Cyclic reductions of elliptic curves at a positive proportion of primes

Introduction

In this article, we prove the following theorem.

More precisely, let

Then Theorem 1 states that

The hypothesis in Theorem 1 is necessary. If all the points of order two are rational, then at every odd prime of good reduction the group $E(\mathbb{F}_p)$ contains a subgroup isomorphic to $(\mathbb{Z}/2\mathbb{Z})^2$, and so is not cyclic. Thus Theorem 1 gives a necessary and sufficient condition for an elliptic curve over $\mathbb{Q}$ to have cyclic reduction at a positive lower proportion of primes.

The study of cyclic reductions of elliptic curves over $\mathbb{Q}$ was initiated in the suggestive numerical investigations of Borosh, Moreno, and Porta [3]. A precise density prediction was given by Serre, who stated it in an equivalent Galois-theoretic form in his 1977–1978 course summary [14 pp. 67–68]. For each integer $m\geq1$, let $K_m=\mathbb{Q}(E[m])$ be the field generated by the coordinates of the $m$-torsion points of $E$; then Serre predicted that

when $K_{2} \ne\mathbb{Q}$, where $\operatorname{Li}(X) = \int_{2}^{X} \frac{\mathrm{d}t}{\log t}$; see also [10 Sections 2, 3, and 5]. Adapting Hooley’s proof of Artin’s conjecture under the generalized Riemann hypothesis [9], Serre established this cyclicity asymptotic under GRH and observed that the density $\delta_{E}$ is positive precisely when $K_{2} \ne\mathbb{Q}$. A proof was published by Murty [10 Section 5]. Cojocaru and Murty [6] later obtained sharper error terms in this conditional asymptotic.

For curves with complex multiplication, Murty [10] removed the GRH assumption, using the class field theory of CM curves and a number-field version of the Bombieri–Vinogradov theorem. Cojocaru [5] subsequently gave an even simpler proof with explicit error terms. Thus the positive-proportion conclusion was already known in the CM case.

For general elliptic curves, Gupta and Murty [8] proved that cyclic reduction occurs at infinitely many primes whenever $K_{2} \ne\mathbb{Q}$. More precisely, their theorem gives the unconditional lower bound

For non-CM curves, Cojocaru [4 Theorem 1.2] proved that the asymptotic (2) follows from the weaker hypothesis that the Dedekind zeta functions of $K_{m}$, for squarefree $m$, have no zeros in $\Re s > 3/4$. The zero-free region available to us from Cureton and Thorner [7] is $\Re s > 31/32$, which is weaker and does not supply the hypothesis used by Cojocaru. Our purpose is to obtain the positive-proportion lower bound (1) for every curve with $K_{2} \ne\mathbb{Q}$ using this narrower zero-free region.

The analytic framework comes from our earlier works on Artin’s primitive root problem [1] and on primitive points on elliptic curves [2]. The varying-cofactor sieve developed there, using the marked Type II estimates of OpenAI [11, 12], produces primes whose predecessor has the form

where $x < p < 2x$, $c$ is a fixed power of two, and $\epsilon> 0$ and $Y$ are fixed before $x$ tends to infinity. In a suitable fixed arithmetic progression, the number of these primes is at least a constant times

Allowing the cofactor $r$ to vary supplies the additional logarithm needed for a positive proportion. The uniformity in $\epsilon$ and $Y$ will also be important.

To use these primes, recall that $E(\mathbb{F}_{p})$ fails to be cyclic precisely when $p$ splits completely in $K_{\ell}$ for some prime $\ell\ne p$. Such an $\ell$ divides $p - 1$ and satisfies $\ell^{2} \mid\#E(\mathbb{F}_{p})$. We choose the progression to exclude complete splitting in $K_{2}$. Hasse’s bound excludes the distinguished large prime $Q$ in (3). Every remaining obstruction therefore comes from a prime

This observation makes the predecessor $p - 1$ useful for arbitrary elliptic curves, even though their group orders need not have any fixed form.

The degree of $K_{\ell}$ is $\gg_{E} \ell^{2}$, and its logarithmic root discriminant is $\ll_{E} \log\ell$. We apply the explicit formula for its Dedekind zeta function with a nonnegative smooth weight that is at least one on the interval being counted. Every completely split prime $p$ in this interval contributes at least $[K_{\ell}:\mathbb{Q}]\log p$ to the resulting nonnegative sum, so a zero-free half-plane gives an upper bound for the number of such primes. We count these exceptional primes among all primes and subtract them from the candidate set. Thus the argument needs no joint distribution statement for the cofactor condition and the division fields. Both the cofactor construction and this smoothed prime-ideal bound are taken from [2]; we give the predecessor version of the construction and the division-field deduction explicitly.

We retain the width of the zero-free half-plane as a parameter in order to make its effect on the lower bound explicit. The quantitative result from which Theorem 1 follows is the following.

Cureton and Thorner [7 Theorem 1.1] prove that every Dedekind zeta function has no zeros in $\Re s > 31/32$. Their theorem therefore supplies $N = 32$ in Theorem 2.

This paper is organized as follows. In § 2, we recall the division-field criterion for cyclicity and construct the required arithmetic progression. In § 3, we deduce the prime-predecessor estimate from the cofactor sieve of [2], recording the changes of sign and the required uniformity. In § 4, we establish the division-field bounds and apply the smoothed prime-ideal bound to count completely split primes. Finally, in § 5, we remove the remaining obstructions and prove Theorems 1 and 2.

Notation. Throughout the paper, the letters $p$, $q$, $\ell$ denote rational primes unless otherwise specified. We use $P^{-}(r)$ for the least prime divisor of an integer $r > 1$, and set $P^{-}(1) = \infty$. All constants allowed to depend on $E$ may also depend on the fixed progression chosen for $E$. The parameters $N$, $\epsilon$, and $Y$ are fixed before $x$ tends to infinity.

Cyclicity and a fixed arithmetic progression

We begin with the standard criterion that connects cyclic reduction to complete splitting. Let $R_E$ denote the product of the primes of bad reduction of $E$.

Proof. A noncyclic finite abelian group contains a subgroup isomorphic to $(\mathbb{Z}/\ell\mathbb{Z})^2$ for some prime $\ell$. Hasse’s bound gives

so such an $\ell$ cannot equal $p$. For $\ell\ne p$, good reduction identifies $E[\ell]$ with the geometric $\ell$-torsion of the reduction. Thus $E(\mathbb{F}_p)$ contains $(\mathbb{Z}/\ell\mathbb{Z})^2$ if and only if Frobenius acts trivially on $E[\ell]$, i.e., if and only if $p$ splits completely in $K_\ell$. The Weil pairing gives $\ell\mid p - 1$, and the remaining assertions follow from the subgroup and Hasse’s bound. These facts may also be found in [16]. ∎

The progression must exclude complete splitting in $K_2$ while leaving every odd prime divisor of its modulus coprime to $p-1$. The following observation gives this compatibility.

Fix such $M,c,u$ for the remainder of the paper. In particular, $c$ is precisely the power of two dividing $p-1$ for primes in this progression. The choices depend only on $E$.

Prime predecessors with a small cofactor

We use the varying-cofactor sieve of [2] in its predecessor form. That sieve counts primes $p \equiv u \pmod{M}$ with $p-1=crQ$ as in (3) by weighting integers $d$ with $F_x(d-1)W(d-1)$: the selector $F_x$ records the required factorization, and the marks $W$ are what make the marked Type II estimates applicable. Summing over the cofactors $r$ with their marked weights gives a weighted harmonic mass comparable to $\epsilon\log x/\log Y$, producing the extra logarithm. The analytic input is the marked Type II estimate of [11 Theorem 3.1], together with the coefficient criterion and rough-factor replacement of [12 Lemma 10.2 and Proposition 10.3]. The arithmetic-progression and smoothing deductions, and the uniformity over invariant selectors and dyadic intervals, are in [2 Proposition 5].

Proof. Proposition 4 of [2] is the corresponding statement for prime successors, with $p+1=crQ$ and $u+1$ in the progression conditions. We record the changes in its proof, which is given in Section 3 of that paper.

Use the same family of cofactors, marked weight $W$, and invariant selector $F_x$. If $\mathcal{P}$ is the set of marked primes and $h_{\mathcal{P}}$ is the largest divisor of $h$ supported on $\mathcal{P}$, the selector has the form

where $\mathcal{R}_x$ is the cofactor family constructed there. In particular, $F_x(\ell h)=F_x(h)$ for every marked prime $\ell$, including when $\ell\mid h$. Replace the weight on integers $d$ by

where $0\le\Psi\le1$ is smooth, supported in $(1,2)$, and has $\int\Psi>0$. On its support, $d=crQ+1$, in place of $crQ-1$. The required marked replacement is [2 Proposition 5] with $\sigma=1$, the original sign in [11, 12]. Its constants are uniform over the invariant selectors and all dyadic intervals in the fixed exponent ranges used in the sieve.

Put $M_0=M/c$. The progression for the prime variable $Q$ becomes

Take $Y_0$ larger than every prime divisor of $M$. Then $(r,M)=1$, and (12) is a reduced residue class. For an odd prime $\ell\nmid Mr$, the condition $\ell\mid crQ+1$ excludes the single nonzero residue $Q\equiv-(cr)^{-1}\pmod{\ell}$. If $\ell\mid Mr$, no permitted residue is excluded. Thus the multiplicative sieve density remains

The distribution estimate of [2 Lemma 7] follows unchanged from Bombieri–Vinogradov, which is uniform over reduced residue classes. The smooth main integral has $\log((xy-1)/(cr))$ in place of $\log((xy+1)/(cr))$ in its denominator; all comparisons used there are identical.

In the rough-pair estimate of [2 Lemma 8], the congruence is now $mn \equiv1 \pmod{cr}$, which has $\varphi(cr)$ solutions in pairs of residue classes. At an odd sieving prime $\ell\nmid cr$, the conditions $mn \equiv1 \pmod{\ell}$ and $mn \equiv0 \pmod{\ell}$ have, respectively, $\ell- 1$ and $2\ell- 1$ solutions, and these sets are disjoint. Hence the local counts and the resulting bound are unchanged, including the independence of its constant from the number of marked groups.

The cofactor mass and tail estimates involve only the factorization of $d - 1$ and are otherwise the same. Their full harmonic mass is $\gg_K \epsilon\log x / \log Y$, where $K$ is the number of marked groups. The cutoff $r \le x^\epsilon$ is imposed by discarding the negligible tail after the marked estimates; it is not inserted into $F_x$, since doing so would destroy its invariance. The block sieve, Buchstab subtraction, and removal of the remaining semiprimes therefore give the same lower bound as in [2 Proposition 4]. As in the last subsection of its § 3, first fix all sieve parameters and $K$ using only the progression, and then choose $\epsilon$ and $Y$. The boundedness of the marked weights converts the weighted lower bound into (10), with a constant independent of these two parameters.

The proof uses only the analytic estimates and cofactor construction of [2]; the elliptic curve and rational point considered there play no role in Proposition 6. In particular, the proposition applies to the progression of Lemma 5 for an arbitrary elliptic curve satisfying $K_2 \ne\mathbb{Q}$.

Completely split primes in division fields

For a prime $\ell$, put

The following familiar bounds allow us to treat CM and non-CM curves together.

Proof. If $E$ has no complex multiplication, Serre’s open image theorem [13 Théorème 2] gives

for all sufficiently large $\ell$. Hence $n_\ell\asymp\ell^4$ in this case. If $E$ has complex multiplication by an order $\mathcal{O}$ in an imaginary quadratic field $F$, the main theorem of complex multiplication gives an image of bounded index, depending only on $E$, in $(\mathcal{O}/\ell\mathcal{O})^\times$ over $F$; see [17 Chapter II]. Outside a fixed finite set of primes, this group has order $(\ell- 1)^2$ or $\ell^2 - 1$. Since

we obtain $n_\ell\gg_E \ell^2$. Enlarging the implied constant accommodates the finitely many remaining primes in either case.

For the discriminant, the Néron–Ogg–Shafarevich criterion gives

and the faithful action on $E[\ell]$ gives $n_\ell\le\lvert\operatorname{GL}_2(\mathbb{F}_\ell) \rvert< \ell^4$. The general discriminant bound for a Galois extension [15 Proposition 6] is

Consequently,

which proves the second bound.

We next recall the consequence of the smoothed explicit formula needed here. For a number field $T$, let $\Lambda_T$ be the von Mangoldt function on its nonzero integral ideals: $\Lambda_T(\mathfrak{p}^j)=\log N\mathfrak{p}$ for a prime ideal $\mathfrak{p}$ and $j\ge1$, and $\Lambda_T$ is zero otherwise. We choose a nonnegative smooth weight, so that discarding unwanted prime ideals can only decrease the sum.

Proof. This is [2 Lemma 10]. We recall why its uniformity does not cost a factor depending on $1/\delta$. If $\widehat{f}$ is the Mellin transform of $f$, the smoothed explicit formula gives a pole term $x\widehat{f}(1)$, a zero term

and a remaining contribution $O_f(\log D_T+n)$ for $x\ge2$. Smoothness and the usual zero count give

The zero-free hypothesis bounds each $|x^\rho|$ by $x^{1-\delta}$, proving (15) with the asserted uniformity.

Proof. Choose $f$ as in Lemma 8, fixed once and for all. A completely split prime $p\in(x,2x)$ gives $n_{\ell}$ distinct prime ideals of norm $p$ in $K_{\ell}$, and hence contributes at least $n_{\ell}\log x$ to the nonnegative sum in (15). Applying that lemma with $\delta=1/N$ and dividing by $n_{\ell}\log x$ gives

Lemma 7 proves (16). Finally, the elementary prime estimates

give (17). The first follows by partial summation from $\pi(t)\ll t/\log t$, and the second is Chebyshev’s bound.

The factor $n_\ell$ contributed by a completely split prime is essential: it leaves only the logarithmic root discriminant in the error term. We have used the explicit formula for the Dedekind zeta function itself, so no separate effective Chebotarev theorem is required.

Proof of the main theorems

Let $E/\mathbb{Q}$ satisfy $K_2\ne\mathbb{Q}$, and fix the progression of Lemma 5. We may decrease $\epsilon_0$ in Proposition 6 so that $\epsilon_0<1/10$. Fix, for the moment, $0<\epsilon<\epsilon_0$ and $Y\ge Y_0$.

Suppose $p\in\mathcal{C}(x;\epsilon,Y)$ and $E(\mathbb{F}_p)$ is noncyclic. By Lemma 3, $p$ splits completely in $K_\ell$ for some prime $\ell\ne p$ satisfying (7). The progression excludes $\ell=2$. Since

and $c$ is a power of two, either $\ell\mid r$ or $\ell=Q$. For all sufficiently large $x$, the latter is impossible, because

Thus $\ell\mid r$ and

Suppose that every Dedekind zeta function has no zeros in $\Re s>1-1/N$, for a fixed real $N\ge2$. Proposition 9 therefore shows that the number of noncyclic candidates is at most

where $C_1,C_2$ depend only on $E$. Combining (10) and (19), we obtain

for all sufficiently large $x$, with the threshold permitted to depend on the fixed parameters. We now choose these parameters, keeping the dependence on $N$ explicit. Fix

and then fix $B\ge2$, depending only on $E$, so large that

For each fixed $N\ge2$, put

These choices are admissible in Proposition 6. The second term in parentheses in (20) is at most one quarter of the first. Moreover,

so for all sufficiently large $x$ the third term is also at most one quarter of the first. We conclude that

Since $N\ge2$,

The constant

is independent of $N$, and (22) proves (5) with $d_E$ in place of $c_E$.

For the lower proportion, apply this bound with $x=X/2$ and use the prime number theorem. It gives

Taking $c_E=d_E/2$ proves both assertions of Theorem 2. The zero-free half-plane $\Re s>31/32$ of Cureton and Thorner now proves Theorem 1.

The argument isolates a set of primes on which every obstruction to cyclicity lies in the short range (18). It does not evaluate the full inclusion-exclusion sum in (2), or prove an asymptotic with that constant. Its conclusion is a positive lower proportion, uniformly expressed in terms of the available zero-free width.

Formal verification. The accompanying Lean development verifies the positive-proportion argument for integral Weierstrass models of elliptic curves from explicit analytic and arithmetic inputs. It proves the construction of the fixed progression and shows that, among the candidate primes, every obstruction to cyclicity—a subgroup $(\mathbb{Z}/\ell\mathbb{Z})^2$ in $E(\mathbb{F}_p)$, corresponding to complete splitting in $K_\ell$—has $Y<\ell\le x^\epsilon$. The bound for these exceptional primes, their subtraction, and the final parameter choice are proved within the development. The formal theorem gives $c_E/(N\log N)$, with $c_E>0$ chosen before $N$, including the lower-proportion conclusion and its specialization to $N=32$.

The analytic inputs are the zero-free hypothesis supplied by [7], the candidate-prime estimate from [1, 2], the prime number theorem, the elementary prime-sum estimates, and the smoothed prime-ideal bound of Lemma 8. The last bound is proved in [2 Lemma 10] from Mellin inversion, the Dedekind zeta functional equation, and the standard zero count, with a constant independent of the field and the zero-free width. It is an explicit hypothesis in Lean because that analytic derivation has not been formalized. The arithmetic inputs are standard facts about torsion, reduction, and division fields. These inputs are supplied as explicit hypotheses; Lean checks the deductions from them. The development records its assumptions and references explicitly, and its completed build has no proof placeholders or added global axioms.

The Lean sources for [1], [2], and the current article are available at https://github.com/bhargavamanjul/FormalizedProofs/.

Acknowledgments

I thank Peter Sarnak, Paul Pollack, and Jesse Thorner for helpful conversations. GPT-6 was used to help write and formalize the arguments. The author was supported by the National Science Foundation (Grant DMS-1001828).