Koblitz Conjecture for Prime Orders of Elliptic Curves

Koblitz Conjecture for Prime Orders of Elliptic Curves

Definitions and mathematical statement

Let $E/{\mathbb{Q}}$ be an elliptic curve without complex multiplication, and $N_E$ its conductor. For $m\ge1$, let $G_E(m)$ be the image of the Galois action on $E[m]\cong({\mathbb{Z}}/m{\mathbb{Z}})^2$. Set \[ \delta_E(m)=\frac{\#\{g\in G_E(m):\det(I-g)\in({\mathbb{Z}}/m{\mathbb{Z}})^\times\}} {|G_E(m)|}, \qquad C_E=\lim_{z\to\infty} \frac{\delta_E(\prod_{\ell\le z}\ell)}{\prod_{\ell\le z}(1-1/\ell)}. \] The products run over primes; this is Zywina's corrected constant with parameter $t=1$, retaining dependencies between torsion fields. For every such curve with $C_E>0$, the conjecture is \[ \#\{p\le x:p\nmid N_E,\ |E({\mathbb{F}}_p)|\text{ prime}\} \sim C_E\frac{x}{(\log x)^2}. \] The positivity hypothesis is essential to this asymptotic formulation. Replacing the joint Galois density by a naive product of independent local densities need not give the same constant.

Formulation and concept references: [S1].

Short English statement

Do prime-order reductions of each eligible elliptic curve occur with the asymptotic frequency predicted by the corrected Koblitz constant?

Research attempt

Scope and source audit (27 September 2026).

Fix one non-CM curve $E/\mathbb Q$ and write $n_p=|E(\mathbb F_p)|=p+1-a_p$ at a good prime. The curve is fixed before $x$ tends to infinity. An average over a growing family of curves, an almost-prime result, or a result assuming an additional distribution conjecture does not supply the requested asymptotic for this fixed curve. The target further assumes the corrected joint density $C_E$ is positive; a curve with a torsion or entanglement obstruction is not a counterexample.

The full text of [S1], Definition 2.1 and Proposition 2.4, was inspected. It defines the joint constant and factors it into a finite exceptional part and a universal tail for non-CM curves. The calculations below reconstruct that factor, including the finite-group count and its convergence; they are not claimed as a new constant. The 2025 paper [E1] explicitly assumes an elliptic Elliott--Halberstam analogue and an additional average growth hypothesis. The August 2026 manuscript [E2] concerns an average over curves, including arithmetic progressions. Neither is used as an unconditional fixed-curve solution here. These source checks establish the scope of the cited inputs; they are not an exhaustive literature survey.

The main attack is to turn primality into a divisibility sieve and separate three questions: the exact local densities, their joint compatibility, and the analytic estimates required when the sieve bound grows with $x$. The first two can be handled structurally. The third is where the proof stops. A finite point-count computation is retained as a diagnostic, with no fitted constant treated as a theorem.

The torsion determinant really detects divisibility.

For a prime $\ell\ne p$ at which $E$ has good reduction, the Frobenius action on $E[\ell]$ has characteristic polynomial \[ T^2-a_pT+p\pmod\ell. \] Consequently \begin{equation}\label{wsref-0-72-61-34-38-36-3a-66-72-6f-62} \det(I-\operatorname{Frob}_p)\equiv p+1-a_p=n_p\pmod\ell. \end{equation} Equivalently, $\ell\mid n_p$ precisely when Frobenius has a nonzero fixed vector on $E[\ell]$. For squarefree $m$ prime to $p$, the Chinese remainder theorem therefore identifies the condition $(n_p,m)=1$ with $\det(I-g)$ being a unit modulo $m$. The Frobenius polynomial and its use in Chebotarev are the standard inputs stated in [S1, Section 2.1].

For fixed $m$, the set of allowed elements is stable under conjugation. Chebotarev for the finite Galois extension $\mathbb Q(E[m])/\mathbb Q$ then gives \begin{equation}\label{wsref-0-72-61-34-38-36-3a-66-69-78-65-64} \#\{p\le x:p\nmid mN_E,\ (n_p,m)=1\} =\delta_E(m)\operatorname{Li}(x)+o_{E,m}(\operatorname{Li}(x)). \end{equation} The notation $o_{E,m}$ is deliberate: this statement holds with $m$ fixed. It asserts neither a uniform error for all $m$ nor that the condition $(n_p,m)=1$ implies primality.

An exact local count in the full matrix group.

Let $q$ be a prime and put $H_q=\operatorname{GL}_2(\mathbb F_q)$. Choosing a nonzero first column and a second column outside its span gives \[ |H_q|=(q^2-1)(q^2-q)=q(q-1)^2(q+1). \] We count the elements with eigenvalue one. There is the identity; the nonidentity unipotent elements; and those with distinct eigenvalues $1,\lambda$, where $\lambda\in\mathbb F_q^\times\setminus\{1\}$. These cases exhaust the possibilities because a quadratic characteristic polynomial having a root one splits over $\mathbb F_q$.

Every nonidentity unipotent matrix is conjugate to $J=\begin{pmatrix}1&1\\0&1\end{pmatrix}$. Its centralizer in $H_q$ is \[ \left\{\begin{pmatrix}a&b\\0&a\end{pmatrix}:a\ne0\right\}, \] of size $q(q-1)$, so the class has size $q^2-1$. For each $\lambda\ne0,1$, the centralizer of $\operatorname{diag}(1,\lambda)$ is the invertible diagonal subgroup, of size $(q-1)^2$; its class has size $q(q+1)$. Distinct values of $\lambda$ give disjoint classes. Hence the forbidden count is \[ 1+(q^2-1)+(q-2)q(q+1)=q(q^2-2). \] This also works at $q=2$, where the last term is absent.

Lemma 486.1. If $G_E(q)=H_q$, then \begin{align} \delta_E(q)&=1-\frac{q^2-2}{(q-1)^2(q+1)},\label{wsref-0-72-61-34-38-36-3a-6c-6f-63-61-6c}\\ \frac{\delta_E(q)}{1-1/q} &=1-\frac{q^2-q-1}{(q-1)^3(q+1)}=:c_q.\label{wsref-0-72-61-34-38-36-3a-66-61-63-74-6f-72} \end{align} The proof is the preceding count followed by division and elementary algebra. For example, $q=2$ gives two allowed matrices out of six and $c_2=2/3$; $q=3$ gives 27 allowed matrices out of 48 and $c_3=27/32$. The denominator $1-1/q$ corrects for the ordinary probability of an integer avoiding $q$; it is not itself the elliptic-curve avoidance density.

Preserving entanglement while proving convergence.

Use the non-CM open-image theorem in the precise independence form stated in [S1, Theorem 2.3]: there is an integer $M$ such that, after separating the primes dividing $M$, all remaining prime-level images are full matrix groups independent of that finite exceptional image. Enlarge $M$ to include 2 if necessary, and write $M_0=\prod_{\ell\mid M}\ell$. The consequence needed here is that for every squarefree $d$ coprime to $M$, \begin{equation}\label{wsref-0-72-61-34-38-36-3a-73-70-6c-69-74} G_E(M_0d)=G_E(M_0)\times\prod_{\ell\mid d}\operatorname{GL}_2(\mathbb F_\ell). \end{equation} This is an attributed deep input; it is not inferred from separate surjectivity statements at individual primes.

For $P(z)=\prod_{\ell\le z}\ell$ and $z$ larger than all prime factors of $M$, the product structure in (ra486:split) proves \[ \frac{\delta_E(P(z))}{\prod_{\ell\le z}(1-1/\ell)} =\frac{\delta_E(M_0)}{\prod_{\ell\mid M}(1-1/\ell)} \prod_{\ell\le z,\ \ell\nmid M}c_\ell. \] For every prime $q$, $0<c_q<1$. Moreover $1-c_q=O(q^{-2})$. Thus $\sum_q(1-c_q)<\infty$, by comparison with $\sum_{n\ge2}n^{-2}$. For all sufficiently large $q$, the inequality $0\le-\log c_q\le2(1-c_q)$ follows by integrating $1/(1-t)$ on $0\le t\le1-c_q\le1/2$. The finite omitted factors are positive, so the infinite product converges to a positive number. It follows that \begin{equation}\label{wsref-0-72-61-34-38-36-3a-63-6f-6e-73-74-61-6e-74} C_E=\frac{\delta_E(M_0)}{\prod_{\ell\mid M}(1-1/\ell)} \prod_{\ell\nmid M}c_\ell, \qquad C_E>0\ \Longleftrightarrow\ \delta_E(M_0)>0. \end{equation} This proves existence and finiteness of the stated limit from the cited open-image theorem and the displayed finite-group computation. It reconstructs the known formula rather than solving the prime-counting question. An effective value of $M$ for a particular curve is additional arithmetic information; small observed Frobenius samples do not certify it.

Two obstruction tests for the proposed constant.

If $E(\mathbb Q)$ contains a nonzero point of prime order $\ell$, then every matrix in $G_E(\ell)$ fixes a nonzero vector. Therefore $\delta_E(\ell)=0$, and every multiple-level avoidance density is zero. In particular $C_E=0$. The same conclusion is visible after reduction at good primes different from $\ell$: their group orders are divisible by $\ell$. This explains why examples with rational torsion cannot refute the positive-constant statement.

Avoidance can also fail jointly even when each marginal probability is positive. As a finite probability model, take \[ H=\{(0,0),(1,1)\}\subset(\mathbb Z/2\mathbb Z)^2, \] with uniform distribution. Let the first allowed event be $a=0$ and the second be $b=1$. Each event has probability $1/2$, but their intersection is empty. This is not asserted to be an elliptic torsion image; it is an exact refutation of the inference "positive marginals imply positive joint avoidance." Actual torsion-field dependencies are why [S1] retains the full image. Even when the joint probability is positive it need not equal the product of its marginals. Formula (ra486:constant) keeps all such dependencies in $G_E(M_0)$.

A weak unconditional consequence of fixed-level information.

Define the target counting function by $\pi_E^{\mathrm{prime}}(x)$. The Hasse bound implies \begin{equation}\label{wsref-0-72-61-34-38-36-3a-68-61-73-73-65} (\sqrt p-1)^2\le n_p\le(\sqrt p+1)^2. \end{equation} For any fixed $z$, a prime value $n_p>z$ is coprime to $P(z)$. If $n_p\le z$, then (ra486:hasse) forces $p\le(\sqrt z+1)^2$, so these exceptions are finite as $x\to\infty$. Equation (ra486:fixed) therefore gives \[ \limsup_{x\to\infty} \frac{\pi_E^{\mathrm{prime}}(x)}{\operatorname{Li}(x)} \le\delta_E(P(z)). \] The factorization above and the divergence of $\sum_\ell1/\ell$ imply $\delta_E(P(z))\to0$: the normalized factors stay bounded, whereas $\prod_{\ell\le z}(1-1/\ell)\to0$. Letting the fixed parameter $z$ tend to infinity after taking the upper limit proves \begin{equation}\label{wsref-0-72-61-34-38-36-3a-77-65-61-6b} \pi_E^{\mathrm{prime}}(x)=o(\operatorname{Li}(x)). \end{equation} This is only zero relative density among the primes. It is compatible with the conjectured order $x/(\log x)^2$, with finitely many prime orders, and with many other smaller counting functions. The order of the two limits is legitimate for this weak upper bound and supplies no asymptotic at the sharper normalization.

The moving sieve threshold exposes the first analytic gap.

Let \[ S_E(x,y)=\#\{p\le x:p\nmid N_E,\ (n_p,P(y))=1\}. \] If $y=\sqrt x+1$, every composite $n_p\le(\sqrt x+1)^2$ has a prime factor at most $y$. Thus the sifted count contains no composite $n_p$. Conversely a prime $n_p>y$ survives. Values $n_p=1$ occur only for bounded $p$ by Hasse. Prime orders at most $y$ force $p\le(\sqrt y+1)^2=O(\sqrt x)$, so, using the crude bound on the number of integers in this interval, \begin{equation}\label{wsref-0-72-61-34-38-36-3a-73-69-65-76-65-67-6f-61-6c} \pi_E^{\mathrm{prime}}(x)=S_E(x,\sqrt x+1)+O(\sqrt x). \end{equation} The error is $o(x/(\log x)^2)$. This is a rigorous sufficient reduction of the conjecture to an asymptotic for one moving sieve count.

For squarefree $d$, put $A_d(x)=\#\{p\le x:p\nmid N_E,\ d\mid n_p\}$, including any primes which divide $d$ in this definition. Exact inclusion--exclusion gives \begin{equation}\label{wsref-0-72-61-34-38-36-3a-69-6e-63-6c-75-73-69-6f-6e} S_E(x,y)=\sum_{d\mid P(y)}\mu(d)A_d(x). \end{equation} For each fixed $d$, Chebotarev gives a density for $A_d(x)$ from the conjugacy condition $\det(I-g)=0\pmod d$, with only finitely many ramified exceptions. But applying fixed-$d$ asymptotics term by term in (ra486:inclusion) when $y=\sqrt x+1$ has not been justified. Both the number of terms and the degrees and discriminants of the division fields grow. Even strong distribution estimates for a truncated divisor sum would need an argument distinguishing primes from remaining almost primes. No such sieve remainder estimate is proved here.

The precise sufficient estimate still missing is \[ S_E(x,\sqrt x+1)\sim C_E\frac{x}{(\log x)^2} \quad\text{for the fixed curve with }C_E>0. \] Equations (ra486:fixed) and (ra486:constant) determine what the local corrections must be; they do not establish this uniform primality estimate. Substituting $m=P(\sqrt x+1)$ into a theorem stated for fixed $m$ is the first invalid step in the attempted proof.

Finite verification and counterexample search.

The companion exact-arithmetic script enumerates every invertible matrix over $\mathbb F_q$ for $q=2,3,5,7,11,13$ and compares both the total and the forbidden counts with the displayed formulas. It separately counts points by the quadratic-residue formula \[ |E(\mathbb F_p)|=p+1+\sum_{u\in\mathbb F_p} \left(\frac{u^3-u+1}{p}\right) \] for the smooth model $y^2=x^3-x+1$ at odd primes $p\le2000$ other than 23. Its model discriminant is $-16\cdot23$. Every count is checked against the integer version $a_p^2\le4p$ of the Hasse inequality. Primality of each resulting integer is tested by trial division, and the full table is saved: 301 primes were tested and 26 prime orders found. At the small primes the residue count is also checked by enumerating all pairs $(u,v)$, independently of the character formula.

This curve is used to test the counting implementation. No claim about its complete adelic image or its corrected constant is inferred from that table. Finding finitely many prime orders cannot establish $C_E>0$ by finite sampling, still less the asymptotic. Finding no prime orders in a finite range would not disprove the conjecture either. The computations are therefore reported as finite verification, not a statistical proof.

Outcome.

Outcome: UNRESOLVED. The work supplies exact local factors, a reconstruction of the known finite-entanglement constant using an attributed open-image theorem, a weak relative-density-zero consequence, and a rigorous reduction to a moving sieve threshold. It also tests torsion and independence shortcuts. It proves no positive lower bound of the conjectured order and no fixed-curve prime-order asymptotic. The first missing estimate is uniform control of the sieve at a threshold large enough to certify primality, while retaining the corrected joint Galois factor.

Sources

• S1 David Zywina, "A refinement of Koblitz's conjecture," International Journal of Number Theory 7 $2011$; arXiv:0909.5280. https://arxiv.org/abs/0909.5280. Formulation source. Consulted 24 September 2026: Definition 2.1 of the corrected joint-Galois-density constant in the full-text HTML version.
• E1 Sampa Dey, Arnab Saha, Jyothsnaa Sivaraman, and Akshaa Vatwani, On the refined Koblitz conjecture, Journal of Mathematical Analysis and Applications 546 $2025$, no. 1, article 129212. https://doi.org/10.1016/j.jmaa.2024.129212. Publisher abstract and introduction inspected 27 September 2026; conditional assumptions retained.
• E2 Ahmet M. Guloglu, Asimina S. Hamakiotes, Sung Min Lee, and Tian Wang, Average twin prime conjecture for elliptic curves in arithmetic progressions, arXiv:2608.29938, 30 August 2026. https://arxiv.org/abs/2608.29938. Abstract inspected 27 September 2026; an average-family result, not used as a fixed-curve theorem.
• E3 David Zywina, full-text version of [S1], Definition 2.1, Theorem 2.3, Proposition 2.4, and Lemma 2.5. https://arxiv.org/html/0909.5280. Directly inspected 27 September 2026 for the joint density, non-CM independence input, and comparison of the reconstructed local factor.