankar proved that the average rank, over curves ordered by size, is at most 1.5. In 2014 Bhargava, Christopher Skinner and Wei Zhang proved that more than 66% of elliptic curves over the rationals satisfy the rank part of BSD.

But for analytic rank 2 or more, nothing is proved, for any curve at all. The rank-2 curve 389.a1 in the widget agrees numerically with the conjecture, but even its analytic rank is computed numerically, not proved.

4 · Why it's so hard

BSD links an infinite, global question (all the rational points) to local data (counts mod each prime). Every known route from one side to the other breaks somewhere.

No algorithm for the rank

Descent gives upper bounds on the rank through "Selmer groups". The gap between that bound and the true rank is measured by Ш, which is not known to be finite in general. So there is no procedure proved to always finish with the right answer.

Only one point at a time

Gross–Zagier and Kolyvagin build one point of infinite order from a Heegner point. Nothing comparable is known for making two or more independent points, which is why "analytic rank 2 means rank 2" is open for every curve.

s = 1 is outside the safe zone

The product defining $L(E,s)$ converges only for real part of $s$ above $3/2$ . Reaching $s = 1$ needed the full modularity theorem, and controlling the function there to high order is much harder still.

Most is not all

Proving BSD for 66%, or even "100% by density", still leaves infinitely many curves uncovered. The prize needs every elliptic curve over the rationals.

5 · What a solution would change

A way to find the points

Wiles notes that a proof of the strong form would give an effective way to find generators of the rational points on any elliptic curve. It is also hoped to explain why Ш is finite.

An ancient problem settled

A number $n$ is "congruent" if it is the area of a right triangle with rational sides. This is equivalent to $y^2 = x^3 - n^2x$ having infinitely many rational points. Tunnell gave a simple test; one direction is proved, the other depends on BSD. BSD would show, for example, that every $n$ leaving remainder 5, 6 or 7 on division by 8 is congruent.

Same rule as cryptography, different world

Elliptic-curve cryptography, such as the curves in NIST SP 800-186 used for secure web connections and digital signatures, uses the same chord-and-tangent rule, but over finite fields, not fractions. Its security rests on the elliptic-curve discrete logarithm problem. BSD is not used by it, and a proof would not break it. The honest link is: same objects, same rule. Point counting does matter in practice, because you need the group size to choose safe curves.

6 · Where it stands

As of October 2026

The Clay page lists the problem as unsolved, and no prize has been awarded. The accepted picture, in one line: BSD (rank form) is proved for every curve of analytic rank 0 or 1, and for more than 66% of curves overall (Bhargava–Skinner–Zhang, 2014), but it is not proved for a single curve of analytic rank 2 or more. That picture has not substantially changed since 2014.

Recent work. On 10 November 2025 Dominik Bullach and Matthew Honnor posted a 74-page preprint claiming to prove "a substantial part" of the Mazur–Tate refinements of BSD. This is a claim, not yet refereed, and it concerns a refinement, not the prize problem itself. In September 2026 Clay ran an invitation-only workshop in Oxford on recent results, organised by Christopher Skinner and Wei Zhang.

AI and big data. The 2024 "murmurations" are statistical patterns in the $a_p$ , found with machine-learning tools and since explained by mathematicians. They are patterns, not a proof; Quanta Magazine is explicit that BSD remains unproved. The 2024 rank-29 curve of Elkies and Klagsbrun is about how large ranks can get, not about BSD. We found no credible claim that AI has proved BSD.

Self-published "proofs" appear online from time to time, for example on Zenodo. None has been refereed or accepted by experts, and none changes the status above.

c. 250
Diophantus uses a tangent to turn one rational solution into another. Fermat later repeats the trick to get infinitely many. (Wiles, Clay description)
1901
Poincaré begins the modern theory of rational points on curves and asks about the number of generators.
1922
Mordell proves the rational points are finitely generated: $E(\mathbb{Q}) \cong \mathbb{Z}^r \oplus T$ .
1960s
Birch and Swinnerton-Dyer find the conjecture experimentally on the EDSAC computer in Cambridge. Published as Notes on elliptic curves II (1965).
1977
Coates and Wiles: for curves with complex multiplication, $L(E,1) \neq 0$ implies finitely many rational points.
1986
Gross and Zagier: if $L(E,1) = 0$ and $L'(E,1) \neq 0$ , a Heegner point has infinite order (announced 1983).
1989–90
Kolyvagin: for modular curves, analytic rank 0 gives rank 0 and analytic rank 1 gives rank 1.
1995–2001
Wiles, Taylor–Wiles, then Breuil–Conrad–Diamond–Taylor prove every elliptic curve over the rationals is modular, so the rank 0 and 1 results apply to all of them.
2000
The Clay Mathematics Institute names BSD one of its seven Millennium Prize Problems.
2014
Bhargava, Skinner and Zhang: more than 66% of elliptic curves over the rationals satisfy the BSD rank conjecture.
2024
Machine-learning work reveals "murmurations", oscillating averages of $a_p$ that depend on rank. Elkies and Klagsbrun find a curve of rank at least 29, beating the 2006 record of 28.
2025
Bullach and Honnor post a preprint (10 Nov 2025) claiming to prove a substantial part of the Mazur–Tate refinements of BSD. Not yet refereed.
2026
Clay holds a workshop on recent BSD results at the Mathematical Institute, Oxford, 21 to 25 September, organised by Skinner and Zhang.

Common mix-ups

MythElliptic curves are ellipses.

ActuallyNo. They are cubic curves like $y^2 = x^3 + ax + b$ . The name comes from elliptic integrals, which measure arc length on ellipses.

MythBSD is about counting the points on a curve.

ActuallyOver the fractions there are often infinitely many points. BSD is about the rank: whether there are infinitely many, and how many independent seeds generate them. The counting happens mod $p$ , as evidence.

Myth66% is proved, so it is nearly solved.

ActuallyEvery curve of analytic rank 2 or more is untouched. Even "100% by density" would leave infinitely many curves, and the prize needs all of them.

MythComputers or AI have verified or proved BSD.

ActuallyComputers have checked that the numbers agree for many curves, as in the LMFDB database. That is evidence, not proof. The AI work found statistical patterns (murmurations), not a proof.

MythProving BSD would break Bitcoin and online security.

ActuallyElliptic-curve cryptography uses the same addition rule, but on finite fields. BSD is about infinitely many fraction points. A proof would not weaken the discrete logarithm problem that cryptography relies on.

7 · References

The Birch and Swinnerton-Dyer Conjecture (Millennium Problem page), Clay Mathematics Institute, 2026
The Birch and Swinnerton-Dyer Conjecture (official problem description), Andrew Wiles / Clay Mathematics Institute, 2000
The Birch and Swinnerton-Dyer Conjecture and Related Problems: Recent Results (workshop), Clay Mathematics Institute, 2026
Binary quartic forms having bounded invariants, and the boundedness of the average rank of elliptic curves, M. Bhargava and A. Shankar, 2010
A majority of elliptic curves over Q satisfy the Birch and Swinnerton-Dyer conjecture, M. Bhargava, C. Skinner and W. Zhang, 2014
The BSD conjecture is true for most elliptic curves, Matt Baker, 2014
Elliptic curve 11.a2, LMFDB Collaboration, 2026
Elliptic curve 37.a1, LMFDB Collaboration, 2026
Elliptic curve 389.a1, LMFDB Collaboration, 2026
Curves of conductor 1728 (y² = x³ − 2 is 1728.o3), LMFDB Collaboration, 2026
Elliptic Curve 'Murmurations' Found With AI Take Flight, Lyndie Chiou, Quanta Magazine, 2024
New Elliptic Curve Breaks 18-Year-Old Record, Joseph Howlett, Quanta Magazine, 2024
On the refined "Birch–Swinnerton-Dyer type" conjectures of Mazur and Tate (preprint), D. Bullach and M. H. L. Honnor, 2025
SP 800-186: Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters, NIST, 2023

Next problemHodge: On a shape cut out by polynomial equations, is every hole that passes Hodge's "looks algebraic" test really traced out by smaller shapes that are also cut out by polynomial equations?