Let \(x, y, z \in k\) be such that \(z^2 = a a'^2 x^2 + b b'^2 y^2\). Then, \(xa', yb', z\) are not all zero and satisfy \(z^2 = ax^2 + by^2\). Conversely, if \(x, y, z \in k\) are such that \(z^2 = ax^2 + by^2\), then \(x/a', y/b', z\) are not all zero and satisfy \(z^2 = a a'^2 x^2 + b b'^2 y^2\).

• Case \(b\) is a square in \(k\). Then \(k(\sqrt{b}) = k\), and the norm map is the identity, so \(a\) is always the norm of itself. Let \(c \in k^\times \) be such that \(c^2 = b\). Then \(c^2 = a \cdot 0^2 + b \cdot 1^2\), so \((a,b)_k=1\).

• Case \(b\) is not a square in \(k\). Then \(k(\sqrt{b})\) is a quadratic extension of \(k\), and the norm map is given by \(N_{k(\sqrt{b})/k}(p + q \sqrt{b}) = p^2 - b q^2\). Suppose \(a\) is a norm, so it satisfies \(a = p^2 - b q^2\) for some \(p, q \in k\). Then \(1, q, p\) are not all zero and satisfy \( p^2 = a \cdot 1^2 + b \cdot q^2\), so \((a, b)_k = 1\). Conversely, if \(x, y, z\) are not all zero and satisfy \(z^2 = ax^2 + by^2\), then \(x=0\), since otherwise \(b\) would be a square in \(k\), which contradicts our assumption. Then \(x \ne 0\), and we have \(a = (z/x)^2 - b (y/x)^2\), so \(a\) is a norm.

• Trivial if \(a\) or \(b\) are zero. Otherwise, if \(x,y,z\) is a solution to \(z^2 = ax^2 + by^2\), then \(y,x,z\) is a solution to \(z^2 = bx^2 + ay^2\).

• In this case, \(c^2 = a \cdot 0^2 + b \cdot 1^2\), so \((a,b)_k=1\). N.B. Alternatively: the same argument as in the first case of the proof of Lemma 2.1.3 applies.

• In this case, \(0 = a \cdot 1^2 + (-a) \cdot 1^2\).

• In this case, \(1 = a \cdot 1^2 + (1 - a) \cdot 1^2\).

• We know, by Lemma 2.1.3, that there exists \(t \in k(\sqrt{b})\) such that \(a = N_{k(\sqrt{b})/k}(t)\). If \((a',b)_k=1\), then \(a'\) is the norm of some \(t' \in k(\sqrt{b})\), so \(aa' = N_{k(\sqrt{b})/k}(t t')\), so \((aa', b)_k = 1\). Conversely, if \((aa', b)_k = 1\), then \(aa' = N_{k(\sqrt{b})/k}(t'')\) for some \(t'' \in k(\sqrt{b})\), so \(a' = N_{k(\sqrt{b})/k}(t''/t)\), hence \((a', b)_k = 1\).

• Trivial if \(a\) or \(b\) are zero. Otherwise it follows from the previous steps, since \((a, -a)_k = 1\).

• Follows from the previous steps, since \((a, 1 - a)_k = 1\).

If \(a{\gt}0\), then \((1,0,\sqrt{a})\) works. Similarly, if \(b{\gt}0\), then \((0,1,\sqrt{b})\) works. If both \(a\) and \(b\) are negative, then \(ax^2 + by^2 \le 0\) for all \(x,y\), so there is no nontrivial solution to \(z^2 = ax^2 + by^2\).

Let \((x,y,z)\) be any nontrivial solution. For any \(\lambda \ne 0\), also \((\lambda x, \lambda y, \lambda z)\) is a solution. Taking \(\lambda = p^a\) for an appropriate \(a\), we can assume that \(x,y,z\) are all in \(\mathbb {Z}_p\) and at least one of them is a unit. Now, if \(z\) is not a unit, then \(px^2+vy^2\) is also not a unit, thus \(y\) is not a unit. Conversely if \(y\) is not a unit, then \(z^2-px^2\) is also not a unit, thus \(z\) is not a unit. This shows that if either \(y\) or \(z\) is not a unit, then they are both non units, but then \(p^2\) would divide \(px^2\), hence \(x\) would not be a unit either, contradicting the fact that one of \(x,y,z\) is a unit.

Since the Hilbert symbol is well defined up to squares, we can assume that \(v_a, v_b \in \{ 0, 1\} \).

• Suppose \(v_a=v_b=0\). Then \(a=u_a\) and \(b=u_b\) are units. By the theorem of Chevalley–Warning, the equation \(z^2 = u_a x^2 + u_b y^2\) has a nontrivial solution in \(\mathbb {F}_p\), so it has a nontrivial solution in \(\mathbb {Z}_p\) (by multivariate Hensel’s lemma), so \((a,b)=1\). Note: Chevalley–Warning is in Mathlibas char_dvd_card_solutions, in Mathlib.FieldTheory.ChevalleyWarning.

• Suppose \(v_a=1\) and \(v_b=0\). Then \(a=p u_a\) and \(b=u_b\). Since by the previous case, we have \((u_a, u_b)=1\), we have \((a,b) = (p u_a, u_b) = (p, u_b)\). We just need to show that this is equal to \(\left(\dfrac {u_b}{p}\right)\). Observe that a unit is a square in \(\mathbb {Q}_p\) if and only if it is a square modulo \(p\). Now, if \(u_b\) is a square, then both terms are \(1\), see 2.1.4. Otherwise, both terms are \(-1\). In fact, if \(z^2-p^2x^2-u_by^2\) has a nontrivial solution, we can assume that \(z\) and \(u_b\) are units, so we can reduce modulo \(p\) to get \(u_b = (zy^{-1})^2\), which is a contradiction.

• Suppose \(v_a=v_b=1\). Then \(a=p u_a\) and \(b=p u_b\). This case follows from the properties of the Hilbert symbol and the previous case: \((pu_a,pu_b)=(pu_a, -p^2u_au_b)= (pu_a, -u_au_b)= \left(\dfrac {-u_au_b}{p}\right)\). By the properties of the Legendre symbol, this is equal to \(\left(\dfrac {-1}{p}\right)\left(\dfrac {u_a}{p}\right)\left(\dfrac {u_b}{p}\right)\), as claimed.

Similarly to the previous case, we can assume that \(v_a, v_b \in \{ 0, 1\} \).

Case 1 Suppose \(v_a=v_b=0\). Then \(a=u_a\) and \(b=u_b\) are units. The claim is \((u_a,u_b)=(-1)^{\epsilon (u_a)\epsilon (u_b)}\), which is \(1\) exactly when at least one of \(u_a\) and \(u_b\) is congruent to \(1\) modulo \(4\) and \(-1\) otherwise. Suppose first, without loss of generality, that \(u_a \equiv 1 \pmod4\). Then its residue class modulo \(8\) is either \(1\) or \(5\). In the first case, \(u_a\) is a square, so \((u_a,u_b)=1\). In the second case, \(u_a+4u_b \equiv 1 \pmod8\), so it is the square of some \(w in \mathbb {Z}_2\), so

and thus \((u_a,u_b)=1\).

If \(u_a \equiv u_b \equiv -1 \pmod4\), then suppose there exist \((x,y,z)\) not all zero, coprime, such that

Reducing modulo \(4\), we obtain \(z^2+x^2+y^2 \equiv 0 \pmod4\), which is impossible, since the only squares modulo \(4\) are \(0\) and \(1\), and the sum can be \(0\) only if \(x,y,z\) are all even, contradicting the fact that they are coprime. Thus, \((u_a,u_b)=-1\). This proof uses ZMod.exists_sq_eq_two_iff from Mathlib.NumberTheory.LegendreSymbol.QuadraticReciprocity and hensels_lemma in Mathlib.NumberTheory.Padics.Hensel

Case 2 Suppose \(v_a=1\) and \(v_b=0\). Then \(a=2 u_a\) and \(b=u_b\). We first show that

i.e. that \((2, u_b)=1\) if an only if \(u_b \equiv \pm 1 \pmod8\). Suppose that \((2, u_b)=1\). Equivalently, there exist \(x,y,z\) not all zero, coprime, such that

By Lemma 2.1.8, we can assume that \(z\) and \(y\) are units. Reducing modulo \(8\), we get \(1 - 2x^2 - u_b \equiv 0 \pmod8\). Since squares modulo \(8\) are \(0, 1\) and \(4\), we have \(2x^2 \equiv 0\) or \(2 \pmod8\), so \(u_b \equiv 1\) or \(-1 \pmod8\).

Conversely, if \(u_b \equiv 1 \pmod8\), then it is a square, so \((2, u_b)=1\). If \(u_b \equiv -1 \pmod8\), then \(z^2-2x^2-u_by^2=0\) has a solution modulo \(8\), namely \((1,1,1)\), which can be lifted to a solution in \(\mathbb {Z}_2\) by Hensel’s lemma (1.2.2), so \((2, u_b)=1\). Now, if we prove that \((2u_a,u_b)=(u_a,u_b)(2,u_b)\), then we are done. If either factor is \(1\), by Proposition 2.1.4, we are done. Otherwise, both factors are \(-1\), so by the above we know \(u_a \equiv -1 \pmod4\) and \(u_b \equiv 3 \pmod8\). Up to multiplying by squares, we can consider the following two cases:

• \(u_a=-1,u_b=3\). Then \((1,1,1)\) is a nontrivial solution to \(z^2+2x^2-3y^2=0\).

• \(u_a=3,u_b=-5\). Then \((1,1,1)\) is a nontrivial solution to \(z^2-6x^2+5y^2=0\).

Case 3 Suppose \(v_a=v_b=1\). Using Proposition 2.1.4 and the proof of the previous case, we have

and a direct calculation shows that

By symmetry, it is enough to show the first equality. If any of \(a, a', b\) is zero, then both sides are zero. We will assume that \(a,a',b \neq 0\).

The real case is trivial: if \(b {\gt} 0\), then all the Hilbert symbols are \(1\); otherwise, if \(a\) and \(a'\) have the same sign, then \((aa',b) = 1\) because \(aa' {\gt} 0\), and \((a,b) = (a',b)\), so the right-hand side is also \(1\); if \(a\) and \(a'\) have different signs, then \((aa',b) = -1\) because \(aa' {\lt} 0\), and \((a,b) = -(a',b)\), so the right-hand side is also \(-1\).

We now assume that \(k=\mathbb {Q}_p\). Suppose first that \(p\) is odd. By the formula in Theorem 2.1.9,

If \(p=2\), we use the formula in Theorem 2.1.10.

Since \(\epsilon \) and \(\omega \) are group homomorphisms from a multiplicative group to an additive group, we have

From the explicit formulas for the Hilbert symbol in the \(p\)-adic and in the real case, we see that it is multiplicative in both variables. In particular, it suffices to prove this theorem (and the following one) for \(a\) and \(b\) equal to \(-1\) or a prime number. Using the formulas, we find:

• Case \(a = -1, \, b = -1\). One has \((-1, -1)_\infty = (-1, -1)_2 = -1\) and \((-1, -1)_p = 1\) if \(p \ne 2, \infty \);

• \(a = -1, \, b = \ell \) with \(\ell \) prime. If \(\ell =2\), one has \((-1, 2)_v = 1\) for all places \(v\); if \(v \ne 2\), one has \((-1, \ell )_v = 1\) if \(v \ne 2, \ell \), and \((-1, \ell )_2 = (-1, \ell )_{\ell } = (-1)^{e(\ell )}\);

• \(a = \ell , b = \ell '\) with \(\ell , \ell '\) primes. If \(\ell = \ell '\), by Proposition 2.1.4, \((\ell , \ell )_v = (-1, \ell )_v\) for all \(v\) and we are reduced to the case considered above. If \(\ell \ne \ell '\) and if \(\ell ' = 2\), one has \((\ell , 2)_v = 1\) for \(v \ne 2, \, \ell \) and

  \[ (\ell , 2)_2 = (-1)^{\omega (\ell )}, \qquad (\ell , 2)_{\ell } = \left(\frac{2}{\ell }\right) = (-1)^{\omega (\ell )}, \quad \text{cf. chap. I, n° 3.2, th. 5.} \]

  If \( \ell \) and \( \ell ' \) are distinct and different from 2, one has \( (\ell , \ell ')_v = 1 \) for \( v \neq 2, \, \ell , \, \ell ' \) and

  \[ (\ell , \ell ')_2 = (-1)^{\epsilon (\ell )e(\ell ')}, \quad (\ell , \ell ')_{\ell } = \left(\frac{\ell '}{\ell }\right), \quad (\ell , \ell ')_{\ell '} = \left(\frac{\ell }{\ell '}\right). \]

Follows immediately from the proof of Theorem 2.1.12 and quadratic reciprocity, which can be imported from Mathlib.NumberTheory.LegendreSymbol.QuadraticReciprocity. In all cases, the product is one.

Let \(y=(y_\infty , (y_p)_{p \in S})\) be an element of \(\mathbb {R}\times \prod _{p \in S} \mathbb {Q}_p\). We can assume \(y_p \in \mathbb {Z}_p\) for all \(p \in S\), since otherwise we can multiply all \(y_p\)’s by an integer. Let \(\varepsilon {\gt} 0\) and \(N \ge 0\). We need to prove that there exists \(x \in \mathbb {Q}\) such that \(|y_\infty - x| \le \varepsilon \) and \(v_p(y_p - x) \ge N\) for all \(p \in S\).

By the Chinese Remainder Theorem Nat.chineseRemainderOfFinset, there exists \(x_0 \in \mathbb {N}\) such that \(x_0 \equiv y_p \pmod{p^N}\) for all \(p \in S\).

Fix \(q\) a prime number. By density of the numbers of the form \(a/q^m\) in \(\mathbb {R}\), where \(a \in \mathbb {Z}\) and \(m \ge 0\), we can find \(a\) in \(\mathbb {Z}\), \(q\) a prime not in \(S\) and \(m \ge 0\), such that

Then \(x = x_0 + \frac{a}{q^m}(p_1\dots p_n)^N\) satisfies the required conditions.

To show that the conditions are necesary, simply observe that 1. is Theorem 2.1.12, 2. is Theorem 2.1.13, and 3. is trivial since we can take \(x_v = x\) for all \(v\).

Conversely, suppose that 1., 2. and 3. hold. Up to multiplying by a square integer (which does not change the Hilbert symbols), we can assume that all \(a_i\)’s are integers. Let \(S\) be the set of places \(2\), \(\infty \) and all the prime divisors of the \(a_i\)’s. Let \(T\) be the set of places \(v\) such that there exists \(i \in I\) with \(e_{i,v}=-1\). The set \(S\) is finite and, by 1., \(T\) is also finite.

Consider first the case where \(S \cap T= \emptyset \). Then, we define

Since \(a,m\) are coprime, by Nat.infinite_setOf_prime_and_modEq, there exists a prime number \(p\) such that \(p \equiv a \pmod m\) and \(p \not\in S \cup T\).

Taking \(x=ap\) works.

• If \(v= \infty \), then \(x {\gt} 0\), so \((x, a_i)_\infty = 1\) for all \(i\), and \(\infty \notin T\), so \(e_{i,\infty }=1\).

• If \(v = \ell \in S\), we have \(x \equiv a^2 \pmod m\), so \(x\) is a square modulo any \(\ell \in S\), hence by Hensel’s lemma it is a square in \(\mathbb {Q}_\ell \), and \(x\) is a square modulo \(8\), so again by Hensel’s lemma it is a square in \(\mathbb {Q}_2\). By Proposition 2.1.4, \((x,a_i)=1\).

• If \(v = \ell \notin T\) and \(\ell \ne p\), \(v_\ell (x)=0\) and so \((x,a_i)_{\ell }=\left(\dfrac {a_i}{\ell }\right)^v_{\ell }(x)=1\). On the other hand, \(e_{i,\ell =1}\), since \(v \notin T\).

• If \(v = \ell \in T\), then \(v_\ell (x)=1\), so \((x,a_i)_{\ell }=\left(\dfrac {a_i}{\ell }\right)\). By 3., there exists \(x_\ell \in \mathbb {Q}_\ell ^\times \) such that \((x_\ell , a_i)_\ell = e_{i,\ell }\) for all \(i\), and \(v_\ell (x_\ell )\) is odd since at least one of the \(e_{i,\ell }\)’s is \(-1\). Therefore, \((a_i,x)_\ell \) and \((a_i,x_\ell )_\ell \) are both equal to \(\left(\dfrac {a_i}{\ell }\right)\).

• If \(v = p\), since for all the other places the equality holds, by the product formula we also have \((x,a_i)_p = e_{i,p}\) for all \(i\).

For the general case, since the image of \(\mathbb {Q}^\times \) is dense in \(\prod _{v \in S} \mathbb {Q}_v^\times \), by Theorem 2.1.15, and squares are open in \(\mathbb {Q}_v^\times \), by Theorem 1.2.1, we can find \(x' \in \mathbb {Q}^\times \) such that \(x'/x_v\) is a square in \(\mathbb {Q}_v^\times \) for all \(v \in S\). Then, \((x', a_i)_v = (x_v, a_i)_v = e_{i,v}\) for all \(i\) and all \(v \in S\). Let \(\eta _{i,v}= e_{i,v} (x', a_i)_v\). Then \(\eta _{i,v}=1\) for all \(v \in S\) and conditions 1., 2. and 3. hold for the \(\eta _{i,v}\)’s, so we can apply the first part of the proof to find \(y \in \mathbb {Q}^\times \) such that \((y, a_i)_v = \eta _{i,v}\) for all \(i\) and all \(v\).

Finally, setting \(x = x' y\), we have \((x, a_i)_v = (x', a_i)_v (y, a_i)_v = e_{i,v}\) (by the explicit formulas for the Hilbert symbol in the \(p\)-adic and in the real case) for all \(i\) and all \(v\), as desired.