The field generated by the points of small prime order on an elliptic curve

Loïc Merel and William A. Stein

Introduction

Let Q̄ be an algebraic closure of Q, and for any prime number p, denote by Q(μ_{p}) the cyclotomic subfield of Q̄ generated by the pth roots of unity.

Theorem . — Let p be a prime. If there exists an elliptic curve E over Q(μ_{p}) such that the points of order p of E(Q̄) are all Q(μ_{p})-rational, then p = 2, 3, 5, 13 or p > 1000.

The case p = 7 was treated by Emmanuel Halberstadt. The part of the theorem that concerns the case p ≡ 3 (mod 4) is given in [3]. In this paper, we give the details that permit our treating the more difficult case in which p ≡ 1 (mod 4). We treat this last case with the aid of Proposition 2 below, which is not present in loc. cit.. The case p = 13 is currently under investigation by Marusia Rebolledo, as part of her Ph.D. thesis.

1. Counterexamples define points on X_{0}(p)(Q(\sqrt{p}))

First we recall some of the results and notation of [3]. Let S_{2}(Γ_{0}(p)) denote the space of cusp forms of weight 2 for the congruence subgroup Γ_{0}(p). Denote by T the subring of End S_{2}(Γ_{0}(p)) generated by the Hecke operators T_{n} for all integers n. Let f ∈ S_{2}(Γ_{0}(p)) have q-expansion ∑_{n=1}^{∞} a_{n}q^{n}. When χ is a Dirichlet character, denote by L(f, χ, s) the entire function which extends the Dirichlet series ∑_{n=1}^{∞} a_{n}χ(n)/n^{s}.

Let S be the set of isomorphism classes of supersingular elliptic curves in characteristic p. Denote by Δ_{S} the group formed by the divisors of degree 0 with support on S. It is equipped with a structure of T-module (induced, for example, from the action of the Hecke correspondences on the fiber at p of the regular minimal model of X_{0}(p) over Z).

Let j ∈ F̄_{p} − J_{S}, where J_{S} denotes the set of supersingular modular invariants. We denote by ι_{j} the homomorphism of groups Δ_{S} ⟶ F̄_{p} that associates to ∑_{E} n_{E}[E] the quantity ∑_{E} n_{E}/(j − j(E)), where j(E) denotes the modular invariant of E.

One says that an element j ∈ F_{p} is anomalous if there exists an elliptic curve over F_{p} with modular invariant j that possesses an F_{p}-rational point of order p (then necessarily j ∉ J_{S}).

Let p be a prime that is congruent to 1 modulo 4. In the following proposition we prove, under a hypothesis on p, that if E is an elliptic curve over Q(μ_{p}) all of whose torsion is Q(μ_{p})-rational, then for each subgroup C ⊂ E(Q̄) of order p, the point (E, C) on X_{0}(p) is defined over Q(\sqrt{p}). As we will see in Proposition 2, this Q(\sqrt{p})-rationality conclusion is contrary to fact, from which we conclude that such elliptic curves E do not exist when the hypothesis on p is satisfied. In Section 3 we verify this hypothesis for p = 11 and 13 < p < 1000.

Proposition 1. — Suppose that p is congruent to 1 modulo 4. Suppose that for all anomalous j ∈ F_{p} and all non-quadratic Dirichlet characters χ: (Z/pZ)^{∗} ⟶ C^{∗}, there exists t_{χ} ∈ T and δ ∈ Δ_{S} such that L(f, χ, 1) ≠ 0 for every newform f ∈ t_{χ}S_{2}(Γ_{0}(p)) and ι_{j}(t_{χ}δ) ≠ 0.

Let E be an elliptic curve over Q(μ_{p}), such that the points of order p of E(Q̄) are all Q(μ_{p})-rational. Then for all subgroups C of order p of E(Q̄), there exists an elliptic curve E_{C} over Q(\sqrt{p}) equipped with a Q(\sqrt{p})-rational subgroup D_{C} of order p, and the pairs (E, C) and (E_{C}, D_{C}) are Q̄-isomorphic. Proof. — We prove the proposition using the results of [3]. The hypothesis ι_{j}(t_{χ}δ) ≠ 0 forces t_{χ} ∉ pT and, a fortiori, t_{χ} ≠ 0; in addition, the non-vanishing hypothesis on the L-series forces the hypothesis H_{p}(χ) of loc. cit., introduction.

By assumption, hypothesis H_{p}(χ) is satisfied for all non-quadratic Dirichlet characters χ of conductor p. Thus Corollary 3 of Proposition 6 of loc. cit. implies that E has potentially good reduction at the prime ideal P of Z[μ_{p}] that lies above p.

Denote by j the modular invariant of the fiber at P of the Néron model of E. According to the corollary of Proposition 15 of loc. cit., j is anomalous.

Let C be a subgroup of E(Q̄) of order p. By assumption E is an elliptic curve over Q(μ_{p}) whose points of order p are all Q(μ_{p})-rational, so the pair (E, C) defines a Q(μ_{p})-rational point P of the modular curve X_{0}(p).

Consider the morphism ϕ_{χ} = ϕ_{t_{χ}} : X_{0}(p) → J_{0}(p) obtained by composing the standard embedding of X_{0}(p) into J_{0}(p) with t_{χ}. As in section 1.3 of loc. cit., ϕ_{χ} extends to a map from the minimal regular model of X_{0}(p) to the Néron model of J_{0}(p). When ι_{j}(t_{χ}δ) ≠ 0, this map is a formal immersion at the point P_{/F_{p}}, according to loc. cit., Proposition 4. The hypothesis that L(f, χ, 1) ≠ 0 for every newform f ∈ t_{χ}S_{2}(Γ_{0}(p)), translates into L(t_{χ}J_{0}(p), χ, 1) ≠ 0, which in turn implies that the χ-isotypical component of t_{χ}J_{0}(p)(Q(μ_{p})) is finite (this is Kato’s theorem, see the discussion in section 1.5 of loc. cit.). We can then apply Corollary 1 of Proposition 6 of loc. cit.. This proves that P is Q(\sqrt{p})-rational, which translates into the conclusion of Proposition 1.

Remark 1: Proposition 1 is true even under the weaker hypothesis that t_{χ} lies in T ⊗ Z[χ], which acts Z[χ]-linearly on modular forms.

2. Elliptic curves and quadratic fields Proposition 2. — Let p be a prime number > 5 and congruent to 1 modulo 4. Let E be an elliptic curve over Q̄. There exists a subgroup C ⊂ E(Q̄) of order p such that (E, C) can not be defined over Q(\sqrt{p}). Proof. — We procede by contradiction, i.e., we assume that for all cyclic subgroups C of order p of E(Q̄), the pair (E, C) can be defined over Q(\sqrt{p}). We choose such a pair (E_{0}, C_{0}) over Q(\sqrt{p}).

Assume first that all twists of E are quadratic, i.e. that j(E) is neither 0 nor 1728. We show that the group Gal(Q̄/Q(\sqrt{p})) acts by scalars on the F_{p}-vector space E_{0}(Q̄)[p]. For this it suffices to show that all subgroups of order p of E_{0}(Q̄)[p] are stable by Gal(Q̄/Q(\sqrt{p})).

Suppose C_{1} is a cyclic subgroup of order p of E_{0}(Q̄)[p]. By assumption, there exists a quadratic twist E_{1} of E_{0} and a cyclic subgroup C′_{1} of E_{1}(Q̄)[p] that is defined over Q(\sqrt{p}), such that the image of C_{1} by the isomorphism E_{0} ≃ E_{1} is C′_{1}. Since Gal(Q̄/Q(\sqrt{p})) leaves C′_{1} stable and the action of Gal(Q̄/Q(\sqrt{p})) on E_{0}(Q̄)[p] is a quadratic twist of the action on E_{1}(Q̄)[p], we see that Gal(Q̄/Q(\sqrt{p})) leaves C_{1} stable. Thus Gal(Q̄/Q(\sqrt{p})) fixes all lines in E_{0}(Q̄)[p], and hence acts by scalars. Denote by α the corresponding character of Gal(Q̄/Q(\sqrt{p})).

Because of the Weil pairing, α^{2} coincides with the cyclotomic character modulo p, and it factors through Gal(Q(μ_{p})/Q(\sqrt{p})). But, when p ≡ 1 (mod 4), the group Gal(Q(μ_{p})/Q(\sqrt{p})) is of even order, and the characters modulo p form a group generated by the reduction modulo p of the cyclotomic character, which, therefore, can not be a square.

Next suppose that j(E) = 0 or j(E) = 1728. Indeed, in these two cases E has complex multiplication by an order of K = Q[\sqrt{−3}] or Q[\sqrt{−1}]. Let d_{K} = 3 or d_{K} = 2 in these two cases respectively. Let C be a subgroup of order p of E(Q̄). Consider the map ρ_{0} : Gal(Q̄/Q(\sqrt{p})) ⟶ Aut E_{0}(Q̄)[p]. Since E has complex multiplication, the image of ρ_{0} has no element of order p. Therefore, there are at least two subgroups, including C_{0}, of order p of E(Q̄) stable under the image of ρ_{0}. Call the other subgroup C_{1}. Let C_{2} be a subgroup of order p of E(Q̄) which is distinct from C_{0} and C_{1}. The pair (E, C_{2}) can be defined over Q(\sqrt{p}). Therefore, there exists an extension field K_{2} of Q(\sqrt{p}), whose degree d_{2} divides 2d_{K}, such that the image of the restriction of ρ_{0} to Gal(Q̄/K_{2}) leaves stable three distinct subgroups of order p of E_{0}(Q̄), and therefore consists only of scalars. If d_{2} ≤ 2, one concludes as in the cases where j(E) ≠ 0 and j(E) ≠ 1728. We suppose now that d_{2} > 2. The projective image of ρ_{0} has order d_{K}.

Since E is an elliptic curve over Q̄ with complex multiplication by a field of class number one, there is a model for E that is defined over Q. Consider the map ρ : Gal(Q̄/Q) ⟶ Aut E(Q̄)[p]. By the theory of complex multiplication, the projective image of ρ has order 2(p+1) or 2(p−1). There exists a field extension L of degree dividing d_{K} of Q(\sqrt{p}) such that the restrictions to Gal(Q̄/L) of the projective images of ρ and ρ_{0} coincide. Therefore one has (p−1)|d_{K}^{2} or (p+1)|d_{K}^{2}. This imposes p = 5 and d_{K} = 2.

3. Verification of the hypothesis of Proposition 1 Let p be a prime number. In this section we explain how we used a computer to verify that the second hypothesis of Proposition 1 are satisfied for p = 11 and 13 < p < 1000. (In the present paper, this verification is only required for p that are congruent to 1 modulo 4.)

We first list the anomalous j-invariants j ∈ F_{p}. Since p is fairly small in the range of our computations, we created this list by simply enumerating all of the elliptic curves over F_{p} and counting the number of points on each curve. For example, when p = 31 the anomalous j-invariants are j = 10, 14.

Let χ : Z/pZ ⟶ C be a non-quadratic Dirichlet character, and denote by Z[χ] the subring of Q(ζ_{p−1}) generated by the image of χ. Denote by S_{2}(Γ_{0}(p); Z) the set of modular forms f ∈ S_{2}(Γ_{0}(p)) whose Fourier expansion at the cusp ∞ lies in Z[[q]].

We study the T-modules T, Δ_{S}, and S_{2}(Γ_{0}(p); Z). After extension of scalars to Q, these are T ⊗ Q-modules that are free of rank 1, of which the irreducible sub-T ⊗ Q modules are the annihilators of the minimal prime ideals of T. We compute a list of the minimal prime ideals of T by computing appropriate kernels and characteristic polynomials of Hecke operators of small index on Δ_{S}, which we find using the graph method of Mestre and Oesterlé [4].

Having computed the minimal prime ideals of T, we verify that some nontrivial ideal I of T (always a minimal prime ideal in the range of our computations) simultaneously satisfies the following three conditions:

1) For each anomalous j-invariant, there exists x ∈ Δ_{S} such that Ix = 0 and ι_{j}(x) ≠ 0.

2) Each of the newforms f ∈ S_{2}(Γ_{0}(p)) with If = 0 satisfies L(f, χ, 1) ≠ 0.

3) The image of I in the T-module T/pT is a direct factor.

Let I be an ideal of T. Here is how we verify these conditions for I.

Verification of condition 1.

We verified that I satisfies the first condition by finding a T-eigenvector v of Δ_{S} ⊗Z̄ that is annihilated by I and satisfies ι_{j}(v) ≠ 0 for all anomalous j-invariants. Because ι_{j} is a homomorphism, this implies the existence of x as in condition 1.

Verification of condition 2.

We verified the second condition using modular symbols. Our method is purely algebraic, so we do not perform any approximate computation of integrals. Using the algorithm described in [2], we compute the action of the Hecke algebra T on the space Hom_{Q[χ]}(H_{1}(X_{0}(p); Q[χ]), Q[χ]). By intersecting the kernels of appropriate elements of T, we find a basis φ_{1}, …, φ_{n} for the subspace of Hom_{Q[χ]}(H_{1}(X_{0}(p); Q[χ]), Q[χ]) that is annihilated by I. Let Φ_{I} = φ_{1}×⋯×φ_{n} denote the linear map H_{1}(X_{0}(p); Q[χ]) ⟶ Q[χ]^{n} defined by the φ_{i}.

Let T_{Q[χ]} = T ⊗ Q[χ], where Q[χ] is the number field generated the image of χ. The χ-twisted winding element (denoted θ_{χ} in [3])

e_{χ} = ∑_{a∈(Z/pZ)^{∗}} χ̄(a)\{∞, \frac{a}{p}\}

generates the χ-twisted winding submodule T_{Q[χ]} · e_{χ}. To compute this submodule, we use that T is generated, even as a Z-module, by T_{1}, T_{2}, …, T_{b}, for any b ≥ (p + 1)/6 (see [1]).

Lemma 3. — Let I be a minimal prime ideal of T, and let χ : (Z/NZ)^{∗} ⟶ C^{∗} be a nontrivial Dirichlet character. Then the dimension of the Q[χ]-vector space Φ_{I}(T_{Q[χ]} · e_{χ}) is equal to the cardinality of the set of newforms f such that If = 0 and L(f, χ, 1) ≠ 0. Proof. — We have

dim_{Q[χ]} Φ_{I}(T_{Q[χ]} · e_{χ}) = dim_{C} Φ_{I}(T_{C} · e_{χ}).

This dimension is invariant upon changing the basis φ_{1}, …, φ_{n} used to define Φ_{I}. In particular, over C there is a basis φ′_{1}, …, φ′_{n} so that the resulting map Φ′_{I} satisfies

Φ′_{I}(x) = (Re(∫_{x} f^{(1)}), Im(∫_{x} f^{(1)}), …, Re(∫_{x} f^{(d)}), Im(∫_{x} f^{(d)})),

where f^{(1)}, …, f^{(d)} are the Galois conjugates of a newform f^{(1)} = ∑ a_{n}^{(1)}q^{n} such that If^{(1)} = 0. Furthermore, Φ′_{I} is a T_{C}-module homomorphism if we declare that T_{C} acts on R^{2d} = C^{d} via

T_{n}(x_{1}, y_{1}, …, x_{d}, y_{d}) = T_{n}(z_{1}, …, z_{d}) = (a_{n}^{(1)}z_{1}, …, a_{n}^{(d)}z_{d}),

where z_{j} = x_{j} + iy_{j} and the a_{n}^{(j)} are Fourier coefficients of the f^{(j)}.

As explained in Section 2.2 of [3], ∫_{e_{χ}} f = ∗ · L(f, χ, 1), where ∗ is some nonzero real or pure-imaginary complex number, according to whether χ(−1) equals 1 or −1, respectively. Combining this observation with the equality

dim_{C} Φ_{I}(T_{C} · e_{χ}) = dim_{C}(T_{C} · Φ_{I}(e_{χ})),

and that the image of T_{C} in End(C^{d}) is equal to the diagonal matrices, proves the asserted equality.

Remark 2: The dimension of Φ_{I}(T_{Q[χ]} · e_{χ}) is unchanged if χ is replaced by a Galois-conjugate character.

In practice, computations over the cyclotomic field Q[χ] are extremely expensive. Fortunately, for our application it suffices to give a lower bound on the dimension appearing in the lemma. Such a bound can be efficiently obtained by instead computing the reductions of Φ, χ, and the χ-twisted winding submodule modulo a suitable maximal ideal of the ring of integers of Q[χ] that splits completely; this amounts to performing the above linear algebra over a relatively small finite field F_{ℓ} where ℓ is congruent to 1 modulo p − 1.

Remark 3: For every newform f in S_{2}(Γ_{0}(p)), with p ≤ 1000, and every mod p Dirichlet character χ, we found that L(f, χ, 1) ≠ 0 if and only if L(f^{σ}, χ, 1) ≠ 0 for all conjugates f^{σ} of f. More generally, for any f and χ, this equivalence holds if Q[χ] is linearly disjoint from the field K_{f} = (T/I) ⊗ Q. The first few primes for which there is a form f and a mod p character χ such that the linear disjointness hypothesis fails are p = 31, 113, 127, and 191. The analogue of this nonvanishing observation is false if we instead consider newforms on Γ_{1}(p) and allow χ to be arbitrary. For example, let f be one of the two Galois-conjugate newforms in S_{2}(Γ_{1}(13)). Then there is a character χ : (Z/7Z)^{∗} ⟶ C^{∗} of order 3 such that L(f, χ, 1) = 0 and L(f^{σ}, χ, 1) ≠ 0.

Verification of condition 3.

The third condition is satisfied for all p < 10000, except possibly p = 389, because we have verified that the discriminant of T is prime to p for all such p ≠ 389, so the ring T/pT is semisimple. The discriminant computation was carried out by the second author as follows. Using the method of [4], we computed discrimininants of characteristic polynomials mod p of the Hecke operators T_{2}, T_{3}, T_{5}, and T_{7}. In the few cases when all four of these characteristic polynomials had discriminant equal to 0 mod p, we resorted to modular symbols to compute several more characteristic polynomials until we found one having nonzero discriminant modulo p.

We consider the remaining case p = 389 in detail. There are exactly five minimal prime ideals of T, which we denote P_{1}, P_{2}, P_{3}, P_{6}, and P_{20}, where the quotient field of T/P_{i} has dimension i. The discriminant of the characteristic polynomial of T_{2} is exactly divisible by 389. Since the field of fractions of T/P_{20} has discriminant divisible by 389, we see that 389 is not the residue characteristic of any congruence prime. Let O_{i} = T/P_{i}. The natural map T → ∏ O_{i} has finite kernel and cokernel each of order coprime to 389, so T/389T ≅ ∏ O_{i}/389O_{i}. The nonquadratic characters χ : (Z/pZ)^{∗} → C^{∗} have orders 1, 4, 97, 193, 388. We must verify that for each of these degrees, one of the ideals P_{i} satisfies conditions 1–3. We check as above that conditions 1–3 for χ of order 4 are satisfied by P_{2} and conditions 1–3 for χ of order greater than 4 are satisfied by P_{1}. When χ is the trivial character, conditions 1–3 are satisfied only by P_{20}.

Summary.

For each prime p < 1000 different than 2, 3, 5, 7, 13, we verified the existence of an ideal that satisfies the three conditions given above, as follows. We consider each Galois conjugacy class of non-quadratic characters χ. We find a single newform f such that L(f, χ, 1) ≠ 0 for all conjugates of f and of χ. Then we let I be the annihilator of f, and try to verify condition 1 for all of the anamolous j-invariants in F_{p}. When the three conditions are satisfied for an ideal I of T, there exists t_{χ} ∈ T that is annihilated by I and is the inverse image of a projector of T/pT on the complement of I + pT. Putting δ = x, one has ι_{j}(t_{χ}δ) = ι_{j}(δ) ≠ 0 (because ι_{j} takes its values in characteristic p, it follows that δ is annihilated by I and t_{χ} ∈ 1 + pT + P). Every newform f ∈ t_{χ}S_{2}(Γ_{0}(p)) satisfies If = 0, and therefore, by our second condition, L(f, χ, 1) ≠ 0. The pair (t_{χ}, δ) then satisfies the conditions required by Proposition 1.

Acknowledgment: We would like to thank Barry Mazur for providing us several useful comments.

Bibliography

[1] A. Agashe, On invisible elements of the Tate-Shafarevich group, C. R. Acad. Sci. Paris Ser. I Math. 328 (1999), no. 5, 369–374.

[2] J. Cremona, Algorithms for modular elliptic curves, second ed., Cambridge University Press, Cambridge, (1997).

[3] L. Merel, Sur la nature non cyclotomique des points d’ordre fini des courbes elliptiques, To appear in Duke Math. Journal.

[4] J.-F. Mestre, La méthode des graphes. Exemples et applications, Proceedings of the international conference on class numbers and fundamental units of algebraic number fields (Katata), 217–242, (1986).