Splitting of small primes in number fields generated by the torsion of elliptic curves Suppose $E/\mathbb Q$ is a non CM elliptic curve and we look at the number field $K_d$ generated by the $d$-torsion of $E$. What is known about the (complete) splitting of small primes in $K_d$?
More precisely, since $|E(\mathbb F_p)| \sim p+1$, if $p$ were a completely split prime, we would need $d^2 < p+1$ (approximately). What can say about primes in, say, the range $d^2 < p < d^4$? What proportion of them split completely (with asymptotic dependence on $d$)?
(I would also be interested in the analogous question for $\mathbb G_m$.)
 A: Let's discuss the $\mathbb G_m$ question first. For $p$ to split completely in the field generated by the $d$-torsion of $\mathbb G_m$, i.e. the field generated by the $d$th roots of unity, a necessary and sufficient condition is that $\mathbb F_p$ contains the $d$th roots of unity, i.e. $p \equiv 1\mod d$. This requires $p>d$ so I guess the analogous question would be to count primes congruent to $1$ mod $d$ between $d$ and $d^2$.
The usual heuristics suggest that this number should be roughly $d^2 / (2\phi(d) \log d)$. But a provable asymptotic is way too much to hope for. We don't even know a lower bound that this is nonzero - one would have to enlarge the range to $d < p < O(d^5)$ and apply Xylouris's strengthening of Linnik's theorem. Even under GRH the $d^2$ case is unknown.
Probably one can get upper bounds that are reasonably close to the truth using sieve methods.
For elliptic curves, the situation is similar, but more complicated. Some necessary conditions are that $p \equiv 1 \mod d$, since from two independent $d$-torsion points we can generate a $d$th root of unity by the Weil pairing, and $a_p \equiv p+1\mod d^2$, writing $E(\mathbb F_p) = p+1-a_p$.
Are the sufficient? The right perspective is to think of Frobenius as a $2 \times 2$ matrix acting on the torsion points, $p$ as the determinant, and $a_p$ as the trace. Knowing the determinant $p$ is congruent to $1$ mod $d$ and the trace $a_p$ is congruent to $1+p$ mod $d^2$ does not suffice to guarantee that the matrix is congruent to the identity mod $d$ as the counterexample $\begin{pmatrix} 1 & 1 \\ 0 & p \end{pmatrix} $ shows.
However, they do imply that the elliptic curve is congruent to an elliptic curve with full $d$-torsion, as any counterexample must be more-or-less congruent to that one modulo $d^2$.
Because these conditions aren't quite sufficient, I don't know a criterion simpler then the claim that the Frobenius conjugacy class in $GL_2(\mathbb Z/d)$ is equal to the identity matrix.
We expect this to hold for a proportion of primes equal to $1$ divided by the image of the Galois group in $GL_2(\mathbb Z/d)$. For a non-CM elliptic curve, this will typically be almost as large as $|GL_2(\mathbb Z/d)|\approx d^4$, and so we expect no or very few such primes $<d^4$. So lower bounds are hopeless, but perhaps some upper bounds exist, although they will surely be much harder than the case where all you have is a congruence condition.
For a CM elliptic curve, the situation is better, and you can express it using CM theory as a congruence condition on the primes lying over $p$ in the CM field, so the problem will only be as hard as an imaginary quadratic variant of the previous case (i.e., too hard to give an asymptotic.)
