Numerical evidence suggests a conjecture that the number of points of certain elliptic curve over $\mathbb{F}_p$ is either $p$ or $p+2$ for $p$ of certain form.

Let $p$ be prime of the form $p=27a^2+27a+7$ and $(a/b)$ denote the Kronecker symbol.

For integer $k$ nonzero modulo $p$ define $E_k / \mathbb{F}_p : y^2=x^3+2k^3$.

$E_k$ is the quadratic twist of $y^2=x^3+2$.

Conjecture 1: $\#E(\mathbb{F}_p)=p+1 + (2k^3 / p)$.

In other words for $p$ of the given form $\#E(\mathbb{F}_p)$ is either $p$ or $p+2$.

Is Conjecture 1 true?

Example sage session with 200 bit $p$

sage: a=2^100+8;p=27*a^2+27*a+7;k=3;Kp=GF(p);E=EllipticCurve([Kp(0),Kp(2*k^3)])
sage: o=E.order();o2=p+1+kronecker(2*k^3,p);o==o2
  • $\begingroup$ We have $(2k^3/p) = (2k/p)$. Does $(2k^3/p)$ suggest a generalization? $\endgroup$ Oct 18, 2017 at 11:39
  • $\begingroup$ @MaxAlekseyev probably this can be generalized by not using $2k^3$ but something else. $\endgroup$
    – joro
    Oct 18, 2017 at 12:16
  • $\begingroup$ The quadratic twist by $k$ multiplies $a_p$ by $(k/p)$ so you may assume $k=1$ in your conjecture. $\endgroup$ Oct 18, 2017 at 13:13
  • 1
    $\begingroup$ The curve has CM by $\mathbb{Z}[\sqrt[3]{1}]$, thus corresponds to some character. This conjecture, if true, can probably be proved easily. But I'm too lazy to work out the details... $\endgroup$
    – WhatsUp
    Oct 18, 2017 at 14:37
  • 2
    $\begingroup$ @joro Sure, but for proving the conjecture you don't need $k$. I agree with WhatsUp. Here more hints of how to solve it (for $k=1$). Theorem 4 in Chapter 18 of Ireland-Rosen tells you what $a_p$ is when $p\equiv 1\pmod{3}$ in terms of sixth residue symbols. But since $4D=8$ is a cube this reduces to $(2/p)$. Then you need to factor $p$. I think $\pi = (9a+4-\omega)/(\omega-1)$ is a prime factor in $\mathbb{Z}[\omega]$ with $\pi\equiv 2\pmod{3}$. Here $\omega^2+\omega+1=0$. Hopefully that helps proving the conjecture. $\endgroup$ Oct 18, 2017 at 15:43

1 Answer 1


The conjecture is true. To prove it, we can restrict to $k=1$ as explained in the comments. Let $\chi$ denote a cubic Dirichlet character modulo $p$; this exists as $p\equiv 1\pmod{3}$, and it is unique up to complex conjugation. Let $\psi$ denote the (unique) quadratic Dirichlet character modulo $p$.

The number of points of the affine elliptic curve $E$ modulo $p$ equals $$\sum_{y\bmod p}\left(1+\chi(y^2-2)+\overline{\chi}(y^2-2)\right)=p+\sum_{y\bmod p}\chi(y^2-2)+\overline{\sum_{y\bmod p}\chi(y^2-2)}.$$ The $y$-sum on the right hand side equals $$\sum_{y\bmod p}\chi(y^2-2)=\sum_{z\bmod p}\chi(z-2)\bigl(1+\psi(z)\bigr)=\sum_{z\bmod p}\chi(z-2)\psi(z).$$ Here $\chi(z-2)=\chi(2-z)$, because $\chi(-1)=\chi((-1)^3)=\chi^3(-1)=1$. Therefore, $$\sum_{y\bmod p}\chi(y^2-2)=\sum_{z\bmod p}\chi(2-z)\psi(z)=\chi(2)\psi(2)J(\chi,\psi),$$ where $J(\chi,\psi)$ is the corresponding Jacobi sum.

To evaluate the Jacobi sum $J(\chi,\psi)$, we rely on Chapter 6 of Rose: A course in number theory (2nd ed., Oxford University Press, 1994). By (the last part of) Exercise 10 at the end of this chapter, $$J(\chi,\psi)=\chi(4)J(\chi,\chi).$$ Now we observe that $4p=1+27(2a+1)^2$, and this is the only way to write $4p$ as $u^2+27v^2$ with $u\equiv 1\pmod{3}$ and $v$ positive, cf. Theorem 2.5 and the subsequent comments. Therefore, by Lemma 2.6, $$J(\chi,\chi)=(3a+2)+(6a+3)e^{\pm 2\pi i/3}=\frac{1\pm(6a+3)i\sqrt{3}}{2},$$ the choice of the $\pm$ sign depending on which cubic character we denoted by $\chi$.

Putting everything together, $$\sum_{y\bmod p}\chi(y^2-2)=\chi(2)\psi(2)J(\chi,\psi)=\chi(8)\psi(2)\frac{1\pm(6a+3)i\sqrt{3}}{2}.$$ Here, $\chi(8)=\chi(2^3)=\chi^3(2)=1$, and so $$\sum_{y\bmod p}\chi(y^2-2)+\overline{\sum_{y\bmod p}\chi(y^2-2)}=\psi(2)\sum_{\pm}\frac{1\pm(6a+3)i\sqrt{3}}{2}=\psi(2).$$

To summarize, the number of points of the affine elliptic curve $E$ modulo $p$ equals $p+\psi(2)$.

  • $\begingroup$ Generalization of this: mathoverflow.net/questions/283853/… $\endgroup$
    – joro
    Oct 19, 2017 at 11:14
  • $\begingroup$ Up to p=10^5 the only primes for which the order is p or p+2 are primes of this form. Did you prove this too? $\endgroup$
    – joro
    Oct 19, 2017 at 12:15
  • $\begingroup$ @joro: No, I did not prove anything in the converse direction. You should formulate that as a separate question. $\endgroup$
    – GH from MO
    Oct 19, 2017 at 12:23
  • $\begingroup$ Have you seen similar elementary constructions of known order? $\endgroup$
    – joro
    Oct 19, 2017 at 12:50
  • $\begingroup$ Asked new question about the other direction. $\endgroup$
    – joro
    Oct 19, 2017 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.