ELLIPTIC CURVES WITH A GIVEN NUMBER OF POINTS OVER ...

ELLIPTIC CURVES WITH A GIVEN NUMBER OF POINTS OVERFINITE FIELDSCHANTAL DAVID AND ETHAN SMITHAbstract. Given an elliptic curve E and a positive integer N, we consider the problem ofcounting the number of primes p for which the reduction of E modulo p possesses exactlyN points over F p . On average (over a family of elliptic curves), we show bounds thatare significantly better than what is trivially obtained by the Hasse bound. Under someadditional hypotheses, including a conjecture concerning the short interval distribution ofprimes in arithmetic progressions, we obtain an asymptotic formula for the average.1. IntroductionLet E be an elliptic curve defined over the rational field Q. For a prime p where E hasgood reduction, we let E p denote the reduced curve modulo p and #E p (F p ) the numberof F p -rational points. Then the trace of the Frobenius morphism at p, a p (E), satisfies thewell-known identity #E p (F p ) = p + 1 − a p (E) and the Hasse bound |a p (E)| < 2 √ p.Let N be a positive integer. We are interested in the number of primes for which#E p (F p ) = N. In particular, we are interested in the behavior of the prime countingfunctionM E (N) := #{p : #E p (F p ) = N}.Note that if #E p (F p ) = N, then the Hasse bound implies ( √ p − 1) 2 < N < ( √ p + 1) 2 , whichin turn implies thatN − := ( √ N − 1) 2 < p < ( √ N + 1) 2 =: N + .Hence, M E (N) is a finite number, and we have the trivial bound√NM E (N) ≪log(N + 1) . (1)In [Kow06], Kowalski shows that if E possesses complex multiplication (CM), thenM E (N) ≪ E,ε N ε (2)for any ε > 0. He asks if the same might be true for curves without CM. However, no boundbetween (1) and (2) is known for curves without CM.Given an integer N, it is always possible through a Chinese Remainder Theorem argumentto find an elliptic curve E that achieves the upper bound (1), i.e., such that #E p (F p ) = Nfor every prime p in the interval (N − , N + ). Yet, for a fixed curve, one expects M E (N) toKey words and phrases. Average order, Elliptic curves over finite fields, Barban-Davenport-HalberstamTheorem, Cohen-Lenstra Heuristics.1

e quite small. Consider the following naïve probabilistic model for M E (N). If we supposethat the values of #E(F p ) are uniformly distributed, i.e., that{14Prob (#E(F p ) = N) =√ if N − < p < N + ,p(3)0 otherwise,then we expect thatM E (N) ≈ ∑ pProb (#E(F p ) = N) =≈ 1 ∫ N +4 √ N N −∑N −

N lying in an interval of length 4 √ N. Therefore, we require an appropriate short intervalversion of the Barban-Davenport-Halberstam Theorem.Given real parameters X, Y > 0 and integers q and a, we let θ(X, Y ; q, a) denote theweighted prime counting function∑θ(X, Y ; q, a) := log p,X 0 be arbitrary. Suppose that X η ≤ Y ≤ X, and that Y/(log X) β ≤ Q ≤ Y. Then∑ q∑|E(X, Y ; q, a)| 2 ≪ Y Q log X.q≤Q a=1(a,q)=1Remark. If η = 1, this is essentially the classical Barban-Davenport-Halberstam Theorem.See for example [Dav80, p. 196]. The best results known are due to Languasco, Perelli, andZaccagnini [LPZ10] who show that for any ɛ > 0, Conjecture 2 holds unconditionally forη = 7/12 + ɛ and for η = 1/2 + ɛ under the Generalized Riemann Hypothesis. For ourapplication, we essentially need η = 1/2 − ɛ.Theorem 3. Let γ > 0, and assume that Conjecture 2 holds with η = 1 log log N−(γ+2) . Supposefurther that A, B ≥ √ N(log N) 1+γ log log N and that AB ≥ N 3/2 (log N) 2+γ log log N.2 log NThen for any odd integer N, we have1 ∑( )NM E (N) = K(N)#C (A, B)ϕ(N) log N + O 1,(log N) 1+γwhereK(N) := ∏ l∤N(1 −E∈C (A,B)( N−1) 2)l l + 1 ∏(1 −(l − 1) 2 (l + 1)l|N2∤ν l (N)) (1 ∏l ν l(N)(l − 1)l|N2|ν l (N)1 − l − ( −N ll)l ν l(N)+1(l − 1)ν l denotes the usual l-adic valuation, and N l := N/l ν l(N) denotes the l-free part of N.Remark. We note that K(N) is uniformly bounded as a function of N. We also note thatN/ϕ(N) ≪ log log N (see [HW79, Theorem 328] for example), which gives the upper boundof Theorem 1.The average of Theorem 3 displays some interesting characteristics that are not presentin the average order (5). In particular, the main term of the average in Theorem 3 doesnot depend solely on the size of the integer N but also on some arithmetic properties ofN as it involves the factor K(N)N/ϕ(N). The occurrence of the weight ϕ(N) appearingin the denominator seems to suggest that this is another example of the Cohen-LenstraHeuristics [CL84a, CL84b], which predict that random groups G occur with probability3),

weighted by 1/#Aut(G). Notice that if as an additive group #E(F p ) ≃ Z/NZ, then#Aut(E(F p )) = ϕ(N). Indeed, the Cohen-Lenstra Heuristics predict that relative to othergroups of same size, the cyclic groups are the most likely to occur.In some work in progress, the authors are exploring this further, considering the averageofM E (G) := # {p : E(F p ) ≃ G}for those Abelian groups G which may occur as the group of F p -rational points of an ellipticcurve. In a preliminary computation, the authors have compared the averages forM E (Z/NZ × Z/NZ) and M E (Z/N 2 Z) when N is prime. In this case, we note that#Aut(Z/NZ × Z/NZ) = N(N − 1) 2 (N + 1) and #Aut(Z/N 2 Z) = N(N − 1);so we would expect the cyclic group to occur roughly N 2 times more frequently. Indeed thisseems to be case.We can express the results of Theorem 3 as stating that for a “random curve” E/Q anda “random prime” p ∈ (N − , N + ),Prob (#E(F p ) = N) ≈ K(N)Nϕ(N) log(N)4 √ Nlog N= K(N)Nϕ(N)14 √ Nrefining the naïve model given by (3). Here, as in (3), we make the assumption that thereare about 4 √ N/ log N primes in the interval (N − , N + ) though we can not justify such anassumption even under the Riemann Hypothesis.There are many open conjectures about the distributions of invariants associated with thereductions of a fixed elliptic curve over the finite fields F p such as the famous conjectures ofKoblitz [Kob88] and of Lang and Trotter [LT76]. The Koblitz Conjecture concerns the numberof primes p ≤ X such that #E(F p ) is prime. The fixed trace Lang-Trotter Conjectureconcerns the number of primes p ≤ X such that the trace of Frobenius a p (E) is equal to afixed integer t. Another conjecture of Lang and Trotter (also called the Lang-Trotter Conjecture)concerns the number of primes p ≤ X such that the Frobenius field Q( √ a p (E) 2 − 4p)is a fixed imaginary quadratic field K.These conjectures are all completely open. To gain evidence, it is natural to consider theaverages for these conjectures over some family of elliptic curves. This has been done byvarious authors originating with the work of Fouvry and Murty [FM96] for the number ofsupersingular primes (i.e., the fixed trace Lang-Trotter Conjecture for t = 0). See [DP99,DP04, Jam04, BBIJ05, JS11, CFJ + ] for other averages regarding the fixed trace Lang-TrotterConjecture. The average order for the Koblitz Conjecture was considered in [BCD]. Veryrecently, the average has been successfully carried out for the Lang-Trotter Conjecture onFrobenius fields [CIJ]. The average order that we consider in this paper displays a verydifferent character than the above averages. This is primarily because the size of primesconsidered varies with the parameter N. Moreover, they all must lie in a very short interval.This necessitates the use of a short interval version of the Barban-Davenport-HalberstamTheorem (see Conjecture 2). This is also the first time that one observes a Cohen-Lenstraphenomenon governing the distribution of the average.4

3. AcknowledgementThe authors would like to thank K. Soundararajan for pointing out how to improve theaverage upper bound of Theorem 1 by using short Euler products holding for almost allcharacters. They also thank Henri Cohen, Andrew Granville and Dimitris Koukoulopoulosfor useful discussions related to this work and Andrea Smith for a careful reading of themanuscript.4. Reduction to an average of class numbersGiven a (not necessarily fundamental) discriminant D < 0, we follow Lenstra [Len87] indefining the Kronecker class number of discriminant D by∑H(D) :=w(D/f 2 ) , (6)h(D/f 2 )f 2 |DDf 2 ≡0,1 (mod 4)where h(d) denotes the (ordinary) class number of the unique imaginary quadratic order ofdiscriminant d < 0 and w(d) denotes the cardinality of its unit group.Theorem 4 (Deuring). Let p > 3 be a prime and t an integer such that t 2 − 4p < 0. Then∑ 1#Aut(E) = H(t2 − 4p),Ẽ/F pa p(E)=twhere the sum is over the F p -isomorphism classes of elliptic curves.Proof. See [Len87, p. 654].The first step in computing the average order of M E (N) over C (A, B) is to reduce toan average of class numbers by using Deuring’s Theorem. The following estimate will thenbe crucial to obtain the upper bound of Theorem 1, and is also used in getting an optimalaverage length in Theorem 3.Proposition 5. For primes p in the range N − < p < N + , we define the quadratic polynomialThenD N (p) := (p + 1 − N) 2 − 4p = p 2 − 2(N + 1)p + (N − 1) 2 . (7)∑N −

where D N (p) is defined by (7).Proof of Proposition 5. The definition of the Kronecker class number (6) and the class numberformula [IK04, p. 515]give us the identity∑N −

which is valid for all Dirichlet characters of conductor q (see [Dav80, p. 96] for example).We note that#{N − < p < N + : χ d ∗N (p) ∈ E (4N)} ≤ #E (4N)τ(4N),where τ(n) denotes the number of positive divisors of n. Therefore, we obtain the bound∑ ∑ L(1, χ dN,f (p))∑ ∑ 1≪ log NffN −

where{1E(N; A, B) ≪N + log N ( 1√ 2 N A + 1 ) √ }N(log N)2 ∑+H(D N (p)).B ABN −

For N − < p < N + , we have |d N,f (p)| ≤ 4N/f 2 , and hence∑f≤2 √ X+Y(f,2)=11f∑XU1n(dN,f (p)n)≪ Y N 7/32√U.Now let V be a real parameter to be determined. Using Lemma 12, we obtain∑V

If p satisfies the congruence D N (p) ≡ af 2 (mod 4nf 2 ) and p divides 4nf 2 , then p divides(4nf 2 , (N − 1) 2 − af 2 ). It follows that such a p must divide n(N − 1). Hence, the error term∑ 1 ∑ ( a ∑fnn)and∑f≤2 √ X+Y(f,2)=1f≤V,n≤U(f,2)=11f∑X

Thus, we have∑ 1 ∑ff≤2 √ X+Y(f,2)=1X 0, we haveK 0 (N) =∑ 1 ∑fnϕ(4nf 2 )f≤V,n≤U(f,2)=1+ Oa∈Z/4nZa≡1 (mod 4)f≤V,n≤U(f,2)=1( Y N7/32√U1fnϕ(4nf 2 )+∑a∈Z/4nZa≡1 (mod 4)Y log U log N√V( √ )Y V log U log N+ O.(log N) 3γ+5( ( a Nɛ#C N (a, n, f) + O √ +n)U( an)#C N (a, n, f))+ U log(UN) log V)log log N.VWe delay the proof of Lemma 8 until Section 8. Applying the lemma and choosingwe have∑f≤2 √ X+Y(f,2)=11fU =∑X

Lemma 10. Suppose that N and f are odd and that a ≡ 1 (mod 4). Let l be any odd primedividing nf, and let e = ν l (4nf 2 ) = ν l (nf 2 ). If l ∤ 4N + af 2 , then{ (#C (l)N (a, n, f) = 1 +)4N+af 2lif l ∤ (N − 1) 2 − af 2 ,1 if l | (N − 1) 2 − af 2 .If l | 4N + af 2 , then with s = ν l (4N + af 2 ), we have#C (l)⎧⎪ ⎨ 2 ( )N+1 2ls/2if 1 ≤ s < e, 2 | s, andlN (a, n, f) = ( N+1) 2l l⌊e/2⌋if s ≥ e,⎪ ⎩ 0 otherwise.((4N+af 2 )/l sl)= 1,In particular, if l | f, then#C (l)(N(N−1) 2)1 +if l ∤ N,⎧⎪l⎨N (1, 1, f) = 2l ν l(N)/2if 1 ≤ ν l (N) < 2ν l (f), 2 | ν l (N), and ( )N ll = 1,l⎪ ν l(f)if 2ν l (f) ≤ ν l (N),⎩0 otherwise,where N l = N/l ν l(N) is the l-free part of N. Furthermore,#C (2)N (a, n, f) = ⎧⎪⎨⎪ ⎩2 if ν 2 (4nf 2 ) = 2 + ν 2 (n) = 2,4 if ν 2 (4nf 2 ) = 2 + ν 2 (n) ≥ 3 and a ≡ 5 (mod 8),0 otherwise.By Lemma 10, we may write#C (2)N (a, n, f) = 2S 2(n, a),where⎧⎪⎨ 1 if 2 ∤ n,S 2 (n, a) := 2 if 2 | n and a ≡ 5 (mod 8),⎪⎩0 otherwise.(21)Note that if l is a prime dividing f and not dividing n, then af 2 ≡ 0 (mod l ν l(4nf 2) ) asν l (4nf 2 ) = ν l (f 2 ). Hence, in this case, #C (l)N(a, n, f) does not depend on the value of a, andso we write #C (l)N(a, n, f) = #C(l)N (1, 1, f) if l | f and l ∤ n. Therefore, letting n′ denote theodd part of n and∑ ( ac N,f (n) :=S 2 (n, a)n) ∏ #C (l)N(a, n, f),l|n ′a∈(Z/4nZ) ∗a≡1 (mod 4)13

we may write∞∑K 0 (N) ===f=1(f,2)=1∞∑f=1(f,2)=1∞∑f=1′1f∞∑n=11f 2 ϕ(f)1nϕ(4nf 2 )∞∑n=1∏l|f #C(l) N(1, 1, f)f 2 ϕ(f)∑a∈Z/4nZa≡1 (mod 4)2ϕ((n, f))(n, f)nϕ(4n)∞∑n=1⎡( an)#C N (a, n, f)⎢∏⎣l|fl∤n#C (l)2ϕ((n, f))(n, f)nϕ(4n)⎤N (1, 1, f) ⎥⎦ c N,f(n)⎡⎣ ∏l|(f,n)⎤−1#C (l)N (1, 1, f) ⎦ c N,f (n),where the prime on the outer sum indicates that the sum is to be restricted to those f whichare odd and are not divisible by any prime for which #C (l)N(1, 1, f) = 0.In order to proceed further, we must show how to compute the function c N,f (n). Wesummarize the computation in the following lemma whose proof we also delay until Section 8.Lemma 11. Suppose that N and f are odd. The function c N,f (n) is multiplicative in n. Letα be a positive integer and l an odd prime. ThenIf l | f and l ∤ N, thenIf l | N and l ∤ f, thenIf l ∤ Nf, thenc N,f (l α )l α−1c N,f (2 α )2 α−1 = (−1) α 2.{= #C (l)N (1, 1, f) l − 1 if 2 | α,0 if 2 ∤ α.c N,f (l α )l α−1 = l − 2.⎧c N,f (l α )⎨l − 2 − ( ) ( ) 2 (Nl −N 2 −1l + N+1) 2if 2 | α,l=l α−1 ⎩−1 − ( ) ( ) 2 ( )−Nl −N 2 −1l + −N(N+1) 2if 2 ∤ αl{l − 1 − ( ) (N=l − N−1) 2if 2 | α,l−1 − ( )N−1 2if 2 ∤ α.lIf l | (f, N) and 2ν l (f) < ν l (N), thenc N,f (l α )l α−1If l | (f, N) and ν l (N) < 2ν l (f), thenc N,f (l α )l α−1= #C (l)N(1, 1, f)(l − 1).{= #C (l)N (1, 1, f) l − 1 if 2 | α,0 if 2 ∤ α.14(22)

If l | (f, N) and ν l (N) = 2ν l (f), thenc N,f (l α )l α−1{( (= #C (l) l − 1 −Nl) (N (1, 1, f) l + −Nl))) ) l− 1(( −Nllif 2 | α,if 2 ∤ α,where N l = N/l νl(N) denotes the l-free part of N. Furthermore, for any n, we have theboundc N,f (n) ≪ n ∏ l|(f,n) #C N(1, 1, f),κ 2N (n)where for any integer m, κ m (n) is the multiplicative function defined on prime powers by{κ m (l α l if 2 ∤ α and l ∤ m,) :=(23)1 otherwise.Recalling the restrictions on f in (22) and applying Lemma 11, the sum over n in (22)may be factored as⎡⎤∞∑ 2ϕ((n, f))⎣ ∏−1#C (l)N(n, f)nϕ(4n)(1, 1, f) ⎦ c N,f (n)n=1l|(f,n){ } { } {∑ 2c N,f (2 α ) ∏ ∑ c N,f (l α ) ∏=1 + ∑ }ϕ((l α , f))c N,f (l α )2 α ϕ(2 α+2 )l α ϕ(l α )α≥0l∤f α≥0l|f α≥1 (l α , f)l α ϕ(l α )#C (l)N (1, 1, f)l≠2= 2 3∏l∤fl|NF 0 (l) ∏ l∤fl∤Nl≠2F 1 (l) ∏ l|fF 2 (l, f),where for any odd prime l, we make the definitions(F 0 (l) := 1 + l − 2 ),(l − 1)(2 ( N−1) 2 (l l + N) (l + N−1) 2)l + 1F 1 (l) := 1 −,(l − 1)(l 2 − 1)⎧()1 +⎪⎨1if νl(l+1)l (N) < 2ν l (f),( )F 2 (l, f) := 1 +1if νll (N) > 2ν l (f),( “ ” ”−Nl −Nl Nl)l+“−“ll⎪⎩ 1 +l”−1if ν l (N) = 2ν l (f).l(l 2 −1)Substituting this back into equation (22), we haveK 0 (N) = 2 3∏l|NF 0 (l) ∏ l∤Nl≠2F 1 (l)∞∑f=1(f,2)=1′∏l|f #C(l) N(1, 1, f) ∏ F 2 (l, f)ϕ(f)f 2 F 0 (l)l|fl|N15∏l|fl∤NF 2 (l, f)F 1 (l) . (24)

The sum over f may be factored as∞∑f=1(f,2)=1′= ∏ l|N∏l|f #C(l) N(1, 1, f) ∏ϕ(f)f 2l|f{1 + ∑ α≥1#C (l)l|NF 2 (l, f)F 0 (l)∏l|fl∤NF 2 (l, f)F 1 (l)}N (1, 1, lα )F 2 (l, l α ) ∏ϕ(l α )l 2α F 0 (l)l∤Nl≠2{1 + ∑ α≥1#C (l)}N (1, 1, lα )F 2 (l, l α ).ϕ(l α )l 2α F 1 (l)When l ∤ 2N, the factor simplifies as1 + ∑ α≥1#C (l)N (1, 1, lα )F 2 (l, l α )ϕ(l α )l 2α F 1 (l)= 1 + lC(l) N (1, 1, l)F 2(l, l)F 1 (l)(l − 1)(1 +(N(N−1) 2l∑α≥11l 3α))(l 2 + l + 1)= 1 +(l 2 − 1)(l 3 − 1)F 1 (l)( )1 + N(N−1) 2l= 1 +(l 2 − 1)(l − 1)F 1 (l) .When ν l (N) is odd, the factor simplifies as1 + ∑ α≥1#C (l)N (1, 1, lα )F 2 (l, l α )ϕ(l α )l 2α F 0 (l)l ∑ #C (l)N= 1 +(1, 1, lα )F 2 (l, l α )F 0 (l)(l − 1)l 3αα≥1⌊ν l (N)/2⌋l ∑ l ( )α 1 + 1 l= 1 +F 0 (l)(l − 1)l 3αα=1= 1 + (l + 1)(1 − l1−νl(N) )F 0 (l)(l − 1)(l 2 − 1)= 1 + 1 − l1−ν l(N)F 0 (l)(l − 1) 2= 1 +l ν l(N) − lF 0 (l)l ν l(N)(l − 1) 2 .16

When ν l (N) positive, even, and ( )N ll = −1, the factor simplifies as1 + ∑ α≥1= 1 +#C (l)N (1, 1, lα )F 2 (l, l α )ϕ(l α )l 2α F 0 (l)l ∑ #C (l)N (1, 1, lα )F 2 (l, l α )F 0 (l)(l − 1)l 3αα≥1l νl(N) − l 2= 1 +F 0 (l)l ν l(N)(l − 1) + l#C(l) N (1, 1, lνl(N)/2 )F 2 (l, l νl(N)/2 )2 F 0 (l)(l − 1)l 3ν l(N)/2l νl(N) − l 2= 1 +F 0 (l)l ν l(N)(l − 1) +l2 − l − ( )−1l2 F 0 (l)l ν l(N)(l − 1) 2= 1 + lνl(N) − l − ( )−1lF 0 (l)l ν l(N)(l − 1) 2= 1 + lνl(N) − l + ( )−N llF 0 (l)l ν l(N)(l − 1) . 2When ν l (N) positive, even, and ( )N ll = 1, the factor simplifies as1 + ∑ α≥1#C (l)N (1, 1, lα )F 2 (l, l α )ϕ(l α )l 2α F 0 (l)= 1 +l ∑ #C (l)N (1, 1, lα )F 2 (l, l α )F 0 (l)(l − 1)l 3αα≥1l νl(N) − l= 1 +F 0 (l)l ν l(N)(l − 1) + l#C(l) N (1, 1, lνl(N)/2 )F 2 (l, l νl(N)/2 )2 F 0 (l)(l − 1)l 3ν l(N)/2l∞∑ #C (l)N+(1, 1, lα )F 2 (l, l α )F 0 (l)(l − 1)l 3αα= ν l (N)2 +1l νl(N) − l 2= 1 +F 0 (l)l ν l(N)(l − 1) + l(l2 − 1) + ( ) (−1l l + −1)l − 22 F 0 (l)(l − 1)(l 2 − 1)l ν l(N)( )∞∑ 2l ν l(N)/21 + 1l(l+1)+lF 0 (l)(l − 1)α= ν l (N)2 +1l νl(N) − l 2= 1 +F 0 (l)l ν l(N)(l − 1) + 2= 1 + lνl(N) − l + ( )−N lll 3αl2 − l + ( )−1lF 0 (l)(l − 1) 2 l ν l(N)F 0 (l)(l − 1) 2 l ν l(N) . 17

We assume that N is large enough so that there are only odd primes p satisfying the conditionN − < p < N + . Therefore, since we assumed that N is odd,D N (p) = (p + 1 − N) 2 − 4p ≡ 1 (mod 4),and it follows that there are only odd f in the above sum and that d N,f (p) ≡ 1 (mod 4)for each such f. Hence, summing (26) over all primes p in the range X < p ≤ X + Y andswitching the order of summation, we have∑X

Therefore, there are at most 2l e−(e−s0) = 2l s/2 ≤ 2l (e−1)/2 solutions to (30) when l is odd,and there are at most 4l e−(e−s0) = 4l s/2 ≤ 4l (e−1)/2 solutions when l = 2.□Proof of Lemma 8. By Lemma 11, c N,f (n) ≪ n Q l|(f,n) #C(l)κ 2N, where for any positive integerm, κ m (n) is the multiplicative function defined on the prime powers by (23).(n)Therefore,K 0 (N) − ∑ 1ff≤V(f,2)=1≪ ∑ f≤V′+ ∑ f>V∑n≤U1nϕ(4nf 2 )∑a∈Z/4nZa≡1 (mod 4)∏l|f #C(l) N(1, 1, f) ∑f 2 ϕ(f)′≪ ∑ f≤V(f,2)=1+ ∑ f>V(f,2)=1n>U∏l|f #C(l) N(1, 1, f) ∑f 2 ϕ(f)n≥1∏l|f #C(l) N(1, 1, f) ∑f 2 ϕ(f)n>U∏l|f #C(l) N(1, 1, f) ∑f 2 ϕ(f)n≥1N (1,1,f)( an)#C N (a, n, f)2ϕ((n, f))c N,f (n)(n, f)nϕ(4n) ∏ l|(n,f) #C(l) N(1, 1, f)2ϕ((n, f))c N,f (n)(n, f)nϕ(4n) ∏ l|(n,f) #C(l) N(1, 1, f) (32)1κ 2N (n)ϕ(n)1κ 2N (n)ϕ(n) ,where the primes on the sums on f are meant to indicate that the sums are to be restrictedto odd f such that #C (l)N(1, 1, f) ≠ 0 for all primes l dividing f.In [DP99, Lemma 3.4], we find thatn>U∑n>U1κ 1 (n)ϕ(n) ∼ c 0√Ufor some positive constant c 0 . In particular, this implies that the full sum converges. Fromthis we obtain a crude bound for the tail of the sum over n∑ 1κ 2N (n)ϕ(n) =∑ 1κ 1 (m)ϕ(m)ϕ(k) = 1 ∑ 1ϕ(k) κ 1 (m)ϕ(m)≪km>U(m,2N)=1l|k⇒l|2N∑k≥1l|k⇒l|2N= √ 1 NU ϕ(N)≪ √ 1 NU ϕ(N)√1 k√ ≪ 1 ∏√ϕ(k) U U∏l|N∏l|Nl|N∑ k≥1l|k⇒l|2N(1 +m>U/k(m,2N)=1l(l − 1)( √ l − 1)() (11 + √ 1 + 1 )√l(l − 1) l(1 + 1 √l).21)

We have already noted that N/ϕ(N) ≪ log log N. It is a straightforward exercise asin [MV07, p. 63] to show that∏(1 + √ 1 ) { ( √ )} log N< exp O.l log log NThus, we conclude thatl|N∑n>U1κ 2N (n)ϕ(n) ≪ N ɛ√U(33)for any ɛ > 0. For the full sum over n, we need a sharper bound in the N-aspect, which weobtain by writing∑ 1ln≥1κ 2N (n)ϕ(n) = ∏ l|2N(1 +(l − 1) 2 ) ∑n≥1(n,2N)=1≤2N ∏(11 +ϕ(2N) l(l − 1)l|2N≪ log log N.1κ 2N (n)ϕ(n)) ∑n≥11κ 1 (n)ϕ(n)For any odd prime l dividing f, we obtain the bounds{#C (l)N (1, 1, f) ≤ 2l ν l(N)/2if ν l (f) > ν l (N)/2 and 2 | ν l (N),l ν l(f)otherwisefrom Lemma 10. However, if ν l (f) > ν l (N)/2 and 2 | ν l (N), it follows that ν l (f) ≥1 + ν l (N)/2, and hence2l νl(N)/2 ≤ l 1+νl(N)/2 ≤ l ν l(f)since l > 2. Therefore, for every odd integer f, we have that∏#C (l)N(1, 1, f) ≤ f,and hence∑f>V(f,2)=1l|f∏l|f #C(l) N(1, 1, f)f 2 ϕ(f)< ∑ f>V(34)1fϕ(f) ≪ 1 V . (35)Substituting the bounds (33), (34), and (35) into (32), the lemma follows.Proof of Lemma 10. Upon completing the square, we have thatz 2 − 2(N + 1)z + (N − 1) 2 − af 2 = (z − N − 1) 2 − (4N + af 2 ).Since N is odd, the number of invertible solutions to the congruence(z − N − 1) 2 ≡ 4N + af 2 (mod 2 α )is the same as the number of invertible solutions to the congruence Z 2 ≡ 4N +af 2 (mod 2 α ).Since 4N+af 2 ≡ 4+a (mod 8), the computation of C (2)N(a, n, f) is thus reduced to a standardexercise. See [HW79, p. 98] for example.22□

Hence c N,f (n) is multiplicative in n.By (21), we find thatc N,f (2 α ) =∑a∈(Z/2 α+2 Z) ∗a≡1 (mod 4)( a2 α )S 2 (2 α , a) = 2∑a∈(Z/2 α+2 Z) ∗a≡5 (mod 8)( a2) α= (−1) α 2 αfor α ≥ 1.We now consider the case when l α is an odd prime power. In view of Lemma 10, it isnatural to split c N,f (l α ) into two parts, writingc (1)N,f (lα ) :=c (0)N,f (lα ) :=∑a∈(Z/l α Z) ∗l∤4N+af 2∑a∈(Z/l α Z) ∗l|4N+af 2( al( al) α#C(l)N (a, lα , f),) α#C(l)N (a, lα , f)so thatc N,f (l α ) = c (1)N,f (lα ) + c (0)N,f (lα ). (38)We concentrate on c (1)N,f (lα ) first. Applying Lemma 10, we havec (1)N,f (lα ) ==∑( ala∈(Z/l α Z) ∗l∤4N+af 2l∤(N−1) 2 −af 2∑( ala∈(Z/l α Z) ∗l∤4N+af 2l∤(N−1) 2 −af 2) α#C(l)N (a, lα , f) +) α[1 +∑( )]4N + af2+l( ala∈(Z/l α Z) ∗l∤4N+af 2l|(N−1) 2 −af 2∑( ala∈(Z/l α Z) ∗l∤4N+af 2l|(N−1) 2 −af 2) α#C(l)N (a, lα , f)) α(39)⎧⎪ ⎨ ∑ ( a) [ ( )]α 4N + af= l α−1 2 ∑ ( a)⎫⎪α⎬ 1 ++.llla∈(Z/lZ)⎪ ∗a∈(Z/lZ) ∗⎩ l∤4N+af 2l∤4N+af 2 ⎪ ⎭l∤(N−1) 2 −af 2 l|(N−1) 2 −af 2In order to finish evaluating this sum, we split into cases. First, assume that l | f. Thenthe sum defining c (1)N,f (lα ) is empty unless l ∤ N. In this case, l | (N − 1) 2 − af 2 if and only24

if l | N − 1. Therefore, if l | f and l ∤ N, then⎧[( )] N ∑ ( a) αc (1)N,f (lα )⎪⎨1 +if l ∤ N − 1,l la∈(Z/lZ)=∗l α−1 ∑ ( a) α⎪⎩if l | N − 1la∈(Z/lZ)⎧∗⎪⎨ (l − 1) [ 1 + ( )]Nif 2 | α and l ∤ N − 1,l= l − 1 if 2 | α and l | N − 1,⎪⎩0 if 2 ∤ α{ ((l − 1) 1 + ( ) (N N−1) ) 2if 2 | α,l l=0 if 2 ∤ α{= #C (l)N (1, 1, f) (l − 1) if 2 | α,0 if 2 ∤ α(40)as #C (l)N (1, 1, f) = (1 + ( Nl) ( N−1) ) 2in this case.lNow, suppose that l ∤ f. Under this assumption, we note that ( alwith equation (39) and dividing through by l α−1 , we havec (1)N,f (lα )l α−1 =∑( af2la∈(Z/lZ) ∗l∤4N+af 2l∤(N−1) 2 −af 2= ∑==a∈(Z/lZ) ∗l∤4N+al∤(N−1) 2 −a∑a∈Z/lZa≢−4N (mod l)[ l∑b=1(1 +( al) α[1 +) α [1 +( )]4N + af2+l( )] 4N + a+ ∑la∈(Z/lZ) ∗l∤4N+al|(N−1) 2 −a)=(af 2∑( af2la∈(Z/lZ) ∗l∤4N+af 2l|(N−1) 2 −af 2( a) αll). Picking up(41)( a) α ∑ ( a) ( )α 4N + a+l l la∈Z/lZa≢(N−1) 2 (mod l)( )) ( ) ] α ( ) α ( ) b b − 4N −N N 2 2− 1− −l lll) αupon completing the sums and making the change of variables b = 4N + a.computes that⎧l∑( ( )) ( ) α b b − 4N⎪⎨ l − 1 if l | N,1 += l − 1 − ( )Nif l ∤ N and 2 | α,l ll⎪⎩−1 if l ∤ N and 2 ∤ α.25b=1One easily

For example, the third case is Exercise 1(b) of [MV07, p. 301]. Therefore,⎧l − 2 if l | N and l ∤ f,c (1)N,f (lα )⎪⎨= l − 2 − ( ) ( ) 2Nl α−1 l −N 2 −1if l ∤ Nf and 2 | α,l⎪⎩ −1 − ( ) ( ) 2−N − if l ∤ Nf and 2 ∤ α.lIt remains to compute c (0)N,f (lα ). We first consider the case when l ∤ f. Note that the sumdefining c (0)N,f (lα ) is empty unless l ∤ N as well. Thus, under this assumption, we have thatc (0)N,f (lα ) =a∈(Z/l α Z) ∗N 2 −1l∑ ( af2ll|4N+af 2= ∑a∈(Z/l α Z) ∗l|4N+a( al( ) α −4N ∑=l) α#C (l)N (a, lα , f)) α#C(l)N (a, lα , 1)a∈(Z/l α Z) ∗l|4N+a#C (l)N (a, lα , 1).In order to evaluate this last sum, for each a ∈ (Z/l α Z) ∗ , we choose an integer representativein the range −4N < a ≤ l α − 4N. This ensures that 0 ≤ ν l (4N + a) ≤ α. There is exactlyone such choice of a so that ν l (4N + a) = α, namely a = l α − 4N. For 1 ≤ t ≤ α − 1, thenumber ( of)such a with ν l (4N + a) = t is (l − 1)l α−t−1 , but for only half of those values is(4N+a)/l t= 1. Perhaps, the easiest way to see this is to consider the base-l expansion ofl4N + a for each a in this range. Therefore, applying Lemma 10 again, we haveα∑t=1∑0

We now compute c (0)N,f (lα ) in the case that l | f. Note that, in this case, the sum definingc (0)N,f (lα ) is empty unless l | N. Note that ν l (4N + af 2 ) ≥ min{ν l (N), 2ν l (f)} with equalityholding if ν l (N) ≠ 2ν l (f).First, suppose that 2ν l (f) < ν l (N). Noting that e = ν l (4l α f 2 ) > 2ν l (f), by Lemma 10we have that#C (l)N (a, lα , f) = 2l νl(f) = 2#C (l)N(1, 1, f)if and only if ( al) ( )=(4N+af 2 )/l 2ν l (f)= 1. Hence,lc (0)N,f (lα ) =∑a∈(Z/l α Z) ∗l|4N+af 2= 2#C (l)N( al(1, 1, f)∑) α#C(l)N (a, lα , f)a∈(Z/l α Z) ∗( a l )=1= #C (l)N (1, 1, f)lα−1 (l − 1)( al) αif 1 < 2ν l (f) < ν l (N).Now, suppose that ν l (N) < 2ν l (f). Since e = ν l (4l α f 2 ) > ν l (N), by Lemma 10, we havethat#C (l)N (a, lα , f) =for every a ∈ (Z/l α Z) ∗ . Hence,c (0)N,f (lα ) ={2l ν l(N)/20 otherwise= #C (l)N(1, 1, f)∑a∈(Z/l α Z) ∗l|4N+af 2( alif 2 | ν l (N) and ( )N ll = 1,) α#C(l)N (a, lα , f)) α∑ (= #C (l)aN(1, 1, f)la∈(Z/l α Z){∗= #C (l)N (1, 1, f) l α−1 (l − 1) if 2 | α,0 if 2 ∤ αif 1 ≤ ν l (N) < 2ν l (f).Finally, consider the case when 2ν l (f) = ν l (N). Let r = ν l (f) and s = ν l (N) and writef = l r f l and N = l s N l with (l, f l N l ) = 1. Thenc (0)N,f (lα ) =∑a∈(Z/l α Z) ∗l|4N+af 2= ∑( ala∈(Z/l α Z) ∗ ( al) α#C(l)N (a, lα , f) =) α#C(l)N (a, lα , l r ).27∑ ( af2lla∈(Z/l α Z) ∗) α#C (l)N (a, lα , l r f l )

To evaluate this last sum, for each a ∈ (Z/l α Z) ∗ , we choose an integer representative inthe range −4N l < a ≤ l α − 4N l . This ensures that 0 ≤ ν l (4N l + a) ≤ α, and hence that2r ≤ ν l (4N + al 2r ) ≤ 2r + α. Similar to before, there is exactly one choice of a such thatν l (4N l +a) = α, namely a = l α −4N l . For 1 ≤ t ≤ α−1, there ) are (l−1)l α−t−1 choices with((4Nl +a)/l tν l (4N l + a) = t, but for only half of those values islthen ( ) (al = −Nl)l . Therefore, if 1 < νl (N) = 2ν l (f), thenc (0)N,f (lα ) =α∑t=0∑0

[CL84a] H. Cohen and H. W. Lenstra, Jr. Heuristics on class groups. In Number Theory (New York, 1982),volume 1052 of Lecture Notes in Math., pages 26–36. Springer, Berlin, 1984.[CL84b] H. Cohen and H. W. Lenstra, Jr. Heuristics on class groups of number fields. In Number Theory,Noordwijkerhout 1983 (Noordwijkerhout, 1983), volume 1068 of Lecture Notes in Math., pages33–62. Springer, Berlin, 1984.[Dav80] Harold Davenport. Multiplicative Number Theory, volume 74 of Graduate Texts in Mathematics.Springer-Verlag, New York, second edition, 1980. Revised by Hugh L. Montgomery.[DP99] Chantal David and Francesco Pappalardi. Average Frobenius distributions of elliptic curves. Internat.Math. Res. Notices, 1999(4):165–183, 1999.[DP04] Chantal David and Francesco Pappalardi. Average Frobenius distribution for inerts in Q(i). J.Ramanujan Math. Soc., 19(3):181–201, 2004.[FM96] Etienne Fouvry and M. Ram Murty. On the distribution of supersingular primes. Canad. J. Math.,48(1):81–104, 1996.[GS03] A. Granville and K. Soundararajan. The distribution of values of L(1, χ d ). Geom. Funct. Anal.,13(5):992–1028, 2003.[HW79] G. H. Hardy and E. M. Wright. An Introduction to the Theory of Numbers. The Clarendon PressOxford University Press, New York, fifth edition, 1979.[IK04] Henryk Iwaniec and Emmanuel Kowalski. Analytic Number Theory, volume 53 of American MathematicalSociety Colloquium Publications. American Mathematical Society, Providence, RI, 2004.[Jam04] Kevin James. Average Frobenius distributions for elliptic curves with 3-torsion. J. Number Theory,109(2):278–298, 2004.[JS11] Kevin James and Ethan Smith. Average Frobenius distribution for elliptic curves defined over finiteGalois extensions of the rationals. Math. Proc. Cambridge Philos. Soc., 150(3):439–458, 2011.[Kob88] Neal Koblitz. Primality of the number of points on an elliptic curve over a finite field. Pacific J.Math., 131(1):157–165, 1988.[Kow06] E. Kowalski. Analytic problems for elliptic curves. J. Ramanujan Math. Soc., 21(1):19–114, 2006.[Len87] H.W. Lenstra, Jr. Factoring integers with elliptic curves. Ann. of Math. (2), 126(3):649–673, 1987.[LPZ10] Alessandro Languasco, Alberto Perelli, and Alessandro Zaccagnini. On the Montgomery-HooleyTheorem in short intervals. Mathematika, 56:231–243, 2010.[LT76] Serge Lang and Hale Trotter. Frobenius Distributions in GL 2 -extensions. Lecture Notes in Mathematics,Vol. 504. Springer-Verlag, Berlin, 1976. Distribution of Frobenius automorphisms in GL 2 -extensions of the rational numbers.[MV07] Hugh L. Montgomery and Robert C. Vaughan. Multiplicative Number Theory. I. Classical theory,volume 97 of Cambridge Studies in Advanced Mathematics. Cambridge University Press, Cambridge,2007.(Chantal David) Department of Mathematics and Statistics, Concordia University, 1455 deMaisonneuve West, Montréal, Québec, H3G 1M8, CanadaE-mail address: cdavid@mathstat.concordia.caURL: www.mathstat.concordia.ca/faculty/cdavid(Ethan Smith) Centre de recherches mathématiques, Université de Montréal, P.O. Box6128, Centre-ville Station, Montréal, Québec, H3C 3J7, Canada; and Department of MathematicalSciences, Michigan Technological University, 1400 Townsend Drive, Houghton,Michigan, 49931-1295, USAE-mail address: ethans@mtu.eduURL: www.math.mtu.edu/~ethans29