Supersingular prime (algebraic number theory)

Complex multiplication case

When ${\displaystyle E}$ has complex multiplication (CM) by an order in an imaginary quadratic field ${\displaystyle K}$, the distribution of supersingular primes is well understood. A classical result of Deuring (1941) implies that a prime ${\displaystyle p}$ of good reduction is supersingular for ${\displaystyle E}$ if and only if ${\displaystyle p}$ is inert or ramified in ${\displaystyle K}$.^[2] By the Chebotarev density theorem, these primes constitute exactly half of all primes, so the set of supersingular primes for a CM curve has natural density ${\displaystyle 1/2}$.^[3]

Non-CM case

When ${\displaystyle E}$ does not have complex multiplication, the situation is more subtle. In 1968, Serre proved that the set of supersingular primes has asymptotic density zero by applying the Chebotarev density theorem to the number fields generated by coordinates of the torsion points of ${\displaystyle E}$.^[3][4] Serre later obtained the unconditional upper bound

${\displaystyle \pi _{E,0}(x)\ll {\frac {x}{\left(\log x\right)^{3/2-\varepsilon }}}}$

for any ${\displaystyle \varepsilon >0}$, where ${\displaystyle \pi _{E,0}(x)}$ denotes the number of supersingular primes up to ${\displaystyle x}$, and showed that under the Generalized Riemann Hypothesis (GRH) one could achieve the bound ${\displaystyle \pi _{E,0}(x)\ll x^{3/4}}$.^[5][4] The unconditional exponent was subsequently improved by Wan (1990), who showed

${\displaystyle \pi _{E,0}(x)\ll {\frac {x}{\left(\log x\right)^{2-\varepsilon }}}}$

by incorporating sieve-theoretic techniques.^[6]

Despite this rarity, Noam Elkies proved in 1987 that every elliptic curve over ${\displaystyle \mathbb {Q} }$ has infinitely many supersingular primes.^[7] His proof uses the theory of complex multiplication and Deuring's lifting lemma: given any finite set ${\displaystyle S}$ of primes, one can find a negative fundamental discriminant ${\displaystyle -D}$ such that the Hilbert class polynomial ${\displaystyle P_{D}(X)}$ evaluated at the j-invariant ${\displaystyle j(E)}$ has a prime factor outside ${\displaystyle S}$, and this prime is necessarily supersingular for ${\displaystyle E}$.^[7] Elkies later extended this result to elliptic curves defined over any number field with at least one real embedding.^[8]

Lang–Trotter conjecture

Lang & Trotter (1976) conjectured that the number of supersingular primes less than a bound ${\displaystyle X}$ satisfies

${\displaystyle \pi _{E,0}(X)\sim C_{E}{\frac {\sqrt {X}}{\log X}}}$

as ${\displaystyle X\to \infty }$, where ${\displaystyle C_{E}>0}$ is an explicit constant depending on ${\displaystyle E}$.^[9] This prediction arises from a probabilistic heuristic: by the Hasse bound, ${\displaystyle |a_{p}|\leq 2{\sqrt {p}}}$, so the "probability" that ${\displaystyle a_{p}=0}$ for a random prime ${\displaystyle p}$ is roughly ${\displaystyle 1/{\sqrt {p}}}$, and summing this over primes up to ${\displaystyle X}$ gives an expected count on the order of ${\displaystyle {\sqrt {X}}/\log X}$.^[9] As of 2026^[update], this conjecture remains open.^[10]