Cyclicity of Elliptic Curves Modulo Primes in arithmetic progressions

TL;DR

This paper investigates the frequency with which the group of rational points on elliptic curves, reduced modulo primes in specific arithmetic progressions, is cyclic, addressing a special case of Serre's Cyclicity Conjecture.

Contribution

It provides new insights into the distribution of cyclic groups of elliptic curve reductions in arithmetic progressions, advancing understanding of Serre's Cyclicity Conjecture.

Findings

Identifies conditions under which the reduced elliptic curve groups are cyclic

Provides statistical data on cyclicity frequency in arithmetic progressions

Contributes to the validation of special cases of Serre's Cyclicity Conjecture

Abstract

We consider the reduction of an elliptic curve defined over the rational numbers modulo primes in a given arithmetic progression and investigate how often the subgroup of rational points of this reduced curve is cyclic as a special case of Serre's Cyclicity Conjecture.

Equations

$$y^2+a_{1}xy+a_{3}y=x^3+a_2{x}^2+a_{4}x+a_6,$$

$$\big{|}\{p\leqslant x:p\nmid N_{E},\widetilde{E}({\mathbb{F}}_{p})\text{ is cyclic}\}\big{|}=\delta_{E}\operatorname{Li}(x)+o(x/\log x),$$

$${\delta }_E=\sum _{n⩾1}\frac{\mu (n)}{[K_n:\mathbb{Q}]}.$$

$$y^2=g(x)=x^3+A{x}^2+Bx+C$$

$$\Delta =A^2{B}^2-4B^3-4A^{3}C-27C^2+18ABC.$$

$$y^2=x^3+a_1{x}^2+a_{2}x+a_3,$$

$$q_1{q}_2\cdots q_r(r⩾1),$$

$${\mathfrak{f}}_2={\mathfrak{d}}_2=21,\left(\frac{-{\mathfrak{d}}_2/3}{5}\right)=\left(\frac{-7}{5}\right)=-1,21=3\gcd (7,21).$$

$${\rho }_m={\rho }_{E/\mathbb{Q},m}:G_{\mathbb{Q}}=\mathrm{Gal}(\overline{\mathbb{Q}}/\mathbb{Q})⟶\text{Aut}(E[m])\simeq {\text{GL}}_2(\mathbb{Z}/m\mathbb{Z})$$

$$\mathrm{Gal}(K_m/\mathbb{Q})\simeq {\rho }_m(G_{\mathbb{Q}}).$$

$$S_E=\{p\text{ prime}:{\rho }_p(G_{\mathbb{Q}})\ne {\text{GL}}_2(\mathbb{Z}/p\mathbb{Z})\}$$

$$A(E)=30\prod _{\begin{array}{c}p>5\\ p\in S_E\end{array}}p.$$

$$M_E=\prod _{p\mid A(E)N_E}p.$$

$${\pi }_E(x;f,a)=\#\{p⩽x:p\nmid 2N_E,p\equiv a\text{mod }f,\text{ and }\tilde{E}({\mathbb{F}}_p)\text{ is cyclic}\}.$$

$$\omega (n)=\sum _{p\mid n}1,\tau (n)=\sum _{d>0,d\mid n}1,\sigma (n)=\sum _{d>0,d\mid n}d,H(n)=\sum _{d\mid n}\sum _{\begin{array}{c}1⩽k⩽d\\ d\mid k^2\end{array}}1,$$

$${\pi }_E(x;f,a)={\delta }_E(f,a)\mathrm{Li}(x)+E(x),$$

$${\delta }_E(f,a):=\sum _{d=1}^{\infty }\frac{\mu (d){\gamma }_{a,f}(K_d)}{[K_d\mathbb{Q}({\zeta }_f):\mathbb{Q}]},$$

$$\begin{array}{rl}E(x)& \ll x^{1/2}f\log (fx{N}_E)+x^{5/6}{\left(\frac{H(f){\log }^2(fx{N}_E)}{f}\right)}^{1/3}\\ & +x^{5/8}{\left(\frac{\tau (f_2)M_E^3{\log }^3(fx{N}_E)}{\phi (f)\log x}\right)}^{1/4}+\frac{\tau (f_2)M_E^3}{x^{1/2}\phi (f)\log x}.\end{array}$$

$$2^{k}\sigma\Bigl{(}\prod_{i\leqslant k}p_{i}^{\left\lceil\alpha_{i}/2\right\rceil-1}\Bigr{)}\leqslant H\Bigl{(}\prod_{i\leqslant k}p_{i}^{\alpha_{i}}\Bigr{)}\leqslant 2^{k}\sigma\Bigl{(}\prod_{i\leqslant k}p_{i}^{\left\lfloor\alpha_{i}/2\right\rfloor}\Bigr{)}.$$

$$H(f)<2.59\cdot 2^k\sqrt{f}\log \log \sqrt{f},$$

$$\begin{gathered} {\delta }_E(f,a)⩾\frac{1}{\phi (f)}\prod _{\begin{array}{c}p\nmid M_E\\ (p,f)\mid a-1\end{array}}\left(1-\frac{\phi (p,f)}{[K_p:\mathbb{Q}]}\right)\prod _{2<p\mid M_E}\left(1-\frac{1}{p-1}\right) \\ \cdot \frac{1}{[K_2:\mathbb{Q}]}\left([K_2:\mathbb{Q}]-1-\frac{\mu ({\mathfrak{f}}_2)([K_2\text{textsuperscript}ab:\mathbb{Q}]-1)}{{\prod }_{2<p\mid {\mathfrak{f}}_2}(p-2)}\right)>0, \end{gathered}$$

$$\frac{1}{2}\biggl{(}1-\frac{\mu(\mathfrak{f}_{2})}{\prod_{2<p\mid\mathfrak{f}_{2}}(p-2)}\biggr{)}\prod_{2<p\mid M_{E}}\left(1-\frac{1}{p-1}\right)\prod_{p\nmid M_{E}}\left(1-\frac{1}{[K_{p}:{\mathbb{Q}}]}\right).$$

$${\delta }_E(f,a)\gg \frac{1}{\phi (f)}\prod _{2<p\mid M_E}\left(1-\frac{1}{p-1}\right)=\frac{2\phi (M_E)}{\phi (f)M_E}\gg \frac{1}{\phi (f)\log \log M_E}.$$

$$y^2=x^3+x^2+4x+4,$$

$$\sum _{d\mid M_E}\frac{\mu (d){\gamma }_{a,g}(L_d)}{[L_d:L_d\cap \mathbb{Q}({\zeta }_g)]},$$

$${\pi }_E(x;f,a)={\delta }_E(f,a)\mathrm{Li}(x)+E(x),$$

$$\begin{gathered} E(x)\ll x^{3/4}{\left(\frac{\log (fx{N}_E)}{\log x}\right)}^{1/2}+x^{3/4}{\left(\frac{\log (fx{N}_E)G_D(a,f)}{f^3}\right)}^{1/2} \\ +x^{1/2}f\log (fx{N}_E)+x^{1/2}\left(\frac{1}{f}+\frac{\log x}{f^2}\right)G_D(a,f). \end{gathered}$$

$$G_D(a,f)<c\cdot 4^{\omega (f)}\tau (f)f^2$$

$$F\ll (\log x{)}^A\text{for some }A⩾0,$$

$$\mathcal{A}=\{p-1:p⩽x,p\equiv c\text{mod }F\}$$

Full text

1. Introduction

1.1. History of the Cyclicity Conjecture

Let $E/{\mathbb{Q}}$ be an elliptic curve given by a global minimal (see [26, Corollary VIII.8.3]) Weierstrass equation

[TABLE]

where $a_{1},\ldots,a_{6}\in{\mathbb{Z}}$. Primes that do not divide the discriminant $\Delta_{E}$ of this equation, or equivalently, its conductor $N_{E}$, are called the primes of good reduction. For such primes $p$, the reduction $\widetilde{E}_{p}$ of $E$ modulo $p$ is a non-singular elliptic curve. In particular, let $\widetilde{E}({\mathbb{F}}_{p})$ denote the subgroup of ${\mathbb{F}}_{p}$-rational points of the reduced curve $\widetilde{E}_{p}$.

In 1976, S. Lang and H. Trotter formulated (cf. [20]) the following elliptic curve analogue of Artin’s primitive root conjecture:

Conjecture 1** (Lang-Trotter Conjecture).**

Let $E/{\mathbb{Q}}$ be an elliptic curve of rank at least 1. Let $P\in E({\mathbb{Q}})$ be a fixed point on $E$ of infinite order. Then, the density of primes such that $\widetilde{E}({\mathbb{F}}_{p})=\langle P\,\text{mod }p\rangle$ exists.

As the first step towards this conjecture, the same year, following Hooley’s conditional proof of Artin’s conjecture (cf. [14, Ch. 3]), Jean Pierre Serre proved (cf. [24]) assuming GRH that

[TABLE]

with the density $\delta_{E}$ given by

[TABLE]

Here, $\operatorname{Li}(x)=\int_{2}^{x}1/\log tdt$, and $K_{n}={\mathbb{Q}}(E[n])$ is the $n$-division field obtained by adjoining to ${\mathbb{Q}}$ the affine coordinates of the group $E[n](\overline{{\mathbb{Q}}})$ of $n$-torsion points of $E$, where $\overline{{\mathbb{Q}}}$ is a fixed algebraic closure of ${\mathbb{Q}}$.

Serre, in [24], does not show, however, that $\delta_{E}>0$, but leaves it as an exercise! Murty and Cojocaru have shown in [6, pp. 621-2] that $\delta_{E}>0$ for both CM and non-CM curves, provided $K_{2}\neq{\mathbb{Q}}$. This result also follows as a byproduct of Theorem 4 below by taking $f=1$ for non-CM curves, and provides an important modification needed in their argument for the non-CM case (see Remark 2). All of these results depend on GRH.

In general, an explicit Euler product for $\delta_{E}$ is known only for the so-called Serre curves (see, for example, [2, § 2.4.1], both for the definition and the explicit formula for $\delta_{E}$).

Serre, possibly motivated by Lang-Trotter conjecture, also claimed in [24]:

Conjecture 2** (Serre’s Cyclicity Conjecture).**

$\widetilde{E}({\mathbb{F}}_{p})$* is cyclic for infinitely many primes $p$ if and only if $E$ contains a non-rational 2-torsion point.*

In 1990, Gupta and R. Murty showed in [7] that for any elliptic curve $E$, $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic for at least $c_{E}x/(\log x)^{2}$ primes for some positive constant $c_{E}$, provided $K_{2}\neq{\mathbb{Q}}$. When $K_{2}={\mathbb{Q}}$, then the torsion group $E({\mathbb{Q}})_{\text{tors}}$ of rational points on $E$ contains a subgroup of the form ${\mathbb{Z}}/2{\mathbb{Z}}\times{\mathbb{Z}}/2{\mathbb{Z}}$. Since for all primes $p$, except for a finite number of them, the torsion group embeds into $\widetilde{E}({\mathbb{F}}_{p})$, we deduce that there are only finitely many primes $p$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic, thereby settling Serre’s cyclicity conjecture.

The asymptotic formula (1), however, has been proven unconditionally only for curves with complex multiplication (that we shall call CM curves). In 1979, Ram Murty showed (cf. [21]) that (1) holds without GRH for all CM elliptic curves. In 2010, Akbary and K. Murty improved (cf. [1, Thm 1.1]) the error term of [21] to $O(x/(\log x)^{A})$ for any sufficiently large positive constant $A$. They, however, assume that the curve has multiplication by the full ring of integers $\mathfrak{O}_{K}$ of an imaginary quadratic field $K$. For non-CM curves, A. C. Cojocaru showed (cf. [3]) in 2002 that if $E$ is a non-CM elliptic curve, then (1) holds with an error $\ll_{N_{E}}x\log\log x/(\log^{2}x)$ under the assumption that the Dedekind zeta functions of the division fields of $E$ have no zeros to the right of $x=3/4$.

Upon combining the results of [21, 1, 7], it follows that $\delta_{E}>0$ for curves with complex multiplication by $\mathfrak{O}_{K}$, which gives a second proof of Serre’s conjecture for these curves via the asymptotic formula (1).

In 2004, assuming GRH, Cojocaru and Murty improved (cf. [6]) the error terms in (1) to $O_{N_{E}}(x^{5/6}(\log x)^{2/3})$ for non-CM curves, and to $O(x^{3/4}(\log N_{E}x)^{1/2})$ for CM curves with explicit dependence on the conductor $N_{E}$. This way, they were able to deduce estimates for the smallest prime $p_{E}$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic.

1.2. The goal of this paper

For the rest of the paper, $f\geqslant 1$ is an integer, and $a$ represents a residue class modulo $f$ and $(a,f)=1$.

We consider Serre’s cyclicity conjecture for primes $p\equiv a\,\text{mod }f$. More precisely, for a given elliptic curve $E$, we try to determine all moduli $f$, and the corresponding residue classes $a$ for each modulus $f$ such that $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic for infinitely many primes $p\equiv a\,\text{mod }f$.

Answering this question in the most general setting with any modulus $f$, any residue class $a$ and an arbitrary elliptic curve $E$ turns out to be too ambitious. Unfortunately, we cannot provide a complete answer to what we seek. The main difficulty is that the non-trivial intersections of the division fields $K_{n}$ for an arbitrary elliptic curve are not completely understood. This is exactly the same reason why there is no explicit product in general for $\delta_{E}$ in (1). On the other hand, we do have conditional and unconditional results, which partially complement each other, and a conjecture which we believe gives the correct answer. We find asymptotic formulas under GRH with error terms similar to the ones given by Cojocaru and Murty in [6] mentioned above, and with explicit dependence on the modulus $f$ and certain constants related to the curve $E$, but the main obstacle in this case is to show that the corresponding density, which we shall denote $\delta_{E}(f,a)$, is positive. We also give unconditional lower bound estimates similar to the one given by Gupta and Murty in [7].

Before we state our prediction, we first introduce some notation. We denote by $\zeta_{n}$ any fixed primitive $n$th root of unity, and by ${\mathbb{Q}}(\zeta_{n})$ the corresponding cyclotomic extension. The letter $\sigma$ when used with a subscript is reserved for automorphisms of cyclotomic fields and the one which takes $\zeta_{n}$ to $\zeta_{n}^{a}$, for each $a$ coprime to the modulus in question, will be denoted by $\sigma_{a}$. Also, the letters $p$ and $q$ always denote primes.

Conjecture 3**.**

Let $E$ be an elliptic curve over ${\mathbb{Q}}$ and let $f$ and $a$ be relatively prime positive integers. Then, there are infinitely many primes $p\equiv a\,\text{mod }f$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic unless $K_{d}\subseteq{\mathbb{Q}}(\zeta_{f})$ for some $d\geqslant 2$ and $\sigma_{a}\in\operatorname{Gal}({\mathbb{Q}}(\zeta_{f})/K_{d})$, in which case there are at most a finite number of such primes.

One direction follows easily. To see this, we first need to quote two key facts from [6, Lemma 2.1, Prop. 3.5.3]:

1. 1.

For odd $p\nmid N_{E}$, $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic if and only if $p$ does not split completely in $K_{q}$ for any prime $q\neq p$. 2. 2.

${\mathbb{Q}}(\zeta_{n})\subseteq K_{n}$ for each integer $n\geqslant 2$.

Now, if $K_{d}\subseteq{\mathbb{Q}}(\zeta_{f})$ for some $d\geqslant 2$, and $\sigma_{a}$ fixes $K_{d}$, then any $p\nmid N_{E}$ with $p\equiv a\,\text{mod }f$ will split completely in $K_{d}$, thereby in any $K_{q}$ with $q\mid d$. Thus, $\widetilde{E}({\mathbb{F}}_{p})$ cannot be cyclic for odd $p\neq q$ with $p\nmid N_{E}$. We record this result below. But, first note that $K_{d}\subseteq{\mathbb{Q}}(\zeta_{f})$ implies $K_{d}$ is abelian over ${\mathbb{Q}}$, and González–Jiménez and Lozano-Robledo show (cf. [8]) that $K_{d}$ is abelian only if $d\in\{2,3,4,5,6,8\}$ for non-CM curves, and if $d\in\{2,3,4\}$ for CM curves. Thus, we deduce the following result.

Proposition 1**.**

Assume that $(a,f)=1$, $K_{d}\subseteq{\mathbb{Q}}(\zeta_{f})$ for some $d\in\{2,3,4,5,6,8\}$, and $\sigma_{a}$ fixes $K_{d}$. Then, $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic for at most finitely many primes $p\equiv a\,\text{mod }f$.

Note that when $K_{d}$ is abelian for some $d\in\{2,3,4,5,6,8\}$, then $K_{d}\subseteq{\mathbb{Q}}(\zeta_{f})$ exactly when the conductor $\mathfrak{f}_{d}$ of $K_{d}$ divides $f$ (see the beginning of section 1.3). In general, it may not be easy to determine $\mathfrak{f}_{d}$. On the other hand, it is easy to determine all moduli $f$ for which $K_{d}\subseteq{\mathbb{Q}}(\zeta_{f})$ if $K_{d}={\mathbb{Q}}(\zeta_{d})$. González–Jiménez and Lozano-Robledo give complete classification and parametrization of all elliptic curves $E/{\mathbb{Q}}$, up to isomorphism over ${\mathbb{Q}}$, such that $K_{d}$ is abelian over ${\mathbb{Q}}$, and those curves such that $K_{d}={\mathbb{Q}}(\zeta_{d})$. Furthermore, they classify all the abelian Galois groups $\operatorname{Gal}(K_{d}/{\mathbb{Q}})$ for each $d\geqslant 2$ that may occur. In particular, they show that $K_{d}={\mathbb{Q}}(\zeta_{d})$ only when $d\in\{2,3,4,5\}$ for non-CM curves, and $d\in\{2,3\}$ for CM curves. Thus, it follows from their result that ${\mathbb{Q}}(\zeta_{d})=K_{d}\subseteq{\mathbb{Q}}(\zeta_{f})$ only if $d\mid f$, unless $d=2$ (which is the trivial case since $\widetilde{E}({\mathbb{F}}_{p})$ is not cyclic for all but a finite number of primes by Serre’s already proven conjecture 2).

One can say more about $K_{2}$ when the Weierstrass model

[TABLE]

is used for $E$. Indeed, the discriminant of $g(x)$ is given by

[TABLE]

Since the $x$-coordinates of 2-torsion points are the roots of this cubic, it follows from Galois Theory that $K_{2}$ is non-abelian if and only if $g(x)$ is irreducible and $\Delta$ is not the square of a rational number. If this is the case, then $K_{2d}\not\subset{\mathbb{Q}}(\zeta_{f})$ since $K_{2}\subseteq K_{2d}$ for any $d\geqslant 1$. Furthermore, $K_{2}={\mathbb{Q}}(\alpha,\sqrt{\Delta})$, where $\alpha$ is any root of $g(x)$. If $\Delta\in{\mathbb{Q}}^{2}$, then $K_{2}$ is a cubic abelian extension, and we can find its conductor in this case (see below). If $g$ splits into three linear factors, then $K_{2}={\mathbb{Q}}$, and if $g$ factors into a linear factor and an irreducible quadratic, then $K_{2}$ is a quadratic extension of ${\mathbb{Q}}$, and we can also determine the conductor easily in this case.

In what follows, we list the partial results we can prove that support our prediction in Conjecture 3.

1.3. Unconditional Results

Let $K_{n}\textsuperscript{ab}$ be the maximal abelian extension of ${\mathbb{Q}}$ in $K_{n}$. By the Kronecker-Weber Theorem, $K_{n}\textsuperscript{ab}\subseteq{\mathbb{Q}}(\zeta_{\mathfrak{f}_{n}})$ for some positive integer $\mathfrak{f}_{n}$, minimal with respect to this inclusion, that consists of primes that ramify in $K_{n}\textsuperscript{ab}$. This number $\mathfrak{f}_{n}$ is called the conductor of $K_{n}\textsuperscript{ab}$.

Theorem 1**.**

Let $E$ be an elliptic curve over ${\mathbb{Q}}$ satisfying $[K_{2}:{\mathbb{Q}}]=3$ and let $a$ and $f$ be any positive integers such that $(a,f)=1$ and $(a-1,f)$ has no odd prime divisors. Let $A\geqslant 0$ be given. Then, for $x$ sufficiently large and assuming $f\ll(\log x)^{A}$, the group $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic for $\gg x/(\log x)^{2+A}$ primes $p\equiv a\,\text{mod }f$, unless $K_{2}\subseteq{\mathbb{Q}}(\zeta_{f})$ and $\sigma_{a}$ fixes $K_{2}$.

To see why this Theorem is consistent with and provides an affirmative answer to Conjecture 3, note that the Artin map $\langle p,{\mathbb{Q}}(\zeta_{f})/{\mathbb{Q}}\rangle=\sigma_{a}$ for any prime $p\nmid N_{E}$ with $p\equiv a\,\text{mod }f$. Thus, if $K_{q}\subseteq{\mathbb{Q}}(\zeta_{f})$ for some odd prime $q$, and $\sigma_{a}$ fixes $K_{q}$, then it also fixes ${\mathbb{Q}}(\zeta_{q})$, and this means $q\mid(a-1,f)$, contradicting our assumption in Theorem 1. Therefore, it is enough to check whether $K_{q}\subseteq{\mathbb{Q}}(\zeta_{f})$ and $\sigma_{a}$ fixes $K_{q}$ only for $q=2$.

The main advantage of this result compared to an asymptotic formula is that it is unconditional, and works for any elliptic curve, CM or non-CM. More importantly, this gives a positive answer to our conjecture for certain residue classes. It is also practical in the sense that one can determine the moduli $f$, and when $K_{2}\not\subset{\mathbb{Q}}(\zeta_{f})$, also the residue classes $a$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic for infinitely many primes $p\equiv a\,\text{mod }f$. To see this, note that if $E$ is given by

[TABLE]

with an irreducible cubic, then $K_{2}$ is a cubic extension exactly when the discriminant $\Delta_{E}$ is a square in ${\mathbb{Q}}$. In this case, Häberle describes in [11, Corollary 12] how to easily determine the conductor $\mathfrak{f}_{2}$ of a cubic extension of ${\mathbb{Q}}$. In particular, $\mathfrak{f}_{2}$ is of the form

[TABLE]

where each $q_{i}\equiv 1\,\text{mod }3$ is a prime, with at most one exception, which then must be $9$. Therefore, any number $f$ not divisible by $\mathfrak{f}_{2}$ will be an admissible modulus, and we may then choose the residue class $a$ coprime to $f$ such that $(a-1,f)$ has no odd prime divisors. Furthermore, if $\mathfrak{f}_{2}\mid f$, but the order of $a$ modulo $f$ does not divide $\varphi(f)/3=|\operatorname{Gal}({\mathbb{Q}}(\zeta_{f})/K_{2})|$, then $\sigma_{a}$ cannot fix $K_{2}$.

In general, there are $2\varphi(f)/3$ possible choices for $a$. In particular, when $f$ is a prime power divisible by $\mathfrak{f}_{2}$, one can take any residue class $a$ which is not a cubic residue modulo $f$.

The proof of Theorem 1 uses linear sieve of Iwaniec (cf. [16]). The idea is to count the primes $p\leqslant x$ with $p\equiv a\,\text{mod }f$ such that $p-1$ is free of odd primes not exceeding $x^{\alpha}$ for some $\alpha>1/4$. Having the exponent $\alpha>1/4$ is essential for the rest of the proof to work, and one way to achieve this is to combine the linear sieve of Iwaniec with a follow up paper by Iwaniec and Fouvry with a necessary modification provided later by Heath-Brown (see [13, Lemma 2]). Using sieve theory also necessitates the restriction on residue classes in Theorem 1. Indeed, were some odd prime $q\leqslant x^{\alpha}$ to divide $(a-1,f)$, $p$ would split completely in ${\mathbb{Q}}(\zeta_{q})$; that is, $q\mid p-1$, and one cannot guarantee then that $p$ does not split in $K_{q}$, which is the only way the sieve can be used to prove Theorem 1.

Since it is desirable to remove the restriction on residue classes $a$, we also investigated ways to deal with the case when $(a-1,f)$ is divisible by odd primes. To understand the obstacles in this situation, we consider an example. Say, $f>5$ is a prime, and we want to count primes $p\equiv 1\,\text{mod }f$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic. Note that these primes split completely in ${\mathbb{Q}}(\zeta_{f})$. Fortunately, there is hope for these primes not to split completely in $K_{f}$ since it follows from [8] that $K_{f}$ is non-abelian when $f>5$. One has to make sure $p$ does not split completely in $K_{q}$ for primes $q\neq p$. To get an unconditional result using sieve methods, one has to count primes $p\leqslant x$, $p\nmid N_{E}$, $p-1$ not divisible by primes $q\leqslant x^{\alpha}$ with some $\alpha>1/4$ except for $2$ and $f$, and the Artin map $\langle p,K_{2f}/{\mathbb{Q}}\rangle\subseteq C$, where $C$ is a conjugacy class that consists of automorphisms in $\operatorname{Gal}(K_{2f}/{\mathbb{Q}}(\zeta_{f}))\setminus\{1_{K_{2f}}\}$. This may be done using a result of Murty and Petersen (cf. [22, Theorem 0.2]), but only, in the best scenario, with an exponent $\alpha=1/2(\varphi(f)-2)-{\varepsilon}<1/4$ (note $\varphi(f)=f-1>4$). Thus, unless their paper can be improved, getting an unconditional result seems to be out of reach with current methods.

One last note relevant also to the next result is that when applying the sieve one has to work with two congruences; namely, that $p\equiv a\,\text{mod }f$ and $p\equiv b\,\text{mod }\mathfrak{f}_{2}$. The latter is needed to make sure that $p$ does not split completely in $K_{2}$ (see Lemma 2 and Remark 4). When $K_{2}$ is cubic, these two congruences are shown to be compatible in Lemma 3, and this leads to Theorem 1 above. However, in what follows, we shall see that this is not always the case when $K_{2}$ is non-abelian, or a quadratic field. Thus, the next result is slightly weaker than but is similar to the cubic case.

The character $\chi_{D}$ that appears in the statement of Theorem 2 below is the real primitive character of conductor $|D|$ associated with the quadratic field ${\mathbb{Q}}(\sqrt{D})$ given by the Kronecker symbol $\chi_{D}(\cdot)=\left(\frac{D}{\cdot}\right)$, and $\mathfrak{d}_{2}$ stands for the discriminant of the quadratic extension $K_{2}\textsuperscript{ab}$ of conductor $\mathfrak{f}_{2}=|\mathfrak{d}_{2}|$.

In case one uses a Weierstrass model given by (3), $K_{2}\textsuperscript{ab}$ is generated by the square root of the square-free part of $\Delta_{E}$. So, in practice, conditions given below can easily be checked to determine which moduli $f$ and the corresponding residue classes $a$ are admissible.

Theorem 2**.**

Let $E$ be an elliptic curve over ${\mathbb{Q}}$ satisfying $[K_{2}\textsuperscript{ab}:{\mathbb{Q}}]=2$ and let $a$ and $f$ be any positive integers such that $(a,f)=1$ and $(a-1,f)$ has no odd prime divisors. Let $A\geqslant 0$ be given. Then, for $x$ sufficiently large and assuming $f\ll(\log x)^{A}$, the group $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic for $\gg x/(\log x)^{2+A}$ primes $p\equiv a\,\text{mod }f$ if $\mathfrak{f}_{2}\nmid f$, unless $\mathfrak{f}_{2}=3(f,\mathfrak{f}_{2})$ and $\chi_{-\mathfrak{d}_{2}/3}(a)=-1$. The same lower bound holds if $\mathfrak{f}_{2}\mid f$ and $\sigma_{a}$ does not fix $K_{2}\textsuperscript{ab}$.

Note that Theorem 2 comes close to, but falls short of providing the converse of Proposition 1 due to the exceptional case when $\mathfrak{f}_{2}\nmid f$. To see what the problem is, we consider an example:

Assume that $K_{2}\textsuperscript{ab}={\mathbb{Q}}(\sqrt{21})$, $f=7$, and $a=5$ so that

[TABLE]

Since $\mathfrak{f}_{2}\nmid f$, $K_{2}\textsuperscript{ab}\not\subset{\mathbb{Q}}(\zeta_{f})={\mathbb{Q}}(\zeta_{7})$. We require primes $p\equiv 5\,\text{mod }7$ not split completely in $K_{2}\textsuperscript{ab}$ so that they do not not split completely in $K_{2}$. The latter is achieved by imposing a condition that $p\equiv b\,\text{mod }21$ for some $b$. We want to see why the sieve cannot be applied. Note that the second congruence should guarantee that $\sigma_{b}\in\operatorname{Gal}({\mathbb{Q}}(\zeta_{21})/{\mathbb{Q}})$, but $\sigma_{b}$ does not fix $K_{2}\textsuperscript{ab}$; that is, $\sigma_{b}(\sqrt{21})=-\sqrt{21}$. Here, $b$ should be chosen in such a way that $(b-1,21)=1$. At the same time, we need $7\mid b-5$ so that the congruences $p\equiv 5\,\text{mod }7$ and $p\equiv b\,\text{mod }21$ are compatible. This implies then that $\sigma_{b}$ restricted to ${\mathbb{Q}}(\zeta_{7})$ sends $\sqrt{-7}$ to $-\sqrt{-7}$ because $\sigma_{a}=\sigma_{5}$ does. This can be seen as follows:

The Artin map $\langle 5,{\mathbb{Q}}(\zeta_{7})/{\mathbb{Q}}\rangle=\sigma_{5}$ when restricted to $K={\mathbb{Q}}(\sqrt{-7})$ equals $\langle 5,K/{\mathbb{Q}}\rangle$, and thus, is not identity on $K$ since $5\mathfrak{O}_{K}$ is a prime ideal in $K$. This follows from Kummer’s Theorem (cf. [17, §1.Thm 7.4]) as $x^{2}+7$ is irreducible modulo $5$; in other words, $-7$ is a quadratic non-residue modulo $5$ and this is captured by $\chi_{-7}(5)=-1$.

Hence, in order to get $\sigma_{b}(\sqrt{21})=-\sqrt{21}$, we need $\sigma_{b}(\sqrt{-3})=\sqrt{-3}$. This implies that $b\equiv 1\,\text{mod }3$, hence $p\equiv 1\,\text{mod }3$, and $p$ splits completely in ${\mathbb{Q}}(\zeta_{3})$. As a result, the sieve cannot be used since we could not choose $b$ so that $(b-1,21)=1$. Therefore, we have to exclude cases where $\mathfrak{f}_{2}=3(f,\mathfrak{f}_{2})$ and $\chi_{-\mathfrak{d}_{2}/3}(a)=-1$ when $\mathfrak{f}_{2}\nmid f$ (see Lemma 4).

1.4. Conditional Results

Next, we move onto the asymptotic results similar to Serre’s Theorem in (1). We first introduce a few facts and give some definitions.

For each integer $m\geqslant 1$, there exists a representation

[TABLE]

determined by the action of the absolute Galois group $G_{\mathbb{Q}}$ on the torsion group $E[m]$. The fixed field of its kernel is the $m$-division field $K_{m}$, so

[TABLE]

In 1972, Serre proved (cf. [25]) that

[TABLE]

is finite if and only if $E$ is non-CM. In this case, the Serre constant of $E/{\mathbb{Q}}$ is defined as the number

[TABLE]

Furthermore, we define the constant

[TABLE]

We shall denote our prime counting function by

[TABLE]

Arithmetic functions $\omega,\tau$, $\sigma$, and $H$ that appear below are

[TABLE]

and, as usual, $\varphi$ is Euler’s totient function.

Theorem 3**.**

Let $E/{\mathbb{Q}}$ be a non-CM curve. Assuming GRH holds for all Dedekind zeta functions of the fields $K_{d}{\mathbb{Q}}(\zeta_{f})$ for all square-free $d\geqslant 1$, we have

[TABLE]

where

[TABLE]

where $\mu$ denotes the Möbius function, and $\gamma_{a,f}(K_{d})=1$ if $\sigma_{a}$ fixes $K_{d}\cap{\mathbb{Q}}(\zeta_{f})$, and is [math] otherwise, and the error term $E(x)$ satisfies

[TABLE]

Here, $f_{2}$ denotes the largest divisor of $f$ that is coprime to $M_{E}$.

Remark 1**.**

It follows from (19) that $H(n)$ satisfies

[TABLE]

In particular, for $f=\prod_{i\leqslant k}p_{i}^{\alpha_{i}}$, it follows from [15] that

[TABLE]

whenever $\prod_{i}p^{\left\lfloor\alpha_{i}/2\right\rfloor}\geqslant 7$, and $H(f)<2^{k+1}\sqrt{f}$ otherwise. The last inequality, of course, gives only a crude estimate since the behavior of $H$ is not very regular. For example, if $f$ is a large prime, then $H(f)=2$ while $H(f^{2})=2+f>f$.

In this paper, we did not try to see if a weaker quasi-GRH would work as in [3], but rather wanted to get explicit and smaller error terms that can be obtained under GRH.

As for the positivity of the density, we have the following.

Theorem 4**.**

Let $E/{\mathbb{Q}}$ be a non-CM curve. If $(f,M_{E})=1$, and $K_{2}\neq{\mathbb{Q}}$, then

[TABLE]

where $\varphi(p,f)$ stands for $\varphi(\gcd(p,f))$.

Remark 2**.**

Note that when $f=1$, (10) would imply $\delta_{E}$ in (2) is at least

[TABLE]

This is obtained in the same way as Cojocaru and Murty had their result on page 621 of [6], yet the results are different. The reason is that when $\mathfrak{f}_{2}$ is not a prime, then $K_{2}\textsuperscript{ab}$ may have non-trivial intersections with ${\mathbb{Q}}(\zeta_{d})$ with square-free $d\mid M_{E}$, even though $K_{2}\textsuperscript{ab}\cap{\mathbb{Q}}(\zeta_{q})={\mathbb{Q}}$ for each prime $q\mid d$. They seem to have overlooked this point in their work.

By the definition of $M_{E}$, we have $[K_{p}:{\mathbb{Q}}]=(p^{2}-p)(p^{2}-1)\asymp p^{4}$ for $p\nmid M_{E}$. Thus, we obtain from (10) that

[TABLE]

Next, we mention another result known about $\delta_{E}(f,a)$. In 2010, Nathan Jones proved (cf. [18]) that almost all non-CM curves are Serre curves, and in 2015, Julio Brau Avila showed in his thesis (cf. [2]) that $\delta_{E}(f,a)$ is positive for Serre curves. Although an asymptotic formula is not given in Brau’s work, the density is computed explicitly using a different approach.

Brau also considers the curve

[TABLE]

as an example, which is a non-CM and non-Serre curve with $K_{2}={\mathbb{Q}}(\zeta_{4})$ (so $\mathfrak{f}_{2}=4$), $N_{E}=20$, and $A(E)=30$ (yielding $M_{E}=30$). Proposition 2.5.12 in [2] then states that $\delta_{E}(f,a)=0$ for this curve if and only if $4\mid f$ and $a\equiv 1\,\text{mod }4$. Proposition 1 and Theorem 2 in this paper show that there are infinitely many primes $p\equiv a\,\text{mod }f$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic unless $4\mid f$ and $a\equiv 1\,\text{mod }4$, in which case there are at most finitely many such primes, which agrees with Brau’s result, and our result is unconditional.

For Serre curves, the intersection of division fields is much better understood, which makes them easier to study. In particular, all $K_{p}$ are non-abelian. However, for an arbitrary non-CM elliptic curve, things are more complicated. As is apparent from (7), in order to study $\delta_{E}(f,a)$, we have to understand $\gamma_{a,f}(K_{d})$ and the intersections $K_{d}\cap{\mathbb{Q}}(\zeta_{f})$. For non-CM curves, Lemma 7 describes the latter for certain values of $d$, thanks to which we can then write $\delta_{E}(f,a)$ as a product of two factors; an infinite convergent product, and the finite sum (see Lemma 12)

[TABLE]

where $g$ is the largest divisor of $f$ coprime to $M_{E}$, $L_{p}/{\mathbb{Q}}$ are Galois extensions lying inside $K_{p}$ and must be chosen appropriately. In particular, $L_{2}$ has to be either $K_{2}$ or $K_{2}\textsuperscript{ab}$, and the main difficulty here is to understand the intersections $L_{d}\cap{\mathbb{Q}}(\zeta_{g})$, and the constants $\gamma_{a,g}(L_{d})$ for every $d\mid M_{E}$ for a general modulus $g$ and residue class $a$. Since we do not have enough information, we cannot write this sum as a product.

Brau’s result in [2] for Serre curves which we record below and his example mentioned above both support our prediction.

Theorem 5** ([2, Corollary 2.5.9]).**

For a Serre curve $E/{\mathbb{Q}}$, $\delta_{E}(f,a)$ is positive for coprime positive integers $a$ and $f$.

Next, we turn to CM curves. We assume as in [1] and [6] that the endomorphism ring is isomorphic to the full ring of integers. The exact definition of the arithmetic function $G_{D}(a,f)$ that appears inside the error term below is given in the proof.

Theorem 6**.**

Let $E/{\mathbb{Q}}$ be an elliptic curve with End${}_{\overline{{\mathbb{Q}}}}(E)\simeq\mathfrak{O}_{K}$, where $\mathfrak{O}_{K}$ is the ring of algebraic integers of an imaginary quadratic field $K={\mathbb{Q}}(\sqrt{-D})$. If GRH holds for all Dedekind zeta functions of the fields $K_{d}{\mathbb{Q}}(\zeta_{f})$ for all square-free $d\geqslant 1$, then

[TABLE]

where $\delta_{E}(f,a)$ is given by (7) and the error term $E(x)$ satisfies

[TABLE]

Here, $G_{D}(a,f)$ is the cardinality of the set given by (23), is multiplicative in the second variable and satisfies

[TABLE]

where $c=2$ if $D\equiv 1,2\,\text{mod }4$, or $D\equiv 3\,\text{mod }4$ and $f$ is odd, and $c=49$ otherwise.

As for the density, we have the following result.

Theorem 7**.**

The density $\delta_{E}(f,a)$ in Theorem 6 is positive if one of the following holds:

1. (1)

$K_{2}\cap K={\mathbb{Q}}$, and $\gamma_{a,f}(K_{2}K)=\gamma_{a,f}(K_{2})\gamma_{a,f}(K)$, and $K_{2}\subsetneq{\mathbb{Q}}(\zeta_{f})$ or $\sigma_{a}$ does not fix $K_{2}\cap{\mathbb{Q}}(\zeta_{f})$, and $K\subsetneq{\mathbb{Q}}(\zeta_{f})$ or $\sigma_{a}$ does not fix $K\cap{\mathbb{Q}}(\zeta_{f})$, 2. (2)

$K_{2}\textsuperscript{ab}=K$, and $K_{2}\subsetneq{\mathbb{Q}}(\zeta_{f})$ or $\sigma_{a}$ does not fix $K_{2}\cap{\mathbb{Q}}(\zeta_{f})$.

Remark 3**.**

We did not attempt to handle the CM case without GRH in this paper even though division fields are better understood for these curves, and one may be able to improve Theorems 6 and 7. We leave this task to a seperate paper.

Acknowledgements. We would like to thank Ram Murty for helpful discussions, and suggesting the use of linear sieve that plays a significant role and makes an important contribution to the results we obtained. We also wish to thank Ernst Kani for sharing his notes given in appendix that are used in several parts of the paper and play an essential role in the proof of some of the Theorems.

2. Proofs of Unconditional Results

2.1. The Linear Sieve

Assume that $F\geqslant 1$ is an integer satisfying

[TABLE]

$c$ is an integer coprime to $F$ such that $(c-1,F)$ has no odd prime divisors. Put

[TABLE]

and, as usual, define

[TABLE]

where $\mathcal{P}$ is the set of odd primes coprime to $F$. We seek a lower bound for

[TABLE]

For $d\mid\mathcal{P}(z)$, we have

[TABLE]

say. Here, $\pi(x;dF,c_{d})$ denotes the number of primes $p\leqslant x$ that are congruent to $c_{d}$ modulo $dF$, $c_{d}$ is the unique integer (by Chinese Remainder Theorem) modulo $dF$ satisfying $c_{d}\equiv 1\,\text{mod }d$ and $c_{d}\equiv c\,\text{mod }F$, and $\omega(d)=d/\varphi(d)$ satisfies $0<\omega(q)<q$ for all odd primes $q$. Furthermore, the inequalities

[TABLE]

and

[TABLE]

hold for all $z>w\geqslant 2$ for some constants $K,L>1$, where in the second inequality of the first equation we use Merten’s estimate

[TABLE]

We have verified so far that the necessary conditions given in [16] by equations (1) and (2) are satisfied. Hence, we are now ready to use the lower bound sieve of Iwaniec in [16]. Thus, assume that ${\varepsilon}_{1}\in(0,1/3)$, and $2\leqslant y^{1/4}\leqslant z<y^{1/2}$. Then, it follows from [16, Thm 1] that

[TABLE]

where $s=\log y/\log z$, $E({\varepsilon}_{1},y,K,L)\ll{\varepsilon}_{1}+{\varepsilon}_{1}^{-8}e^{K+L}(\log y)^{-1/3}$ and

[TABLE]

for some well factorable functions $\lambda_{l}$ (see the paragraph before [13, Lemma 2] for the definition). Here, the implied constant is absolute. The function $f(s)$ that appears above is a continuous solution of a system of differential-difference equations given in [16], and in the interval $2\leqslant s\leqslant 4$ that we are interested in $f(s)$ is given by (cf. [10, p. 126])

[TABLE]

where $\gamma=0.5772156649\ldots$ is the Euler-Mascheroni constant.

Now, we choose $y=x^{4/7-{\varepsilon}_{2}}$ and $z=y^{1/(2+{\varepsilon}_{2})}$ with a fixed ${\varepsilon}_{2}\in(0,1)$ so that $s=2+{\varepsilon}_{2}$, and

[TABLE]

For ${\varepsilon}_{1}$ sufficiently small in terms of ${\varepsilon}_{2}$ and $x$ sufficiently large, we get

[TABLE]

Furthermore, it follows from [13, Lemma 2] that for a given ${\varepsilon}_{2}$ and any $B>0$,

[TABLE]

for some fixed positive integer $k$, where the implied constant may depend on $c,{\varepsilon}_{2}$, and $B$. Then, choosing $B=(k+1)A+3$, it follows from (13) that

[TABLE]

for sufficiently large $x$. For ${\varepsilon}_{2}\in(0,2/35)$, we see that $z=x^{\alpha}$ with

[TABLE]

Furthermore, since

[TABLE]

we can also assume that each $p-1$ counted in $S(\mathcal{A},\mathcal{P},x^{\alpha})$ has distinct odd prime divisors $q\geqslant x^{\alpha}$ coprime to $F$. Finally, since there are only finitely many divisors of $N_{E}$, we obtain the following result:

Lemma 1**.**

Let $A\geqslant 0$ and ${\varepsilon}\in(0,2/35)$ be given. Assume that $c$ and $F$ are positive coprime integers such that $F\ll(\log x)^{A}$ and no odd prime divides $(c-1,F)$. Then, there is some $\alpha=\alpha({\varepsilon})>1/4$ and a positive constant $c(\alpha,A)$ such that for $x$ sufficiently large, there are at least $c(\alpha,A)x/(\log x)^{2+A}$ primes $p\leqslant x$ with $p\equiv c\,\text{mod }F$ and $p\nmid N_{E}$ such that odd prime divisors $q$ of $p-1$ are distinct, coprime to $F$ and satisfy $q\geqslant x^{\alpha}$.

2.2. Proofs of Theorems 1 and 2

As mentioned in the introduction, Murty and Gupta showed in [7] unconditionally that for any elliptic curve $E/{\mathbb{Q}}$ for which $K_{2}\neq{\mathbb{Q}}$, there are infinitely many primes $p$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic. The first step in their proof is to make sure $p$ does not split completely in $K_{2}$, which is established by imposing a congruence condition on $p$ as mentioned in [7, Lemma 3]. Since this result plays a fundamental role in this paper and since they do not give any details, we show below that there is in fact an appropriate arithmetic progression that serves this purpose.

Lemma 2**.**

If $K_{2}\neq{\mathbb{Q}}$, there exists some $b\in({\mathbb{Z}}/\mathfrak{f}_{2}{\mathbb{Z}})^{\times}$ such that $\gamma_{b,\mathfrak{f}_{2}}(K_{2})=0$ and the odd part of $\mathfrak{f}_{2}$ is coprime to $b-1$.

Remark 4**.**

As mentioned in the introduction, to be able to apply the linear sieve, it is of fundamental importance to make sure that no odd prime divides $(\mathfrak{f}_{2},b-1)$, and that is exactly why we need to prove that there is at least one such $b$. Otherwise, only finding some $b\in({\mathbb{Z}}/\mathfrak{f}_{2}{\mathbb{Z}})^{\times}$ such that $\gamma_{b,\mathfrak{f}_{2}}(K_{2})=0$ can easily be accomplished by choosing an automorphism \sigma\in\operatorname{Gal}({\mathbb{Q}}(\zeta_{\mathfrak{f}_{2}})/{\mathbb{Q}})\setminus\operatorname{Gal}\bigl{(}{\mathbb{Q}}(\zeta_{\mathfrak{f}_{2}})/(K_{2}\cap{\mathbb{Q}}(\zeta_{\mathfrak{f}_{2}}))\bigr{)}.

Proof.

Note that $K_{2}\cap{\mathbb{Q}}(\zeta_{\mathfrak{f}_{2}})=K_{2}\textsuperscript{ab}$.

Assume first that $[K_{2}\textsuperscript{ab}:{\mathbb{Q}}]=2$. Then, $K_{2}\textsuperscript{ab}={\mathbb{Q}}(\sqrt{D})$ for some square-free integer $D$, and

[TABLE]

is the absolute value of the discriminant $\mathfrak{d}_{2}$ of $K_{2}\textsuperscript{ab}$ over ${\mathbb{Q}}$ (cf. [17, Corollary VI.1.3]). We choose $b=3$ if $D=-1,2$; $b=7$ if $D=-2$. For $|D|>2$, let $p$ be the smallest odd prime divisor of $D$, and choose $b$ as the unique solution modulo $\mathfrak{f}_{2}$ of the system of congruences

[TABLE]

Here, $g_{p}$ denotes a primitive root modulo $p$ for each odd prime divisor of $D$. Since $q>3$ for any $q\neq p$, $g_{q}^{2}\not\equiv 1\,\text{mod }q$. Furthermore, $\sigma_{b}(\sqrt{D})=-\sqrt{D}$. Thus, we have the desired $b$.

Next, assume that $[K_{2}:{\mathbb{Q}}]=3$ (note $K_{2}=K_{2}\textsuperscript{ab}$). Hasse proved (cf. [12]) that

[TABLE]

where $p_{1},\ldots,p_{r}$ are either all distinct primes with $p_{i}\equiv 1\,\text{mod }3$, or all except one, say $p_{r}$, are such primes, and $p_{r}=9$.

If $r=1$, any $b$ which is not a cube modulo $p_{1}$ works. In particular, there are $2\varphi(p_{1})/3$ choices for $b$. If $r>1$, write $\mathfrak{f}_{2}=p_{1}m$. Since $K_{2}\cap{\mathbb{Q}}(\zeta_{n})={\mathbb{Q}}$ for any $n\mid m$ (otherwise, $K_{2}\subset{\mathbb{Q}}(\zeta_{m})$), we have

[TABLE]

Thus, there are $2\prod_{i=2}^{r}(\varphi(p_{i})-1)$ choices for an automorphism $\tau\in\operatorname{Gal}({\mathbb{Q}}(\zeta_{m})K_{2}/{\mathbb{Q}})$, which is not identity on $K_{2}$ and on any ${\mathbb{Q}}(\zeta_{p_{i}})$ for $i=2,\ldots,r$. Furthermore,

[TABLE]

where $L={\mathbb{Q}}(\zeta_{m})K_{2}\cap{\mathbb{Q}}(\zeta_{p_{1}})$, implies $[L:{\mathbb{Q}}]=3$. Since $[{\mathbb{Q}}(\zeta_{p_{1}}):{\mathbb{Q}}]>3$, we can extend $\tau_{|L}$ to a non-identity automorphism $\beta$ of $\operatorname{Gal}({\mathbb{Q}}(\zeta_{p_{1}})/{\mathbb{Q}})$. Since $\tau$ and $\beta$ agree on $L$, it follows from Galois theory that there is a $\sigma\in\operatorname{Gal}({\mathbb{Q}}(\zeta_{\mathfrak{f}_{2}})/{\mathbb{Q}})$ which extends $\tau$ and $\beta$. Then, $\sigma$ uniquely determines some $b\in({\mathbb{Z}}/\mathfrak{f}_{2}{\mathbb{Z}})^{\times}$ such that $(b-1,\mathfrak{f}_{2})=1$ and $\gamma_{b,\mathfrak{f}_{2}}(K_{2})=0$ as desired. ∎

Remark 5**.**

Let $\chi_{\mathfrak{d}_{2}}$ be the real primitive character of conductor $\mathfrak{f}_{2}$ given by the Kronecker symbol $(\tfrac{\mathfrak{d}_{2}}{\cdot})$. Then, $\gamma_{b,\mathfrak{f}_{2}}(K_{2})=1$ if and only if $b\in\ker\chi_{\mathfrak{d}_{2}}$ (to see how this character plays a role, see for example, [17, I.7.4 and pp. 250-1]). So, when $[K_{2}\textsuperscript{ab}:{\mathbb{Q}}]=2$, we choose $b$ in such a way that $b\not\in\ker\chi_{\mathfrak{d}_{2}}$ and that $b\not\equiv 1\,\text{mod }q$ for odd $q\mid D$.

The next result is needed in the proof of Theorem 1.

Lemma 3**.**

Assume that $[K_{2}:{\mathbb{Q}}]=3$. Let $m>1$ be a proper divisor of $\mathfrak{f}_{2}$ and $a$ an integer such that $(m,a(a-1))=1$. Then, there is some $b$ satisfying conditions of Lemma 2 such that $b\equiv a\,\text{mod }m$.

Proof.

Write $\mathfrak{f}_{2}=pdm=pn$, where $p$ is a prime, $d\geqslant 1$ and $(d,m)=1$. Since $K_{2}\cap{\mathbb{Q}}(\zeta_{n})={\mathbb{Q}}$, there is some $\tau\in\operatorname{Gal}({\mathbb{Q}}(\zeta_{n})K_{2}/{\mathbb{Q}})$ which is not identity on $K_{2}$ and on ${\mathbb{Q}}(\zeta_{q})$ for each prime (if any) $q\mid d$, while it equals $\sigma_{a}$ on ${\mathbb{Q}}(\zeta_{m})$. If $p=3$, then ${\mathbb{Q}}(\zeta_{n})K_{2}={\mathbb{Q}}(\zeta_{\mathfrak{f}_{2}})$. Thus, $\tau=\sigma_{b}$ for some $b$. If $3\mid m$, then $b\equiv a\,\text{mod }m$ implies $b\equiv 2\,\text{mod }3$ since $(m,a(a-1))=1$. Otherwise, $3\mid d$ and $\sigma_{b}\neq 1_{{\mathbb{Q}}(\zeta_{3})}$ implies $b\equiv 2\,\text{mod }3$. In either case, we obtain the desired result. If $p\neq 3$, we put $L={\mathbb{Q}}(\zeta_{n})K_{2}\cap{\mathbb{Q}}(\zeta_{p})$. Then,

[TABLE]

Thus, we can extend $\tau_{|L}$ to a non-identity automorphism $\beta$ of ${\mathbb{Q}}(\zeta_{p})$. Since $\tau$ and $\beta$ agree on $L$, it follows from Galois theory that there is a $\sigma_{b}\in\operatorname{Gal}({\mathbb{Q}}(\zeta_{\mathfrak{f}_{2}})/{\mathbb{Q}})$ which extends $\tau$ and $\beta$ for some $b$ with the desired property. ∎

Proof of Theorem 1.

If $\mathfrak{f}_{2}\nmid f$, then we can write $f=mg$ with $m=(\mathfrak{f}_{2},f)<\mathfrak{f}_{2}$. Applying Lemma 2 if $m=1$, and Lemma 3 for $m>1$ yields some $b$ with which the system $p\equiv b\,\text{mod }\mathfrak{f}_{2}$ and $p\equiv a\,\text{mod }f$ is solvable since $m\mid a-b$, and there is a unique solution, say, $c$ modulo $F=[f,\mathfrak{f}_{2}]$. Applying Lemma 1 to primes $p\equiv c\,\text{mod }F$, we find some $\alpha>1/4$ and a set of primes $S_{\alpha}(x)$ having properties stated in Lemma 1. We would like to show that the number of $p\in S_{\alpha}(x)$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is not cyclic is negligible. The rest of the proof follows the proof of [7, Theorem 1], but we shall include it here.

Recall that $|\widetilde{E}({\mathbb{F}}_{p})|=p+1-a_{p}$, where $a_{p}$ denotes the trace of the Frobenius associated to E and $p$. Put

[TABLE]

By Hasse’s inequality, $S_{\alpha}(x)$ is the union of $S(b,x)$ with $|b|\leqslant 2\sqrt{x}$. Take a prime $p\in S(b,x)$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is not cyclic. Then, $p$ splits completely in $K_{q}$, for some odd prime $q$. Since ${\mathbb{Q}}(\zeta_{q})\subset K_{q}$, $q\mid p-1$ and the fact that $p\in S_{\alpha}(x)$ implies $q\geqslant x^{\alpha}$ and is coprime to $[f,\mathfrak{f}_{2}]$. Moreover, $q^{2}\mid|\widetilde{E}({\mathbb{F}}_{p})|=p+1-a_{p}=p-1+(2-b)$, thus $q\mid b-2$. Notice that $b\neq 2$ since odd prime divisors of $p-1$ are distinct. Since $q\geqslant x^{\alpha}$ with $\alpha>1/4$ and $|a_{p}-2|\ll x^{1/2}$, there is only one such prime $q$ for a given $b$, for $x$ sufficiently large. Therefore, any $p\in S(b,x)$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is not cyclic satisfies

[TABLE]

and the number of such $p$ is $<x/q^{2}+O(1)\ll x^{1-2\alpha}$. The total number of $p\in S_{\alpha}(x)$ for which $\widetilde{E}({\mathbb{F}}_{p})$ is not cyclic is, therefore, $\ll x^{3/2-2\alpha}=o(x/(\log x)^{2+A})$.

If $\mathfrak{f}_{2}\mid f$ and $\gamma_{a,f}(K_{2}\textsuperscript{ab})=0$, we can apply Lemma 1 with the pair $(a,f)$, and repeat the same arguments above. ∎

Lemma 4**.**

Assume that $[K_{2}\textsuperscript{ab}:{\mathbb{Q}}]=2$, $m>1$ is a proper divisor of $\mathfrak{f}_{2}$, $(a,m)=1$ and the odd part of $m$ is coprime to $a-1$. Then, there is some $b$ satisfying conditions of Lemma 2 such that $b\equiv a\,\text{mod }m$ unless $\mathfrak{f}_{2}=3m$ and $\chi_{-\mathfrak{d}_{2}/3}(a)=-1$.

Proof.

By remark 5, we need to find some $b$ with $(b,\mathfrak{f}_{2})=1$ such that $\chi_{\mathfrak{d}_{2}}(b)=-1$ and that $b\not\equiv 1\,\text{mod }q$ for odd $q\mid D$. Write $\mathfrak{f}_{2}=pdm=pn$ with $d\geqslant 1$. Whenever $p=3$, we need to choose $b\equiv 2\,\text{mod }3$ so that $3\nmid b-1$, and $b\equiv a\,\text{mod }m$. This gives $\chi_{\mathfrak{d}_{2}}(b)=(\tfrac{b}{3})\chi_{-\mathfrak{d}_{2}/3}(b)=-\chi_{-\mathfrak{d}_{2}/3}(b)$. If $d=1$, this implies $\chi_{-\mathfrak{d}_{2}/3}(a)$ should be $1$ since otherwise $\gamma_{b,\mathfrak{f}_{2}}(K_{2}\textsuperscript{ab})=1$. If $d\neq 1$ and $(d,m)=1$, we choose $b$ modulo $d$ in such a way that $q\nmid b-1$ for each odd $q\mid d$ and that $\chi_{\mathfrak{d}_{2}}(b)=-1$. This can be done since odd prime divisors of $d$ are larger than $3$. If $(d,m)\neq 1$, it equals 4 or 8. In this case, we choose $b$ similarly for odd prime divisors of $d$, and congruent to $a$ modulo the odd part of $m$. We finally choose $b$ modulo $(d,m)$ so that $\chi_{\mathfrak{d}_{2}}(b)=-1$. If $3\nmid\mathfrak{f}_{2}$, then we choose $b$ similarly. ∎

Proof of Theorem 2.

If $\mathfrak{f}_{2}\nmid f$, then we can write $f=mg$ with $m=(\mathfrak{f}_{2},f)<\mathfrak{f}_{2}$. Applying Lemma 2 if $m=1$, and Lemma 4 for $m>1$ yields some $b$ with which the system $p\equiv b\,\text{mod }\mathfrak{f}_{2}$ and $p\equiv a\,\text{mod }f$ is solvable since $m\mid a-b$, and there is a unique solution modulo $[f,\mathfrak{f}_{2}]$. Applying Lemma 1 and proceeding as in the proof of Theorem 1, we get the result. If $\mathfrak{f}_{2}\mid f$ and $\gamma_{a,f}(K_{2}\textsuperscript{ab})=0$, we can apply Lemma 1 with the pair $(a,f)$. ∎

3. Proofs of Theorems 3 and 4

Throughout this section we assume that $E$ is an elliptic curve over ${\mathbb{Q}}$ that has no complex multiplication.

3.1. Preliminaries

Recall that $\mathfrak{f}_{n}$ is the conductor of $K_{n}\textsuperscript{ab}$. It follows from [23, V Thm 1.10, p.324] that $\mathfrak{f}_{n}$ consists of primes that ramify in $K_{n}\textsuperscript{ab}$. Also, primes that ramify in $K_{n}$ are the divisors of $nN_{E}$ (see, for example, [26, p.179]). Since these primes also ramify in $K_{n}$, $\mathfrak{f}_{n}\mid(nN_{E})^{\infty}$. In particular, $\mathfrak{f}_{2}\mid M_{E}^{\infty}$ and we use this implicitly in the proof of Theorem 4.

Lemma 5** ([6, Lemma 2.1]).**

Let $E$ be an elliptic curve defined over ${\mathbb{Q}}$, and $p$ a prime with $p\nmid N_{E}$. Then, for any prime $q\neq p$, $\widetilde{E}({\mathbb{F}}_{p})$ contains a subgroup isomorphic to ${\mathbb{Z}}/q{\mathbb{Z}}\times{\mathbb{Z}}/q{\mathbb{Z}}$ if and only if $p$ splits completely in $K_{q}$. Therefore, for odd $p$, $\widetilde{E}({\mathbb{F}}_{p})$ is cyclic if and only if $p$ does not split completely in $K_{q}$ for any prime $q\neq p$.

Lemma 6**.**

If $(d,e)=1$, then $K_{de}=K_{d}K_{e}$.

Proof.

Since $K_{d},K_{e}\subseteq K_{de}$, $K_{d}K_{e}\subseteq K_{de}$. Now, take any $de$-torsion point $(x,y)$ of $E$, and note that since $(d,e)=1$, $(x,y)=ad(x,y)\oplus be(x,y)$ for some integers $a$ and $b$, where $\oplus$ denotes the group operation on $E$; that is, $(x,y)$ is the sum of a $d$-torsion and an $e$-torsion point. Thus, the claim follows. ∎

Lemma 7**.**

If $(e,A(E))=1$, then $K_{e}\cap{\mathbb{Q}}(\zeta_{g})={\mathbb{Q}}(\zeta_{(e,g)})$, where $A(E)$ is Serre’s constant defined in (5).

Proof.

By [5, Appendix Cor. 13], ${\mathbb{Q}}(\zeta_{e})$ is the maximal abelian extension of ${\mathbb{Q}}$ in $K_{e}$. Thus, $K_{e}\cap{\mathbb{Q}}(\zeta_{g})$, being abelian, lies in both ${\mathbb{Q}}(\zeta_{e})$ and ${\mathbb{Q}}(\zeta_{g})$, and also contains their intersection since ${\mathbb{Q}}(\zeta_{e})\subseteq K_{e}$. ∎

Lemma 8** (Theorem 1 in Appendix).**

If $(m,nM_{E})=1$, then $K_{n}\cap K_{m}={\mathbb{Q}}$.

Below we give an effective version of Chebotarev’s Density Theorem.

Lemma 9** ([6, Thm 3.1 + Lemma 3.4]).**

Let $L/{\mathbb{Q}}$ be a Galois extension of discriminant $\Delta_{L}$, $G=\operatorname{Gal}(L/{\mathbb{Q}})$, $C\subseteq G$ a conjugacy class, and $\mathcal{P}(L)$ the set of primes $p$ that ramify in $L$. Then, assuming GRH for the Dedekind zeta function of $L$,

[TABLE]

where

[TABLE]

Lemma 10**.**

For real $Y\geqslant 1$ and integer $k\geqslant 1$,

[TABLE]

Proof.

We have

[TABLE]

and taking limit as $Z\to\infty$, the result follows. ∎

Lemma 11**.**

For $Y>1$,

[TABLE]

Proof.

Note that for any $x\geqslant 1$,

[TABLE]

where $c>1$, the last inequality by Lemma 10. Thus,

[TABLE]

where the first inequality follows by using $\varphi(dn)\geqslant\varphi(d)\varphi(n)$ and the second by $\varphi(d)\gg d/\log\log d$. We conclude that for $z>y>1$,

[TABLE]

Taking limit as $z\to\infty$, we get the result. ∎

3.2. Proof of Theorem 3

We shall assume $f<\tfrac{1}{2}\sqrt{x}$ since otherwise the theorem trivially holds. For a squarefree integer $d\geqslant 1$, put

[TABLE]

If a prime $p\leqslant x$ splits completely in $K_{d}$ for some $d>1$, then $p$ splits completely in $K_{q}$ for each prime $q\mid d$. Since $p$ ramifies in ${\mathbb{Q}}(\zeta_{p})$ and ${\mathbb{Q}}(\zeta_{p})\subseteq K_{p}$ by [6, Proposition 3.5#3], $p\nmid d$. Consequently, it follows from Lemmas 5 and 6 that $d^{2}$ divides $|\widetilde{E}({\mathbb{F}}_{p})|$. Then, by Hasse’s inequality $d^{2}\leqslant(\sqrt{p}+1)^{2}$, yielding $d\leqslant\sqrt{x}+1$. Hence, using inclusion-exclusion principle we can write

[TABLE]

Put

[TABLE]

where $y$ is a parameter satisfying $2f\leqslant y\leqslant\sqrt{x}$.

3.2.1. Main Term $\Sigma_{1}$

For each square-free $d\leqslant y$, there is a unique automorphism in $\operatorname{Gal}(K_{d}{\mathbb{Q}}(\zeta_{f})/{\mathbb{Q}})$ whose restrictions to $K_{d}$ and ${\mathbb{Q}}(\zeta_{f})$ are identity and $\sigma_{a}$, respectively, provided that $\gamma_{a,f}(K_{d})=1$. Thus, $\pi_{E,d}(x;f,a)$ counts primes $p\leqslant x$ of good reduction whose Frobenius automorphism coincides with this automorphism whenever $\gamma_{a,f}(K_{d})=1$. Therefore, it follows from Lemma 9 that for each squarefree $d\leqslant y$,

[TABLE]

if $\gamma_{a,f}(K_{d})=1$, and is [math] otherwise. Here, $p\in\mathcal{P}(K_{d}{\mathbb{Q}}(\zeta_{f}))$.

Note that $[K_{d}{\mathbb{Q}}(\zeta_{f}):{\mathbb{Q}}]\leqslant[K_{d}:{\mathbb{Q}}]\varphi(f)<d^{4}f$, the second inequality by (4). By [6, Proposition 3.5#3], ${\mathbb{Q}}(\zeta_{f})\subseteq K_{f}$. Thus, $K_{d}{\mathbb{Q}}(\zeta_{f})\subset K_{[d,f]}$, and this implies $\mathcal{P}(K_{d}{\mathbb{Q}}(\zeta_{f})/{\mathbb{Q}})\subseteq\mathcal{P}(K_{[d,f]}/{\mathbb{Q}})$. By [26, p. 179], we conclude that $\mathcal{P}(K_{d}{\mathbb{Q}}(\zeta_{f})/{\mathbb{Q}})$ is a subset of primes dividing $dfN_{E}$. Therefore, the above error is $\ll x^{1/2}\log(dfxN_{E})$, and we conclude

[TABLE]

Write $f=f_{1}f_{2}$, where $f_{1}\mid M_{E}^{\infty}$ and $(f_{2},M_{E})=1$. Then,

[TABLE]

Here, the second equality follows by Lemma 8 (see the proof of Lemma 12 for details). By [6, Prop. 3.6.2] and Lemma 7, we get

[TABLE]

Thus, the last sum over $e$ is

[TABLE]

where, in the last inequality, we used $\varphi(ek)\geqslant\varphi(e)\varphi(k)$. By Lemma 10 we derive that

[TABLE]

3.2.2. Estimate of the error $\Sigma_{2}$

By Lemma 5, and the fact that $p$ splits completely in ${\mathbb{Q}}(\zeta_{d})$, we obtain

[TABLE]

Writing $|\widetilde{E}({\mathbb{F}}_{p})|=p+1-a_{p}$, we have by Hasse’s inequality, $|a_{p}|<2\sqrt{p}\leqslant 2\sqrt{x}$. Thus, $\Sigma_{2}$ is

[TABLE]

The last sum over $d$ is

[TABLE]

Using the estimate

[TABLE]

and recalling that $2f\leqslant y\leqslant\sqrt{x}$, we obtain

[TABLE]

where $H(f)$ is given by (6).

3.2.3. Finale

Combining (17), (18) and (3.2.2), we obtain

[TABLE]

By [9, Lemma 2.4], there is some $y$ in the interval $[2f,\sqrt{x}]$ for which the right hand side becomes

[TABLE]

Note that writing $n=b^{2}c$, where $b^{2}$ is the largest square dividing $n$, yields

[TABLE]

and it follows that $H(f)$ is multiplicative. For $k\geqslant 1$, we have

[TABLE]

This gives the inequality in (9). In particular, $H(f)<f^{2}$ holds. Thus, the second term can be eliminated in the error term above, and we end up with (8). This completes the proof.

3.3. Positivity of Density $\delta_{E}(f,a)$

Given a family

[TABLE]

we define the density associated with $\mathcal{F}$ by

[TABLE]

where, for any number field $L$,

[TABLE]

In particular, $\delta_{E}(f,a)=\delta_{\mathcal{F}}(f,a)$ when $L_{p}=K_{p}$ for each $p$.

Lemma 12**.**

Let $\mathcal{F}=\{L_{p}\}_{p}$ be a family where ${\mathbb{Q}}\subsetneq L_{p}\subseteq K_{p}$ for each prime $p$. Then, $\delta_{E}(f,a)\geqslant\delta_{\mathcal{F}}(f,a)$. Furthermore, if $L_{p}=K_{p}$ for each $p\nmid M_{E}$, then

[TABLE]

where $(f,M_{E})=1$, $g\mid M_{E}^{\infty}$, and $(a,fg)=1$.

Remark 6**.**

For any prime $p\nmid A(E)$, $[K_{p}:{\mathbb{Q}}]=(p^{2}-p)(p^{2}-1)$, so the product is absolutely convergent.

Proof.

For any finite subset $\mathcal{P}$ of primes, the set

[TABLE]

contains

[TABLE]

Thus, proceeding as in the proof of [6, Lemma 6.1], the first assertion follows.

As for the latter, we write

[TABLE]

First note that

[TABLE]

and since numerators are the same, so are the denominators. Furthermore, since $(ef,dgM_{E})=1$, Lemma 8 gives

[TABLE]

Thus, we have

[TABLE]

Since $K_{e}\cap{\mathbb{Q}}(\zeta_{f})$ and $L_{d}\cap{\mathbb{Q}}(\zeta_{g})$ are disjoint by Lemma 8, we see that

[TABLE]

Finally, since $K_{e}\cap{\mathbb{Q}}(\zeta_{f})={\mathbb{Q}}(\zeta_{(e,f)})$ by Lemma 7, $\delta_{\mathcal{F}}(fg,a)$ is given by

[TABLE]

and the result follows by writing the last sum as a product. ∎

Proof of Theorem 4.

We choose $L_{2}=K_{2}$, $L_{p}={\mathbb{Q}}(\zeta_{p})$ for $p\mid M_{E}/2$, $L_{p}=K_{p}$ for $(p,M_{E})=1$. By Lemma 12,

[TABLE]

Splitting the sum over $d$, we obtain

[TABLE]

Here, we have used the fact that $K_{2}\cap{\mathbb{Q}}(\zeta_{d})=K_{2}\textsuperscript{ab}\cap{\mathbb{Q}}(\zeta_{d})$ is either ${\mathbb{Q}}$ or $K_{2}\textsuperscript{ab}$. The latter implies $K_{2}\textsuperscript{ab}\subseteq{\mathbb{Q}}(\zeta_{(\mathfrak{f}_{2},d)})$, which holds if $\mathfrak{f}_{2}=(\mathfrak{f}_{2},d)$; that is, if $\mathfrak{f}_{2}\mid d$. The converse trivially holds. If $\mathfrak{f}_{2}$ is not square-free, then

[TABLE]

If $\mathfrak{f}_{2}$ is square-free, then by (14) and (15), it must be odd. Then, writing

[TABLE]

we derive

[TABLE]

The second sum on the right side can be written as

[TABLE]

where we have used the fact that $M_{E}$ and $\mathfrak{f}_{2}$ are square-free (and, $\mathfrak{f}_{2}$ is odd). Inserting this expression back into the previous equation, we obtain

[TABLE]

Combining this identity with (20), we conclude that

[TABLE]

and this gives (10). ∎

4. Proofs of Theorems 6 and 7

Throughout this section, we assume that $E$ is an elliptic curve over ${\mathbb{Q}}$ with complex multiplication.

4.1. Proof of Theorem 6

We proceed as in the proof of Theorem 3. Everything up to equation (17) applies to the CM case. We start with the estimate of $\Sigma_{1}$ given by (16). By [6, Proposition 3.8], $[K_{d}:{\mathbb{Q}}]\gg\varphi(d)^{2}$. Thus, using Lemma 11 we obtain

[TABLE]

which yields

[TABLE]

Next, we deal with

[TABLE]

If $p$ is a prime counted in $\pi_{E,d}(x;f,a)$, then $p$ splits completely in $K_{d}$ and thus in ${\mathbb{Q}}(\zeta_{d})$ since ${\mathbb{Q}}(\zeta_{d})\subseteq K_{d}$. Thus, by Lemma 5, $d^{2}$ divides $|\widetilde{E}({\mathbb{F}}_{p})|$ and also $d\mid p-1$. Hence, we note that $|\widetilde{E}({\mathbb{F}}_{p})|\neq p+1$, since otherwise, $d\mid p+1-(p-1)=2$, which is impossible since $d>y>2$. This means no prime except possibly $p=3$ that splits completely in $K_{d}$ can have supersingular reduction. Therefore, it follows from [4, Lemma 2.2] that $p\neq 3$ splits completely in $K_{d}$ if and only if $\pi_{p}-1\in d\mathfrak{O}_{K}$. Here, $\pi_{p}$ is one of the complex roots of the polynomial $X^{2}-(p+1-|\widetilde{E}({\mathbb{F}}_{p})|)X+p$. Note that $N_{K/{\mathbb{Q}}}(\pi_{p})=\pi_{p}\overline{\pi_{p}}=p$. Thus, we deduce that

[TABLE]

Since $K$ is an imaginary quadratic extension of ${\mathbb{Q}}$, $K={\mathbb{Q}}(\sqrt{-D})$ for some square-free positive integer $D$, and $\mathfrak{O}_{K}={\mathbb{Z}}[\omega_{D}]$, where

[TABLE]

Thus, any $\alpha\in\mathfrak{O}_{K}$ with $\alpha\equiv 1\,\text{mod }d\mathfrak{O}_{K}$ can be written as

[TABLE]

for some integers $b$ and $c$, and therefore has its norm equal to

[TABLE]

Note that

[TABLE]

We shall use this equivalent form only when $D\equiv 3\,\text{mod }4$ since, in this case, $4N_{K/{\mathbb{Q}}}(\alpha)$ becomes a quadratic form in $b,c,d$ with integer coefficients. Using this observation we deduce that $\pi_{E,d}(x;f,a)$ is at most

[TABLE]

where

[TABLE]

Now, summing over $d\in(y,\sqrt{x}+1]$ leads to the bound

[TABLE]

with the parity condition required only when $D\equiv 3\,\text{mod }4$. Note that the second inequality follows from the fact that

[TABLE]

since $F(b,d,c)$ has integer coefficients.

For $y\in[2f,\sqrt{x}]$, and uniformly for any $\alpha,\beta,\gamma$ modulo $f$,

[TABLE]

Note that the implied constant depends on $K$. Since $E/{\mathbb{Q}}$ has CM by $\mathfrak{O}_{K}$, then $K$ is one of the nine imaginary quadratic fields of class number one, and so the implied constant above can be replaced by an absolute constant. Inserting this estimate into the previous estimate of $\Sigma_{2}$, we deduce that

[TABLE]

where $G_{D}(a,f)$ is the cardinality of the set

[TABLE]

Combining (21) and (22) we obtain the bound

[TABLE]

Recalling that $2f\leqslant y\leqslant\sqrt{x}$ and using [9, Lemma 2.4] yields the error

[TABLE]

Note that the second term can be eliminated since it is already smaller than the fifth term, and this gives the error in (11).

To complete the proof of Theorem 6, we need to estimate $G_{D}(a,f)$. Since $G_{D}$ is multiplicative in the second variable, it is enough to estimate $G_{D}(a,p^{k})$ for primes $p$ with $p^{k}\|f^{\prime}$. Note that $p\nmid a$ since $(a,f)=1$.

Assume first that $D\equiv 1,2\,\text{mod }4$. Recall, in this case, $f^{\prime}=f$ and $a^{\prime}=a$. Put

[TABLE]

Note that for any triple in $A_{i}$ with $i\geqslant 1$, $p\nmid D\beta\gamma$. Also, if $i\geqslant k$, then for $\varphi(p^{k})$ possible choices of $1\leqslant\gamma\leqslant p^{k}$, there are at most $\eta(p^{k})$ choices for $\beta$ satisfying

[TABLE]

where $\eta(p^{n})=2$ if $p$ is odd, or $p=2$ and $n=1,2$, and it equals $4$ otherwise. Furthermore,

[TABLE]

implies

[TABLE]

and there is unique $\alpha$ modulo $p^{\left\lceil k/2\right\rceil}$ satisfying this congruence, which gives $p^{k-\left\lceil k/2\right\rceil}$ choices for $\alpha$ modulo $p^{k}$. Hence,

[TABLE]

Next, assume that $p\nmid a-D(\beta\gamma)^{2}$. Then,

[TABLE]

has at most $\eta(p^{k})$ solutions. If $X_{0}=X_{0}(\beta,\gamma)$ is one of these solutions, and $p^{i}\|\beta$ with $0\leqslant i\leqslant k$, then there are $\gcd(\beta,p^{k})=p^{i}$ values of $\alpha\in[1,p^{k}]$ satisfying

[TABLE]

provided $p^{i}\mid X_{0}-1$. Since there are $\varphi(p^{k-i})$ values of $\beta$ modulo $p^{k}$ with $p^{i}\|\beta$, and at most $p^{k}$ values of $\gamma$, we get

[TABLE]

Finally, assume $1\leqslant i\leqslant k-1$ and $k>2$ (note for $k\leqslant 2$, this part will not contribute as will be seen below). In this case, we have

[TABLE]

For $\varphi(p^{k})$ choices of $\gamma$, there are at most $\eta(p^{i})p^{k-i}$ choices for $\beta$ modulo $p^{k}$. For these values of $\gamma$ and $\beta$,

[TABLE]

implies $p^{\left\lceil i/2\right\rceil}\mid X$, which then yields $p^{i+1}\mid a-D(\beta\gamma)^{2}$ if $i$ is odd. Thus, (26) has no solutions for odd $i<k$. Otherwise, writing $X=p^{i/2}Y$ with $1\leqslant Y\leqslant p^{k-i/2}$ gives

[TABLE]

Since the right side is now coprime to $p$, there are at most $\eta(p^{k-i})$ solutions for $Y$ modulo $p^{k-i}$, which gives $\eta(p^{k-i})p^{i/2}$ choices for $X$. If $X_{0}$ is one of these possible solutions, then

[TABLE]

has exactly one solution for $\alpha$. Hence,

[TABLE]

Combining (24), (25) and (27), we conclude that

[TABLE]

Next, assume $D\equiv 3\,\text{mod }4$. We shall count the solutions to

[TABLE]

Assume first that $p$ is odd. Since $p\nmid 4a$ in this case, the proof in the previous case goes through and gives the same upper bound in (28) for $G_{D}(a,p^{k})$.

Next, assume $2^{k}\|f$. Then, we consider $F\equiv 4a\,\text{mod }2^{k+2}$ with $\alpha\equiv\gamma\,\text{mod }2$. If $\gamma$ is even, then so is $\alpha$ and we have to count the solutions to

[TABLE]

where $\alpha,\gamma\in[1,2^{k+1}]$ and $\beta\in[1,2^{k+2}]$. When all variables lie in $[1,2^{k}]$, there are at most $2k\eta(2^{k})2^{2k}$ triples by (28). Lifting variables, we get at most $32k\eta(2^{k})2^{2k}$ solutions.

When $\alpha$ and $\gamma$ are odd and $\beta$ is even, we end up with the congruence

[TABLE]

where $\alpha,\gamma\in[1,2^{k+2}]$ are odd, while $\beta\in[1,2^{k+1}]$. If $\beta$ is odd,

[TABLE]

has at most $\eta(2^{k})$ solutions for $\gamma$ since right hand is odd, and these can be lifted to $4\eta(2^{k})$ solutions mod $2^{k+2}$. Hence, there are at most $4\eta(2^{k})2^{2k+1}$ triples modulo $2^{k+2}$.

If $2^{i}\|\beta$ for $1\leqslant i\leqslant k$, then

[TABLE]

has at most $\eta(2^{k})$ solutions. If $X_{0}$ is one of the possible solutions, then

[TABLE]

has at most $2^{i+2}$ solutions for $\alpha$ modulo $2^{k+2}$. There are $2^{k+1-i}$ values of $\beta$ modulo $2^{k+2}$ with $2^{i}\mid\beta$, and $2^{k+1}$ odd values of $\gamma\in[1,2^{k+2}]$. Hence, we get at most

[TABLE]

solutions.

Finally, if all the variables are odd, then we have

[TABLE]

Given odd $\alpha,\beta\in[1,2^{k+2}]$, there are at most $\eta(2^{k+2})$ solutions for $\gamma\in[1,2^{k+2}]$ since the right hand side is odd. Hence, we obtain at most $\eta(2^{k+2})2^{2k+2}$ triples. Combining all the estimates, we deduce that

[TABLE]

Multiplying the bounds for $G_{D}(a,p^{k})$ over the prime powers dividing $f$, we obtain the bound in (12). This completes the proof.

4.2. Proof of Theorem 7

Recall that End${}_{\overline{{\mathbb{Q}}}}(E)\simeq\mathfrak{O}_{K}$, where $K={\mathbb{Q}}(\sqrt{-D})$. By [21, Lemma 6], for all $p\geqslant 3$, $K\subset K_{p}$. Suppose first that $K_{2}\cap K=K_{2}\textsuperscript{ab}\cap K={\mathbb{Q}}$ and that

[TABLE]

Note that

[TABLE]

since

[TABLE]

Then, taking $\mathcal{F}=\{K_{2},K\}$ and using [6, Lemma 6.1] yields

[TABLE]

Thus, $\delta_{\mathcal{F}}>0$ if $K_{2}\subsetneq{\mathbb{Q}}(\zeta_{f})$ or $\gamma_{a,f}(K_{2})=0$, and $K\subsetneq{\mathbb{Q}}(\zeta_{f})$ or $\gamma_{a,f}(K)=0$, provided (29) holds and $K_{2}\cap K={\mathbb{Q}}$.

If $K_{2}\textsuperscript{ab}=K$, then taking $\mathcal{F}=\{K_{2}\}$ yields

[TABLE]

We conclude again that $\delta_{\mathcal{F}}>0$ if $K_{2}\subsetneq{\mathbb{Q}}(\zeta_{f})$ or $\gamma_{a,f}(K_{2})=0$.

Appendix A Intersections of Division Fields

By Ernst Kani

Let $E/K$ be an elliptic curve defined over a number field $K$. Recall that for each integer $m\geqslant 1$ we have a natural representation

[TABLE]

The fixed field of its kernel is the $m$-division field $K(E[m])=\overline{K}^{\,\ker(\rho_{m})}$, so

[TABLE]

Put

[TABLE]

By Serre [25], $S_{E/K}$ is finite if (and only if) $E$ is non-CM, which we assume henceforth. In this case the Serre constant of $E/K$ is defined as the number

[TABLE]

The main aim of this appendix is to prove the following result.

Theorem 1**.**

Let $E/{\mathbb{Q}}$ be a non-CM elliptic curve, and let $m,n\geqslant 1$ be integers with $(m,nN_{E}A_{E/{\mathbb{Q}}})=1$, where $N_{E}$ denotes the conductor of $E/{\mathbb{Q}}$. Then,

[TABLE]

Note that we cannot drop the condition of Theorem 1 that $(m,N_{E})=1$, even if $m$ is a prime; cf. Proposition 2 and Example 1 below.

As we shall see presently, Theorem 1 follows from the following result which is valid for elliptic curves over an arbitrary number field $K$. This, in turn, follows easily from the results of the Appendix of [5].

Theorem 2**.**

Let $E/K$ be a non-CM elliptic curve, and let $m,n\geqslant 1$ be integers with $(m,nA_{E/K})=1$. Then, $K(E[m])\,\cap\,K(E[n])$ is an abelian extension of $K$.

Proof of Theorem 1 (using Theorem 2).

Put $L={\mathbb{Q}}(E[n])\cap{\mathbb{Q}}(E[m])$. By Theorem 2 we know that $L/{\mathbb{Q}}$ is an abelian extension with $L\subset{\mathbb{Q}}(E[m])$. Since $m$ is coprime to $A_{E/{\mathbb{Q}}}$, we know that ${\mathbb{Q}}(\zeta_{m})$ is the maximal abelian extension of ${\mathbb{Q}}$ in ${\mathbb{Q}}(E[m])$; cf. Corollary 13 of the Appendix of [5]. Thus, $L\subset{\mathbb{Q}}(\zeta_{m})$, and so $L/{\mathbb{Q}}$ is ramified only at the primes $p\mid m$. On the other hand, since $L\subset{\mathbb{Q}}(E[n])$, we see by the criterion of Néron-Ogg-Shafarevič that $L/{\mathbb{Q}}$ is ramified only at primes $p\mid nN_{E}$; cf. Silverman [26, Theorem VII.7.1]. Thus, since $(m,nN_{E})=1$, it follows that $L/{\mathbb{Q}}$ is everywhere unramified and so $L={\mathbb{Q}}$, as claimed. ∎

To prove Theorem 2, we will use some basic facts about the non-abelian composition factors of a subgroup $G$ of $\operatorname{GL}({m})$ which were presented in the Appendix of [5]. For this, let $\mathcal{N}(G)$ denote the set of (isomorphism classes) of non-abelian composition factors of a group $G$, and put

[TABLE]

Proposition 1**.**

(a)* For any integer $m>1$, we have that*

[TABLE]

where $\operatorname{PSL}_{2}(p)=\operatorname{SL}_{2}({\mathbb{Z}}/p{\mathbb{Z}})/\{\pm 1\}$, if $p$ is prime. Moreover, $\operatorname{Occ}(\operatorname{PSL}_{2}(p))=\emptyset$ when $p=2$ or $3$, whereas for $p\geqslant 5$ we have

[TABLE]

(b)* If $G\leqslant\operatorname{GL}(m)$, where $(m,30)=1$, then*

[TABLE]

If this is the case, then $G/\operatorname{SL}(m)$ is abelian and $\mathcal{N}(G)=\{\operatorname{PSL}_{2}(p):p|m\}$.

Proof.

(a) This is Lemma 10 of the Appendix of [5].

(b) The first assertion is Theorem 2(b) of the same Appendix. To prove the others, note that $G/\operatorname{SL}(m)\leqslant\operatorname{GL}(m)/\operatorname{SL}(m)\simeq({\mathbb{Z}}/m{\mathbb{Z}})^{\times}$ is abelian, so

[TABLE]

the latter because $\operatorname{SL}(m)=\prod_{p|m}\operatorname{SL}(p^{v_{p}(m)})$. Since the kernel of the homomorphism $\operatorname{SL}(p^{r})\rightarrow\operatorname{SL}(p)$ is a $p$-group, we have that

[TABLE]

and so the last assertion follows. ∎

Corollary 1**.**

If $(m,A_{E/K})=1$, then $\operatorname{SL}({m})\leqslant G_{m}$. Thus, if $L/K$ is a solvable extension with $L\subset K(E[m])$, then $L/K$ is abelian.

Proof.

Since $(m,A_{E/K})=1$, we have that $G_{p}=\operatorname{GL}({p})$ for all $p\mid m$, and so $\operatorname{PSL}_{2}(p)\in\operatorname{Occ}(\operatorname{GL}(p))\subset\operatorname{Occ}(G_{m})$, the latter because $G_{p}$ is a quotient of $G_{m}$, $\forall p\mid m$. Thus, $\operatorname{SL}({m})\leqslant G_{m}$ by Proposition 1 because $(m,30)=1$.

To prove the second assertion, let

[TABLE]

Since $G/H\simeq\operatorname{Gal}(L/K)$ is solvable and $G\simeq G_{m}$, we have that $\operatorname{Occ}(H)=\operatorname{Occ}(G_{m})$. Thus, by Proposition 1(b) there exists $H_{1}\leqslant H$ with $H_{1}\simeq\operatorname{SL}({m})$, and then $G/H_{1}$ is abelian. Thus, the quotient $G/H$ of $G/H_{1}$ is also abelian. ∎

Proof of Theorem 2.

Put $L=K(E[n])\cap K(E[m])$ and $H=\operatorname{Gal}(L/K)$. Then $H$ is a quotient of $\operatorname{Gal}(K([E[n])/K)\simeq G_{n}\leqslant\operatorname{GL}(n)$ and also of $\operatorname{Gal}(K(E[m])/K)\simeq G_{m}$, so

[TABLE]

where the last inclusion follows from both parts of Proposition 1 together with Corollary 1. Since $(n,m)=1$ and $5\nmid m$, we see that this intersection is empty because $\operatorname{PSL}(p)\simeq A_{5}\Leftrightarrow p=5$ and $\operatorname{PSL}(p)\simeq\operatorname{PSL}(q)\Leftrightarrow p=q$; cf. Lemma 3 of the Appendix of [5]. Thus, $\mathcal{N}(H)=\emptyset$, which means that $H$ is solvable. Since $L\subset K(E[m])$, we have by Corollary 1 that $L/K$ is abelian. ∎

We now show that the condition $(m,N_{E})=1$ in Theorem 1 cannot be dropped. This follows from the following result together with Example 1 below which shows that there exist elliptic curves $E/{\mathbb{Q}}$ satisfying the hypotheses of Proposition 2.

Proposition 2**.**

Let $E/{\mathbb{Q}}$ be an elliptic curve with prime conductor $N_{E}=p$ with $p\equiv 3\,\text{mod }4$. Suppose that the discriminant of some integral model of $E/{\mathbb{Q}}$ satisfies $\Delta_{E}<0$ and $v_{p}(\Delta_{E})\equiv 1\,\text{mod }2$. Then, $(p,A_{E/{\mathbb{Q}}})=1$, but

[TABLE]

Proof.

Since there are no elliptic curves of conductor $N_{E}<11$, the hypothesis implies that $p\geqslant 11$. Moreover, since $N_{E}$ is squarefree, $E/{\mathbb{Q}}$ is semi-stable (and non-CM), so by Corollary 1 of §5.4 of Serre [25], we know that $p\notin S_{E/{\mathbb{Q}}}$ because $p>(\sqrt{2}+1)^{2}\approx 5.8$. Thus $p\nmid A_{E/{\mathbb{Q}}}$.

For any integral model of $E/{\mathbb{Q}}$, there exists an integer $d\geqslant 1$ such that

[TABLE]

where $\Delta_{E/{\mathbb{Q}}}^{\textsuperscript{min}}$ denotes the minimal discriminant of $E/{\mathbb{Q}}$. Thus, the given conditions on $\Delta_{E}$ do not depend on the choice of the model.

Since $N_{E}$ and $\Delta^{\textsuperscript{min}}_{E/{\mathbb{Q}}}$ have the same prime divisors, we see that $\Delta^{\textsuperscript{min}}_{E/{\mathbb{Q}}}=-p^{k}$, with $k$ odd, so $\Delta_{E}=-d^{12}p^{k}$. By taking an integral model of the form $Y^{2}=f(X)$, where $f(X)$ is a cubic, we see that ${\mathbb{Q}}(E[2])$ is the splitting field of $f(X)$. Since $\Delta_{E}=16\,\text{disc}(f)$, it follows from field theory that ${\mathbb{Q}}(\sqrt{-p})\subset{\mathbb{Q}}(E[2])$. Moreover, ${\mathbb{Q}}(\sqrt{-p})$ is the maximal abelian extension of ${\mathbb{Q}}$ in ${\mathbb{Q}}(E[2])$. Indeed, if $f(X)$ is irreducible, then this is clear by field theory, and otherwise we have that ${\mathbb{Q}}(E[2])={\mathbb{Q}}(\sqrt{-p})$ is abelian.

On the other hand, the condition $p\equiv 3\,\text{mod }4$ implies (cf. [19, Theorem V1.3.3]) that

[TABLE]

This proves the inclusion ${\mathbb{Q}}(\sqrt{-p})\subset{\mathbb{Q}}(E[p])\cap{\mathbb{Q}}(E[2])$. Since the latter intersection is abelian by Theorem 2 and is contained in ${\mathbb{Q}}(E[2])$, it follows from what was said above that it is contained in ${\mathbb{Q}}(\sqrt{-p})$, and so the assertion follows. ∎

Example 1**.**

Consider the following elliptic curves $E_{i}/{\mathbb{Q}}$ defined by the equations

[TABLE]

The discriminant of $E_{i}$ is $\Delta_{E_{i}}=-6^{12}p_{i}$, for $i=1,2,3$, where $p_{1}=11$, $p_{2}=43$ and $p_{3}=19$. Furthermore, $N_{E_{i}}=p_{i}\equiv 3\,\text{mod }4$, and so $E_{i}/{\mathbb{Q}}$ satisfies the hypotheses of Proposition 2 with $p=p_{i}$, for $i=1,2,3$.