LANG-TROTTER REVISITED Dedicated to the memory ... - CiteSeerX

LANG-TROTTER REVISITED 3has no integer solutions because it has no R solutions; the equationx 2 + y 2 = 691,and more generally any equation of the formx 2 + y 2 = 4n + 3,has no integer solutions because it has no solutions mod 4; and theequationy 2 + x 4 + 2 = 0has no integer solutions both because it has no R solutions and becauseit has no mod 5 solutions.Even in the possible presence of an archimedean obstruction, it canstill be interesting to ask, given f, modulo which primes p the equationf = 0 has an F p solution. For example, the study of the equation inone variablex 2 + 1 = 0,mod odd primes p, amounts to the determination of the “quadraticcharacter of −1 mod p”, and led Euler to the theorem, already stateda century earlier by Fermat, that all primes of the form 4n + 1, butnone of the form 4n − 1, are sums of two squares. In this example, thenumber N p of mod p solutions is either 0 or 2; if we writeN p = 1 + a pthen a p = ±1, and the result is that a p = 1 if p is of the form 4n + 1,and a p = −1 if p is of the form 4n − 1.Still with this x 2 + 1 = 0 example, we might ask whether a p = 1(resp. a p = −1) holds for infinitely many primes. That it does, forboth choices of sign, amounts to the special case of Dirichlet’s theorem,that there are infinitely many primes in each of the two arithmeticprogressions 4n ± 1.Now let us consider an equation in two variables. For simplicity, wetake it to be of the formy 2 = h(x)with h(x) ∈ Z[x] monic of some odd degree 2g+1, such that h has 2g+1distinct zeroes in C. The C solutions, together with a single “point at∞”, form a compact Riemann surface of genus g. The discriminant∆ ∈ Z of the polynomial h(x) is nonzero. For any “good” prime,i.e., any odd prime p which does not divide ∆, the F p -solutions of thisequation, together with a single “point at ∞”, form the F p points C(F p )

4 NICHOLAS M. KATZof a (projective, smooth, geometrically connected) curve C/F p of genusg over F p . In this case, for each good prime p we have#C(F p ) = 1 + #{F p solutions of y 2 = h(x)}and we define the integers a p by#C(F p ) = p + 1 − a p .In the x 2 +1 example with its a p , we knew a priori that a p was either±1, and the two questions were a) how a p depended on p and b) werethere infinitely many p with a given choice of a p .In the curve case, we almost never know a “simple” rule for how a pdepends on p (short of literally computing it for each given p, more orless cleverly). We do have an archimedean bound, the celebrated Weilbound|a p | ≤ 2g √ p.And since a curve cannot have a negative number of points, we havethe archimedean inequalitya p ≤ p + 1,which for large genus g and small prime p, say 2g > √ p, does not followfrom the Weil bound.What else do we know about the numbers a p for a given curve?Remarkably little (outside the trivial case of genus g = 0, where alla p vanish), but there are a plethora of open problems and conjecturesabout them, some of which have strikingly elementary formulations, orat least consequences which have strikingly elementary formulations.Here is one example of an easy-to-state open problem. Suppose weare given the numbers a p /p 1/2 for all good p, but are not told whatcurve they came from, or even its genus. By the Weil bound, we havea p /p 1/2 ∈ [−2g, 2g].Is it true that we can recover 2g as the limsup of the numbers |a p |/p 1/2 ?Or weaker, is it true that the inequality|a p |/p 1/2 > 2g − 2holds for infinitely many p? Weaker yet, does it hold for at least onegood p? If this were the case, then 2g would be the smallest eveninteger such that |a p |/p 1/2 ≤ 2g for all good p.The truth of the strong form, that 2g is the limsup of the numbers|a p |/p 1/2 , is implied by a general Sato-Tate conjecture about the realnumbers a p /p 1/2 attached to a curve C of genus g ≥ 1. To formulateit, denote by USp(2g) ⊂ Sp(2g, C) a maximal compact subgroupof the complex symplectic group. [So USp(2) is just SU(2).] The

LANG-TROTTER REVISITED 5conjecture 5 is that for a given curve C there is a compact subgroupK ⊂ USp(2g) with the property that, roughly speaking, the numbersa p /p 1/2 are distributed like the traces of random elements of K. Moreprecisely, denote by dk the Haar measure on K of total mass one, anddenote byTrace : K → [−2g, 2g]the trace map, for the tautological 2g-dimensional representation of K.Any continuous functionF : [−2g, 2g] → Cgives rise to a continuous function on K by k ↦→ F (Trace(k)), so wecan form the integral∫F (Trace(k))dk.KThe conjecture is that for any such F , we can compute this integral byaveraging F over more and more of the a p /p 1/2 ; i.e., we have the limitformula∑good p≤Tlim F (a p/p 1/2 ∫)T →∞ = F (Trace(k))dk.#{ good p ≤ T}If Sato-Tate holds for C, then we will recover 2g as the limsup of thenumbers |a p |/p 1/2 . Given a real ɛ > 0, take for F a continuous R-valuedfunction on [−2g, 2g] which is nonnegative, supported in [2g−ɛ, 2g] andidentically 1 on [2g − ɛ/2, 2g]. [For instance, take F piecewise linear.]Because the setU ɛ/2 := {k ∈ K|Trace(k) > 2g − ɛ/2}is an open neighborhood of the identity element, it has strictly positiveHaar measure, and therefore the integral ∫ K F (Trace(k))dk ≥∫U ɛ/2F (Trace(k))dk = ∫ U ɛ/2dk > 0. So if Sato-Tate holds, there mustbe infinitely many p for which |a p |/p 1/2 ≥ 2g − ɛ.The Sato-Tate conjecture is now known for all elliptic curves over Qwhose j-invariant is not an integer, where the group K is SU(2) itself[H-SB-T, Thm. A], and is expected to hold, still with K = SU(2), solong as the curve does not have complex multiplication. It has beenknow for elliptic curves over Q with complex multiplication for over5 Strictly speaking, what we are formulating is “merely” the consequence fortraces of the actual Sato-Tate conjecture, which asserts the equidistribution ofunitarized Frobenius conjugacy classes in the space K # of conjugacy classes ofK, with respect to Haar measure, cf. [Se-Mot, 13.5]. Only in genus 1 are theyequivalent.K

6 NICHOLAS M. KATZfifty years, thanks to work of Deuring [Deu-CM] and Hecke [He]. Inthe CM case, the K is the normalizer in SU(2) of its maximal torus.In higher genus, Sato-Tate is hardly ever known 6 . For certain hyperellipticcurves y 2 = h(x) as above, we can be more precise in itsformulation. Denote by G the galois group of (the splitting field L/Qof) the polynomial h(x). If g ≥ 2 and if G is either the full symmetricgroup S 2g+1 or the alternating group A 2g+1 , then Sato-Tate should 7hold, with K = USp(2g).Now let us turn to considering, for a given curve C, the integers a pthemselves. Here we ask two questions. First, for which integers A willwe have A = a p for infinitely many p? Second, for an A which doesoccur as a p for infinitely many p, give an asymptotic formula for thenumber of p up to X for which A = a p .Of course these same questions make sense for other naturally occurringsequences of integers a p . For example, if we take, instead of acurve, a projective smooth hypersurface H ⊂ P n+1 of degree d, thenfor good primes p we define integers a p byn∑#H(F p ) = p i + a p .i=0Here the Weil bound is replaced by Deligne’s bound|a p | ≤ prim(n, d)p n/2 ,with prim(n,d) the constant ((d − 1)/d)((d − 1) n+1 − (−1) n+1 ).Or we might wish to consider the sequence a p = τ(p), where Ramanujan’sτ(n) are the coefficients inq ∏ (1 − q n ) 24 = ∑n≥1n≥1τ(n)q n .6 However, it is (trivially) known for a genus 2 curve whose Jacobian is isogenousto E × E, for an elliptic curve E for which Sato-Tate is known. For example,take h(x) = x 3 + λ(x 2 + x) + 1 to be a palindromic cubic with all distinct roots,i.e., λ ≠ −1, 3. Then C:=(the complete nonsingular model of) y 2 = h(x 2 ) hasits Jacobian isogenous to E × E for E the elliptic curve of equation y 2 = h(x),by the two maps C → E given by (x, y) ↦→ (x 2 , y) and (x, y) ↦→ (1/x 2 , y/x 3 ). Inparticular, for each good p, the a p ’s of these curves are related by a p,C = 2a p,E .This last identity has an elementary proof.7 There is a conjectural description of K in terms of the l-adic representationsattached to C, and having K = USp(2g) is conjecturally equivalent to theproperty that for every l, the l-adic representation has a Zariski-dense image inGSp(2g, Q l ).That this property holds for the curves y 2 = h(x) whose G is eitherS 2g+1 or A 2g+1 is a striking result of Zarhin [Z]

Here we have Deligne’s boundLANG-TROTTER REVISITED 7|a p | ≤ 2p 11/2 .The Lang-Trotter approach to these question is based in part on asimple probabilistic model. For each (good) prime p, we have an integera p in a finite setX p ⊂ Z.In the curve case, X p = Z ∩ [−2g √ p, 2g √ p]. In the hypersurface case,X p = Z ∩ [−prim(n, d)p n/2 , prim(n, d)p n/2 ]. In the Ramanujan τ case,X p = Z ∩ [−2p 11/2 , 2p 11/2 ].The sets X p are increasing, in the sense that X p1 ⊂ X p2 ⊂ Z ifp 1 ≤ p 2 , and their union, in this simple model, is all of Z. Our collectionof a p is an element in the product spaceX := ∏X p .good pWe endow each X p with counting measure, normalized to have totalmass one; i.e., each point x p in X p has mass 1/#X p .We then endow X with the product measure. The basic idea is that,in the absence of any special information, the particular element (a p ) pof X should behave like a “random” element of X, in the sense that any“reasonable” property of elements of X which holds on a set of measureone should hold for the particular element (a p ) p . For example, fix aninteger A, and consider the set of points x = (x p ) p ∈ X which havethe property that A = x p for infinitely many p. If this set has measureone, then we will “expect” that A = a p for infinitely many p. And iffor some explicit function g : R >0 → R >0 , the set of x = (x p ) p ∈ X forwhich the asymptotic formula#{p ≤ T |A = x p } ∼ g(T ) as T → ∞holds is a set of measure one, then we “expect” that we have the asymptoticformula#{p ≤ T |A = a p } ∼ g(T ) as T → ∞.Let us recall the basic results which address these questions.Lemma 1.1. Fix A ∈ Z. The following properties are equivalent.(1) The set of points x = (x p ) p ∈ X which have the property thatA = x p for infinitely many p has measure one.(2) The series ∑ p 1/#X p diverges.

8 NICHOLAS M. KATZProof. Given A, consider the set Z A ⊂ X of those x = (x p ) p ∈ Xfor which A = x p holds for only finitely many p. So (1) for A isthe statement that this set Z A has measure zero. This set Z A is theincreasing union of the setsZ n,A := {x ∈ X|x p ≠ A ∀p ≥ p n }.So Z A has measure zero if and only if each Z n,A has measure zero. Butthe measure of Z n,A is the product ∏ p≥p n(1 − 1/#X p ), which is zero ifand only (2) holds.□As a special case of the strong law of large numbers, we get a quantitativeversion of the previous result.Lemma 1.2. Suppose the series ∑ p 1/#X p diverges. Fix an integerA, and an increasing sequence b p of positive real numbers with b p → ∞such that the series ∑ p 1/#X p(b p ) 2 converges. Then for x ∈ X in aset of measure one, we have#{p ≤ p n |x p = A} = ∑ p≤p n1/#X p + o(b pn ).Proof. This is the strong law of large numbers [Ito, Thm. 4.5.1], appliedto the independent sequence of L 2 functions {f p } p on X given byf p (x) := δ xp,A. The mean E(f p ) of f p is 1/#X p , and its variance V (f p )is bounded above by 1/#X p + 1/(#X p ) 2 ≤ 2/#X p . So by hypothesisthe series ∑ p V (f p)/b 2 p converges. Then the strong law of largenumbers tells us that on a set of measure one, we havelim n→∞ (1/b pn ) ∑ p≤p n(f p − E(f p )) = 0.Making explicit the f p , we recover the assertion of the lemma.□Let us see what this gives in the cases we have looked at above.In the case of a curve C, we have #X p ∼ 4g √ p. The series ∑ p 1/√ pdiverges, and one knows that∑1/ √ p ∼ √ T / log T.p≤THere we can take b p = p (1+ɛ)/4 for any fixed real ɛ > 0. So we get#{p ≤ T |x p = A} = ∑ p≤T1/#X p + o(T (1+ɛ)/4 ) ∼ √ T /4g log Ton a set of measure one.

LANG-TROTTER REVISITED 9In the case of a smooth hypersurface of dimension n, we have #X p ∼2prim(n, d)p n/2 . So for n ≥ 3, the series ∑ p 1/#X p converges. Similarlyfor the Ramanujan τ, we have #X p ∼ 2p 11/2 , and again the series∑p 1/#X p converges. So in both these cases we don’t expect any A tooccur as a p infinitely often.The remaining example case is that of a smooth surface in P 3 . Here#X p ∼ 2prim(2, d)p, so the series ∑ p 1/#X p diverges, but very slowly:one knows that ∑1/p ∼ log log T .p≤TSo while the probabilistic heuristic suggests that a given A might occurinfinitely often as an a p , it also suggests that no computer experimentcould ever convince us of this.Let us now return to the case of a (projective, smooth, geometricallyconnected) curve C/Q, and introduce the second heuristic on whichthe Lang-Trotter approach is based. This is the notion of a congruenceobstruction. If a given integer A occurs as a p for infinitely many p,then whatever the modulus N ≥ 2, the congruence A ≡ a p mod N willhold for infinitely many p.Here is the simplest example of a congruence obstruction. Take ahyperelliptic curve C of equation y 2 = h(x) with h(x) ∈ Z[x] monicof degree 2g + 1 ≥ 3, with 2g + 1 distinct roots in C. Suppose inaddition that all these 2g + 1 roots lie in Z. Then for any good (sonecessarily odd) p, a p will be even. [Here is the elementary proof, basedon the character sum formula for a p . Denote by χ quad,p the quadraticcharacter χ quad,p : F × p → ±1, (so χ quad,p takes the value 1 precisely onsquares) and extend it to all of F p by setting χ quad,p (0) := 0. Then forany b ∈ F p , 1 + χ quad,p (b) is the number of square roots of b in F p . Sothe number of F p points on C is1(the point at ∞) + ∑ x∈F p(1 + χ quad,p (h(x))) = p + 1 + ∑ x∈F pχ quad,p (h(x)).So we have the formulaa p = − ∑ x∈F pχ quad,p (h(x)).In this formula, the reductions mod p of the 2g + 1 roots of h are the2g + 1 distinct (because p is a good prime) elements of F p at which hmod p vanishes; at all other points of F p , h is nonzero. So a p is thesum of an even number p − (2g + 1) of nonzero terms, each ±1, so iseven.] So in this example, no odd integer A can ever be an a p for agood prime p.

10 NICHOLAS M. KATZIn the special case of an elliptic curve E/Q, say with good reductionoutside of some ∆, there is another visible source of congruence obstructions,namely torsion points, based on the fact that the set E(Q)has the structure of an abelian group. Suppose that the group E(Q)contains a point P of finite order N ≥ 2. For every odd prime p notdividing ∆, it makes sense to reduce this point mod p, and we obtaina point of the same order N in E(F p ). Therefore N divides #E(F p ),so we have the congruencea p ≡ p + 1 mod N.From this congruence, we see that among odd primes p not dividing∆, A = 1 can never occur as a p unless N|p, i.e., unless N is itself anodd prime, in which case we might have a p = 1 for p = N, but for noother, cf. [Maz, pp. 186-188].Let us explain briefly the general mechanism by which congruenceobstructions arise. Taking for ∆ the product of the primes which arebad for our curve C, we get a proper smooth curve C/Z[1/∆]. Foreach integer N ≥ 2, we have the “mod N representation” attached toC/Q, or more precisely to its Jacobian Jac(C)/Q. This is the actionof Gal(Q/Q) on the group Jac(C)(Q)[N] of points of order dividingN. This group is noncanonically (Z/NZ) 2g , and it is endowed with aGalois-equivariant alternating autoduality toward the group µ N (Q) ofN’th roots of unity. Because C is a proper smooth curve C/Z[1/∆], themod N representation is unramified outside of N∆, so we may view itas a homomorphismρ N : π 1 (Spec(Z[1/N∆])) → GSp(2g, Z/NZ)toward the group GSp(2g, Z/NZ) of mod N symplectic similitudes.The key compatibility is that for any prime p not dividing N∆, thearithmetic Frobenius conjugacy classhasF rob p ∈ π 1 (Spec(Z[1/N∆]))Trace(ρ N (F rob p )) ≡ a p mod N, det(ρ N (F rob p )) ≡ p mod N.Now consider the image group Im(ρ N ) ⊂ GSp(2g, Z/NZ). If this groupcontains at least one element whose trace is A mod N, then by Chebotarevthe set of primes p not dividing N∆ for which a p ≡ A mod Nhas a strictly positive Dirichlet density, so in particular is infinite. Onthe other hand, if the image group Im(ρ N ) ⊂ GSp(2g, Z/NZ) containsno element whose trace is A mod N, then a p ≡ A mod N can hold atmost for one of the finitely many primes p dividing N. It is precisely in

LANG-TROTTER REVISITED 11this second case that A has a congruence obstruction at N(to havinga p = A for infinitely many primes p).Lang-Trotter conjecture 8 that, for curves, it is only congruence obstructionswhich prevent an A from being a p infinitely often:Conjecture 1.3. (Weak Lang-Trotter)Let C/Q be a projective, smooth,geometrically connected curve, with good reduction outside of ∆. Givenan integer A, suppose that for every modulus N ≥ 2, A has no congruenceobstruction at N, i.e., the congruence A ≡ a p mod N holds forinfinitely many p. Then we have A = a p for infinitely many p.In the case of a non-CM elliptic curve E, Lang-Trotter also formulate,for any A which has no congruence obstructions, a precise conjecturalasymptotic for how often A is an a p . Given such an A, they define anonzero real constant c A,E and make the following precise conjecture.Conjecture 1.4. (Strong Lang-Trotter for elliptic curves) LetE/Q be a non-CM elliptic curve. Then as T → ∞,#{p ≤ T |a p = A} ∼ c A,E (2/π) √ T / log T.Here is their recipe for the constant c A,E . For each integer N ≥ 2,consider the finite groupG N := Im(ρ N ) ⊂ GL(2, Z/NZ).For each a ∈ Z/NZ, we have the subset G N,a ⊂ G N defined asG N,a := {elements γ ∈ G N with Trace(γ) = a},whose cardinality we denoteWe defineg N,avg := (1/N)g N,a := #G N,a .a∑mod Ng N,a = (1/N)#G Nto be the average, over a, of g N,a . For an A with no congruence obstruction,Lang-Trotter show that as N grows multiplicatively, the ratiog N,A /g N,avg ,(which Lang-Trotter write as Ng N,A /#G N ) tends to a nonzero (archimedean)limit, which they define to be c A,E . [If we apply this recipe to an Awhich has a congruence obstruction, then for all sufficiently divisibleN, we have g N,A = 0, so the limit exists, but it is 0.]8 Lang-Trotter make this conjecture explicitly only for elliptic curves

12 NICHOLAS M. KATZIn this vein, we have the following “intermediate” conjecture, forany 9 curve C of any genus g ≥ 1 which is “strongly non-CM” in thesense that for every l, the l-adic representation has Zariski dense imagein GSp(2g, Q l ).Conjecture 1.5. (Intermediate Lang-Trotter) Let C/Q be a projective,smooth, geometrically connected curve, with good reduction outsideof ∆, such that that for every l, the l-representation has Zariskidense image in GSp(2g, Q l ).Suppose the integer A has no congruenceobstruction mod any N. Then for every real ɛ > 0, there exists aconstant c(C, A, ɛ) such that for T ≥ c(C, A, ɛ), we have√ 1−ɛT ≤ #{p ≤ T |ap = A} ≤ √ T 1+ɛ .There are no cases whatever of a pair (C, A) for which this conjectureis known. In the case of elliptic curves, there are some results on upperbounds with ɛ = 1/2, some under GRH [Se-Cheb, 8.2, Thm. 20], andsome on average, cf. [Da-Pa], [Ba], [Co-Shp].Are there other situations where one should expect congruence obstructionsto be the only thing preventing a given integer A from occurringas a p infinitely often? A natural context for this question is that ofa compatible system of l-adic representations of some π 1 (Spec(Z[1/∆])).Let us recall one version of this notion. We are given an integer n ≥ 1and, for each prime l, a homomorphismρ l ∞ : π 1 (Spec(Z[1/l∆])) → GL(n, Z l ).The compatibility condition is that for every prime p not dividing ∆,there is an integer polynomial P p (T ) ∈ Z[T ] such that for every primel ≠ p, the reversed characteristic polynomialdet(1 − T ρ l ∞(F rob p )) ∈ Z l [T ]lies in Z[T ] and is equal to P p (T ). We are then interested in the a p :=Trace(F rob p ) (trace in any l-adic representation with l ≠ p) for good(i.e., prime to ∆) primes p. Reducing mod powers l ν of l, we getrepresentationsρ l ν: π 1 (Spec(Z[1/l∆])) → GL(n, Z/l ν Z).Putting these together, we get for each integer N ≥ 2 a mod N representationρ N : π 1 (Spec(Z[1/Nl∆])) → GL(n, Z/NZ).9 Without some sort of “non-CM” hypothesis, we can have a p = 0 for a set ofprimes p of positive Dirichlet density, cf. the example following Conjecture 1.7.Perhaps for nonzero A the conjecture remains reasonable for any C/Q.

LANG-TROTTER REVISITED 13Exactly as in the case of curves, A has no congruence obstruction atN, i.e., A ≡ a p mod N holds for infinitely many p, if and only if thereis an element in the image group Im(ρ N ) ⊂ GL(n, Z/NZ) whose traceis A mod N. In this case the set of p for which A ≡ a p mod N haspositive Dirichlet density.In the case of curves, these representations are “pure of weight 1” inthe sense that for each good p, when we factor P p (T ) = ∏ i (1 − α iT )over C, each α i has |α i | = p 1/2 . This in turn implies the estimate|a p | ≤ np 1/2 .The Lang-Trotter idea is that for any compatible system which ispure of weight 1, it is only congruence obstructions which preventan integer A from being a p for infinitely many primes p. As Serrehas remarked [Se-Cheb, 8.2, Remarques (3)], all of the image groupsIm(ρ N ) ⊂ GL(n, Z/NZ) contain the identity, and hence its trace, theinteger n, has no congruence obstruction. Specializing to the case ofcurves, we get the following conjecture, which in genus g ≥ 1 seems tobe entirely open. [It is of course trivially correct in genus zero, whereevery a p vanishes.]Conjecture 1.6. Let C/Q be a projective smooth geometrically connectedcurve of genus g. Then there are infinitely many good primes pwith a p = 2g.Already very special cases of this conjecture are extremely interesting.Consider the special g = 1 case when E/Q is the lemniscatecurve y 2 = x 3 − x, which has good reduction outside of 2. Here weknow the explicit “formula” for a p , cf. [Ir-Ros, Chpt.18, &4, Thm. 5].If p ≡ 3 mod 4, then a p = 0. If p ≡ 1 mod 4, then we can writep = α 2 + β 2 with integers α, β, α odd, β even, and α ≡ 1 + β mod 4.This specifies α uniquely, and it specifies ±β. [More conceptually, thetwo gaussian integers α ± βi are the unique gaussian primes in Z[i]which are 1 mod 2 + 2i and which lie over p.] Then a p = 2α. So wehave a p = 2 precisely when there is a gaussian prime of the form 1 + βiwith 1 ≡ 1+β mod 4, i.e. with β = 4n for some integer n. Thus a p = 2precisely when there exists an integer n withp = 1 + 16n 2 .So the conjecture for this particular curve is the statement that thereare infinitely many primes of the form 1 + 16n 2 .There is another element common to all the mod N image groups.Embeddings of Q into C determine “complex conjugation” elementsin Gal(Q/Q), all in the same conjugacy class, denoted F rob R . In the

14 NICHOLAS M. KATZcurve case, F rob R has g eigenvalues 1 and g eigenvalues −1 in everyl-adic representation. Therefore F rob R has trace zero in every l-adicrepresentation, and consequently in every mod N representation. So weare led to the following conjecture, which in genus g = 1 is a celebratedresult of Elkies, cf. [Elkies-Real] and [Elkies-SS].Conjecture 1.7. Let C/Q be a projective smooth geometrically connectedcurve of genus g. Then there are infinitely many good primes pwith a p = 0.This conjecture is trivially true in some cases. For example, takean odd Q-polynomial h(x) = −h(−x) with all distinct roots, and thecurve y 2 = h(x). Then the character sum formula for a p shows thata p = 0 for all good p ≡ 3 mod 4. But for an irreducible h of degreed ≥ 5 whose Galois group is either S d or A d , and the curve y 2 = h(x),this conjecture seems to be entirely open.What should we expect for compatible systems which are pure ofweight 2, i.e., each |α i | = p? In this weight 2 case, the probabilisticmodel has sets X p = Z ∩ [−np, np] of size 2np + 1. So the series∑ p 1/#X p ∼ (1/2n) ∑ p1/p diverges slowly, and the model allowsA = a p to hold about (1/2n) log log T times for primes up to T . Butin weight 2 there may be more than congruence obstructions to havinga given A being a p infinitely often. Here is the simplest example.Start with an elliptic curve E/Q, say with good reduction at primes pnot dividing some integer ∆, and its compatible system of weight onerepresentationsρ l ∞ : π 1 (Spec(Z[1/l∆])) → GL(2, Z l ).In each of these, F rob R has eigenvalues 1 and −1. Now consider thecompatible systemSym 2 (ρ l ∞) : π 1 (Spec(Z[1/l∆])) → GL(3, Z l ).In each of these, F rob R has two eigenvalues 1 and one eigenvalue −1,so has trace 1, and hence has trace 1 in every mod N representationSym 2 (ρ N ). Thus A = 1 has no congruence obstruction for the compatiblesystem of Sym 2 (ρ l ∞)’s. Denote by A p the trace of F rob p in thisSym 2 system. Then A p is related to the original a p by the formulaA p = (a p ) 2 − p.So A p = 1 is equivalent to (a p ) 2 − p = 1, i.e. top = (a p + 1)(a p − 1),which is trivially impossible for p ≥ 5.

LANG-TROTTER REVISITED 15It would be interesting to understand, even conjecturally, what “should”be true about compatible weight 2 systems, for instance for the a pof a weight 3 newform 10 with integer coefficients on some congruencesubgroup Γ 1 (N). Here we are dealing with a compatible system of 2dimensional representations, so in particular A = 2 has no congruenceobstruction. It may well be that no fixed nonzero integer A is a p forinfinitely many p, no computer experiment can convince us either way.Nonetheless, we report on some computer experiments below. Caveatemptor.The simplest examples of weight 3 newforms with integer coefficientsare gotten by taking a (K-valued, type (1, 0)) weight one grossencharacterρ of a quadratic imaginary field K of class number one and inducingits square down to Q. The common feature they exhibit is thatfor a certain integer D ≥ 1, we have a p = 2 if and only if the pair ofsimultaneous equationsx 2 + Dy 2 = p, x 2 − Dy 2 = 1has an integer solution. Here are some examples.(D=1) Here K = Q(i), and ρ attaches to an odd prime ideal P of Z[i]the unique generator π = α + βi ≡ 1 mod (2 + 2i). This ρ isthe grossencharacter attached to the elliptic curve y 2 = x 3 − x,cf. [Ir-Ros, Chpt. 18, Thm. 5]. Inducing ρ 2 gives a weight3 newform on Γ 1 (16) whose nebentypus character is the mod4 character of order 2. [This is 16k3A[1,0]1 in Stein’s tables[St].] See [Ka-TLFM, 8.8.10-11] for another occurrence, in thecohomology of a certain elliptic surface.] For this form, we havea p = 0 unless p ≡ 1 mod 4. When p ≡ 1 mod 4, choose a Plying over p, and write ρ(P) = π = α + βi. Thena p = Trace Q(i)/Q ((π) 2 ) = 2(α 2 − β 2 ) = 2(α − β)(α + β).So no odd A is ever a p . For a fixed nonzero even A, the pairof integers (α − β, α + β) is on the finite list of factorizationsin Z of A/2. Solving for (α, β), we see that (α, β) is itself on afinite list. So p = α 2 + β 2 is on a finite list, and hence a p = Aholds for at most finitely many primes p. In this particularexample, A = 2 is never an a p , since the only integer solutionsof α 2 − β 2 = 1 are (±1, 0). This D = 1 case is the only casewhere we can prove that for any fixed nonzero A, a p = A holdsfor at most finitely many primes p.10 The weight in the sense of modular forms is one more than the weight in thesense of compatible systems.

16 NICHOLAS M. KATZ(D=2) Here K = Q( √ −2), and ρ attaches to an odd prime ideal Pof Z[ √ −2] the unique generator π = α + β √ −2 with α ≡ 1mod 4. Inducing ρ 2 gives a weight 3 newform on Γ 1 (8) whosenebentypus character is the mod 8 character of order 2 whosekernel is {1, 3}. [This is 8k3A[1,1]1 in Stein’s tables [St].] Forodd p, a p vanishes unless p ≡ 1 or 3 mod 8. When p ≡ 1 or3 mod 8, choose either P lying over p, and write ρ(P) = π =α + β √ −2. Then p = Norm Q(√ −2)/Q (π) = α 2 + 2β 2 , anda p = Trace Q(√ −2)/Q ((π) 2 ) = 2(α 2 − 2β 2 ).(D=3) Here K = Q(ζ 3 ), and ρ attaches to a prime-to-6 prime ideal Pof Z[ζ 3 ] the unique generator π = α + β √ −3 which lies in theorder Z[ √ −3] and which has α ≡ 1 mod 3. Inducing ρ 2 gives aweight 3 newform on Γ 1 (12) whose nebentypus character is themod 3 character of order 2. [This is 12k3A[0,1]1 in Stein’s tables[St].] For p prime to 6, a p vanishes p ≡ 1 mod 3. If p ≡ 1 mod3, choose a P lying over p, and write ρ(P) = π = α + β √ −3.Then Then p = Norm Q(ζ3 )/Q(π) = α 2 + 3β 2 , anda p = Trace Q(ζ3 )/Q((π) 2 ) = 2(α 2 − 3β 2 ).(D=27) Here K = Q(ζ 3 ), and ρ attaches to a prime-to-3 prime ideal Pof Z[ζ 3 ] the unique generator π = α + β(3ζ 3 ) which lies in theorder Z[3ζ 3 ] and has α ≡ 1 mod 3.This ρ is the grossencharacterattached to the elliptic curve y 2 = x 3 + 16, cf. [Ir-Ros, Chpt.18, Thm. 4]. Inducing ρ 2 gives a weight 3 newform on Γ 1 (27)whose nebentypus character is the mod 3 character of order 2.[This is 27k3A[9]1 in Stein’s tables [St].] For p prime to 3, a pvanishes p ≡ 1 mod 3. If p ≡ 1 mod 3, choose a P lying overp, and write ρ(P) = π = α + 3βζ 3 . Then p = Norm Q(ζ3 )/Q(π) =α 2 − 3αβ + 9β 2 anda p = Trace Q(ζ3 )/Q((π) 2 ) = 2α 2 − 6αβ − 9β 2 .So if a p is even, then β must be even, say β = 2B, and ourequations becomep = (α − 3B) 2 + 27B 2 , a p = 2((α − 3B) 2 − 27B 2 ).(D=7,11,19,43,67,163) Here K = Q( √ −D), and ρ attaches to a prime-to-D prime idealP of Z[(1 + √ −D)/2] the unique generator π = α 0 + β 0 (1 +√−D)/2 which mod√−D is a square mod D. Inducing ρ2gives a weight 3 newform on Γ 1 (D) whose nebentypus characteris the mod D character of order 2. [This is Dk3A[(D-1)/2]1in Stein’s tables [St].] For p ≠ D, a p vanishes unless p is a

18 NICHOLAS M. KATZD u D T X # for n =2 3 + 2 √ D 32768 50170 3 1, 2, 43 2 + √ D 32768 37482 3 1, 2, 827 26 + 5 √ D ∞ ∞ 0 none7 8 + 3 √ D 32768 78801 3 1, 2, 1611 10 + 3 √ D 16384 42596 2 1, 219 170 + 39 √ D 8192 41475 0 none43 3482 + 531 √ D 8192 62961 0 none67 48842 + 5967 √ D 8192 81753 2 4, 32163 64080026 + 5019135 √ D 8192 132837 0 noneThat there are provably none for D = 27 results from the fact thatu 27 is the cube of u 3 . For the amusement of the reader, we give below,for D = 2, 3, 7, 11, the two or three primes p with a p = 2 in our searchrange.D p 1 p 2 p 32 17 577 6658573 7 19 7081589777 127 32257 15003817139490503043200328185433971097711 199 79201 no third one[For D = 67, the first of the two primes found in our search range witha p = 2 wasp = 4145314481238973783106627512888262311297.The second prime found with a p = 2 had 320 digits; it was too big forMathematica to certify its primality.]2. Lang-Trotter in the function field case: generalitiesand what we might hope forWe now turn to a discussion of the Lang-Trotter conjecture for ellipticcurves in the function field case, cf. [Pa] for an earlier discussion(but note that his Proposition 4.4 is incorrect). Thus we let k be afinite field F q of some characteristic p > 0, X/k a projective, smooth,geometrically connected curve, K the function field of X, and E/K anelliptic curve over K. Then E has good reduction at all but finitelymany closed points P ∈ X; more precisely, its Neron model E/X is,over some dense open set U ⊂ X, a one-dimensional abelian scheme.For each closed point P ∈ U, with residue field F P of cardinality N(P),

20 NICHOLAS M. KATZFor each finite extension field F Q /k, and each F Q -valued point u ∈U(F Q ), we have its arithmetic Frobenius conjugacy class F rob u,FQ ∈π 1 (U), whose image in Gal(k/k) is the Q’th power automorphism of k.For a closed point P of U of some degree d ≥ 1, viewed as a Gal(k/k)-orbit of length d in U(k), we have the arithmetic Frobenius conjugacyclass F rob P ∈ π 1 (U), equal to the class of F rob u,FQ , for F Q the residuefield F q d of P and for u ∈ U(F Q ) any point in the orbit which “is” P.For any element F ∈ π 1 (U) of degree one, e.g., F rob u,k if there existsa k-rational point of U, we have a semidirect product descriptionπ geom1 (U)⋊ < F > ∼−→ π 1 (U)where < F > −→ ∼Ẑ is the pro-cyclic group generated by F .The second difference from the number field case is that only forintegers N 0 ≥ 2 which are prime to p is the group scheme E[N 0 ] a finiteétale form of Z/N 0 Z × Z/N 0 Z. So it is only for integers N 0 ≥ 2 whichare prime to p that we get a mod N 0 representationρ N0 : π 1 (U) → (GL(2, Z/N 0 Z).For a finite extension field F Q /k, and an F Q -valued point u ∈ U(F Q ),we have an elliptic curve E u,FQ /F Q , the number of whose F Q -rationalpoints we writeE u,FQ (F Q ) = Q + 1 − A u,FQ .The fundamental compatibility is that for each N 0prime to p, we have≥ 2 which isTrace(ρ N0 (F rob u,FQ )) ≡ A u,FQ mod N 0 , det(ρ N0 (Frob u,FQ )) ≡ Q mod N 0 .In particular, for a closed point P of U, weTrace(ρ N0 (F rob P )) ≡ A P mod N 0 , det(ρ N0 (Frob P )) ≡ N(P) mod N 0 .The third difference from the number field case is that, because E/Uis fibre by fibre ordinary, the p-divisible group E[p ∞ ] sits in a shortexact sequence0 → E[p ∞ ] 0 → E[p ∞ ] → E[p ∞ ] et → 0,in which the quotient E[p ∞ ] et is a form of Q p /Z p , and the kernel E[p ∞ ] 0is the dual form of µ p ∞. So the quotient E[p ∞ ] et gives us a homomorphismρ p ∞ : π 1 (U) → Aut gp (Q p /Z p ) ∼ = GL(1, Z p ) ∼ = Z × p .On Frobenius elements, this p-adic character ρ p ∞ of π 1 (U) gives thep-adic unit eigenvalue of Frobenius: the fact that the integer A u,FQ ,

g N (avg, Q) := (1/N)LANG-TROTTER REVISITED 23∑A mod Ng N (A, Q) = (1/N)g N,det=Q .The relevance of the subsets G N (A, Q) ⊂ G N,det=Q ⊂ G N is this.Suppose we are given an integer A prime to p, and a power Q of #k. Ifthere is an F Q -valued point u ∈ U(F Q ) with A u,FQ = A, resp. a closedpoint P with norm Q and A P = A, then for every N ≥ 2, ρ N (F rob u,FQ ),resp. ρ N (F rob P ), lies in G N (A, Q).We say that the data (A, Q), A an integer prime to p and Q a (strictlypositive) power of #k, has a congruence obstruction at N if the setG N (A, Q) is empty. And we say that (A, Q) has an archimedean obstructionif A 2 > 4Q.The most optimistic hope is that if (A, Q) has neither archimedeannor congruence obstruction (i.e., A is prime to p, |A| < 2 √ Q, and for allN ≥ 2 the set G N (A, Q) is nonempty), then there should be a closedpoint P with norm Q and A P = A. [And we might even speculateabout how many, at least if Q is suitable large.] Unfortunately, thishope is false for trivial reasons; we can remove from U all its closedpoints of any given degree and obtain now a new situation where thegroups G N , being birational invariants, are unchanged, but where thereare no closed points whatever of the given degree. What is to bedone? One possibility is to make this sort of counterexample illegal:go back to the projective smooth geometrically connected curve X/kwith function field K in which U sits as a dense open set, and replace Uby the possibly larger open set U max ⊂ X we obtain by removing fromX only those points at which the Neron model of E K /K has either badreduction or supersingular reduction. But even this alleged remedy isinsufficient, as we will see below. It is still conceivable that if (A, Q) hasneither archimedean nor congruence obstruction there is an F Q -pointu ∈ U max such that F rob u,FQ gives rise to (A, Q); the counterexamplebelow does not rule out this possibility.Here is the simplest counterexample.Take any prime power q = p ν ≥4, take for U = U max the (ordinary part of the) Igusa curve Ig(q) ord /F q ,and take for E/U the corresponding universal elliptic curve. For afinite field (or indeed for any perfect field) L/k, an L-valued pointu ∈ Ig(q) ord (L) is an L-isomorphism class of pairs (E/L, P ∈ E[q](L))consisting of an elliptic curve E/L together with an L-rational pointof order q. Now consider the data (A = 1 − 2q, Q = q 2 ). The keyfact is that any E 2 /F q 2 with trace A 2 = 1 − 2q is isomorphic to theextension of scalars of a unique E 1 /F q with trace A 1 = 1, as will beshown in Lemma 4.1. But any such E 1 /F q has q rational points, sothe group E 1 (F q ) is cyclic of order q, and hence every point of order q

24 NICHOLAS M. KATZin E 1 (F q ), and a fortiori every point of order q in E 1 (F q 2), is alreadyF q -rational. So although the data (A = 1 − 2q, Q = q 2 ) occurs from anF q 2-point, and hence has no congruence obstruction, it does not occurfrom a closed point of degree 2.There are three plausible hopes one might entertain in the functionfield case. Let E/U be as above (fibrewise ordinary, nonconstant j-invariant). Here are the first two.HOPE (1) Given a prime-to-p integer A, there exists a real constant C(A, E/U)with the following property. If Q is a power of #k with Q ≥C(A, E/U), and if (A, Q) has neither archimedean nor congruenceobstruction, then there exists a closed point P with normQ and A P = A.HOPE (2) Given a prime-to-p integer A, and a real number ɛ > 0, thereexists a real constant C(A, ɛ, E/U) with the following property.If Q is a power of #k with Q ≥ C(A, ɛ, E/U), and if (A, Q)has neither archimedean nor congruence obstruction, then forthe number π A,Q of closed points with norm Q and A P = Aand for the number n A,Q of F Q -valued points u ∈ U(F Q ) withA u,FQ = A we have the inequalitiesQ 1 2 −ɛ < π A,Q ≤ n A,Q < Q 1 2 +ɛ .To describe the final hope, we must discuss another, weaker, notionof congruence obstruction. Given a prime-to-p integer A, suppose thereare infinitely many closed points P with A P = A. Then as there areonly finitely many closed points of each degree, it follows that there areinfinitely many powers Q i of #k for which (A, Q i ) has no congruenceobstruction (and of course no archimedean obstruction either). For afixed N = N 0 p ν , if Q i is sufficiently large (Q i ≥ p ν being the precisecondition), then G N contains an element whose trace is A mod N.So we are led to a weaker notion of congruence obstruction, whichis the literal analogue of the number field condition: we say that theprime-to-p integer A has a congruence obstruction at N if G N containsno element whose trace is A mod N, and we say that A has a congruenceobstruction if it has one at N for some N. This brings us to the thirdhope.HOPE (3) Suppose the prime-to-p integer A has no congruence obstruction.Then there exist infinitely many closed points P withA P = A.Notice, however, that the assumption that A has no congruence obstructionis, at least on its face, much weaker than the assumption

LANG-TROTTER REVISITED 25that there are infinitely many powers Q i of #k for which (A, Q i ) hasno congruence obstruction.3. Lang-Trotter in the function field case: the case ofmodular curvesIn the number field case, there is no elliptic curve where we knowLang-Trotter for even a single nonzero integer A. But over any finitefield k, we will show that there are infinitely many examples of situationsE/U/k, nonconstant j-invariant and fibrewise ordinary, where allthree of our hopes are provably correct. These examples are providedby modular curves over finite fields, and the universal families of ellipticcurves they carry.Let us first describe the sorts of level structures we propose to dealwith in a given characteristic p > 0. We specify three prime-to-ppositive integers (L, M, N 0 ) and a power p ν ≥ 1 of p. We assume that(L, M, N 0 ) are pairwise relatively prime.Given this data, we work over a finite extension k/F p given with aprimitive N 0 ’th root of unity ζ N0 ∈ k, and consider the moduli problem,on k-schemes S/k, of S-isomorphism classes of fibrewise ordinaryelliptic curves E/S endowed with all of the following data, which forbrevity we will call an M-structure on E/S.(1) A cyclic subgroup of order L, i.e., a Γ 0 (L)-structure on E/S.(2) A point P M of order M, i.e., a Γ 1 (M)-structure on E/S,(3) A basis (Q, R) of E[N 0 ] with e N0 (Q, R) = ζ N0 , i.e., an orientedΓ(N 0 )-structure on E/S.(4) A generator T of Ker(V ν : E (pν /S)→ E), i.e., an Ig(p ν )-structure on E/S.Having specified a finite extension k/F p given with a primitive N 0 ’throot of unity ζ N0 ∈ k and the data (L, M, N 0 , p ν ) above, we make thefurther assumption that at least one of the following three conditionsholds:(1) M ≥ 4,(2) N 0 ≥ 3,(3) p ν ≥ 4.This assumption guarantees that the associated moduli problem is representableby a smooth, geometrically connected k-curve M ord overwhich we have the corresponding universal family E univ /M ord . Forthis situation, points of M ord have a completely explicit description.For any k-scheme S/k, the S-valued points of M ord are preciselythe S-isomorphism classes of fibrewise ordinary elliptic curves E/S

26 NICHOLAS M. KATZendowed with an M-structure. In particular, for F Q /k a finite overfield,an F Q -valued point of M ord is an F Q -isomorphism class of pairs(an ordinary elliptic curve E/F Q ,an M−structure on it).What about closed points P of M ord with norm N(P) = Q? Theseare precisely the orbits of Gal(F Q /k) on the set M ord (F Q ) which containdeg(F Q /k) distinct F Q -valued points. In more down to earth terms,an F Q -valued point lies in the orbit of a closed point of norm N(P) = Qif and only it is not (the extension of scalars of) a point with values ina proper subfield k ⊂ F Q1 F Q . Let us denote byM ord (F Q ) prim ⊂ M ord (F Q )those F Q -valued points which lie in no proper subfield. So we have thetautological formula#{closed points with norm Q} = #Mord (F Q ) prim.deg(F Q /k)4. Counting ordinary points on modular curves by classnumber formulasIn this section, we recall the use of class number formulas in countingordinary points. In a later section, we will invoke the Brauer-Siegeltheorem (but only for quadratic imaginary fields, so really Siegel’s theorem[Sie]) and its extension to quadratic imaginary orders, to convertthese class number formulas into the explicit upper and lower boundsasserted in HOPE (2).] These class number formulas go back to Deuring[Deu], cf. also Waterhouse [Wat]. As Howe points out [Howe], thestory is considerably simplified if we make use of Deligne’s description[De-VA] of ordinary elliptic curves over a given finite field. Let F q bea finite field, and E/F q an ordinary elliptic curve. We have#E(F q ) = q + 1 − A,for some prime-to-p integer A satisfyingA 2 < 4q.Conversely, given any prime-to-p integer A satisfyingA 2 < 4q,one knows by Honda-Tate, cf. [Honda] and [Tate], that there is at leastone one ordinary elliptic curve E/F q with#E(F q ) = q + 1 − A.

LANG-TROTTER REVISITED 27The first question, then, is to describe, for fixed (A, q) as above (i.e.,A prime-to-p with A 2 < 4q) the category of all ordinary elliptic curvesE/F q with#E(F q ) = q + 1 − A,the morphisms being F q -homomorphisms. We denote by Z[F ] the ringZ[X]/(X 2 − AX + q). Since A 2 < 4q, this ring Z[F ] is an order ina quadratic imaginary field, whose ring of integers we will denote O.[In the general Deligne story we would need to work with the ringZ[F, q/F ], but here q/F is already present, namely q/F = A − F .]Deligne provides an explicit equivalence of categories (by picking (!) anembedding of the ring of Witt vectors W (F q ) into C and then takingthe first integer homology group of the Serre-Tate canonical lifting, cf.[Mes, V 2.3, V 3.3, and Appendix]) of this category with the categoryof Z[F ]-modules H which as Z-modules are free of rank 2 and suchthat the characteristic polynomial of F acting on H isX 2 − AX + q.In this equivalence of categories, suppose an ordinary E/F q givesrise to the Z[F ]-module H. For any prime-to-p integer N, the groupE[N](F q ) as Z[F ]-module, F acting as the arithmetic Frobenius F rob qin Gal(F q /F q ), is just the Z[F ]-module H/NH. For a power p ν of p,the group E[p ν ](F q ) as Z[F ]-module is obtained from H as follows. Wefirst write the Z p [F ]-decompositionH ⊗ Z Z p = H et ⊕ H conn ,H et := Ker(F − unit q (A)), H conn := Ker(F − q/unit q (A)),of H ⊗ Z Z p as the direct sum of two free Z p -modules of rank one, ofwhich the first is called the“unit root subspace”. Then for each powerp ν of p, we haveE[p ν ](F q ) ∼ = H et /p ν H et .An equivalent, but less illuminating, description of H et /p ν H et is asthe the image of F ν in H/p ν H (because H/p ν H is the direct sumH et /p ν H et ⊕ H conn /p ν H conn , and F ν is an isomorphism on the firstfact but kills the second factor).Here is an application of Deligne’s description.Lemma 4.1. Suppose E 2 /F q 2 is an elliptic curve with trace A 2 = 1−2q.Then there exists a unique elliptic curve E 1 /F q with trace A 1 = 1 whichgives rise to E 2 /F q 2 by extension of scalars.Proof. Denote by F 2 the Frobenius for E 2 /F q 2. Then F 2 satisfiesF 2 2 − (1 − 2q)F 2 + q 2 = 0, i.e. F 2 = (F 2 + q) 2 .

28 NICHOLAS M. KATZThus F 1 := F 2 + q is a square root of F 2 , and it satisfies the equationF 2 1 − F 1 + q = 0, i.e. F 2 = F 1 − q.This last equation shows that Z[F 2 ] = Z[F 1 ]. In terms of the Z[F 2 ]-module H 2 attached to E 2 /F q 2, E 1 /F q is the unique curve over F q correspondingto the same H 2 , now viewed as a Z[F 1 ]-module. □Class number formulas are based on the following “miracle” of complexmultiplication of elliptic curves. [We say “miracle” because theanalogous statements can be false for higher dimensional abelian varieties.]Given a Z[F ]-module H as above, we can form a possibly largerorder R,Z[F ] ⊂ R ⊂ O,defined asR := End Z[F ] (H).Of course this R is just the F q -endomorphism ring of the correspondingE/F q , thanks to the equivalence. So tautologically H is an R-module.The miracle is that H is an invertible R-module, cf. [Sh, 4.11, 5.4.2].Of course any order Z[F ] ⊂ R ⊂ O can occur as H varies, since onecould take R itself as an H. So if we separate the ordinary ellipticcurves E/F q with given data (A, q) by the orders which are theirF q -endomorphism rings, then for a given order R the F q -isomorphismclasses with that particular R are the isomorphism classes of invertibleR-modules, i.e., the elements of the Picard group P ic(R), whose orderis called the class number h(R) of the order R.Suppose that we now fix not only (A, q) but also the endomorphismring R. Then for any ordinary elliptic curve E/F q with this data, thequestion of exactly how many M-structures E/F q admits is determinedentirely by the data consisting of (A, q) and R. Indeed, if E/F q givesrise to H, then H is an invertible R module. Now for any invertibleR-module H 1 , and for any integer N 1 ≥ 1, the invertible R/N 1 R-module H 1 /N 1 H 1 is R-isomorphic to R/N 1 R (simply because R/N 1 R,being finite, is semi-local, so has trivial Picard group), and hence afortiori is Z[F ]-isomorphic to R/N 1 R. Taking H 1 to be H and N 1 tobe LMN 0 p ν , we conclude that H/(LMN 0 p ν )H is Z[F ]-isomorphic toR/(LMN 0 p ν )R. Translating back through Deligne’s equivalence, wesee that E[LMN 0 p ν ]((F q ) is Z[F ]-isomorphic toR/LMN 0 R × F ν (R/p ν R).Thus we have the following dictionary:(1) Γ 0 (L)-structure: a cyclic subgroup of R/LR of order L whichis Z[F ]-stable.

LANG-TROTTER REVISITED 29(2) Γ 1 (M)-structure: a point P ∈ R/MR which has additive orderM and which is fixed by F .(3) unoriented Γ(N 0 )-structure: a Z/N 0 Z-basis of R/N 0 R consistingof points fixed by F . An unoriented Γ(N 0 )-structure exists ifand only if F acts as the identity on R/N 0 R. If an unorientedΓ(N 0 )-structure exists, there are precisely #GL(2, Z/N 0 Z) ofthem. Of these, precisely #SL(2, Z/N 0 Z) are oriented (for achosen ζ N0 ).(4) Ig(p ν )-structure: a Z/p ν Z-basis of F ν (R/p ν R) ( ∼ = H et /p ν H et )which is fixed by F , or equivalently, an F -fixed point in R/p ν Rwhich has additive order p ν .Thus we see explicitly that how many M-structures E/F q admitsis determined entirely by the data consisting of (A, q) and R. Let usdenote this number by#M(A, q, R).Notice also that for for such an E/F q giving rise to (A, q) and R, theautomorphism group of E/F q is the group R × of units in the endomorphismring R. Recall that F q points on the modular curve M ord are F q -isomorphism classes of pairs (ordinary E/F q , M − structure on E/F q ).So the number of F q points on M ord whose underlying ordinary ellipticcurve gives rise to the data (A, q, R) is the product#M(A, q, R)h(R)/#R × .For given (ordinary) data (A, q), with Z[F ] := Z[X]/(X 2 − AX + q)and ring of integers O ⊂ Q[F ],let us denote byM ord (F q , A) ⊂ M ord (F q )the set of F q points on M ord whose underlying ordinary elliptic curvegives rise to the data (A, q). Then #M ord (F q , A) is a sum, over allorders R between Z[F ] and O:∑#M ord (F q , A) =#M(A, q, R)h(R)/#R × .orders Z[F ]⊂R⊂OBefore we try to count M-structures, let us record the congruencesand inequalities which necessarily hold when such structures exist.Lemma 4.2. Let k/F p be a finite extension, given with a primitiveN 0 ’th root of unity ζ N0 ∈ k, F q /k a finite extension, and E/F q anordinary elliptic curve which gives rise to the data (A, q, R). Supposethat E/F q admits an M-structure. Then q ≡ 1 mod N 0 , and we havethe following additional congruences.

30 NICHOLAS M. KATZ(1) There exists a ∈ (Z/LZ) × satisfying a 2 − Aa + q ≡ 0 mod L,i.e., the polynomial X 2 − AX + q factors completely mod L.Equivalently, there exists a ∈ (Z/LZ) × such that A ≡ a + q/amod L.(2) q + 1 ≡ A mod MN 2 0 p ν .Moreover, we have q ≥ p ν if p is odd. When p = 2, we also have q ≥ p νexcept in the two exceptional cases (q, p ν ) = (2, 4) and (q, p ν ) = (4, 8);in those two cases we have A = −1 and A = −3 respectively.Proof. That q ≡ 1 mod N 0 results from the fact that F q contains aprimitive N 0 ’th root of unity. To prove (1), suppose we have an F -stable Z/LZ subgroup Γ 0 ⊂ R/LR. Then F , being an automorphismof R/LR, acts on this subgroup by multiplication by some unit a ∈(Z/LZ) × . But F 2 − AF + q annihilates R, so it annihilates R/LR. AsΓ 0 ⊂ R/LR is F -stable, and F acts on Γ 0 by a, we get that a 2 −Aa+q ∈Z/LZ annihilates this cyclic group of order L, so a 2 − Aa + q = 0 inZ/LZ. The existence of such an a is equivalent to the polynomialX 2 −AX +q factoring mod L, and to the congruence A ≡ a+q/a modL (then the factorization is (X − a)(X − q/a) mod L). The congruence(2) is just the point-count divisibility that follows from having an M-structure. To prove the “moreover” statement, we exploit the fact that,by (2), p ν divides q + 1 − A. We argue by contradiction. If p ν > q,then p ν ≥ pq (since q is itself a power of p). So p ν is divisible by pq,and hence pq divides q + 1 − A. By the Weil bound and ordinarity,q + 1 − A is nonzero (indeed q + 1 − A > ( √ q − 1) 2 > 0), so from thedivisibility we get the inequalityq + 1 − A ≥ pq.Again by the Weil bound, we have ( √ q + 1) 2 > q + 1 − A, so we getq + 1 + 2 √ q = ( √ q + 1) 2 > pq = (p − 2)q + q + q.Adding 1 − 2 √ q − q to both sides, we getThis is nonsense if p ≥ 3.indicated cases.2 > (p − 2)q + ( √ q − 1) 2 .If p = 2, this can hold, precisely in the□To say more about how this works explicitly, we need to keep track,for given ordinary data (A, q), of the orders between Z[F ] and thefull ring of integers O. The orders R ⊂ O are the subrings of theform Z + fO, with f ≥ 1 an integer. The integer f ≥ 1 is calledthe conductor of the order; it is the order of the additive group O/R.

LANG-TROTTER REVISITED 31Because (A, q) is given, the particular order Z[F ] ⊂ O is given, and wewill denote by f A,q its conductor:f A,q := conductor of Z[F ].An order R ⊂ O contains Z[F ] if and only if its conductor f R dividesf A,q . For an intermediate order Z[F ] ⊂ R ⊂ O, we define its coconductorfR c to be the quotient:f c R := f A,q /f R = #(R/Z[F ]).Of course this notion of co-conductor only makes sense because we havespecified the particular order Z[F ]. Just as the conductor measureshow far “down” an intermediate order is from O, so its co-conductormeasures how far “up” it is from Z[F ].Lemma 4.3. Let k/F p be a finite extension, given with a primitiveN 0 ’th root of unity ζ N0 ∈ k, F q /k a finite extension, and E/F q anordinary elliptic curve which gives rise to the data (A, q, R). Supposethat the following congruences hold.(1) There exists a ∈ (Z/LZ) × satisfying a 2 − Aa + q ≡ 0 mod L.(2) q + 1 ≡ A mod MN 0 p ν .Then we have the following conclusions.(1) Whatever the order R, E/F q admits precisely φ(p ν ) Ig(p ν ) structures.(2) If R has co-conductor prime to L, then E/F q admits at leastone Γ 0 (L) structure.(3) If R has co-conductor prime to M, then E/F q admits preciselyφ(M) Γ 1 (M) structures.(4) If R has co-conductor divisible by N 0 , then E/F q admits precisely#SL(2, Z/N 0 Z) oriented Γ(N 0 ) structures. Otherwise,E/F q admits none.Proof. (1) Since E/F q is ordinary, the group E(F q )[p ∞ ] is noncanonicallyQ p /Z p . So the p-power torsion subgroup of E(F q ) is cyclic, andits order is the highest power of p which divides #E(F q ) = q + 1 − A.Because this cardinality is divisible by p ν , E(F q )[p ν ] is cyclic of orderp ν , and its φ(p ν ) generators are precisely the Ig(p ν ) structures on E/F q .(2) and (3) The existence of a Γ 0 (L) (resp. Γ 1 (M))-structure dependsonly upon R/LR (resp. R/MR) as a Z[F ]-module. If R hasco-conductor prime to L (resp. M), then the inclusion Z[F ] ⊂ R inducesa Z[F ]-isomorphism Z[F ]/LZ[F ] ∼ = R/LR (resp. Z[F ]/MZ[F ] ∼ =R/MR). So it suffices to treat the single case when R = Z[F ]. We willnow show in Z[F ]/LZ[F ] (resp. Z[F ]/MZ[F ]), the kernel of F −a (resp.F − 1) is a cyclic subgroup of order L (resp. M). Once we show this,

32 NICHOLAS M. KATZthen the kernel of F −a in Z[F ]/LZ[F ] is the asserted Γ 0 (L)-structure,and the φ(M) generators of the kernel of F − 1 in Z[F ]/MZ[F ] areall the Γ 1 (M) structures. The assertion about the kernels results fromthe fact (elementary divisors) that for an endomorphism Λ of a finitefree Z/LZ-module (resp. of a finite free Z/MZ-module), Ker(Λ) andCoker(Λ) are isomorphic abelian groups. [In fact, as Bill Messing explainedto me, the kernel and cokernel of an endomorphism of any finiteabelian group are isomorphic abelian groups, but we will not need thatfiner statement here.] Applying this to the endomorphisms F − a ofZ[F ]/LZ[F ] and F −1 of Z[F ]/MZ[F ], we find that the relevant kernelsare the cyclic groups underlying the quotient ringsandZ[F ]/(L, F − a) := Z[X]/(L, X 2 − aX + q, X − a)∼ = Z/(L, a 2 − aA + q) ∼ = Z/LZ,Z[F ]/(M, F − 1) := Z[X]/(M, X 2 − aX + q, X − 1)∼ = Z/(M, 1 − A + q) ∼ = Z/MZ,(4) We have q ≡ 1 mod N 0 because F q contains a primitive N 0 ’throot of unity; by assumption N02 divides q + 1 − A. We must showthat all the points of order dividing N 0 are F q -rational if and only ifR has co-conductor divisible by N 0 . All the points of order dividingN 0 are F q -rational if and only if F − 1 kills R/NR, i.e., if and only ifif (F − 1)/N, which a priori lies in the fraction field of O, lies in R.[Let us remark in passing that in order for (F − 1)/N to lie in O, itis necessary and sufficient that its norm and trace down to Q lie inZ. But its norm down to Q is (q + 1 − A)/N0 2 and its trace down toQ is (A − 2)/N 0 = (q − 1)/N 0 + (A − q − 1)/N 0 .] Thus there existΓ(N 0 )-structures if and only if R contains the order Z[(F − 1)/N 0 ].This last order visibly has co-conductor N 0 , so the orders containingit are precisely those whose co-conductor is divisible by N 0 . Onceany (possibly unoriented) Γ(N 0 ) structure exists, there are precisely#SL(2, Z/N 0 Z) oriented Γ(N 0 )-structures.□Remark 4.4. In the above lemma, we don’t specify how many Γ 0 (L)-structures there are,“even” when R has co-conductor prime to L, andwe don’t say when any exist for other R. We also don’t say how manyΓ 1 (M)-structures there are for other R. For these R, we will be ableto make do with the trivial inequalities, valid for any R,0 ≤ #{Γ 0 (L) − structures on R/LR} ≤ #P 1 (Z/LZ),0 ≤ #{Γ 1 (M) − structures on R/MR} ≤ φ(M)#P 1 (Z/MZ).

LANG-TROTTER REVISITED 335. Interlude: Brauer-Siegel for quadratic imaginaryordersThe following minor variant of Siegel’s theorem for quadratic imaginaryfields is certainly well known to the specialists. We give a proofhere for lack of a suitable reference. For a quadratic imaginary order,i.e., an order R in an quadratic imaginary field, we denote by d R itsdiscriminant, by h(R) := #P ic(R) its class number, and byh ⋆ (R) := h(R)/#R ×its “normalized” class number. [We should warn the reader that inGekeler [Ge, 2.13, 2.14] his h ⋆ and his H ⋆ are twice ours.]Theorem 5.1. Given a real ɛ > 0, there exists a real constant C ɛ > 0such that for any quadratic imaginary order R with |d R | ≥ C ɛ , we havethe inequalities|d R | 1 2 −ɛ ≤ h ⋆ (R) ≤ |d R | 1 2 +ɛ .Proof. Given a quadratic imaginary order R, denote by f R its conductor,K its fraction field, and O K the ring of integers of K. Then thediscriminant d R of R = Z + f R O K is related to the discriminant d OKby the simple formulad R = f 2 Rd OK .Their normalized class numbers are related as follows, cf. [Cox, 7.2.6and exc. 7.30(a)] or [Sh, p. 105, exc. 4.12]:h ⋆ (R)h ⋆ (O K ) = #(O K/f R O K ) ×#(Z/f R Z) × .We rewrite this as follows. Given the quadratic imaginary field K,denote by χ K the associated Dirichlet character: for a prime numberp, χ K (p) := 1 if p splits in K, χ K (p) := 0 if p ramifies in K, andχ K (p) := −1 if p is inert in K. We then define the multiplicativefunction φ K on strictly positive integers byφ K (1) = 1, φ K (nm) = φ K (n)φ K (m) if gcd(n, m) = 1,φ K (p ν ) = p ν−1 (p − χ K (p)), if ν ≥ 1.In terms of this function, we can rewrite the relation of normalizedclass numbers ash ⋆ (R) = φ K (f R )h ⋆ (O K ).By Siegel’s theorem, applied with ɛ/2, there exist real constants A ɛ > 0and B ɛ > 0 such that for all quadratic imaginary fields K we have(∗∗ ɛ/2 ) : A ɛ |d OK | 1 2 −ɛ/2 ≤ h ⋆ (O K ) ≤ B ɛ |d OK | 1 2 +ɛ/2 .

34 NICHOLAS M. KATZ[This is true without A and B for |d| large; A and B take care of thesmall |d|. Conversely, if we know (∗∗ ɛ/2 ) for all |d|, we get (∗∗ ɛ ) forlarge |d| with A = B = 1.]In view of the formulasandh ⋆ (R) = φ K (f R )h ⋆ (O K ),d R = f 2 Rd OK ,it suffices to show that there exist real constants A ′ ɛ > 0 and B ′ ɛ > 0such that for every quadratic imaginary field K and every integer f ≥ 1,we haveA ′ ɛf 1−ɛ ≤ φ(f) ≤ B ′ ɛf 1+ɛ .In view of the definition of φ K , this is immediate from the two followingobservations. First, for large (how large depending on ɛ) primes p, wehavep 1−ɛ ≤ p − 1 ≤ φ K (p) ≤ p + 1 ≤ p 1+ɛ .Second, for the finitely many, say N, small primes p where this fails,we can find real constants A ′′ɛ > 0 and B ɛ ′′ > 0 such thatA ′′ɛ p 1−ɛ ≤ p − 1 ≤ φ K (p) ≤ p + 1 ≤ B ′′ɛ p 1+ɛholds for these N primes. We defineA ′ ɛ := (A ′′ɛ ) N , B ′ ɛ := (B ′′ɛ ) N .Then we have the desired inequalityA ′ ɛf 1−ɛ ≤ φ K (f) ≤ B ′ ɛf 1+ɛ .Once we have this, we combine it with Siegel’s theorem for quadraticimaginary fields to conclude that for every quadratic imaginary orderR we haveA ɛ A ′ ɛ|d R | 1 2 −ɛ/2 ≤ h ⋆ (R) ≤ B ɛ B ′ ɛ|d R | 1 2 +ɛ/2 .Then as soon as |d R | is large enough thatand1 ≤ A ɛ A ′ ɛ|d R | ɛ/2B ɛ B ′ ɛ|d R | −ɛ/2 ≤ 1,we get the assertion of the theorem.It is also convenient to introduce the (normalized) Kronecker classnumber of a quadratic imaginary order R, H ⋆ (R), defined as the sum□

LANG-TROTTER REVISITED 35of the normalized class numbers of all orders between R and the ringof integers O in its fraction field:∑H ⋆ (R) :=h ⋆ (R ′ ).orders R⊂R ′ ⊂OCorollary 5.2. Given a real ɛ > 0, there exists a real constant C ɛ > 0such that for any quadratic imaginary order R with |d R | ≥ C ɛ , we havethe inequalities|d R | 1 2 −ɛ ≤ H ⋆ (R) ≤ |d R | 1 2 +ɛ .Proof. We trivially have H ⋆ (R) ≥ h ⋆ (R), so we get the asserted lowerbound for H ⋆ (R). To get the lower bound, recall from the proof of theprevious theorem that for any quadratic imaginary order R ′ , we haveSo we getH ⋆ (R) ≤h ⋆ (R ′ ) ≤ B ɛ B ′ ɛ|d R ′| 1 2 +ɛ/2 .∑orders R⊂R ′ ⊂OB ɛ B ′ ɛ|d R ′| 1 2 +ɛ/2 .The co-conductors f c R ′ := f R/f R ′ of these intermediate orders withrespect to R are precisely the divisors of f R , and we haved R ′ = d R /(f c R ′)2 .Thus we haveH ⋆ (R) ≤ ∑ n|f RB ɛ B ′ ɛ|d R /n 2 | 1 2 +ɛ/2 .But the sum∑n≥11/n 1+ɛconverges, to ζ(1 + ɛ), so we get the inequalityH ⋆ (R) ≤ B ɛ B ′ ɛζ(1 + ɛ)|d R | 1 2 +ɛ/2for all quadratic imaginary R, and we need only take |d R large enoughthatB ɛ B ′ ɛζ(1 + ɛ)|d R | −ɛ/2 ≤ 1to insure the asserted upper bound.□

36 NICHOLAS M. KATZ6. Point-count estimatesWe now return to the modular curve M ord /k Recall that we fix acharacteristic p > 0, three prime-to-p positive integers (L, M, N 0 ) anda power p ν ≥ 1 of p. We assume that (L, M, N 0 ) are pairwise relativelyprime. We assume that either M ≥ 4 or N 0 ≥ 3 or p ν ≥ 4. Wework over a finite extension k/F p given with a primitive N 0 ’th root ofunity ζ N0 ∈ k. We have the smooth, geometrically connected modularcurve M ord /k, which parameterizes isomorphism classes of fibrewiseordinary elliptic curves over k-schemes endowed with a Γ 0 (L)-structure,a Γ 1 (M)-structure, a Γ(N 0 )-structure, and an Ig(p ν )-structure.For a finite extension F q /k, and a prime-to-p integer A with |A| A 2 /4 such that (A, q) satisfies the conditions of theprevious lemma. If p = 2, suppose further that q ≥ 8. Then there exist□

LANG-TROTTER REVISITED 37infinitely many powers Q of q such that (A, Q) satisfies these sameconditions.Proof. We first observe that the “moreover” part of Lemma 4.2, andthe assumption that q ≥ 8 if p = 2, insures that q ≥ p ν . So the p-partof the second condition is simply that A ≡ 1 mod p ν , and this willhold whatever power Q we take. The other conditions depend only onq mod LMN0 2 . As q is invertible mod LMN0 2 , we have q e ≡ 1 modLMN0 2 for some divisor e of φ(LMN0 2 ). Then every power Q := q 1+ne ,n ≥ 1 has Q ≡ q mod LMN0 2 .□Theorem 6.3. Given a prime-to-p integer A, suppose there exists anF q /k with q > A 2 /4 such that (A, q) satisfies the conditions of Lemma6.1. If p = 2, suppose further that q ≥ 8. Given a real number ɛ > 0,there exists a real constant C(A, ɛ, M ord /k) such that whenever F Q /k isa finite extension with Q ≥ C(A, ɛ, M ord /k) such that (A, Q) satisfiesthe conditions of Lemma 6.1, then we have the inequalitiesQ 1 2 −ɛ ≤ #M ord (A, Q) < Q 1 2 +ɛ .Proof. This is immediate from Lemma 6.1 and the Brauer-Siegel inequalities:the discriminant of Z[(F − 1)/N 0 ], for F relative to F Q , is(A 2 − 4Q)/N 2 0 , and A and N 0 are fixed while Q grows. □We now explain how to pass from estimates for F Q -points to estimatesfor closed points of norm Q, with given A. Denote by M ordclosed (A, Q)the set of closed points of norm Q giving rise to (A, Q), and byM ord (A, Q) prim ⊂ M ord (A, Q)the subset of those F Q -points which, viewed simply as points in M ord (F Q ),come from no proper subfield k ⊂ F Q1 F Q . As noted at the end ofsection 3, we have#M ordclosed(A, Q) = #M ord (A, Q) prim / log #k (Q).So our basic task is to estimate #M ord (A, Q) prim .Lemma 6.4. Let A be a prime to p integer, Q a prime power, and F q ⊂F Q a subfield. There exists a list, depending on (A, Q, q), of at mostsix integers a such that if E 0 /F q is an elliptic curve with #E 0 (F Q ) =Q + 1 − A, then #E 0 (F q ) = q + 1 − a for some a on the list.Proof. Since A is prime to p, any such E 0 /F q becomes ordinary overF Q , so is already ordinary. Denote by n := deg(F Q /F q ), by F theFrobenius of E 0 ⊗ Fq F Q //F Q , and by F 0 the Frobenius of E 0 /F q . Wehave an inclusion of ordersZ[F ] ⊂ Z[F 0 ].

38 NICHOLAS M. KATZThese orders have the same fraction field K, and in K we have (F 0 ) n =F . But K is quadratic imaginary, so it contains at most 6 roots ofunity. So if F , a root of X 2 − AX + q in K, has any n’th roots in K, ithas at most 6, since the ratio of any two is a root of unity in K. Thelist is then the list of traces, down to Q, of all the n’th roots of F . □In fact, we will need only the following standard fact, whose proofwe leave to the reader.Lemma 6.5. Let A be an integer, q a prime power, and Q = q 2 . IfE 0 /F q is an elliptic curve with #E 0 (F q 2) = q 2 +1−A, then #E 0 (F q ) =q + 1 − a with a one of the two roots of X 2 − 2q = A.Theorem 6.6. Given a prime-to-p integer A, suppose there exists anF q /k with q > A 2 /4 such that (A, q) satisfies the conditions of Lemma6.1. If p = 2, suppose further that q ≥ 8. Given a real number ɛ > 0,there exists a real constant C ′ (A, ɛ, M ord /k) such that whenever F Q /k isa finite extension with Q ≥ C ′ (A, ɛ, M ord /k) such that (A, Q) satisfiesthe conditions of Lemma 6.1, then we have the inequalitiesQ 1 2 −ɛ ≤ #M ord (A, Q) prim < Q 1 2 +ɛ .Proof. The statement only gets harder as ɛ shrinks, so it suffices totreat the case when 0 < ɛ < 1/10. If the degree of F Q over k is odd,we will use only the trivial inequality#M ord (A, Q) − #M ord (A, Q) prim ≤ ∑k⊂F qF Q#M ord (F q ).Whatever the value of q, we have a uniform upper upper bound of theform#M ord (F q ) ≤ σq,for σ the sum of the Betti numbers of M ord ⊗ k k. But if deg(F Q /k) isodd, each of the at most log #k (Q) terms is at most σQ 1 3 , so this erroris, for large Q, negligeable with respect to Q 1 2 −ɛ .If the degree of F Q over k is even, we can still use the above crudeargument to take care of imprimitive points which come from a subfieldk ⊂ F q F Q with deg(F Q /F q ) ≥ 3.But we must be more careful about imprimitive points in #M ord (A, Q)which come from the subfield F q ⊂ F Q over which F Q is quadratic. IfX 2 − 2q = A has no integer solutions, there are no such imprimitivepoints. If X 2 − 2q = A has integer solutions, say ±a, then the numberof such imprimitive points in #M ord (A, Q) is#M ord (a, q) + #M ord (−a, q).

LANG-TROTTER REVISITED 39If we take Q so large that √ Q is large enough for Theorem 6.3 to applyto the sets M ord (±a, q), then these sets have size at most Q 1 4 + ɛ 2 , againnegligeable with respect to Q 1 2 −ɛ .□Combining this with the identity#M ordclosed(A, Q) = #M ord (A, Q) prim / log #k (Q),and noting that log #k (Q) is negligeable with respect to Q ɛ , we get thefollowing corollary.Corollary 6.7. Given a prime-to-p integer A, suppose there exists anF q /k with q > A 2 /4 such that (A, q) satisfies the conditions of Lemma6.1. If p = 2, suppose further that q ≥ 8. Given a real number ɛ >0, there exists a real constant C ′′ (A, ɛ, M ord /k) such that wheneverF Q /k is a finite extension with Q ≥ C ′′ (A, ɛ, M ord /k) such that (A, Q)satisfies the conditions of Lemma 6.1, then we have the inequalitiesQ 1 2 −ɛ ≤ #M ordclosed(A, Q) < #M ord (A, Q) < Q 1 2 +ɛ .To end this section, we interpret its results in terms of the mod NGalois images G N := ρ N (π 1 (M ord )) and their subsets G N (A, Q) ⊂ G Nintroduced in section 2.Theorem 6.8. Given a prime-to-p integer A, suppose that for thesingle value N := LMN 2 0 p ν , A mod N is the trace of some elementof G N . Then there exist infinitely many closed points P of M ord withA P = A.Proof. By Chebotarev, every conjugacy class in G N is the image ofF rob P for infinitely many closed points P. In particular, every conjugacyclass in G N is the image of some F rob P with N(P) := Q ≥Max(A 2 /4, 8). By Lemma 4.2, we have Q ≥ p ν , and (A P , Q) satisfiesthe two conditions of that lemma, namely(1) X 2 − A P X + Q factors completely mod L,(2) A P ≡ Q + 1 mod MN0 2 p ν .But A ≡ A P mod N, and hence (A, Q) satisfies these same two conditions.The result now follows from Lemma 6.2 and Corollary 6.7,applied to (A, Q).□Similarly, we have the following result.Theorem 6.9. Given a prime-to-p integer A and a power q of #k withq ≥ Max(A 2 /4, 8), suppose that for the single value N := LMN 2 0 p ν ,the subset G N (A, q) ⊂ G N is nonempty. Then there exist infinitelymany closed points P of M ord with A P = A and with N(P) ≡ q modLMN 2 0 .

40 NICHOLAS M. KATZProof. Pick an element γ in G N (A, q); its conjugacy class in G N is theimage of F rob P for infinitely many closed points P, so is the image ofsome F rob P with N(P) := Q ≥ Max(A 2 /4, 8). Exactly as in the proofof the theorem above, Q ≥ p ν and (A P , Q) satisfies the two conditionsof Lemma 4.2. We write these now as three conditions, breaking thesecond one into a prime-to-p part and a p-part.(1) X 2 − A P X + Q factors completely mod L,(2a) A P ≡ Q + 1 mod MN 2 0 .(2b) A P ≡ Q + 1 mod p ν .As F rob P lands in G N (A, Q), we have the congruences A ≡ A P modN and Q ≡ q mod LMN0 2 . Both Q and q are 0 mod p ν . Hence (A, Q)satisfies these same conditions, and we conclude as above. □7. Exact and approximate determination of Galois imagesIf we take the inverse limit of the mod N representations as N growsmultiplicatively, we get a representationρ = ρ not p × ρ p ∞ : π 1 (M ord ) → GL(2, Ẑnot p) det in (#k) Ẑ × Z × p .Here Ẑnot p := ∏ l≠p Z l, and (#k)Ẑ is the closed subgroup of (Ẑnot p) ×profinitely generated by #k. Under this representation, the geometricfundamental group lands in SL(2, Ẑnot p) × Z × p .The following theorem is certainly well known to the specialists. Wegive a proof for lack of a suitable reference.Theorem 7.1. In suitable bases, the image groupρ(π 1 (M ord )) ⊂ GL(2, Ẑnot p) det in (#k) Ẑ × Z × pconsists of those elements which mod L have the shape (⋆, 0, ⋆, ⋆), modM have the shape (1, 0, ⋆, ⋆), mod N 0 have the shape (1, 0, 0, 1), mod p νhave the shape (1) (i.e., the p-component is 1 mod p ν ). The image ofthe geometric fundamental group,ρ(π geom1 (M ord )) ⊂ SL(2, Ẑnot p) × Z × pis just the intersection of ρ(π 1 (M ord )) with SL(2, Ẑnot p) × Z × p ,i.e., itconsists of those elements of SL(2, Ẑnot p)×Z × p with the imposed shapes.Proof. In a basis adapted to the imposed level structures, every elementof the image ρ(π 1 (M ord )) has the asserted shapes.To see this, denoteby K the function field of M ord , and by K an algebraic closure of K.Viewing η := Spec(K) as a geometric generic point of M ord , π 1 (M ord )

LANG-TROTTER REVISITED 41viewed as π 1 (M ord , η) is a quotient of Aut(K/K), and ρ on Aut(K/K)is the action of this group on the profinite group∏T l (E univ (K)) = T not p (E univ (K)) × T p (E univ (K)).all primes lHere T not p (E univ (K)) is a free Ẑnot p-module of rank 2, and T p (E univ (K))is a free Z p -module of rank one. Then take any Z p -basis of T p , andany Ẑnot p-basis of T not p adapted to the imposed Γ 0 (L), Γ 1 (M), andΓ(N 0 )-structures. Then Aut(K/K) acts through elements of the assertedshape.We next explain that it suffices to show that the imageρ(π geom1 (M ord )) ⊂ SL(2, Ẑnot p) × Z × pis as asserted. For if F ∈ π 1 (M ord )) is any element of determinant #k,then ρ(π 1 (M ord )) is the semidirect product of ρ(π geom1 (M ord )) with theẐ generated by F . [Such elements F exist: if M ord has a k-point, takeits Frobenius, otherwise take the ratio of Frobenii at two closed pointswhose large degrees differ by one.] The key point is that ρ(F ) is anelement of GL(2, Ẑnot p) det in (#k) Ẑ × Z × p of the asserted shape. By theexplicit description of ρ(π geom1 (M ord )), this semidirect product itselfhas the asserted description.That the imageρ(π geom1 (M ord )) ⊂ SL(2, Ẑnot p) × Z × pis as asserted is a geometric statement, so we may extend scalars fromk to k. Suppose first that either M ≥ 4 or that N 0 ≥ 3. In that casewe can consider the moduli problem M 0 /k where we require Γ 0 (L),Γ 1 (M), and (oriented) Γ(N 0 )-structures, but no longer impose eitherordinarity or any further condition on p-power torsion. Suppose weknow that for M ord0 , the imageρ(π geom1 (M ord0 )) ⊂ SL(2, Ẑnot p) × Z × pis as asserted. Then we argue as follows. By a fundamental theorem ofIgusa, cf. [Ig] and [K-M, 12.6.2], at any supersingular point s ∈ M 0 (k),the p-adic character ρ p ∞ restricted to the inertia group I s at s haslargest possible image:ρ p ∞(I s ) = Z × p .Therefore the covering M ord → M ord0 is finite étale galois, with group(Z/p ν Z) × . So ρ(π geom1 (M ord )) ⊂ ρ(π geom1 (M ord0 )) is an open subgroupof index φ(p ν ). But ρ(π geom1 (M ord )) lies in the group it is asserted to be,

42 NICHOLAS M. KATZand that group has the same index φ(p ν ) in the known ρ(π geom1 (M ord0 )).So we get the asserted description of ρ(π geom1 (M ord )).We now show that for M ord0 , the imageρ(π geom1 (M ord0 )) ⊂ SL(2, Ẑnot p) × Z × pis as asserted. By Igusa’s theorem, at any supersingular point of M 0 ,ρ p ∞(I s ) = Z × p . But the representation ρ not p is everywhere unramifiedon M 0 , so ρ(I s ) = {1} × Z × p in the product SL(2, Ẑnot p) × Z × p . So weare reduced to showing that the imageρ not p (π geom1 (M ord0 )) ⊂ SL(2, Ẑnot p)is as asserted. This follows from the tame specialization theorem[Ka-ESDE, 8.17.14] and the corresponding result over C. The modulischeme M 0 is one geometric fibre of the corresponding modulischeme M 0 over /Z[ζ N0 ][1/LMN 0 ], which one knows has a propersmooth compactification M 0 over Z[ζ N0 ][1/LMN 0 ] with “infinity” adivisor which is finite étale over Z[ζ N0 ][1/LMN 0 ]. Extend scalars fromZ[ζ N0 ][1/LMN 0 ] to the Witt vectors W (k). On this scheme M 0 /W (k),the lisse Ẑnot p-sheaf which “is” ρ not p is (automatically) tamely ramifiedalong “infinity”, so by the tame specialization theorem its geometricmonodromy is the same on the special fibre as on the geometricpoint over the generic fibre gotten by choosing (!) an embedding ofW (k) ⊂ C.It remains to show that the imageρ(π geom1 (M ord )) ⊂ SL(2, Ẑnot p) × Z × pis as asserted in the general case, i.e., without the assumption thateither M ≥ 4 or N 0 ≥ 3. To treat this case, pick two distinct primes l 1and l 2 , both of which are odd and prime to LMN 0 p. Consider the moduliproblems M ord1 , respectively M ord2 , over k where in addition to imposingan M structure we impose also an oriented Γ(l 1 )-structure, resp.an oriented Γ(l 2 )-structure. The two groups ρ(π geom1 (M ordi )), i = 1, 2,are then known. Both are subgroups of ρ(π geom1 (M ordi )), and togetherthey visibly generate the asserted candidate forρ(π geom1 (M ordi )). □Using this result, one can say something, again well known to thespecialists, in the case of general families.Theorem 7.2. Let E/U/k be a family of fibrewise ordinary ellipticcurves with nonconstant j-invariant over a base curve U/k, k a finitefield, which is smooth and geometrically connected.

LANG-TROTTER REVISITED 43(1) The image ρ(π geom1 (U)) is open in SL(2, Ẑnot p) × Z × p ; thereexists an integer D = D 0 p ν , D 0 prime to p and ν ≥ 0, suchthat ρ(π geom1 (U)) contains the subgroupKer(SL(2, Ẑnot p) × Z × p → SL(2, Z/D 0 Z) × (Z/p ν Z) × )which is the kernel of reduction mod (D 0 , p ν ).(2) Denote by G geomD⊂ SL(2, Z/D 0 Z)×(Z/p ν Z) × the mod D imageρ D (π geom1 (U)), and denote by G D ⊂ GL(2, Z/D 0 Z) × (Z/p ν Z) ×the mod D image ρ D (π 1 (U)). Then G geomDis a normal subgroupof G D , and the quotient is cyclic, generated by the image ρ D (F )of any element F ∈ π 1 (U)) such that ρ not p (F ) has determinant#k.(3) An element γ 0 ∈ SL(2, Ẑnot p) × Z × p lies in ρ(π geom1 (U)) if andonly if mod D it lies in G geomD .(4) Suppose given an element γ ∈ GL(2, Ẑnot p) det in (#k) Ẑ × Z × p ,with det(γ not p ) = (#k) n , n ∈ Ẑ. This element lies in ρ(π 1(U))if and only if γ mod D lies the coset ρ D (F n )G geomDof G D .Proof. It suffices to prove (1). For (2) is universally true, and (1)and (2) together imply (3). For (4), the condition given is obviouslynecessary; applying (3) to F −n γ we see that it is sufficient.To prove (1) we argue as follows. The assertion is geometric, so wemay extend scalars from k to k. It suffices to prove it for some finiteétale cover U 1 of U, since π 1 (U 1 ) is a subgroup of π 1 (U). So we mayassume choose an odd prime l ≠ p and reduce to the case when E/Uhas an oriented Γ(l)-structure. Then we have a classifying map U →M ord (l), for M(l) the Γ(l) modular curve. This map is nonconstant,because our family has nonconstant j-invariant. Therefore the imageof π 1 (U) in π 1 (M ord (l)) is a closed subgroup of finite index, hence anopen subgroup of finite index, in π 1 (M ord (l)), to which we apply thetheorem.□Given E/U/k as in the above theorem, fibrewise ordinary with nonconstantj-invariant, we say that any integer D for which part (1) of thecorollary holds is a modulus for E/U/k. Of course if D is a modulus,so is any multiple of D.8. Gekeler’s product formulaTo motivate this section, we first explain the heuristic which underliesit. Given a family E/U/F q with nonconstant j-invariant, we knowthe Sato-Tate conjecture for this family, cf. Deligne [De-WeilII, 3.5.7].Given a finite extension F Q /F q , attached to each point u ∈ U(F Q ) is an

44 NICHOLAS M. KATZelliptic curve E u,FQ /F Q , which gives rise to data (A u,FQ , Q), which inturn gives rise to the real number t u,FQ := A u,FQ /(2 √ Q) ∈ [−1, 1]. TheSato-Tate theorem says that as Q grows, these #U(F Q ) real numberst u,FQ ∈ [−1, 1] become equidistributed for the measure 2 (√ 1 − tπ 2 )dton [−1, 1]. This means that∫for any continuous C-valued function f on[−1, 1], we can compute 2 1 f(t)(√ 1 − tπ −1 2 )dt as the large Q limit of(1/#U(F Q )) ∑ u∈U(F f(t q) u,F Q). For a fixed Q, we make the change ofvariable t = A/(2 √ Q), so the integral becomes2π∫ 2√ Q−2 √ Qf(A/(2 √ Q))( √ 1 − A 2 /4Q)dA/(2 √ Q) =∫ 2√ Q= 2 1f(A/(2 √ Q))( √ 4Q − Aπ 4Q2 )dA.−2 √ QAnd the approximating sum is∑(1/#U(F Q )) f(A u,FQ /(2 √ Q)).u∈U(F q)Since there are “about” Q points in U(F Q ), it is “as though” a giveninteger A ∈ [−2 √ Q, 2 √ Q] occurs as an A u,FQ for “about”1 √4Q − A22πof the u ∈ U(F q ); this is the Sato-Tate heuristic.We have already discussed how congruence obstructions can preventsome particular (A, Q) from occurring at all in a given family. TheGekeler product formula says that, at least in certain modular families,whenever (A, Q) is ordinary and has no archimedean or congruenceobstruction, we can use congruence considerations to compute the ratio#{u ∈ U(F Q )|A u,FQ = A}√ .4Q − A212πThe prototypical example of computing such a ratio by “congruenceconsiderations” is Dirichlet’s class number formula for a quadatic imaginaryfield K:L(1, χ) =2πh K√w K |dK | .Here h K = h(O K ) is the class number, w K = #O × Kis the order of thegroup of roots of unity in K, and d K is the discriminant of O K . So interms of the normalized class numberh ⋆ K := h K /w K

the formula readsLANG-TROTTER REVISITED 45L(1, χ) =12πh ⋆ K√|dK | .In this example, the ratio is the value L(1, χ), and “congruence considerations”give the Euler factors, whose conditionally convergent productis L(1, χ). Indeed, it is precisely this class number formula whichunderlies Gekeler’s, as we will see.We return now to a family E/U/F q with nonconstant j-invariant.Fix data (A, Q) with A prime to p, |A| < 2 √ Q, and no congruenceobstruction. We introduced, for every integer N ≥ 2 the finite groupsG N , their normal subgroups G geomN⊳ G N , the cosetsG N,det=Q ⊂ G N ,and their subsetsG N (A, Q) ⊂ G N,det=Q ,whose cardinalities were denoted g N (A, Q) and g N,det=Q . We also introducedthe rational number∑g N (avg, Q) = (1/N)g N,det=Q = (1/N) g N (A, Q).Gekeler’s idea is to consider the ratiosA mod Ng N (A, Q)/g N (avg, Q) = Ng N (A, Q)/g N,det=Q ,to show they have a “large N limit’, and then to show that this limitis the ratio#{u ∈ U(F Q )|A u,FQ = A}12π√4Q − A2Let us be more precise. We have the following elementary lemma.Lemma 8.1. Let D be a modulus for E/U/F q . Suppose given (A, Q)with Q a power of #k and A an integer prime to p with A 2 < 4Q.Suppose that (A, Q) has no congruence obstruction. Suppose N ≥ 2and M ≥ 2 are relatively prime. Suppose further that N is relativelyprime to D.(1) Under the “reduction mod NM” map we have an isomorphismof groupsG geomNM(2) We have a bijection of cosetsG NM,det=Q(3) We have a bijection of setsG NM (A, Q)∼−→ G geomN× G geomM .∼−→ G N,det=Q × G M,det=Q .∼−→ G N (A, Q) × G M (A, Q)..

46 NICHOLAS M. KATZ(4) For a prime number l prime to pD and an integer n ≥ 1, wehave= SL(2, Z/l n Z),G geoml nG l n ,det=Q = {γ ∈ GL(2, Z/l n Z)| det(γ) = Q},G l n(A, Q) = {γ ∈ GL(2, Z/l n Z)| det(γ) = Q, Trace(γ) = A}.(5) If the characteristic p is prime to D, then for any n ≥ 1, wehaveG geomp = n (Z/pn Z) × ,G p n ,det=Q = (Z/p n Z) × ,G p n(A, Q) = {α ∈ (Z/p n Z) × | α ≡ unit Q (A) mod p n }.Proof. Assertions (1), (4) and (5) result from Theorem 7.2. Assertion(1) implies (2) by the definition of G N,det=Q as a coset, and (2) implies(3) trivially. □Remark 8.2. In the case of any of the moduli problems we have considered,Theorem 7.1 shows that the image groupρ(π geom1 (M ord )) ⊂ SL(2, Ẑnot p) × Z × p = ∏ l≠pSL(2, Z l ) × Z × pis the product over all primes l, including l = p, of the images ofthe separate l-adic representations. So for (the universal families over)these modular curves, assertions (1), (2) and (3) of Lemma 8.1 hold forevery pair (N, M) of relatively prime integers.Gekeler proves that for a prime number l prime to pD, the sequenceof ratiosl n g l n(A, Q)/g l n ,det=Q, n ≥ 1,i.e., the sequence of ratiosl n #{γ ∈ GL(2, Z/l n Z)| Trace(γ) = A, det(γ) = Q}#SL(2, Z/l n Z)becomes constant for large n, and computes this constant explicitly[Ge, Thm. 4.4], calling it ν l (A, Q). He also shows that so long as l is,in addition, either prime to A 2 − 4Q or split in K := Q( √ A 2 − 4Q),thenν l (A, Q) = 1/(1 − χ(l)l )is the Euler factor at l in L(1, χ) for χ the quadratic character attachedto the field K. And if the characteristic p does not divide D, it isimmediate from the definitions that the sequencep n g p n(A, Q)/g p n ,det=Q, n ≥ 1,

is constant, with valueLANG-TROTTER REVISITED 47(p n × 1)/φ(p n ) = 1/(1 − 1 p ),the Euler factor at p of the same L(1, χ).To go further, we must define a reasonable factor “at D”. It should betrue that for any sequence of positive integers M n such that M n |M n+1and such that D n |M n for all n ≥ 1, the sequence of ratiosM n g Mn (A, Q)/g Mn,det=Q, n ≥ 1,becomes constant for large n, and that this constant is independent ofthe particular choice of the sequence of M n as above. If this is true, wewould call this constant ν D (A, Q). [For the moduli problems we havebeen considering, the problem of defining the factor “at D” is reducedto the problem of defining the factor separately at each prime dividingD, cf. Remark 8.2.] The most optimistic conjecture would then be thefollowing.Conjecture 8.3. Let E/U/F q be fibrewise ordinary with nonconstantj-invariant, D a modulus. Suppose that U = U max . If (A, Q) hasneither archimedean nor congruence obstruction, then#{u ∈ U(F Q )|A u,FQ = A}√ = ν1D (A, Q) ∏ ν l (A, Q),2π 4Q − A2l∤Dwhere the conditionally convergent product is defined by∏∏ν l (A, Q) := lim ν l (A, Q).l∤DX→∞l

48 NICHOLAS M. KATZcurve V/F q and a finite flat F q -map, f : V → U, such that the inducedmaps of fundamental groupsf ⋆ : π geom1 (V ) → π geom1 (U), f ⋆ : π 1 (V ) → π 1 (U)are both surjective. Now consider the pullback E V /V/F q of E/U/F q bythe map f. This pullback family also has V = V max (because supersingularpoints, resp. points of potentially multiplicative reduction downstairshave their inverse images upstairs supersingular, resp. pointsof potentially multiplicative reduction). Since the pullback family hasthe same galois image data, the notion of congruence obstruction isthe same for the original family and for its pullback. So the conjecturepredicts that for each (A, Q) with no congruence obstruction, we have#{u ∈ U(F Q )|A u,FQ = A} = #{v ∈ V (F Q )|A v,FQ = A}.Fixing Q and summing over the allowed A, which are the same upstairsand down, we get the equality#U(F Q ) = #V (F Q ).As we will recall below, one condition that forces f ⋆ to be surjectiveon fundamental groups is that it be fully ramified over some ¯F q -point,say over u 0 ∈ U( ¯F q ), with unique point v 0 ∈ V ( ¯F q ) lying over u 0 . Givensuch an f, we are to have#U(F Q ) = #V (F Q ).But of course this is nonsense in general. Here is the simplest example.Work over a prime field F p with p ≡ 1 mod 3, pick a cuberoot of unity, and take for E/U/F p the universal family for the moduliproblem of oriented Γ(3) structures. Here the modular curve M Γ(3) isP 1 \ {µ 3 , ∞}, with parameter µ and universal familyX 3 + Y 3 + Z 3 = 3µXY Z.In this family, we have multiplicative reduction at each missing point.And while there are p−1 supersingular points over ¯F p , no supersingularpoint is F p -rational (simply because over F p with p ≥ 5, supersingularpoints have A = 0, whereas our A’s satisfy A ≡ p + 1 mod 9, so arecertainly nonzereo). ThusM ordΓ(3)(F p ) = F p \ {µ 3 }has p − 3 points. Now consider the pullback family by the doublecovering “square root of µ” of U := P 1 \ {µ 3 , ∞} by V := P 1 \ {µ 6 , ∞}.Explicitly, this is the familyX 3 + Y 3 + Z 3 = 3µ 2 XY Z.

LANG-TROTTER REVISITED 49HereV (F p ) = F p \ {µ 6 }has p − 6 points.Here is the precise surjectivity statement used above, whose proofwe owe to Deligne. It is not as well known as it should be.Lemma 8.4. Let X and Y be connected, locally noetherian schemes,and f : X → Y a morphism which is proper and flat. Suppose that forsome geometric point y of Y , say with values in the algebraically closedfield K, the fibre X y (K) := f −1 (y)(K) consists of a single K-valuedpoint x ∈ X(K). Then the map of fundamental groupsis surjective.f ⋆ : π 1 (X, x) → π 1 (Y, y)Proof. For any X-scheme h : Z → X, we can also view Z as a Y -scheme, by f ◦ h. So we have the fibres Z x (K) := h −1 (x)(K) andZ y (K) := (f ◦ h) −1 (y)(K). The hypothesis that f −1 (y)(K) = x insuresthat Z x (K) = Z y (K).Let g : E → Y be finite étale of some degree d ≥ 1, with E connected,and denote by g X : E X → X its pullback to a finite étale cover of X,of the same degree d. We must show that E X remains connected. Letj : Z ⊂ E X be the inclusion of a connected component Z of E X , andW := f E (Z) ⊂ E its image in E. As f is proper and flat, so is f E . AsZ is both open and closed in E X , its image W := f E (Z) ⊂ E is bothclosed and open in E, and hence W = E.Z⏐↓jf E |Z−−−→ W⏐↓ =E X⏐↓ g Xf E−−−→ E⏐fX −−−→ YSo the fibre W y (K) of W over y consists of d points. But Z maps ontoW , hence, viewing Z as a Y -scheme (by f ◦g X ◦j) and f E |Z : Z → W asa Y -morphism , Z y (K) maps onto W y (K). Therefore Z y (K) consists ofat least d points. But Z x (K) = Z y (K), as noted above, hence Z x (K)has at least d points. But the entire fibre (E X ) x (K) has d points.Therefore Z and E X have the same fibre over x; as both are finite étaleover X and Z ⊂ E X , we conclude that Z = E X . Thus E X is connected,as required.□↓ g

50 NICHOLAS M. KATZDespite the failure of the conjecture above in general, there are certainmodular families of elliptic curves for which the conjecture holds.Theorem 8.5. (Gekeler) The conjecture is true for (the universal fibrewiseordinary families over) the Igusa curves Ig(p ν )/k/F p , any p ν ≥ 4.Proof. For this family, Theorem 7.1 tells us thatandρ(π geom1 (Ig(p ν ))) = SL(2, Ẑnot p) × (1 + p ν Z p ),ρ(π 1 (Ig(p ν )) = GL(2, Ẑnot p) det in (#k) Ẑ × (1 + p ν Z p ).So here we can take D = p ν . Take an (A, Q) with neither congruencenor archimedean obstruction. Then A is prime to p, unit Q (A) ≡ 1 modp ν , and A 2 < 4Q. For l ≠ p, the local factor is Gekeler’s ν l (A, Q).What about the factor ν p ν(A, Q) at D = p ν ? For any integer n ≥ ν,g p n(A, Q) is the ratiop n #{γ ∈ ((1 + p ν Z p )/(1 + p n Z p ))| γ ≡ unit Q (A) mod p n },#((1 + p ν Z p )/(1 + p n Z p ))which is just = p n × 1/p n−ν = p ν , which in turn isand henceφ(p ν ) × (1 − 1/p) −1 ,ν p ν(A, Q) = φ(p ν ) × (1 − 1/p) −1 .Gekeler proves [Ge, Cor. 5.4] (remember his H ⋆ is twice ours and hewrites H ⋆ (A 2 − 4Q) for H ⋆ (Z[F ])) that(1 − 1/p) −1 ∏ l≠pν l (A, Q) = 2πH⋆ (Z[F ])√4Q − A2 .Hence we haveν p ν(A, Q) ∏ l≠pν l (A, Q) = φ(pν )H ⋆ (Z[F ])√ .4Q − A212πBut the numerator φ(p ν )H ⋆ (Z[F ]) is precisely#{u ∈ Ig(p v )(F Q )|A u,FQ = A},cf. Lemma 4.3, (1).□Here is a slight generalization of Gekeler’s result.

LANG-TROTTER REVISITED 51Theorem 8.6. Let N = N 0 p ν with N 0 prime to p. Supppose thateither N 0 ≥ 3 or that p ν ≥ 4. Let k/F p be a finite field containinga chosen primitive N 0 ’th root of unity. Let E univ /M ord /k be the universalfamily of ordinary elliptic curves endowed with both an orientedΓ(N 0 )-structure and an Ig(p ν )-structure. The conjecture is true forthis family.Proof. Suppose (A, Q) has neither archimedean nor congruence obstruction.Our first task is to compute, for this family, the local factorsν l (A, Q, M ord ) at the primes l dividing pN 0 .Suppose we have done this. Then we proceed as follows. We haveseen in Lemma 4.3, (1) and (4), that#{u ∈ M ord (F Q )|A u,FQ = A}= φ(p ν )#SL(2, Z/N 0 Z)H ⋆ (Z[(F − 1)/N 0 ]).So what we must show is thatφ(p ν )#SL(2, Z/N 0 Z)H ⋆ (Z[(F − 1)/N 0 ])√4Q − A2= ( ∏12πThe factor ν p ν(A, Q, M ord ) at p isl|pN 0ν l (A, Q, M ord ))( ∏ l∤N 0ν l (A, Q)).ν p ν(A, Q, M ord ) = φ(p ν ) × (1 − 1/p) −1 ,exactly as in the proof of the previous theorem.theorem, we have(1 − 1/p) −1 ∏ l≠pν l (A, Q) = H⋆ (Z[F ])√ .4Q − A212πAccording to thatComparing these two formulas, what we must show is that∏ ν l (A, Q, M ord )= #SL(2, Z/N 0 Z) H⋆ (Z[(F − 1)/N 0 ]).ν l (A, Q)H ⋆ (Z[F ])l|N 0We next express the right hand side as a product over the primesdividing N 0 . Factoring N 0 = ∏ l n ii , we have#SL(2, Z/N 0 Z) = ∏#SL(2, Z/l n ii Z).l i |N 0We can factor the ratioH ⋆ (Z[(F − 1)/N 0 ])H ⋆ (Z[F ])

52 NICHOLAS M. KATZas follows. Denote by K the fraction field of Z[F ], O K its ring ofintegers, χ K the quadratic character corresponding to K/Q, φ K themultiplicative function introduced in the proof of Theorem 5.1, andWe have the formulasf := the conductor of the order Z[(F − 1)/N 0 ].H ⋆ (Z[(F − 1)/N 0 ]) = ∑ φ K (d)h ⋆ (O K ),d|fH ⋆ (Z[F ]) = ∑φ K (d)h ⋆ (O K ).d|fN 0Because φ K is multiplicative, we have the formulas∑φ K (d) = ∏ ∑φ K (l a ),d|fl|f a≥0, l a |f∑φ K (d) = ∏ ∑φ K (l a ).d|fN 0 l|fN o a≥0, l a |fN 0In these two products, the primes l not dividing N 0 give rise to thesame factor in each. So we getH ⋆ (Z[(F − 1)/N 0 ])H ⋆ (Z[F ])= ∏ ∑a≥0, l a |f φ K(l a )l|N 0∑a≥0, l a |fN 0φ K (l a ) .So we are reduced to showing that for each prime l i dividing N 0 = ∏ l n iiwe haveν li (A, Q, M ord )ν li (A, Q)∑= #SL(2, Z/l n a≥0, lii Z)a i |f φ K(l a i )∑a≥0, l a i |fN φ 0K(l a i ).Fix one such l i := l, and put n := ord l (N 0 ), δ := ord l (f). Thusn + δ = ord l (fN 0 ). We now compute explicitly everything in sight,using the results [Ge, Thm.4.4] of Gekeler. To state them, we firstestablish a bit of notation. Given an arbitrary pair (A 1 , Q 1 ) of integerswith A 2 1 − 4Q 1 < 0, we wish to count the number α l k(A 1 , Q 1 ) of 2 × 2matrices X ∈ M 2 (Z/l k Z) with Trace(X) = A 1 and det(X) = Q 1 , atleast for k large. Attached to (A 1 , Q 1 ) we have the quadratic imaginaryorderZ[F 1 ] := Z[T ]/(T 2 − A 1 T + Q 1 ),

LANG-TROTTER REVISITED 53its fraction field K 1 , ring of integers O K1 , and Dirichlet character χ K1 .We denote by f A1 ,Q 1the conductor of the order Z[F 1 ], and we defineδ 1 := ord l (f A1 ,Q 1).Gekeler shows that for k ≥ 2δ 1 + 2, α l k(A 1 , Q 1 ) is equal tol 2k + l 2k−1 , if χ K1 (l) = 1,l 2k + l 2k−1 − (l + 1)l 2k−δ 1−2 , if χ K1 (l) = 0,l 2k + l 2k−1 − 2l 2k−δ 1−1 , if χ K1 (l) = −1.We apply this first to (A, Q). Then K 1 is just K, f A,Q = N 0 f, andδ 1 = δ + n. So for large k, the factorν l k(A, Q) := l k α l k(A, Q)/#SL(2, Z/l k Z) = α l k(A, Q)/l 2k−2 (l 2 − 1)is easily calculated, as α l k(A, Q) is equal tol 2k + l 2k−1 , if χ K (l) = 1,l 2k + l 2k−1 − (l + 1)l 2k−δ−n−2 , if χ K (l) = 0,l 2k + l 2k−1 − 2l 2k−δ−n−1 , if χ K (l) = −1.We next calculate the factor ν l k+2n(A, Q, M ord ). Here the groupG l k+2n is the group of matrices of the shape 1+l n X, X ∈ M 2 (Z/l n+k Z),and G l ,det=Q, being a coset of G geom = {1+l n X}∩SL(2, Z/l 2n+k Z),k+2n l k+2nhas#G l k+2n ,det=Q = l 3(k+n) .How do we compute the number of X ∈ M 2 (Z/l n+k Z) such that 1+l n Xhas trace A and determinant Q mod l k+2n ? These conditions are2 + l n Trace(X) ≡ A mod l k+2n ,1 + l n Trace(X) + l 2n det(X) ≡ Q mod l k+2n .Because (A, Q) has no congruence obstruction, we know thatA ≡ Q + 1 mod l 2n ,Q ≡ 1 mod l n .Thus the conditions on X areTrace(X) ≡ (A − 2)/l n mod l k+n ,det(X) ≡ (Q + 1 − A)/l 2n mod l k .To count these, we first consider X k mod l k , satisfying the above twoconditions mod l k . The number of such X k mod l k iswithα l k(A 1 , Q 1 ),A 1 := (A − 2)/l n , Q 1 := (Q + 1 − A)/l 2n .

54 NICHOLAS M. KATZOnce we have such an X k mod l k , we lift it arbitrarily to some X k+nmod l k+n ; then can correct this lift by adding to it anything of the forml k Y , Y mod l n , so long as Y has the required trace mod l n , namelyTrace(Y ) ≡ (A 1 − Trace(X k+n ))/l k mod l n .So there are l 3n possible Y , and hence the number of elements inG l k+2n ,det=Q with trace A and determinant Q isThus we getl 3n α l k(A 1 , Q 1 ).ν l k+2n(A, Q, M ord ) = l k+2n l 3n α l k(A 1 , Q 1 )/l 3(k+n) .For this (A 1 , Q 1 ), Z[T ]/(T 2 − A T + Q 1 ) is just Z[(F − 1)/l n ], and soits δ 1 is just δ, the ord l of the conductor of Z[(F − 1)/N 0 ]. Also its K 1is just K. So for k ≥ 2δ + 2, α l k(A 1 , Q 1 ) is given by Gekeler’s formulasl 2k + l 2k−1 , if χ K (l) = 1,l 2k + l 2k−1 − (l + 1)l 2k−δ−2 , if χ K (l) = 0,l 2k + l 2k−1 − 2l 2k−δ−1 , if χ K (l) = −1.With this data at hand, it is straightforward but unenlighteningto verify, case by case depending on the value of χ K (l), the requiredidentityν l (A, Q, M ord )ν l (A, Q)∑ δ= #SL(2, Z/l n a=0Z)φ K(l a )∑ δ+na=0 φ K(l a ) . □Remark 8.7. Perhaps with a more conceptual approach, one couldalso verify the conjecture for the more general moduli problems weconsidered, where we allow also a Γ 0 (L) structure and a Γ 1 (M) structure.What is the relation of the conjectured formula to the formula, interms of orbital integrals, given by Kottwitz in [Ko1, &16, pp. 432-433]and [Ko2, p. 205], when that general formula is specialized to the caseof elliptic curves, cf. also [Cl, &3,&4]?Question 8.8. As explained above, the conjecture is false in general,because of its incompatibility with pullback by a map which is surjectiveon fundamental groups. Nonetheless, one could ask if the followingconsequence of it is asymptotically correct. Take one of themoduli problems M ord /k we have discussed above, and take a finiteflat f : V → M ord , with V/k smooth and geometrically connected,such that f ⋆ is surjective on fundamental groups (e.g., an f which isfully ramified over some point). Fix a prime-to-p integer A, and an

LANG-TROTTER REVISITED 55extension F q /k with q ≥ 8 and A 2 < 4q. We know precisely whatthe congruence obstructions for (A, q) are, and that, if there are none,then there are F q -valued points of M ord whose Frobenii have trace A,cf. Lemmas 4.2, 4.3. We further know that if (A, q) has no congruenceobstruction, then there are infinitely many extensions F Q /k for which(A, Q) has no congruence obstruction, and for each of these there areF Q -valued points of M ord whose Frobenii have trace A, cf. Lemma 6.2.For each such Q, consider the ratio#{v ∈ V (F Q )|A v,FQ = A}#{u ∈ M ord (F Q )|A u,FQ = A} .Is it true that this ratio tends to 1 as Q tends archimedeanly to infinityover the Q’s for which the denominator is nonzero?References[Ba] Baier, Stephan The Lang-Trotter conjecture on average. J. Ramanujan Math.Soc. 22 (2007), no. 4, 299-314.[B-K] Bombieri, E., and Katz, N., A Note on Lower bounds for Frobenius traces,2008 preprint available at www.math.princeton.edu/∼nmk.[Cl] Clozel, Laurent, Nombre de points des variétés de Shimura sur un corps fini(d’aprs R. Kottwitz). Séminaire Bourbaki, Vol. 1992/93. Astérisque No. 216(1993), Exp. No. 766, 4, 121-149.[Co-Shp] Cojocaru, Alina Carmen, and Shparlinski, Igor E., Distribution of Fareyfractions in residue classes and Lang-Trotter conjectures on average, Proc.A.M.S. 136 Number 6 (2008), 1977-1986.[Cox] Cox, David, Primes of the Form x 2 + ny 2 , John Wiley and Sons, New York,1989.[Da-Pa] David, Chantal, and Pappalardi, Francesco, Average Frobenius distributionsof elliptic curves, Internat. Math. Res. Notices 1999 (1999), no. 4, 165-183.[De-VA] Deligne, Pierre, Variétés abéliennes ordinaires sur un corps fini. (French)Invent. Math. 8 1969 238-243.[De-WeilII] Deligne, Pierre, La conjecture de Weil. II, Inst. Hautes Études Sci.Publ. Math. No. 52 (1980), 137-252.[Deu] Deuring,M., Die Typen der Multiplikatorenringe elliptischer Funktionenkörper,Abh. Math. Sem. Hansischen Univ. 14 (1941), 197-272[Deu-CM] Deuring,M., Die Zetafunktion einer algebraischen Kurve vomGeschlechte Eins, Nachr. Akad.Wiss.Göttingen. Math.-Phys. Kl. Math.-Phys.-Chem. Abt. (1953) 8594.[Elkies-Real] Elkies, Noam D. Supersingular primes for elliptic curves over realnumber fields. Compositio Math. 72 (1989), no. 2, 165-172.

56 NICHOLAS M. KATZ[Elkies-SS] Elkies, Noam D. The existence of infinitely many supersingular primesfor every elliptic curve over Q. Invent. Math. 89 (1987), no. 3, 561-567.[Ge] Gekeler, Ernst-Ulrich, Frobenius distributions of elliptic curves over finiteprime fields, IMRN 2003, no. 37, 1999-2018.[H-SB-T] Harris, Michael, Shepherd-Barron, Nicholas, and Taylor, Richard, A familyof Calabi-Yau varieties and potential automorphy, preprint available atwww.math.harvard.edu/∼rtaylor/cy3.pdf.[He] Hecke, Erich, ´’Uber eine neue Art von Zetafunktionen und ihre Beziehungenzur Verteilungen der Primzahlen. Math. Z. 1 (1918), 357-376;4 (1920), 11-21.Reprinted in Mathematishe Werke, Vandenhoeck and Ruprecht, G´’ottingen,1983.[Honda] Honda, Taira, Isogeny classes of abelian varieties over finite fields, J. Math.Soc. Japan 20 (1968), 83-95.[Howe] Howe, Everett W. Principally polarized ordinary abelian varieties over finitefields. Trans. Amer. Math. Soc. 347 (1995), no. 7, 2361-2401.[Ig] Igusa, Jun-ichi, Class number of a definite quaternion with prime discriminant.Proc. Nat. Acad. Sci. U.S.A. 44 1958 312-314.[Ir-Ros] Ireland, Kenneth F., and Rosen, Michael I., A classical introduction tomodern number theory. Revised edition of Elements of number theory. GraduateTexts in Mathematics, 84. Springer-Verlag, New York-Berlin, 1982.[Ito] Ito, Kyosi, Introduction to Probability Theory, Cambridge University Press,New York, 1984.[Ka-ESDE] Katz, Nicholas M., Exponential sums and differential equations, Annalsof Mathematics Studies, 124. Princeton University Press, Princeton, NJ, 1990.[Ka-TLFM] Katz, Nicholas M.,Twisted L-Functions and Monodromy, Annals ofMathematics Studies, 108. Princeton University Press, Princeton, NJ, 1985.[K-M] Katz, Nicholas M., and Mazur, Barry, Arithmetic moduli of elliptic curves.Annals of Mathematics Studies, 150. Princeton University Press, Princeton,NJ, 2002.[Ko1] Kottwitz, Robert E., Points on some Shimura varieties over finite fields. J.Amer. Math. Soc. 5 (1992), no. 2, 373-444.[Ko2] Kottwitz, Robert E., Shimura varieties and λ-adic representations. Automorphicforms, Shimura varieties, and L-functions, Vol. I (Ann Arbor, MI, 1988),161-209, Perspect. Math., 10, Academic Press, Boston, MA, 1990.[L-T] Lang, Serge, and Trotter, Hale, Frobenius distributions in GL 2 -extensions,Springer Lecture Notes in Mathematics 504, 1976.[Maz] Mazur, Barry, Rational points of abelian varieties with values in towers ofnumber fields. Invent. Math. 18 (1972), 183-266.[Mes] Messing, William, The crystals associated to Barsotti-Tate groups: withapplications to abelian schemes. Lecture Notes in Mathematics, Vol. 264.Springer-Verlag, Berlin-New York, 1972.

LANG-TROTTER REVISITED 57[Pa] Pacheco, Amícar, Distribution of the traces of Frobenius on elliptic curves overfunction fields. Acta Arith. 106 (2003), no. 3, 255–263.[Sch] Schoof, René Nonsingular plane cubic curves over finite fields. J. Combin.Theory Ser. A 46 (1987), no. 2, 183-211.[Se-Cheb] Serre, Jean-Pierre, Quelques applications du théorème de densité deChebotarev, Pub. Math. IHES 54(1981), 123-201.[Se-Mot] Serre, Jean-Pierre, Propriétés conjecturales des groupes de Galois motiviqueset des représentations l-adiques, Proceedings of Symposia in PureMathematics 55 (1994) Part I, 377-400.[Sh] Shimura, Goro, Introduction to the arithmetic theory of automorphic functions.Kan Memorial Lectures, No. 1. Publications of the Mathematical Societyof Japan, No. 11. Iwanami Shoten, Publishers, Tokyo; Princeton UniversityPress, Princeton, N.J., 1971[Sie] Siegel, Carl Ludwig, Über die Classenzahl quadratischer Zahlkörper, ActaArith. 1 (1935), 83-86.[St] Stein, William, The Modular Forms Explorer, database available athttp://modular.fas.harvard.edu.[Tate] Classes d’isogénie des variétés abéliennes sur un corps fini, Séminaire Bourbaki1968-69, exp. 352, 95-110.[Wat] Waterhouse, William C. Abelian varieties over finite fields. Ann. Sci. ÉcoleNorm. Sup. (4) 2 1969 521-560.[Z]Zarhin, Yuri G., Very simple 2-adic representations and hyperelliptic Jacobians,Mosc.Math. J. 2 (2002), no. 2, 403431.Princeton University, Dept. Math., Fine Hall, Princeton, NJ 08544-1000, USAE-mail address: nmk@math.princeton.edu