arxiv: v1 [math.nt] 3 Jan 2016

Transcription

1 TORSION SUBGROUPS OF CM ELLIPTIC CURVES OVER ODD DEGREE NUMBER FIELDS ABBEY BOURDON AND PAUL POLLACK arxiv: v [math.nt] 3 Jan 06 Abstract. Let G CM(d) denote the collection of groups (up to isomorphism) that appear as the torsion subgroup of a CM elliptic curve over a degree d number field. We completely determine G CM(d) for odd integers d and deduce a number of statistical theorems about the behavior of torsion subgroups of CM elliptic curves. Here are three examples: () For each odd d, the set of natural numbers d with G CM(d ) = G CM(d) possesses a well-defined, positive asymptotic density. () Let T CM(d) = max G GCM (d)#g; under the Generalized Riemann Hypothesis, ( e γ ) /3. π ) /3 limsup d d odd ( T CM(d) 4e γ (dloglogd) /3 π (3) For each ǫ > 0, we have #G CM(d) ǫ d ǫ for all odd d; on the other hand, for each A > 0, we have #G CM(d) > (logd) A for infinitely many odd d.. Introduction For a given positive integer d, let G(d) denote the set of (isomorphism classes) of abelian groups that appear as E(F)[tors] for some elliptic curve E defined over some degree d number field F, and let T(d) denote the supremum of the orders of all such groups. Celebrated work of Merel [3] shows that T(d) < for every d. However, the nature of the finite sets G(d) remains largely mysterious. The only d for which G(d) has been completely determined are d = (Mazur [], 977) and d = (work of Kamienny, Kenku, and Momose, completed in 99 [7, 6]). And while there are completely explicit upper bounds on T(d), the known bounds grow superexponentially, whereas it is widely believed that T(d) is bounded polynomially in d. More can be said if we restrict the class of elliptic curves under consideration. In particular, elliptic curves with complex multiplication (CM) are of interest since they are known to provide examples of rational points of large order appearing in unusually low degree [8]. Let G CM (d) and T CM (d) be defined as above, but with the added restriction that E has CM. Whereas G(d) is known only for d = and d =, the set G CM (d) has been computed for all d 3 [9]. And in contrast to the situation for T(d) where the known upper bounds are (presumably) far from sharp, the upper order of T CM (d) has recently been determined. In [0], it is shown that lim sup d T CM (d) dloglogd <. From earlier work of Breuer [6], this limsup is positive. Hence, T CM (d) has upper order dloglogd. Several other statistics concerning T CM (d) are investigated in [4]; e.g., it is shown there that the average of T CM (d) for d x is x/(logx) +o(), as x. In [5], the authors study torsion of CM elliptic curves over real number fields, meaning number fields admitting at least one real embedding. Observe that all number fields of odd degree are real. One of the central results of [5] is a complete classification of which groups arise as torsion subgroups of CM elliptic curves defined over number fields of odd degree, i.e., a classification of the elements of d odd G CM (d). This strengthens earlier work of Aoki []. Date: May 8, 08.

2 Theorem. (Odd Degree Theorem, [5], cf. [, Corollary 9.4]). Let F be a number field of odd degree, let E /F be a K-CM elliptic curve, and let T = E(F)[tors]. Then: a) One of the following occurs: () T is isomorphic to the trivial group { }, Z/Z, Z/4Z, or Z/Z Z/Z; () T = Z/l n Z for a prime l 3 (mod 8) and n Z + and K = Q( l); (3) T = Z/l n Z for a prime l 3 (mod 4) and n Z + and K = Q( l). b) If E(F)[tors] = Z/Z Z/Z, then EndE has discriminant = 4. c) If E(F)[tors] = Z/4Z, then EndE has discriminant { 4, 6}. d) Each of the groups listed in part a) arises up to isomorphism as the torsion subgroup E(F) of a CM elliptic curve E defined over an odd degree number field F. However, given a particular subgroup that does arise, the argument of [5] does not identify the degrees d in which it occurs. The main theorem of this paper is precisely such a result. Here, h Q( l) denotes the class number of Q( l). Theorem. (Strong Odd Degree Theorem). Let l 3 (mod 4) and n Z +. Define δ as follows: ö ù 3n, l > 3, δ = 0, l = 3 and n =, ù, l = 3 and n. ö 3n Then: () For any odd positive integer d, the groups { }, Z/Z, Z/4Z, and Z/Z Z/Z appear as the torsion subgroup of a CM elliptic curve defined over a number field of degree d. () Z/l n Z appears as the torsion subgroup of a CM elliptic curve defined over a number field of odd degree d if and only if l 3 (mod 8) and d is a multiple of h Q( l) l l δ. (3) Z/l n Z appears as the torsion subgroup of a CM elliptic curve defined over a number field of odd degree d if and only if one of the following holds: a. l 3 (mod 8), where n if l = 3, and d is a multiple of 3 h Q( l) l l δ, or b. l = 3 and n = and d is any odd positive integer, or c. l 7 (mod 8) and d is a multiple of h Q( l) l l δ. This theorem can be used to algorithmically determine G CM (d) for any odd degree d. See section 7 for a table of the groups which arise for odd d 99. The CM elliptic curves with a point of order l n in lowest possible odd degree are unexpectedly varied. In the case of even degrees, points of order l often appear for the first time on a CM elliptic curve with a rational j-invariant. For example, any prime l (mod 3) appears for the first time in even degree l 3 on an elliptic curve E with j(e) = 0 by [8, Theorem ]. However, we see already from the Odd Degree Theorem that a CM elliptic curve with a rational point of order l in odd degree will not have a rational j-invariant once l > 63. Moreover, through the proof of the Strong Odd Degree Theorem, we find that the algebraic structure of these optimal examples is surprisingly complex. Specifically, we find that if n 3, an elliptic curve with a point of order l n in lowest possible odd degree necessarily has CM by a non-maximal order, and the size of the conductor increases with n. See Remark.7 for a precise statement along these lines. Non-maximal orders provide considerable technical complications, due in part to the fact that ideals do not necessarily factor uniquely into prime ideals, and so many results in the literature are formulated only to address the case of CM by the full ring of integers. However, we know now that non-maximal orders play a crucial role in the extremal behavior of rational torsion points of elliptic curves. Theorem. opens the door to establishing new statistical properties of G CM (d) and T CM (d), as d ranges over odd integers. The mean of T CM (d) for odd d x is studied already in [4], where it is

3 shown to be x /3+o(), as x. This should be compared with the unrestricted average, which we recalled above was x/(logx) +o(). In the next theorem, we study the upper order of T CM (d) for odd d. Again, we find that it is much smaller than the corresponding unrestricted statistic. Theorem.3 (Upper order of T CM (d) for odd d). () There is an infinite sequence of odd d, with d, where ÅÅ e γ ã /3 T CM (d) dloglogdã π +o(). () Assume the Riemann Hypothesis for Dirichlet L-functions. Then as d through all odd integers, ÅÅ 4e γ ã /3 T CM (d) dloglogdã π +o(). Unconditionally, T CM (d) ǫ d /3+ǫ for each fixed ǫ > 0 and all odd d. We turn next to understanding the stratification of torsion by degree. In974, Olsonshowedthat G CM () = {{ },Z/Z,Z/3Z,Z/4Z,Z/6Z,Z/Z Z/Z} [6]. Computationscarriedoutin[9]revealed thatthissamelistreoccursas G CM (d) forseveralothersmallvalues of d. This was one of the phenomena investigated in [5], where it was shown that G CM (d) = G CM () if d = p or p for some prime p 7. Call d an Olson degree if G CM (d) = G CM (). The following complete classification of Olson degrees was proved in [4]. To state the result, we need one more piece of notation. Given a set G of positive integers, we write M(G) for the set of multiples of G, meaning the collection of all positive integers divisible by some element of G. Proposition.4 ([4]). The complement of the set of Olson degrees can be written as M(G), where ß l G = {} h Q( l) : l prime, l 3 (mod 4), l > 3. As a corollary of Proposition.4, it was proved in [5] that the set of Olson degrees possesses a positive density. It is easy, for reasons recalled at the start of 4., to rigorously bound this density from above by 4/5 = However, no explicit lower bound is proved in [4]. We take the opportunity here to address this lacuna, estimating the density of Olson degrees to within 0.%. Theorem.5. The density of Olson degrees lies in the open interval (0.64, 0.65). Thus, a little more than half of the odd numbers d are Olson degrees. It is natural to wonder if our results on Olson degrees are the tip of a larger iceberg. Generalizing the above, we say that d and d are CM-torsion-equivalent if G CM (d) = G CM (d ). In this case, we call d a d -Olson degree. The following questions were suggested by Pete L. Clark: Questions.6. Is it true that for every d, the set of d-olson degrees possesses an asymptotic density? If so, is the sum of the densities of d-olson degrees, taken over inequivalent d, equal to? To avoid a possible source of confusion, we remind the reader that asymptotic density is finitely additive but not countably additive. Thus, an affirmative answer to the first question does not immediately imply an affirmative answer to the second. Note that if d and d are CM-torsion equivalent, then d and d share the same parity. Indeed, if d is even, then Z/3Z Z/3Z is realizable in degree d (see [5, Theorems.4,.]), whereas the Odd Degree Theorem guarantees that such a group is never realizable in any odd degree d, so that G CM (d) G CM (d ). Consequently, each equivalence class consists entirely of even integers or entirely of odd integers. Using Theorem., we are able to answer affirmatively the odd degree variants of Questions.6. 3

4 Theorem.7 (Stratification of torsion in odd degrees). For each odd positive integer d, the set of d-olson degrees possesses a positive asymptotic density. Moreover, using d( ) for asymptotic density, d({d-olson degrees}) =, d where the sum on the left is taken over any complete set of inequivalent odd integers. Remark.8. One can use the method of proof of Theorem.5 to study the density of d-olson degrees for other odd d. For instance, we have calculated in this way that the 3-Olson degrees have density between 6.% and 6.4%. We conclude with a result about the number of groups realizable in a given odd degree, i.e., the number #G CM (d) for odd d. There is no mystery about how small #G CM (d) can be; the Strong Odd Degree Theorem implies that G CM () is always a subset of G CM (d), so that #G CM (d) 6, with equality if and only d is an Olson degree. But how large can #G CM (d) be? This is the subject of our final theorem, proved in 6. Theorem.9. For each fixed ǫ > 0, we have #G CM (d) ǫ d ǫ for all positive odd integers d. On the other hand, for each fixed A > 0, there are infinitely many odd d with #G CM (d) > (logd) A. Theorem.9 provides another point of contrast between the even and odd degree cases. Indeed, at the end of 6 we will adapt methods of Erdős [3] and Pomerance [8, 9] to show that for some constant η > 0 and all large x, we have max d x #G CM (d) > x η.. Complete determination of torsion in odd degrees: Proof of Theorem... Background. Let l > be prime, and let F be a number field of odd degree. If E /F is a CM elliptic curve with an F-rational point of order l n, then the Odd Degree Theorem gives that l 3 (mod 4). Moreover, we also have the following additional results of [5]. Here, ζ l n denotes a primitive l n th root of unity, and h( ) denotes the class number of the order of discriminant. Theorem. ([5]). Let F be a number field of odd degree, and let E /F be a CM elliptic curve with a point of order l n in E(F) for some prime l 3 (mod 4). Then: () E has CM by an order of discriminant = ( ǫ l a ) l for ǫ {0,} and a Z 0. () Q(ζ l n) FK. (3) ϕ(ln ) h( ) [F : Q]. (4) If E has CM by an order of discriminant = l a+, there is a basis of E[l n ] such that if σ Gal( F/FK), then the image of σ under the mod-l n Galois representation associated to E is of the following form: ñ Ä β t äô ρ l n(σ) = 4t, 4t t, βt 0 (mod l n ). 0 Proof. Since h( ) = [Q(j(E)) : Q] and Q(j(E)) is a subfield of F, it follows that h( ) is odd. Then part () is a consequence of the Odd Degree Theorem and [5, Lemma 3.5]. Parts () and (3) may be deduced from [5, Theorem 4.]. Part (4) follows from the proof of [5, Theorem 4.(a)]. As indicated in the introduction, elliptic curves with CM by a non-maximal order play a significant role in determining G CM (d) for odd d. One approach to analyzing rational torsion points on an elliptic curve with CM by a non-maximal order is to consider the rational torsion points on an elliptic curve with smaller conductor induced by the following natural isogeny. We thank Pete L. Clark for the idea of the next proof. 4

5 Proposition.. Let E /F be an elliptic curve with CM by the order O in K of conductor f. If f f, there exists an F-rational isogeny ι f : E E, where E /F is an elliptic curve with CM by the order in K of conductor f. Moreover, ι f is cyclic of degree d = f f. Proof. Let O be the order of K of conductor f, and let I = do. Then I is an ideal of O, and we may form the I-torsion kernel, E[I] = {x E( F) : α I, αx = 0}. Since I is fixed by complex conjugation, E[I] is defined over F. (See the discussion in Section 3.3 of [5].) Thus we have an F-rational isogeny E E/E[I]. It remains to show E/E[I] has CM by O and that E[I] is cyclic of order d. Choose an embedding F C so that E = C E O, where E O is the O-CM elliptic curve corresponding to C/O under uniformization. Since O O, we have a natural map C/O C/O, and hence a map from E O E O. Then as in Proposition.4 of [34], ker(e O E O ) = ker(c/o C/O ) = O /O = {z C : zo O }/O We will show {z C : zo O } = {z C : zdo O}. Indeed, if zo O, then in particular z = a + f k for some a Z and k O K. Then (a + f k)do O, as desired. Conversely, if zdo O, then z = (a/d) + f k, for some a Z and k O K. Note that if d divides a, then zo O, as desired. But d must divide a, for otherwise zdo would not be contained in O. Thus: ker(c/o C/O ) = { z C : zdo O } /O = {z C : αz O α I}/O = {z C/O : αz = 0 α I} = C/O[I] = E O [I]. Composing with the isomorphism E = C E O gives an isogeny E E O with kernel E[I]. It follows that E/E[I] = C E O, and so E/E[I] has CM by O. Moreover, E[I] = O /O, which is cyclic of order d. Remark.3. If f =, we recover the classical statement which appears, for example, as Proposition 5 in [8]. Finally, we will make use of the connection between CM elliptic curves and class field theory, as stated in the following result. For a positive integer N and an imaginary quadratic field K, we let K (NO K) denote the N-ray class field of K. Proposition.4. Let F be a number field, and let E /F be an elliptic curve with CM by an order in K. If (Z/NZ) E(F) for some N Z +, then K (NO K) FK. Proof. For CM by the maximal order, see [34, Theorem II.5.6]. For the general case, see [0, Theorem 5]. Lemma.5. Let l 3 (mod 4) be prime and K = Q( l). If n Z +, then for any a n, Q(ζ l a) K ln O K = Q(ζ l n). 5

6 Proof. Let O be the order in K of discriminant = l n+, and let K O denote the ring class field of K of conductor l n. Then by Corollary 8.7 of Cox [], K O K ln O K. The field Q(ζ l a) K O is generalized dihedral over Q by Theorem 9.8 of Cox [], and since it is also abelian over Q we have Gal(Q(ζ l a) K O /K) = (Z/Z) ν. However, [K O : K] = h( ) is odd by [5, Lemma 3.5]. Hence Q(ζ l a) K O = K. Since Q(ζ l n) K ln O K, we have Q(ζ l n) Q(ζ l a) K ln O K. Let δ = [Q(ζ l a) K ln O K : Q(ζ l n)]. Then the compositum of K O and Q(ζ l a) K ln O K has degree w K h K l n (l )δ over K, where w K denotes the number of roots of unity in K. Since [K ln O K : K] = w K h K l n (l ) (see [, Corollary 3..5]), we find δ = and Q(ζ l a) K ln O K = Q(ζ l n)... Identifying torsion in lowest degree. We will use part (4) of Theorem. to deduce a relationship between the discriminant and the rational torsion of the elliptic curve. Since t, we find a connection between ord l ( ) and the full torsion over FK forced by the existence of an F-rational point of order l n. For example, suppose F is a number field of odd degree and E /F is an elliptic curve with CM by an order of discriminant = l, where l 3 (mod 4) is prime. If E(F) contains a point of order l n, then E has full l n torsion over FK by Theorem.(4). This kind of argument is key to ruling out points of order l n appearing in low degree on elliptic curves with small conductor. Instead, we find that elliptic curves E defined over F = Q(j(E)) which possess a cyclic F-rational isogeny of degree l n give examples of rational points of order l n appearing in lowest possible odd degree. Such isogenies have been classified by Kwon [9]. Theorem.6. Let F be a number field of odd degree, let l 3 (mod 4) be prime, and let n Z +. If E /F is a CM elliptic curve with a point of order l n in E(F), then where h Q( l) l l δ [F : Q], ö ù 3n, l > 3, δ = 0, l = 3 and n =, ù, l = 3 and n. ö 3n Moreover, for any such l and n, there exists a CM elliptic curve defined over a number field of degree h Q( l) l l δ with a rational point of order l n. Proof. Let F be a number field of odd degree, and suppose E /F is a CM elliptic curve with a point P of order l n in E(F), where l 3 (mod 4) is prime. For now suppose l 3. It follows from Theorem. that E has CM by an order in K = Q( l) of discriminant = ( ǫ l a ) l for ǫ {0,} and a Z 0, and ϕ(l n Å ) l () h( ) = h K la+n (The formula for h( ) appears in [, Theorem 7.4].) If a n Å ãã l ǫ [F : Q]., then this quantity is divisible l by h K lδ, as desired. So we may assume a < n. Let ϕ: E E be the F-rational isogeny of degree ǫ l a whose existence is guaranteed by Proposition., where E is an elliptic curve with CM by O K. Then ϕ(p) has order l α, where 6

7 α n a. Indeed, n a < contradicts a < n. By Theorem., there is a basis of E [l α ] such that if σ Gal( F/FK), then ρ l α(σ) is of the following form: ñ Ä β l t ä ô 4t, 4t t +l, βt 0 (mod l α ). 0 In particular, t l, so βt 0 (mod l α ) implies β 0 (mod l α ). Thus E has full l α -torsion over FK. Since FK contains Q(ζ l n) by Theorem. and K lα O K by Proposition.4, it follows from Lemma.5 that h K (l )l n+α [FK : Q]. Hence (l ) () h K l n+α [F : Q]. K (lα O K ) h K l α (l )lα K (lα O K ) (ζ l n) Q(ζ l α ) K Q h K l α Q(ζ l n) l n α+ Since a < n, we have n+α n a δ. It follows that (l ) hk l δ [F : Q]. If l = 3, then by Theorem. E has CM by an order O in K = Q( 3) of discriminant = ( ǫ 3 a ) 3 for ǫ {0,} and a Z 0. In addition, Theorem. implies (3) ϕ(3 n ) h( ) = 3a+n+ǫ [O K : [F : Q]. O ] If a n, then this quantity is divisible by 3 hk 3δ = 3 δ, as desired. So we may assume a < n. Arguing as above, we find that FK contains both K 3α O K and Q(ζ 3 n) for some α n a. By Lemma.5, these fields are linearly disjoint over Q(ζ 3 α ); hence, (4) 3 n+α 3 [F : Q]. Since a < n, we have n+α 3 n a 3 δ. It follows that 3 δ [F : Q]. It remains to show these divisibility conditions are best possible. Set a = n. Then l n = (l a ) l. Let E be an O( )-CM elliptic curve defined over F = Q(j(E)). By work of Kwon [9, Corollary 4.], E admits an F-rational isogeny which is cyclic of degree l n. It follows from [5, Theorem 5.6] that there is a twist E of E /F and an extension L/F of degree ϕ(l n )/ such that E (L) has a point of order l n. We have [L : Q] = ϕ(ln ) l h( ) = h K lδ, as desired. Remark.7. If F is a number field of odd degree and E /F is a CM elliptic curve with an F- rational point of order l n, it follows from the proof of Theorem.6 that E has CM by an order of discriminant = ( ǫ l a ) l where a = n, n, or n +. The latter two cases are only 7

8 possible if n is even or if n = (and l = 3), respectively. In particular, it we see that E necessarily has CM by a non-maximal order if n 3. Corollary.8. Let l 3 (mod 4) be prime, and let n Z +. Let F be a number field of odd degree. If E /F is a CM elliptic curve with a point of order l n in E(F), then E has CM by K = Q( l) and FK contains K l n OK (ζ l n). Proof. By Theorem., E has CM by the order O in K = Q( l) of discriminant = ( ǫ l a ) l for ǫ {0,} and a Z 0. We consider two cases. If a n, then O is contained in the order O of conductor l n. Thus the ring class field of K with conductor l n, KO, is contained in K O = K(j(E)) FK. (See exercise 9.9 of Cox [].) Since Q(ζ l n) FK by Theorem. and Q(ζ l n) K O = K by the proof of Lemma.5, K O (ζ l n) is a subfield of FK of degree h Q( l) (l ) l δ. By Corollary 8.7 of Cox [], K O K l n OK, so K O (ζ l n) K l n OK (ζ l n). Since they have the same degree, equality holds. If a < n, then FK contains K l α O K and Q(ζ l n), where α n a n +. Thus FK contains K l n OK (ζ l n). Corollary.9. Let l 3 (mod 4) be prime, and let n Z +. Suppose E /F is a CM elliptic curve with a point of order l n in E(F). If [F : Q] = h Q( l) l l δ, for δ defined as above, then E has CM by an order in K = Q( l) and FK = K l n OK (ζ l n). In particular, l is the only prime which ramifies in F. Proof. This follows from Corollary Proof of the Strong Odd Degree Theorem. LetT beagroupwhichappearsasthetorsion subgroup of a CM elliptic curve defined over a number field of odd degree. We will identify an odd positive integer d T such that d T [F : Q] whenever E /F is a CM elliptic curve with E(F)[tors] = T and F is of odd degree. Once we exhibit a number field F of degree d T and a CM elliptic curve E /F with E(F)[tors] = T, the Strong Odd Degree Theorem will follow by a result of [5]: Theorem.0. Let A /F be an abelian variety over a number field, and let d. There are infinitely many L/F such that [L : F] = d and A(L)[tors] = A(F)[tors]. Proof. See Theorem. of [5]. We isolate the more involved case in the following lemma. Here, δ is as defined in the statement of the Strong Odd Degree Theorem. Lemma.. Let F be a number field of odd degree. If E /F is acm elliptic curvewith E(F)[tors] = Z/l n Z for l 3 (mod 8), where n if l = 3, then 3 h Q( l) l l δ [F : Q]. Proof. We will first consider the case where l 3 (mod 8), l 3. Suppose E /F is an elliptic curve with CM by an order O of discriminant in K, and suppose E(F)[tors] = Z/l n Z. By Theorem., = ( ǫ l a ) l for ǫ {0,} and a Z 0. If ǫ = 0, then K O K F( d) = FK by [5, Lemma 3.5] and Proposition.4. By Corollary.8, K l n OK (ζ l n) FK. Since ramifies in K O K and K l n OK (ζ l n) is unramified away from l, these fields are linearly disjoint over K O K. Thus 3 h K (l )l δ [FK : Q], and 3 h K l lδ [F : Q]. If ǫ =, then the ring class field of K of conductoriscontainedink O = K(j(E)) = FK (seeexercise9.9ofcox[]). Sincethisringclass field and K l n OK (ζ l n) are linearly disjoint over K O K, it follows that 3 h Q( l) l l δ [F : Q]. 8

9 Supposel = 3, and supposee /F has CM by an order O of discriminant in K and E(F)[tors] = Z/ 3 n Z. As in the lemma statement, we assume n. We first consider the case where, i.e., = ( 3 a ) 3 for a Z 0. If a n, then 3 δ+ [F : Q] by equation (3). If a < n, then we must consider several sub-cases: a : Since 6 divides the conductor of O, the ring class field of conductor 6, K O, is contained in K O = K(j(E)) FK (see exercise 9.9 of Cox []). The prime ramifies in K O, so K 3 n OK (ζ 3 n) and K O are linearly disjoint over K. Since [K O : K] = 3, we have 3 δ+ [F : Q]. a = 0, n 3: The proof of Theorem.6 shows that a rational point of order 3 n forces K 3α O K (ζ 3 n) FK, where α n. Thus K 3n O K (ζ 3 n) FK, which means 3 n 3 [F : Q]. Since n 3, we have 3 δ+ [F : Q]. a = 0, n = : Let P be the point of order 8 in E(F)[tors], where E is an elliptic curve with CM by an order of discriminant = 3. Note j(e) = Work of [8] implies E has an equation of the form y +( c)xy by = x 3 bx forsomeb,c F andp = (0,0). We let j(b,c) denotethej-invariant of E. Asin [9], wemay obtain a polynomial f 8 Q[b,c] that vanishes when (0,0) has order 8. A computation shows that if { f8 (b,c) = 0 j(b,c) = , then 9 [Q(b,c) : Q] (see the research website of the first author for the Magma scripts used). Hence 9 [F : Q], as desired. Next, suppose, i.e., = (3 a ) 3 for a Z 0. If a, then by Proposition., there exists an F-rational isogeny ι 3 : E E, where E has CM by the order in K = Q( 3) of conductor 3. Since the kernel of this isogeny has size 3 a, a point of order in E(F) induces a point of order in E (F). But E is a quadratic twist of the elliptic curve E 0 : y = x 3 480x+4048, and points of order are invariant under quadratic twists. Thus E 0 (F) contains a point of order, and F contains a root α of x 3 480x Since ramifies in K(α), the fields K(α) and K 3 n OK (ζ 3 n) are linearly disjoint over K; hence 3 δ+ [F : Q]. If a = 0 and n 3, K 3n O K (ζ 3 n) FK and 3 δ+ [F : Q] as above. Finally, if a = 0 and n =, then j(e) = 0. As in the case where, a computation shows that 9 [F : Q]. Again, see the research website of the first author for the Magma scripts used. Theorem. (Strong Odd Degree Theorem). Let l 3 (mod 4) and n Z +. Define δ as follows: ö ù 3n, l > 3, δ = 0, l = 3 and n =, ù, l = 3 and n. ö 3n Then: () For any odd positive integer d, the groups { }, Z/Z, Z/4Z, and Z/Z Z/Z appear as the torsion subgroup of a CM elliptic curve defined over a number field of degree d. () Z/l n Z appears as the torsion subgroup of a CM elliptic curve defined over a number field of odd degree d if and only if l 3 (mod 8) and d is a multiple of h Q( l) l l δ. (3) Z/l n Z appears as the torsion subgroup of a CM elliptic curve defined over a number field of odd degree d if and only if one of the following holds: 9

10 a. l 3 (mod 8), where n if l = 3, and d is a multiple of 3 h Q( l) l l δ, or b. l = 3 and n = and d is any odd positive integer, or c. l 7 (mod 8) and d is a multiple of h Q( l) l l δ. Proof. The groups { }, Z/Z, Z/4Z, and Z/Z Z/Z appear as torsion subgroups of CM elliptic curves defined over Q by work of Olson [6], so part () is an immediate consequence of Theorem.0. For part (), suppose E /F is a CM elliptic curve with E(F)[tors] = Z/l n Z. Then l 3 (mod 8) by the Odd Degree Theorem, and [F : Q] is a multiple of h Q( l) l lδ by Theorem.6. Conversely, if for each l 3 (mod 8) there exists a number field F of degree h Q( l) l l δ and a CM elliptic curve E /F with E(F)[tors] = Z/l n Z, part () will follow from Theorem.0. First suppose l 3 (mod 8), l 3. By Theorem.6 there exists a CM elliptic curve E defined over a number field F of degree h Q( l) l lδ with l n E(F)[tors]. By the Odd Degree Theorem, E has CM by K = Q( l) and E(F)[tors] = Z/l n Z or Z/l n Z. But if E(F)[tors] = Z/l n Z, then 3 h K l l δ [F : Q] by Lemma., which is a contradiction. Thus E(F)[tors] = Z/l n Z, as desired. If l = 3, we know that Z/3Z occurs in degree by work of Olson [6], and Z/9Z occurs in degree 3 by work of Clark, Corn, Rice, and Stankewicz [9]. If n 3, we know there is an elliptic curve E defined over a number field of F degree 3 δ with 3 n E(F)[tors] by Theorem.6. If E(F)[tors] = Z/ 3 n Z, then 3 δ+ [F : Q] by Lemma.. Thus the Odd Degree Theorem guarantees E(F)[tors] = Z/3 n Z, as desired. This completes the proof of part. Let F be a number field of odd degree, and suppose E /F is a CM elliptic curve with E(F)[tors] = Z/l n Z for some prime l 3 (mod 4). If l 3 (mod 8), where n if l = 3, then 3 h Q( l) l l δ [F : Q] by Lemma.. If l 7 (mod 8), then h Q( l) l l δ [F : Q] by Theorem.6. Thus part 3 will follow from Theorem.0 if we can demonstrate that there is a CM elliptic curve E defined over a number field F of smallest possible odd degree with E(F)[tors] = Z/l n Z. Suppose l 3 (mod 8), where n if l = 3. By the proof of part, there is a number field F of degree h K l lδ and a CM elliptic curve E /F with E(F)[tors] = Z/l n Z. Since points of order correspond to the roots of a cubic polynomial, E gains a rational -torsion point over a cubic extension of F, say F(α). By the Odd Degree Theorem and Lemma., E(F(α))[tors] = Z/l n Z. Since [F : Q] = 3 h Q( l) l l δ, we may conclude part 3(a). Ifl = 3andn=, thenz/lzdoesoccurindegreebyolson[6]. Thus3(b)holds. For3(c), let l 7 (mod 8). By Theorem.6 there exists a CM elliptic curve E defined over a number field F of degree h l) l Q( lδ with l n E(F)[tors]. TheOddDegree Theoremshows E(F)[tors] = Z/l n Z, as desired. 3. The upper order of T CM (d) for odd degrees d: Proof of Theorem.3 Here we exploit the fact that while h Q( l) is typically of size l /, it can be smaller by a factor of size /loglogl, but (assuming GRH) no more. The precise statements we need correspond via Dirichlet s class number formula to the following two estimates. Proposition 3. (Joshi). There is a sequence of primes l 3 (mod 4), l, with L(, ( l) π ) 6e γ loglogl. Proof. This is part of [5, Theorem ]. 0

11 Proposition 3. (Littlewood). Assume the Riemann Hypothesis for Dirichlet L-functions. Then as D, with D ranging through fundamental discriminants, L(, ( Ç å D) π ) e γ +o() loglog D. For D satisfying ( D ) =, this lower bound can be strengthened to L(, ( Ç å D) π ) 4e γ +o() loglog D. Proof. The first assertion is explicitly contained in [, Theorem ]. The second can be proved by the same method. For the sake of completeness, we sketch an argument for the second claim taking as a starting point the the modern approach to Littlewood s work presented in [0, 5.]. From [0, eq. (5.)], we see that with X = 4 (log D ), logl(, ( D) ) n X Λ(n) ( D) Å n nlogn X logx ã +o(), as D. (We have dropped lower order terms from [0], since we are only interested in asymptotics, not in an explicit bound.) For each prime p, the contribution to the right-hand sum from n that are powers of p is at least Å ã Λ(p k )( ) k p k logp k ; X logx p k X moreover, since ( D ) =, the factor ( ) k appearing here can be replaced with when p =. Now summing over p, Å Λ(p k )( ) k ã+ Å ã Λ( k ) +o(). logl(, ( D) ) p k X As on p. 408 of [0], k X k odd p k X Moreover, Å Λ( k ) p k logp k XlogX Å Λ(p k )( ) k p k logp k X logx k log k XlogX ã = k X k odd = k k +o() = ln j j k j k X k odd k log k X logx ã loglogx γ +log π 6 +o(). k k +o() Ç å Å +ln ã +o() = ln(3)+o(). 4 Collecting the estimates and exponentiating (and noting that logx loglog D ), we obtain the claim. We can now prove the unconditional lower-bound half of Theorem.3. Proof of Theorem.3(i). We fix a sequence of primes l as in Proposition 3.. To each such l, we associate the odd positive integer d = h Q( l) l. Clearly, d as l. By Dirichlet s class number formula, Å ã l d = π L(,( l) l π ) e γ +o() l 3/ /loglogl,

12 as l. It is straightforward to deduce that l 3/ ( eγ π + o())dloglogd. From the Strong Odd Degree Theorem, either Z/lZ or Z/lZ is realizable in degree d, and so T CM (d) l. Theorem.3(i) follows. The proof of the upper bound is more intricate. Proof of Theorem.3(ii). We will assume to start with that the Riemann Hypothesis for L-functions holds, and we will prove that under this assumption, ÅÅ 4e γ ã ã /3 (5) T CM (d) π +o() dloglogd as d through odd values. We say a few words at the end about how to modify the proof to obtain the unconditional upper bound T CM (d) ǫ d /3+ǫ. From the Odd Degree Theorem, the largest torsion subgroup realizable in degree d has the form Z/l n Z or Z/l n Z for a prime l 3 (mod 4) and a positive integer n. Here the prime l and the positive integer n are uniquely determined by d. Case : n is even. From Theorem. along with the bounds l l 3 and h Q( l), d l l δ h Q( l) 3 lδ+ 9 l3n/. To see the last estimate, notice that l δ+ = l 3n/ unless l = 3, in which case it is 3 l3n/. Hence, l n (9d) /3 and T CM (d) l n (9d) /3. This certainly implies (5) for these d. Case : l < loglogd. Here Theorem. implies that d 3 lδ+3 hq( l) l / 9 l3n/ hq( l) l / 9(loglogd) /l3n/. Thus, T CM (d) l n d /3 (loglogd) /3 in these cases, so (5) again holds. Case 3: n odd and l loglogd. Taking D = l in Proposition 3. and invoking the class number formula, we deduce from Proposition 3. that as d, d h Q( l) l l l δ = π L(,( l) l (6) ) lδ Å ã π l δ+3/ Å ã π l 3n/ (7) 4e γ +o() loglogl = 4e γ +o() loglogl. This certainly implies that d l for large d, and hence loglogd loglogl. Feeding this back into the above estimate gives Å ã π l 3n/ ÅÅ 4e γ ã /3 d 4e γ +o() loglogd, whence ln dloglogdã π +o(). As a consequence, if the largest torsion subgroup in degree d has the form Z/l n Z, rather than Z/l n Z, then weagain obtain (5). Itremainsto treat thesubcasewhenthelargest torsion subgroup has the form Z/l n Z. Recall that d and l loglogd, so certainly we can assume l > 3. If l 3 (mod 8), Theorem. shows that the first inequality in (6) can be strengthened by a factor of 3. If l 7 (mod 8), then ( l) =, and Proposition 3. shows that the inequality in (7) can be strengthened by a factor of 3. Following the argument through shows that in either case, ÅÅ 8e l n γ ã /3 dloglogdã π +o(),

13 and hence Since 8 3/ < 4, (5) holds in this case as well. ÅÅ 8e γ ã /3 T CM (d) dloglogdã π +o(). The proof of the unconditional bound is similar but simpler. The key difference is that in the treatment of odd n, we are forced to use Siegel s lower bound L(, ( D) ) ǫ D ǫ instead of the much stronger results of Proposition The density of Olson degrees: Proof of Theorem Upper bound. To bound the density of Olson degrees from above, we must bound from below the density of M(G) for the set G appearing in Proposition.4. There is an obvious plan of attack: Bound M(G) from below by M(H) for a large finite subset H G. For example, since g 5 = 3 and g = 5, we have {,3,5} G, and so d(m(g)) d(m({,3,5})) = 5. 4 This implies the upper bound of 5 mentioned in the introduction for the density of Olson degrees. In this section, we implement the same strategy with a much larger set H. It requires some finesse to make this method computationally feasible. For any finite set H of positive integers, inclusion-exclusion immediately yields a formula for M(H), namely d(m(h)) = #H j=( ) j A H #A=j lcm(a). Unfortunately, the above formula involves #H terms and so a direct implementation of this idea quickly becomes prohibitively time-consuming. To work around this we make two observations, encoded in the following lemmas. Lemma 4.. For a finite collection H of positive integers, let Then H rel = {h H : h is relatively prime to all other elements of H}. d(m(h)) = ( d(m(h\h rel ))) h H rel Å ã. h If H is a finite set of natural numbers and p is a prime, we define the p-scaled set H (p) by and we define the p-sieved set H (p) by H (p) = {h/gcd(h,p) : h H}, H (p) = {h H : p h}. Lemma 4.. Let H be a finite collection of positive integers. For any prime number p, d(m(h)) = Å p d(m(h (p)))+ ã d(m(h (p) )). p Lemmas 4. and 4. make pleasant elementary exercises, and we omit the proofs. The more difficult of the two, Lemma 4., appears in more general form in work of Behrend [3, Lemma, p. 68]. 3

14 Proof of the upper bound in Theorem.5. We begin by computing a large list of elements of G which eventually will be truncated to form our H. Specifically, we start with the singleton set {}. We then successively go through the primes 3 < l from the congruence class 3 mod 4, throwing g l into our set whenever g l is not divisible by a preexisting element. (If g l is divisible by such an element, then there is no need to throw it in, as this would not lead to a larger set of multiples.) At the end of this process, we sort the resulting list; this leaves us with a set the first several elements of which are,3,5,93,63,703,05,89,347,340,369,4067,537,65,667,705,783,749,9737, 089, 9, 43, 389, 463, 673, 847, 76, 8403, 953, 993, 0033,, 747, 335, 749, 837, 3073, 397, 3354, 387, 3864, 393, 39689, 40687, 460, 4503,... We let H consist of the first 38 elements of this list, so that We will show that H = {,3,5,93,...,397}. d(m(h)) < This implies the same upper bound 0.65 for the density of Olson degrees. Apply Lemma 4. to H. In this case, one computes that H rel = {,3,5,9,749}. Thus, puting H = H\H rel, Ç d(m(h)) = ( d(m(h ))) åç åç åç åç å To estimate d(m(h )), we apply Lemma 4. with p = : d(m(h )) = Å d(m(h () ))+ ã d(m(h () )). ThesetH () hasonly3elements, andsod(m(h () )) canbecomputedwithoutfussbyinclusionexclusion. We find that d(m(h () )) = Let H = H (). Then H has 33 elements; 33 is large enough that a direct inclusion-exclusion computation is best avoided. So we make another application of Lemma 4., this time to H. We compute that H rel = {64,653,03,33,60}. So with H = H \H rel, d(m(h )) = ( d(m(h )) Ç 64 åç 653 åç 03 åç 33 åç å. 60 The set H has 8 elements. However, it contains both 83 and 4067 = So we may remove 4067 from H without changing the corresponding set of multiples. Similarly, H contains both 39 and 65 = 9 39, and so 65 can also be removed. This brings #H down to 6, which is small enough that the inclusion-exclusion computation is manageable. We find that Working back through the chain of equalities, and finally d(m(h )) = d(m(h )) = , d(m(h )) = , d(m(h)) = This completes the proof of the upper bound half of Theorem.5. 4

15 4.. Lower bound. For the rest of this section, l always denotes a prime with l > 3 and l 3 mod 4. To establish the lower bound in Theorem.5, we require a lower bound on the numbers g l thatholds mostofthetime. ViaDirichlet s class numberformula, thiscomesdowntobounding below L(, ( l) ). We will deduce what we need from the following variant of the Siegel Tatuzawa theorem, due to Chen [7]. Proposition 4.3. Let 0 < ǫ <. For all real primitive characters χ of conductor q > log(0 6 ) exp(/ǫ), with at most one exception, (8) L(,χ) > min 7.73logq,.5 06 ǫ q ǫ Let ǫ 0 = log(0 6 ), and apply Proposition 4.3 with ǫ = ǫ 0. The minimum in (8) corresponds to the first term when q.8 0 5, and to the second term past this point. Moreover, for q > 0 5, one checks that the right-hand side of (8) is bounded below by 0 5 q ǫ 0. We use these observations in the proof of the next result. Corollary 4.4. For all negative fundamental discriminants D with D > 0 6, except for a single possible exception, we have» h Q( D) > 0.04 D /log D when D 0 5, and, with ǫ 0 = 0.999/log(0 6 ), h Q( D) > D ǫ 0 when D > 0 5. Proof. Recall that when D is negative and D > 4, we have h Q( D) = 7.73π = and 05 π > 3 04, the result follows.. D π L(,( D) ). Since Proof of the lower bound in Theorem.5. We have already noted that G {,3,5} and that d(m({,3,5})) = 5 = The lower bound claimed in Theorem.5 is equivalent to the assertion that M(G) has density < So it is enough to show that, with d( ) denoting upper density, (9) d(m(g)\ M({,3,5})) < Suppose that m M(G) and m / M({,3,5}). Then m has the form g l r, where gcd(g l,30) = gcd(r,30) =. Fixing l with gcd(g l,30) =, the number of corresponding m x is 4 x 5 g l +O(). (The O() error term comes from the application of inclusion-exclusion to enforce the condition gcd(r,30) =.) Hence, the total number of such m x is at most 4 5 x l: g l x gcd(g l,30)= Dividing by x and letting x shows that We write d(m(g)\m({,3,5})) 4 5 l: gcd(g l,30)= g l +O(x/logx). l: gcd(g l,30)= g l = + + 3, 5 g l.

16 where,, and 3 indicate a restriction to the ranges l 0 9, 0 9 < l.8 0 9, and l >.8 0 9, respectively. We treat these three sums in turn. The first sum can be calculated directly in PARI, using the routine quadclassunit to compute the class numbers of the fields Q( l). We find that < We remark that, in general, PARI s function quadclassunit is only guaranteed to produce correct output assuming the truth of GRH. However, in our range of l, the GRH-conditional result employed here has been verified by extensive computations of Jacobson, Ramachandran, and Williams. (See the discussion in [4, 3.4].) So our estimation of is in fact unconditional. To treat, we recall that Watkins [35] has shown that h Q( D) > 00 for all negative fundamental discriminants with D > Thus, replacing the condition gcd(g l,30) = by the weaker hypothesis that gcd( l,30) =, < 0 9 <l gcd( l,30)= l 00 < , where again the final estimate comes from an explicit computation in PARI. It remains to treat 3. We write 3 = 3 + 3, where is the contribution of the possible exceptional D = l described in Corollary 4.4, and is the contribution from all other l. Using that h Q( l) > 00 for this exceptional l (if it exists), 3 < < 0. We turn next to 3. Let Π(t) be the number of l (3,t] with gcd( l,30) =. Each l counted here satisfies l 3 (mod 4), l (mod 3), and l,3, or 4 (mod 5). So l is forced into 3 of the ϕ(60) = 6 reduced residue classes modulo 60. By the Brun Titchmarsh theorem in the explicit form of Montgomery Vaughan [4], for every t > 60. Applying Corollary 4.4, we find that 3 < <l 0 5 gcd( l,30)= 0 5 = 0.04 < 0.04 Π(t) 3 t 6log(t/60) = 3 t 8log(t/60) l 0.04 l logl logt Π(t) l>0 5 gcd( l,30)= (t ) t dπ(t) Ç logt (t ) t å dt l l / ǫ 0 (t ) t / ǫ dπ(t) 0 Ç å Π(t) 0 5 (t )t / ǫ dt Inserting the above upper bound for Π(t) and using Mathematica to bound the resulting integrals from above, we find that < Putting everything together, d(m(g)\m({,3,5})) 4 5 Ä ä

17 < 4 Ä ä < This establishes (9) and so completes the proof of the lower bound in Theorem Stratification of torsion in odd degrees: Proof of Theorem.7 We begin with an analytic lemma concerning integers with prescribed sets of divisors. Let G be a set of positive integers. For each positive integer n, put D(n,G) = {g G : g n}. Lemma 5.. Let G be a set of odd positive integers, and suppose that the sum of the reciprocals of the elements of G converges. Let H be any finite subset of G. The set of odd n with D(n,G) = H possesses a well-defined asymptotic density; this density is positive as long as there is at least one such n. Proof. We prove the lemma in two steps. First, we show that the density exists, and then we show positivity. Let A be the set of odd n with D(n,G) = H. For each real z > maxh, put Notice that whenever z > z > maxh, A z = {n : D(n,G [,z]) = H}. (0) A A z A z. Now whether or not n belongs to A z depends only on n modulo g G [,z]g. Thus, A z is a finite union of congruence classes, and so d(a z ) exists. From (0), d(a z ) is a nonincreasing function of z, and so we we may define δ = lim z d(a z). We will show that A has asymptotic density δ. In what follows, we continue to use d( ) for upper density, and we use d( ) for lower density. From the first inclusion in (0), d(a) d(a z ) for all z; now letting z shows that A has upper density at most δ. Now consider the lower density of A. If n A z but n / A, then n is divisible by some g G with g > z; the number of these n x is at most x g G, g>z/g. Dividing by x and letting x, it follows that d(a) d(a z ) g G, g>z Letting z, andrecalling ourassumptionthat thereciprocal sumof theelements ofg converges, we find that d(a) δ. Thus, d(a) = δ. It remains to show the positivity of δ under the assumption that A is nonempty. We prove this by exhibiting a subset of A of positive lower density. Fix n 0 A. For each real z > maxh, put M z := g. g G, g z We consider n of the form n 0 m, where m (mod M z ). Clearly, the set of m (mod M z ) has density M z. Moreover, each number of the form n 0 m is odd and satisfies D(n 0 m,g [,z]) = H. So if m x and n 0 m / A, then g n 0 m for some g G with g (z,n 0 x]; hence, g/gcd(g,n 0 ) m. Since m (mod M z ), we must have g/gcd(g,n 0 ) coprime to M z. Hence, the above divisibility forces m into a uniquely determined residue class modulo gm z /gcd(g,n 0 ). The number of these 7 g.

18 m x is at most Observe that g n 0 x g G z<g n 0 x g G, (g/gcd(g,n 0 ),M z)= x / + x / <g n 0 x g G Ç å xgcd(g,n0 ) + x Ç n 0 gm z M z g>z g G x / + x / <g n 0 x g G n 0 x g å +. g g n 0 x g G Ç x / +x n 0 Thus, the number of m x with m (mod M z ) and n 0 m / A is at most Ç å Ç å x n 0 +x n 0 +x /. M z g g g>z g G g>x / g G g>x / g G Dividingby xandletting x, wefindthat theupperdensity ofm (mod M z ) withn 0 m / A is at most Ñ é n 0. g M z We now fix z large enough that the parenthesized term is smaller than /. Then the lower density of m with n 0 m A is at least M z, and so the lower density of A is at least n 0 M z. g>z We can now prove the first assertion of Theorem.7. Proof that the density of the d-olson degrees exists and is positive, for odd d. Let G run over the groups realizable as torsion subgroups in odd degree, as specified by the Odd Degree Theorem. For each such G, Theorem. shows that G is realizable in a particular odd degree d precisely when a certain explicitly described positive odd integer g G (say) divides d. So with G = {g G : G realizable in odd degree}, the d-olson degrees are precisely the odd positive integers d with D(d,G) = D(d,G). The existence of the density of d-olson degrees, together with its positivity, now follows from Lemma 5. once it is checked that g G /g converges. From Theorem., every g G has the form h Q( l) l l δ or 3h Q( l) l l δ for some prime l 3 (mod 4) and some nonnegative integer δ. Hence, g G g 4 3 l h Q( l) l δ l δ < 8 3 l h Q( l) l As already observed in [4], this final sum on l converges; for example, this follows from Siegel s lower bound h Q( l) ǫ l / ǫ. It remains to prove that the densities of the sets of d-olson degrees, for inequivalent odd d, sum to /. For this we need the following result from [4]. Proposition 5. ( Typical boundedness of torsion in the CM case). For each ǫ > 0, there is a positive real number z such that the set of (odd or even) d with T CM (d) > z has upper density smaller than ǫ. 8. å. g

19 Proof of the final assertion of Theorem.7. We must show that for any complete set D of inequivalent odd degrees, d Dd({d-Olson degrees}) = /. To begin, fix ǫ > 0 and choose z so that the integers d with T CM (d) > z comprise a set of upper density smaller than ǫ. Since equivalent integers d share the same value of T CM (d), the set of odd d with T CM (d) z is a union of equivalence classes. Moreover, since there are only finitely many abelian groups of order at most z, this union is necessarily a finite one. So we can pick d,...,d k D with k {odd d : T CM (d) z} = {d i -Olson degrees}, i= where the union on the right is disjoint. Exploiting finite additivity, k d({d-olson degrees}) d({d i -Olson degrees}) d D i= = d({odd d : T CM (d) z}) = d({odd d : T CM(d) > z}) > ǫ. On the other hand, we also have that for each positive Z, d({d-olson degrees}) = d( {d-olson degrees}) d({odd d}) =. d D, d Z d D, d Z Letting Z, d({d-olson degrees}). d D Since ǫ > 0 is arbitrary, we conclude that d Dd({d-Olson degrees}) = /. 6. The number of groups that can appear in a given degree 6.. Odd degrees: Proof of Theorem.9. The proof of the lower bound in Theorem.9 will depend on the following Brun Titchmarsh theorem on average, which gives nontrivial information about primes in [,X] in arithmetic progressions with moduli slightly larger than X / (i.e., slightly beyond the range of applicability of the Bombieri Vinogradov Theorem or the GRH). For the rest of this section, we fix the constant δ 0 = As usual, π(x;q,a) denotes the count of primes p x with p a (mod q). Proposition 6.. Let A > 0. If X > X 0 (A) and Q [X /,X /+δ 0 ], then X X 0.85 π(x;q,).48 ϕ(q)logx ϕ(q)logx for all q [Q,Q] except those belonging to an exceptional set E A (X,Q) of cardinality not exceeding Q(logX) A. Proof. This is a theorem of Rousselet [3]. Proof of Theorem.9. The upper bound is relatively straightforward. The Odd Degree Theorem implies that apart from { }, Z/Z, Z/4Z, and Z/Z Z/Z, the elements of G(d) are of the form Z/l n Z or Z/l n Z, where l 3 (mod 4) is prime. From Theorem., for Z/l n Z or Z/l n Z to appear, it is necessary that l divide d. Thus, the number of possible l is at most τ(d). Theorem. also implies that n 3 v l(d) +O(), where v l ( ) is the l-adic valuation. Since v l (d) log(d), given l there are only O(log(3d)) possibilities for n. Hence, #G CM (d) +τ(d)log(3d) ǫ d ǫ, 9

20 where we use in the last step the well-known upper estimate for the maximal order of τ(d). The lower bound requires significantly more effort. Recall from Theorem. that if l 3 (mod 4) is prime and l h Q( l) d, then at least one of Z/lZ or Z/lZ belongs to G(d). So if r(d) denotes the number of divisors of d of the form l h Q( l), with l as above, then #G(d) r(d). Now let A be any large, fixed positive real number. We will show that there are infinitely many odd d with r(d) > (logd) 4 Aδ 0. The lower bound in Theorem.9 is then immediate. In what follows, we allow implied constants to depend on A, and l is understood to run only over primes from the residue class 3 mod 4. For each real number x 3, put M := <p logx p. By the prime number theorem, M x /3 for large x. Our plan is to show that the average of r(d) is large when taken over those d x that are multiples of M. (This strategy is inspired by a similar argument of Prachar [30]. Cf. the proof of [, Proposition 0].) Hence, some individual term r(d) must also be large. Now d x M d r(d) = #{(m,l) : m d x M d Å l Å l = #{(m,l) : M m ã h Q( l) = d} ã h Q( l), and m Å l ã h Q( l) x}. We partition the pairs (m,l) counted above according to the value of gcd(m,m). Since we seek only a lower bound on the partial sums of r(d), it is enough to consider pairs with gcd(m,m) highly restricted. Let T = (logx) A. Given g M with g (T,T], we construct pairs (m,l) with gcd(m,m) = M/g as follows: First, fix l T δ 0 with g/gcd(g,) l. Choose any m with gcd(m,m) = M/g. x h Q( l) (l )/ Then the pair (m, l) is counted above. Given l, inclusion-exclusion shows that the number of corresponding m is (as x ) x l h Q( l) ϕ(g) M/g g. Using h Q( l) l / logl and ϕ(g) g/loglogg, the preceding expression is x M(loglogx) g l 3/. Summing on l, and recalling that l T δ 0, the number of pairs we construct for our given g is x M(loglogx) T T 3 ( δ 0) 0 l T δ 0 l 3 (mod 4) l (mod g/ gcd(g,)).

21 Now l T δ 0 l 3 (mod 4) l (mod g/ gcd(g,)) In the notation of Proposition 6., = π(t δ 0 ;g/gcd(g,),) π(t δ 0 ;4g/gcd(g,),). π(t δ 0 ;g/gcd(g,),) 0.85 T δ 0 ϕ(g/gcd(g,))log(t δ 0 ) unless g is even and g/ E (T δ 0,T/) or g is odd and g E (T δ 0,T); from Proposition 6., the number of g involved in these exceptional sets is O(T/loglogx). Similarly, as long as g avoids a certain set of size O(T/loglogx), we have π(t δ 0 ;4g/gcd(g,),).48 T δ 0 ϕ(g/gcd(g,))log(t δ 0 ). Inserting these prime counting estimates above (noting that.48/ < 0.85) we find that as long as g avoids a set of size O(T/loglogx), we construct x M(loglogx) T T ( δ 0) glogt x M(loglogx) 3 T δ 0 pairs for a given g. We now wish to sum over allowable values of g. Recall that our g (T,T] must satisfy g M, i.e., g must be a squarefree, logx-smooth number. Without the squarefree restriction, the number oftheseg T is ρ(a)t, whereρ( )isdickman s function; insistingthatg issquarefreecutsthis down to π ρ(a)t (see, e.g., [5]). Similarly, the number of 6 logx-smooth g T is π ρ(a)t. Thus, there are T values of g (T,T] that divide M. (This could also be established by more elementary methods.) Excluding the O(T/loglogx) bad values of g coming from the application of Proposition 6., we are still left with T allowable values of g (for large x). It follows that and hence r(d) d x M d x M(loglogx) 3 T δ 0 r(d) > x M (logx) 4 Aδ 0 d x M d T = x M (logx) Aδ 0 (loglogx) 3, for large enough x. Since there are no more than x/m multiples of M in [,x], there is some d x satisfying r(d) > (logx) 4 Aδ 0, and hence also r(d) > (logd) 4 Aδ 0. Letting x, we obtain infinitely many distinct d of this kind. 6.. Even degrees. In this section we explain why the upper bound in Theorem.9 fails if we do not restrict to odd values of d. The key ingredient in our argument is a variant of the following 935 theorem of Erdős [3] asserting the existence of popular values of Euler s ϕ-function. Proposition 6.. For some constant δ > 0 and all sufficiently large x, max #{n squarefree : ϕ(n) = m} > m x xδ. An easy modification of Erdős s proof yields the following more general result.