Séminaire BOURBAKI Mars 1994 46ème année, 1993-94, n^{o} 782

RATIONAL TORSION POINTS ON ELLIPTIC CURVES OVER NUMBER FIELDS [after Kamienny and Mazur]

by Bas EDIXHOVEN

1. INTRODUCTION

Let E be an elliptic curve over a number field K. In other words, K is a finite field extension of Q and E is a non-singular algebraic curve in the projective plane P_{K}^{2} over K given by an equation of the form y^{2}z = x^{3} + axz^{2} + bz^{3}, with a, b in K such that 4a^{3} + 27b^{2} ≠ 0. For each field extension L of K, we denote by E(L) the set of L-rational points of E; the point (0, 1, 0) in E(K) will be denoted by 0_{E}. It is well known that the sets E(L) have a unique stucture of abelian group with 0_{E} as origin, such that P_{1} + P_{2} + P_{3} = 0_{E} whenever P_{1}, P_{2} and P_{3} are the three intersection points (counted with multiplicity) of E with a straight line. For example, E(C) is isomorphic to a group of the form C/Λ with Λ a lattice in C. This already shows that the torsion subgroup E(C)_{tors} of E(C) is isomorphic to Q/Z × Q/Z.

The theorem of Mordell-Weil states that E(K) is finitely generated, hence isomorphic to Z/n_{1}Z × Z/n_{2}Z × Z^{r} with n_{1}|n_{2}, n_{1} > 0, n_{2} > 0 and r ≥ 0. The pair (n_{1}, n_{2}) is the isomorphism type of E(K)_{tors}; the integer r is called the rank of E(K).

1.1. Conjecture. For every integer d ≥ 1 there exists an integer B_{d} such that for every number field K of degree d (over Q) and every elliptic curve E over K one has: |E(K)_{tors}| < B_{d}.

This conjecture is known as the strong uniform boundedness conjecture, the word “strong” meaning that the bound is uniform in all number fields of degree d.

Let us introduce some notation. For d ≥ 1 we define Φ(d) to be the set of isomorphism types of the groups E(K)_{tors} with E an elliptic curve over a number field K with [K : Q] = d. We define S(d) to be the set of primes p for which there exists an elliptic curve E over a number field K with [K : Q] = d and |E(K)_{tors}| divisible by p. With this terminology, Conjecture 1.1 is clearly equivalent to the statement that for all d, Φ(d) is a finite set. The results obtained by Kamienny and Mazur can now be stated as follows.

1.2. Theorem. ^{1}

1. For d ≤ 8 the set Φ(d) is finite (Kamienny [8], see also [9]).

2. The sets S(d) have density zero for all d ([9]).

3. Φ(d) is finite if and only if S(d) is finite ([9]).

Furthermore, the sets S(1), S(2), Φ(1) and Φ(2) are known:

Φ(1) = {(1, m) | 1 ≤ m ≤ 10} ∪ {(1, 12)} ∪ {(2, 2m) | 1 ≤ m ≤ 4}
Φ(2) = {(1, m) | 1 ≤ m ≤ 16} ∪ {(1, 18)} ∪ {(2, 2m) | 1 ≤ m ≤ 6} ∪
{(3, 3m) | 1 ≤ m ≤ 2} ∪ {(4, 4)}

The set Φ(1) was determined by Mazur [17] in 1976, see also [18], using results of Kubert [13]. This result was at that time known as a conjecture of Ogg ([22]), but in fact it had already been conjectured by B. Levi ([15]) in 1908 (see a forthcoming article by Schappacher and Schoof). The determination of Φ(2) uses work of Kamienny, Kenku and Momose (see [11]). Part 3 of Theorem 1.2 is an easy consequence of a result of Frey (1992), which in turn is an easy consequence of a theorem of Faltings (see §6). A “local” version of the uniform boundedness conjecture was proved by Manin in 1969: he showed that for any number field K and any prime p there exists an integer e ≥ 0 such that no elliptic curve over K has a rational point of order p^{e} (see [16] and [23]).

1See §7 for more recent results. In particular, Conjecture 1.1 is now a theorem of Merel.

2. RELATION WITH OTHER CONJECTURES

It is easily seen that the ABC-conjecture for a number field K implies a uniform bound for |E(K)_{tors}| (see [4]). The same is true for the height conjecture for elliptic curves over K (see [4]). Instead of considering elliptic curves over number fields of degree d, one might consider abelian varieties over Q of dimension d. Restriction of scalars à la Weil shows that Conjecture 1.1 is a consequence of:

2.1. Conjecture. For every d ≥ 0 there exists an integer B′_{d} with the property that |A(Q)_{tors}| < B′_{d} for all d-dimensional abelian varieties over Q.

It seems almost nothing is known about this conjecture, see [24] and references therein.

3. MAZUR’S METHOD FOR THE NUMBER FIELD Q

Let E be an elliptic curve over a number field K and P ∈ E(K) a point of prime order N. Let O_{K} be the ring of integers of K and let F_{q} (q some prime power) be a residue field of O_{K}. Let Ẽ be the fibre over F_{q} of the Néron model of E, and let P̃ in Ẽ(F_{q}) be the reduction of P. Suppose that N does not divide q. Then elementary theory of group schemes shows that P̃ has order N. Now Ẽ is of one of the following three types:

good reduction: Ẽ is an elliptic curve over F_{q}, hence |Ẽ(F_{q})| ≤ (q^{1/2} + 1)^{2}, so N ≤ (q^{1/2} + 1)^{2};

additive reduction: there is an exact sequence 0 → G_{a}_{,F_{q}} → Ẽ → Φ → 0 with |Φ(F_{q})| ≤ 4; since G_{a}_{,F_{q}}(F_{q}) ≅ F_{q}, one has N ≤ 3;

multiplicative reduction: there is an exact sequence 0 → T → Ẽ → Φ → 0 with T = G_{m}_{,F_{q}} or T = G̃_{m}_{,F_{q}} (the unique non-trivial twist) and Φ(F_{q}) = Z/nZ for some n, so in this case one has N|(q − 1) or N|(q + 1) or N|n.

We conclude that in order to prove that S(1) ⊂ {2, 3, 5, 7, 13}, it suffices to prove that an elliptic curve over Q with a point of prime order N ∉ {2, 3, 5, 7, 13} does not have multiplicative reduction at 3.

So let us suppose that we have P ∈ E(Q) of prime order N with N not in {2, 3, 5, 7, 13}. Our goal is now to show that E does not have multiplicative reduction at 3 (actually, with a bit more work one can show that E has potentially good reduction at all p ≥ 3). The idea of the proof is to interpret (E, P) as a Q-rational point of some moduli space, and to study the reduction of that point modulo 3.

Let X_{0}(N) be the coarse moduli space of generalized elliptic curves equipped with a subgroup scheme of rank N which meets all irreducible components in all geometric fibres ([2], [10]). It is known that X_{0}(N) is a projective curve over Spec(Z), smooth over Z[1/N]. Its fibre X_{0}(N)_{F_{N}} over F_{N} has two irreducible components which are both smooth, of genus zero and which intersect transversally in the so-called supersingular points. The genus of X_{0}(N) is roughly N/12 and the condition N ∉ {2, 3, 5, 7, 13} means precisely that X_{0}(N) has positive genus. By construction, a pair (E/S, G) with E an elliptic curve over a scheme S and G a subgroup scheme of rank N of E gives an S-valued point of X_{0}(N). Points of X_{0}(N) with values in an algebraically closed field k correspond to isomorphism classes of objects (E/k, G). The Riemann surface X_{0}(N)(C) can be obtained by adding two points (called the cusps 0 and ∞) to Γ_{0}(N)\H (the quotient of the upper half plane by the congruence subgroup Γ_{0}(N) of SL_{2}(Z)). The cusp ∞ corresponds to a projective line with its points 0 and ∞ identified, equipped with its subgroup μ_{N}. The cusp 0 corresponds to an N-gon of projective lines, equipped with a subgroup Z/NZ meeting all N projective lines. In fact 0 and ∞ give Z-valued points of X_{0}(N); the complement of 0 and ∞ is the moduli space for elliptic curves with a subgroup scheme of rank N.

Let J_{0}(N) be the Néron model over Z of the jacobian of X_{0}(N)_{Q}. Its restriction to Z[1/N] is an abelian scheme whose fibres have dimension equal to the genus of X_{0}(N). The points of J_{0}(N) with values in a field k of characteristic different from N correspond to divisor classes of degree zero on X_{0}(N)_{k}, modulo principal divisors. The fibre over F_{N} of J_{0}(N) sits in an exact sequence

0 → torus → J_{0}(N)_{F_{N}} → Z/nZ → 0, n = num (\frac{N − 1}{12})

with the group Z/nZ generated by the reduction mod N of the point c in J_{0}(N)(Q) of order n given by the divisor class c = (0) − (∞).

Let T be the endomorphism ring of J_{0}(N); it is generated by the Hecke operators T_{p} (p ≠ N prime) and the Atkin-Lehner involution w_{N}. It will be convenient to work with the Hecke operators T_{m} for all m ≥ 1; these are defined as follows: T_{N} = −w_{N} and one formally has the Euler product:

(1 − T_{N}N^{−s})^{−1} ∏_{l≠N} (1 − T_{l}l^{−s} + l^{1−2s})^{−1} = ∑_{m≥1} T_{m}m^{−s}

If one interprets H^{0}(J_{0}(N)_{C}, Ω^{1}) = H^{0}(X_{0}(N)_{C}, Ω^{1}) as the space of cuspidal modular forms of weight two on Γ_{0}(N) and uses q-expansions, these operators are given by the usual formulas. This implies that the coefficient of q^{m} of an eigenform with eigenvalue a_{m} for T_{m}, equals a_{m} times the coefficient of q. The ring T is commutative, reduced, free of rank dim(J_{0}(N)_{Q}) as Z-module. The Q-algebra Q ⊗ T is a product of totally real fields and Spec(T) is connected. For each prime number p ≠ N one has the Eichler-Shimura identity in End_{F_{p}}(J_{0}(N)_{F_{p}}):

T_{p} = Frob_{p} + Ver_{p}, where Frob_{p}Ver_{p} = Ver_{p}Frob_{p} = p

Weil’s theorem on the eigenvalues of Frobenius endomorphisms of abelian varieties then implies that for any homomorphism ϕ: T → C and for any prime p ≠ N, one has |ϕ(T_{p})| ≤ 2p^{1/2}.

The action of T on c is as follows: T_{p}(c) = (p+1)c for all primes p ≠ N, and w_{N}(c) = −c. Let I ⊂ T be the annihilator of c. It follows that T/I = Z/nZ and that I is generated by the T_{p}−p−1 (p ≠ N prime), w_{N}+1 and n (actually one doesn’t need n). The ideal I ⊂ T is called the Eisenstein ideal because it corresponds to congruences between cuspidal forms and non-cuspidal forms on Γ_{0}(N) of weight two ([17], page 37).

Let T_{I} := lim_{←} T/I^{m} be the I-adic completion of T. The ideal γ_{I} of T is then defined to be the kernel of the map T → T_{I}. In other words, γ_{I} is the intersection of the minimal prime ideals p of T with p+I ≠ T. Phrased differently: Spec(T/γ_{I}) is the union of the irreducible components of Spec(T) that have nonempty intersection with Spec(T/I).

Let γ_{I}J_{0}(N)_{Q} be the abelian subvariety of J_{0}(N)_{Q} generated by the tJ_{0}(N)_{Q}, t ∈ γ_{I}. The Eisenstein quotient J_{Q} is then defined by: J_{Q} := J_{0}(N)_{Q}/γ_{I}J_{0}(N)_{Q}. Let J be its Néron model over Z. By construction, T/γ_{I} acts faithfully on J. The following theorem is one of the main results of [17] (see also [19]).

3.1. Theorem (Mazur). The group J(Q) is torsion, and in fact, J(Q) is generated by c, hence cyclic of order n.

Let X_{0}(N)^{sm} ⊂ X_{0}(N) be the biggest open part which is smooth over Z (i.e., X_{0}(N)^{sm} is the complement of the set of double points in characteristic N). The points 0 and ∞ in X_{0}(N)(Z) are in fact in X_{0}(N)^{sm}(Z). Let X_{0}(N)^{sm} → J_{0}(N) be the usual embedding of a curve in its jacobian, normalized by the condition that ∞ is sent to 0. By composition with the canonical map J_{0}(N) → J we get a morphism f: X_{0}(N)^{sm} → J.

3.2. Theorem (Mazur). (See [18].) The morphism f is a formal immersion at ∞, away from characteristic 2. In other words, the cotangent space Cot_{0}(J_{Z[1/2]}) of J_{Z[1/2]} at 0 maps surjectively to Cot_{∞}(X_{0}(N)_{Z[1/2]}), or equivalently, for each prime p ≠ 2 the map from Cot_{0}(J_{F_{p}}) to Cot_{∞}(X_{0}(N)_{F_{p}}) is non-zero.

Proof. The hypothesis that p is not equal to 2 implies that Cot_{0}(J_{F_{p}}) maps injectively to Cot_{0}(J_{0}(N)_{F_{p}}). Because J_{0}(N) is a (commutative) group scheme, we have a canonical isomorphism Ω_{J_{0}(N)/Z}^{1} ≅ π^{∗}Cot_{0}(J_{0}(N)) (π: J_{0}(N) → Spec(Z)), inducing Cot_{0}(J_{0}(N)) ≅ H^{0}(J_{0}(N), Ω_{J_{0}(N)/Z}^{1}). Composing with the pullback of differential forms along f gives an isomorphism:

Cot_{0}(J_{0}(N)) ≅ H^{0}(J_{0}(N), Ω_{J_{0}(N)/Z}^{1}) ˜→ H^{0}(X_{0}(N)^{sm}, Ω_{X_{0}(N)/Z}^{1}) = S(N, 2)

where S(N, 2) is the Z-module of cusp forms over Z of weight two on Γ_{0}(N). With this identification, the map Cot_{0}(J_{0}(N)) → Cot_{∞}(X_{0}(N)) corresponds to evaluating at ∞. The Tate curve over Z((q)) shows that dq is a Z-basis of Cot_{∞}(X_{0}(N)); the q here can be interpreted as the function z ↦ exp(2πiz) on the upper half plane H. So finally we see that the map on cotangent spaces corresponds to the map:

S(N, 2) → Z,  ( ∑_{m≥1} a_{m}q^{m}) (dq)/q ↦ a_{1}

Let p > 2 and let ω ≠ 0 be an eigenvector for T in Cot_{0}(J_{\overline{F}_{p}}). Since p > 2, ω has non-zero image in S(N, 2)_{F_{p}}; this image is an eigenvector for T, hence it has a_{1} ≠ 0. □

With all this, we can finish Mazur’s proof that the elliptic curve E does not have multiplicative reduction at 3. So suppose that E has multiplicative reduction at 3. Since N ≥ 11 > 3+1, P̃ in Ẽ(F_{3}) has non-zero image in Φ(F_{3}). This means that the Q-rational point (E/Q, ⟨P ⟩) of X_{0}(N) specializes to the cusp 0 modulo 3. Let x be the Q-rational point corresponding to (E/⟨P ⟩, E[N]/⟨P ⟩); then x specializes to ∞ modulo 3. We consider f(x) ∈ J(Q). By Thm. 3.1, f(x) is torsion. By Thm. 3.2, f(x) is not zero (this can be seen in the completion of X_{0}(N) along ∞). But this is in contradiction with the following lemma, whose proof is an elementary calculation with formal groups.

3.3. Lemma. Let R be a discrete valuation ring of characteristic 0 and with residue field k of characteristic p. Let G be a smooth group scheme over R. Let x ∈ G(R) be torsion. Suppose that the valuation of p is strictly less than p−1. Then the specialization x_{k} has the same order as x.

4. KAMIENNY’S GENERALIZATION OF MAZUR’S METHOD

Let d ≥ 1, K a number field of degree d, E an elliptic curve over K and P ∈ E(K) a point of prime order N. Let y ∈ X_{0}(N)(K) be the point corresponding to (E/⟨P ⟩, E[N]/⟨P ⟩). The idea is now to look at the Q-rational point x := ∑_{σ} σ(y), with σ: K → C, of the dth symmetric power X_{0}(N)^{(d)} of X_{0}(N). By definition, X_{0}(N)^{(d)} is the quotient by the symmetric group S_{d} acting on the dth power X_{0}(N)^{d}. Hence X_{0}(N)^{(d)} is proper over Z, smooth of relative dimension d over Z[1/N]. To give a k-valued point of X_{0}(N)^{(d)}, where k is a perfect field, is the same as giving an effective divisor of degree d on X_{0}(N)_{k}.

Let f_{d}: X_{0}(N)_{Z[1/N]}^{(d)} → J_{Z[1/N]} be the usual map from the symmetric product of a curve to its jacobian, normalized by the condition that d·∞ is sent to 0. We apply Mazur’s method to x and f_{d}.

Suppose p > 2 is a prime such that N > (p^{d/2} + 1)^{2}. Then at each residue field of O_{K} of characteristic p, E has multiplicative reduction, and P̃ has non-zero image in Φ; in other words, all specializations to characteristic p of the K-valued point y of X_{0}(N) are ∞. This means that x specializes to d·∞ modulo p. If moreover f_{d} is a formal immersion at the point d·∞ modulo p, then we obtain a contradiction as before: f_{d}(x) is torsion, f_{d}(x) is not zero and f_{d}(x) specializes to 0 modulo p. These arguments prove the following proposition.

4.1. Proposition. Let d ≥ 1, N ∈ S(d) and suppose that f_{d} is a formal immersion at d·∞ modulo a prime p > 2. Then N ≤ (p^{d/2} + 1)^{2}. □

Recall that X_{0}(N) has a formal local coordinate q at ∞. Hence X_{0}(N)^{d} has formal local coordinates q_{1}, …, q_{d} at (∞, …, ∞). The elementary symmetric functions σ_{1} = q_{1}+ ⋯ +q_{d}, …, σ_{d} = q_{1} ⋯ q_{d} are then formal local coordinates of X_{0}(N)^{(d)} at d·∞, so dσ_{1}, …, dσ_{d} is a Z-basis for Cot_{d·∞}(X_{0}(N)^{(d)}).

4.2. Lemma. Let ω be in Cot_{0}(J), or, equivalently, in H^{0}(J, Ω_{J/Z}^{1}). Then f_{1}^{∗}(ω) is a differential form on X_{0}(N)_{Z[1/N]}, say with q-expansion (∑_{m≥1} a_{m}q^{m})(dq)/q. We have:

f_{d}^{∗}(ω) = a_{1}dσ_{1} − a_{2}dσ_{2} + ⋯ + (−1)^{d+1}a_{d}dσ_{d} in Cot_{d·∞}(X_{0}(N)_{Z[1/N]}^{(d)}).

Proof. Let g: X_{0}(N)^{d} → X_{0}(N)^{(d)} be the canonical map. For m ≥ 1 define s_{m} = q_{1}^{m} + ⋯ + q_{d}^{m}. Then

g^{∗}f_{d}^{∗}(ω) = ∑_{i=1}^{d} ∑_{m≥1} a_{m}q_{i}^{m} (dq_{i})/q_{i} = ∑_{m≥1} a_{m}m^{−1}ds_{m}

From Newton’s identities

s_{m} − σ_{1}s_{m−1} + ⋯ + (−1)^{m−1}σ_{m−1}s_{1} + (−1)^{m}mσ_{m} = 0

one sees that

m^{−1}ds_{m} = (−1)^{m}dσ_{m} in Cot_{d·∞}(X_{0}(N)^{(d)}).

This finishes the proof. □

4.3. Theorem (Kamienny’s criterion). Let d ≥ 2 and N ∈ S(d). Suppose that the images T′_{1}, …, T′_{d} in T/γ_{I} of T_{1}, …, T_{d} ∈ T are linearly independent. Then N ≤ 2^{d+1}(d!)^{5d/2}.

Proof. By the q-expansion principle, Tan_{0}(J_{0}(N)) is a locally free T-module of rank 1. Since Q ⊗ T is a product of fields, Q ⊗ S(N, 2) is a free Q ⊗ T-module of rank 1. It follows that Q ⊗ S(N, 2)[γ_{I}] (forms annihilated by γ_{I}) is a free module of rank 1 over Q ⊗ (T/γ_{I}). Let ω_{1}, …, ω_{r} be a basis of \overline{Q} ⊗ S(N, 2)[γ_{I}] consisting of normalized eigenforms for T, and write ω_{i} = ∑_{m≥1} a_{i,m}q^{m}(dq)/q (normalized means that a_{i,1} = 1 for all i). Let R ⊂ \overline{Q} be the ring generated by the a_{i,m}. Then, as a Z-module, R is free of some rank t, say. The hypothesis that T′_{1}, …, T′_{d} are linearly independent means that the (a_{i,1}, …, a_{i,d}), 1 ≤ i ≤ r, generate the \overline{Q}-vector space \overline{Q}^{d}. Note that Lemma 4.2 implies that f_{d}: X_{0}(N)_{Q}^{(d)} → J_{Q} is a formal immersion at d·∞.

Exactness properties of Néron models show that the torsion of the quotient Cot_{0}(J_{0}(N))/Cot_{0}(J) is killed by 2 (compare [18], Cor. 1.1). Hence ω_{1}, …, ω_{r} can be viewed as elements of R[1/2] ⊗ Cot_{0}(J).

After renumbering, we may suppose that Δ := det(a_{i,m})_{1≤i,m≤d} is non-zero. Recall that for all embeddings R → C and all prime numbers l ≠ N one has |a_{i,l}| ≤ 2l^{1/2}, and that a_{i,N} = ±1. For arbitrary m one has |a_{i,m}| ≤ σ_{0}(m)m^{1/2}, where σ_{0}(m) is the number of positive divisors of m. Hence for the norm of Δ one has:

|N(Δ)| ≤ (d! · (d!)^{1/2}σ_{0}(2) ⋯ σ_{0}(d))^{t} ≤ (d!)^{5t/2}

Suppose now that p > 2 is a prime such that f_{d} is not a formal immersion at ∞ modulo p. Then p divides the index of f_{d}^{∗}Cot_{0}(J) in Cot_{d·∞}(X_{0}(N)^{(d)}). It follows that there is an α ∈ R such that Δ = pα, hence also |N(Δ)| = p^{t}|N(α)| ≥ p^{t}. We conclude that p ≤ (d!)^{5/2}.

Let p be a prime between (d!)^{5/2} and 2(d!)^{5/2}; then f_{d} is a formal immersion at ∞ modulo p. Prop. 4.1 implies that N ≤ (p^{d/2} + 1)^{2} ≤ 2^{d+1}(d!)^{5d/2}. □

We end this section with some remarks. First of all, the difficulty with Kamienny’s criterion is that one needs to know whether T′_{1}, …, T′_{d} are linearly independent or not. The question of linear dependence of T_{1}, …, T_{d} in T itself is easily settled: let g := dim(J_{0}(N)_{Q}), then T_{1}, …, T_{g} are linearly independent in T. To prove this (optimal) result, one remarks that it is equivalent to ∞ not being a Weierstrass point on X_{0}(N)_{Q}. Reduction modulo N shows that ∞ is not a Weierstrass point (one finds a Vandermonde determinant, see also [14]).

Secondly, let us consider the case d = 2. We want to know the primes N for which T′_{1} and T′_{2} are linearly independent. Since T′_{1} is the identity, the question is whether T′_{2} acts as a scalar on J or not, so suppose that T′_{2} acts as a scalar. Weil’s bound implies that T′_{2} ∈ {−2, −1, 0, 1, 2}. But on the other hand we have T′_{2} = 2+1 modulo n (consider the image of T′_{2} in T/I = Z/nZ). It follows that (N − 1)/12 ≤ num((N − 1)/12) = n ≤ 5, hence that N ≤ 61. So Conjecture 1.1 is now proved for d = 2. The bounds given in Theorem 4.3 can be improved in this case: the proof shows that for N > 61 the map f_{2}: X_{0}(N)^{(2)} → J is a formal immersion at ∞ modulo 7, so that N ∈ S(2) implies N ≤ ((7^{2})^{1/2} + 1)^{2} = 64. To go further, one has to do explicit calculations for the N ≤ 61. For example, by calculating the characteristic polynomial of T_{2} acting on the space of weight two cusp forms on Γ_{0}(N) one sees that T′_{2} does not acts as a scalar modulo 5 for N = 43, 53 and 61, which means that these three N are not in S(2).

5. WINDING HOMOMORPHISMS AND FUGITIVE SETS

In order to prove that the sets S(d) are finite for d ≤ 8 and, for all d, have density zero, it suffices, in view of Theorem 4.3, to prove that the set of primes N such that T′_{1}, …, T′_{d} are linearly dependent is finite for d ≤ 8 and has density zero for all d. The following lemma shows that to check whether T′_{1}, …, T′_{d} are linearly independent or not (for a given N), it suffices to check a finite set of relations; this set of relations is independent of N.

5.1. Lemma. Let d ≥ 1, let N be a prime and suppose that T′_{1}, …, T′_{d} are linearly dependent. Consider a non-trivial relation

a_{1}T′_{1} + ⋯ + a_{d}T′_{d} = 0, a_{1}, …, a_{d} in Z

which is minimal in the following sense: there is no non-trivial relation among T′_{1}, …, T′_{d} with more coefficients equal to zero, and a_{1}, …, a_{d} have greatest common divisor equal to 1. Then |a_{i}| ≤ ((d−1)!)^{5/2} for all i.

Proof. Let a_{i_{1}}, …, a_{i_{r+1}} be the a_{i} which are non-zero. We rewrite the equation as:

−a_{i_{r+1}}T′_{i_{r+1}} = a_{i_{1}}T′_{i_{1}} + ⋯ + a_{i_{r}}T′_{i_{r}}

Recall that Q⊗T is a product of totally real fields. Hence R⊗T/γ_{I} is canonically isomorphic (as R-algebra) to R^{e}, where e = dim(J_{Q}). This gives an embedding T/γ_{I} ↪ R^{e}; let v_{i} = (v_{i,1}, …, v_{i,e}) denote the image of T′_{i}. Then, by Weil’s bound, we have |v_{i,j}| ≤ i^{3/2} for all i and j. Since T′_{i_{1}}, …, T′_{i,r} are linearly independent, there exist j_{1}, …, j_{r} in {1, …, e} such that Δ := det(v_{i_{k},j_{l}})_{1≤k,l≤r} is not zero. Let R be the subring of R generated by all v_{i,j}. Then, as a Z-module, R is free of some rank t, say. Let \overline{R} denote R/a_{i_{r+1}}R. Then in \overline{R}^{e} we have the relation:

0 = \overline{a}_{i_{1}} \overline{v}_{i_{1}} + ⋯ + \overline{a}_{i_{r}} \overline{v}_{i_{r}}

and \overline{a}_{i_{1}} \overline{R} + ⋯ + \overline{a}_{i_{r}} \overline{R} = \overline{R} since a_{i_{1}}, …, a_{i_{r+1}} have greatest common divisor equal to 1. It follows that v_{i_{1}} ∧ ⋯ ∧ v_{i_{r}} has image 0 in ⋀^{r}(\overline{R}^{e}), hence Δ has image zero in \overline{R} (it is one of the “coordinates” of v_{i_{1}} ∧ ⋯ ∧ v_{i_{r}}). Hence we have Δ = a_{i_{r+1}}Δ′ for some Δ′ in R. It follows that |N(Δ)| ≥ |a_{i_{r+1}}|^{t}. As in the proof of Theorem 4.3 one shows that |N(Δ)| ≤ ((d−1)!)^{5t/2}, hence the result. □

Remark. Applying Siegel’s lemma (which gives an upper bound for the smallest non-trivial solution of a system of linear equations with coefficients in Z) one gets more or less the same estimate.

Recall that, by definition, T/γ_{I} is the image of T in its completion T_{I}. Hence, for a_{1}, …, a_{d} in Z, one has a_{1}T′_{1} + ⋯ + a_{d}T′_{d} = 0 if and only if a_{1}T_{1} + ⋯ + a_{d}T_{d} is in I^{m} for all m. The finiteness of S(2) was obtained by studying the image of a relation among T_{1} and T_{2} in T/I. We will now generalize this method and study an arbitrary relation using the filtration T ⊃ I ⊃ I^{2} ⊃ · · ·. To do this, it will be convenient not to work with the T_{i}, but with the η_{i} in T defined as follows:

η_{l} := T_{l} − l − 1 for l ≠ N prime, η_{N} := T_{N} − 1,  η_{1} := 1,  η_{ab} := η_{a}η_{b}.

The T_{m} can be written as linear combinations of the η_{k}:

T_{m} = η_{m} + ∑_{k<m} c_{m,k}η_{k},

with c_{m,k} in Z. It is important to note that the c_{m,k} with m < N do not depend on N. For all m, let η′_{m} be the image of η_{m} in T/γ_{I}. For m ≥ 1, let v(m) denote the number of factors in a prime factorization of m: if m = l_{1} ⋯ l_{r} with the l_{i} prime, then v(m) = r. Note that by definition, we have η_{l} ∈ I for all primes l, hence for all m ≥ 1 we have η_{m} ∈ I^{v(m)}.

Suppose now that we have d ≥ 1 and a prime N > d such that T′_{1} …, T′_{d} are linearly dependent. Then Lemma 5.1 gives a non-trivial relation b_{1}η′_{1}+⋯+b_{d}η′_{d} = 0, with |b_{i}| < C(d) for all i, where C(d) is an integer depending only on d. We want to show that, for d ≤ 8, N is bounded, and that in general N lies in a set of primes which has density zero.

Before treating the general case, let us deal with d ≤ 8, or, what amounts to the same, with d = 8. Then we have b_{1}, …, b_{8} in Z, |b_{i}| ≤ C(8) for all i, such that the element

x := b_{1}η_{1} + (b_{2}η_{2} + b_{3}η_{3} + b_{5}η_{5} + b_{7}η_{7}) + (b_{4}η_{2}^{2} + b_{6}η_{2}η_{3}) + b_{8}η_{2}^{3}

of T is in I^{m} for all m ≥ 0. Note that in this expression for x the second term is in I, the third is in I^{2} and the fourth is in I^{3}. Suppose first that b_{1} ≠ 0. Since b_{1} = b_{1}η_{1} ∈ I ∩ Z = nZ, one then has (N−1)/12 ≤ n ≤ |b_{1}| ≤ C(8), hence N ≤ 12C(8)+1. So we may suppose that b_{1} = 0. Then x ∈ I, so it will be useful to consider the image of x in I/I^{2}; this is where Mazur’s winding homomorphism comes in.

5.2. Theorem ([17], §18). Write N−1 = en, hence e = gcd(N−1, 12). Let F_{N}^{∗}[e] be the kernel of the eth power endomorphism of F_{N}^{∗}. There is a unique isomorphism of groups (the winding homomorphism)

w: I/I^{2} ⟶ F_{N}^{∗}/F_{N}^{∗}[e]

which sends η_{l} to l^{(l−1)/2} for all primes l ≠ N.

Let ϕ: I/I^{2} → F_{N}^{∗} be the homomorphism defined by ϕ(y) = w(y)^{12}. Then for all primes l ≠ N, ϕ(η_{l}) = l^{6(l−1)}.

Now suppose that b_{2}, b_{3}, b_{5} and b_{7} are not all zero. Then we have:

1 = ϕ(x) = (2^{b_{2}}3^{2b_{3}}5^{4b_{5}}7^{6b_{7}})^{6} in F_{N}^{∗}

It follows that N divides the numerator of (2^{b_{2}}3^{2b_{3}}5^{4b_{5}}7^{6b_{7}})^{6} − 1, hence N is at most exp(127·C(8)). So we may now suppose that b_{2}, b_{3}, b_{5} and b_{7} are zero. Then we have η′_{2}(b_{4}η′_{2} + b_{6}η′_{3} + b_{8}η′_{4}) = 0. Since η′_{2} is an isogeny from J to itself (this follows from Weil’s bound), we must also have:

y := (b_{4}η_{2} + b_{6}η_{3}) + b_{8}η_{2}^{2} ∈ I^{m} for all m ≥ 0

If b_{4} and b_{6} are not both zero, we find N ≤ exp(18·C(8)). If b_{4} and b_{6} are both zero, then we find η′_{2} = 0, which implies that J = 0 and hence N ≤ 13. This finishes the proof that the sets S(d) with d ≤ 8 are finite. Note, by the way, that the reason the proof works, is that we obtained linear relations among the images of the η_{l} in I/I^{2}. This method breaks down for d = 9, since then one has to deal with b_{4}η_{2}^{2} + b_{6}η_{2}η_{3} + b_{9}η_{3}^{2}.

In the general case (i.e., d arbitrary) let m be minimal such that not all b_{i} with v(i) = m are zero. We define x := ∑_{v(i)=m} b_{i}η_{i}; then x ∈ I^{m+1}. We choose an isomorphism of groups log: F_{N}^{∗} → Z/(N−1)Z. The fact (see [17], Thm. 18.10) that I ⊂ T is locally principal, implies that we have a homomorphism of groups:

ϕ_{m}: I^{m}/I^{m+1} ˜→ (I/I^{2})^{⊗m} ⟶^{ϕ^{⊗m}} (F_{N}^{∗})^{⊗m} ⟶^{log^{⊗m}} (Z/(N−1)Z)^{⊗m} ˜→ Z/(N−1)Z

(The tensor products are over Z.) We have ϕ_{m}(x) = 0. To see what this means, let us first consider ϕ_{m}(b_{i}η_{i}), where i = l_{1}^{e_{1}} ⋯ l_{r}^{e_{r}} with the l_{j} prime. One computes that

ϕ_{m}(b_{i}η_{i}) = B_{i}(log l_{1})^{e_{1}} ⋯ (log l_{r})^{e_{r}}, with B_{i} = b_{i}(6(l_{1} − 1))^{e_{1}} ⋯ (6(l_{r} − 1))^{e_{r}}

where we view B_{i} as an integer. Note that B_{i} does not depend on N, that B_{i} does not depend on the choice of log: F_{N}^{∗} → Z/(N−1)Z and that not all B_{i} are zero. Let F be the homogenous polynomial of degree m, with coefficients in Z, in the variables X_{l}, l ≤ d prime, whose monomials are the B_{i}X_{l_{1}}^{e_{1}} ⋯ X_{l_{r}}^{e_{r}}, with v(i) = m and 1 ≤ i ≤ d. Then the relation 0 = ϕ_{m}(x) = ∑_{i} b_{i}ϕ_{m}(η_{i}) can be rewritten as F (log 2, log 3, …) = 0 in Z/(N−1)Z. The set of primes N with the property that F (log 2, log 3, …) = 0 in Z/(N−1)Z is called the fugitive set associated to F (note that this does not depend on the choice of the logarithms on the F_{N}^{∗}). We conclude that the set of primes N such that T′_{1}, …, T′_{d} are linearly dependent, is contained in a finite union of such fugitive sets. H.W. Lenstra has given an elementary argument, using Cebotarev’s theorem, that fugitive sets have density zero. In an appendix to [9], A. Granville improves this result as follows: for x ∈ R sufficiently large, the number of primes N ≤ x in a fixed fugitive set is bounded by a constant times (x/ log(x))(log log log(x))/(log log(x)). K. Murty has shown that under the generalized Riemann hypothesis, Granville’s bound can be improved to O((x/ log(x)) log log(x)/ log(x)). One expects that the actual size of a fugitive set is O(log log(x)).

6. AN APPLICATION OF A THEOREM OF FALTINGS

In this section we prove that S(d) is finite if and only if Φ(d) is finite. We begin by recalling a result of Frey [6].

6.1. Proposition (Frey). Let K be a number field, d ≥ 0 an integer and C a smooth projective geometrically irreducible curve over K with C(K) non-empty. Suppose that every non-constant morphism from C to P_{K}^{1} has degree > 2d. Then C^{(d)}(K) is finite.

Proof. Consider the morphism C^{(d)} → Pic_{C}^{d} which sends an effective divisor D of degree d to the line bundle O_{C}(D) of degree d. This map induces an injection on K-rational points, since if D_{1} ≠ D_{2} are effective divisors of degree d on C such that D_{1} − D_{2} is a principal divisor (f), then f is a finite morphism of degree ≤ d to P_{K}^{1}. Let X be the image of C^{(d)} in Pic_{C}^{d}. It suffices to show that X(K) is finite. Suppose that X(K) is not finite. Then, by Faltings’s theorem [3, Thm. 4.2], there exists a non-zero abelian subvariety B of Pic_{C}^{0} with B(K) Zariski-dense in B, and a point P_{0} in X(K) such that P_{0} +B ⊂ X. For b in B(K), let P_{b} := b+P_{0} ∈ X(K); let D_{b} denote the effective divisor on C corresponding to P_{b} (here we use that C^{(d)}(K) → X(K) is a bijection). Then for all b ∈ B(K) the divisors D_{b} + D_{−b} and 2D_{0} are linearly equivalent. Note that the equality D_{b} + D_{−b} = 2D_{0} can happen only for finitely many b, so there exists a b and a non-constant rational function f on C such that D_{b} + D_{−b} − 2D_{0} = (f). But such a f is a morphism from C to P_{K}^{1} of degree at most 2d. □

6.2. Corollary (Frey, [6]). Let d ≥ 0 and e ≥ 0 be integers, let N be prime and suppose that N^{e} ≥ 120d. Then there are, up to isomorphism, only finitely many elliptic curves E over \overline{Q} which have a cyclic isogeny of degree N^{e} that can be defined over a number field K of degree at most d.

Proof. Let f: X_{0}(N^{e}) → P_{Q}^{1} be a finite morphism. Take l ∈ {2, 3}, l ≠ N. Since X_{0}(N^{e}) has good reduction at l, the line bundle f^{∗}O(1) has a unique extension to X_{0}(N^{e})_{Z_{l}} and induces a finite morphism f_{l}: X_{0}(N)_{F_{l}} → P_{F_{l}}^{1} of degree at most deg(f). An easy computation shows that X_{0}(N^{e})(F_{l^{2}}) ≥ (N+1)N^{e−1}/e_{l}, where e_{2} = 12 and e_{3} = 6 (consider the supersingular points). Hence

deg(f) ≥ deg(f_{l}) > N^{e}/(e_{l}(l^{2}+1) ≥ 120d/60 = 2d  □

6.3. Corollary ([9]). Let d ≥ 1. If S(d) is finite then Φ(d) is finite.

Proof. Instead of giving a proof using Cor. 6.2, we give a proof using a variant of that corollary for the curves X_{1}(N^{e}). An advantage of this is that the curves X_{1}(N^{e})_{Q} are fine moduli spaces for N^{e} > 4.

Let d ≥ 1 and suppose that S(d) is finite. Since S(d) is finite, it suffices to give, for each N in S(d), an integer r ≥ 0 such that no elliptic curve over a field of degree d has a rational point of order N^{r}. So let N be in S(d) and e ≥ 0. An elliptic curve E over a field K of degree d, together with a rational point P of order N^{e}, gives a K-valued point of the modular curve X_{1}(N^{e}), hence a Q-valued point of the symmetric product X_{1}(N^{e})^{(d)}. The curve X_{1}(N^{e}) is projective and smooth over Z[1/N], and has geometrically irreducible fibres. For any field k not of characteristic N, X_{1}(N^{e})_{k} has at least (N−1)N^{e−1}/2 rational points (coming from the cusps). It follows that any finite morphism from X_{1}(N^{e})_{Q} to P_{Q}^{1} has degree at least (N−1)N^{e−1}/8. Suppose that e > 1 + log_{N}(16d/(N−1)). Then, by Prop. 6.1, X_{1}(N^{e})^{(d)}(Q) is finite. Let x_{1}, …, x_{m} be the non-cuspidal closed points of the scheme X_{1}(N^{e})_{Q} that have non-zero multiplicity in at least one of the finitely many effective divisors on X_{1}(N^{e})_{Q} corresponding to the elements of X_{1}(N^{e})^{(d)}(Q). Let K_{i} be the residue field of X_{1}(N^{e}) at x_{i}; then K_{i} is a field of degree ≤ d. Note that N^{e} > 4, so X_{1}(N^{e})_{Q} is a fine moduli space. Hence over each K_{i} we have an elliptic curve E_{i} together with a point P_{i} in E_{i}(K_{i}) of order N^{e}. By construction, these (E_{i}/K_{i}, P_{i}) have the property that all (E/K, P) with E an elliptic curve over K, K of degree d and P ∈ E(K) of order N^{e}, can be obtained by extension of scalars from one of the (E_{i}/K_{i}, P_{i}). For each i, choose a residue field k_{i} of the ring of integers O_{i} of K_{i} such that k_{i} has characteristic different from N and E_{i} has good reduction at k_{i}. Now if (E/K, P) is obtained by extension of scalars from (E_{i}/K_{i}, P_{i}), then O_{K} has a residue field k which is an extension of degree at most d of k_{i} such that E has good reduction at k. Let Ẽ/k be the reduction. Then |Ẽ(k)| ≤ (|k_{i}|^{d/2} + 1)^{2}. Now take r ≥ e such that for all i one has N^{r} > (|k_{i}|^{d/2} + 1)^{2}. □

7. BEYOND KAMIENNY AND MAZUR

D. Abramovich [1] has remarked that the hypothesis in Prop. 4.1 that f_{d} is a formal immersion at d·∞ modulo a prime p > 2 can be weakened. In fact, all one needs is that f_{d}(x) ≠ 0 for all x in X_{0}(N)^{(d)}(Q) that specialize to d·∞ modulo p. Using this remark Abramovich has proved finiteness of S(d) for all d ≤ 14. For d equal to 13 and 14 his proof uses computer computations.

Very recently (February 11), L. Merel has announced a proof of the finiteness of S(d) for all d. His method is to replace the Eisenstein quotient J of J_{0}(N) by a bigger quotient J_{w}. This quotient, which he calls the winding quotient, is defined as follows. Integration over {it | t ∈ R_{>0}} ⊂ H defines a Clinear form on H^{0}(X_{0}(N)(C), Ω). It is known that this form corresponds to an element e in H_{1}(X_{0}(N)(C), Q). Let a ⊂ T be the annihilator of e, then J_{w,Q} = J_{0}(N)_{Q}/aJ_{0}(N)_{Q}. A result of Kolyvagin and Logachev [12], supplemented by work of Bump, Friedberg and Hoffstein [7], or by work of Murty and Murty [21], shows that J_{w}(Q) is finite. The condition for f_{d}: X_{0}(N)_{Q}^{(d)} → J_{w,Q} to be a formal immersion at d·∞ is that T_{1}e, …, T_{d}e are linearly independent in the free Z-module T·e ⊂ H_{1}(X_{0}(N)(C), Q). For N sufficiently large with respect to d (to be precise, N/(log N)^{4} should be greater than 400d^{4} and greater than d^{8}), Merel shows this linear independence using the theory of modular symbols.

The text that follows has been added at the time the final version of this text was written (August 1994). Shortly after this exposé, Oesterlé has improved Merel’s result: he shows that N ∈ S(d) implies N ≤ (3^{d/2} + 1)^{2}. His proof, which follows Merel’s proof, shows that for N prime such that N/(log N)^{4} > (2d)^{8}, the images in (T·e) ⊗ F_{3} of T_{1}e, …, T_{d}e are F_{3}-linearly independent, and from that he deduces that the map f_{d} of §4 (with the Eisenstein quotient replaced by the winding quotient) is a formal immersion at d·∞ modulo 3. The proof is then finished by Prop. 4.1 and some extra work for the primes N < 37.

Merel’s work will appear in [20].

REFERENCES

[1] D. Abramovich. Formal finiteness and the uniform boundedness conjecture, a footnote to a paper of Kamienny and Mazur. Preprint March 1993. To appear in an Astérisque volume.

[2] P. Deligne, M. Rapoport. Les schémas de modules des courbes elliptiques. In Modular Functions of One Variable II. Springer Lecture Notes in Mathematics 349 (1973).

[3] G. Faltings. The general case of S. Lang’s conjecture. To appear in “The Barsotti symposium in algebraic geometry”, W. Messing and V. Christante, eds. Acad. Press, Cambridge, Mass.

[4] G. Frey. Links between solutions of A − B = C and elliptic curves. Number theory, Ulm 1987. Lecture Notes in Mathematics 1380.

[5] G. Frey. A remark on isogenies of elliptic curves defined over quadratic fields. Compos. Math. 58, 133-134 (1986).

[6] G. Frey. Curves with infinitely many points of fixed degree. Preprint, Institut für Experimentelle Mathematik (1992).

[7] D. Bump, S. Friedberg and J. Hoffstein. Nonvanishing theorems for Lfunctions of modular forms and their derivatives. Invent. Math. 102, 543–618 (1990).

[8] S. Kamienny. Torsion points on elliptic curves and winding homomorphisms. MSRI preprint, December 1993.

[9] S. Kamienny, B. Mazur. Rational torsion of prime order in elliptic curves over number fields. To appear in an Astérisque volume.

[10] N.M. Katz, B. Mazur. Arithmetic moduli of elliptic curves. Annals of Mathematics Studies 108, Princeton University Press (1985).

[11] M. Kenku, F. Momose. Torsion points on elliptic curves defined over quadratic fields. Nagoya Mathematical Journal 109, 125–149 (1988).

[12] V.A. Kolyvagin, D. Logachev. Finiteness of the Shafarevich-Tate group and group of rational points for some modular abelian varieties. Leningrad Math. J. 1, 1229–1253 (1990).

[13] D. Kubert. Universal bounds on the torsion of elliptic curves. Proceedings London Math. Soc. (3) 33, 193–237 (1976).

[14] J. Lehner, M. Newman. Weierstrass points of Γ_{0}(N). Annals of Mathematics 79, No. 2, 360–368 (1963).

[15] B. Levi. Sull’equazione indeterminata del 3^{o} ordine. Atti del IV congresso internazionale dei matematici, Roma, 6–11 Aprile 1908, G. Castelnuovo editor.

[16] Y. Manin. A uniform bound for p-torsion in elliptic curves. Izv. Akad. Nauk. CCCP 33, 459–465 (1969).

[17] B. Mazur. Modular curves and the Eisenstein ideal. Publications Mathématiques de l’IHES 47, 33–186 (1977).

[18] B. Mazur. Rational isogenies of prime degree. Invent. Math. 44, 129–162 (1978).

[19] B. Mazur and J-P. Serre. Points rationnels des courbes modulaires X_{0}(N). Séminaire Bourbaki exp. 469 (1974–1975). Lecture Notes in Mathematics 514, 238–255 (1976).

[20] L. Merel. Bornes pour la torsion des courbes elliptiques sur les corps de nombres. To appear.

[21] M.R. Murty and V.K. Murty. Mean values of derivatives of modular L-series. Ann. Math. 133, 447–475 (1991).

[22] A. Ogg. Rational points of finite order on elliptic curves. Invent. Math. 12, 105–111 (1971).

[23] J-P. Serre. p-torsion des courbes elliptiques (d’après Y. Manin). Séminaire Bourbaki exp. 380 (1969–1970). Lecture Notes in Mathematics 180, 281–294 (1971).

[24] A. Silverberg. Points of finite order on abelian varieties. Contemporary Mathematics 133, 175–193 (1992).

Bas EDIXHOVEN

Institut Mathématique URA 305 du CNRS Campus de Beaulieu F-35042 Rennes cedex France