# Conjecture: The number of points modulo $p$ of certain elliptic curve is $p$ or $p+2$ for $p$ of form $p=27a^2+27a+7$

Numerical evidence suggests a conjecture that the number of points of certain elliptic curve over $\mathbb{F}_p$ is either $p$ or $p+2$ for $p$ of certain form.

Let $p$ be prime of the form $p=27a^2+27a+7$ and $(a/b)$ denote the Kronecker symbol.

For integer $k$ nonzero modulo $p$ define $E_k / \mathbb{F}_p : y^2=x^3+2k^3$.

$E_k$ is the quadratic twist of $y^2=x^3+2$.

Conjecture 1: $\#E(\mathbb{F}_p)=p+1 + (2k^3 / p)$.

In other words for $p$ of the given form $\#E(\mathbb{F}_p)$ is either $p$ or $p+2$.

Is Conjecture 1 true?

Example sage session with 200 bit $p$

sage: a=2^100+8;p=27*a^2+27*a+7;k=3;Kp=GF(p);E=EllipticCurve([Kp(0),Kp(2*k^3)])
sage: o=E.order();o2=p+1+kronecker(2*k^3,p);o==o2
True

• We have $(2k^3/p) = (2k/p)$. Does $(2k^3/p)$ suggest a generalization? Oct 18, 2017 at 11:39
• @MaxAlekseyev probably this can be generalized by not using $2k^3$ but something else.
– joro
Oct 18, 2017 at 12:16
• The quadratic twist by $k$ multiplies $a_p$ by $(k/p)$ so you may assume $k=1$ in your conjecture. Oct 18, 2017 at 13:13
• The curve has CM by $\mathbb{Z}[\sqrt[3]{1}]$, thus corresponds to some character. This conjecture, if true, can probably be proved easily. But I'm too lazy to work out the details... Oct 18, 2017 at 14:37
• @joro Sure, but for proving the conjecture you don't need $k$. I agree with WhatsUp. Here more hints of how to solve it (for $k=1$). Theorem 4 in Chapter 18 of Ireland-Rosen tells you what $a_p$ is when $p\equiv 1\pmod{3}$ in terms of sixth residue symbols. But since $4D=8$ is a cube this reduces to $(2/p)$. Then you need to factor $p$. I think $\pi = (9a+4-\omega)/(\omega-1)$ is a prime factor in $\mathbb{Z}[\omega]$ with $\pi\equiv 2\pmod{3}$. Here $\omega^2+\omega+1=0$. Hopefully that helps proving the conjecture. Oct 18, 2017 at 15:43

The conjecture is true. To prove it, we can restrict to $k=1$ as explained in the comments. Let $\chi$ denote a cubic Dirichlet character modulo $p$; this exists as $p\equiv 1\pmod{3}$, and it is unique up to complex conjugation. Let $\psi$ denote the (unique) quadratic Dirichlet character modulo $p$.

The number of points of the affine elliptic curve $E$ modulo $p$ equals $$\sum_{y\bmod p}\left(1+\chi(y^2-2)+\overline{\chi}(y^2-2)\right)=p+\sum_{y\bmod p}\chi(y^2-2)+\overline{\sum_{y\bmod p}\chi(y^2-2)}.$$ The $y$-sum on the right hand side equals $$\sum_{y\bmod p}\chi(y^2-2)=\sum_{z\bmod p}\chi(z-2)\bigl(1+\psi(z)\bigr)=\sum_{z\bmod p}\chi(z-2)\psi(z).$$ Here $\chi(z-2)=\chi(2-z)$, because $\chi(-1)=\chi((-1)^3)=\chi^3(-1)=1$. Therefore, $$\sum_{y\bmod p}\chi(y^2-2)=\sum_{z\bmod p}\chi(2-z)\psi(z)=\chi(2)\psi(2)J(\chi,\psi),$$ where $J(\chi,\psi)$ is the corresponding Jacobi sum.

To evaluate the Jacobi sum $J(\chi,\psi)$, we rely on Chapter 6 of Rose: A course in number theory (2nd ed., Oxford University Press, 1994). By (the last part of) Exercise 10 at the end of this chapter, $$J(\chi,\psi)=\chi(4)J(\chi,\chi).$$ Now we observe that $4p=1+27(2a+1)^2$, and this is the only way to write $4p$ as $u^2+27v^2$ with $u\equiv 1\pmod{3}$ and $v$ positive, cf. Theorem 2.5 and the subsequent comments. Therefore, by Lemma 2.6, $$J(\chi,\chi)=(3a+2)+(6a+3)e^{\pm 2\pi i/3}=\frac{1\pm(6a+3)i\sqrt{3}}{2},$$ the choice of the $\pm$ sign depending on which cubic character we denoted by $\chi$.

Putting everything together, $$\sum_{y\bmod p}\chi(y^2-2)=\chi(2)\psi(2)J(\chi,\psi)=\chi(8)\psi(2)\frac{1\pm(6a+3)i\sqrt{3}}{2}.$$ Here, $\chi(8)=\chi(2^3)=\chi^3(2)=1$, and so $$\sum_{y\bmod p}\chi(y^2-2)+\overline{\sum_{y\bmod p}\chi(y^2-2)}=\psi(2)\sum_{\pm}\frac{1\pm(6a+3)i\sqrt{3}}{2}=\psi(2).$$

To summarize, the number of points of the affine elliptic curve $E$ modulo $p$ equals $p+\psi(2)$.

• Generalization of this: mathoverflow.net/questions/283853/…
– joro
Oct 19, 2017 at 11:14
• Up to p=10^5 the only primes for which the order is p or p+2 are primes of this form. Did you prove this too?
– joro
Oct 19, 2017 at 12:15
• @joro: No, I did not prove anything in the converse direction. You should formulate that as a separate question. Oct 19, 2017 at 12:23
• Have you seen similar elementary constructions of known order?
– joro
Oct 19, 2017 at 12:50