Galois representations with non-surjective traces

Chantal David, Concordia University Hershy Kisilevsky, Concordia University Francesco Pappalardi, Università Roma Tre

Abstract Let E be an elliptic curve over ℚ, and let r be an integer. According to the Lang– Trotter conjecture, the number of primes p such that a_{p}(E) = r is either finite, or is asymptotic to C_{E,r}\sqrt{x}/log x where C_{E,r} is a non-zero constant. A typical example of the former is the case of rational ℓ-torsion, where a_{p}(E) = r is impossible if r ≡ 1 (mod ℓ). We prove in this paper that, when E has a rational ℓ-isogeny and ℓ ≠ 11, the number of primes p such that a_{p}(E) ≡ r (mod ℓ) is finite (for some r modulo ℓ) if and only if E has rational ℓ-torsion over the cyclotomic field ℚ(ζ_{ℓ}). The case ℓ = 11 is special, and is also treated in the paper. We also classify all those occurences.

1 Introduction

Let E be an elliptic curve defined over ℚ and let N_{E} denote its conductor. For any prime p ∤ N_{E}, let E_{p} be the elliptic curve over 𝔽_{p} obtained by reducing E modulo p. Let a_{p}(E) be the trace of the Frobenius morphism of E_{p}/𝔽_{p}. Then, #E_{p}(𝔽_{p}) = p + 1 − a_{p}(E), and |a_{p}(E)| ≤ 2\sqrt{p}. If p > 3, the case a_{p}(E) = 0 corresponds to supersingular reduction mod p.

For a fixed r ∈ ℤ, let

π_{E,r}(x) = # {p ≤ x, p ∤ N_{E} : a_{p} (E) = r} .

If E has complex multiplication, Deuring [6] showed that π_{E,0}(x) ∼ \frac{1}{2}π(x), as the supersingular primes are exactly the primes which are inert in the field of complex multiplication. This is the only (non trivial) case where the asymptotic behavior of π_{E,r}(x) is known. In all other cases, for E an elliptic curve over ℚ, and r ∈ ℤ, Lang and Trotter [9] conjectured that there exists a constant C_{E,r} such that

π_{E,r}(x) ∼ C_{E,r} \frac{\sqrt{x}}{log x} as x → ∞.  (1)

Lang and Trotter define C_{E,r} “explicitly” for any E and r. When the constant is 0, the asymptotic relation is interpreted to mean that there is only a finite number of primes such that a_{p}(E) = r. We want to classify the cases where C_{E,r} = 0, i.e., the cases where the Lang-Trotter conjecture predicts only a finite number of primes p with a_{p}(E) = r. It will be clear from the explicit formula for the constants C_{E,r} that C_{E,r} = 0 implies that π_{E,r}(x) is bounded.

The Lang-Trotter constant is defined from the distributions of the traces a_{p}(E) modulo m, for m a positive integer. Let ρ_{E,m} be the Galois representation

ρ_{E,m} : Gal (\overline{ℚ}/ℚ) → Aut(E[m])

where E[m] is the subgroup of m-torsion points of E(\overline{ℚ}). Since E[m] ≃ (ℤ/mℤ)^{2}, after choosing a basis for E[m], we can identify Aut(E[m]) with GL_{2} (ℤ/mℤ). Let G(m) be the image of ρ_{E,m} in GL_{2} (ℤ/mℤ), and for any subgroup G of GL_{2} (ℤ/mℤ), let G_{r} be the subset of elements of G of trace r modulo m.

Let E be an elliptic curve without complex multiplication. Serre proved in [15] that the image of the Galois representation on the full torsion subgroup of E(\overline{ℚ}) is an open subgroup of GL_{2}(ℤ̂). It follows that there exists an integer M = M_{E} such that ρ_{E,ℓ} is surjective for all primes ℓ not dividing M, and such that the image in GL_{2}(ℤ̂) of the Galois representation on the torsion subgroup of E(\overline{ℚ}) is the full inverse image of G(M). The Lang-Trotter constant C_{E,r} is then defined as

C_{E,r} = \frac{2}{π} \frac{M |G(M)_{r}|}{|G(M)|} ∏_{ℓ∤M} \frac{ℓ |GL_{2} (𝔽_{ℓ})_{r}|}{|GL_{2} (𝔽_{ℓ})|}.

For the details, we refer the reader to [9], and to [5] for evidence supporting the conjectural value of the constant C_{E,r}. It follows from the definition of the constant that C_{E,r} = 0 if and only if |G(M)_{r}| = 0 as the infinite product converges to a positive number. In that case, a_{p}(E) ≢ r (mod M) for all p ∤ MN_{E}. The Lang-Trotter conjecture then severely restricts the behavior of π_{E,r}(x): if π_{E,r}(x) is finite for some r ∈ ℤ, then there is a positive integer M such that π_{E,s}(x) is finite for all s ≡ r (mod M). To our knowledge, the only cases of C_{E,r} = 0 presented in the literature are the curves with rational ℓ-torsion [9, p. 37].

For E/ℚ an elliptic curve and ℓ a prime, let S_{ℓ}(E) be the complement of the set of traces of E modulo ℓ, i.e.

S_{ℓ}(E) = 𝔽_{ℓ} \ {a ∈ 𝔽_{ℓ} : a_{p}(E) ≡ a (mod ℓ) for some p ∤ ℓN_{E}} .

Serre proved in [15] that if ℓ ≥ 5 and ρ_{E,ℓ} is not surjective, then G(ℓ) is contained either in a Borel subgroup or in the normalizer of a Cartan subgroup of GL_{2}(𝔽_{ℓ}). This is an exceptional situation and for “most” elliptic curves E/ℚ, ρ_{E,ℓ} is surjective for all primes. Precise estimates can be found in [7, 8]. We classify in this paper all elliptic curves E/ℚ for which G(ℓ) is contained in a Borel subgroup of GL_{2} (𝔽_{ℓ}), and S_{ℓ}(E) ≠ ∅. G(ℓ) is contained in a Borel subgroup if and only if E has a rational ℓ-isogeny. By the work of Mazur [10, 11], this can happen only for finitely many values of ℓ. This is not a complete classification of all cases where C_{E,r} = 0, as one should also look at exceptional Cartan primes (which are much more difficult since there is no analogue to Mazur’s Theorem in that case) and one should also consider the image of ρ_{E,m} for all positive integers m.

Theorem 1.1 Let ℓ ≠ 11 be a prime, and let E be an elliptic curve over ℚ with a rational ℓ-isogeny. Then the following are equivalent:

(i) S_{ℓ}(E) ≠ ∅;

(ii) E has non-trivial ℚ(ζ_{ℓ})-rational ℓ-torsion.

That (ii) implies (i) is straightforward (see Section 3); we prove in this paper that (i) implies (ii). We can also rephrase (ii) in terms of congruences for the a_{p}(E)’s, which gives the following corollary.

Corollary 1.2 Let ℓ ≠ 11 be a prime, and let E be an elliptic curve over ℚ with a rational ℓ-isogeny, and such that S_{ℓ}(E) ≠ ∅. Then, there is an integer a with 1 ≤ a ≤ ℓ − 1 such that

a_{p}(E) ≡ p^{a} + p^{ℓ−a} (mod ℓ).

The case ℓ = 11 is different, and does not fit Theorem 1.1. The following theorem will be proven in Section 8.

Theorem 1.3 Let E be an elliptic curve over ℚ with a rational 11-isogeny, and such that S_{11}(E) ≠ ∅. Then, E is isogenous to a twist of an elliptic curve with a ℚ(ζ_{11})-rational 11-torsion point.

We now use theorems 1.1 and 1.3 to classify all possible curves E/ℚ with a rational ℓisogeny such that S_{ℓ}(E) ≠ ∅. This classification is summarized in the following theorem. Our proof of the non-existence of elliptic curves for which S_{13}(E) ≠ ∅ is conditional to the Birch and Swinnerton-Dyer conjecture for abelian varieties over number fields (see Proposition 6.1).

Theorem 1.4 Let ℓ be a prime, and let E be an elliptic curve over ℚ with a rational ℓisogeny, and such that S_{ℓ}(E) ≠ ∅. Let a be as in Corollary 1.2. Then, all possible values of ℓ, S_{ℓ}(E) and a are described in the following table. The last column gives a curve with minimal conductor for which S_{ℓ}(E) is as prescribed, in the notation of Cremona’s tables [4].

ℓ S_{ℓ}(E) a E/ℚ  ℓ  S_{ℓ}(E)  a E/ℚ
2 {1}  1 E14A 11 {3, 4, 6, 7}  2 E121A
(𝔽_{ℓ}^{∗})^{2}  3 E121B
3 {1} 1 E14A {3, 4, 5, 7, 10} 4 E121C
{4, 7}  – E1089F
5 {1}  1 E11A
{3, 4} 3 E50A 19 (𝔽_{ℓ}^{∗})^{2}  5 E361A
43 (𝔽_{ℓ}^{∗})^{2}  11 E1849A
7 {1} 1 E26B 67 (𝔽_{ℓ}^{∗})^{2} 17 E4489A
{4, 6} 3 E294A 163 (𝔽_{ℓ}^{∗})^{2}  41 E26569
{3, 5, 6} 5 E49A

One notices that all the examples in the table of Theorem 1.4 which do not arise from rational ℓ-torsion over ℚ are non semistable elliptic curves. In fact, if E is a semistable elliptic curve over ℚ, and if the image of the Galois representation ρ_{E,ℓ} is not surjective, then it is essentially because E has a ℚ-rational ℓ-torsion point [15, Proposition 21].

2 Some Lemmas

Let E be an elliptic curve over ℚ, ℓ a prime, and suppose that E has a rational ℓ-isogeny. Then, the Galois representation ρ_{E,ℓ} has the form

ρ_{E,ℓ} ∼ ( \begin{matrix}χ_{1} & ∗ \\ 0 & χ_{2} \end{matrix} )  (2)

where χ_{1}, χ_{2} are characters of G(ℓ) = Gal (ℚ (E[ℓ]) /ℚ) taking values in 𝔽_{ℓ}^{∗}. For i = 1, 2, let n_{i} be the order of χ_{i}, and let N_{i} = ker(χ_{i}). N_{i} is a normal subgroup of G(ℓ), and we denote by K_{i} the fixed field of N_{i}. Then for i = 1, 2,

Gal(K_{i}/ℚ) ≃ G(ℓ)/N_{i}

is a cyclic group of order n_{i}. The character groups of the Galois groups of K_{1}, K_{2} and K_{1}K_{2} are respectively:

{ \atop Gal(K_{1}/ℚ)} = ⟨χ_{1}⟩;

{ \atop Gal(K_{2}/ℚ)} = ⟨χ_{2}⟩;

{ \atop Gal(K_{1}K_{2}/ℚ)} = ⟨χ_{1}, χ_{2}⟩.

By the Weil pairing, χ_{1}χ_{2} = ω_{ℓ} the cyclotomic character, and therefore { \atop Gal(ℚ(ζ_{ℓ})/ℚ)} =

⟨ω_{ℓ}⟩ ⊆ { \atop Gal(K_{1}K_{2}/ℚ)}, or equivalently ℚ(ζ_{ℓ}) ⊆ K_{1}K_{2}.

The following lemma will allow us to reformulate Theorem 1.1 in terms of characters.

Lemma 2.1 Let ℓ be a prime, and let E/ℚ be an elliptic curve with a rational ℓ-isogeny. The followings are equivalent:

(i) E has a non-trivial ℚ(ζ_{ℓ})-rational ℓ-torsion point;

(ii) E is isogenous to a curve with a non-trivial ℚ(ζ_{ℓ})-rational ℓ-torsion point;

(iii) K_{1}K_{2} = ℚ(ζ_{ℓ});

(iv) ⟨χ_{1}, χ_{2}⟩ = ⟨ω_{ℓ}⟩.

Proof: The equivalence of (iii) and (iv) follows from general properties of characters of Galois groups: let L_{1}, L_{2} be abelian extensions of a field k, contained in some field K. Then, L_{1} ⊆ L_{2} ⟺ { \atop Gal(L_{1}/k)} ⊆ { \atop Gal(L_{2}/k)}. It is also clear that (iii) implies (i): we then have K_{1} ⊆ ℚ(ζ_{ℓ}), and K_{1} = ℚ(P_{1}) where P_{1} is the ℓ-torsion point corresponding to χ_{1}. For (i) implies (iv), let P be the ℚ(ζ_{ℓ})-rational ℓ-torsion point on E. Then, either ⟨P ⟩ is Galois stable, or ℚ (E[ℓ]) ⊆ ℚ(ζ_{ℓ}). In either cases,

ρ_{E,ℓ} ∼ ( \begin{matrix}χ_{1} & ∗ \\ 0 & χ_{2} \end{matrix} ) ,

with χ_{1} ∈ ⟨ω_{ℓ}⟩, which gives ⟨χ_{1}, χ_{2}⟩ = ⟨ω_{ℓ}⟩. Finally, we have to show that (ii) implies (i): Let ϕ : E′ → E be the isogeny where E′ has ℚ(ζ_{ℓ})-rational ℓ-torsion. Let P_{1}, P_{2} be a basis for E′[ℓ] giving the representation

ρ_{E′,ℓ} ∼ ( \begin{matrix}χ_{1} & ∗ \\ 0 & χ_{2} \end{matrix} ) , with χ_{1}, χ_{2} ∈ ⟨ω_{ℓ}⟩.  (3)

If E′[ℓ] ⊈ ker ϕ, then Q_{1} = ϕ(P_{1}), or Q_{2} = ϕ(P_{2}) if Q_{1} = 0, is a non-trivial ℚ(ζ_{ℓ})-rational ℓ-torsion point on E. If E′[ℓ] ⊆ ker ϕ, let a be the largest integer such that E′[ℓ^{a}] ⊆ ker ϕ. Since

E′[ℓ^{a+1}]/E′[ℓ^{a}] and E′[ℓ]

are isomorphic 𝔽_{ℓ}[G]-modules, let P′_{1} and P′_{2} be a basis for E′[ℓ^{a+1}]/E′[ℓ^{a}] giving the representation (3). Then, either Q′_{1} = ϕ(P′_{1}), or Q′_{2} = ϕ(P′_{2}) if Q′_{1} = 0, is a non-trivial ℚ(ζ_{ℓ})-rational ℓ-torsion point on E. QED.

If E and E′ are isogenous curves, then a_{p}(E) = a_{p}(E′) for all p ∤ ℓN_{E}. We will then classify up to isogeny the curves missing a trace modulo ℓ. The following lemmas describe the Galois representations of isogenous and twisted curves.

Lemma 2.2 Let E be an elliptic curve over ℚ with a rational ℓ-isogeny. Choose P_{1} ∈ E[ℓ] such that P_{1}^{σ} = χ_{1}(σ)P_{1} for all σ ∈ G(ℓ). Let E′ be the isogenous curve E′ = E/ ⟨P_{1}⟩. Then,

ρ_{E′,ℓ} ∼ ( \begin{matrix}χ_{2} & ∗ \\ 0 & χ_{1} \end{matrix} ) .

Proof: Let ϕ denote the rational ℓ-isogeny between E and E′, and let P_{1}, P_{2} be a basis for E[ℓ] giving the representation ρ_{E,ℓ}. We denote by ξ the cocycle in the upper right corner of ρ_{E,ℓ}. Then, ϕ(P_{2}) is a ℓ-torsion point on E′, and for p ∤ ℓN_{E},

ϕ(P_{2})^{σ_{p}} = ϕ(P_{2}^{σ_{p}}) = ϕ(ξ(σ_{p})P_{1} + χ_{2}(σ_{p})P_{2}) = χ_{2}(σ_{p})ϕ(P_{2}).

Since the determinant of ρ_{E′,ℓ} is the cyclotomic character, this proves the lemma. QED.

Lemma 2.3 Let E be an elliptic curve over ℚ with a rational ℓ-isogeny. Let D ∈ ℤ, and let E_{D} be the twist of E by D. Then

ρ_{E_{D},ℓ} ∼ ( \begin{matrix}(\frac{D}{.}) χ_{1} & ∗ \\ 0 & (\frac{D}{.}) χ_{2} \end{matrix} ) .

Proof: Let P_{1}, P_{2} be a basis of E[ℓ] giving the representation (2), and let ϕ be the ℚ(\sqrt{D})- isomorphism between E and E_{D}. Then, ϕ(P_{1}) and ϕ(P_{2}) form a basis for the ℓ-torsion on E_{D}. For p ∤ ℓN_{E},

ϕ(P_{1})^{σ_{p}} = ϕ^{σ_{p}} (P_{1}^{σ_{p}}) = ϕ^{σ_{p}} (χ_{1}(σ_{p})P_{1}) = (\frac{D}{p}) χ_{1}(σ_{p})ϕ(P_{1}).

Since the determinant of ρ_{E_{D},ℓ} is the cyclotomic character, this proves the lemma. QED.

Lemma 2.4 Let E be an elliptic curve over ℚ. Let D ≠ 1 be a squarefree integer with (D, ℓN_{E}) = 1, and let E_{D} be the twist of E by D. Then, S_{ℓ}(E_{D}) = S_{ℓ}(E) ∩ −S_{ℓ}(E).

Proof: As (D, ℓN_{E}) = 1, the field extensions K_{ℓ} = ℚ(E[ℓ]) and K_{D} = ℚ(\sqrt{D}) are disjoint [16, Proposition VII.4.1]. Let K_{ℓ,D} = K_{ℓ}K_{D}. Then,

Gal(K_{ℓ,D}/ℚ) = Gal(K_{ℓ}/ℚ) × Gal(K_{D}/ℚ).

Let b = ±1, and let a be a trace of E modulo ℓ, i.e. a_{p}(E) ≡ a (mod ℓ) for some p ∤ ℓN_{E}. Then, by the Chebotarev Density Theorem, there is a positive proportion of primes p such that (\frac{D}{p}) = b and a_{p}(E) ≡ a (mod ℓ). As

a_{p}(E_{D}) = (\frac{D}{p}) a_{p}(E),

a and −a are traces of E_{D} modulo ℓ. This proves the result. QED.

3 Mazur’s Theorem

We begin by proving the the easy side of Theorem 1.1. Corollary 1.2 also follows from the same arguments. Proof of Theorem 1.1(ii) ⇒ (i): By Lemma 2.1, the hypothesis can be rewritten as ⟨χ_{1}, χ_{2}⟩ = ⟨ω_{ℓ}⟩. Then, χ_{1} = ω_{ℓ}^{a} and χ_{2} = ω_{ℓ}^{ℓ−a} for some integer 1 ≤ a ≤ ℓ − 1. Then, for all p ∤ ℓN_{E},

a_{p}(E) ≡ ω_{ℓ}^{a}(σ_{p}) + ω_{ℓ}^{ℓ−a}(σ_{p}) ≡ p^{a} + p^{ℓ−a} (mod ℓ).  (4)

But this takes at most ℓ − 1 values modulo ℓ, as p takes exactly all non-zero values modulo ℓ. QED.

Assuming Theorem 1.1, the same argument also proves Corollary 1.2.

We then have to prove the other implication of Theorem 1.1. By Mazur’s Theorem [10, 11], there are only finitely many values of ℓ for which there is an elliptic curve E/ℚ with a rational ℓ-isogeny. More precisely, we reproduce here the table of [11] listing the only cases where X_{0}(ℓ) has noncuspidal rational points:

ℓ = 2, 3, 5, 7, 13 and X_{0}(ℓ) has genus 0;

ℓ = 11, 17, 37 and #Y_{0}(ℓ)(ℚ) = 3, 2, 2 respectively;

ℓ = 19, 43, 67, 163 and #Y_{0}(ℓ)(ℚ) = 1 corresponding to the curve E/ℚ with complex multiplication by ℚ(\sqrt{−ℓ}).

The noncuspidal rational points on those modular curves correspond to j-invariants (or equivalently isomorphism classes) of elliptic curves over ℚ with a rational ℓ-isogeny. For ℓ = 11 or ℓ ≥ 17, there are only finitely many possible j-invariants. We treat those separately in Sections 7 and 8.

We then concentrate on ℓ = 2, 3, 5, 7, 13. Since X_{0}(ℓ) has genus 0, they are infinitely many isomorphism classes of curves with a rational ℓ-isogeny for those ℓ. We consider two cases, depending if n_{1} and n_{2} are coprime or not. As χ_{1}χ_{2} is the cyclotomic character, it is necessary to have lcm (n_{1}, n_{2}) = ℓ − 1. If n_{1} and n_{2} are coprime, there are at most ℓ − 1 possible traces χ_{1}(σ_{p}) + χ_{2}(σ_{p}). This generalizes the case of rational ℓ-torsion, where n_{1} = 1 and n_{2} = ℓ − 1. This case is done in Section 4.

If n_{1} and n_{2} are not coprime, one expects that S_{ℓ}(E) = ∅ when there is no “relation” between χ_{1} and χ_{2}. This is proven in Section 5. The final cases are classified in Section 6.

4 Coprime orders

Let E be an elliptic curve over ℚ with rational ℓ-torsion. Then, the Galois representation ρ_{E,ℓ} has the form

ρ_{E,ℓ} ∼ ( \begin{matrix}1 & ∗ \\ 0 & ω_{ℓ} \end{matrix} ) ,  (5)

and for p ∤ ℓN_{E}

a_{p}(E) ≡ 1 + ω_{ℓ}(σ_{p}) ≡ p + 1 (mod ℓ).

Then, from Dirichlet’s Theorem, S_{ℓ}(E) = {1} when E has rational ℓ-torsion. This is a particular case of the following lemma.

Lemma 4.1 Let ℓ be an odd prime, and let E/ℚ be an elliptic curve with a rational ℓisogeny. Suppose also that (n_{1}, n_{2}) = 1. Then K_{1} is a subfield of the cyclotomic field ℚ(ζ_{ℓ}).

Proof: Let

G_{ℓ} = Gal (ℚ(E[ℓ])/ℚ(ζ_{ℓ})) = {g ∈ G(ℓ) : det g = 1} .

As (n_{1}, n_{2}) = 1,

G_{ℓ} = \{g ∈ G(ℓ) : g = ( \begin{matrix}1 & a \\ 0 & 1 \end{matrix} )\} .

Then, either G_{ℓ} is trivial, or G_{ℓ} ≃ 𝔽_{ℓ}. Let G(ℓ)′ be the commutator of G(ℓ). Clearly,

G(ℓ)′ ⊆ G_{ℓ}. If G_{ℓ} is trivial, then G(ℓ)′ = G_{ℓ}. If not, let A = ( \begin{matrix}1 & a \\ 0 & 1 \end{matrix} ) ∈ G_{ℓ} with a ≠ 0 and

B = ( \begin{matrix}β_{1} & b \\ 0 & β_{2} \end{matrix} ) ∈ G(ℓ) with β_{1} ≠ β_{2}. Then, AB ≠ BA, so that G(ℓ)′ ≠ \{1\} which proves

that G(ℓ)′ = G_{ℓ}. Then, as K_{1}/ℚ is abelian,

Gal (ℚ(E[ℓ])/ℚ(ζ_{ℓ})) = G_{ℓ} = G(ℓ)′ ⊆ Gal (ℚ(E[ℓ])/K_{1}) ,

i.e. K_{1} ⊆ ℚ(ζ_{ℓ}). QED.

This proves Theorem 1.1 in the case where n_{1} and n_{2} are coprime. Using Mazur’s Theorem, we now list all cases of elliptic curves with a rational ℓ-isogeny for ℓ = 2, 3, 5, 7, 13 and with (n_{1}, n_{2}) = 1. There is only one case other than rational torsion.

Theorem 4.2 Let ℓ = 2, 3, 5, 7, 13, and let E/ℚ be an elliptic curve with a rational ℓisogeny. Suppose also that (n_{1}, n_{2}) = 1. Then, either ℓ = 2, 3, 5, 7 and E is isogenous to a curve with rational ℓ-torsion, or E is isogenous to a curve with ℚ(\sqrt{−7})-rational 7-torsion. More precisely, the possible values of ℓ, S_{ℓ}(E) and a are described in the following table. The last column gives a curve with minimal conductor for which S_{ℓ}(E) is as prescribed.

ℓ S_{ℓ}(E) a E/ℚ
2 {1}  1 E14A
3 {1}  1 E14A
5 {1}  1 E11A
7 {1}  1 E26B
{4, 6} 3 E294A

Proof of Theorem 4.2: Using Lemma 2.2, we can always exchange χ_{1} and χ_{2}, then n_{1} and n_{2}, by an isogeny.

\underline{ℓ = 2}: The only possibility is n_{1} = n_{2} = 1, i.e. E has rational torsion of order 2.

\underline{ℓ = 3}: The only possibility is n_{1} = 1 and n_{2} = 2, i.e. E has rational torsion of order 3. \underline{ℓ = 5}: The only possibility is n_{1} = 1 and n_{2} = 4, E has rational torsion of order 5. \underline{ℓ = 7}: If n_{1} = 1 and n_{2} = 6, then E has rational torsion of order 7. If n_{1} = 2 and n_{2} = 3,

then by Lemma 4.1, K_{1} = ℚ(\sqrt{−7}) and χ_{1} = (\frac{−7}{·}). As χ_{1}χ_{2} = ω_{7}, we have

ρ_{E,7} ∼ ( \begin{matrix}(\frac{−7}{·}) & ∗ \\ 0 & (\frac{−7}{·}) ω_{7} \end{matrix} ) = ( \begin{matrix}ω_{7}^{3} & ∗ \\ 0 & ω_{7}^{4} \end{matrix} ) .  (6)

Since K_{1} = ℚ(\sqrt{−7}), E has rational torsion over ℚ(\sqrt{−7}). Equivalently, E is a twist by −7 of a curve with rational 7-torsion. Indeed, let E′ be the twist by −7 of E. It is clear that E′ has rational 7-torsion. Then, if n_{1} = 2 and n_{2} = 3, ρ_{E,7} is given by (6),

a_{p}(E) ≡ ω_{7}^{3}(σ_{p}) + ω_{7}^{4}(σ_{p}) ≡ p^{3} + p^{4} (mod ℓ),

and S_{ℓ}(E) = {4, 6}. This gives one of the cases of the classification of Theorem 1.4. As X_{1}(7) has genus 0, there are infinitely many isomorphism classes of elliptic curves over ℚ such that ρ_{E,7} is given by (6). By inspection of Cremona’s tables [4], one finds that such a curve with minimal conductor is E = E294A2 of conductor N_{E} = 2 · 3 · 7^{2}. E is the twist by −7 of the curve E′ = E294B2 of conductor N_{E′} = 2 · 3 · 7^{2}, and E′ has rational 7-torsion. The curves E and E′ have minimal equations

E = E294A2 : y^{2} + xy + y = x^{3} + x^{2} − 6910x − 232261;
E′ = E294B2 : y^{2} + xy = x^{3} − 141x + 657.

\underline{ℓ = 13}: As there are no elliptic curves over ℚ with rational 13-torsion [11, Theorem 2], the only possible case is n_{1} = 4 and n_{2} = 3. By Lemma 4.1, K_{1} is contained in the cyclotomic field ℚ(ζ_{13}), which implies that K = ℚ(\sqrt{13}) ⊆ K_{1}. Let G_{K} = Gal(\overline{K}/K), and consider E as an elliptic curve over K. Then

ρ_{E,13}|_{G_{K}} ∼ ( \begin{matrix}χ_{1}|_{G_{K}} & ∗ \\ 0 & χ_{2}|_{G_{K}} \end{matrix} )

where χ_{1}|_{G_{K}} is the character of order 2 associated with the quadratic extension K_{1}/K. Twisting by χ_{1}|_{G_{K}}, we get a curve E′ over K = ℚ(\sqrt{13}) with a K-rational 13-torsion point. This is impossible by a result of Momose [13, p. 157].

This completes the proof of Theorem 4.2. QED.

5 Non coprime orders

We will prove in that section the following theorem:

Theorem 5.1 Let ℓ = 2, 3, 5, 7, 13, and let E/ℚ be an elliptic curve with a rational ℓ-isogeny for which S_{ℓ}(E) ≠ ∅. Suppose also that (n_{1}, n_{2}) > 1. Then, K_{2} ⊆ K_{1} or K_{1} ⊆ K_{2}.

In the next four lemmas, K_{1} and K_{2} are any cyclic extensions of ℚ of degree n_{1} and n_{2}, and character groups ⟨χ_{1}⟩ and ⟨χ_{2}⟩ respectively. Let K_{0} = K_{1} ∩ K_{2} and s = [K_{0} : ℚ].

Lemma 5.2 Suppose that K_{0} = ℚ. Then, for any a_{1} ∈ Im(χ_{1}) and a_{2} ∈ Im(χ_{2}), there is a positive proportion of primes p such that

χ_{1}(σ_{p}) = a_{1} and χ_{2}(σ_{p}) = a_{2}.

Proof: Since K_{0} = ℚ, we have

Gal (K_{1}K_{2}/ℚ) ≃ Gal (K_{1}/ℚ) × Gal (K_{2}/ℚ) .

Let g be an element of Gal (K_{1}K_{2}/ℚ) such that χ_{1}(g) = a_{1} and χ_{2}(g) = a_{2}. By the Chebotarev Density Theorem, there is a positive proportion of primes p such that σ_{p} = g. QED.

Lemma 5.3 Suppose that (s, n_{2}/s) = 1. Then,

\begin{aligned}& \\ Gal & (K_{1}K_{2}/ℚ) \end{aligned} = ⟨χ_{1}⟩ × ⟨χ_{2}^{s}⟩ .

Proof: Let L be the unique subfield of degree n_{2}/s of K_{2}. As s and n_{2}/s are coprime, L and K_{0} are disjoint, and K_{1}K_{2} = K_{1}L with K_{1} ∩ L = ℚ. Then,

Gal (K_{1}K_{2}/ℚ) = Gal(K_{1}L/ℚ) ≃ Gal (K_{1}/ℚ) × Gal (L/ℚ) ,

and as { \atop Gal(L/ℚ)} = ⟨χ_{2}^{s}⟩, this proves the lemma. QED.

Lemma 5.4 If s = 2, and 2n_{2} divides n_{1} + n_{2}, then χ_{1}χ_{2} has order dividing n_{1}/2.

Proof: As s = 2,

{ \atop Gal(K_{0}/ℚ)} = ⟨χ_{1}^{n_{1}/2}⟩ = ⟨χ_{2}^{n_{2}/2}⟩ ,

and χ_{1}^{n_{1}/2} = χ_{2}^{n_{2}/2}. Then, (χ_{1}χ_{2})^{n_{1}/2} = χ_{2}^{(n_{1}+n_{2})/2}, which proves the result. QED.

Lemma 5.5 If n_{1} = n_{2} = 12, and s = 4 or s = 6, then χ_{1}χ_{2} has order 6.

Proof: Similar to the previous lemma. QED.

Proof of Theorem 5.1: There are only finitely many tuples (ℓ, n_{1}, n_{2}, s) where ℓ = 2, 3, 5, 7, 13, lcm(n_{1}, n_{2}) = ℓ − 1, (n_{1}, n_{2}) > 1 and s | (n_{1}, n_{2}). We have to show that there are no such tuples associated to the Galois representation of an elliptic curve E/ℚ with a rational ℓ-isogeny for which S_{ℓ}(E) ≠ ∅, K_{1} ⊈ K_{2} and K_{2} ⊈ K_{1}. Because we can exchange χ_{1} and χ_{2} by an isogeny, we may suppose that n_{1} ≥ n_{2}. The tuples (ℓ, n_{1}, n_{2}, n_{2}) would correspond to representations with K_{2} ⊆ K_{1}, and the tuples (ℓ, n_{1}, n_{2}, 1) would correspond to representations for which S_{ℓ}(E) = ∅ by Lemma 5.2 as Im(χ_{1}) + Im(χ_{2}) = 𝔽_{ℓ} in each case. Under those restrictions, the possible tuples (ℓ, n_{1}, n_{2}, s) are:

ℓ = 5: (5,4,4,2);

ℓ = 7: (7,6,6,2), (7,6,6,3);

ℓ = 13: (13,12,12,2), (13,12,12,3), (13,12,12,4), (13,12,12,6), (13,12,6,2), (13,12,6,3), (13,12,4,2), (13,6,4,2).

By Lemmas 5.4 and 5.5, the tuples

(5, 4, 4, 2), (7, 6, 6, 2), (13, 12, 12, 2), (13, 12, 4, 2), (13, 12, 12, 4), (13, 12, 12, 6)

cannot be associated with the Galois representation ρ_{E,ℓ} of an elliptic curve with a rational ℓisogeny. We also prove that the tuple (13, 6, 4, 2) cannot occur. After an isogeny, we consider (13, 4, 6, 2). We have [K_{1}K_{2} : ℚ] = 12, which implies that K_{1}K_{2} = ℚ(ζ_{13}). There is then a unique quadratic subfield of K_{1}K_{2}, namely K = ℚ(\sqrt{13}). We consider E as an elliptic curve over K. Then χ_{1}|_{K}, χ_{2}|_{K} are characters on Gal(\overline{K}/K) ⊆ Gal(\overline{ℚ}/ℚ) of order 2 and 3 respectively. By twisting the representation by the quadratic character χ_{1}|_{K}, one gets an elliptic curve over K with a K-rational 13 torsion point. This is impossible by the results of Momose [13, p. 157].

The remaining tuples are:

ℓ = 7: (7,6,6,3);

ℓ = 13: (13,12,12,3), (13,12,6,2), (13,12,6,3).

We now show that if any of those tuples is associated to the Galois representation of an elliptic curve E/ℚ with a rational ℓ-isogeny, then S_{ℓ}(E) = ∅. Indeed, by Lemma 5.3,

\begin{aligned}& \\ Gal & (K_{1}K_{2}/ℚ) \end{aligned} = ⟨χ_{1}⟩ × ⟨χ_{2}^{s}⟩

for all those tuples. Then, as χ_{2} ∈ { \atop Gal(K_{2}/ℚ)} ⊆ \begin{aligned}& \\ Gal & (K_{1}K_{2}/ℚ) \end{aligned}, we can write

χ_{2} = χ_{1}^{m}χ_{2}^{ns}

with 0 ≤ m < n_{1} and 0 ≤ n < (n_{2}/s) in a unique way. There are of course only a few values of m, n which are possible if χ_{1}, χ_{2} are the diagonal characters of the Galois representation ρ_{E,ℓ}, with K_{2} ⊈ K_{1}, or equivalently χ_{2} is not a power of χ_{1}. In particular, m and n must be such that χ_{2} and χ_{1}χ_{2} have order n_{2} and ℓ − 1 respectively. We then compute all possible tuples (m, n) under these conditions, and check that S_{ℓ}(E) = ∅ in each case.

For example, we do here the computations for the tuple (7, 6, 6, 3). By Lemma 5.3, we know that

\begin{aligned}& \\ Gal & (K_{1}K_{2}/ℚ) \end{aligned} = ⟨χ_{1}⟩ × ⟨χ_{2}^{3}⟩ .

We can then write χ_{2} = χ_{1}^{m}χ_{2}^{3n} in a unique way for some 0 ≤ m ≤ 5 and 0 ≤ n ≤ 1. Since χ_{2} is not a power of χ_{1}, we have n = 1, and since χ_{1} and χ_{1}χ_{2} have order 6, the only possibilities are (m, n) = (1, 1) or (m, n) = (4, 1). If (m, n) = (1, 1), then χ_{2} = χ_{1}χ_{2}^{3} ⟺ χ_{1} = χ_{2}^{4} contrary to the hypothesis K_{1} ⊈ K_{2}. We are then left with one possibility, namely χ_{2} = χ_{1}^{4}χ_{2}^{3}, which could occur for the diagonal characters of an elliptic curve with a rational 7-isogeny described by the tuple (7, 6, 6, 3). Then, χ_{1} and χ_{2}^{3} are independent characters, i.e. for all a ∈ 𝔽_{7}^{∗} and all b ∈ {±1} ⊆ 𝔽_{7}^{∗}, there is a positive proportion of primes p such that

χ_{1}(σ_{p}) = a and χ_{2}^{3}(σ_{p}) = b

by the Chebotarev Density Theorem. Then, the traces

χ_{1}(σ_{p}) + χ_{2}(σ_{p}) = χ_{1}(σ_{p}) + χ_{1}^{4}(σ_{p})χ_{2}^{3}(σ_{p})

take all values a ± a^{4} for all a ∈ 𝔽_{7}^{∗}, and this last set is 𝔽_{7}.

Treating similarly the remaining 3 tuples listed above, this completes the proof of Theorem 5.1. QED.

By the results of Lemma 4.1 and Theorem 5.1, we can prove Theorem 1.1 for ℓ = 2, 3, 5, 7, 13. Indeed, if K_{1} ⊆ K_{2}

⟨χ_{1}⟩ ⊆ ⟨χ_{2}⟩ = ⟨χ_{1}, χ_{2}⟩ = ⟨ω_{ℓ}⟩ .

Then K_{1} ⊆ ℚ(ζ_{ℓ}), and E has rational torsion over K_{1}.

6 χ_{1} is a power of χ_{2}

Let E/ℚ be an elliptic curve with a rational ℓ-isogeny such that (n_{1}, n_{2}) > 1 and S_{ℓ}(E) ≠ ∅. Then, by Theorem 5.1, K_{1} ⊆ K_{2} or K_{2} ⊆ K_{1}. By exchanging E with an isogenous curve if necessary, we assume in this section that K_{1} ⊆ K_{2}. Then, K_{2} = ℚ(ζ_{ℓ}) and

χ_{1} = ω_{ℓ}^{ℓ−a} and χ_{2} = ω_{ℓ}^{a}

with 1 < a < ℓ − 1 and (a, ℓ − 1) = 1. We treat each of the possible cases in turn. This gives the final cases of Theorem 1.4 for ℓ = 2, 3, 5, 7, 13.

\underline{ℓ = 5:} a = 3 is the only possibility. In this case

χ_{1} = ω_{5}^{2} = (\frac{5}{·}) and χ_{2} = ω_{5}^{3} = (\frac{5}{·}) ω_{5},

and S_{5}(E) = \{3, 4\}. Then, K_{1} = ℚ(\sqrt{5}) and E is the twist by 5 of an elliptic curve E′/ℚ with rational 5-torsion. There are infinitely many such elliptic curves E as X_{1}(5) has genus 0. By inspection of Cremona’s tables [4], the example with smallest conductor is E = E50A. E50B2 have rational 5-torsion.

\underline{ℓ = 7:} a = 5 is the only possibility. In this case

χ_{1} = ω_{7}^{2} and χ_{2} = ω_{7}^{5},

and S_{7}(E) = {3, 5, 6}. Then, K_{1} is the cubic field inside ℚ(ζ_{7}) and E has a rational 7-torsion over K_{1}. The example with smallest conductor is the curve E = E49A1 with complex multiplication by the maximal order in ℚ(\sqrt{−7}) (see also Section 7). For curves without complex multiplication, the example with smallest conductor is E = E637A with conductor N_{E} = 637 = 7^{2} · 13.

\underline{ℓ = 13:} The possible values of a are 5, 7, 11. Then, [K_{1} : ℚ] = 3, 2, 6 respectively, and E has rational 13-torsion over K_{1} ⊆ ℚ(ζ_{13}). If a = 7, K_{1} = ℚ(\sqrt{13}) which is impossible by the result of Momose [13]. We want to generalize this result to K_{1} = Q(ζ_{13} + ζ_{13}^{−1}).

Proposition 6.1 Assume the Birch and Swinnerton-Dyer conjecture for abelian varieties over number fields. Then, X_{1}(13)(K_{13}) has no noncuspidal K_{13}-rational points, where K_{13} = Q(ζ_{13} + ζ_{13}^{−1}).

Proof: The modular curve X_{1}(13) has genus 2, and has 12 cusps over K_{13}, 6 rational cusps and 6 cusps defined over K_{13}. Let J_{1}(13) be the Jacobian of X_{1}(13). According to the Birch and Swinnerton-Dyer conjecture, the rank of J_{1}(13)(K_{13}) is the order of vanishing of the Lseries L(s, J_{1}(13), K_{13}) at s=1. Let f_{1} and f_{2} be a basis of eigenforms for the 2-dimensional space of cusp forms S_{2}(Γ_{1}(13)). Then,

L(s, J_{1}(13), ℚ) = L(s, f_{1}) L(s, f_{2}),

and

L(s, J_{1}(13), K_{13}) = ∏_{χ} L(s, f_{1}, χ) L(s, f_{2}, χ)

where the product is taken for all χ characters of Gal (K_{13}/ℚ). The order of vanishing at s = 1 of each

L(s, f_{i}, χ) = ∑_{n≥0} a_{n}(f_{i}) χ(n) n^{−s}

was computed by J. Fearnley using PARI [2], and he showed that each L(s, f_{i}, χ) does not vanish at s = 1. Assuming the Birch and Swinnerton-Dyer conjecture, this shows that J_{1}(13)(K) has rank 0.

We now compute #X_{1}(13)(K_{13}), using Coleman’s effective version of Chabauty’s estimate [3]: if C is a curve of genus g over a number field K with Mordell-Weil group of rank at most g − 1, if 𝔭 is an unramified prime of K at which C has good reduction, and if the residue characteristic of 𝔭 is greater than 2g, then

#C(K) ≤ #C(𝔽_{𝔭}) + 2g − 2.

We take C = X_{1}(13), K = K_{13} = ℚ(ζ_{13} +ζ_{13}^{−1}), and 𝔭 a prime of K_{13} of residue characteristic 5. This gives

#X_{1}(13)(K_{13}) ≤ #X_{1}(13)(𝔽_{25}) + 2.  (7)

We then have to count the number of points of X_{1}(13) over the finite field with 25 elements. But, following Ogg [14], we use the fact that the curve X_{1}(13) is also a moduli space in finite characteristic, and X_{1}(13)(𝔽_{25}) parametrizes isomorphism classes of elliptic curves over 𝔽_{25} with a 𝔽_{25}-rational 13-torsion point. Suppose that X_{1}(13)(𝔽_{25}) has a non-cuspidal rational point corresponding to an elliptic curve E over 𝔽_{25}. Then, we must have 13 | 26 − a_{25}(E), with |a_{25}(E)| ≤ 10, where a_{25}(E) is the trace of the Frobenius endomorphism over 𝔽_{25}. This implies that a_{25}(E) = 0, which is impossible as then E would be a supersingular elliptic curve in characteristic 5, and 5 splits in the quadratic field ℚ (\sqrt{a_{25}^{2}(E) − 4 · 25}) = ℚ(i). It follows that X_{1}(13)(𝔽_{25}) has no non-cuspidal points, and using (7), we get #X_{1}(13)(K_{13}) ≤ 14. Suppose that P ∈ X_{1}(13)(K_{13}) is a non-cuspidal point. Then, P ∉ X_{1}(13) (ℚ(\sqrt{13})) by the result of Momose [13], and then P has 3 or 6 Galois conjugates, which are also points on X_{1}(13)(K_{13}). Then, #X_{1}(13)(K_{13}) ≥ 15, which contradicts (7). This proves that, under the Birch and Swinnerton-Dyer conjecture, X_{1}(13)(K_{13}) has no non-cuspidal points. QED.

7 Complex multiplication curves

The case of curves with complex multiplication is well-know, and we recall it here. For such a curve, we know how to compute the a_{p}(E)’s by the work of Deuring [6], who proved that L(E, s) = L(s, χ) for some Hecke character χ. We use here the explicit formulas given by Stark in [17] for the values of a_{p}(E) at split primes p.

For ℓ ≥ 7, let E_{ℓ} be the elliptic curve over ℚ with complex multiplication by the maximal order in ℚ(\sqrt{−ℓ}) and conductor N_{E_{ℓ}} = ℓ^{2}. Then, ρ_{E_{ℓ},ℓ} is contained in a Borel subgroup of GL_{2}(𝔽_{ℓ}). We show in this section that S_{ℓ}(E_{ℓ}) contains exactly half of elements of 𝔽_{ℓ}^{∗}, and we exhibit the relation between the 2 characters χ_{1} and χ_{2} of the Galois representation ρ_{E_{ℓ},ℓ}.

Lemma 7.1 Let E_{ℓ} be one of the 6 curves defined above. Then,

S_{ℓ}(E_{ℓ}) = \{ \begin{matrix}𝔽_{ℓ}^{∗} \ (𝔽_{ℓ}^{∗})^{2} & for ℓ = 7; \\ (𝔽_{ℓ}^{∗})^{2} & for ℓ = 11, 19, 43, 67, 163. \end{matrix}

Proof: For primes p inert in ℚ(\sqrt{−ℓ}), a_{p}(E_{ℓ}) = 0. Let p be a prime which splits in ℚ(\sqrt{−ℓ}), 4p = u^{2} + ℓv^{2} for some u, v ∈ ℤ. Then from [17, p. 1118]

a_{p}(E_{ℓ}) = \{ \begin{matrix}(\frac{u}{ℓ}) u & for ℓ = 7; \\ − (\frac{u}{ℓ}) u & for ℓ = 11, 19, 43, 67, 163. \end{matrix}

As ℓ ≡ 3 (mod 4), (\frac{u}{ℓ}) u is always a square modulo ℓ. Also, for any a ∈ 𝔽_{ℓ}^{∗}, we can choose split primes p ≡ (a/2)^{2} (mod ℓ). This proves the result. QED.

We now examine the characters χ_{1} and χ_{2} of the Galois representation ρ_{E_{ℓ},ℓ}. If p is a split prime with 4p = u^{2}+ℓv^{2} for some u, v ∈ ℤ, then the characteristic polynomial x^{2}−a_{p}(E)x+p has a double root

χ_{1}(σ_{p}) = χ_{2}(σ_{p}) = (−1)^{(ℓ^{2}−1)/8} (\frac{u}{ℓ}) \frac{u}{2}

modulo ℓ. If p is an inert prime, then the characteristic polynomial x^{2} + p has roots

χ_{1}(σ_{p}) = ±\sqrt{−p} and χ_{2}(σ_{p}) = −χ_{1}(σ_{p})

modulo ℓ. Also, for any a ∈ 𝔽_{ℓ}^{∗}, we can choose an inert prime p such that χ_{1}(σ_{p}) = a or χ_{2}(σ_{p}) = a; indeed, we take p ≡ −a^{2} (mod ℓ). We now determine how the sign χ_{1}(σ_{p}) = ±\sqrt{−p} is chosen. This will give the relation between χ_{1} and χ_{2}.

Lemma 7.2 Let χ_{1} and χ_{2} be the characters of (2) for one of the curves E_{ℓ} defined above. Suppose that χ_{1}(σ_{p}) ∉ (𝔽_{ℓ}^{∗})^{2} for some inert prime p. Then, for all inert primes p, χ_{1}(σ_{p}) ∉ (𝔽_{ℓ}^{∗})^{2} and χ_{2}(σ_{p}) ∈ (𝔽_{ℓ}^{∗})^{2}.

Proof: Let N be the normal subgroup of G(ℓ) consisting of the elements fixing the complex multiplication field ℚ(\sqrt{−ℓ}). Then,

N = \{( \begin{matrix}χ_{1}(σ_{p}) & ∗ \\ 0 & χ_{2}(σ_{p}) \end{matrix} ) such that p splits in ℚ(\sqrt{−ℓ})\} .

Let h = ρ_{E_{ℓ},ℓ}(σ_{p}) for some inert prime p with χ_{1}(σ_{p}) ∉ (𝔽_{ℓ}^{∗})^{2}. Then, h^{n} = ( \begin{matrix}−1 & ∗ \\ 0 & 1 \end{matrix} ) for

some integer n. Let g = h^{n}. As G(ℓ) is the disjoint union of the 2 cosets N and gN, for any inert prime p, ρ_{E,ℓ}(σ_{p}) can be written as

( \begin{matrix}−1 & ∗ \\ 0 & 1 \end{matrix} ) ( \begin{matrix}a^{2} & ∗ \\ 0 & a^{2} \end{matrix} ) = ( \begin{matrix}−a^{2} & ∗ \\ 0 & a^{2} \end{matrix} )

for some a ∈ 𝔽_{ℓ}^{∗}. This proves the result. QED.

As we can always exchange χ_{1} and χ_{2} by an isogeny, we can suppose that χ_{1} and χ_{2} are as in the lemma. Then, χ_{1} and χ_{2} are characters of order ℓ − 1 and (ℓ − 1)/2 respectively, and

χ_{2} = (\frac{−ℓ}{·}) χ_{1} = χ_{1}^{(ℓ+1)/2}.

As χ_{1}χ_{2} = ω_{ℓ}, this is equivalent to χ_{1} = ω_{ℓ}^{a} and χ_{2} = ω_{ℓ}^{ℓ−a} where a = (ℓ + 1)/4. Together with Lemma 7.1, this gives the last 4 entries of the table of Theorem 1.4.

If E is any other curve in the isomorphism class of E_{ℓ}, then E is a quadratic twist of E_{ℓ} by some squarefree integer D. Let E_{ℓ,D} denote the twist by D of E_{ℓ}. If D ≠ 1 and (D, ℓ) = 1, then S_{ℓ}(E_{ℓ,D}) = ∅ by Lemma 2.4 and Lemma 7.1. If ℓ = D, then E_{ℓ,D} is isogenous to E_{ℓ}. If D ≠ ℓ and ℓ|D, then E is the twist of a curve isogenous to E_{ℓ} and S_{ℓ}(E_{ℓ,D}) = ∅.

8 Exceptional ℓ

\underline{ℓ = 11:} The modular curve X_{0}(11) has genus 1, and X_{0}(11)(ℚ) has 3 noncuspidal rational points corresponding to the j-invariants j_{1} = −11 · 131^{3}, j_{2} = −2^{15} and j_{3} = −11^{2}. The second j-invariant corresponds to complex multiplication by ℚ(\sqrt{−11}), and each j-invariant has a model with conductor 11^{2}. With the notation of Cremona’s tables [4], let E_{1} = E121A1, E_{2} = E121B1 and E_{3} = E121C1 such that j(E_{i}) = j_{i} for i = 1, 2, 3. The minimal equations for E_{1}, E_{2}, E_{3} are

E_{1} : y^{2} + xy + y = x^{3} + x^{2} − 30x − 76
E_{2} : y^{2} + y = x^{3} − x^{2} − 7x + 10
E_{3} : y^{2} + xy = x^{3} + x^{2} − 2x − 7.

For those curves, K_{1}, K_{2} ⊆ ℚ(ζ_{11}) because they are cyclic extensions of degree dividing 10 ramifying only at the prime 11 [16, Proposition VII.4.1] Then,

χ_{1} = ω_{11}^{a} and χ_{2} = ω_{11}^{11−a}

for some 1 < a < 10, and

a_{p}(E_{i}) ≡ p^{a} + p^{11−a} (mod 11).

By computing the first a_{p}’s for each curve, one checks that E_{1}, E_{2}, E_{3} corresponds to a = 2, 3, 4 respectively (possibly after exchanging χ_{1} and χ_{2} by considering an isogenous curve). The following congruences then hold:

a_{p}(E_{1}) ≡ p^{2} + p^{9} (mod 11);
a_{p}(E_{2}) ≡ p^{3} + p^{8} (mod 11);
a_{p}(E_{3}) ≡ p^{4} + p^{7} (mod 11).

This gives S_{11}(E_{1}) = {3, 4, 6, 7}, S_{11}(E_{2}) = {1, 3, 4, 5, 9} (all the squares, as shown in Section 7), and S_{11}(E_{3}) = {3, 4, 5, 7, 10}.

For the complex multiplication curve E_{2}, the twist by −11 is the isogenous curve E121B2. Then for all twists E_{2,D} of E_{2} by a squarefree integer D ≠ 1, −11, S_{11}(E_{2,D}) = ∅ by Lemmas 2.4 and 7.1.

E_{1} is isogenous to the twist of E_{3} by −11, and for any twist E_{D} of E_{1} or E_{3} by a squarefree integer D ≠ 1, −11, S_{11}(E_{D}) = {4, 7} by Lemma 2.4. Such a twist with minimal conductor is E = E1089F, the twist of E_{1} by 3.

This proves Theorem 1.3 and Theorem 1.4 for ℓ = 11. Then, the case ℓ = 11 does not fit Theorem 1.1. For any twist E_{D} of E_{1} or E_{2} as above, S_{ℓ}(E_{D}) = {4, 7} but K_{1}K_{2} contains ℚ(\sqrt{D}) because

(\frac{D}{·}) ∈ { \atop Gal(K_{1}K_{2}/ℚ)}.

\underline{l = 17:} The modular curve X_{0}(17) has genus 1, and X_{0}(17)(ℚ) has 2 noncuspidal rational points corresponding to the j-invariants j_{1} = −17^{2} · 101^{3}/2 and j_{2} = −17 · 373^{3}/2^{17}. Both curves (which are isogenous to each other by the rational 17-isogeny) have a model with conductor N = 2 · 5^{2} · 17^{2} = 14450, namely

E_{1} : y^{2} + xy + y = x^{3} − 3041x + 64278
E_{2} : y^{2} + xy + y = x^{3} − 190891x − 36002922

(see [1, p. 80]).

One checks that the traces a_{p}(E_{1}) are surjective modulo 17 (and then also for the isogenous curve E_{2}). This is also true for the twists by −1, ±2, ±5, ±10, ±17, ±34, ±85 and ±170. This is then true for all other twists by Lemma 2.4.

\underline{l = 37:} The modular curve X_{0}(37) has genus 2, and X_{0}(37)(ℚ) has 2 noncuspidal rational points corresponding to the j-invariants j_{1} = −7 · 11^{3} and j_{2} = −7 · 137^{3} · 2083^{3}. The 2 j-invariants have a model with conductor N = 1225 = 5^{2} · 7^{2}, namely

E_{1} : y^{2} + xy + y = x^{3} + x^{2} − 8x + 6
E_{2} : y^{2} + xy + y = x^{3} + x^{2} − 208083x − 36621194

(see [12, p. 30]). Then, j(E_{i}) = j_{i} for i = 1, 2 and E_{2} = E_{1}/ϕ where ϕ is the rational 37-isogeny. In the notation of Cremona’s tables [4], E_{1} = E1225H1 and E_{2} = E1225H2.

We check that the traces a_{p}(E_{1}) are surjective modulo 37 (and then the traces a_{p}(E_{2}) as the curves are isogenous). We then check surjectivity of the traces modulo 37 for all twists E_{D} of E_{1} with D = −1, ±5, ±7, ±35. Together with E_{1} and E_{2}, those twists are all curves of conductor 1225 and j-invariants j_{1} and j_{2}: there exists 8 such curves, in 4 isogeny classes. Finally, one checks surjectivity for the twists by ±37, ±185, ±259, ±1295; they are curves of conductor 5^{2} · 7^{2} · 37^{2}.

Acknowledgments: The authors would like to thank I. Chen, H. Darmon and A. Schweizer for helpful discussions, and D. Grant for pointing out the paper of Stark. We specially thank J. Fearnley who computed the analytic rank of J_{1}(13) as described in Proposition 6.1.

References

[1] Modular functions of one variable. VI. Proceedings of the Second International Conference, held at the University of Bonn, Bonn, July 2–14, 1976. Edited by J.-P. Serre and D. B. Zagier. Lecture Notes in Mathematics, Vol. 627. Springer-Verlag, Berlin-New York, 1977. ii+339 pp.

[2] C. Batut, K. Belabas, D. Bernardi, H. Cohen and M. Olivier, PARI-GP.

[3] R. Coleman, Effective Chabauty, Duke Mathematical Journal 52 (1985), 765-770.

[4] J. E. Cremona, Algorithms for modular elliptic curves, Cambridge University Press, 1992.

[5] C. David and F. Pappalardi, Average Frobenius distributions of elliptic curves, Internat. Math. Res. Notices 1999, no. 4, 165–183.

[6] M. Deuring, Die Typen der Multiplikatorenringe elliptischer Funktionenkörper, Abh. Math. Sem. Hansischen Univ. 14 (1941), 197-272.

[7] W. Duke, Rational elliptic curves with no exceptional primes, C.R. Acad. Sci. Paris 325 (1997), 813–818.

[8] D. Grant, A formula for the number of elliptic curves with exceptional primes, Compositio Math., to appear.

[9] S. Lang and H. Trotter, Frobenius distributions in GL_{2}-extensions, Springer-Verlag Lecture Notes in Mathematics 504, 1976.

[10] B. Mazur, Modular curves and the Eiseinstein ideal, Publ. Math. I.H.E.S. 47 (1977), 33-186.

[11] B. Mazur, Rational isogenies of prime degree, Inventiones Math. 44 (1978), 129-162.

[12] B. Mazur and P. Swinnerton-Dyer, Arithmetic of Weil curves, Inventiones Math. 25 (1974), 1-61.

[13] F. Momose, p-torsion points on elliptic curves defined over quadratic fields, Nagoya Math. J. 96 (1984), 115-137.

[14] A. P. Ogg, Rational points on certain elliptic modular curves, Proc. Symp. Pure Math., 24 (1973), 221-231, A.M.S., Providence.

[15] J.-P. Serre, Propriétés galoisiennes des points d’ordre fini des courbes elliptiques, Inventiones Math. 15 (1972, 259-331.

[16] J. Silverman, The arithmetic of elliptic curves, Springer-Verlag, 1986.

[17] H. Stark, Counting points on CM elliptic curves, Rocky Mountain J. Math. 26 (1996), 1115-1138.

Concordia University, Department of Mathematics, 1455 de Maisonneuve Blvd. West, Montréal, Quebec H3G 1M8, CANADA E–mail: chantal@cicma.concordia.ca Concordia University, Department of Mathematics, 1455 de Maisonneuve Blvd. West, Montréal, Quebec H3G 1M8, CANADA E–mail: kisilev@cicma.concordia.ca Università degli Studi di Roma Tre, Dipartimento di Matematica, Via Corrado Segre, 4, 00146, Roma, ITALIA E–mail: pappa@mat.uniroma3.it