Points of prime order on elliptic curves over number fields of degree $9$ to $22$

Introduction

Let $K$ be a number field and $E/K$ an elliptic curve. By the Mordell-Weil theorem the torsion group $E(K)_{\mathrm{tors}}$ is finite, and Merel [28] proved that its order is bounded by a constant depending only on the degree $d = [K : \mathbb{Q}]$. A key step in all the proofs of such results is to bound the primes that divide $\#E(K)_{\mathrm{tors}}$. Following [10 Definition 1.1] we denote by $S(d)$ the set of primes $p$ for which there exists an elliptic curve over a number field of degree $d$ with a point of order $p$ (in [18] the same notation is used for fields of degree at most $d$), and by $\operatorname{Primes}(x)$ the set of primes $p \le x$.

Mazur [24] proved that $S(1) = \operatorname{Primes}(7)$, Kamienny [17] proved that $S(2) = \operatorname{Primes}(13)$ (which, together with the work of Kenku and Momose [21], determined the torsion groups over quadratic fields), and Parent [35, 36] proved that $S(3) = \operatorname{Primes}(13)$. Derickx, Kamienny, Stein and Stoll [10, Theorem 1.2] proved that

and Khawaja [22] proved that $S(8) = \operatorname{Primes}(23)$. An important ingredient of [10] is a bound of Oesterlé, which states that $p \le(3^{d/2} + 1)^2$ for all $p \in S(d)$ [10 Theorem 6.1]. Derickx and Stoll [12] studied the behavior of $S(d)$ as $d \to\infty$. Among other things they gave a criterion [12 Corollary 7.5], in terms of the strange characters modulo $p$, that rules out most primes below Oesterlé’s bound, and they determined the strange characters modulo all primes $p < 10^5$ [12 Proposition 5.2 and Table 2]. They have also determined $S(9)$, up to not being able to eliminate 89 from $S(9)$ [13]. The sets $S(d)$ are the starting point of the classifications of the possible torsion groups of elliptic curves over number fields of degree $d$, which are now known

2020 Mathematics Subject Classification. 11G05, 11G18, 14G05.

Key words and phrases. elliptic curves, torsion, modular curves, number fields.

The author was supported by the Croatian Science Foundation under the project no. IP-2022-10-5008, by the project “Implementation of cutting-edge research and its application as part of the Scientific Center of Excellence for Quantum and Complex Systems, and Representations of Lie Algebras”, PK.1.1.10.0004, co-financed by the European Union through the European Regional Development Fund – Competitiveness and Cohesion Programme 2021–2027, and by the European Union – NextGenerationEU through the National Recovery and Resilience Plan 2021–2026, via an institutional grant of the University of Zagreb Faculty of Science, IK 1A 1.3, Impact4Math. for $d \le10$ (see [9, 11, 29, 31, 32] and the references therein). In particular, the determinations of $S(9)$ and $S(10)$ in this paper are used in [32] and [31].

In this paper we determine $S(d)$ for $9 \le d \le22$. Our main result is the following theorem.

Together with the results mentioned above, this determines $S(d)$ for all $d \le22$. Note that $S(d') \subseteq S(d)$ if $d'$ divides $d$, but that $S(d)$ is not increasing in $d$: for example $37 \in S(10)$, but $37 \notin S(11)$, and $41, 43 \in S(14)$, but $41, 43 \notin S(16)$. The primes $31 \in S(10)$, $29, 43 \in S(14)$, $41, 61 \in S(20)$ and $67 \in S(22)$ are of the form $2d+1$ or $3d+1$, and such primes are always in $S(d)$ for even $d$, because of points with complex multiplication [12 Corollary 7.5]. Derickx and Stoll [12 Corollary 7.8] showed that, assuming a conjecture on the sparsity of strange newforms, $S(d)$ is contained in $\operatorname{Primes}(d+1) \cup\{\frac{3}{2}d+1, 2d+1, 3d+1\}$ for $d$ large enough. Note that the degrees we consider are far from this range, as $S(22)$ contains all the primes up to 53.

We now describe the proof. For a point of order $p$ on an elliptic curve over a number field of degree $d$, we study the corresponding effective divisor $D$ of degree $d$ on the modular curve $X_1(p)$, and our methods depend on the size of $p$.

For large $p$ we use Oesterlé’s bound together with [12 Corollary 7.5]. Unfortunately, Oesterlé’s bound exceeds $10^5$, the limit of [12 Table 2], for $d \ge11$, and it grows like $3^d$. For $d \ge13$ we prove a version of Oesterlé’s bound that uses reduction modulo 2 instead of modulo 3 (Proposition 4.5), which gives bounds of size about $2^d$. The price we pay for using the prime 2 is that we have to check that $2d$, instead of $d$, Hecke operators acting on the winding element are linearly independent modulo 2. For $d \in\{11, 12\}$ we use reduction modulo 3, 5 and 7 instead. Above $10^5$ at most 1488 primes remain in each degree, and for each of them we show that sufficiently many characters are not strange, by a computation with modular symbols over a finite field (Section 4.3). Below $4 \cdot10^5$ this agrees with a list of the strange characters that Michael Stoll has sent us, which also gives an independent proof for these primes (see the end of Section 4.3).

For medium-sized $p$ we use [12 Proposition 4.1], which shows that $D$ is invariant under a diamond operator whenever the gonality of $X_1(p)$ is large compared to $d$ (Section 4.4). For a few primes $p > 157$ its hypothesis on rational 2-torsion is not known, and we check it by showing that a Hecke operator restricts to an isogeny of odd degree on a suitable abelian subvariety of $J_1(p)$.

The remaining primes, which satisfy $37 \le p \le139$, require most of the work (§ 6 and § 7). We reduce $D$ modulo 2 and enumerate all the possible reductions, using all the elliptic curves over $\mathbb{F}_{2^f}$ for $f \le d$. Reductions supported on rational cusps are ruled out by the formal immersion criterion of [10]. For all other reductions we use the Hecke operator $A_3 = T_3 - 1 - 3\langle3\rangle$, composed with an element of the group ring of the diamond operators which kills the part of $J_1(p)$ of positive rank: if $D$ exists, a certain divisor of degree 0 on $X_1(p)_{\mathbb{F}_2}$ has to be principal [10 Lemma 8.6]. We show that it is not, by linear algebra in the canonical ring of $X_1(p)_{\mathbb{F}_2}$, which we compute from $q$-expansions. This argument rules out all but a short list of reductions. For these we show that $D$ is invariant under a diamond operator, which typically leads to a contradiction by counting, or we use a relative version of the formal immersion criterion, or the formal immersion criterion at the reductions of known points of smaller degree, or quotients of $X_1(p)$.

Our methods are those of [10], [12] and [22], applied to a much larger range of degrees. The main difference is the scale of the computations: for $d=22$ we have to deal with 155750 primes, the local computations concern 501 types of reductions at 17 primes, and they consist of 129638 new linear algebra certificates on the curves $X_1(p)_{\mathbb{F}_2}$, of genus up to 737. The certificates for $d=22$ alone occupy about 220 GB.

All the code used in the paper can be found at

https://github.com/F-Najman/Sd

and the complete certificates at Harvard Dataverse [30].

AI disclosure and comments

AI disclosure and comments. AI models were extensively used in the work leading to this paper. OpenAI’s GPT-Sol 6.1 and GPT-6 Astra models produced almost all of the mathematical content of the first versions of the proofs and carried out the computations. Anthropic’s Claude Opus 5.5 reviewed these proofs, without rerunning the computations, wrote the draft of the present manuscript and organized the code repository.

Acknowledgements

I thank Maarten Derickx for helpful discussions and Michael Stoll for sending me his list of the strange characters modulo all primes $p < 4 \cdot10^5$ (see the end of Section 4.3).

Notation and auxiliary results

Throughout the paper $p \ge5$ is a prime. The modular curve $X_1(p)$ parametrizes pairs $(E,P)$, where $E$ is an elliptic curve and $P \in E$ is a point of order $p$, and it is a fine moduli space. It has a smooth proper model over $\mathbb{Z}[1/p]$, which we also denote by $X_1(p)$, so in particular it has good reduction at 2. We write $J_1(p)$ for its Jacobian, $X_0(p)$ and $J_0(p)$ for the curve parametrizing pairs $(E,C)$ with $C \subseteq E$ cyclic of order $p$ and for its Jacobian, $X^{(d)}$ for the $d$-th symmetric power of a curve $X$, and $\operatorname{gon}_k X$ for the gonality of $X$ over a field $k$. For an effective divisor $D$ of degree $d$ on a curve $X$ over $\mathbb{Q}$ we write $D$ also for the corresponding point of $X^{(d)}(\mathbb{Q})$, and, when $X$ has good reduction at 2, $\overline{D}$ for its reduction modulo 2, an effective divisor of degree $d$ on $X_{\mathbb{F}_2}$.

Diamond and Hecke operators

For $a \in(\mathbb{Z}/p\mathbb{Z})^\times$ we write $\langle a\rangle$ for the automorphism $(E,P) \mapsto(E,aP)$ of $X_1(p)$. It depends only on the class of $a$ in

which is a cyclic group of order $(p-1)/2$, and for $h \in\Delta(p)$ we denote by $\operatorname{ord}(h)$ its order in $\Delta(p)$. We identify $h \in\Delta(p)$ with the corresponding diamond operator. For a subgroup $H \subseteq\Delta(p)$ we write $X_H = X_1(p)/H$ and $J_H$ for its Jacobian, so that $X_H = X_1(p)$ if $H$ is trivial. If $X_H$ has positive genus, then it has good reduction at every prime $q \ne p$, and the quotient map $X_1(p) \to X_H$ extends to a finite morphism of the smooth models over $\mathbb{Z}_{(q)}$ [23 Corollary 4.10]. For a prime $q \ne p$ we denote by $T_q$ the Hecke correspondence

where the sum is over cyclic subgroups $C$ of order $q$.

the sum running over the $q+1$ subgroups $C \subseteq E$ of order $q$, and we put