Cyclic reduction densities for elliptic curves

For an elliptic curve E defined over a number field K, the heuristic density of the set of primes of K for which E has cyclic reduction is given by an inclusion–exclusion sum δE/K\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\delta _{E/K}$$\end{document} involving the degrees of the m-division fields Km\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$K_m$$\end{document} of E over K. This density can be proved to be correct under assumption of GRH. For E without complex multiplication (CM), we show that δE/K\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\delta _{E/K}$$\end{document} is the product of an explicit non-negative rational number reflecting the finite entanglement of the division fields of E and a universal infinite Artin-type product. For E admitting CM over K by a quadratic order O\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\mathcal {O}$$\end{document}, we show that δE/K\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\delta _{E/K}$$\end{document} admits a similar ‘factorization’ in which the Artin type product also depends on O\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\mathcal {O}$$\end{document}. For E admitting CM over K¯\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\overline{K}$$\end{document} by an order O⊄K\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\mathcal {O}\not \subset K$$\end{document}, which occurs for K=Q\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$K=\textbf{Q}$$\end{document}, the entanglement of division fields over K is non-finite. In this case we write δE/K\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\delta _{E/K}$$\end{document} as the sum of two contributions coming from the primes of K that are split and inert in O\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\mathcal {O}$$\end{document}. The split contribution can be dealt with by the previous methods, the inert contribution is of a different nature. We determine the ways in which the density can vanish, and provide numerical examples of the different kinds of densities.


Introduction
Let E be an elliptic curve defined over a number field K, and p a prime of K for which E has good reduction.Then the point group E p (k p ) of the reduced curve over the residue class field k p is a finite abelian group on at most two generators.If one generator suffices, we call p a prime of cyclic reduction of E. The question considered in this paper is whether the set S E/K of primes of cyclic reduction of E is infinite and, if so, whether it has a density inside the set of all primes of K.
Serre [20] observed in 1977 that this question is very similar to the Artin primitive root problem (1927), which asks for the density of the set of primes p of K for which a fixed element a ∈ K * is a primitive root modulo p, i.e., the unit group of the residue class field k p at p satisfies k * p = a mod p .In this situation, these primes are (up to finitely many primes of 'bad reduction' for a) the primes p that do not split completely in any of the 'ℓ-division fields' K ℓ = K(ζ ℓ , ℓ √ a) = Split K (X ℓ − a) of the element a at prime values ℓ ∈ Z.A heuristic inclusion-exclusion argument [2, pp.viii-ix] that goes back to Artin suggests that the set of such primes has a natural density that can be expressed in terms of the degrees of the m-division fields K m as Here µ denotes the Möbius function.In 1967, Hooley [6] proved Artin's conjecture for K = Q under the assumption of the Generalized Riemann Hypothesis (GRH).
The set S E/K of primes of cyclic reduction of an elliptic curve E/K can be characterized in a similar way, in terms of the elliptic division fields K m = K(E[m](K)) of E over K obtained by adjoining to K the coordinates of all m-torsion points of E defined over an algebraic closure K of K.It is, up to finitely many p, the set of primes that do not split completely in any of the ℓ-division fields K ℓ of E at prime values ℓ ∈ Z (Corollary 2.2).Unsurprisingly, the associated heuristic density for S E/K is given by an inclusion-exclusion sum that, at least typographically, is identical to (1).It is the limit of the finite sums for n tending to infinity under the partial ordering of divisibility.Under this ordering, we have m|n =⇒ δ E/K (m) δ E/K (n) 0, (4) so the limit exists and is non-negative.As each value δ E/K (n) is an upper bound for the upper density of the set S E/K , so is δ E/K .Proving unconditionally that S E/K is infinite in case δ E/K in (2) is positive is an open problem, just as in Artin's original setting (1).If δ E/K vanishes, then we can show unconditionally that S E/K is finite.
For K = Q, Serre showed that, under GRH, the set S E/Q does have a density, and that it is equal to δ E/Q .His proof, which is in the spirit of Hooley, was published in 1983 by Murty [14].It can be extended to general number fields along lines that are actually already contained in the very same paper [14].For completeness, we summarize the argument in Section 2.
The number δ E/K in (2), which we now know to be the density (under GRH) of the set S E/K of primes of K of cyclic reduction, is defined by a series that converges rather slowly, and it is unsuitable to determine whether δ E/K vanishes.We remedy this situation by 'factoring' the infinite sum as the product of a finite sum and an infinite non-vanishing product.The outcome depends on whether E has complex multiplication (CM) over an algebraic closure K of K, leading to the distinction of three mutually exclusive cases for an elliptic curve E defined over K: Case 1. E without CM over K; Case 2. E with CM that is defined over K; Case 3. E with CM that is not defined over K.These cases are the subject of Theorems 1.1, 1.2 and 1.4, respectively.In the first two cases, the finite sum that goes into the 'factorization' of δ E/K is a sum δ E/K (n) from (3), where n = N (E, K) is the product of the primes in an explicit finite set T E/K of critical prime numbers for E over K.
Case 1.For E without CM over K, the set T E/K of critical non-CM primes for E consists of those prime numbers ℓ satisfying at least one of the following conditions: (1) ℓ | 2 • 3 • 5 • ∆ K , with ∆ K the discriminant of K; (2) ℓ lies below a prime of bad reduction of E; (3) the Galois group Gal(K ℓ /K) is not isomorphic to GL 2 (F ℓ ).Condition (3) is only satisfied for finitely many ℓ by Serre's open image theorem [19].We prove the following 'factorization theorem'.
Theorem 1.1.Let E/K be an elliptic curve without CM, and n = N (E, K) as in (5).
Then δ E/K can be factored as a product of the finite sum δ E/K (n) ∈ Q 0 in (3) and a non-vanishing infinite product.
Theorem 1.1 reflects the fact that some critical n-division field K n of E and the fields K ℓ for primes ℓ ∤ n form a linearly disjoint family of finite Galois extensions of K, as in Definition 3.1 and Theorem 3.2.The existence of such an integer n follows from the open image theorem in [19], but not the explicit value n = N (E, K) that we provide.Our N (E, K) will not in general be the smallest such value.
The finite sum δ E/K (n) in Theorem 1.1, which may vanish, is the density of the set of primes of K that do not split completely in any of the ℓ-division fields K ℓ at the critical primes ℓ ∈ T E/K .At primes ℓ / ∈ T E/K the fields K ℓ have maximal degree so the factor at ℓ / ∈ T E/K in the infinite product is the density of the set of primes not splitting completely in K ⊂ K ℓ .Just as in the case of δ a,K in (1), we deduce that δ E/K can be written as a product of a rational number c E/K ∈ Q 0 and a universal non-CM elliptic Artin constant We have c E/K = 1 when the division fields K ℓ for ℓ prime all assume the maximal degree in (6) and they form a linearly disjoint family over K.When the first condition is not satisfied, a decomposition that is more satisfactory than (7) is where the naive density depends only on the degrees [K ℓ : K], and the rational entanglement correction factor α E/K ∈ Q 0 reflects the dependencies that exist between finitely many critical K ℓ .
The density δ E/K vanishes if and only if the finite rational sum δ E/K (n) in Theorem 1.1 vanishes.In this case we know unconditionally that S E/K is a finite set, as there is a 'finite' obstruction to cyclic reduction in the division field K n .We call this obstruction non-trivial if the corresponding naive density A E/K is non-zero, meaning that for no prime ℓ, the ℓ-division field K ℓ is equal to K. In this case it is the entanglement correction factor α E/K that vanishes.
Non-trivial vanishing does not occur over K = Q, and 'natural' examples are rare.We show however that non-trivial vanishing does happens for all elliptic curves E/K with naive density A E/K > 0, in the sense that over a suitable base change K ⊂ K ′ , we have δ E/K ′ = 0 = A E/K ′ .We do not know whether non-trivial vanishing can occur over In the CM-cases 2 and 3, the endomorphism ring O = End K (E) = Z is an imaginary quadratic order.In this case, the finite set T E/K of critical CM-primes of E/K is defined as consisting of those prime numbers ℓ for which at least one of the following holds: (1) ℓ is divisible by a prime of bad reduction of E/K, or (2) ℓ divides the product ∆(O) • ∆ K of the discriminants of O and K.
For CM-curves E/K, the degree [K m : K] of the division fields K m only grows quadratically in m, and the ramification can be controlled by class field theory.This makes it possible to prove unconditionally that S E/K has density δ E/K , as the explicit versions of the Chebotarev density theorem without GRH in [8] now suffice to handle the error terms.For K = Q, this has been written down in [5], and the proof given there extends without essential changes to arbitrary number fields K.
Case 2. Suppose that K contains the CM-field F = Frac(O).In this case, the situation is structurally reminiscent of the non-CM-case, but now almost all ℓ-division fields have a Galois group Gal(K ℓ /K) ∼ = (O/ℓO) * that also depends on O, not just on ℓ as in the case of the generic group GL 2 (F ℓ ) that we had before.To ease notation, we write D = ∆(O) for the discriminant of O and define the Artin constant of the order O as with local factors A O,ℓ at ℓ given by The Artin constant for O vanishes if and only if we have A O,2 = 0, or, equivalently, for∆(O) ≡ 1 mod 8.
In the case where O (and therefore F ) is contained in K, the non-maximality and entanglement of the division fields K ℓ of E over K is 'finite', just as in the non-CM case.We have the following CM-analogue of Theorem 1.1.
Theorem 1.2.Suppose E/K has CM by an order O ⊂ K, and define n = N (E, K) as in (5).Then δ E/K can be factored as the product of the finite sum δ E/K (n) ∈ Q 0 from (3) and an infinite product.
In Theorem 1.2, we have We deduce that in the case where K contains the CM-order O, all densities δ E/K are rational multiples of the Artin constant A F = A OF associated to the ring of integers O F of the CM-field F .
Case 3. We finally suppose that E has CM by an order O not contained in K. Then the entanglement of the division fields K ℓ is no longer of finite nature, and the density δ E/K can sometimes be established by easy arguments.
Example 1.3.The elliptic curve E/Q given by y 2 = x 3 +x has good reduction outside 2, and its CM-order and for ℓ > 2 the ℓ-division field K ℓ contains Q(i), as for any non-zero ℓ-torsion point (x, y) ∈ E(K ℓ ), we have y = 0 and (−x, iy) If p is a prime of cyclic reduction for E, then it is odd and does not split completely in K 2 = Q(i).Conversely, any odd p that does not split completely in K 2 = Q(i) is a prime of cyclic reduction for E, as it does not split completely in any other ℓ-division field K ℓ ⊃ K 2 .Thus, the set {p : p ≡ 3 mod 4} of primes of cyclic reduction of E has density δ E/Q = 1/2.
In the case O ⊂ K we treat the cyclicity of reduction modulo a prime p / ∈ T E/K according to the splitting behavior of p in the quadratic extension K ⊂ KF .
For p inert in K ⊂ KF , the reduction E mod p is supersingular, and it follows from Proposition 4.2 that in this case, the cyclicity of the resulting point group E(k p ) only depends on the splitting behavior of p in K ⊂ K 2 .These supersingular p contribute a rational density δ ss E/K to δ E/K .For p / ∈ T E/K split in K ⊂ KF as pO KF = q 1 q 2 , we have so there is a 2 to 1 correspondence between the set of primes q / ∈ T E/KF of cyclic ordinary reduction for the base changed elliptic curve E/KF and the set of primes p / ∈ T E/K of cyclic ordinary reduction for E/K.
Theorem 1.4.Let E/K be a CM-elliptic curve with CM-order O and CM-field F ⊂ K.
Then the cyclic reduction density δ E/K can be written as where the supersingular density δ ss E/K satisfies δ ss E/K ∈ {0, Acknowledgments.The first author is supported by ANR-20-CE40-0003 Jinvariant.The second author was funded by a research grant of the Max-Planck-Institut für Mathematik in Bonn.Both authors thank the institute in Bonn for its financial support and its inspiring atmosphere.

The density of the set of primes of cyclic reduction
This section gives the basic splitting criterion (Corollary 2.2) for primes of K to be primes of cyclic reduction for E/K, and also a proof that for arbitrary number fields K, the density of cyclic reduction is given as in (2) by the inclusion-exclusion sum We define our elliptic curve E/K by an integral Weierstrass equation y 2 = x 3 + Ax + B with coefficients A, B in the ring of integers O K of the number field K. To this model of E we associate the discriminant The primes p of K coprime to ∆ E , which are necessarily of odd characteristic, are the primes of good reduction for this model of E. Changing the model, or providing a minimal model, will only affect the reduction type of finitely many primes, and this is irrelevant for our density questions.For primes p of good reduction for E/K, the reduced curve modulo p is an elliptic curve E p over the residue class field k p .We begin by formally stating the key criterion for a prime of good reduction of E/K to be a prime of cyclic reduction of E/K, i.e., a prime for which the finite group E p (k p ) is cyclic.
Lemma 2.1.For a prime p of good reduction for the elliptic curve E/K, the following are equivalent: (1) p is a prime of cyclic reduction for E/K; (2) for no prime number ℓ coprime to p, the prime p splits completely in , it is a generality on elliptic curves in positive characteristic that the group E p [ℓ](k p ) is cyclic, so we can further assume p ∤ ℓ.
Then p is unramified in the Galois extension K ⊂ K ℓ , as it is a prime of good reduction of E coprime to ℓ.
The group E[ℓ](K ℓ ) has order ℓ 2 by definition of K ℓ , and at every prime q|p of K ℓ , the natural reduction map ](k q ) has order ℓ 2 .Now k q is generated over k p by the coordinates of the points in E q [ℓ](k q ), as K ⊂ K ℓ is generated by the coordinates of the ℓ-torsion points of E. It follows that the natural inclusion k p ⊂ k q is an equality for all q|p in K ℓ , i.e., p splits completely in K ⊂ K ℓ , if and only if the natural inclusion ) is an equality.As E q [ℓ](k q ) has order ℓ 2 , this proves the lemma.
If p is a prime of good reduction of E of characteristic p coprime to the discriminant ∆ K of K, then p can not split completely in the division field K p , as it is totally ramified in the subextension K ⊂ K(ζ p ) of degree p − 1 > 1 of K ⊂ K p that is generated by a primitive p-th root of unity ζ p .This shows that, for primes p coprime to both ∆ E and ∆ K , being in the set S E/K of primes of cyclic reduction of E is tantamount to not splitting completely in any division field extension K ⊂ K ℓ at a rational prime ℓ.
Corollary 2.2.For a prime p ∤ ∆ E ∆ K , we have p ∈ S E/K if and only if p does not split completely in any of the division fields K ℓ , with ℓ ∈ Z prime.
The proof of Lemma 2.1 shows that if a prime p ∤ ∆ E ∆ K splits completely in K ⊂ K ℓ , then E p (k p ) has complete ℓ-torsion, so we have ℓ N K/Q (p) + 1 by the Hasse-Weil bound.For a squarefree integer m and a prime p ∤ ∆ E , we similarly obtain In order to count the cardinality #S E/K (x) of primes p in the set The function π K (x, K) counts primes p ∤ ∆ K of good reduction of E of norm at most x, and, as there are only finitely many primes p|∆ K in S E/K , Corollary 2.2 and inclusionexclusion yield Note that by ( 16), the function π K (x, K m ) vanishes for m > √ x + 1, so the infinite sum of integers in ( 17) is actually finite, and therefore convergent.
In order to obtain the desired asymptotic relation #S After dividing both sides in (17) by x/ log x, the problem in obtaining (14) lies in interchanging the infinite sum and the limit x → ∞ in the right hand side of (17).This can be done if one assumes GRH in order to bound the error terms in the asymptotic relations for π K (x, K m ) and adapts the argument of Hooley found in [6].More precisely, Murty [14,Theorem 1] has shown that in this setting, for the density of S E/K to be equal (under GRH) to the the inclusionexclusion density (2) it is enough to show that [K m : K] grows sufficiently rapidly with m (as it does for division fields) and that two conditions are satisfied.The first condition is that the root discriminants of the division fields K m do not grow too rapidly with m, as follows.
Note that the quantity in the Proposition is [K : Q] times the logarithm of the ordinary root discriminant The second condition is that 'not too many' primes p of K split in the division fields K ℓ for 'large' primes ℓ, in the following sense.
Thus, in order to establish that, under GRH, the quantity δ E/K in ( 2) is in all cases the density of the set S E/K of primes of cyclic reduction, it now suffices to prove Propositions 2.3 and 2.4.For completeness, we sketch the proofs in the remainder of this Section.
Proof of Proposition 2.3.Bounding absolute root discriminants already dates back to Hensel [18, p. 58].For the relative extension K ⊂ K m we can use the version found in [16, p. 44].It states that for a finite Galois extension of number fields As the absolute discriminant of L equals can be combined with the inequality (18) in the case L = K m to obtain, after division by The primes p|D(K m /K) either divide m, or they lie under one of the finitely many primes of bad reduction of E, so we have p|D(Km/K) log p C E + log m for some constant C E depending only on E. We obtain As we have d m = O(m 4 ), this yields the desired asymptotic relation.
Proof of Proposition 2.4.When showing that the cardinality of the set of primes p of K of norm N K/Q (p) x that split completely in K ⊂ K ℓ for some prime ℓ > x 1/2 log 2 x is asymptotically o( x log x ), we may disregard primes p|∆ K ∆ E , as they are finite in number, and primes p that are not of degree 1, as there are no more than o( x, and that p splits completely in an ℓ-division field K ℓ with ℓ > 2. By (16), this implies ℓ √ x + 1.As p ∤ ∆ K necessarily splits completely in the subextension K ⊂ K(ζ ℓ ), we have p ∤ ℓ, and p lies over a rational prime p ≡ 1 mod ℓ.Any such p gives rise to at most [K : Q] primes p in K of norm p.Thus, the number B(x) of such p can be bounded by with π(x, 1, ℓ) denoting the number of primes p x satisfying p ≡ 1 mod ℓ.By the Brun-Titchmarsh theorem, we have , so we obtain Applying the well known estimate [1, Theorem 4.12] for the sum ℓ<X ℓ −1 of reciprocals of primes, we obtain B(x) = o( x log x ) for x → ∞.

Cyclic reduction density in the non-CM case
The explicit definition (2) of the conjectural density δ E/K of cyclic reduction is ill-suited to determine either its approximate value or its vanishing.Theorem 1.1 allows us to approximate it with high precision from fewer data, and to determine whether it vanishes.Its proof amounts to determining the entanglement of the division fields K ℓ , which, by the open image theorem of Serre [19], is 'of finite nature' for E without CM.
Definition 3.1.Let F be a field and let F = {F n } n∈X a family of Galois extensions of F inside an algebraic closure of F .We call F linearly disjoint over F if for the compositum L of the fields F n , the natural inclusion map is an isomorphism.If this is not the case, we call the family F entangled over K.The entanglement is said to be finite if A family as in Definition 3.1, which can be either finite or infinite, depending on X, is linearly disjoint over F if and only if for every individual field F n ∈ F , the field F n and the compositum of the fields F m with m = n are linearly disjoint over F .The family of ℓ-division fields K ℓ with ℓ prime is not necessarily linearly disjoint over a number field K for an elliptic curve E/K without CM, but we can make it linearly disjoint by grouping together finitely many 'critical' K ℓ in their compositum.This crucial fact was already formulated in the Introduction, and we repeat it here.Theorem 3.2.Let K be a number field, E/K an elliptic curve without CM, and define the set T E/K of critical primes for E/K as consisting of the prime numbers ℓ satisfying at least one of the following conditions: ( (2) ℓ lies below a prime of bad reduction of E; (3) the Galois group The proof of Theorem 3.2 relies on a group theoretical result on the Jordan-Hölder factors that can occur in subgroups of H ⊂ GL 2 (Z/N Z).Lemma 3.3.Let N ∈ Z >0 be an integer and H ⊂ GL 2 (Z/N Z) a subgroup.Suppose S is a non-abelian simple group that occurs in H. Then S is isomorphic to either A 5 or PSL 2 (F ℓ ), with ℓ a prime dividing N .
Proof.We may assume H ⊂ SL 2 (Z/N Z) = ℓ|N SL 2 (Z/ℓZ) as we only care about nonabelian simple Jordan-Hölder factors.In addition, we may assume that N is squarefree, i.e., equal to its own radical N 0 = rad(N ); indeed, the natural map r : SL 2 (Z/N Z) → SL 2 (Z/N 0 Z) has a solvable kernel that is a product of ℓ-groups, and the groups H and H/(H ∩ ker r) ⊂ SL 2 (Z/N 0 Z) H and H/(H ∩ ker r) ⊂ SL 2 (Z/N 0 Z) have the same nonabelian simple Jordan-Hölder factors.Thus, every non-abelian simple group that occurs in H occurs in a subgroup of some SL 2 (Z/ℓZ), so we can reduce to the case that N = ℓ is prime.In this case the statement is a classical result that can be found in [21, p. IV-23].
Proof of Theorem 3.2.It suffices to show that for an integer N > 1 divisible by all primes in T E/K and l ∤ N a prime number, we have K N ∩K ℓ = K.Take such N and ℓ.Then ℓ ∤ N is unramified in the tower Q ⊂ K ⊂ K N by ( 1) and ( 2), and since K ⊂ K(ζ ℓ ) is totally ramified over ℓ of degree ℓ − 1 > 1 by (1), the fields K N and K(ζ ℓ ) are K-linearly disjoint.It now suffices to prove that the normal extensions We have Gal( 3), and for ℓ 5 this group has a unique nontrivial normal subgroup {± id ℓ } with simple quotient PSL , we find that the non-abelian simple group PSL 2 (F ℓ ), which is not A 5 as we assume ℓ = 5 by (1), is a Jordan-Hölder factor of Gal(K As we can view Gal(K N /K) as a subgroup of GL 2 (Z/N Z), this contradicts Lemma 3.3, since we have ℓ ∤ N .
We are now ready to prove our main result for Case 1.
Proof of Theorem 1.1.We simply note that the quantity δ E/K (n) in ( 3) is the inclusionexclusion fraction of elements in the Galois group Gal(K n /K) that have non-trivial restriction on every subfield K ℓ with ℓ|N .Thus, if n 1 and n 2 are coprime numbers for which the division fields K n1 and K n2 are K-linearly disjoint, we have an equality δ E/K (n 1 n 2 ) = δ E/K (n 1 )δ E/K (n 2 ).If N ′ is any squarefree multiple of the integer N in Theorem 3.2, this yields Taking the limit N ′ → ∞ with respect to the divisibility ordering yields Theorem 1.1.
For our purposes, we only need to apply Theorem 3.2 for squarefree values of N .We can however strengthen its conclusion a bit and reformulate it in the following way, as an explicit form of Serre's open image theorem.This is the form used by Lombardo and Tronto in [13].
Theorem 3.4.Let K be a number field, E/K an elliptic curve without CM, and T E/K the set of prime numbers ℓ satisfying one of (2) ℓ lies below a prime of bad reduction of E; (3) the Galois group Gal(K ℓ /K) is not isomorphic to GL 2 (F ℓ ).
For ℓ prime, write K ℓ ∞ for the compositum of all ℓ-power division fields of E over K, and K T for the compositum of the fields K ℓ ∞ with ℓ ∈ T E/K .Then the family consisting of K T and {K ℓ ∞ } ℓ / ∈T E/K is linearly disjoint over K.
Proof.It suffices to show that for N an integer divisible by all primes in T E/K and ℓ ∤ N prime, we have K N ∩ K ℓ n = K for every n ∈ Z >0 .For n = 1, this is Theorem 3.2.
As K ⊂ K N is unramified over ℓ ∤ N by condition (2), the intersection is K-linearly disjoint from K(ζ ℓ n ) by the condition ℓ ∤ ∆ K in (1), and it is K-linearly disjoint from K ℓ by Theorem 3.2.It therefore corresponds to a subgroup of Gal(K ℓ n /K) ⊂ GL 2 (Z/ℓ n Z) that maps surjectively to Gal(K ℓ /K) = GL 2 (F ℓ ) by ( 3) and has surjective image (Z/ℓ n Z) * under the determinant map.By a result of Serre [21, p. IV-23, Lemma 3], valid for ℓ 5, such a group is the full group GL 2 (Z/ℓ n Z), proving K N ∩ K ℓ n = K.

Cyclic reduction densities for CM-curves
We now let E be an elliptic curve defined over a number field K for which O = End K (E) is an imaginary quadratic order of discriminant ∆(O) < 0. In other words, the j E ∈ K of E and the analytically defined j-invariant j(O) of the order O are algebraic numbers having the same irreducible polynomial over Q.We write ∆(O) = f 2 ∆ F , where ∆ F denotes the discriminant of the CM-field If F is contained in K, the basic assumption of bf Case 2, the situation with respect to cyclic reduction resembles the non-CM case: entanglement of the ℓ-division fields K ℓ concerns only finitely many ℓ, and for almost all ℓ, the Galois group of the extension K ⊂ K ℓ is the full group (O/ℓO) * .The proof of the main result, Theorem 1.2, will therefore be short.
Proof of Theorem 1.2.Just as in the proof of Theorem 1.1, it suffices to have the analogue of Theorem 3.2 in the CM-case with O ⊂ K.As in the proof of this Theorem, it suffices to show that for N any integer divisible by the critical CM-primes that make up T E/K and ℓ ∤ N prime, we have K N ∩ K ℓ = K.This can be shown by a ramification argument.On the one hand, the extension K ⊂ K N is unramified at all primes over ℓ, as these are primes of good reduction of E and ℓ does not divide N .On the other hand, Campagna and Pengo show in [3, Proposition 3.3] that any subextension K ⊂ L of K ⊂ K ℓ is ramified above ℓ for L = K.Moreover, we have Gal(K ℓ /K) = (O/ℓO) * at these ℓ, so the factor corresponding to ℓ in the infinite product (12) is A O,ℓ as stated.
The argument of Campagna and Pengo mentioned above uses the fact that ℓ does not divide the discriminant ∆ K of K to obtain the desired ramification behavior of K ⊂ K ℓ over ℓ.As ℓ ∤ ∆ K is not a necessary condition for this, such ℓ can in many examples be omitted from T E/K .Note also that in the case O ⊂ K, all odd primes ℓ dividing ∆(O) will actually divide ∆ K , as not only F = Frac(O) is contained in K, but also the ring class field F (j(O)) of the order O, which is ramified over F at all odd primes dividing the conductor f .
We finally come to Case 3, when O and F are not contained in K.This situation arises in particular for K = Q.In this case the entanglement between the division fields K ⊂ K ℓ is of a different, non-finite nature, as illustrated by the following example.
The primes p ≡ 5 mod 8 cease to be primes of cyclic reduction for E over F = Q( √ −2), as they are inert in F and E acquires complete 2-torsion over F p 2 .Primes p ≡ 3 mod 8 are split in F and give rise to two primes p|p in F with E(k p ) = E(F p ).This yields We now base-change E to L = Q(i).In this case E has complete 2-torsion modulo primes p ≡ 3 mod 4. The primes p ≡ 1 mod 4 split into 2 primes, which are of cyclic reduction for p ≡ 5 mod 8, and have complete 2-torsion for p ≡ 1 mod 8.We conclude that a prime p of Q(i) is a prime of cyclic reduction for E if and only if its norm is a prime p ≡ 1 mod 8, and find δ E/L = 1 2 .Note that the cyclic reduction density of E is bigger over F than over Q: the 1  4 in (20) from rational primes p ≡ 5 mod 8 becomes 1 2 , and the 1 2 δ E/F from rational primes p ≡ 3 mod 8 disappears as these primes are inert in L: over their residue fields of order p 2 in L, the reduced elliptic curve has complete 2-torsion, since p splits completely in Proof.Suppose we have F ⊂ K ℓ for a prime number ℓ.Then the quadratic extension K ⊂ KF and the extension K ⊂ K ℓ are K-linearly disjoint Galois extensions of K.
By the Chebotarev Density Theorem, we can pick a degree 1 prime p|p of K of good reduction for E that is coprime to ℓ, inert in K ⊂ KF and totally split in K ⊂ K ℓ .The splitting condition in K ⊂ KF implies, by [9,Chapter 13,Theorem 12], that the reduced curve E p is a supersingular elliptic curve over k p = F p , so it has #E p (k p ) = p + 1 points.The splitting of p in K ⊂ K ℓ implies that k * p contains a primitive ℓ-th root of unity and that E p (k p ) has full ℓ-torsion.The resulting divisibility relations show that we have ℓ = 2, proving (1).For discriminants ∆(O) ≡ 1 mod 8 we have ∆(O) < −4 or, equivalently, O * = {±1}.In this generic case, which only excludes the special discriminant values −3 and −4, the 2-division field K 2 is invariant under twisting of E. Replacing E by a twist, if necessary, we will assume that E is defined over L = Q(j E ) and with CM-order O.Note that L does not contain F , as L has a real embedding sending j E to j(O).
In the case ∆(O) ≡ 1 mod 8, the ring O/2O ∼ = F 2 × F 2 has trivial unit group, so we have H 2,O = H O and two inclusions L ⊂ L 2 ⊂ LF = H O of which exactly one is an equality.If we have F ⊂ L 2 , the resulting equality L = L 2 implies that, trivially, all primes split completely in L ⊂ L 2 .In this case any odd prime p of L of degree 1 that is inert in the quadratic extension L ⊂ LF and a prime of good reduction for E satisfies p = N L/Q p ≡ −1 mod 4 by ( 21).This implies LF = L(i), so For ∆(O) ≡ 5 mod 8, the ring O/2O is the field of 4 elements, with unit group of order 3 on which the generator of Gal(F/Q) acts by inversion.For ∆(O) = 3, this makes Gal(H 2,O /L) into the symmetric group on 3 elements, so the normal extension L ⊂ L 2 coincides with L ⊂ H 2,O , and we have F ⊂ L 2 ⊂ K 2 .For the special value ∆ = −3, we have H 2,O = H O as the group (O/2O) * /O * is trivial, but from a Weierstrass equation Y 2 = X 3 − a for E we see that we still have

This proves (3).
We finally suppose that we have ∆(O) ≡ 0 mod 4 and F ⊂ K, with ∆(O) = −4.In this case the ring O/2O ∼ = F 2 [X]/(X 2 ) has a nilpotent maximal ideal xO of index 2, and its unit group {1, 1 + x} has order 2. As L ⊂ H 2,O is a Galois extension of degree 4 that is the compositum of the quadratic extension L ⊂ LF and the Galois extension L ⊂ L 2 of degree dividing 6, we conclude that Gal(H 2,O /L) is a Klein 4-group, and that L ⊂ L 2 and L ⊂ LF are L-linearly disjoint quadratic extensions.As we have F ⊂ K by assumption, the quadratic extension L 2 ⊂ L 2 F remains quadratic after taking composita with K, so K 2 does not contain F .In the excluded case ∆ Proof of Theorem 1.4.We treat the cyclic reduction density of the sets of primes of K for which E has supersingular and ordinary reduction separately, and write δ E/K accordingly as δ E/K = δ ss + δ ord The supersingular primes are inert in the quadratic extension K ⊂ KF , so, by Proposition 4.2, they do not split completely in the ℓ-division fields K ℓ when ℓ is an odd prime.
If ∆(O) is odd, the same applies to ℓ = 2.In view of Corollary 2.2, we deduce that all primes p ∤ ∆ K of supersingular reduction have cyclic reduction if ∆(O) is odd, leading to the contribution δ ss = 1/2 to δ E/K .In the subcase ∆(O) ≡ 1 mod 8, we have KF = K 2 , so the ordinary primes, which split completely in K ⊂ KF , cannot have cyclic reduction as the reduced curve will have complete 2-torsion.Thus δ ord = 0 in this case.
When ∆(O) is even, supersingular primes are primes of cyclic reduction if and only if they do not split completely in the extension K ⊂ K 2 .We find δ ss = δ ord = 0 if we have K = K 2 .In all other cases K ⊂ K 2 and K ⊂ KF are both quadratic extensions, and we find δ ss ∈ { 1  4 , 1 2 } depending on whether they are different or the same.If they are the same, we have δ ord = 0, since the ordinary primes then split completely in K 2 = KF .
The primes p of ordinary reduction of E/K are split in the quadratic extension K ⊂ KF , and the point group E(k p ) is the same for these extension primes, which both have norm N K/Q (p).Thus every ordinary prime p of cyclic reduction in K corresponds to two ordinary primes of cyclic reduction in KF of the same norm.This yields δ ord = 1 2 δ E/KF , and finishes the proof.
Note that as KF does contain the CM-field F of E, the ordinary density 1 2 δ E/KF can be written in the form given by Theorem 1.2.
We summarize what we proved above Table 4.3, which gives more precise information than Theorem 1.4 for the case F ⊂ K and reduces the computation of δ E/K in Case 3 to the computation of δ E/KF in Case 2.

Table. Supersingular and ordinary densities for
1 mod 8 5 mod 8 0 mod 4 The three possibilities for δ ss ∈ {0, 1 4 , 1 2 } listed in the case ∆(O) ≡ 0 mod 4 correspond to the respective cases Note that for the values ∆(O) ≡ 0 mod 4 different from −4, twisting the elliptic curve E/K does not change F and K 2 and which of the three subcases we are in.In the special case ∆(O) = −4 we have F = Q(i), and E is a twist of the curve with Weierstrass model . Here all three possibilities mentioned above occur for certain a ∈ K * .

Vanishing of the density
The most common cause for the vanishing of the density δ E/K in ( 2) is that we have K = K ℓ for some prime ℓ.This can only occur for primes ℓ|2∆ K , as K = K ℓ implies that we have ζ ℓ ∈ K.In our Case 3 of CM-curves with CM-field F ⊂ K, Table 4.3 shows that this trivial cause for vanishing is the only possible one, and that it only happens for ℓ = 2.
If we have K = K ℓ for all primes ℓ in either the non-CM Case 1 or the Case 2 of CM by O ⊂ K, there is still the interesting possibility of δ E/K vanishing non-trivially.If one writes δ E/K as explained in the Introduction as with ) the naive density from ( 9) and α E/K ∈ Q 0 a rational entanglement correction factor, then non-trivial vanishing amounts to having In this case all K ℓ are different from K, but the non-splitting conditions in the various K ℓ cannot be satisfied simultaneously.
Murty proved [17, Theorem 1] that non-trivial vanishing does not happen for K = Q: we have δ E/Q = 0 if and only if E has full 2-torsion over Q.Over other number fields, non-trivial vanishing of δ E/K is a rare occurrence, but we can make it happen by base changing elliptic curves E defined over a small field such as Q to a well-chosen number field.
The underlying idea is an elliptic analogue of a similar construction in the multiplicative setting [7, Section 3].One starts with an elliptic curve E/K with End K (E) = End K (E), i.e., in Case 1 or Case 2, and considers E over an extension K ⊂ K ′ for which the ℓ-division fields K ′ ℓ of E over K ′ for primes ℓ 1 , ℓ 2 , and ℓ 3 are different quadratic extensions of K ′ , but with compositum K ′ ℓ1ℓ2ℓ3 a multi-quadratic extension of K ′ of degree 4, and not 8.In this case, no prime of K ′ can be inert in all three subextensions K ′ ℓ , and almost all reduced curves at primes of K ′ will have complete ℓ-torsion for at least one value ℓ ∈ {ℓ 1 , ℓ 2 , ℓ 3 }, implying that S E/K ′ is finite.The construction has many degrees of freedom.Both in Case 1 and Case 2, it leads to infinitely many different curves and number fields for which non-trivial vanishing as in (23) occurs.
Theorem 5.1.Let E/K be any elliptic curve with End K (E) = End K (E), and suppose that E has naive density A E/K > 0. Then for any finite normal extension K ⊂ M , there exists a normal extension K ⊂ K ′ that is K-linearly disjoint from M and for which δ E/K ′ vanishes non-trivially.
Proof.Let N be an integer divisible by all critical primes, as in (5).Then the N -division field K N and the ℓ-division fields K ℓ at ℓ ∤ N of E form a linearly disjoint family over K, and Gal(K ℓ /K) is isomorphic to the full group GL 2 (F ℓ ) or (O/ℓO) * , depending on whether End K (E) equals Z or O. Now let K ⊂ M be a finite normal extension, and replace K N by the compositum M K N .Then the family may no longer be K-linearly disjoint, but it becomes K-linearly disjoint again after leaving out finitely many K ℓ from the family.This is because any finite extension of K contained in the compositum of some K-linearly disjoint family of division fields K ℓ is contained in the compositum of finitely many K ℓ , and these are the ones that we leave out.Now pick any set {ℓ 1 , ℓ 2 , ℓ 3 } of odd primes that have not been left out.Then the ℓ 1 ℓ 2 ℓ 3 -division field K ℓ1ℓ2ℓ3 of E is Galois over K with group where each G i = Gal(K ℓi /K) is isomorphic to either GL 2 (F ℓi ) or to (O/ℓ i O) * .Every G i thus contains a central subgroup −1 generated by − id ℓi ∈ GL 2 (F ℓi ) or by −1 ∈ (O/ℓ i O) * , so the center of G contains an elementary abelian 2-group H ′ = 3 i=1 −1 ⊂ G of order 8.We let H ⊂ H ′ be the 'norm-1-subgroup' of order 4 consisting of elements (e i ) 3  i=1 ∈ H with e 1 e 2 e 3 = 1.Then H is normal in G, and we take for K ′ the invariant field K ′ = K H ℓ1ℓ2ℓ3 .We now view E as an elliptic curve over the finite normal extension K ′ of K, and note that the division field K ′ ℓ1ℓ2ℓ3 = K ℓ1ℓ2ℓ3 is by construction Galois over K ′ with group isomorphic to the Klein four-group H.As every non-trivial element of H is the identity on exactly one of the division fields K ′ ℓi , the three intermediate quadratic extensions of K ′ ⊂ K ′ ℓ1ℓ2ℓ3 are the division fields K ′ ℓi , and no prime of K ′ will be inert in all three of them.This implies that we have δ E/K ′ = 0.
As the naive density A E/K ′ in (9) differs from A E/K > 0 only in the three factors corresponding to the primes ℓ i , with the degree [K ℓi : K] = #G i being replaced by [K ′ ℓi : K ′ ] = 2, we still have A E/K ′ > 0, so the vanishing of δ E/K ′ is non-trivial.
Remark 5.2.Our proof of Theorem 5.1 only uses the fact that an element of order 2 is contained in Gal(K ℓi /K), and that the Klein four-group H in the proof is contained in This observation is useful when constructing an explicit example of an elliptic curve E over a 'small' normal number field K ′ for which δ E/K ′ vanishes non-trivially.In the non-CM case, if one does not insist on K ′ being normal over K = Q, one can use any element of order 2 in Gal(K ℓi /K) ⊂ GL 2 (F ℓi ) instead of − id ℓi .In all cases, one can use small primes ℓ i for which K ℓi is of small even degree.
Example 5.3.The elliptic curve E defined over K = Q by the minimal Weierstrass equation y 2 + xy + y = x 3 − 76x + 298 does not have CM, has discriminant ∆ E = −2 5 • 5 8 and, according to LMFDB [12], its mod ℓ Galois representations are maximal at ℓ = 3, 5.The division field K 3 is nonabelian of degree 6, smaller than the generic degree 48 = # GL 2 (F 3 ), and K 5 is Galois with group A 20 = C 5 ⋊ Aut(C 5 ), the affine group over F 5 of order 20, much smaller than the generic group GL 2 (F 5 ) of order 480.As the division fields K 2 and K 3 are non-abelian of degree 6 with different quadratic subfields Q( and Q(ζ 3 ), they are linearly disjoint over K = Q.As K 6 and K 5 are solvable extensions of Q maximal abelian subfields Q( √ −2, ζ 3 ) and Q(ζ 5 ) that are linearly disjoint over Q, the division fields K 2 , K 3 and K 5 are Q-linearly disjoint of even degree, so Gal(K 30 /Q) ∼ = S 3 ×S 3 ×A 20 does contain an elementary abelian 2-subgroup H ′ of order 8 as in the proof of Theorem 5.1.We can therefore find a non-normal field K ′ of degree [K ′ : Q] = 6 • 6 • 20/4 = 180 inside K 30 for which δ E/K ′ vanishes non-trivially.
) is equal to the ray class field of conductor 3 of K generated by the xcoordinates of the points of order 3 in E(K).This implies that the family of ℓ-division fields K ℓ is linearly disjoint over K, with Gal(K ℓ /K) ∼ = (O/ℓO) * for all primes ℓ = 3.
In particular, K 2 and K 5 are cyclic extensions of K of degree 2 and 24.This yields Gal(K 30 /K) ∼ = C 2 × C 2 × C 24 and, as in the previous example, we can find a field K ′ of degree [K ′ : Q] = 48 inside K 30 for which δ E0/K ′ vanishes non-trivially.
We do not know whether there exist examples of non-trivial vanishing over number fields of degree less than 48.We also do not know if there are examples that do not arise by base change, i.e., an example in which δ E/K vanishes non-trivially for K = Q(j(E)).

Numerical examples
In this final Section, we will show by examples how one may explicitly compute cyclic reduction densities.The non-CM Case 1, with which we start, is the more complicated case, as already in the simplest case K = Q, there are quite a few possibilities one may encounter for the non-generic Galois groups Gal(K ℓ /K).Moreover, as these typically non-abelian groups can be entangled in various ways, our small sample of examples can only sketch a very incomplete picture.
In order to compute the δ E/K = α E/K • A E/K as in (22) for a non-CM elliptic curve E/K, one needs explicit knowledge of finitely many Galois groups Gal(K ℓ /K) different from GL 2 (F ℓ For small examples over Q, these are listed in LMFDB [12].This list enables us to compute the naive density A E/K as a rational multiple of the elliptic non-CM Artin constant A from (8).
Finding the exact entanglement correction factor α E/K for the fields K ℓ with ℓ from the set T E/K of critical primes can be more complicated.It typically involves group theory and ramification arguments.
Over K = Q, there is a type of entanglement noticed by Serre that prevents the Galois representation on the torsion points of E/Q in all cases to be the full group GL 2 ( Z).It arises from the fact that the parity of a permutation of the three non-trivial 2-torsion points of E under Galois is given by 2 different quadratic characters on GL 2 ( Z).One is the parity map ε : GL is contained in the kernel of the character εχ D of order 2. Elliptic curves E/Q for which the image is equal to this subgroup of order 2 are known as Serre curves.Generically, elliptic curves over Q are known to be Serre curves [7], so this is by far the most common form of entanglement of division fields.
In the context of cyclic reduction, this Serre type entanglement is only relevant if ) is squarefree or, equivalently, congruent to 1 mod 4. For Serre curves, the entanglement correction factor α E/Q is therefore equal to 1 if D is even, and equal if D is odd.This follows from the character sum method [11,Theorem 8.4], which more or less mechanically produces entanglement correction factors in all cases where, in terms of Definition 3.1, the Galois group over K of the compositum K ∞ of all ℓ-division fields K ℓ is a normal subgroup Gal(K ∞ /K) ⊂ Gal(K ℓ /K) for which the quotient is finite and abelian.The simplest formula arises when the index equals 2. For K 'small enough' to be numerically accessible, such as K = Q, the degrees [K ℓ : K] going into the computation of α E/K are typically close to their maximal degree, which is of order ℓ 4 .The resulting value of α E/K in (24) is therefore often so close to 1 that the difference between the naive density A E/K and the actual cyclic reduction density δ E/K cannot be observed numerically.Clearly, only approximate correctness can be confirmed by a computer count of the fraction of primes of cyclic reduction among primes of norm below some modest bound.
For the non-CM curves E over K = Q in Table 2 below, we computed the theoretical cyclic reduction density δ E and compared it to numerically computed fraction d E (10 6 ) of the 78,498 rational primes below 10 6 for which the reduction was cyclic.In all cases, the difference |δ E − d E (10 6 )| very small: at most .0006.The curves in Table 2 are given by their minimal Weierstrass equations from LMFDB [12], with discriminant ∆ min E dividing the discriminant ∆ E of a short Weierstrass model in (15).Example 6.3.For the elliptic curve E 4 : y 2 = x 3 − 3x + 1 the splitting field K 2 of the polynomial x 3 − 3x + 1 is the real subfield ), which is cubic, and not of maximal degree 6.As all other K ℓ have maximal degree, the naive density equals • A ≈ 0.6510015.
The group Gal(K 3 /Q) ∼ = GL 2 (F 3 ) has no quotient of order 3, so the division field K 6 is a linearly disjoint compositum of K 2 and K 3 .We have K 6 ∩ K 5 = K as the intersection is solvable over K, but does not contain √ 5 / ∈ K 6 .We can take N = 2 • 3 • 5 in Theorem 3.2, so we find that the family of ℓ-division fields K ℓ is Q-linearly disjoint, and that δ E4 equals the naive density A E4 .The numerical agreement is excellent.
We can take N = 2 • 3 • 5 • 11 in Theorem 3.2.As K 2 is not the unique quadratic subfield Q(ζ 3 ) of K 3 , the extension K 6 is a linearly disjoint compositum of K 2 and K 3 .Again, K 6 is solvable and does not contain √ 5, so it is linearly disjoint from K 5 .The family of division fields {K ℓ } ℓ =11 is linearly disjoint over Q, and ) is a quadratic subfield of K 11 : the familiar Serre-type entanglement.In this case multiplying A E5 by α E5 according to (24) amounts to leaving out the Euler factor 1 − 1/[K 11 : Q] = 13199 13200 from A E5 : any prime that does not split completely in K 2 automatically does not do so in K 11 , making the non-splitting condition in K 11 for primes of cyclic reduction superfluous.The resulting value δ E5 = 13200 13199 A E5 ≈ 0.4882881 is too close to A E5 to detect the entanglement correction numerically.
Example 6.5.The entanglement correction can be made numerically visible by selecting a curve such as E 6 : y 2 = x(x 2 + x + 7), which has K 2 = Q( √ −3) equal to the quadratic subfield of K 3 rather than of K 11 , and a rational 3-torsion point (1, 3) that causes K 3 = K 6 to be of degree 6.There is no further entanglement, so the correction factor α E6 = 6 5 = 1.2 removing the Euler factor at 3 makes the naive density A E6 = 24 47 A ≈ .42very different from the actual density ∆ E6 = 144 235 A ≈ .50.Example 6.6.Our final example E 7 shows that for non-CM curves, small division fields K ℓ at small ℓ yield cyclic reduction densities that are very far from the 'generic density' A of about .81.In the case of E 7 , both K 2 = Q( √ 2) and K 3 = Q( √ −3) are quadratic and

Example 4 .Proposition 4 . 2 .
1 illustrates the much more general phenomenon concerning the relation between the CM-field F and the ℓ-division fields K ℓ .Suppose that E/K has CM-order O and CM-field F .Then (1) the ℓ-division field K ℓ contains F for all primes ℓ 3; (2) the 2-division field K 2 equals KF for ∆(O) ≡ 1 mod 8; (3) the 2-division field K 2 contains F for ∆(O) ≡ 5 mod 8; (4) for F ⊂ K and ∆(O) ≡ 0 mod 4, the 2-division field K 2 only contains F in the special case ∆(O) = −4, with E admitting a Weierstrass model Y 2 = X 3 + aX with a ∈ K * 2 .
From the theory of complex multiplication, we obtain the diagram of fields below in the generic case O * = {±1}.In this diagram LF = F (j E ) = F (j(O)) is the ring class field H O of O, with Galois group Cl(O) over F .It is unramified over F outside the conductor of O, and unramified over Q outside ∆(O).As we have O * = {±1}, the ray class field H 2,O of conductor 2 of the order O has Galois group (O/2O) * over H O .It can be obtained as the compositum

Example 6 . 1 .Example 6 . 2 .
The curves E 1 and E 2 are more or less arbitrarily chosen Serre curves from LMFDB, withD i = disc(Q( ∆ Ei )) equal to D 1 = −2 2 • 29 and D 2 = −13 • 19.We omit the full proof that E 1 and E 2 are indeed Serre curves.In the first case we have cyclic reduction density δ E1/Q = A, in the second case we have to multiply A by an entanglement correction factorα E2 = 1 + ℓ|2•13•19 −1 [K ℓ : Q] − 1 ≈ 0.999999999938, that is numerically invisible in δ E2 ≈ A. The curve E 3 with discriminant ∆ E = −2 5 • 5 8 appeared in Example 5.3, where we proved that the family of division fields K ℓ is linearly disjoint over Q, with [K 3 : Q] = 6 and [K 5 : Q] = 20 having smaller degrees over Q than the generic values 48 and 480.Changing the corresponding Euler factors in A yields a naive density the actual density δ E3 and is in good numerical agreement with d E3 .
In cases ofTheorem 1.4where δ E/KF vanishes but δ ss E/K does not, we obtain examples such as Example 1.3 where δ E/K is rational and cyclicity of reduction modulo p only depends on the splitting of p in K ⊂ K 2 .