An algorithm for determining torsion growth of elliptic curves

TL;DR

This paper introduces a fast algorithm to determine torsion growth of elliptic curves over number fields, applied to a large dataset of curves, revealing new sporadic points and expanding understanding of torsion structures.

Contribution

The paper presents a novel, efficient algorithm for analyzing torsion subgroup growth of elliptic curves over number fields, with extensive computational results.

Findings

Identified a degree 6 sporadic point on X_1(4,12)

Analyzed 2,483,649 elliptic curves of conductor < 400,000

Collected data on torsion subgroup behavior across various degrees

Abstract

We present a fast algorithm that takes as input an elliptic curve defined over $\mathbb Q$ and an integer $d$ and returns all the number fields $K$ of degree $d'$ dividing $d$ such that $E(K)_{tors}$ contains $E(F)_{tors}$ as a proper subgroup, for all $F \varsubsetneq K$. We ran this algorithm on all elliptic curves of conductor less than 400.000 (a total of 2.483.649 curves) and all $d \leq 23$ and collected various interesting data. In particular, we find a degree 6 sporadic point on $X_1(4,12)$, which is so far the lowest known degree a sporadic point on $X_1(m,n)$, for $m\geq 2$.

Tables

Table 1. Table 1. Bounds on Φ ℚ ​ ( d ) subscript Φ ℚ 𝑑 \Phi_{\mathbb{Q}}(d) for d ≤ 23 𝑑 23 d\leq 23 .

$d$		$h_{\mathbb{Q}}\left(d\right)$	$N_{\mathbb{Q}}\left(d\right)$	$\#{\mathscr{H}}_{\mathbb{Q}}\left(d\right)$
$1$	$\{\left(1\right),\left(2\right),\left(3\right),\left(4\right),\left(5\right),\left(6\right),\left(7\right),\left(8\right),\left(9\right),\left(10\right),\left(12\right),(2,2),(2,4),(2,6),(2,8)\}$	$-$	$-$	$-$
$2$	$\{\left(15\right),\left(16\right),(2,10),(2,12),(3,3),(3,6),(4,4)\}$	$4$	$3150$	$52$
$3$	$\{\left(13\right),\left(14\right),\left(18\right),\left(21\right),(2,14)\}$	$3$	$3969$	$26$
$4$	$\{\left(13\right),\left(20\right),\left(24\right),(2,16),(4,8),(5,5),(6,6)\}$	$\ge 9$	$\ge 14400$	$\ge 130$
$5$	$\{\left(11\right),\left(25\right)\}$	$1$	$121$	$4$
$6$	$\{\left(30\right),(2,18),(3,9),(3,12),(4,12),(6,6)\}$	$\ge 9$	$\ge 10816$	$\ge 137$
$7$	$-$	$1$	$26$	$1$
$8$	$\{\left(17\right),\left(21\right),\left(30\right),\left(32\right),(2,20),(2,24),(3,12),(4,12)\}$	$\ge 17$	$\ge 277440$	$\ge 275$
$9$	$\{\left(19\right),\left(26\right),\left(27\right),\left(28\right),\left(36\right),\left(42\right),(2,18)\}$	$\ge 6$	$\ge 3969$	$\ge 34$
$10$	$-$	$\ge 4$	$\ge 3150$	$\ge 58$
$12$	$\left\{\begin{array}{c}\left(26\right),\left(28\right),\left(36\right),\left(37\right),\left(42\right),\\ (2,28),(2,30),(2,42),(3,15),(3,21),(5,10),(6,12)\end{array}\right\}$	$\ge 19$	$\ge 18176$	$\ge 268$
$14$	$-$	$\ge 4$	$\ge 3150$	$\ge 52$
$15$	$\{\left(22\right),\left(50\right)\}$	$\ge 3$	$\ge 3969$	$\ge 30$
$16$	$\{\left(40\right),\left(48\right),(2,30),(2,32),(3,15),(4,16),(4,20),(5,15),(6,12),(8,8)\}$	$\ge 25$	$\ge 277440$	$\ge 480$
$18$	$\{\left(45\right),(2,26),(2,36),(2,42),(3,18),(3,21),(4,28),(6,18),(7,7),(9,9)\}$	$\ge 17$	$\ge 254016$	$\ge 192$
$20$	$\{\left(22\right),\left(33\right),(2,22),(5,10),(5,15)\}$	$\ge 9$	$\ge 14400$	$\ge 149$
$21$	$\left\{\left(43\right)\right\}$	$\ge 3$	$\ge 3969$	$\ge 29$

Table 2. Table 2. Bounds on Ψ ℚ ​ ( d ) subscript Ψ ℚ 𝑑 \Psi_{\mathbb{Q}}(d) for d ≤ 23 𝑑 23 d\leq 23 .

$d$	$\left(n\right)$	$(2,2n)$	$(3,3n)$	$(4,4n)$	$(5,5n)$	$(6,6n)$	$(7,7n)$	$(8,8n)$	$(9,9n)$
2	3-10,12,15,16	1-6	1,2	1	-	-	-	-	-
3	2-4,6,7,9,10, 12-14,18,21	1,3,7	-	-	-	-	-	-	-
4	3-6,8,10,12, 13,15,16,20,24	2-6,8	1,2	1,2	1	1	-	-	-
5	5,10,11,25	-	-	-	-	-	-	-	-
6	3,4,6,7,9,10, 12-15,18,21,30	1,3,5-7,9	1-4	1,3	-	1	-	-	-
7	7	-	-	-	-	-	-	-	-
8	3,5,6,8,10,12,15,16, 17,20,21,24,30,32	2-6,8,10,12	1,2,4	1-3	1	1	-	-	-
9	6,7,9,12,14,18, 19,21,26-28,36,42	3,7,9	-	-	-	-	-	-	-
10	5,10,11,15,25	5	-	-	-	-	-	-	-
12	4,6,7-10,12-15,18,20, 21,24,26,28,30,36,37,42	2,3,5,6,7, 9,14,15,21	1-5,7	1,3	2	1,2	-	-	-
14	7	-	-	-	-	-	-	-	-
15	10,22,50	-	-	-	-	-	-	-	-
16	5,8,10,12,15,16,17 20,21,24,30,32,40,48	3-6,8,10, 12,15,16	1,2,4,5	1-5	1,3	1,2	-	1	-
18	6,7,9,12,14,18,19,21, 26-28,30,36,42,45	3,7,9,13,18,21	2-4,6,7	3,7	-	1,3	1	-	1
20	5,10,11,15,20,22,25,33	5,11	-	-	1-3	-	-	-	-
21	7,14,21,43	7	-	-	-	-	-	-	-

Table 3. Table 3. Data for Ψ ℚ ​ ( d ) subscript Ψ ℚ 𝑑 \Psi_{\mathbb{Q}}(d)

$d$	$4$	$6$	$8$	9	$10$	$12$	$14$	$15$	$16$	$18$	$20$	$21$
$g_{\mathbb{Q}}\left(d\right)\ge$	5	5	9	3	1	6	1	1	10	6	3	1
$M_{\mathbb{Q}}\left(d\right)\ge$	18176	5184	223494	3969	150	18176	208	121	277440	254016	18176	1922
$\#{𝒢}_{\mathbb{Q}}\left(d\right)\ge$	104	88	200	20	7	134	1	3	336	101	26	6

Table 4. Table 4. Timings for the computations

d	2	3	4	5	6	7	8	9	10	12	14	15	16	18	20	21
Mode (s)	0.06	0.06	0.06	0.06	0.09	0.06	0.08	0.06	0.06	0.23	0.06	0.06	0.08	0.09	0.06	0.06
Median (s)	0.07	0.06	0.07	0.06	0.13	0.06	0.10	0.06	0.07	4.7	0.07	0.06	0.10	0.13	0.07	0.06
Mean (s)	0.08	0.06	0.15	0.06	0.17	0.06	1.1	0.13	0.1	6.5	0.08	0.07	24	1.4	0.35	0.06
Maximum (s)	1.3	3.7	9.0	3.5	9.1	16	98	16	27	110	16	16	1200	440	470	17
Total (h)	54.4	43.5	106.4	42.2	119.6	41.6	774.7	88.2	66.8	4492.8	55.45	44.85	16339	1004	241.3	43.8

Equations

$${\overline{\rho }}_{E,n}:G_K⟶\mathrm{Aut}(E[n]).$$

$$\left\{(17,-17\cdot 373^3/2^{17}),(17,-17^2\cdot 101^3/2),(37,-7\cdot 11^3),(37,-7\cdot 137^3\cdot 2083^3)\right\},$$

$$[{\mathrm{GL}}_2(\mathbb{Z}/{\ell }^{k+1}\mathbb{Z}):G_E({\ell }^{k+1})]\ge \ell [{\mathrm{GL}}_2(\mathbb{Z}/{\ell }^k\mathbb{Z}):G_E({\ell }^k)]$$

$$-{\ell }^{j}P={\ell }^j(\sigma (P))=\sigma ({\ell }^{j}P)={\ell }^{j}P,$$

$$E(F)[169]\simeq E(F^{\prime })[169]\oplus E^{\delta }(F^{\prime })[169],$$

$$g(x)=x^6-210x^5-8085x^4+125300x^3+4251975x^2-16133250x-408849875.$$

$$g(x)=x^4+340x^3+510x^2-5560700x-237673175.$$

$${\varphi }_{\ell }(x)-x(Q){\psi }_{\ell }(x{)}^2=g_1(x)\cdot \dots \cdot g_u(x),$$

$$T=\prod _{\ell \in (S_i\cup S_j{)}^{\prime }}T[{\ell }^{\infty }]$$

$$E_t:y^2=x^3-27\left(t^2-3\right){\left(t^2-8t-11\right)}^{3}x+54{\left(t^2-8t-11\right)}^4\left(t^2-6t-9\right)\left(t^2+2t+3\right).$$

$$j(E_t)=-\frac{4{\left(t^2-3\right)}^3\left(t^2-8t-11\right)}{(t+1{)}^4}.$$

$$J_1(s)=\frac{27(s+1{)}^3(s+3{)}^3(s^2+3{)}^3}{t^3(t^2+3t+3{)}^3}\text{mbox}and{J}_3(s)=\frac{27(s+1)(s+9{)}^3}{s^3}.$$

$$(t+1)z^3=-4\left(t^2-8t-11\right).$$

$$\begin{array}[]{|c|c|c|}\hline\cr t&\text{label}&G\\ \hline\cr 7&\href http://www.lmfdb.org/EllipticCurve/Q/1296/l/2&(1)\\ \hline\cr-5&\href http://www.lmfdb.org/EllipticCurve/Q/1296/l/1&(1)\\ \hline\cr-1/2&\href http://www.lmfdb.org/EllipticCurve/Q/162/d/1&(1)\\ \hline\cr-5/4&\href http://www.lmfdb.org/EllipticCurve/Q/162/d/2&(3)\\ \hline\cr\end{array}$$

Full text

The first author was partially supported by the grant PGC2018–095392–B–I00 (MCIU/AEI/FEDER, UE). The second author gratefully acknowledges support from the QuantiXLie Center of Excellence, a project co-financed by the Croatian Government and European Union through the European Regional Development Fund - the Competitiveness and Cohesion Operational Programme (Grant KK.01.1.1.01.0004) and by the Croatian Science Foundation under the project no. IP-2018-01-1313.

1. Introduction

Let $E$ be an elliptic curve defined over a number field $K$. The Mordell–Weil Theorem states that the set $E(K)$ of $K$-rational points is a finitely generated abelian group. Denote by $E(K)_{\operatorname{tors}}$ the torsion subgroup of $E(K)$. One of the main goals in the theory of elliptic curves is to determine $E(K)_{\operatorname{tors}}$, or in more generality, all possible torsion groups of all elliptic curves over all number fields of a given degree.

Let $d$ a positive integer and $\Phi(d)$ be the set of groups, up to isomorphism, that occur as torsion groups of some elliptic curve defined over a number field of degree $d$. Note that the set $\Phi(d)$ is finite thanks to Merel’s uniform boundedness theorem [32]. These sets have so far been determined for only***M. Derickx, A. Etropolski, M. van Hoeij, J. Morrow and D. Zureick-Brown have announced results for $d=3$. $d\leq 2$ [31, 25, 26]. For degree $d=1,2$, each group in $\Phi(d)$ occurs for infinitely many ${\overline{\mathbb{Q}}}$-isomorphism classes of elliptic curves, but for $d=3$ this is not the case (see [33, Theorem 1] and [23, Theorem 3.4]). Therefore we define $\Phi^{\infty}(d)\subseteq\Phi(d)$ to be the set of groups that arise for infinitely many ${\overline{\mathbb{Q}}}$-isomorphism classes of elliptic curves. While $\Phi(d)$ is not completely known even for $d=3$, $\Phi^{\infty}(d)$ is known for $d\leq 6$ [23, 24, 9].

A slightly different approach is to consider only elliptic curves over $\mathbb{Q}$ under base change to number fields of a given degree. Let $d$ be a positive integer and $\Phi_{\mathbb{Q}}(d)\subseteq\Phi(d)$ be the set of groups, up to isomorphism, that occur as the torsion group $E(K)_{\operatorname{tors}}$ of an elliptic curve $E$ defined over $\mathbb{Q}$ base changed to a number field $K$ of degree $d$. Notice that $\Phi_{\mathbb{Q}}(d)$ does not have to be contained in $\Phi^{\infty}(d)$, as the group $\mathbb{Z}/21\mathbb{Z}$ shows†††The second author showed in [33] that the elliptic curve with LMFDB label 162.c3 has torsion subgroup $\mathbb{Z}/21\mathbb{Z}$ defined over the cubic field $\mathbb{Q}(\zeta_{9})^{+}=\mathbb{Q}(\zeta_{9}+\zeta_{9}^{-1})$ where $\zeta_{9}$ is a primitive $9$-th root of unity. for $d=3$, and $\Phi^{\infty}(d)$ does not have to be contained in $\Phi_{\mathbb{Q}}(d)$ as the group $\mathbb{Z}/15\mathbb{Z}$ shows for $d=2$ (see [33, Theorem 1] and [26]).

Similarly, for a fixed $G\in\Phi(1)$, let $\Phi_{\mathbb{Q}}(d,G)$ be the subset of $\Phi_{\mathbb{Q}}(d)$ consisting of all possible torsion groups $E(K)_{\operatorname{tors}}$ of an elliptic curve $E$ defined over $\mathbb{Q}$ such that $E(\mathbb{Q})_{\operatorname{tors}}=G$ base changed to $K$, a number field of degree $d$. The sets $\Phi_{\mathbb{Q}}(d)$ and $\Phi_{\mathbb{Q}}(d,G)$, for any $G\in\Phi(1)$, have been completely determined for $d=2,3,4,5,7$ in a series of papers [33, 18, 19, 15, 4, 16, 12]. Moreover, in [16] it has been established that $\Phi_{\mathbb{Q}}(d)=\Phi(1)$ for any positive integer $d$ whose prime divisors are greater than $7$.

Let $E$ be an elliptic curve defined over $\mathbb{Q}$ and let $K$ a number field. We say that there is torsion growth over $K$ if $E(\mathbb{Q})_{\operatorname{tors}}\subsetneq E(K)_{\operatorname{tors}}$. One can easily work out that there is torsion growth (of the $2$-primary torsion) in at least one number field of degree $2$, $3$, or $4$. On the other hand, there is no torsion growth in number fields of degree only divisible by primes $>7$ (cf. [16, Theorem 7.2(i)]).

The purpose of this paper is to develop a fast algorithm, usable in practice, which for a given elliptic curve $E$ defined over $\mathbb{Q}$ and a positive integer $d$ finds all the pairs $(K,H)$ where $K$ is a number field of degree dividing $d$ and $E(K)_{\operatorname{tors}}\simeq H\supsetneq E(\mathbb{Q})_{\operatorname{tors}}$. Of course, the set of such number fields can be infinite if there exists a number field $F$ of degree $d^{\prime}$, where $d^{\prime}$ divides $d$ and $d^{\prime}<d$ such that $E(F)_{\operatorname{tors}}\supsetneq E(\mathbb{Q})_{\operatorname{tors}}$; then every number field $K\supseteq F$ of degree $d$ will have the desired property. To circumvent this problem, we will say that $E$ has primitive torsion growth over a number field $K$ if $E(F)_{\operatorname{tors}}\subsetneq E(K)_{\operatorname{tors}}$, for all subfields $F\subsetneq K$. For a prime $\ell$ we say that $E$ has primitive $\ell$-power torsion growth if $E(F)[\ell^{\infty}]\subsetneq E(K)[\ell^{\infty}]$, for all subfields $F\subsetneq K$.

It is an easy corollary of Merel’s theorem [32] that for a given integer $d$ the list of number fields where primitive torsion growth occurs will be finite. The existence of such an algorithm is obvious: for every integer $d$, by the aforementioned theorem of Merel, there exists an effective bound $B_{d}$ such that $\#E(K)_{\operatorname{tors}}\leq B_{d}$. So to determine the number fields $F$ where torsion growth occurs one does the following:

$\bullet$ For all prime powers $\ell^{n}\leq B_{d}$ do:

$\bullet$ factor the $\ell^{n}$-th division polynomial $\psi_{\ell^{n}}$ and check whether there are any irreducible factors of degree $d^{\prime}$ dividing $d$.

$\bullet$ If no, move on to the next prime power. If yes, for all irreducible factors $f$ of degree $d^{\prime}\,|\,d$ do:

Construct the number field $F$ whose minimal polynomial is $f$ - this will be the field of definition of the $x$-coordinate of a $\ell^{n}$-torsion point $P$ of $E$.

• -

Check whether $P$ is defined over $F$, if yes add $F$ to the set that will be the output. If $P$ is not defined over $F$, then check whether $2d^{\prime}$ divides $d$, if yes, then add $\mathbb{Q}(P)$ (which will be obtained from $F$ by adjoining the $y$-coordinate of $P$ to $F$) to the output set.

• -

If a point of order $\ell^{n}$ was constructed in the previous step, check whether the full $\ell^{n}$-torsion of $E$ is defined over a number field of degree dividing $d$, by checking whether the degree of the splitting field of $\psi_{\ell^{n}}$ or an appropriate degree 2 extension divides $d$.

However, if implemented as stated above, this algorithm would not be very useful in practice. The main obstacle would be factoring division polynomials, as $\psi_{n}$ is a polynomial of degree $\frac{n^{2}-1}{2}$ for $n$ odd, and the values $n$ that need to be checked will grow exponentially in $d$.

Our algorithm will use information that can be obtained from the images of mod $n$ Galois representations attached to $E$ to avoid factoring division polynomials wherever possible. To make the algorithm usable in practice we will add a number of if-then conditions that will rule out most of the integers $n$ that need to be checked using results from [16] and results that we develop for this purpose in Section 2.1.

One of the main motivations of this paper is to run the algorithm on all elliptic curves of conductor less than 400.000 (see [6, 29]) and for each curve within determine all the number fields of degree $\leq 23$ over which there is primitive torsion growth. In Section 4 we present the most interesting data coming out of these computations. The main results appear in Table 1. We obtain sets contained in $\Phi_{\mathbb{Q}}(d)$ for $d\leq 23$ and our data motivates us to conjecture that we have in fact obtained all of $\Phi_{\mathbb{Q}}(d)$ for $d\leq 23$ (see Conjecture 4.2). We can also see that there is much more torsion growth and it is much more complex when $d$ is divisible by powers of $3$ and especially $2$. Moreover we find two elliptic curves defined over $\mathbb{Q}$ with torsion $\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$ over a degree 6 number field and prove that these are the only two such curves. By [9], there are only finitely many elliptic curves over sextic fields (without supposing that they are defined over $\mathbb{Q}$) with this torsion group, so these curves give us examples of sporadic points of degree 6 on $X_{1}(4,12)$. This is the lowest known degree of a sporadic point on a modular curve $X_{1}(m,n)$, for $m|n$ and $m\geq 2$.

Notation

Specific elliptic curves mentioned in this paper will be referred to by their LMFDB label and a link to the corresponding LMFDB page [29] will be included for the ease of the reader. Conjugacy classes of subgroups of $\operatorname{GL}_{2}(\mathbb{Z}/\ell\mathbb{Z})$ will be referred to by the labels introduced by Sutherland in [38, §6.4]. We write $G=H$ (or $G\leq H$) for the fact that $G$ is isomorphic to $H$ (or to a subgroup of $H$ resp.) without further detail on the precise isomorphism.

2. Auxiliary results

In this section, we prove a series of results that will make it possible to replace costly factorizations of division polynomials by simple if-then checks. This will be useful in the computations described in Section 4.

Let $E$ be an elliptic curve defined over a number field $K$, $n$ a positive integer and ${\overline{K}}$ a fixed algebraic closure of $K$. The absolute Galois group $G_{K}:=\operatorname{Gal}({\overline{K}}/K)$ acts on $E[n]$, inducing a mod $n$ Galois representation attached to $E$

[TABLE]

Fixing a basis $\{P,Q\}$ of $E[n]$, we identify $\operatorname{Aut}(E[n])$ with $\operatorname{GL}_{2}(\mathbb{Z}/n\mathbb{Z})$. Therefore we can view $\overline{\rho}_{E,n}(G_{K})$ as a subgroup of $\operatorname{GL}_{2}(\mathbb{Z}/n\mathbb{Z})$, determined uniquely up to conjugacy in $\operatorname{GL}_{2}(\mathbb{Z}/n\mathbb{Z})$, and denoted by $G_{E}(n)$ from now on.

For elliptic curves over $\mathbb{Q}$, we conjecturally (see [38, Conjecture 1.1] and [40, Conjecture 1.12.]) know all the mod $\ell$ Galois representations attached to non-CM elliptic curves over $\mathbb{Q}$.

Conjecture 2.1**.**

Let $E/\mathbb{Q}$ be a non-CM elliptic curve, $\ell\geq 17$ a prime and $(\ell,j_{E})$ not in the set

[TABLE]

then $G_{E}(\ell)=\operatorname{GL}_{2}(\mathbb{F}_{\ell})$.

For a prime $\ell$, $\rho_{E,\ell}:G_{K}\rightarrow\operatorname{GL}_{2}(\mathbb{Z}_{\ell})$ will denote the $\ell$-adic representation attached to $E$ (again we assume that we have fixed a basis for the Tate module $T_{\ell}(E)$). We say that the $\ell$-adic representation of $E$ is defined modulo $\ell^{n}$ if for all $m\geq n$ we have $G_{E}(\ell^{m+1})\geq I_{2}+\ell^{m}M_{2}(\mathbb{Z}/\ell^{m+1}\mathbb{Z})$, where $I_{2}$ is the identity matrix.

Proposition 2.2**.**

Let $E$ be an elliptic curve defined over a number field $K$ such that its $\ell$-adic representation is defined modulo $\ell^{n}$. Then for any point $P\in E({\overline{K}})$ of order $\ell^{n+1}$, we have $[K(P):K(\ell P)]=\ell^{2}$.

Proof.

We need to prove that $I_{2}+\ell M_{2}(\mathbb{Z}/\ell^{n+1}\mathbb{Z})$ acts transitively on the solutions of $\ell X=P$ (where the action of $I_{2}+\ell^{n}M_{2}(\mathbb{Z}/\ell^{n+1}\mathbb{Z})$ on the $\mathbb{Z}/\ell^{n}\mathbb{Z}$-module of the solutions of $\ell X=P$ is defined in the obvious way). The $G_{K}$-module $E[\ell^{n+1}]$ is isomorphic to $(\mathbb{Z}/\ell^{n+1}\mathbb{Z})^{2}$, and we choose an isomorphism sending $P$ to $(\ell,0)$ and study the action of $I_{2}+\ell M_{2}(\mathbb{Z}/\ell^{n+1}\mathbb{Z})$ on the $\ell^{2}$ solutions of the equation $\ell X=(\ell,0)$. One easily sees that already the subgroup of $I_{2}+\ell^{n}M_{2}(\mathbb{Z}/\ell^{n+1}\mathbb{Z})$ generated by $\left(\begin{smallmatrix}1&\ell^{n}\\ 0&1\end{smallmatrix}\right)$ and $\left(\begin{smallmatrix}\ell^{n}+1&0\\ 0&1\end{smallmatrix}\right)$ acts transitively on the solutions of the equation $\ell X=(\ell,0)$. ∎

For easier reference we state and prove the following lemma which will follow from standard group-theoretic arguments.

Lemma 2.3**.**

Let $E$ be an elliptic curve without $CM$ defined over a number field $K$ and $\ell\geq 5$ a prime such that $v_{\ell}([\operatorname{GL}_{2}(\mathbb{Z}_{\ell}):\rho_{E,\ell}(G_{\mathbb{Q}})])=n$. Then the $\ell$-adic Galois representation of $E/K$ is defined modulo $\ell^{m}$ for some $m\leq n+1$.

Proof.

Define $V_{k}:=I_{2}+\ell^{k}M_{2}(\mathbb{Z}/\ell^{k+1}\mathbb{Z})$ and $G:=\rho_{E,\ell}(G_{\mathbb{Q}})$. Let $\rho_{k}:\operatorname{GL}_{2}(\mathbb{Z}/\ell^{k+1}\mathbb{Z})\rightarrow\operatorname{GL}_{2}(\mathbb{Z}/\ell^{k}\mathbb{Z})$ be the reduction mod $\ell^{k}$ map. Then $\ker\rho_{k}=V_{k}$.

We use the fact, as explained in the proof of [36, Lemma 3, IV-23], that if $V_{m}\subset G_{E}(\ell^{m+1})$, then $V_{k}\subset G_{E}(\ell^{k+1})$ for all $k\geq m$. It follows that if $G$ is defined modulo $\ell^{m}$, then we have $\ker(\rho_{k}|_{G_{E}(\ell^{k+1})})=V_{k}$ for all $k\geq m$. So if $\rho_{m}^{-1}(G_{E}(\ell^{m}))=G_{E}(\ell^{m+1})$, then $\rho_{k}^{-1}(G_{E}(\ell^{k}))=G_{E}(\ell^{k+1})$ for all $k\geq m$.

This implies that if $G$ is defined modulo $\ell^{m}$, then $\rho_{k}^{-1}(G_{E}(\ell^{k}))\neq G_{E}(\ell^{k+1})$ (and hence $\rho_{k}^{-1}(G_{E}(\ell^{k}))$ is of index $\ell^{i}$ for some $1\leq i\leq 4$ in $G_{E}(\ell^{k+1})$), for all $1\leq k\leq m-1$.

Suppose now that $G$ is not defined modulo $\ell^{m}$ for any $1\leq m\leq n+1$. This implies that

[TABLE]

for all $1\leq k\leq n+1$. This implies that $v_{\ell}\left([\operatorname{GL}_{2}(\mathbb{Z}_{\ell}):\rho_{E,\ell}(G_{\mathbb{Q}})]\right)\geq n+1$, which is a contradiction.

∎

Lemma 2.4**.**

Let $\ell\geq 3$ be a prime and $E/\mathbb{Q}$ an elliptic curve. Then if $G_{E}(\ell)=\operatorname{GL}_{2}(\mathbb{F}_{\ell})$ and $P\in E(\overline{\mathbb{Q}})$ is a point of order $\ell^{2}$, then $[\mathbb{Q}(P):\mathbb{Q}]=\ell^{2}(\ell^{2}-1)$.

Proof.

If $\ell\geq 5$, then it follows from [36, Lemma 3, IV-24] that if $G_{E}(\ell)=\operatorname{GL}_{2}(\mathbb{F}_{\ell})$, then $\rho_{E,\ell}$ is surjective. It follows that the $\ell$-adic representation is defined modulo $\ell$, so the lemma follows from Proposition 2.2. For $\ell=3$, if $G_{E}(9)=\operatorname{GL}_{2}(\mathbb{Z}/9\mathbb{Z})$, then the conclusion is the same as before, while if $G_{E}(9)\neq\operatorname{GL}_{2}(\mathbb{Z}/9\mathbb{Z})$ then it follows from [11] that $G_{E}(9)=G$, where $G$ is a (unique up to conjugacy) subgroup $G$ of $\operatorname{GL}_{2}(\mathbb{Z}/9\mathbb{Z})$ generated by $\left(\begin{smallmatrix}4&5\\ 4&4\end{smallmatrix}\right)$ and $\left(\begin{smallmatrix}4&5\\ 8&6\end{smallmatrix}\right)$. One easily checks that this group acts transitively on the 72 points of order 9 in $E(\overline{\mathbb{Q}})$, so the $[\mathbb{Q}(P):\mathbb{Q}]=72$ for all points of order 9 (using the same argumentation as in [16, Section 5]).

∎

Lemma 2.5**.**

Let $\ell$ be a prime, $E$ an elliptic curve defined over a number field $K$, $P\in E({\overline{K}})$ a point of order $\ell^{k}$, $k\geq 2$ and suppose $\ell^{j}P\in E(K)$ for some $j<k$ and such that $\ell^{k-j}>2$. Then $K(x(P))=K(P)$.

Proof.

Obviously $[K(P):K(x(P))]=1$ or $2$. Suppose $[K(P):K(x(P))]=2$ and let $1\neq\sigma\in\operatorname{Gal}(K(P)/K(x(P)))$. Then we have $\sigma(x(P))=x(P)$, so $\sigma(y(P))=y(-P)$ and hence $\sigma(P)=-P$, as $\sigma\neq 1$. But we have

[TABLE]

where the last equation follows from the fact that $\ell^{j}P\in E(K)$. Since by assumption $\ell^{j}P$ is a point of order $>2$, this is a contradiction. ∎

The most time-consuming part of our algorithm is determining the existence of points of order $\ell^{k}$ for $k\geq 2$, and the fields over which such points live if they exist.

We now prove results that will prove the non-existence of points of certain orders $\ell^{k}$ over number fields of relatively small degree $d$.

2.1. Points of order $125$

Proposition 2.6**.**

Let $E/\mathbb{Q}$ be an elliptic curve and $K$ a number field of degree $<50$. Then $E(K)$ does not have a point of order $125$.

Proof.

Let $P$ be a point of order $125$. First consider the case when $E$ has a $5$-isogeny over $\mathbb{Q}$. Let $d$ be the power of 5 in $[\operatorname{Aut}_{\mathbb{Z}_{5}}T_{5}(E):\operatorname{im}\rho_{E,5}]$ (note that this index is finite as elliptic curves with CM do not have $5$-isogenies over $\mathbb{Q}$). By [20, Theorem 2], $d$ is at most $5$, and we conclude by Lemma 2.3 that the $\ell$-adic representation of $E$ is defined modulo $25$. From here it follows by Proposition 2.2 that $[\mathbb{Q}(P):\mathbb{Q}(5P)]=25$. Since there exist no points of order $25$ on elliptic curves over quadratic fields [25, 26], we have $[\mathbb{Q}(P):\mathbb{Q}]>50$.

Suppose now that there is no isogeny of degree 5 over $\mathbb{Q}$. Applying [30, Theorem 2.1] (with $L=\mathbb{Q}$, $p=5$, $a=1$ and $n=3$), we obtain that $[\mathbb{Q}(P):\mathbb{Q}]$ is divisible by $25$. From [16, Table 1] we see that the field over which an elliptic curve without an isogeny gains a $5$-torsion point is divisible by 2. So we conclude that $[\mathbb{Q}(P):\mathbb{Q}]$ is divisible by 50 and hence $[\mathbb{Q}(P):\mathbb{Q}]\geq 50$. ∎

2.2. Points of order $49$

Lemma 2.7**.**

There are no points of order $49$ on an elliptic curve $E/\mathbb{Q}$ over any number field of degree $d<42$.

Proof.

Let us split the proof in two cases depending if $E$ has a 7-isogeny or not. If $E$ has a 7-isogeny, then by the results of [21] the $7$-adic representation is either as large as possible or the curve has $j_{E}=-15^{3}$ or $255^{3}$. If the representation is as large as possible, then by Proposition 2.2 we have $[\mathbb{Q}(P):\mathbb{Q}(7P)]=49$, eliminating this case. If $j_{E}=-15^{3}$ or $255^{3}$, we explicitly check that $[\mathbb{Q}(P):\mathbb{Q}]\geq 147$.

Finally, suppose that $E$ does not have a $7$-isogeny and let $P$ be a point of order $49$ of $E$. By [30, Theorem 2.1], we get that $[\mathbb{Q}(P):\mathbb{Q}(7P)]$ is divisible by $7$. So if $[\mathbb{Q}(P):\mathbb{Q}]=[\mathbb{Q}(P):\mathbb{Q}(7P)][\mathbb{Q}(7P):\mathbb{Q}]<42$, then it would follow that $[\mathbb{Q}(7P):\mathbb{Q}]<6$. By looking at [16, Table 1] we see that this is only possible when $G_{E}(7)$ is a Borel subgroup, which is a contradiction, since then $E$ would have a $7$-isogeny over $\mathbb{Q}$.

∎

2.3. Points of order $\ell^{2}$ for $\ell>7$

Lemma 2.8**.**

There are no points of order $\ell^{2}$ for $\ell\geq 11$ on an elliptic curve $E/\mathbb{Q}$ over any number field of degree $d<55$.

Proof.

We divide the proof into two cases: when $E$ has CM and when it doesn’t.

Suppose first that $E$ doesn’t have CM. Let $P$ be a point of order $\ell^{2}$. If $E$ has a $\ell$-isogeny over $\mathbb{Q}$ and does not have CM, by the results of [20], it follows that the $\ell$-adic image is defined mod $\ell$, from which it follows by Proposition 2.2 that $[\mathbb{Q}(P):\mathbb{Q}(\ell P)]$ is divisible by $\ell^{2}$. On the other hand, if there are no $\ell$-isogenies over $\mathbb{Q}$, then we have that $[\mathbb{Q}(\ell P):\mathbb{Q}]\geq 55$ for $\ell=11$ by [16, Table 1], $[\mathbb{Q}(\ell P):\mathbb{Q}]\geq 72$ for $\ell=13$ by [16, Table 2] and $[\mathbb{Q}(\ell P):\mathbb{Q}]\geq(\ell^{2}-1)/3$ for $\ell>13$ by [16, Theorems 3.2 and 5.6].

Suppose now that $E$ has CM by an order $\mathcal{O}$. Let $F=\mathbb{Q}(P)$, where $P$ is of order $\ell^{k}$, $k\geq 2$, and let $K=\mathcal{O}\otimes_{\mathbb{Z}}\mathbb{Q}$ be the CM field of $E$. If $j(E)\neq 0,1728$ or $\ell\neq 13$ it follows from [1, Theorem 6.2] that $FK$ is of degree $\geq 110$ and hence $[F:\mathbb{Q}]\geq 55$.

Suppose from now on that $\ell=13$. If $K\nsubseteq F$ and $j(E)=0$ or $1728$, we have $(\ell,\Delta(\mathcal{O}))=1$ so we can apply [2, Therorem 4.8 c)] to show that $\mathbb{Q}(\zeta_{\ell^{k}})^{+}$ is strictly contained in $F$, from which it follows that $[F:\mathbb{Q}]\geq 312$.

Suppose $K\subset F$. If $j(E)=1728$, then [1, Theorem 6.2] gives us that $[F:\mathbb{Q}]\geq 78$. Finally, suppose $j(E)=0$. From [1, Theorem 6.2] it follows that for any elliptic curve with $j(E)=0$ with a point of order $169$ over a number field $F$ containing $K$, we have that $52\mid[F:\mathbb{Q}]$. Suppose $E/F$ is such an elliptic curve; i.e. $j(E)=0$, $E(F)_{\operatorname{tors}}$ has a point of order 169 and $[F:K]=26$. We claim that $E$ cannot be a base change of an elliptic curve defined over $\mathbb{Q}$. Since $F$ is a subfield of $\mathbb{Q}(E[13])$, by the theory of complex multiplication it is Abelian over $K$ and so $\operatorname{Gal}(F/K)\simeq\mathbb{Z}/26\mathbb{Z}$. It follows by Galois theory that there exists a field $K\subset F^{\prime}\subset F$ where $[F:F^{\prime}]=2$. We can write $F=F^{\prime}(\sqrt{\delta})$ for some $\delta\in F^{\prime}$. Let $E^{\delta}$ be the quadratic twist of $E$ by $\delta$. If $E$ was defined over $\mathbb{Q}$, then we would have (see for example [28, Lemma 1.1])

[TABLE]

which now implies that there exists an elliptic curve with $j(E)=0$ and a point of order $169$ over $F^{\prime}$, contradicting [1, Theorem 6.2].

∎

2.4. Points of order $37$

The following lemma allows us to deal with points of order $37$ over number fields of degree $12$, which is the smallest degree over which an elliptic curve defined over $\mathbb{Q}$ can have a point of order $37$.

Lemma 2.9**.**

Let $E/\mathbb{Q}$ be an elliptic curve. Then $E$ has a point of order $37$ over a degree $12$ number field $K$ if and only if $j_{E}=-7\cdot 11^{3}$. Moreover, $K$ has to be $K=\mathbb{Q}(\alpha,\sqrt{\frac{1}{d}\cdot f(\alpha)})$ where $f(x)=x^{3}-1155x+16450$, $d\in\mathbb{Q}$ is such that $E$ is $\mathbb{Q}$-isomorphic to the elliptic curve $dy^{2}=f(x)$ and $\alpha$ is a root of the irreducible polynomial

[TABLE]

In particular, $E(K)_{\operatorname{tors}}=\mathbb{Z}/37\mathbb{Z}$.

Proof.

From [16, Table 2] it follows that $E$ has a point of order 37 over a degree 12 field if and only if $G_{E}(37)=\texttt{37.B.8.1}$, which happens if and only if $j_{E}=-7\cdot 11^{3}$ (see [40, Theorem 1.10. (ii)]). We note that the elliptic curve $E^{\prime}:y^{2}=f(x)$ has $j_{E^{\prime}}=-7\cdot 11^{3}$ and therefore there exists a number field $L$ of degree $12$ such that $E^{\prime}$ has a point of order $37$ over $L$ (see [33, Section 6]). We have that $g(x)$ is an irreducible factor of the $37$-division polynomial of $E^{\prime}$. In particular $\alpha=x(P)$ where $P$ is a point of order $37$ in $E^{\prime}$ and $L=\mathbb{Q}(P)=\mathbb{Q}(\alpha,\sqrt{f(\alpha)})$. Now if $E/\mathbb{Q}$ is an elliptic curve with $j_{E}=-7\cdot 11^{3}$, it will be a quadratic twist of $E^{\prime}$; thus $E$ will have a model $E\,:\,dy^{2}=f(x)$ for some $d\in\mathbb{Q}$. In particular, $R=(\alpha,\sqrt{\frac{1}{d}\cdot f(\alpha)})$ is a point of order $37$ on $E$. Then we obtain $K=\mathbb{Q}(R)$ and get the desired result.

Let us prove $E(K)_{\operatorname{tors}}=\mathbb{Z}/37\mathbb{Z}$. The curve $E$ cannot have full $37$-torsion over $K$ by the Weil pairing and cannot have a point of order $37^{2}$ by Lemma 2.8. The set of non-surjective primes only depends on the $j$-invariant of $E$ ([38, Lemma 5.27]). Therefore it is enough to compute this set for a single elliptic curve with that $j_{E}=-7\cdot 11^{3}$. We have that the elliptic curve $E^{\prime}$ of minimal conductor with $j_{E^{\prime}}=-7\cdot 11^{3}$ has LMFDB label 1225.b2.

We see in the LMFDB‡‡‡Note that the data for non-CM elliptic curves over $\mathbb{Q}$ in the LMFDB provably includes all p for which the mod-p representation is non-surjective (this has been verified using Zywina’s algorithm [40], see https://www.lmfdb.org/EllipticCurve/Q/Reliability). (or alternatively explicitly compute) that $37$ is the only non-surjective prime for this elliptic curve. So if $E(K)$ had a point $P$ of order $\ell\neq 37$, $\mathbb{Q}(P)$ would have to be a subfield of $K$ and $\ell^{2}-1$ would have to divide $12$. We see that the only possibility is that $\ell=2$. But the field $\mathbb{Q}(P)$ generated by a point of order $2$ will not be Galois over $\mathbb{Q}$, since the mod $2$ representation is surjective, and hence cannot be a subfield of the cyclic field $K$ (we see that $K$ is cyclic as it is generated by a point lying in the kernel of an isogeny, see [8, Lemma 4.8]).

∎

2.5. Points of order $17$

We obtain similar results as in Lemma 2.9, but for order $17$ and for number fields of degree $8$, which is the smallest degree over which an elliptic curve defined over $\mathbb{Q}$ can have a point of order $17$.

Lemma 2.10**.**

Let $E/\mathbb{Q}$ be an elliptic curve. Then $E$ has a point of order $17$ over a degree $8$ number field $K$ if and only if $j_{E}=-17\cdot 373^{3}/2^{17}$. Moreover, $K$ has to be $K=\mathbb{Q}(\alpha,\sqrt{d\cdot f(\alpha)})$ where $f(x)=x^{3}-95115x-12657350$, $d\in\mathbb{Q}$ is such that $E$ is $\mathbb{Q}$-isomorphic to the elliptic curve $dy^{2}=f(x)$ and $\alpha$ is a root the irreducible polynomial

[TABLE]

In particular $E(K)_{\operatorname{tors}}=\mathbb{Z}/17\mathbb{Z}$.

Proof.

By the same arguments as in Lemma 2.9, we get that an elliptic curve $E/\mathbb{Q}$ such that $E$ gains a point of order $17$ over a number field $K$ of degree $8$ has $j_{E}=-1\cdot 2^{-17}\cdot 17\cdot 373^{3}$ (see [16, Table 2] and [40, Theorem 1.10. (i)]) and $17$ is the only surjective prime§§§This can be read off from LMFDB - see the footnote in Lemma 2.9. for all such curves. Note that in this case the quadratic twist with minimal conductor of $E^{\prime}$ has LMFDB label 14450.o2.

Let us prove $E(K)_{\operatorname{tors}}=\mathbb{Z}/17\mathbb{Z}$. The curve $E$ cannot have full $17$-torsion over $K$ by the Weil pairing and cannot have a point of order $17^{2}$ by Lemma 2.8. So if $E(K)$ had a point $P$ of order $\ell\neq 17$, $\mathbb{Q}(P)$ would have to be a subfield of $K$ and $\ell^{2}-1$ would have to divide $8$. We see that the only possibility is that $\ell=3$. But there cannot be any points of order $3$ over $K$, as $K$ is cyclic (as it is generated by a point lying in the kernel of an isogeny, see [8, Lemma 4.8]) and $\mathbb{Q}(P)$ will not be Galois over $\mathbb{Q}$ for any $P\in E[3]$.

∎

2.6. Some special degrees

From the results proved in this section, we immediately obtain the following result.

Lemma 2.11**.**

Let $d=22$ or $26$ and $E/\mathbb{Q}$ an elliptic curve. Then there is no primitive torsion growth over any number field of degree $d$.

Proof.

Suppose the opposite, in particular that for some $P\in E(\overline{\mathbb{Q}})_{tors}$, we have $[\mathbb{Q}(P):\mathbb{Q}]=d$. Let $K=\mathbb{Q}(P)$. From [16, Theorem 5.8] we see that there is no primitive $\ell$-torsion growth over $K$ for any prime $\ell$. Moreover, we see that there can be no points of order $\ell\geq 11$ over $K$ at all. It remains to check whether the $\ell$-power torsion cannot grow from a subfield of $K$ to $K$ for $\ell\leq 7$. If $P$ is a point of order $\ell^{k}$, then it would follow that $\mathbb{Q}(P)\subset\mathbb{Q}(E[\ell^{k}])$ for some $k$. So in particular $[\mathbb{Q}(P):\mathbb{Q}]=d$ divides $[\mathbb{Q}(E[\ell^{k}]):\mathbb{Q}]=|G_{E}(\ell^{k})|$. Since $G_{E}(\ell^{k})$ is a subgroup of $\operatorname{GL}_{2}(\mathbb{Z}/\ell^{k}\mathbb{Z})$, it follows that $d$ divides $\#\operatorname{GL}_{2}(\mathbb{Z}/\ell^{k}\mathbb{Z})$. This is easily seen to be a contradiction for all $\ell\leq 7$. By the same argument, the extension over which a subgroup of the form $\mathbb{Z}/l^{m}\mathbb{Z}\times\mathbb{Z}/l^{n}\mathbb{Z}$ is first defined cannot be of degree $22$ or $26$. More generally, one can deduce the same result for a group of the form $\mathbb{Z}/m\mathbb{Z}\times\mathbb{Z}/n\mathbb{Z}$ for integers $n$ and $m$ divisible by multiple primes. ∎

3. The algorithm

In this section we describe our algorithm. We always strive to make the algorithm useful in practice, and not to obtain an algorithm with small worst-case complexity. The reason for this is that in most cases, standard conjectures tell us that certain things will not happen, so we do not worry too much about the run-times of events that are conjecturally impossible. To give an explicit example, it is widely believed (see Conjecture 2.1) that $G_{E}(\ell)=\operatorname{GL}_{2}(\mathbb{F}_{\ell})$ for all $\ell>37$ and all non-CM elliptic curves over $\mathbb{Q}$. Hence, we focus on trying to quickly prove that indeed $G_{E}(\ell)=\operatorname{GL}_{2}(\mathbb{F}_{\ell})$, and not worry too much on the run-time of what happens if $G_{E}(\ell)\neq\operatorname{GL}_{2}(\mathbb{F}_{\ell})$ for $\ell>37$, which, as already noted, conjecturally never happens.

We will use the following notation/definition in the algorithm.

Definition 1**.**

For an elliptic curve $E/\mathbb{Q}$ and a positive integer $d$, we define $R(d,E)$ to be the set of primes such that there exists a number field $K$ of degree $d^{\prime}|d$ such that there is primitive $\ell$-power torsion growth over $K$.

Recall that in [16] the set $R_{\mathbb{Q}}(d)$ is defined to be the set of all primes $\ell$ such that there exists a point of order $\ell$ on some elliptic curve $E/\mathbb{Q}$ over some number field of degree $d$. Note that $R_{\mathbb{Q}}(d)$ is unconditionally known for all $d<3.343.296$ (and in the larger cases we know a set containing $R_{\mathbb{Q}}(d)$), so for all values of $d$ in which one hopes to be able to run the algorithm.

The algorithm consists of 3 sub-algorithms.

Algorithm 1: $R(d,E)$

Input: An elliptic curve $E/\mathbb{Q}$ and integer $d$.

Output: The set $R(d,E)$

1. (1)

Set $R(d,E):=\emptyset$. 2. (2)

If the largest prime divisor of $d$ is larger than $7$, exit this algorithm and return $R(d,E)=\emptyset$. 3. (3)

Compute $R_{\mathbb{Q}}(d)$ using [16, Corollary 6.1]. 4. (4)

For $\ell\in R_{\mathbb{Q}}(d)$ compute $G_{E}(\ell)$. 5. (5)

For $\ell\in R_{\mathbb{Q}}(d)$ compute the degrees $n$ of number fields over which there is $\ell$-torsion, depending on $G_{E}(\ell)$ using [16, Table 1 $\&$ 2] and [16, Theorem 3.2] for non-CM curves and [16, Theorem 3.6 and 5.6 ] for CM curves. If any such $n$ divides $d$, add $\ell$ to $R(d,E)$. 6. (6)

Return $R(d,E)$.

Remark 3.1*.*

Algorithm 1 is used to determine the (finite) set of primes $\ell$ such that there will be primitive $\ell$-power torsion growth over number fields of degree $d^{\prime}$ dividing $d$.

Remark 3.2*.*

Step (2) follows from [16, Theorem 7.1. (i)]. In step (4), we compute $G_{E}(\ell)$ using the algorithm sketched in [40, 1.8.].

Algorithm 2: $\ell$-primary torsion growth

In this algorithm we will store a point or points generating the torsion group of $E(K)$. These are necessary for computing the $\ell$-power torsion, but will not be returned in the output of the algorithm (although they could be), as they will not be necessary. We will also store an auxiliary sequence $F$ of pairs $(F_{i},(P_{i},Q_{i}))$, where $F_{i}=\mathbb{Q}(E[\ell^{i}])$ and $P_{i}$ and $Q_{i}$ generate the $\ell^{i}$-torsion of $E$ and such that $[F_{i}:\mathbb{Q}]$ divides $d$. In Algorithm 2, $F_{i}$ will always denote $\mathbb{Q}(E[\ell^{i}])$.

Input: An elliptic curve $E/\mathbb{Q}$, $d\in\mathbb{Z}_{+}$, a prime $\ell$

Output: A set $A$ of all pairs $(K,T)$ such that $E$ has primitive $\ell$-power torsion growth over $K$, the group $T:=E(K)[\ell^{\infty}]$ and such that $[K:\mathbb{Q}]$ divides $d$.

1. (1)

$A:=\emptyset$ and $F:=\emptyset$. 2. (2)

If $E(\mathbb{Q})[\ell]\neq\{0\}$: Set $A:=A\cup(\mathbb{Q},E(\mathbb{Q})[\ell],S)$, where $S$ is a set of generators of $E(\mathbb{Q})[\ell]$. If $\#G_{E}(\ell)$ divides $d$, then factor $\psi_{\ell}$, set $F_{1}=\mathbb{Q}(E[\ell])$¶¶¶We have $\mathbb{Q}(E[\ell])=F_{1}$ by [38, Lemma 5.17]. to be the field defined by an irreducible factor of degree $>1$ and set $A:=A\cup(F_{1},(\mathbb{Z}/\ell\mathbb{Z})^{2},S)$ and $F:=(F_{1},S)$, where $S$ is a set of generators of $E[\ell]$. 3. (3)

If $E(\mathbb{Q})[\ell]=\{0\}$: Explicitly determine the triples $(K_{i}:=\mathbb{Q}(P_{i}),\mathbb{Z}/\ell\mathbb{Z},\{P_{i}\})$ for all $P_{i}\in E[\ell]$ by factoring the $\ell$-division polynomial $\psi_{\ell}$, keeping only one number field up to isomorphism. Add all these triples to $A$. For all $K_{i}$ constructed, check whether $\#G_{E}(\ell)=[K_{i}:\mathbb{Q}]$ for any $i$; if yes, change $(K_{i},\mathbb{Z}/\ell\mathbb{Z},\{P_{i}\})$ to $(K_{i},(\mathbb{Z}/\ell\mathbb{Z})^{2},S)$ and $F:=F\cup(F_{1},S)$, where $S$ generates $E[\ell]$. 4. (4)

Set $k:=2$. Repeat: if ($\ell<11$ or $d\geq 55$) and ($\ell\neq 5$ or $k=2$ or $d\geq 50$) and ($\ell\neq 7$ or $d\geq 42$)

• (i)

Compute the primitive $\ell^{k}$-division polynomial $\psi_{\ell^{k}}/\psi_{\ell^{k-1}}$, as a polynomial in $\mathbb{Z}[x]$, reduce it modulo small primes $p$ of good reduction different from $\ell$, factor it over $\mathbb{F}_{p}[x]$, and check whether there are any irreducible factors of degree dividing $d$ for each prime $p$. If not, then exit the loop.

• (ii)

Now for each element $(K_{i},T,S)$ that we have in $A$, for each cyclic subgroup of $T$ of order $\ell^{k-1}$ (if it exists): select a generator $Q$. Factor over $K_{i}$ the polynomial

[TABLE]

where $\phi_{\ell}$ and $\psi_{\ell}$ are as defined in [39, Chapter 3.2. p.81] ∥∥∥We use [38, Corollary 5.18] where possible. By [39, Theorem 3.6] we have that $x(Q)=\frac{\phi_{\ell}(x)}{\psi_{\ell}(x)^{2}},$ for any $P=(x,y)$ such that $Q=\ell P$. Using this step is crucial (instead of factoring $\ell^{k}$-division polynomials) as one uses the polynomial (1) of degree $\ell^{2}$ (over number fields) instead of factoring (over $\mathbb{Q}$) the primitive $\ell^{k}$-division polynomial, which is of degree $\ell^{2k-2}(\ell^{2}-1)/2$.. Let $P_{i}$ be a point of order $\ell^{k}$ such that $x(P_{i})$ is a root of $g_{i}$.

If $[\mathbb{Q}(P_{i}):\mathbb{Q}]$ divides $d$, define $T^{\prime}$ by as follows: if $T$ was $\mathbb{Z}/\ell^{k-1}\mathbb{Z}\times\mathbb{Z}/\ell^{j}\mathbb{Z}$ for some $j$, then $T^{\prime}:=\mathbb{Z}/\ell^{k}\mathbb{Z}\times\mathbb{Z}/\ell^{j}\mathbb{Z}$. Add the field $\mathbb{Q}(P_{i})$, the subgroup $T^{\prime}$ and its generators into $A$, where the generators of $T^{\prime}$ are obtained by taking the generators of $T$ and replacing $\ell P_{i}$ by $P_{i}$.

• (iii)

For each element $(K_{i},\mathbb{Z}/{\ell^{k}}\mathbb{Z}\times\mathbb{Z}/{\ell^{n}}\mathbb{Z},S)$ in $A$, check whether $K_{i}F_{j}$ is of degree dividing $d$ for $j=n+1,\ldots,k-1$. If yes, add $(K_{i}F_{j},\mathbb{Z}/{\ell^{k}}\mathbb{Z}\times\mathbb{Z}/{\ell^{j}}\mathbb{Z},S^{\prime})$ to $A$ and if furthermore $K_{i}F_{j}=K_{i}$, then remove the triple $(K_{i},\mathbb{Z}/{\ell^{k}}\mathbb{Z}\times\mathbb{Z}/{\ell^{n}}\mathbb{Z},S)$ from $A$.

• (iv)

Check whether $F_{k}$ is of degree dividing $d$ by checking whether in $A$ there exists an entry $(K_{i},\mathbb{Z}/{\ell^{k}}\mathbb{Z}\times\mathbb{Z}/{\ell^{k-1}}\mathbb{Z},S)$; if yes, check whether the element $P\in S$ of order $\ell^{k-1}$ is divisible by $\ell$ over $K_{i}$. If yes, change the previous entry into $(K_{i},\mathbb{Z}/{\ell^{k}}\mathbb{Z}\times\mathbb{Z}/{\ell^{k}}\mathbb{Z},S^{\prime})$, where $S^{\prime}=\{Q,R\}$ is obtained from $S=\{P,Q\}$, where $Q$ is of order $\ell^{k}$ and $\ell R=P$ and add $(F_{k}:=K_{i},S^{\prime})$ to $F$.

• (v)

$k:=k+1$;

until the first occurrence that there are no points of order $\ell^{k}$ in A. 5. (5)

Return A.

Remark 3.3*.*

The conditions at the beginning of (4) come from Lemmas 2.6, 2.7 and 2.8, and make the algorithm much faster for "small" ($<50$) degrees, i.e. in all the ones where it is feasible to use the algorithm in practice.

In ((iii)) (iii), if $K_{i}F_{j}$ is not of degree dividing $d$, then neither is $K_{i}F_{j+1}$, so we can stop for the smallest $j$ such $K_{i}F_{j}$ is not of degree dividing $d$.

In (5), the generators of the torsion groups can be deleted from $A$, as they will not be used again later.

Algorithm 3: Combining different $\ell$-primary torsion growths

Input: A positive integer $d$, a set $A$ of all pairs $(K,T)$ such that $E$ has primitive $\ell$-power torsion growth over $K$ for some prime $\ell$, where $[K:\mathbb{Q}]$ divides $d$, and the group $T:=E(K)[\ell^{\infty}]$.

Output: A set $B$ of all pairs $(K,T)$ where $E$ has primitive torsion growth over $K$ and such that $[K:\mathbb{Q}]$ divides $d$, and where $T:=E(K)_{\operatorname{tors}}$.

1. (1)

To each pair $(K,T)$ previously obtained we adjoin the set $\{(\ell,K^{\ell})\}$ where $\ell$ is a prime such that $T$ is an $\ell$-group and $K^{\ell}:=K$ . So we get triples $(K,T,\{(\ell,K)\})$. For a triple $(K,T,S)$, where $S:=\{(\ell,K)\}$, we will denote by $S^{\prime}:=\bigcup_{a\in S}{a[1]}$ the set of all first coordinates of $S$. 2. (2)

Set $k:=2$; Repeat: new:=false;

• (i)

For each pair of triples $(K_{i},T_{i},S_{i})$ and $(K_{j},T_{j},S_{j})$ satisfying $|S_{i}^{\prime}\cup S_{j}^{\prime}|=|S_{i}\cup S_{j}|=k$ check whether the degree of $K_{i}K_{j}$ divides $d$. If yes put new:=true and construct the triple $(K_{i}K_{j},T,S_{i}\cup S_{j})$ where

[TABLE]

and add it to the set.

• (ii)

If new=false, exit the loop and return the obtained results, forgetting the third element of the triples from $B$, i.e returning just the values $(K,T)$. If new=true, set $k:=k+1$.

Remark 3.4*.*

Note that in the previous algorithm the elements in $S_{i}$ and $S_{j}$ are the same only if both coordinates are the same.

Finally the whole algorithm:

Algorithm TorsionGrowth

Input: An elliptic curve $E/\mathbb{Q}$ and a positive integer $d$.

Output: A sequence of all pairs $(K,T)$ of a number field $K$ of degree $d^{\prime}$ such that $d^{\prime}|d$ and that $E$ has primitive torsion growth over $K$, together with the group $T:=E(K)_{\operatorname{tors}}$.

1. (1)

$R(d,E):=\texttt{Algorithm1(E,d)}$ 2. (2)

$A:=\emptyset$

For $\ell\in R(d,E)$:

 \mbox{\,}\qquad\qquad A:=A\,\cup\,\texttt{Algorithm2(E,\ell,d)} 3. (3)

$B:=\texttt{Algorithm3(A,d)}$ 4. (4)

Check whether in $B$ there are pairs $(K_{1},T_{1})$ and $(K_{2},T_{2})$ such that $K_{1}\simeq K_{2}$ and $T_{1}\geq T_{2}$. If yes, remove $(K_{2},T_{2})$ from $B$. 5. (5)

Return $B$

4. Computational results

One of the main motivations for the development of our algorithm is to get computational evidence of how the torsion grows when we consider an elliptic curve defined over $\mathbb{Q}$ base change to a number field of fixed degree.

Our algorithm takes as input an elliptic curve $E$ defined over $\mathbb{Q}$ and a positive integer $d$ and outputs all the pairs $(K,H)$ (up to isomorphism) where $K$ is a number field of degree dividing $d$, $E$ has primitive torsion growth over $K$, and $E(K)_{\operatorname{tors}}\simeq H$. We denote by $\mathcal{H}_{\mathbb{Q}}(d,E)$ the multiset formed by the groups $H$ obtained in the above computation. Note that we are allowing the possibility of two (or more) of the torsion subgroups $H$ being isomorphic if the corresponding number fields $K$ are not isomorphic. We call the set $\mathcal{H}_{\mathbb{Q}}(d,E)$ the set of torsion configurations of degree $d$ of the elliptic curve $E/\mathbb{Q}$. We let $\mathcal{H}_{\mathbb{Q}}(d)$ denote the set of $\mathcal{H}_{\mathbb{Q}}(d,E)$ as $E$ runs over all elliptic curves defined over $\mathbb{Q}$ such that $\mathcal{H}_{\mathbb{Q}}(d,E)\neq\{E(\mathbb{Q})_{\operatorname{tors}}\}$, that is $E$ has torsion growth over a number field of degree $d$. For $S\in\mathcal{H}_{\mathbb{Q}}(d)$ define $N_{\mathbb{Q}}(S)$ to be the minimum conductor $N_{\mathbb{Q}}(E)$ such that $\mathcal{H}_{\mathbb{Q}}(d,E)=S$ and we denote by $N_{\mathbb{Q}}(d)$ the maximum******Note that the smallest integer $B$ such that for every torsion group $T$ possible over $\mathbb{Q}$ there exists an elliptic curve $E$ with $E(\mathbb{Q})_{\operatorname{tors}}=T$ and $N_{\mathbb{Q}}(E)\leq B$ is $B=210$. of $N_{\mathbb{Q}}(S)$ for all $S\in\mathcal{H}_{\mathbb{Q}}(d)$. Note that if we denote the maximum of the cardinality of the sets $S$ when $S\in\mathcal{H}_{\mathbb{Q}}(d)$ by $h_{\mathbb{Q}}(d)$, then $h_{\mathbb{Q}}(d)$ gives the maximum number of field extension of degrees dividing $d$ where there is primitive torsion growth. The sets $\mathcal{H}_{\mathbb{Q}}(d)$ have been completely determined for $d=2,3,5,7$ and for any $d$ not divisible by a prime smaller than $11$ (see [19, 15, 12, 16]). From these results, one can read out the value of $h_{\mathbb{Q}}(d)$ for $d=2,3,5,7$ (see [34] for a different approach to obtain $h_{\mathbb{Q}}(2)$). For $d=4,6$, exhaustive computations to obtain bounds on the above sets and values have been carried out (see [14, 7]).

As $d$ grows, all these problems become much more difficult, so it makes sense to obtain lower bounds on some of these sets, where possible. We will obtain such a lower bound for $d\leq 23$, by finding all the possible torsion groups of the $2.483.649$ elliptic curves of conductor less than $400.000$ over number fields of degree up to $23$. We chose to stop at $23$ (although it could probably be feasible to do computations for a few more degrees), as this is the largest degree of number fields that have been included in the LMFDB at the moment of writing of this paper. The algorithm has been implemented in Magma [3] and can be found in the online supplement [17].

Table 1 gives a short overview of our computations. For the sake of simplicity we denote in Table 1 by $(n)$ and $(n,m)$ the groups $\mathbb{Z}/n\mathbb{Z}$ and $\mathbb{Z}/n\mathbb{Z}\times\mathbb{Z}/m\mathbb{Z}$, respectively. The values in the table are:

• •

1st column: degree $d$.

• •

2nd column: the set $\Theta(d)$ consisting of all the possible torsion subgroups $H$ such that there exists an elliptic curve $E/\mathbb{Q}$ and a number field $K$ of degree $d$ such that there is primitive torsion growth over $K$ and such that $E(K)_{\operatorname{tors}}=H$. Or in the other words, the subgroups in $\Phi_{\mathbb{Q}}(d)$ that do not appear in $\Phi_{\mathbb{Q}}(d^{\prime})$ for any proper divisor $d^{\prime}|d$.

• •

3rd column: a lower bound of $h_{\mathbb{Q}}(d)$ (or the exact value, where it is known), the maximum number of field extension of degrees dividing $d$ where there is primitive torsion growth.

• •

4th column: a lower bound of $N_{\mathbb{Q}}(d)$, the minimum value such that there exist elliptic curves over $\mathbb{Q}$ of conductor less than $N_{\mathbb{Q}}(d)$ with every possible torsion configuration over number fields of degree $d$.

• •

5th column: a lower bound of $\#\mathcal{H}_{\mathbb{Q}}(d)$, the number of torsion configurations over number fields of degree $d$.

Remark 4.1*.*

In Table 1 the degrees over which we know that there is no primitive torsion growth ($d=11,13,17,19,22,23$) have been excluded. The fact that there is no primitive torsion growth over number fields of degree $d=22$ follows from Lemma 2.11.

Table 1 gives some useful information to conjecture upon. Note that any group in $\Phi_{\mathbb{Q}}(d)$ will also arise in $\Phi_{\mathbb{Q}}(dk)$ for any $k\in\mathbb{Z}^{+}$ [2, Theorem 2.1. a)]. We conjecture that the groups we found are all that are possible.

Conjecture 4.2**.**

Let $d\leq 23$ and define $\Theta(d)$ to be the set of groups found in Table 1 for each $d$. Then $\Phi_{\mathbb{Q}}(d)$ consists of the union of all $\Theta(d^{\prime})$ such that $d^{\prime}\mid d$.

Remark 4.3*.*

The 4th column in Table 1 gives a lower bound for $N_{\mathbb{Q}}(d)$. When this value is very far from $400.000$ (the bound for the conductor up to which we tested), this might suggest more strongly that the corresponding $\Phi_{\mathbb{Q}}(d)$ is as stated in Conjecture 4.2, and one should consider that the case for the conjecture stronger in these cases. This happens for $d\neq 8,16,18$. The 3rd and 5th columns and the values $h_{\mathbb{Q}}(d)$ and $\#\mathcal{H}_{\mathbb{Q}}(d)$ give information about the complexity of the torsion growth and how often it happens over the given degree $d$. The values seem to grow with the powers of $2$ and $3$ dividing $d$, which is to be expected. The highest values correspond to $d=16,12,18,8$ in that order. In particular, when $d$ is divisible by a power of $2$ these values grow considerably.

In the online supplement [17] we give more data about our computations. For each degree $d\leq 23$ we include the following:

• •

For any $G\in\Phi_{\mathbb{Q}}(1)$ we include a table with a lower bound for the set $\Phi_{\mathbb{Q}}(d,G)$.

• •

For each torsion configuration $S\in\mathcal{H}_{\mathbb{Q}}(d)$ obtained, we provide the Cremona label [6] of the elliptic curve $E/\mathbb{Q}$ with minimal conductor such that $S=\mathcal{H}_{\mathbb{Q}}(E,d)$.

Remark 4.4*.*

At the moment of writing this paper, each elliptic curve defined over $\mathbb{Q}$ with conductor less than $400.000$ and for any degree $d\leq 7$, the data obtained with our algorithm appears in LMFDB. We have in plan to include all the data for $d\leq 23$. Moreover, all our data is already at the Cremona’s Elliptic Curve Data [6] in Table Eleven: Torsion Growth.

4.1. Primitive torsion growth

An interesting question is to restrict our attention to the case of primitive torsion growth of exactly a fixed degree instead of the whole growth over number fields of degree dividing a fixed degree. For a positive integer $d$, we denote by $\Psi_{\mathbb{Q}}(d)\subseteq\Phi_{\mathbb{Q}}(d)$ the set of groups, up to isomorphism, that appear as primitive torsion growth of an elliptic curve defined over $\mathbb{Q}$ over a number field of degree $d$. In the same vein, we define $\Psi_{\mathbb{Q}}(d,G)$, $\mathcal{G}_{\mathbb{Q}}(d,E)$, $\mathcal{G}_{\mathbb{Q}}(d)$, $g_{\mathbb{Q}}(d)$, $M_{\mathbb{Q}}(d)$ analogously as we did $\Phi_{\mathbb{Q}}(d,G)$, $\mathcal{H}_{\mathbb{Q}}(d,E)$, $\mathcal{H}_{\mathbb{Q}}(d)$, $h_{\mathbb{Q}}(d)$, $N_{\mathbb{Q}}(d)$, respectively.

In Table 2 we include a lower bound for the set $\Psi_{\mathbb{Q}}(d)$ for $d\leq 23$. In particular, in each line the first column is the degree $d$, the second column includes the cyclic groups $\mathbb{Z}/n\mathbb{Z}$, denoted by $(n)$, that we have obtained, and the rest of the columns $\mathbb{Z}/m\mathbb{Z}\times\mathbb{Z}/mn\mathbb{Z}$, denoted by $(m,mn)$, for $2\leq m\leq 9$.

In Table 3 we show lower bounds for the values $g_{\mathbb{Q}}(d)$, $M_{\mathbb{Q}}(d)$ and $\#\mathcal{G}_{\mathbb{Q}}(d)$ for $d\leq 23$ non-prime.

Again, in the online supplement [17] we give more data which gives lower bounds on the sets $\Psi_{\mathbb{Q}}(d,G)$ and the Cremona labels of the elliptic curves $E/\mathbb{Q}$ with minimal conductor for each torsion configuration in $\mathcal{G}_{\mathbb{Q}}(d)$ that we have obtained.

Similarly to Conjecture 4.2 we can state the following conjecture in the case of primitive torsion growth:

Conjecture 4.5**.**

Let $d\leq 23$ and define $\Omega(d)$ to be the set of groups found in Table 2 for each $d$. Then $\Psi_{\mathbb{Q}}(d)=\Omega(d)$.

Remark 4.6*.*

Similarly as with $N_{\mathbb{Q}}(d)$ in Table 1, $M_{\mathbb{Q}}(d)$ can be considered to be a measure of how strongly we should believe $\Psi_{\mathbb{Q}}(d)=\Omega(d)$ for a particular $d$. The values $g_{\mathbb{Q}}(d)$ and $\#\mathcal{G}_{\mathbb{Q}}(d)$ measure how often primitive torsion growth happens and how complex it can be over the given degree $d$. As before, we get more primitive torsion growth and more torsion configurations when $d$ is divisible by $3$, and especially $2$.

4.2. Heuristical complexity

Here we give a heuristical complexity of our algorithm. By the results of [16], we can assume that for a large enough $d$, the largest prime $\ell\in R(d,E)$ will be of size $\sim\sqrt{d}$.

There are 2 parts in our algorithm that should heuristically have a worst case running time $O(d^{18+\epsilon})$ for a fixed elliptic curve $E$. The first one is checking whether a point of order $\ell$ is divisible by $\ell$ in Algorithm $2$, where $\ell$ is a prime of size $\sqrt{d}$, in case factorization of the reduction of the primitive $\ell^{2}$-division polynomial modulo small primes in step $4(i)$ in Algorithm $2$ always has factors of degree dividing $d$. Then in the worst case, we will need to factor a polynomial of degree approximately $d$ over a number field of degree $d$, which is of complexity $O(d^{18+\epsilon})$ (see [27]).

The other is checking whether 2 number fields of degree $d$ are isomorphic and similarly checking whether 2 number fields of degree approximately $d$ have compositum of degree dividing $d$. The way we implemented both of these functions (as the built-in MAGMA functions were far too slow) is by factoring the defining polynomial of one field over the other, which again has complexity $O(d^{18+\epsilon})$ (as before, see [27]).

Each of these operations should be expected to occur $O(d^{\epsilon})$ times, which leads us to our expected complexity of $O(d^{18+\epsilon})$.

In practice, for small values of $d$, the only ones for which this problem can be solved in practice, one should expect that algorithm $2$ will be the bottleneck of the computations, as the primes $\ell\in R(d,E)$ can be larger than $\sqrt{d}$. In the computations we performed, Algorithm 2 took about $75\%$ of the total running time.

4.3. Timing

We ran our algorithm for all elliptic curves defined over $\mathbb{Q}$ of conductor less than $400.000$ and for degree $d\leq 23$ on the Number Theory Warwick Grid, in particular at two computers (atkin and lehner) with 64 CPUs at 2.50 GHz and 128GB of memory RAM each. In Table 4 we show for each degree $d$ the total time of the whole computation, the maximum time taken for a single elliptic curve, and other statistics. Note that this project used roughly $2.7$ cpu-years of computing time.

5. On sporadic torsion

Another motivation for our computations are sporadic points on the modular curves $X_{1}(m,n)$.

Definition 2**.**

Let $m,n$ positive integers such that $m|n$. We say that a degree $d$ non-cuspidal point on the modular curve $X_{1}(m,n)$ is sporadic if there exists only finitely many degree $d$ points on $X_{1}(m,n)$.

Obviously there exists a non-cuspidal sporadic point on $X_{1}(m,n)$ if and only if $\mathbb{Z}/m\mathbb{Z}\times\mathbb{Z}/n\mathbb{Z}\in\Phi(d)\backslash\Phi^{\infty}(d)$.

There exist no sporadic points on modular curves $X_{1}(m,n)$ of degree $d\leq 2$, and hence the aforementioned elliptic curve with $\mathbb{Z}/21\mathbb{Z}$ torsion over a cubic field provides the lowest possible degree of a sporadic point on $X_{1}(n)$. There are many examples of sporadic points on $X_{1}(n)$ of degree $\geq 5$, see [22] for a long list. The fact that many of these in fact correspond to sporadic points follows from [10, Table 1 and Lemma 1].

It is somewhat surprising that there is no (to our knowledge) known example of a sporadic point on $X_{1}(m,n)$ for $m\geq 2$. Hence it is interesting to ask what is the lowest possible degree of a sporadic point on $X_{1}(m,n)$ for $m\geq 2$. During our computation, we find a degree $6$ sporadic non-cuspidal point on $X_{1}(4,12)$ about which we will say more in Section 5.1.

5.1. A degree 6 sporadic point on $X_{1}(4,12)$

As mentioned in the previous section, during our computations of torsion growth for elliptic curves of conductor less than 400.000, we found two elliptic curve with $\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$ torsion over a sextic field. By [9, Theorem 1.1], there are only finitely many such curves over sextic fields, so these curves induce sporadic points on $X_{1}(4,12)$.

We prove a stronger result below.

Theorem 5.1**.**

Let $E$ be an elliptic curve defined over $\mathbb{Q}$ and $K/\mathbb{Q}$ such that $[K:\mathbb{Q}]=6$. If $E(K)_{\operatorname{tors}}=\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$ then the LMFDB label of $E$ is 162.d2 or 1296.l2. In particular, $j(E)=109503/64$.

Proof.

Let $E$ be an elliptic curve defined over $\mathbb{Q}$ and $K/\mathbb{Q}$ a sextic field such that $E(K)_{\operatorname{tors}}=\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$. First notice that $E$ does not have CM by [5, §4.6]. Denote by $G:=E(\mathbb{Q})_{\operatorname{tors}}$ and $H:=E(K)_{\operatorname{tors}}$. Let $G_{2}$ (resp. $H_{2}$) denote the $2$-primary part of $G$ (resp. $H$). Then by the classification of the possible growth of the $2$-primary part of the torsion over sextic fields (cf. [7, Proposition 6 (b), Table 2]) we have that $G$ is trivial, $\mathbb{Z}/3\mathbb{Z}$, $\mathbb{Z}/4\mathbb{Z}$, $\mathbb{Z}/12\mathbb{Z}$, or $\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/4\mathbb{Z}$. The first two cases occur: if $E$ has LMFDB label 162.d2 or 1296.l2 then $H=\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$, and $G=\mathbb{Z}/3\mathbb{Z}$ or $G$ is trivial, respectively. Let us remove the other three cases:

• $\bullet$

$G\neq\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/4\mathbb{Z}$ since if $\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/4\mathbb{Z}\subset G$ then $\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}\not\subset H$; see the Remark below [14, Theorem 7].

• $\bullet$

$G\neq\mathbb{Z}/12\mathbb{Z}$ since otherwise $G_{2}=\mathbb{Z}/4\mathbb{Z}$ and $H_{2}=\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/4\mathbb{Z}$. The first author together with Lozano-Robledo, based on the classification of all the possible 2-adic images of Galois representations attached to elliptic curves without CM defined over $\mathbb{Q}$ given by Rouse and Zureick-Brown [35], computed the degree of the field of definition of the $\mathbb{Z}/2^{i}\mathbb{Z}\times\mathbb{Z}/2^{i+j}\mathbb{Z}$ torsion for $i+j\leq 6$ (cf. [13, 2primary_Ss.txt]). Using the above data it would follow that the number field $K$ would have to have a quadratic subfield and that $E$ would have full $4$-torsion over it. Then $E$ would have $\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$ torsion over this quadratic field, which is impossible [26, 25].

• $\bullet$

$G\neq\mathbb{Z}/4\mathbb{Z}$. Using the same argument as above, we see that $E$ has full $4$-torsion over a quadratic field. Since $\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}\not\in\Phi_{\mathbb{Q}}(d)$ for $d=2,3,4$, we have that the image of the mod $3$ representation is such that there does not exist a point $P\in E(\overline{\mathbb{Q}})[3]$ such that $[\mathbb{Q}(P):\mathbb{Q}]=1$ or $2$. On the other hand, by assumption, there exists a point $R\in E(\overline{\mathbb{Q}})[3]$ such that $[\mathbb{Q}(R):\mathbb{Q}]$ divides $6$. Checking for example [16, Table 1], we see that there is no mod $3$ Galois representation satisfying both these conditions.

Now if $G$ is trivial or $G=\mathbb{Z}/3\mathbb{Z}$ we have that $G_{2}$ is trivial and $H_{2}=\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/4\mathbb{Z}$. We check using [13] and [35] that this happens over a sextic number field if and only if the $2$-adic image correspond to the modular curve X20b (using the notation of [35]), implying that there exists a $t\in\mathbb{Q}$ such that $E$ is isomorphic to $E_{t}$, where:

[TABLE]

In particular,

[TABLE]

Now we need a point of order $3$ on $E_{t}$ defined over a subfield of a sextic number field. Checking [16, Table 1] we obtain that this could happen when $G_{E}(3)$ is 3Cs.1.1, 3B.1.1, 3Cs, 3B.1.2 or 3B. Then, thanks to the classification of mod $3$ Galois representation of [40, Theorem 1.2] we have that $j(E)=J_{1}(s)$ or $j(E)=J_{3}(s)$ for some $s\in\mathbb{Q}$, where:

[TABLE]

• $\bullet$

$j(E_{t})=J_{1}(s)$. Since $J_{1}(s)$ is a cube we have to solve the following Diophantine equation over $\mathbb{Q}$:

[TABLE]

This equation defines a curve $C$ of genus $2$, which is birational to $C^{\prime}\,:\,y^{2}=x^{6}-10x^{3}+27$. The Jacobian of $C^{\prime}$ has rank [math] over $\mathbb{Q}$, so it is easy to determine that the points on $C^{\prime}(\mathbb{Q})=\{\pm\infty\}$, from which it follows that $C(\mathbb{Q})=\{\pm\infty\}$. So there do not exist $t,s\in\mathbb{Q}$ satisfying $j(E_{t})=J_{1}(s)$.

• $\bullet$

$j(E_{t})=J_{3}(s)$. In this case the equation defines a genus $1$ curve, which is birational to the elliptic curve 48.a3 which has Mordell-Weil group over $\mathbb{Q}$ isomorphic to $\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/4\mathbb{Z}$. An easy computation shows that the possible $t$ are $7,-5,-1/2$ and $-5/4$. The following table shows for each $t$ the corresponding elliptic curve (by plugging in $t$ into the equation of $E_{t}$) and the torsion over $\mathbb{Q}$:

[TABLE]

Note that for the elliptic curve 162.d2 we have already obtained that the torsion over some sextic field is $\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$. For the remaining curves we check that only 1296.l2 has torsion $\mathbb{Z}/4\mathbb{Z}\times\mathbb{Z}/12\mathbb{Z}$ over a sextic field.

∎

Remark 5.2*.*

One might try to obtain more sporadic points by running a modification of our algorithm for a large number of elliptic curves $E$ with $j(E)\in\mathbb{Q}$.

Acknowledgements. We would like to thank Jeremy Rouse and David Zureick–Brown for sharing some useful data. We also thank John Cremona for providing access to computer facilities on the Number Theory Warwick Grid at University of Warwick, where the main part of the computations were done and for doing a massive check of all our computations, in particular rechecking that all the curves have the torsion growth we claim. We are greatly indebted to the referee for a very careful and helpful report that significantly improved all aspects of this paper.