There is a question (2.4.c) marked ** (to denote "extremely difficult/currently open problem") in Silverman and Tate's Rational Points on Elliptic Curves which I found really interesting and wondered if anyone can shed any more light on the problem for me.

Let $p\geq 5$ be a prime and let $C=C_p: y^2 = x^3 + 1$ be the cubic curve over the finite field $\mathbb{F}_p$. Let $M_p = \left\vert C(\mathbb{F}_p)\right\vert$ be the order of the group of rational points of $C$ (this includes the point at infinity). Looking at some small primes I proved that if $p\equiv 2 \pmod 3$ then $M_p = p+1$.

The interesting case is when $p\equiv 1 \pmod 3$. I wrote a program which computes $M_p$ where $p\equiv 1\pmod 3$ is prime. We get the following sequence, where the $i$th term is the value of $M_p$ for the $i$th largest prime $p$ of the form $p\equiv 1\pmod 3$, and I have computed here for all $p\leq 1000$:

$12, 12, 12, 36, 48, 36, 48, 84, 84, 84, 84, 84, 108, 108, 156, 156, 144, 156, 156, 192, 228, 228, 252, 252, 228, 300, 252, 252, 324, 336, 300, 372, 336, 372, 336, 372, 432, 372, 444, 432, 468, 468, 444, 444, 468, 516, 588, 588, 588, 624, 576, 588, 624, 588, 588, 684, 624, 624, 684, 732, 684, 684, 756, 804, 732, 768, 732, 756, 876, 876, 912, 804, 912, 876, 948, 972, 912, 948, 948, 1008, \dots$

It seems that however many terms you take their GCD is always $12$, and this doesn't change as far as $p\leq 3000$, so I have two questions:

  1. Can anyone prove that $M_p$ is always divisible by 12?
  2. Since 1992 when the book was published, has anyone found an expression for $M_p$?

Any extra information about this sequence (or related topics/papers) is very welcome!

  • 2
    $\begingroup$ Presumably the proof of 1. would go by proving that $C(\Bbb F_p)$ has both full $2$-torsion and also nontrivial $3$-torsion for all $p\equiv1\pmod3$. The first part, at least, follows from the fact that $x^3+1$ splits completely over $\Bbb F_p$ when $p\equiv1\pmod3$. As for 2., other than being a multiple of $12$, I doubt there's any pattern other than that the number of points must obey the Hasse bound $|\#C(\Bbb F_p)-(p+1)| < 2\sqrt p$. $\endgroup$ Commented Feb 19, 2015 at 1:05

2 Answers 2


The numbers you actually want to look at turn out to be

$$a_p = p + 1 - |C(\mathbb{F}_p)|.$$

There is a lot to say about these numbers. The Hasse-Weil bound implies that $|a_p| \le 2 \sqrt{p}$. The Weil conjectures explain why this bound holds: it's because (for all but finitely many $p$) there is a pair of conjugate algebraic numbers $\alpha_p, \overline{\alpha}_p$ of absolute value $\sqrt{p}$ such that

$$|C(\mathbb{F}_{p^n})| = p^n + 1 - \alpha_p^n - \overline{\alpha}_p^n$$

for all $n$, which gives

$$a_p = \alpha_p + \overline{\alpha}_p.$$

The Sato-Tate conjecture describes the asymptotic distribution of these numbers as $p$ varies. Finally, one way to state the modularity theorem (which was not a theorem when Silverman-Tate was published!) in this case is that there is a modular form

$$f(q) = \sum_{n \ge 0} b_n q^n$$

which must be a "normalized cuspidal Hecke eigenform of weight $2$ and level $N$," where $N$ is a positive integer called the conductor of $C$, such that $b_0 = 0$ ("cuspidal"), $b_1 = 1$ ("normalized"), and

$$a_p = b_p$$

for all primes $p$ not dividing $N$. So essentially the best you can do as far as finding a formula for the $a_p$ goes is to find a concise description of this modular form.

Sage informs me that this curve has conductor $36$ and that there is a unique normalized cusp form of weight $2$ and level $36$, which is necessarily the Hecke eigenform we want. This implies that $y^2 = x^3 + 1$ must in fact be (isogenous to?) the modular curve $X_0(36)$. The $q$-expansion of this modular form begins

$$q - 4 q^7 + 2 q^{13} + 8 q^{19} - 5 q^{25} + \dots$$

and according to this paper that I found, it is $\eta (6 \tau)^4$ where $\eta$ is the Dedekind eta function. The $q$-expansion of this modular form, in full, is therefore

$$f(q) = q \prod_{n=1}^{\infty} (1 - q^{6n})^4.$$

See also the pentagonal number theorem, which leads to an expression for $a_p = b_p$ in terms of a signed sum over the set of ways $\frac{p - 1}{6}$ can be written as a sum of $4$ pentagonal numbers.

Edit: Here is a proof that $|C(\mathbb{F}_p)|$ is divisible by $12$ when $p \equiv 1 \bmod 3$. As Greg Martin says in the comments, this is equivalent to showing that $C(\mathbb{F}_p)$ has full 2-torsion and a 3-torsion point. The 2-torsion points on an elliptic curve in Weierstrass normal form are precisely those of the form $(x_0, 0)$, together with the point at infinity, and hence the number of 2-torsion points is the number of roots of $x^3 + 1$, plus one.

Now, if $p \equiv 1 \bmod 6$, then $\mathbb{F}_p^{\times}$ contains an element of order $6$, and hence $\mathbb{F}_p$ has all sixth roots of unity. Since the roots of $x^3 + 1$ are sixth roots of unity, it follows that $x^3 + 1$ has $3$ roots over $\mathbb{F}_p$ in this case, and hence there are $4$ 2-torsion points, as desired.

It remains to show that there is also a nontrivial $3$-torsion point. Recall that a point is $3$-torsion iff its tangent line intersects the curve with multiplicity $3$. In fact, the points $(0,\pm 1)$ both have this property: their tangent lines take the form $y = \pm 1, x = t$, and substituting this in gives $t^3 = 0$. So there are always at least $3$ 3-torsion points, as desired.

  • $\begingroup$ This is a fantastic answer - I'm especially impressed to see modular forms appearing here and I'll definitely be learning more about these as soon as I can. Thank you! $\endgroup$
    – Alex Saad
    Commented Feb 19, 2015 at 8:11
  • $\begingroup$ @XeSaad: happy to help. Incidentally, once you suspect that $y^2 = x^3 + 1$ is (isogenous to?) $X_0(36)$, you don't actually need the modularity theorem; you can just write down an isomorphism (maybe an isogeny?) between them, and then $a_p = b_p$ follows from the Eichler-Shimura relation (en.wikipedia.org/wiki/…). $\endgroup$ Commented Feb 19, 2015 at 20:16

If $p$ is $\equiv 1 \bmod 3,$ then we may write $p = a^2 + 3 b^2$, where $a$ is pinned down by requiring $a \equiv 1 \bmod 3$ (and I won't bother to pin down $b$). Then, writing $a_p = 1 + p - | C(\mathbb F_p)|$, as usual, one has that $$a_p = 2a,$$ or equivalently, $$| C(\mathbb F_p)| = 1 + p - 2 a .$$

In terms of Qiaochu's answer, the relevant modular form is a CM modular forms, and so can be expressed in terms of a Hecke character for the CM field (which is $\mathbb Q(\zeta_3)$ in this case).

More directly, the curve $C$ is a CM elliptic curve, with CM by $\mathbb Z[\zeta_3]$ (the element $\zeta_3$ acts by $(x,y) \mapsto (\zeta_3 x, y)$), and so it corresponds to a Hecke character of $\mathbb Q(\zeta_3)$. Explicitly computing this Hecke character gives the above result.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .