Supersingular zeros of divisor polynomials of elliptic curves of prime conductor

For a prime number $p$ we study the zeros modulo $p$ of divisor polynomials of rational elliptic curves $E$ of conductor $p$. Ono made the observation that these zeros of are often $j$-invariants of supersingular elliptic curves over $\overline{\mathbb{F}_p}$. We show that these supersingular zeros are in bijection with zeros modulo $p$ of an associated quaternionic modular form $v_E$. This allows us to prove that if the root number of $E$ is $-1$ then all supersingular $j$-invariants of elliptic curves defined over $\mathbb{F}_{p}$ are zeros of the corresponding divisor polynomial. If the root number is $1$ we study the discrepancy between rank $0$ and higher rank elliptic curves, as in the latter case the amount of supersingular zeros in $\mathbb{F}_p$ seems to be larger. In order to partially explain this phenomenon, we conjecture that when $E$ has positive rank the values of the coefficients of $v_E$ corresponding to supersingular elliptic curves defined over $\mathbb{F}_p$ are even. We prove this conjecture in the case when the discriminant of $E$ is positive, and obtain several other results that are of independent interest.

Ono [8, p. 118] made the observation that the zeros of F (F E , x) mod p ∈ F p [x] (in F p ) are often supersingular j-invariants (i.e. j-invariants of supersingular elliptic curves over F p ), and asked for an explanation for this.
In this case, the roots of F (F E83 , x) in F 83 are precisely the supersingular j-invariants that lie in F 83 .
It is worth noting that the root number of E 83 is −1. The behavior of the roots of the divisor polynomial is explained by the following theorem.
Theorem 1.1. Let E/Q be an elliptic curve of prime conductor p with root number −1, and let F (F E , x) be the corresponding divisor polynomial. If j ∈ F p is a supersingular j-invariant mod p, then F (F E , j) ≡ 0 (mod p).
If the root number of E is 1, the supersingular zeros of divisor polynomials are harder to understand. Denote by s p the number of isomorphism classes of supersingular elliptic curves defined over F p . Eichler proved that where h(−p) is the class number of the imaginary quadratic field Q( √ −p). See [4] for an excellent exposition of Eichler's work.
Denote by N p (E) the number of F p -supersingular zeros of the divisor polynomial F (F E , x), i.e.
N p = #{j : j ∈ F p , F (F E , j) ≡ 0 mod p and j is supersingular j-invariant}. Figure 1 shows the graph of the function where E ranges over all elliptic curves of root number 1 and conductor p where p < 10000. The elliptic curves of rank zero (158 of them) are colored in blue, while the elliptic curves of rank two (59 of them) are colored in red. It would be interesting to understand this data. In particular,
(2) How can we explain the difference between rank 0 and rank 2 curves?
(3) What about the outlying rank 0 curves (e.g. of conductor p = 4283 and p = 5303) with the "large" number of zeros?
Remark. It seems that there is no obvious connection between the number of F p 2 -supersingular zeros of the divisor polynomial F (F E , x) and the rank of elliptic curve E.
The key idea to study these questions is to show (following [13]) how to associate to F E a modular form v E on the quaternion algebra B over Q ramified at p and ∞. Such modular form is a function on the (finite) set of isomorphism classes of supersingular elliptic curves over F p . In order to explain this precisely we combine the expositions from [3] and [4].
Let X 0 (p) be the curve over Spec Z that is a coarse moduli space for the Γ 0 (p)-moduli problem. The geometric fiber of X 0 (p) in characteristic p is the union of two rational curves meeting at n = g +1 ordinary double points: e 1 , e 2 , . . . , e n (g is the arithmetic genus of the fibers of X 0 (p).) They are in bijective correspondence with the isomorphism classes of supersingular elliptic curves E i /F p . Denote by X the free Z-module of divisors supported on the e i . The action of Hecke correspondences on the set of e i induces an action on X . Explicitly, the action of the correspondence t m (m ≥ 1) is given by the transpose of the Brandt matrix B(m) There is a correspondence between newforms of level p and weight 2 and modular forms for the quaternion algebra B that preserves the action of the Hecke operators.
We normalize v E (up to the sign) such that the greatest common divisor of all its entries is 1. We are now able to state the following crucial theorem.
This theorem allows us to give a more explicit description of the supersingular zeros of the divisor polynomial. Furthermore it enables us to obtain computational data in a much more efficient manner. The proof of Theorems 1.1 and 1.2 will be the main goal of Section 2. In order to prove them we will use both Serre's and Katz's theory of modular forms modulo p and the modular forms introduced in [13]. Now, let D E be the congruence number of f E , i.e. the largest integer such that there exists a weight two cusp for on Γ 0 (p), with integral coefficients, which is orthogonal to f E with respect to the Petersson inner product and congruent to f E modulo D E . The congruence number is closely related to deg φ f E , the modular degree of f E , which is the degree of the minimal parametrization φ f E : X 0 (p) → E of the strong Weil elliptic curve E /Q associated to f E (E is isogenous to E but they may not be equal). In general, deg φ f E |D E , and if the conductor of E is prime, we have that deg φ f E = D E (see [1]).
The idea is to relate these concepts to the aforementioned quaternion modular form v E . Denote by w i = 1 2 #Aut(E i ). It is known that w = i w i is equal to the denominator of p−1 12 and n i=1 1 wi = p−1
We have the following theorem due to Mestre [7, Theorem 3] Theorem 1.3. Using the notation above, we have where t is the size of E(Q) tors .
We observe that the modular degree of the elliptic curves under consideration (of rank 0 or 2, conductor p, where p < 10000) is "small", which suggests that the integral vector v E will have many zero entries. This gives a partial answer to Question 1. Zagier [15, Theorem 5] proved that if we consider elliptic curves with bounded j-invariants we have On the other hand, Watkins [14,Theorem 5.1] showed that deg φ f E >> p 7/6 / log(p).
To address Questions 2 and 3 we focus on the mod 2 behavior of v E . Based on the numerical evidence we pose the following conjecture.

Conjecture 1.
If E is an elliptic curve of prime conductor p, root number 1, and rank(E) > 0, then v E (e i ) is an even number for all e i with j(E i ) ∈ F p While this is true for all 59 rank 2 curves we observed, it holds for 35 out of 158 rank 0 curves. This explains in a way a difference in the number of F p -supersingular zeros between rank 0 and rank 2 curves (Question 2), since, heuristically, it seems more likely for a number to be zero if we know it is even (especially in light of Theorem 1.3 which suggests that the numbers v E (e i ) are small.) The thirty two out of thirty five elliptic curves of rank 0 for which the conclusion of Conjecture 1 holds (the remaining three curves have conductors p = 571, 6451 and 8747) are distinguished from the other rank 0 curves by the fact that their set of real points E(R) is not connected (i.e. E has positive discriminant). In general, we have the following theorem, which will be the subject of Section 3.
Note that this gives a partial answer to Question 3 since, for example, all outlying elliptic curves of rank 0 for which Np sp > 0.5 have positive discriminant and no rational point of order 2. Note that among 59 rank 2 curves, for 25 of them E(R) is not connected (and have no rational point of order 2). For the rest of the rank 2 elliptic curves, we don't have an explanation of why they satisfy the conjecture.
Lastly, in the final section we will show how the Gross-Waldspurger formula might answer question 2. More precisely, we will show that the quaternion modular form v E associated to an elliptic curve E of rank 2 must be orthogonal to divisors arising from optimal embeddings of certain imaginary quadratic fields into maximal orders of the quaternion algebra B, leading to a larger amount of supersingular zeros.
Acknowledgments: We would like to thank the ICTP and the ICERM for provding the oportunity of working on this project. We would like to thank A. Pacetti for his comments on an early version of this draft.

2.
Proof of the main theorems 2.1. Katz's modular forms. We will recall the definition of modular forms given by Katz in [5].
Definition 2.1. A modular form of weight k ∈ Z and level 1 over a commutative ring R 0 is a rule g that assigns to every pair (Ẽ/R, ω), whereẼ is and elliptic curve over Spec(R) for R an R 0 -algebra and ω is a nowhere vanishing section of Ω 1 E/R onẼ, an element g(Ẽ/R, ω) ∈ R that satisfies the following properties: (1) g(Ẽ/R, ω) depends only on the R-isomorphism class of (Ẽ/R, ω).
The space of modular forms of weight k and level 1 over R 0 is denoted by M(R 0 , k, 1). Given any g ∈ M(R 0 , k, 1), we say that g is holomorphic at ∞ if its q-expansion, The submodule of all such elements will be denoted by M (R 0 , k, 1).
Remark. The reader should notice that the notations used here are not the same as the ones used by Katz. In the rest of the article we will only consider the case when R 0 = F p , for p ≥ 5 a prime number.
In [10] and [11] Serre considers the space of modular forms modulo p of weight k and level 1 as the space consisting of all elements of F p [[q]] that are the reduction modulo p of the q-expansions of elements in M k that have p-integer coefficients. The following proposition shows that under mild assumptions, this definition agrees with the previous definition.
Example. Given p ≥ 5, and an elliptic curveẼ/F p we can write an equation forẼ of the form It is equipped with a canonical nowhere vanishing differential ω can = dx y . • E 4 (Ẽ/F p , ω can ) := c 4 defines an element in M (F p , 4, 1) whose q-expansion is the same as the the reduction modulo p of the classical Eisenstein series E 4 . • E 6 (Ẽ/F p , ω can ) := c 6 defines an element in M (F p , 6, 1) whose q-expansion is the same as the the reduction modulo p of the classical Eisenstein series E 6 .
1728 = ∆(Ẽ) defines an element in M (F p , 12, 1) whose q-expansion is the same as the the reduction modulo p of the classical cuspform ∆.
, it only depends on the isomorphism class ofẼ.
Proof. If we evaluate ∆(Ẽ, ω can ) we recover the discriminant ofẼ. This is non-zero as, by definition, an elliptic curve is non-singular. The remaining statements are analogous.
Now we have the ingredients to prove the following proposition that relates the zeros of the divisor polynomial of E with the zeros of the modular form F E modulo p.
Proposition 2.4. GivenẼ/F p an elliptic curve with a nowhere vanishing invariant differential ω we have that Proof. Suppose that j(Ẽ) = 0, 1728. Consider It can be evaluated at pairs (Ẽ, ω), but since it is has weight zero it depends only on the isomorphism class ofẼ. Therefore it only depends on the j-invariant of the elliptic curve. Note that by Proposition 2.3 the denominator does not vanish and the result follows. If j = 0 or j = 1728 an analogous argument shows the proposition, as , and h k takes into account the vanishing of these special j-invariants.

2.2.
The spaces S(F p , k, 1). Following [13], we introduce a definition: Definition 2.5. S(F p , k, 1) is the space of rules g that assign to every pair (Ẽ/F p , ω), whereẼ is a supersingular elliptic curve and ω is a nowhere vanishing differential onẼ, an element g(Ẽ/F p , ω) ∈ F p that satisfies the same properties as in Definition 2.1.
Definition 2.6. For = p a prime number we define the Hecke operator T acting on S(F p , k, 1) as where the sum is taken over the + 1 subgroups ofẼ of order and π C :Ẽ →Ẽ/C is the corresponding isogeny.
Proposition 2.7. We have a natural inclusion M (F p , k, 1) ⊂ S(F p , k, 1). If g ∈ M (F p , k, 1) is an eigenform for the Hecke operators T ( = p) with eigenvalues a ∈ F p , then, the image of g in S(F p , k, 1) is an eigenform for the Hecke operators with the same eigenvalues a .
Proof. This is clear from the definitions.
We have the following proposition that allows us to shift from weight p + 1 to weight 0. Proposition 2.8 ([9], Lemma 6). The map from S(F p , 0, 1) → S(F p , p + 1, 1) given by multiplication by E p+1 induces an isomorphism of Hecke modules where S(F p , 0, 1)[1] denotes the Tate twist. More precisely we have that for all g ∈ S(F p , 0, 1), If we consider the isobaric polynomials A, B such that A(E 4 , E 6 ) = E p−1 and B(E 4 , E 6 ) = E p+1 , the reductionsÃ,B have no common factor ([10, Corollary 1 of Theorem 5]). Since E p−1 vanishes at supersingular elliptic curves we obtain that E p+1 does not vanish at supersingular elliptic curves over F p .
The reduction modulo p of F E can be regarded as an element of S(F p , p + 1, 1), and by the above remarks we can consider Combining these results with Proposition 2.4 we obtain the following result. Proposition 2.9. GivenẼ/F p a supersingular elliptic curve with a nowhere vanishing invariant differential ω we have that Finally, we state a proposition that will be useful later.
Proposition 2.10. The element F E ∈ S(F p , 0, 1) [1] has the same eigenvalues for T ( = p) as F E . In addition, it has the same eigenvalues modulo p as f E .
Proof. The first part follows from Proposition 2.8 while the second part follows from the discussion given in the introduction.

2.3.
Modular forms on quaternion algebras. We will recall some of the results previously stated in the introduction. This exposition follows entirely the fundamental work of Gross [4]. The geometric fiber of the curve X 0 (p) in characteristic p is the union of two rational curves meeting at n ordinary double points: e 1 , e 2 , . . . , e n that are in bijective correspondence with the isomorphism classes of supersingular elliptic curves E i . Recall that X is the free Z-module of divisors supported on the e i with a Z-bilinear pairing , : X × X → Z, given by e i , e j = w i δ i,j for all i, j ∈ {1, . . . , n}, where w i Let M 2 be the Z-module consisting of holomorphic modular forms for the group Γ 0 (p) such that when we consider its q-expansion, all coefficients are integers except maybe the coefficient a 0 which is only required to be in Z[1/2]. The Hecke algebra T = Z[· · · , T m , · · · ] acts on M 2 by the classical formulas. Moreover, we have that as endomorphisms of M 2 where W p is the Atkin-Lehner involution. In addition, the map given by T m → t m defines an isomorphism of Hecke algebras.

Now we can define
to be an eigenvector for all t m corresponding to f E , i.e. t m v E = a(m)v E , where f E (τ ) = ∞ m=1 a(m)q m . We normalize v E (up to the sign) such that the greatest common divisor of all its entries is 1. The key observation is that v E has the same eigenvalues modulo p as F E .

The rule
can be evaluated at supersingular elliptic curves over F p (it has weight zero), and by duality, it defines an element F E * ∈ X , where X is the reduction modulo p of X . Proof. By Proposition 2.10, F E has the same eigenvalues as F E for T ( = p), but with the action twisted. Note that t and the action of T on S(F p , 0, 1) differ by precisely this factor , therefore the result follows since v E has the same eigenvalues modulo p as F E and the pairing is Hecke-linear.
have the same eigenvalues for T ( = p) by Proposition 2.12. By the work of Emerton [3, Theorem 0.5 and Theorem 1.14] we have the multiplicity one property for X modulo p, since p is a prime different from 2.
Therefore, up to a non-zero scaling, the coefficients of these two quaternion modular forms agree modulo p. Finally, noting that the w i are not divisible by p, the result follows. Now we are in position to prove Theorem 1.2.
The first equivalence is Corollary 2.13; the last one is Proposition 2.9.  Proof of Theorem 1.1. Let E i be a supersingular elliptic curve with j(E i ) ∈ F p . The operator t p acts as −W p on M 2 and since the elliptic curve has root number −1 we get that t p acts as −1. By Proposition 2.14 we have that t p e i = e i , hence v E (e i ) = 0, and the result follows from Theorem 1.2.

Proof of Theorem 1.4
3.1. Some basic properties of Brandt matrices. Following [4], we will recall some useful properties of Brandt matrices. Let B be the quaternion algebra over Q ramified at p and ∞. For each i = 1, . . . , n let R i be a maximal order of B such that R i ∼ = End(E i ). Set R = R 1 and let {I 1 , . . . , I n } be a set of left R-ideals representing different R-ideal classes, with I 1 = R. We can choose the I i 's such that the right order of I i is equal to R i . For 1 ≤ i, j ≤ n, define M ij = I −1 j I i ; this is a left R i -module and a right R j -module. The Brandt matrix of degree m, B(m) = (B ij (m)) 1≤i,j≤n , is defined by the formula where Nr(b) is the reduced norm of b, and Nr(M ij ) is the unique positive rational number such that the quotients Nr(b) Nr(Mij) are all integers with no common factor. Alternatively, M ij ∼ = Hom Fp (E i , E j ) and B i,j (m) is equal to the number of subgroup schemes C of order m in E i such that E i /C E j [4, Proposition 2.3].
Following the discussion before 2.14 we can state the following results.
Proposition 3.1. We have the equality v E (e j ) = λ p v E (ej). In particular, v E (e j ) and v E (ej) have the same parity.
Proof. The first assertion follows from the fact that i v E (e i )e i is an eigenvector for the action of t p and Proposition 2.14. The last assertion follows from the fact that λ p = ±1. Using Proposition 2.14 we know that B k (p) = δk , in consequence we have B ij (m) = Bīj(m), as we wanted. Proof. Let φ i ∈ R i ∼ = End(E i ) and φ j ∈ R j ∼ = End(E j ) be the Frobenius endomorphisms of the elliptic curves E i and E j respectively (they exist since E i ∼ = E p i and E j ∼ = E p j ). These are trace zero elements of reduced norm p, i.e. φ 2 i = φ 2 j = −p. Consider the map Θ : B → B given by Note that Θ 2 = Id, and Nr(Θ(f)) = Nr(f). First we prove that Θ(M ij ) ⊂ M ij . Take f ∈ Hom(E i , E j ) and consider Since the inseparable degree of g is divisible by Next, we show that Θ has two eigenspaces W − and W + of dimension 2 with eigenvalues −1 and 1 respectively. We consider two cases: a) i = j (i.e. M ij = R i ) Direct calculation shows that the vectors 1 and φ i span the eigenspace with eigenvalue 1. The eigenspace with eigenvalue −1 is the orthogonal complement of φ i in the trace zero subspace For b ∈ M ij let w 1 ∈ W − and w 2 ∈ W + be such that b = w 1 + w 2 . Then Θ(b) = −w 1 + w 2 ∈ M ij , and 2w 1 , In order to prove that B ij (l) is even, it is enough to show that for every b ∈ M ij such that Nr(b) Nr(Mij) = l the set has maximal cardinality #C = 4w j (note that all elements of C have the same norm.) It is enough to prove that b is not an eigenvector of Θ. Let a ∈ Z be such that M is an integral quadratic form on I which is in the same genus as (R j , Nr). In particular, disc(q I ) = p 2 . Moreover, q(x) := q I (ax) is a quadratic form on M ij for which q(x) = Nr(x) Nr(Mij) (Nr(M ij ) = 1 M ). Since Θ preserves reduced norm, the lattices V + and V − are orthogonal with respect to q, and and q is a positive definite form. Assume that b is an eigenvector of Θ. Then b ∈ V + or b ∈ V − . In any case since l = q(b), it follows that l is representable by a binary quadratic form of discriminant −p or −4p which is not possible
Proposition 3.4. Let E/Q be an elliptic curve of prime conductor p such that E has positive discriminant and E has no rational point of order 2. There is a positive proportion of odd primes such that −p = −1 and a( ) ≡ 1 (mod 2), where f E (τ ) = a(n)q n is the q-expansion of f E (τ ).
Proof. Denote by ρ 2 : Gal(Q/Q) → GL 2 (F 2 ) the mod 2 Galois representation attached to the elliptic curve E (or equivalently, by the modularity theorem, to the modular form f E ). For an odd prime = p, we have that a( ) ≡ Tr(ρ 2 (F rob )) mod 2, where F rob is a Frobenius element over . The group GL 2 (F 2 ) is isomorphic to S 3 , and the elements of trace 1 are exactly the elements of order 3. ρ 2 factors through Gal(K/Q), and Gal(K/Q) ∼ = (ρ 2 ) where K = Q(E [2]). It is enough to prove that there is a positive proportion of prime numbers such that −p = −1 and F rob ∈ Gal(K/Q) has order 3. Since E has no rational point of order 2, Gal(K/Q) is either Z/3Z (if the discriminant of E is a square) or S 3 . Moreover, since E has prime conductor and no rational two torsion, it follows from Proposition 7 in [12] that the absolute value of the discriminant is not a square. Hence, K/Q is an S 3 extension, and since the discriminant is positive and its only prime divisor can be p, the quadratic field F contained in K is equal to Q( √ p).
If ≡ 3 (mod 4) then −p = −1 implies that splits in F . If, in addition, does not split completely in K, then the order of F rob is 3 and a( ) is odd. There is a positive proportion of such primes since by Chebotarev density theorem (applied to the field L = Q( √ −1)K) there is a positive proportion of primes which are inert in Q( √ −1), split in F and do not split completely in K.

Proof of Theorem 1.4.
Proof. Take an odd prime such that −p = −1 and a( ) ≡ 1 (mod 2) as in Proposition 3.4. Consider the action of t on i v E (e i )e i . Take any j ∈ S p , that isj = j. By comparing the coefficient of e j in the equation We are going to look at this equation modulo 2; we know that λ = + 1 − a is odd and we know by Proposition 3.3 that for any i ∈ S p , B ij ( ) is even. Therefore, Proposition 3.2 tells us that B ij ( ) = Bīj( ) = Bī j ( ) as j =j. Moreover, by Proposition 3.1, the numbers v E (e i ) and v E (eī) have the same parity. Therefore, rearranging the elements of the sum i ∈Sp v E (e i )B ij ( ) in conjugated pairs, we obtain that this sum is zero modulo 2. In conclusion we must have v E (e j ) ≡ 0 mod 2, as we wanted to prove.
We are going to give a different proof of Theorem 1.4 under the additional assumption that E is supersingular at 2. The idea is to use the results of [6] on level raising modulo 2 together with the multiplicity one mod 2 results from [3] to obtain mod 2 congruences between modular forms of the same level p, but with different signs of the Atkin-Lehner involution. We hope that by extending these ideas to level 2 r p one will be able to understand Conjecture 1 better.
Theorem 3.5. Let E be a rational elliptic curve of conductor p, without rational 2-torsion and with positive discriminant. Suppose further that E is supersingular at 2 . Then, there exists a newform g ∈ S 2 (Γ 0 (p)) and a prime λ above two in the field of coefficients of g such that f ≡ g mod λ and such that W p acts as −1 on g.
Proof. We will verify the assumptions of [6, Theorem 2.9], starting with our elliptic curve E of prime conductor and in the scenario where we choose no primes as level raising primes (so we are looking for a congruence between level p newforms). As we explained before, the hypotheses imply that ρ 2 : G Q → Gl 2 (F 2 ) is surjective and the only quadratic extension of Q(E [2]) is given by Q( √ p).
Therefore, the conductor of ρ 2 is p and it is not induced from Q(i). Moreover ρ 2 restricted to G Q2 is not trivial if E is supersingular at 2. Thus, we are in position to use the theorem and find a g as in the statement, because, since ∆(E) > 0, we can prescribe the sign of the Atkin-Lehner involution at p.
Now we are in condition to give another proof of Theorem 1.4, under the additional assumption that E is supersingular at 2. Since g has eigenvalue −1 for the Atkin-Lehner operator we have that v g (e i ) = 0 for every i ∈ S p by Proposition 2.14. As we did earlier, Theorem 0.5 and Theorem 1.14 in [3] imply, since E is supersingular at 2, that we have multiplicity one mod 2 in the f E -isotypical component in X , therefore v E (e i ) is even for i ∈ S p as we wanted to show.

Further remarks
Suppose that E is an elliptic curve with root number +1 and positive rank. By Gross-Zagier-Kolyvagin we must have L(E, 1) = 0 and we can use Gross-Waldspurger formula to obtain some relations satisfied by the v E (e i ). More precisely if we take −D a fundamental negative discriminant define where ε D is the quadratic character associated to −D, (f E , f E ) is the Petersson inner product on Γ 0 (p) and m D = v E , b D .
Since L(E, 1) = 0 we obtain that m D = v E , b D = 0. This says that, as we vary throughout all D as in the proposition, we obtain some relations that are satisfied by the v E (e i ) that make them more likely to be zero. For example, if we take a fundamental discriminant of class number 1 such that p is inert in that field, then the divisor b D is supported in only one e i with i ∈ S p . Since the inner product between b D and v E is zero we get that v E (e i ) = 0. This certainly explains a lot of the vanishing that is occurring in our setting, specially considering that the range we are looking into is not very large. One could hope to make these heuristics more precise by analyzing imaginary quadratic fields with small size compared to the degree of the modular parametrization (this measures the norm of v E ) and try to obtain explicit lower bounds on the number of zeros in this situation.