A REFINEMENT OF KOBLITZ S CONJECTURE

Transcription

1 A REFINEMENT OF KOBLITZ S CONJECTURE DAVID ZYWINA Abstract. Let E be an eiptic curve over the rationas. In 1988, Kobitz conjectured an asymptotic for the number of primes p for which the cardinaity of the group of F p-points of E is prime. However, the constant occurring in his asymptotic does not take into account that the distributions of the EF p need not be independent moduo distinct primes. We sha describe a corrected constant. We aso take the opportunity to extend the scope of the origina conjecture to ask how often EF p /t is an integer and prime for a fixed positive integer t, and to consider eiptic curves over arbitrary number fieds. Severa worked out exampes are provided to suppy numerica evidence for the new conjecture. 1. Introduction Motivated by appications to eiptic curve cryptography and the heuristic methods of Hardy and Littewood [HL23], N. Kobitz made the foowing conjecture: Conjecture 1.1 [Kob88, Conjecture A]. Let E be a non-cm eiptic curve defined over Q with conductor N E. Assume that E is not Q-isogenous to a curve with nontrivia Q-torsion. Then x {p x prime : p N E, EF p is prime} C E og x 2 as x, where C E is an expicit positive constant. However, the description of the constant C E in [Kob88] is not aways correct and more seriousy, our corrected version of the constant is not necessariy positive. The additiona phenomena that needs to be taken into account is that the divisibiity conditions moduo distinct primes, unike the more cassica cases considered by Hardy and Littewood, need not be independent. Lang and Trotter have successfuy deat with this non-independence in their conjectures [LT76]. A simiar modification was required for the origina constant of Artin s conjecture; see [Ste03] for a nice historica overview An exampe. As an iustration, consider the foowing exampe kindy provided by N. Jones. Let E be the eiptic curve over Q defined by the Weierstrass equation y 2 = x 3 + 9x + 18; this curve has conductor , and is not isogenous over Q to an eiptic curve with non-trivia Q-torsion. Conjecture 1.1 predicts that EF p is prime for infinitey many primes p; however for p > 5, EF p is aways composite! For a positive integer m, et ϑ m be the density of the set of primes p for which EF p is divisibe by m; intuitivey, we may think of this as the probabiity that m divides EF p for a random p. We can compute these ϑ m by appying the Chebotarev density theorem to the extensions QE[m]/Q where QE[m] is the extension of Q generated by the coordinates of the m-torsion points of E. For our eiptic curve, we have ϑ 2 = 2/3 and ϑ 3 = 3/4. It is thus natura to expect that ϑ 6 = ϑ 2 ϑ 3 = 1/2 i.e., that the congruences moduo 2 and 3 are independent of each other; however, one actuay has ϑ 6 = 5/12. The incusion-excusion principe then tes us that the probabiity that EF p is reativey prime to 6 is 1 ϑ 2 ϑ 3 + ϑ 6 = Mathematics Subject Cassification. Primary 11G05; Secondary 11N05. Key words and phrases. Eiptic curves moduo p, Gaois representations, Kobitz conjecture. 1

2 2 DAVID ZYWINA This ack of independence is expained by the observation that QE[2] and QE[3] are not ineary disjoint over Q. They both contain Qi: The point x, y = 3, 6i in EQi has order 3, so QE[3] contains Qi. If p spits in Qi i.e., p 1 mod 4, then 3, 6i wi give a point in EF p of order 3; hence EF p 0 mod 3. The points in E[2] {0} are of the form x, 0, where x is a root of x 3 + 9x The discriminant of this cubic is = , so QE[2] contains Q = Qi. If p > 3 is inert in Qi i.e., p 3 mod 4, then is not a square moduo p and one checks that EF p has exacty one point of order 2; hence EF p 0 mod 2. For p 5, we deduce that EF p is divisibe by 2 or 3. Therefore EF p is prime ony in the case where it equas 2 or 3 which happens ony for p = 5 where EF 5 = 3. It is now natura to ask if EF p /3 or EF p /2 is prime for infinitey many p? Our refinement/generaization of Kobitz s conjecture predicts that the answer is yes, and we wi suppy numerica evidence in The refined Kobitz conjecture. Before stating our conjecture, we set some notation that wi hod throughout the paper. For a number fied K, denote the ring of integers of K by O K, and et Σ K be the set of non-zero prime ideas of O K. For each prime p Σ K, we have a residue fied F p = O K /p whose cardinaity we denote by Np. Let Σ K x be the finite set of primes p Σ K with Np x. For an eiptic curve E over K, et S E be the set of p Σ K for which E has bad reduction. For p Σ K S E, et EF p be the corresponding group of F p -points more precisey, the F p -points of the Néron mode E/O K over E/K. For a fied extension L/K, we wi denote by E L the corresponding base extension of E. Conjecture 1.2. Let E be an eiptic curve defined over a number fied K, and et t be a positive integer. Then there is an expicit constant C E,t 0 such that x P E,t x := {p Σ K x S E : EF p /t is a prime} C E,t og x 2 as x. If C E,t > 0, then the above conjecture impies in particuar that there are infinitey many p for which EF p /t is an integer and is prime. If C E,t = 0, then we define the above asymptotic to mean that P E,t x is bounded as a function of x equivaenty, that EF p /t is a prime number for ony finitey many p Σ K S E. Our constant C E,t wi be described in 2. The expression C E,t x/og x 2 in Conjecture 1.2 has been used for its simpicity. The heuristics in 2.4 suggest that the expression 1.1 C E,t x t+1 1 du ogu + 1 og t og u wi be a better approximation of P E,t x, and this is what we wi use to test our conjecture. We wi not study the error term of our conjecture i.e., the difference between P E,t x and the expression 1.1, though we remark that our data suggests that it coud be Ox θ for any θ > 1/ Overview. In 2, we describe the constant C E,t occurring in Conjecture 1.2. We sha express the constant in terms of the Gaois representations arising from the torsion points of our eiptic curve. To have a computationay usefu version, we treat separatey the CM and non-cm cases. In 2.4 we give a brief heuristic for our conjecture. In 3, we describe the common factor t E of a the EF p. It is of course necessary to have t E divide t for Conjecture 1.2 to be interesting. In 4, we cacuate C E,1 assuming that E/Q is a Serre curve.

3 A REFINEMENT OF KOBLITZ S CONJECTURE 3 In 5 8, we consider four specific eiptic curves. We describe the Gaois action on their torsion points, compute constants C E,t for interesting t, and then suppy numerica evidence for Conjecture 1.2. In the fina section, we describe some of the partia progress that has been made on Kobitz s conjecture in the ast decade. Some of the recent study on the conjecture requires our corrected constant. Acknowedgments. Thanks to Nathan Jones for comments and providing the exampe in 1.1. Specia thanks to Chanta David and Bjorn Poonen. The experimenta evidence for our conjecture was computed using PARI/GP [PG08]. We aso used Magma [BCP97] to check some group theoretic caims and Mape to approximate integras. This research was supported by an NSERC postgraduate schoarship. 2. The constant Throughout this section, we wi fix an eiptic curve E defined over a number fied K and a positive integer t. The etter wi aways denote a rationa prime Description of the constant. To understand the divisibiity of the numbers EF p, it is usefu to recast everything in term of Gaois representations. For each positive integer m, et E[m] be the group of m-torsion in EK, where K is a fixed agebraic cosure of K. The natura Gaois action induces a representation ρ m : GaK/K AutE[m] whose image we wi denote by Gm. Let KE[m] be the fixed fied of kerρ m in K; so ρ m induces an isomorphism GaKE[m]/K Gm. If p Σ K S E does not divide m, then ρ m is unramified at p i.e., p is unramified in KE[m] and ρ m Frob p wi denote the corresponding Frobenius conjugacy cass in Gm. Note that the notation does not mention the curve E which wi aways be cear from context. The group E[m] is a free Z/mZ-modue of rank 2, and a choice of Z/mZ-basis for E[m] determines an isomorphism AutE[m] = GL 2 Z/mZ that is unique up to an inner automorphism of GL 2 Z/mZ. For a prime idea p Σ K S E with p m, we have a congruence For m 1, define the set EF p deti ρ m Frob p mod m. 2.1 Ψ t m = { A AutE[m] : deti A t Z/mZ }. m gcdm,t Thus for a prime p Σ K S E with p m, we find that EF p /t is invertibe moduo if and ony if ρ m Frob p Gm Ψ t m. In particuar, EF p /t is an integer if and ony if ρ t Frob p Gt Ψ t t. Define the number δ E,t m := Gm Ψ tm Gm By the Chebotarev density theorem, δ E,t m is the natura density of the set of p Σ K S E for which EF p /t is invertibe moduo m/ gcdm, t. The connection with Conjecture 1.2 is that if EF p /t is an integer and prime, then it is invertibe moduo a positive integers m < EF p /t. Definition 2.1. With notation as above, define C E,t := im m + m δ E,t m 1 1/

4 4 DAVID ZYWINA where the imit runs over a positive integers ordered by divisibiity. This is our predicted constant for Conjecture 1.2. If EF p /t is an integer, then to check that it is invertibe moduo m we need ony verify that it is invertibe moduo m. So to check if EF p /t is an integer that is reativey prime to m, we need ony consider the vaue of EF p moduo t m. For each m, we have δ E,ttm = δ E,t t m, so an equivaent definition of our constant is δ E,t t C E,t = im Q + Q Q 1 1/. This expression for C E,t is often preferabe since it requires knowedge ony of the groups Gtm for m squarefree. We sha see in 2.2 and 2.3 that the imit of Definition 2.1 does indeed converge, and hence C E,t is we-defined. It wi aso be apparent that C E,t = 0 if and ony if δ E,t m = 0 for some m, which gives the foowing quaitative version of our conjecture: Conjecture 2.2. Let E be an eiptic curve over a number fied K and et t be a positive integer. There are infinitey many p Σ K for which EF p /t is a prime integer if and ony if there are no congruence obstructions, i.e., for every m 1 there exists a prime p Σ K S E with p m such that EF p /t is invertibe moduo m The constant for non-cm eiptic curves. The foowing renowned theorem of Serre, gives the genera structure of the groups Gm. Theorem 2.3 Serre [Ser72]. Let E/K be an eiptic curve without compex mutipication. There is a positive integer M such that if m and n are positive integers with n reativey prime to Mm, then Gmn = Gm AutE[n]. Proposition 2.4. Let E/K be an eiptic curve without compex mutipication and et t be a positive integer. Let M be a positive integer such that G t = G t AutE[] tm t gcdm,m m, tm for a squarefree m in particuar, one can take M as in Theorem 2.3. Then C E,t = δ E,t t tm tm 1 1/ tm Proof. Let Q be a rea number greater than tm. From the assumption of the proposition, we have Gt = Gt AutE[]. Q tm Therefore and hence 2.2 δ E,t t Q = δ E,t t tm δ E,t t Q Q 1 1/ = δ E,t t tm tm 1 1/ tm, Q tm, Q tm, Q δ E,t, δ E,t 1 1/.

5 For any tm, we have and by Lemma 2.5 beow, A REFINEMENT OF KOBLITZ S CONJECTURE 5 δ E,t = 1 {A GL 2F : deti A = 0} GL 2 F = 1 {A GL 2 F : the eigenvaues of A are 1 and a} GL 2 F a F δ E,t 1 1/ = 1 1 1/ A easy cacuation then shows that δ E,t 1 1/ = Substituting this into 2.2, gives + 1 δ E,t t tm tm 1 1/ tm, Q Letting Q +, we deduce that the imit defining C E,t is convergent and that it has the stated vaue. Lemma 2.5. For a F, {A GL 2 F : A has eigenvaues 1 and a} = { 2 + if a 1, 2 if a = 1. Proof. This foows easiy from Tabe 12.4 in [Lan02, XVIII], which describes the conjugacy casses of GL 2 F. Remark 2.6. For ater reference, we record the foowing numerica approximation: 2.3 C := So to estimate C E,t, it suffices to find M and then compute δ E,t t tm The constant for CM eiptic curves. Let E be an eiptic curve over a number fied K with compex mutipication, and et R = EndE K. The ring R is an order in the imaginary quadratic fied F := R Z Q. For each positive integer m, we have a natura action of R/mR on E[m]. The group E[m] is a free R/mR-modue of rank 1, so we have a canonica isomorphism Aut R/mR E[m] = R/mR. If a the endomorphism of E are defined over K, then the actions of R and GaK/K on E[m] commute, and hence we may view ρ m GaK/K as a subgroup of R/mR. Proposition 2.7. Let E be an eiptic curve over a number fied K with compex mutipication. Assume that a the endomorphisms in R = EndE K are defined over K. There is a positive integer M such that if m and n are positive integers with n reativey prime to Mn, then Gmn = Gm R/nR. Proof. For an overview and further references, see [Ser72, 4.5] For a prime, define R = R Z Z and F = F Q Q. Let T E be the -adic Tate modue of E i.e, the inverse imit of the groups E[ i ] with mutipication by as transition maps. The Tate modue T E is a free R -modue of rank 1 see the remarks at the end of 4 of [ST68], we thus have a canonica isomorphism Aut R T E = R. The actions of GaK/K and R on T E commute with each other since we

6 6 DAVID ZYWINA have assumed that a the endomorphisms of E are defined over K. Combining our representations ρ i gives a Gaois representation ρ : GaK/K Aut R T E = R. The theory of compex mutipication impies that the representation ρ := ρ : GaK/K R has open image, and our proposition is an immediate consequence. We now describe the representation ρ in further detai this wi be usefu ater when we actuay want to compute a suitabe M. Since the endomorphism in R are defined over K, the action of R on the Lie agebra of E gives a homomorphism R K. This aows us to identify F with a subfied of K. By cass fied theory, we may view ρ as a continuous homomorphism I R F that is trivia on K, where I is the group of idees of K with its standard topoogy. For each prime, define K := K Z Q = p K p. For an eement a I, et a be the component of a in K. From [ST68, 4.5 Theorems 10 & 11], there is a unique homomorphism ε: I F such that ρ a = εan K /F a 1 for a and a I. The homomorphism ε is continuous and εx = x for a x K. Since ε is continuous, there is a set S Σ K such that ε is 1 on p Σ K S O K,p I; in fact, we may take S = S E. Let M be a positive integer such that N K /F : O K Z R is surjective for a M. E has good reduction at a p Σ K for which p M. Take any b = b R with b = 1 for a M. For each, there is an a O K Z K such that N K /F a 1 = b. Let a be the corresponding eement of I with archimedean component equa to 1. Then ρa = ρ a = εan K /F a 1 = N K /F a 1 = b. Since b was an arbitrary eement of R with b = 1 for M, we concude that ρgak/k {1} M R. Our M thus agrees with the one in the statement of the propostion. Proposition 2.8. Let E be an eiptic curve over a number fied K with compex mutipication. Assume that a the endomorphisms in R = EndE K are defined over K. Let χ be the Kronecker character corresponding to the imaginary quadratic extension F = R Q of Q. Let M be a positive integer as in Proposition 2.7 which is aso divisibe by a the primes dividing the discriminant of F or the conductor of the order R. For any positive integer t, we have C E,t = δ E,t t tm χ 1 1/ χ 1 2. tm Proof. Let Q be a rea number greater than tm. By Proposition 2.7, we have Gt = Gt R/R. Q tm Therefore δ E,t t tm Q = δ E,t t tm tm, Q tm, Q δ E,t,

7 and hence 2.4 A REFINEMENT OF KOBLITZ S CONJECTURE 7 δ E,t t Q Q 1 1/ = δ E,t t tm tm 1 1/ tm, Q δ E,t 1 1/. Now take any tm. Under the identification Aut R/R E[] = R/R, for a R/R we find that deti a agrees with N1 a where N is the norm map from R/R to Z/Z. So δ E,t equas {a R/R : N1 a Z/Z } R/R = {a R/R : 1 a R/R } R/R. From our assumptions on M, is unramified in F and R/R = O F /O F. One can then verify that O F /O F = 1 χ, and {a O F /O F : 1 a O F /O F } = 2 χ An easy cacuation then shows δ E,t 1 1/ = 1 χ 2 1. Substituting this into 2.4, gives χ 1 2 δ E,t t tm tm 1 1/ tm, Q χ χ 1 2. Letting Q +, we deduce that the imit defining C E,t is conditionay convergent and has the stated vaue the convergence can be seen by a comparison with the Euer product of the L-function Ls, χ at s = 1 which converges to a non-zero number Case where not a the endomorphisms are defined over base fied. Let us now consider the case where not a the endomorphisms of E over K. Choose an embedding F K. The endomorphisms of E are defined over KF, and KF is a quadratic extension of K. We break up the conjecture into two cases. Primes that spit in KF. Let p Σ K S E be a prime idea that spits in KF, i.e., there are two distinct primes P 1, P 2 Σ KF ying over p. The maps EF p EF Pi are group isomorphisms. So we have {p Σ K x S E : p spits in KF, EF p /t is prime} = 1 2 {P Σ KF x S EKF : EF P /t is prime} + O x = 1 2 P E KF,tx + O x Therefore Conjecture 1.2 impies that 2.5 {p Σ K x S E : p spits in KF, EF p /t is prime} C E KF, t 2 x og x 2 as x, and the constant C EKF, t can be computed as in Proposition 2.8 if C EKF, t = 0, then there is a congruence obstruction and the eft hand side of 2.5 is indeed bounded. Primes that are inert in KF. Let p Σ K S E be a prime that is inert in KF, i.e., po KF is a prime idea of O KF. For these primes we aways have EF p = Np + 1, so {p Σ K x S E : p is inert in KF, EF p /t is prime} = {p Σ K x : p is inert in KF, Np + 1/t is prime} + O1; Our conjecture combined with the spit case above impy that x 2.6 {p Σ K x : p is inert in KF, Np + 1/t is prime} C og x 2

8 8 DAVID ZYWINA as x where C = C E,t C EKF, t/2. We can aso give the more intrinsic definition C = im Q + δ tt Q Q 1 1/ where δ tm is the density of the set of p Σ K for which p is inert in KF and Np + 1/t is invertibe moduo m/ gcdt, m. The asymptotics of 2.6 depends ony on K and KF, and not the specific curve E. We wi not consider this case any further Heuristics. We wi now give a crude heuristic for Conjecture 1.2 one coud aso give a more systematic heuristic as in [LT76]. The prime number theorem states the number of rationa primes ess than x is asymptotic to x/ og x as x. Intuitivey, this means that a random natura number n is prime with probabiity 1/og n. This probabiistic mode, caed Cramér s mode, is usefu for making conjectures. Of course the event n is prime is deterministic, i.e., has probabiity 0 or 1. If the primaity of the integers in the sequence { EF p /t} p ΣK S E were assumed to behave ike random integers, then the ikeihood that EF p /t is prime woud be 1 og EF p /t 1 ognp + 1 og t the ast ine is reasonabe because of Hasse s bound, EF p Np Np. However, the EF p /t are certainy not random integers with respect to congruences in particuar, they might not a be integers!. To savage our mode, we need to take into account these congruences. Fix a positive integer m which we wi assume is divisibe by t t. For a but finitey many p, if EF p /t is prime then it is invertibe moduo m. The density of p Σ K S E for which EF p /t is an integer and invertibe moduo m is δ E,t m, whie the density of the set of natura numbers that are invertibe moduo m is m 1 1/. By taking into account the congruences moduo m, we expect δ E,t m 1 1 1/ ognp + 1 og t m to be a better approximation for the probabiity that EF p /t is prime for a random p Σ K S E. Taking into account a possibe congruences, our heuristics suggest that EF p /t is prime for a random p Σ K S E with probabiity where C E,t C E,t = 1 ognp + 1 og t im Q + δ E,t t Q Q 1 1/. We have aready seen that this imit converges. Using our heuristic mode, the expected number of p Σ K x S E such that EF p /t is prime, shoud then be we approximated by p Σ K x S E Np t C E,t ognp + 1 og t C E,t x t+1 1 du ogu + 1 og t og u. The restriction of p in the above sum to those with Np t is incuded simpy to ensure that each term of the sum is we-defined and positive. The integra expression foows from the prime

9 A REFINEMENT OF KOBLITZ S CONJECTURE 9 number theorem for the fied K, and is asymptotic to x/og x 2. We can now conjecture that as x. P E,t x C E,t x t+1 1 du ogu + 1 og t og u Remark 2.9. In the setting of Conjecture 1.1 with t = 1, Kobitz assumed that the divisibiity conditions were independent and hence his constant was δ E,1 1 1/. 3. Common factor of the EF p Let E be an eiptic curve over a number fied K. There may be an integer greater than one which divides amost a of the EF p, which is an obvious obstruction to the primaity of the vaues EF p. Thus it wi be necessary to divide by this common factor before addressing any questions of primaity. In this section we describe the common factor and expain how it arises from the goba arithmetic of E. The foowing we-known resut says that the K-rationa torsion of E injects into EF p for amost a p for a proof see [Kat81, Appendix]. Define the finite set S E := S E {p Σ K : e p p 1 where p ies over the prime p} where e p is the ramification index of p over p. Lemma 3.1. For a p Σ K S E, reduction moduo p induces an injective group homomorphism EK tors EF p. In particuar, EK tors divides EF p for a p Σ K S E. The integer EF p is a K-isogeny invariant of the eiptic curve E. So for a p Σ K S E, we find that EF p is divisibe by 3.1 t E := cm E E K tors, where E varies over a eiptic curves that are isogenous to E over K. One can aso show that 3.2 t E = max E E K tors. From our discussion above, t E divides EF p for amost a p Σ K in particuar, Conjecture 1.2 is ony interesting when t E divides t. The foowing theorem of Katz shows that t E is the argest integer with this property. Theorem 3.2 Katz [Kat81, Theorem 2bis]. Let Σ be a subset of Σ K S E with density 1. Then t E = gcd EF p. p Σ There is an eiptic curve E which is K-isogenous to E satisfying t E = E K tors. Thus our conjecture with t = t E predicts how frequenty the groups E F p /E K tors have prime cardinaity as p varies, this was mentioned by Kobitz in the fina remarks of [Kob88] as a natura way to generaize his paper. Kobitz s origina conjecture was restricted to those eiptic curves over Q with t E = 1. Remark 3.3. Using the characterization of t E from Theorem 3.2, we can aso express t E in terms of our Gaois representations. It is the argest integer t such that deti ρ t g 0 mod t for a g Gt.

10 10 DAVID ZYWINA 4. Serre Curves 4.1. The constant C E,1 for Serre curves. Throughout this section, we assume that E is a eiptic curve over Q without compex mutipication. For each m 1, we have defined a Gaois representation ρ m : GaQ/Q AutE[m]. Combining them a together, we obtain a singe representation ρ: GaQ/Q AutE tors = GL 2 Ẑ. A theorem of Serre [Ser72] says that that the index of Gm in AutE[m] is bounded by a constant that depends ony on E; equivaenty, ρgaq/q has finite index in GL 2 Ẑ. Serre has aso shown that the map ρ is never surjective [Ser72, Proposition 22]. He proves this by showing that ρgaq/q ies in a specific index 2 subgroup H E of AutE tors see 4.2 for detais. Foowing Lang and Trotter, we make the foowing definition. Definition 4.1. An eiptic curve E over Q is a Serre curve if ρgaq/q is an index 2 subgroup of AutE tors. Serre curves are thus eiptic curves over Q whose Gaois action on their torsion points are as arge as possibe. For exampes of Serre curves, see 5 and [Ser72, 5.5]. Jones has shown that most eiptic curves over Q are Serre curves [Jon10]. Thus Serre curves are prevaent and we have a compete understanding of the groups Gm see beow, so they are worthy of specia consideration. We are particuary interested in Conjecture 1.2 with t = 1. Proposition 4.2. Let E/Q be a Serre curve. Let D be the discriminant of the number fied Q where is the discriminant of any Weierstrass mode of E over Q. Then C C E,1 = if D 1 mod 4, + 3 D C if D 0 mod 4 where C = The proof of Proposition 4.2 wi be given in 4.3. Remark 4.3. i In the paper [Jon09], Jones studies the constant C E,1 as E/Q varies over certain famiies of eiptic curves. The main term of his resuts comes from the contribution of the Serre curves. ii There are eiptic curves defined over number fieds K Q for which ρgak/k = AutE tors. The first exampe was give by A. Greicius [Gre07] aso see [Zyw10] The group H E. We sha now describe the desired group H E see [Ser72, p. 311] for further detais. Let D be the discriminant of the number fied L := Q where is the discriminant of any Weierstrass mode of E over Q note that L is independent of the choice of mode. Define the character χ D : GaQ/Q GaL/Q {±1}, where the first map is restriction. The fied L is contained in QE[2]. Let ε: AutE[2] {±1} be the character which corresponds to the signature map under any isomorphism AutE[2] = S 3. One checks that χ D σ = ερ 2 σ for a σ GaQ/Q. Since L is an abeian extension of Q, it must ie in a cycotomic extension 1 of Q. Set d := D ; it is the smaest positive integer for which L Qζ d where ζ d Q is a primitive d-th root of 1 This is where the assumption K = Q is important

11 A REFINEMENT OF KOBLITZ S CONJECTURE 11 unity. The homomorphism det ρ d : GaQ/Q Z/dZ factors through the usua isomorphism GaQζ d /Q Z/dZ. Thus there exists a unique character α: Z/dZ {±1} such that χ D σ = αdet ρ d σ for a σ GaQ/Q. The minimaity of d impies that α is a primitive Dirichet character of conductor d. Combining our two descriptions of χ D, we have ερ 2 σ = αdet ρ d σ for a σ GaQ/Q. Define the integer M E := cmd, 2, and the group HM E := { g AutE[M E ] : εa mod 2 = αdeta mod d }. which has index 2 in AutE[M E ]. By the above discussion, HM E contains GM E. The index 2 subgroup H E of AutE tors mentioned earier is just the inverse image of HM E under the natura map AutE tors AutE[M E ], and E is a Serre curve if and ony if ρgaq/q = H E. Proposition 4.4. Let E/Q be a Serre curve, and et m be a positive integer. If M E m, then the group Gm is the inverse image of HM E under the natura map AutE[m] AutE[M E ]. If M E m, then Gm = AutE[m]. Proof. Define the group H = { A GL 2 Ẑ : εa mod 2 = αdeta mod d}; it is an index 2 subgroup of GL 2 Ẑ. For each integer m, et Hm be the image of H under the reduction moduo m map GL 2 Ẑ GL 2Z/mZ. If E/Q is a Serre curve, then ρ E GaQ/Q = H E = H and Gm = Hm for a m. It thus suffices to prove the anaogous resuts for the groups Hm. First suppose that m is divisibe by M E. The group H is the inverse image of HM E under the reduction moduo M E map r ME : GL 2 Ẑ GL 2Z/M E Z. The map r ME equas the composition GL 2 Ẑ GL 2Z/mZ GL 2 Z/M E Z arising from reduction moduo m and M E, so Hm equas the inverse image of HM E under reduction moduo M E. We may now suppose that m is not divisibe by M E, equivaenty not divisibe by 2 or not divisibe by d. Take any B GL 2 Z/mZ. We wi show that there is an A H such that A B mod m, and hence B beongs to Hm. Since B was arbitrary, we wi deduce that Hm = GL 2 Z/mZ. First suppose that 2 does not divide m. Define n = cmm, M E which we can write in the form 2 e n with n odd. Take any x Z/nZ for which detb x mod m. Let A odd be a matrix in GL 2 2 Z such that A odd moduo m equas B and such that deta odd x mod n. The homomorphism GL 2 Z 2 {±1} Z 2, C εc mod 2, detc is surjective, so there is a matrix A 2 GL 2 Z 2 such that deta 2 x mod 2 e and εa 2 mod 2 = αx mod d. Let A be the matrix A 2, A odd GL 2 Z 2 GL 2 2 Z = GL 2 Ẑ. The matrix A beongs to H since εa mod 2 = αx mod d = αdeta mod d, and it satisfies A B mod m. Now suppose that d does not divide m and that m is even. Then there is an eement x Z/ cmm, dz such that detb x mod m and αx mod d = εb mod 2; this uses that d m and that α is a primitive Dirichet character of conductor d. There exists an A GL 2 Ẑ such that B A mod m and deta x mod cmm, d. The matrix A beongs to H since and it satisfies A B mod m. εa mod 2 = εb mod 2 = αx mod d = αdeta mod d, 4.3. Proof of Proposition 4.2. Let E/Q be a Serre curve, and keep the notation introduced in 4.2.

12 12 DAVID ZYWINA Let us first consider the case where D 0 mod 4. The integer M E = d = D is divisibe by 4, so by Proposition 4.4, we have Gm = AutE[m] for a squarefree m. By Proposition 2.4, with t = 1 and M = 1, we have C E,1 = We sha now restrict to the case where D 1 mod 4. In this case, the integer M E = cm2, d = 2d = 2 D is squarefree. By Proposition 4.4, we have GM E m = HM E AutE[m] for a squarefree m reativey prime to M E. Thus by Proposition 2.4, with t = 1 and M = M E, we have 4.1 C E,1 = HM E Ψ 1 M E / HM E M E 1 1/ M E Since d is odd and α is a quadratic character of conductor d, we find that α is the Jacobi symbo d. The set HME Ψ 1 M E then has the same cardinaity as the set X = { A GL 2 Z/M E Z : εa mod 2 = deta mod d d, deti A Z/M E Z }. Take any eement A X. Setting A 2 := A mod 2, we have deti A 2 = 1 and deta 2 = 1 in Z/2Z. The ony matrices in GL 2 Z/2Z that satisfy these conditions are: and These two matrices have order 3 in GL 2 Z/2Z, and hence εa 2 = 1. Since d is odd, HM E Ψ 1 M E has twice as many eement as the set Y = {A GL 2 Z/dZ : For each prime d, define the sets Y ± deta d = 1, deti A Z/dZ }. := { A GL 2 Z/Z : deta } = ±1, deti A 0. Under the isomorphism GL 2 Z/dZ = d GL 2Z/Z, the set Y corresponds to the disjoint union of sets: Y Y +. Therefore, J {: d} J even J d, J 4.2 HM E Ψ 1 M E = 2 Y = 2 f d = d Y µf 2 f + Y + d Y Y + d f Y + Y, where µ is the Möbius function. Lemma 4.5. For d and ε {±1}, Y + + ε Y GL 2 Z/Z 1 1/ = { if ε = +1, if ε = 1.

13 Proof. We use Lemma 2.5 to compute the Y ± : Y ± A REFINEMENT OF KOBLITZ S CONJECTURE 13 = {A GL 2Z/Z : det A = ±1} {A GL 2 Z/Z : det A = 1 2 GL 2Z/Z = ±1, deti A = 0} a F, a =±1 {A GL 2 F : A has eigenvaues 1 and a} = ± 1 2 The rest is a direct cacuation. Using 4.2, HM E = 1 2 M E GL 2 Z/Z = 3 d GL 2Z/Z, and Lemma 4.5, we have: HM E Ψ 1 M E / HM E M E 1 1/ = = 2 3 = d d = M E =2d d Y + + Y GL 2 Z/Z 1 1/ + d d Y + Y GL 2 Z/Z 1 1/ d d Proposition 4.2 foows by combining this expression with 4.1 and noting that d = D.. 5. Exampe: y 2 = x 3 + 6x 2 In this section, we consider the eiptic curve E over Q defined by the Weierstrass equation y 2 = x 3 + 6x 2. This curve is a Serre curve for a proof, see [LT76, Part I 7]. The given Weierstrass mode has discriminant = , and hence Q has discriminant 3. By Proposition 4.2 and 2.3, 5.1 C E,1 = In the foowing tabe, the expected number of p x with p 6 such that EF p is prime is rounded to the nearest integer. x 1 du C E,1 ogu + 1 og u 2

14 14 DAVID ZYWINA Tabe 1. Number of p x with p 6 such that EF p is prime. x Actua Expected x Actua Expected Remark 5.1. The predicted constant in [Kob88] was 9/10 C E,1. This woud have ed to a predicted vaue of in the ast entry of Tabe Exampe: y 2 = x 3 + 9x + 18 Let E be the eiptic curve over Q defined by the Weierstrass equation y 2 = x 3 + 9x The discriminant of our Weierstrass mode is = This is the curve mentioned in 1.1. It is not isogenous over Q to a curve with nontrivia Q-torsion in the notation of 3, t E = 1, but we have C E,1 = 0. We saw that EF p was divisibe by 3 if p 1 mod 4 and divisibe by 2 if p 3 mod 4. In this section we wi give numerica evidence for Conjecture 1.2 with t {2, 3, 6}. We now state, without proof, enough information about the groups Gm so that one may compute the constants C E,2, C E,3 and C E,6. 2-torsion. We have G2 = AutE[2]. 4-torsion. Viewing AutE[2] as the symmetric group on E[2] {0}, et ε: AutE[4] AutE[2] {±1} be the signature homorphism. Let χ be the non-identity character of Z/4Z. Then Q = Qi impies that G4 is contained in the group {A AutE[4] : εa = χdeta},

15 and this is actuay an equaity. We then have A REFINEMENT OF KOBLITZ S CONJECTURE 15 ρ 4 GaQ/Qi = {A AutE[4] : εa = χdeta = 1}. The maxima abeian extension of Qi in QE[4] is Qi, α, 6 where α is a root of x 3 + 9x Group theory with G4 tes us that it is a degree six extension of Qi. In genera, one aways has Qi, 4 QE[4]; for our curve Qi, 4 = Qi, 4 9 = Qi, 6. 3-torsion. Choose a Z/3Z-basis of E[3] whose first vector is P := 3, 6i. Then with respect to this basis, G3 = ρ 3 GaQ/Q is the subgroup of upper trianguar matrices in GL 2 Z/3Z. 9-torsion. The group G9 is the inverse image of G3 under the map AutE[9] AutE[3]. The maxima abeian extension of Qi in QE[9] is Qi, ζ 9. Let β : G9 {±1} be the homomorphism for which σp = βρ 9 σp for a σ GaQ/Q. 36-torsion. We may view G36 as a subgroup of G4 G9, where we have aready described G4 and G9. To work out G36, one needs to know the fied QE[4] QE[9]. We caim that QE[4] QE[9] = Qi. Suppose that QE[4] QE[9] Qi; then the sovabiity of G4 impies that there is a nontrivia abeian extension L/Qi in QE[4] QE[9]. However the maxima abeian extension of Qi in QE[4] and QE[9] is Qi, α, 6 and Qi, ζ 9, respectivey. Thus L Qi, α, 6 Qi, ζ 9 = Qi. We deduce that G36 = { A, B AutE[4] AutE[9] : εa = χdeta = βb } and ρ 36 GaQ/Q = { A, B AutE[4] AutE[9] : εa = χdeta = βb = 1 }. 5-torsion. The group G5 is the unique subgroup of AutE[5] of order 96. The image in PGL 2 Z/5Z is isomorphic to the symmetric group S 4 this is one of the exceptiona cases in [Ser72, Prop. 16]. The maxima abeian extension of Q in QE[5] is Qζ 5. -torsion, 7. For every prime 7, we have G = AutE[]. Group theory shows that for any squarefree positive integer m reativey prime to 2 3 5, we have Gm = m AutE[]. The maxima abeian extension of Q in QE[m] is Qζ m. For any squarefree positive integer m reativey prime to 2 3 5, we caim that 6.1 G36 5 m = G36 G5 m AutE[]. Since G36 and G5 are sovabe, it suffices to show that the maxima abeian extensions of Q in QE[36], QE[5], and QE[m] are pairwise ineary disjoint over Q this is cear since the intersection of any two of these fieds is an unramified extension of Q. Take any t {2, 3, 6}. From the above description, we may appy Proposition 2.4 with M = 30 to obtain δ E,t 36 5 C E,t = / Since G36 5 = G36 G5, we have δ E,t 36 δ E,t 5 C E,t = 1 1/21 1/3 1 1/ We have δ E,t 5 = δ E,1 5 since t is reativey prime to 5, and using our description of G5 one can show that δ E,t 5 = δ E,1 5 = 77/96. Hence C E,t = δ E,t

16 16 DAVID ZYWINA Using our description of G36, one can show that δ E,2 36 = 1/8, δ E,3 36 = 5/27, and δ E,6 36 = 1/12. We record the resuting constants in the next emma. Lemma 6.1. For the eiptic curve E over Q defined by y 2 = x 3 + 9x + 18, we have where C = C E,2 = C C E,3 = C C E,6 = C In the foowing tabe, the expected number of p x with p 6 such that EF p /t is prime is C E,t x t+1 1 du ogu + 1 og u rounded to the nearest integer, where C E,t is estimated using Lemma 6.1 and 2.3. Tabe 2. Number of p x with p 6 such that EF p /t is prime. t = 2 t = 3 t = 6 x Actua Expected Actua Expected Actua Expected CM exampe: y 2 = x 3 x Let E be the eiptic curve over Q defined by the Weierstrass equation y 2 = x 3 x. This curve has compex mutipication by R = Z[i], where i corresponds to the endomorphism x, y x, iy defined over Qi. The curve E has conductor 2 5.

17 A REFINEMENT OF KOBLITZ S CONJECTURE 17 The torsion group EQi tors has order 8 and is generated by i, 1 i and 1, 0. So for those primes p that spit in Qi i.e., p 1 mod 4, we find that EF p is divisibe by 8. In this section, we give numerica evidence for Conjecture 1.2 with t = 8. We wi study it in the form given in 2.5, which predicts that 7.1 {p x : p 1 mod 4, EF p /8 is prime} C E Qi, 8 2 x 9 1 ogu + 1 og 8 du og u as x we have used the integra version of the conjecture since it shoud give a better approximation. This particuar curve was studied by Iwaniec and Jiménez Urroz in [IJU06] where they proved that {p x : p 1 mod 4, EF p /8 is a product of one or two primes} x og x 2 using sieve theoretic methods. We now describe the constant C EQi,8: Lemma 7.1. Let E be the eiptic curve over Q given by y 2 = x 3 x. Then C EQi,8 = χ χ where χ = 1 1/2. We have C EQi, Proof. Since E has conductor 2 5, the curve E Qi has good reduction away from the prime 1 + i. For the curve E Qi, fix notation as in the proof of Proposition 2.7 in particuar, K = F = Qi and R = Z[i]. Checking the two conditions in the second haf of the proof of Proposition 2.7, we find that the Proposition hods for E Qi with M = 2. The discriminant of Qi is 4 and the conductor of the order R is 1, so by Proposition 2.8 we have C EQi,8 = δ E Qi, χ 1 1/2 χ where χ is the Kronecker character of Qi and hence χ = 1 1/2. To prove the required product description of C EQi,8, it remains to show that δ EQi,816 = 1/2. Consider the representation ρ 2 : GaQi/Qi R Z 2 = Z 2 [i] arising from the Gaois action on the Tate modue T 2 E. It is we known that ρ 2 has image equa to 1 + p 3 2 where p 2 is the prime idea 1 + iz 2 [i] for exampe, see [KS99, 9.4]. In particuar, G16 = ρ 16 GaQi/Qi = 1 + p 3 2 / Z2 [i] = 1 + p 3 2 / 1 + p 8 2. Under our identification of Aut Z2 [i]t 2 E with Z 2 [i], we find that deti a agrees with N1 a where N is the norm map from Z 2 [i] to Z 2. We deduce that δ EQi,816 is the proportion of a 1 + p 3 2 / 1 + p 8 2 for which N1 a 8 mod 16; this is indeed equa to 1/2. With respect to how one estimates the constant, we simpy note that C E,8 = L1, χ χ χ χ 1. 2 The product is now absoutey convergent and L1, χ = π/4 by the cass number formua.

18 18 DAVID ZYWINA In the foowing tabe, the Actua coumn is the vaue of the eft hand side of 7.1, whie the Expected coumn is the right hand side of 7.1 with the approximation from Lemma 7.1. Tabe 3. Number of p x with p 1 mod 4 such that EF p /8 is prime. x Actua Expected x Actua Expected Exampe: X 0 11 In this section we consider the eiptic curve E = X 0 11 defined over Q. The moduar interpretation of X 0 11 is not important for our purposes; it suffices to know that y 2 +y = x 3 x 2 10x 20 is a minima Weierstrass mode for E/Q. The curve E has conductor 11 and hence has good reduction away from 11. By Theorem 3.2, t E divides EF p for each prime p 2 11, and since EF 3 = 5, we deduce that t E divides 5. The rationa point x, y = 5, 5 of E has order 5, and thus 5 divides t E. We deduce that t E = 5 and in particuar that EQ tors is generated by 5, 5. In this section we sha test Conjecture 1.2 with t = t E = 5. Lang and Trotter have worked out the Gaois theory for this eiptic curve, and in particuar have shown that Theorem 2.3 hods with M = see [LT76, Part I, 8] for fu detais. By

19 Proposition 2.4, we have 8.1 A REFINEMENT OF KOBLITZ S CONJECTURE 19 C E,5 = δ E, / = δ E, We sha now describe the structure of the group G and then compute δ E, Those not interested in this computation can skip ahead to the data. For a 5, we have G = AutE[]. There is a basis of E[5 2 ] over Z/25Z for which G5 2 becomes the group { } 1 + 5a 5b : a, b, c Z/25Z, u Z/25Z 5c u. To ease computation, identify G5 2 with this matrix group. Fixing a basis, we can aso identify G2 and G11 with the fu groups GL 2 Z/2Z and GL 2 Z/11Z respectivey. Let ε: G2 {±1} be the signature map i.e, compose any isomorphism G2 = S 3 with the usua signature, and define the homomorphisms φ 11 : G11 F 11 /{±1}, A ± deta and α: G5 2 Z/5Z, 1+5a 5b 5c u a mod 5. The group F 11 /{±1} is cycic of order 5 with generator ±2, so it makes sense to define a homomorphism φ 5 : G5 2 F 11 /{±1} by φ 5 A = ±2 αa. We have a natura incusion G G2 G5 2 G11, which gives us the foowing description of G : φ 5 A 5 = φ 11 A 11, G = A 2, A 5, A 11 G2 G5 2 G11 : deta11 11 = εa2. Lemma 8.1. G = Proof. We first use the fact that ε surjects onto {±1}, and G2 = 6. G = {A 2, A 5, A 11 G2 G5 2 G11 : φa 5 = φa 11, deta = εa2 } =3 {A 5, A 11 G5 2 G11 : φa 5 = φa 11, deta = 1} + 3 {A 5, A 11 G5 2 G11 : φa 5 = φa 11, deta = 1} =3 {A 5, A 11 G5 2 G11 : φa 5 = φa 11 } We now use that φ 5 and φ 11 surject onto a common group of order 5. G = 3 {A 5, A 11 G5 2 G11 : φa 5 = φa 11 } Lemma 8.2. δ E, = 9/50. = 3 G5 2 G11 /5 = =

20 20 DAVID ZYWINA Proof. To ease notation, define Bm := Gm Ψ t m. First note that an eement A GL 2 Z/2Z = G2 is in B2 if and ony if deti A = deta = 1. One quicky verifies that B2 = { , }. These two eements have order three, so εa = 1 for a A B2. B = {A 2, A 5, A 11 B2 B5 2 B11 : φa 5 = φa 11, deta = εa2 } =2 {A 5, A 11 B5 2 B11 : φa 5 = φa 11, deta 11 F 11 2 } =2 {A B5 2 : φ 5 A = x} {A B11 : φ 11 A = x, deta F 11 2 } x F 11 /{±1} Take any A = 1+5a 5b 5c u G5. We have deti A = 5au 1 te Z/25Z = 5Z/25Z if and ony if a 0 mod 5 and u 1 mod 5. Given a Z/5Z, we find that { {A B = 375 if a 0 mod 5 : αa = a} = 0 if a 0 mod 5, and hence for b F 11, {A B5 2 : φ 5 A = ±b} = { 375 if b ±1 0 if b = ±1. Our expression for B thus simpifies to the foowing, B = 750 {A B11 : φ 11 A = x, deta F 11 2 }. x F 11 /{±1} {{±1}} Take any x F 11 /{±1}. Since 1 is not a square in F 11, the cass x contains a unique eement b x F {A B11 : φ 11 A = x, deta F 11 2 } = {A B11 : deta = b x }. So our expression for B simpifies further to B = 750 {A GL 2 F 11 : deta = b, deti A 0}. Using Lemma 2.5, we obtain B = 750 b F 11 2 {1} b F 11 2 {1} Therefore using the previous emma, we have GL 2 F 11 / = / = δ E, = B / G = / = 9/50. We finay describe the constant C X0 11,5 from Conjecture 1.2. Lemma 8.2 and 8.1 impy that 8.2 C X0 11,5 = In the foowing tabe, the expected number of p x with p 11 such that X 0 11F p /5 is prime is 8.3 C X0 11,5 x 6 1 du ogu + 1 og 5 og u

21 A REFINEMENT OF KOBLITZ S CONJECTURE 21 rounded to the nearest integer, where C X0 11,5 is estimated using 8.2 and 2.3. Tabe 4. Number of p x with p 11 such that X 0 11F p /5 is prime. x Actua Expected x Actua Expected Remark 8.3. The term og 5 in 8.3 is numericay important. For exampe, we find that C X0 11, ogu + 1 og u 1 du , which is a worse approximation of P X0 11,510 9 than that given in Tabe Recent progress We briefy describe some of the progress that has been made on Kobitz s conjecture. This very short survey is not meant to be exhaustive and sometimes we ony state specia cases of resuts; one shoud consut the cited papers for more detais and deveopments. In this section, we imit ourseves to eiptic curves defined over Q. First of a, there are currenty no exampes where Conjecture 1.2 is known to hod besides those trivia cases where C E,t = 0 and thus have a congruence obstruction. Moreover, there are no known exampes of eiptic curves E and integers t for which im x P E,t x =. Much of the recent progress has been made by appying methods from sieve theory incuding methods that were used to study twin primes or Sophie Germain primes. Reca that the conjecture that there are infinitey many Sophie Germain primes is equivaent to there being infinitey many

22 22 DAVID ZYWINA primes p for which p 1/2 is prime this is an anaogue of Conjecture 1.2 with K = Q, t = 2 and E repaced by the group scheme G m Non-CM curves. Let E be an eiptic curve over Q without compex mutipication. Miri and Murty [MM01] showed, assuming GRH, that there are x/og x 2 primes p x for which EF p has at most 16 prime divisors. Steuding and Weng [SW05a, SW05b] improved this to 9 factors. Assuming GRH and t E = 1, David and Wu [DW08] have shown that x {p x : EF p has at most 8 prime factors} C E,1 og x 2 for x E 1, where C E,1 is the constant of Conjecture 1.2. We now mention some upper bounds obtained under GRH though weakening of this conjecture can aso be used. Cojocaru [Coj05] proved that P E,1 x x/og x 2 ; which of course shoud be the best possibe genera bound, up to improvement of the impicit constant. David and Wu [DW08] have shown that for any ε > 0, one has x P E, εc E,1 og x 2 for a x E,ε 1. In the genera setting of Conjecture 1.2, one has the bound x P E,t x 22 + o1c E,t og x 2 where the o1 term depends on E and t; this is Theorem 1.3 of [Zyw08] this theorem uses t = t E, but the proof carries through for genera t. For unconditiona upper bounds, Cojocaru [Coj05] proved that P E,1 x x/og x og og og x. This can be strengthened to P E,1 x 24+o1C E,1 x/og x og og x, see [Zyw08, Theorem 1.3]. However, this is sti not strong enough to prove that 1 p < p, EF p is prime which woud be the anaogue of Brun s theorem that p and p+2 are prime 1/p < CM eiptic curves. Now consider a CM eiptic curve E over Q. If t E = 1, then Cojocaru [Coj05, Theorem 4] has shown that {p x : EF p has at most 5 prime factors} x og x 2 note that this theorem does not depend on GRH. If E has CM by the maxima order O F of an imaginary quadratic extension F/Q, then Jiménez Urroz [JU08] has proved that {p x : p spits in F, EF p /t EF has at most 2 prime factors} x og x 2 this extends a resut of Iwaniec and Jiménez Urroz mentioned at the beginning of The conjecture on average. We now consider the functions P E,1 x averaged over a famiy of eiptic curves. Fix α > 1/2 and β > 1/2 with α+β > 3/2. Let Fx be the set of a, b Z 2 with a x α and b x β for which 4a b 2 0. For a, b Fx, et Ea, b be the eiptic curve over Q defined by the affine equation Y 2 = X 3 + ax + b. Baog, Cojocaru, and David [BCD07] have proved that 1 x 9.1 P Fx Ea,b,1 x C og x 2 a,b Fx