# The elliptic sieve and Brauer groups

Subham Bhakta  Subham Bhakta
Mathematisches Institut
Georg-August-Universität Göttingen
Bunsenstraße 3-5
D-37073 Göttingen
Germany<EMAIL_ADDRESS>,  Daniel Loughran  Daniel
Loughran
Department of Mathematical Sciences
University of Bath
Claverton Down
Bath
BA2 7AY
UK. https://sites.google.com/site/danielloughran/ ,  Simon L. Rydin Myerson
Simon L. Rydin Myerson
Mathematics Institute
Zeeman Building
University of Warwick
Coventry
CV4 7AL<EMAIL_ADDRESS>and  Masahiro Nakahara  Masahiro Nakahara
Department of Mathematics
University of Washington
Seattle
WA 98195
USA<EMAIL_ADDRESS>https://sites.math.washington.edu/ mn75/index.html

###### Abstract.

A theorem of Serre states that almost all plane conics over ${{\mathbb{Q}}}$
have no rational point. We prove an analogue of this for families of conics
parametrised by elliptic curves using elliptic divisibility sequences and a
version of the Selberg sieve for elliptic curves. We also give more general
results for specialisations of Brauer groups, which yields applications to
norm form equations.

###### 2010 Mathematics Subject Classification:

14G05; 11N36, 14F22, 11G05 (secondary).

###### Contents

  1. 1 Introduction
  2. 2 Elliptic curves over $\mathbb{Q}_{p}$
  3. 3 Elliptic divisibility sequences
  4. 4 Brauer groups
  5. 5 Examples and applications
  6. 6 Applicability

##  1\. Introduction

###  1.1. Sums of two squares

A famous theorem of Landau and Ramanujan states that almost all integers are
not sums of two squares, when ordered by absolute value. In this paper we
prove a version of this result for elliptic curves.

######  Theorem 1.1.

Let $E$ be an elliptic curve over ${{\mathbb{Q}}}$ given by an integral
Weierstrass equation. Let $P\in E({{\mathbb{Q}}})$ have infinite order with
$P\in E({{\mathbb{R}}})^{0}$. Then there exists $\omega=\omega(E,P)>0$ such
that

$\\#\\{n\in{{\mathbb{Z}}}\colon|n|\leq B,y(nP)\text{ is a sum of two
squares}\\}\ll_{E,P}B/(\log B)^{\omega}.$ (1.1)

Here $E({{\mathbb{R}}})^{0}$ denotes the connected component of the identity
of $E({{\mathbb{R}}})$, and $y(nP)$ denotes the $y$-coordinate of the point
$nP$; this is a rational number and we are asking that this is the sum of two
rational squares. The result shows that for almost all multiples of $P$, the
$y$-coordinate is not a sum of two (rational) squares. (See § 1.4 for a
discussion on sharpness of this result.)

The reader may wonder: why consider the $y$-coordinate and not the
$x$-coordinate? Well, the corresponding result is _false_ otherwise: Consider
the elliptic curve

$y^{2}=x^{3}-k^{2}.$ (1.2)

Evidently $x=(y^{2}+k^{2})/x^{2}$ is always a sum of two squares. Our methods
are able to handle the $x$-coordinate problem, but only with additional
assumptions on $E$ (see Theorem 5.3).

The assumption that $P\in E({{\mathbb{R}}})^{0}$ is slightly deeper and is
intimately connected with our method; however without it we can obtain
counter-examples to similar statements (see Example 1.3).

###  1.2. Conic bundles

To understand exactly what is happening, we put our results into the more
geometric framework of _conic bundles_. In an influential paper [22], Serre
proved that almost all plane conics over ${{\mathbb{Q}}}$ have no rational
point, when ordered by the size of their coefficients. This was a special case
of a more general result [22, Thm. 2] on conic bundles
$\pi:X\to{{\mathbb{P}}}^{n}_{{\mathbb{Q}}}$, which says that providing $\pi$
has no rational section we have

$\\#\\{x\in{{\mathbb{P}}}^{n}({{\mathbb{Q}}}):H(x)\leq
B,x\in\pi(X({{\mathbb{Q}}}))\\}\ll_{X,E,P}B^{n+1}/(\log B)^{\Delta(\pi)}$
(1.3)

for some $\Delta(\pi)>0$, where $H$ denotes the usual naive height on
projective space. Here by a conic bundle, we mean a surjective morphism of
varieties all of whose fibres are isomorphic to plane conics. This result was
generalised in [17, Thm. 1.2] to other families of varieties over
${{\mathbb{P}}}^{n}$.

One of the aims of the paper is to obtain a version of Serre’s result for
conic bundles over elliptic curves. Here the crucial concept is that of a
_non-split fibre_ : this is an irreducible fibre isomorphic to $2$ lines over
a quadratic extension (called the splitting field of the fibre). The relevant
conic bundle for Theorem 1.1 is

$x_{1}^{2}+x_{2}^{2}=yx_{0}^{2},$ (1.4)

where the equation is an affine patch of the surface in
${{\mathbb{P}}}^{2}\times E$. Here a non-split fibre occurs over the point at
infinity, but in the example (1.2) one can check that every fibre of the
relevant conic bundle is split. So to get savings one requires at least a non-
split fibre; this is essentially the content of our next theorem.

######  Theorem 1.2.

Let $E$ be an elliptic curve over ${{\mathbb{Q}}}$ given by an integral
Weierstrass equation and $\pi:X\to E$ a non-singular conic bundle. Let $P\in
E({{\mathbb{Q}}})$ have infinite order with $P\in E({{\mathbb{R}}})^{0}$.
Assume that $\pi^{-1}(mP)$ is non-split with imaginary quadratic splitting
field, for some $m\in{{\mathbb{Z}}}$. Then there exists
$\omega=\omega(X,E,P)>0$ such that

$\\#\\{n\in{{\mathbb{Z}}}\colon|n|\leq
B,nP\in\pi(X({{\mathbb{Q}}}))\\}\ll_{X,E,P}B/(\log B)^{\omega}.$

The theorem says that under some technical assumptions, for almost all
multiples of a given non-torsion rational point the associated conic has no
rational point. The assumption $P\in E({{\mathbb{R}}})^{0}$ may look
artificial, however it is necessary for the conclusion.

######  Example 1.3.

Consider the elliptic curve with the point $P$ of infinite order

$E:y^{2}=x(x+2)(x-3),\quad P=(-1,2)$

and the conic bundle

$t_{0}^{2}+t_{1}^{2}=(x-x_{1})(x-x_{3})t_{2}^{2}$

where $x_{i}$ denotes the $x$-coordinate of $iP$. This has non-split fibres
over $\pm P$ and $\pm 3P$. Here $P\notin E({{\mathbb{R}}})^{0}$ so the
assumptions of Theorem 1.2 don’t hold.

We claim that the fibre over every even multiple of $P$ contains a rational
point, so the conclusion of Theorem 1.2 in fact does not hold either. This is
a special case of a more general construction (Proposition 5.7), but we
explain the key ideas here.

Firstly one checks that the fibre over $O$ has a rational point. So let $2nP$
be a non-trivial even multiple of $P$. It is clear there are always $p$-adic
points for $p\equiv 1\bmod 4$. We will show that for every prime $p\equiv
3\bmod 4$, we have $v_{p}((x-x_{1})(x-x_{3}))=0$, which implies that the fibre
has a ${{\mathbb{Q}}}_{p}$-point. Moreover as every element of
$2{{\mathbb{Z}}}P$ lies in the real component of the identity it satisfies
$x\geq 3$. Hence $(x-x_{1})(x-x_{3})>0$ so the conic has a real point.
Hilbert’s version of quadratic reciprocity now shows that every conic has a
${{\mathbb{Q}}}_{2}$-point, hence has a ${{\mathbb{Q}}}$-point by Hasse-
Minkowski.

So assume for a contradiction that there is some even multiple $2nP$ and
$p\equiv 3\mod 4$ such that $v_{p}((x-x_{1})(x-x_{3}))>0$. (One can check that
$v_{p}(x_{3})\geq 0$ for all $p\equiv 3\bmod 4$, so the valuation cannot be
negative.) Suppose for example that $v_{p}(x-x_{1})>0$, so that $2nP\equiv\pm
P\bmod p$. Then $P$ is divisible by $2$ modulo $p$. However our example was
chosen so that $2$-division field of $P$ is ${{\mathbb{Q}}}(i)$ (this can be
shown using the criterion from [6, §2]), and since $p$ is inert in
${{\mathbb{Q}}}(i)$ it follows that $P$ is not $2$-divisible modulo $p$; a
contradiction. The case $2nP\equiv\pm 3P\bmod p$ is analogous.

###  1.3. Proof ingredients

Our key tools are sieves and elliptic divisibility sequences.

In the classical sieve setting one usually sieves with respect to the
homomorphisms ${{\mathbb{Z}}}\to{{\mathbb{Z}}}/p{{\mathbb{Z}}}$, for primes
$p$, or more general prime powers. We originally tried to mimic this setting
by sieving with respect to the homomorphisms $E({{\mathbb{Q}}})\to
E({{\mathbb{F}}}_{p})$, inspired by Kowalski’s elliptic sieve [14, §4.4] used
to study prime divisors in elliptic divisibility sequences. However our method
quickly diverges from the classical setting and Kowalski’s setting, as in our
case information modulo $p$ is insufficient. A significant technical step in
our proof is trying to control the $p$-adic valuations of the rational points
we are sieving, which we achieve by sieving modulo $p^{n_{p}}$ for varying
primes $p$ and growing exponents $n_{p}$, so our sieve has no classical
analogue. This difficulty is related to the fact that elliptic curves do not
satisfy weak approximation, and does not arise in the classical sieve setting
where $p$-adic valuations are easy to control. Our exact valuation theoretic
problems are closely related to $p$ being a “non-Wieferich prime for base
$P\in E$” in the sense of Voloch [33], and it is not even known whether there
exists a single elliptic curve with infinitely many such primes [24]. These
issues greatly complicate our sieve set up, and we have to work with the
filtration structure on $E({{\mathbb{Q}}}_{p})$ to control valuations. (See
Remark 3.20.)

To come up with a sieve criterion we use elliptic divisibility sequences:
these are defined via the denominators of the $x$-coordinates of the multiples
of $P$, multiplied by a sign to obtain better recurrence properties. We recall
the relevant definitions in §3. The key property for us is that elliptic
divisibility sequences are periodic modulo an arbitrary integer (Proposition
3.7). We achieve this using work of Verzobio [32] and does not seem to have
been proven in the literature before in this generality. In our proof we also
have to be careful with signs, which requires us to use the work [27] as well
as equidistibution results for multiples of irrational numbers modulo $1$.
Whilst these sign issues may seem a mere technical step, in fact they are
crucial and related to our necessary assumptions on the real components of
$E({{\mathbb{R}}})$ (cf. Example 1.3).

Theorem 1.2 is a quantitative strengthening of a result of the fourth-named
author and Berg [7], which proves under suitable assumptions that for certain
conic bundles $\pi:X\to E$, the image $\pi(X({{\mathbb{Q}}}))$ does not
contain a translate of a subgroup of finite index. In [7] the authors only
consider elliptic curves which are Galois general in a sense captured by
conditions (1)-(4) in their Theorem 3.5, and their results only apply to
special conic bundles given by pulling back Châtelet surfaces from
${{\mathbb{P}}}^{1}$ which also have a non-split fibre over a rational point.
Our results apply to an overlapping collection of elliptic curves and conic
bundles, but the key point is that our conclusion is stronger: a subset of
${{\mathbb{Z}}}$ which contains no arithmetic progression may still have
positive density (e.g. the set of squarefree numbers in ${{\mathbb{Z}}}$).

###  1.4. Lower bounds and counting by height

We believe that our paper demonstrates the usefulness of sieve techniques and
elliptic divisibility sequences to counting problems on elliptic curves. The
proof of Theorem 1.2 gives an explicit value for $\omega$, but we doubt that
our upper bound is sharp. Proving any kind of lower bound seems very difficult
in general; we are only able to do this in various trivial cases where
$\omega=0$, so that $\pi(X({{\mathbb{Q}}}))$ has positive density in
$E({{\mathbb{Q}}})$ (see §5). The following question seems quite challenging.

######  Question 1.4.

Does there exist an elliptic curve $E$ over ${{\mathbb{Q}}}$ such that the set

$\\{(x,y)\in E({{\mathbb{Q}}})\colon y\text{ is a sum of two squares}\\}$
(1.5)

is infinite?

Standard conjectures in arithmetic geometry seem to have nothing to say about
this question, as the associated conic bundle surface is neither rationally
connected nor of general type (over ${{\mathbb{Q}}}(i)$ it is birational to
${{\mathbb{P}}}^{1}\times E$).

However, the following heuristic suggests (1.5) should be quite sparse. Let
$E({{\mathbb{Q}}})$ have rank $r$. Fix a norm $\|\,\cdot\,\|$ on
${{\mathbb{R}}}^{r}$. The numerator and denominator of
$y(n_{1}P_{1}+\dotsb+n_{r}P_{r})$ are both integers of size
$\exp(O_{E,P}(\|\vec{n}\|^{2}))$, with the denominator being a perfect cube. A
proportion $1/\|\vec{n}\|^{2}$ of such rational numbers are sums of two
squares. One might therefore speculate that the set (1.5) has size
$\ll\sum_{\vec{n}\in{{\mathbb{N}}}^{r}}1/\|\vec{n}\|^{2}$, so can be infinite
only when $r>1$.

Versions of this problem were raised by Poonen [19, Questions 23, 33] and
Browning [5, Problem 10, pp3181-2]. Browning in particular asked about the
number of points for which the denominator of $y$ is a sum of two squares. A
similar heuristic suggests the number of points $\\{nP:n\leq B\\}$ with this
property might be around $\sum_{n\leq B}1/n\sim\log B$. Our methods give upper
bounds for problem without alteration.

One can rephrase our results in terms of the canonical height $\widehat{h}$ on
$E$, as $nP$ has height roughly $n^{2}$. In this language the heuristic just
discussed suggests the following.

$\displaystyle\\#\\{Q\in E({{\mathbb{Q}}}):\widehat{h}(Q)\leq H,y(Q)\text{ is
a sum of two squares}\\}$ $\displaystyle\asymp\begin{cases}1,&\text{if
}\operatorname{rank}E({{\mathbb{Q}}})\leq 1,\\\ \log H,&\text{if
}\operatorname{rank}E({{\mathbb{Q}}})=2,\\\ H^{(r-2)/2},&\text{if
}\operatorname{rank}E({{\mathbb{Q}}})>2;\end{cases}$ $\displaystyle\\#\\{Q\in
E({{\mathbb{Q}}}):\widehat{h}(Q)\leq H,\text{the denominator of }y(Q)\text{ is
a sum of two squares}\\}$ $\displaystyle\asymp\begin{cases}\log H,&\text{if
}\operatorname{rank}E({{\mathbb{Q}}})=1,\\\ H^{(r-1)/2},&\text{if
}\operatorname{rank}E({{\mathbb{Q}}})\geq 2.\end{cases}$

Our present method cannot handle the case of rank $>1$; the key stumbling
block is that we have no control over the prime $p$ constructed in Proposition
3.19, which would be necessary to combine $p$-adic information at sums of
points. We are however able to prove non-trivial upper bounds provided the
curve has rank $1$. Rather than stating the most general result in terms of
conic bundles, we content ourselves with the following variant of Theorem 1.1.

######  Theorem 1.5.

Let $E$ be an elliptic curve over ${{\mathbb{Q}}}$ given by an integral
Weierstrass equation. Assume that $E$ has rank $1$. Let

$\eta=\begin{cases}1&\text{ if
}\\#E({{\mathbb{Q}}})^{\operatorname{tors}}\text{ has two distinct prime
divisors,}\\\ -1&\text{ otherwise.}\end{cases}$

Then

$\\#\left\\{Q\in E({{\mathbb{Q}}})\cap
E({{\mathbb{R}}})^{0}:\begin{array}[]{l}\widehat{h}(Q)\leq H,y(Q)\text{ is a
}\\\ \text{sum of two
squares}\end{array}\right\\}\ll_{E}\frac{H^{1/2}(\log\log\log
H)^{\eta/2}}{(\log\log H)^{1/2}}.$

The total number of rational points in $E({{\mathbb{R}}})^{0}$ of height at
most $H$ is $\gg H^{1/2}$, since $2E({{\mathbb{Q}}})\subset
E({{\mathbb{R}}})^{0}$, so the theorem indeed shows that $0\%$ of these have
$y$-coordinate which is a sum of two squares. Note that if $E({{\mathbb{R}}})$
is connected, then the upper bounds applies to all rational points on $E$.

###  1.5. Generalisation to Brauer groups

We now state our most general result, of which Theorem 1.2 is a special case.
Firstly, we are able to prove results for conic bundles whose non-split fibres
have real quadratic splitting field. Secondly, we make explicit the dependence
of $\omega$ and the leading constant on $P$. Thirdly, our methods are
sufficiently robust that they allow applications to specialisations of Brauer
group elements on elliptic curves. This is also the viewpoint taken by Serre
in his paper [22], as well in the more recent papers [15, 17]. Brauer groups
are formally easier to work with than conic bundles, since one does not
require explicit equations and one can make use of Grothendieck’s residue map.
Here we take a Brauer group element which is ramified at a rational point. The
ramification gives rise to a cyclic extension of ${{\mathbb{Q}}}$ to which we
associate a Dirichlet character using Kronecker–Weber (see §4 for details and
relevant background on Brauer groups). Our result here is as follows.

######  Theorem 1.6.

Let $E$ be an elliptic curve over ${{\mathbb{Q}}}$ given by an integral
Weierstrass equation. Let $P\in E({{\mathbb{Q}}})$ have infinite order. Assume
there is $m\in{{\mathbb{Z}}}$ such that
$b\in\operatorname{Br}{{\mathbb{Q}}}(E)$ is ramified at $mP$ and let the
associated Dirichlet character $\chi$ have modulus $q(\chi)$. Let $\beta_{n}$
be the elliptic divisibility sequence associated to $P$ and let $\pi$ be the
period of the sequence $\beta_{n}\bmod q(\chi)$.

Assume that there is some index $\alpha\in{{\mathbb{N}}}$ with
$\gcd(\alpha,\pi)=1$ which satisfies either

  1. (1)

$\chi(|\beta_{\alpha}|)\neq 0,1$, or

  2. (2)

$\chi(-|\beta_{\alpha}|)\neq 0,1$ and $P\in E({{\mathbb{R}}})^{0}$, or

  3. (3)

$\chi(-|\beta_{\alpha}|)\neq 0,1$ and $4\nmid\pi$.

Then we have $\pi\ll_{E,\chi}1$ and

$\\#\\{|n|\leq B:b(nP)=0\in\operatorname{Br}{{\mathbb{Q}}}\\}\leq
C_{E,P,b}\frac{B\log\log B}{(\log B)^{1/2\varphi(\pi)}},$

where $\varphi$ denotes Euler’s totient function and $C_{E,P,b}$ is a positive
constant depending on $E,P$ and $b$ only and given by (4.4) below.

In the statement $b(Q)\in\operatorname{Br}{{\mathbb{Q}}}$ denotes the
evaluation of the Brauer element $b$ at $Q$. We abuse notation slightly and
implicitly ignore the finitely many points where $b$ is not defined.

The Brauer group framework essentially allows us to replace quadratic
extensions by arbitrary cyclic extensions and conic bundles by higher-
dimensional Brauer–Severi varieties. Moreover we can even handle some non-
abelian extensions. As an example application in the style of Theorem 1.1, we
have the following.

######  Theorem 1.7.

Let $K/{{\mathbb{Q}}}$ be a number field which contains a cyclic subfield
which is not totally real. Let $E$ be an elliptic curve over ${{\mathbb{Q}}}$
given by an integral Weierstrass equation and let $P\in E({{\mathbb{Q}}})$ be
a point of infinite order with $P\in E({{\mathbb{R}}})^{0}$. Then there exists
$\omega=\omega(E,K)>0$ such that

$\\#\\{|n|\leq B\colon y(nP)\text{ is a norm from }K\\}\ll_{E,P,K}B/(\log
B)^{\omega},$

where the implicit constant is
$\exp(O_{E,K}({\widehat{h}(P)}/{\log\widehat{h}(P)}))$.

The fields $K={{\mathbb{Q}}}(\sqrt[n]{a},\mu_{n})$ satisfy these hypotheses,
for $a\in{{\mathbb{Q}}}^{\times}$ and $n\geq 3$. The explicit dependence on
the point $P$ is included as it is needed to prove Theorem 1.5. (A version of
Theorem 1.5 replaced with the condition that $y(Q)$ is a norm from $K$, where
$K$ is of the type in Theorem 1.7, would follow by the same proof.)

Let us consider the technical assumptions on elliptic divisibility sequences
in Theorem 1.6. We suspect that Condition (1) holds for all but finitely many
$\chi$ of given order; but it seems incredibly difficult to prove this, and
even the analogous statement for the much simpler cases of Fibonacci or
Mersenne numbers seems to be an open problem [18, 30]. However if
$|\beta_{\alpha}|$ is a non-square (say), which indeed holds for all but
finitely many $\alpha$ [11, Thm. 1.1], then $\chi(|\beta_{\alpha}|)\neq 0,1$
for a positive proportion of quadratic Dirichlet characters; the challenge is
it show that these characters cover all but finitely many as $\alpha$ varies.
We are able to show the modest result that Condition (1) holds $100\%$ of the
time under suitable assumptions; see §6 for details.

As for our applications, if $\chi$ is an odd Dirichlet character then we
simply use that $\beta_{1}=1$ and $\chi(-1)=-1\neq 0,1$ to see that Conditions
(2) or (3) are satisfied. This is what makes stating Theorem 1.2 so simple, as
for an imaginary quadratic extension ${{\mathbb{Q}}}(\sqrt{D})$ with $D$ a
fundamental discriminant, the associated Dirichlet character is simply the
Kronecker symbol $\left(\frac{D}{\cdot}\right)$, which takes the value $-1$ at
$-1$ as $D$ is negative.

We finish by returning to Example 1.3.

######  Example 1.8.

Consider the elliptic curve from Example 1.3

$E:y^{2}=x(x+2)(x-3)$

with $P=(-1,2)$. As we have seen, this pair does not satisfy the conclusion of
Theorem 1.2 with respect to ${{\mathbb{Q}}}(i)$. Let us verify that the
hypotheses of Theorem 1.6 do not hold in this case. Firstly $P\notin
E({{\mathbb{R}}})^{0}$ so Condition (2) does not hold. Here $P$ has everywhere
good reduction and the elliptic divisibility sequence $\beta_{n}$ is

$0,1,4,-65,-504,242369,-58888180,-66048490369,60955459632144,\dots$

The relevant Dirichlet character is the unique non-principal character $\chi$
modulo $4$. The sequence $\beta_{n}\bmod 4$ is just

$0,1,0,3,0,1,0,3,0,1,0,3,0,1,0,3,0,1,0,3,0,\ldots$

which has period $4$. Thus Condition (3) from Theorem 1.6 does not hold.
Finally, the sequence $|\beta_{n}|\bmod 4$ is

$0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,\ldots$

so (1) does not hold either. In particular, this demonstrates that all
hypotheses in Theorem 1.6 are necessary in general for the conclusion to hold.

### Outline of the paper

In §2 we recall various facts about elliptic curves over ${{\mathbb{Q}}}_{p}$.
The following §3 contains a detailed study of elliptic divisilibity sequences.
Here we prove periodicity modulo an arbitrary integer, and show our main
technical result (Proposition 3.19) on such sequences. In §4 we prove the
theorems from the introduction. We give various examples illustrating our
results in §5, as well as further examples which demonstrate that the
conclusion of Theorem 1.2 does not hold for arbitrary conic bundles over
elliptic curves. We finish in §6 by showing that the technical assumption in
Theorem 1.6 holds for $100\%$ of suitable Dirichlet characters of prime
moduli.

###  1.6. Notation and conventions

We choose an embedding
${{\mathbb{Q}}}/{{\mathbb{Z}}}\subset{{\mathbb{C}}}^{\times}$. This
corresponds to a choice of a compatible system of $n$th roots of unity for all
$n$. We denote by $O=(0:1:0)\in{{\mathbb{P}}}^{2}$. By a Weierstrass equation
with coefficients $a_{i}$ we mean

$y^{2}+a_{1}xy+a_{3}y=x^{3}+a_{2}x^{2}+a_{4}x+a_{6}.$ (1.6)

We denote by $\widehat{h}$ the canonical height on $E({{\mathbb{Q}}})$ [26,
Ch. VIII.9]. This extends to a positive definitive quadratic form on
$E({{\mathbb{Q}}})\otimes{{\mathbb{R}}}$ [26, Prop. VIII.9.6]. By
$O_{a,\dotsc,z}(A)$ we mean a quantity with absolute value at most $CA$ for
some positive constant $C$ depending on $a,\dotsc,z$ only; if the subscripts
are omitted the implied constant is absolute. We write $A\ll_{a,\dotsc,z}B$
for $A=O_{a,\dotsc,z}(B)$ and $A=o(B)$ for $A/B\to 0$.

### Acknowledgements

We thank Gergely Harcos and Efthymios Sofos for helpful comments and advice on
some of the proofs. We also thank the anonymous referee for a careful reading
of the paper which led to an improvement of Theorem 1.5.

D. Loughran and M. Nakahara were sponsored by EPSRC grant EP/R021422/2.

S. Bhakta and S. L. Rydin Myerson were supported by the European Research
Council (ERC) under the European Union’s Horizon 2020 research and innovation
program (grant ID 648329). S. L. Rydin Myerson was supported by DFG project
number 255083470, and by a Leverhulme Early Career Fellowship.

We thank the ZORP online seminar and its organisers. Initially there were two
separate teams working on this problem using similar methods. But during a
gathertown meeting on ZORP on 11th December 2020, we became aware of each
other during discussions with Efthymios Sofos. Each team had a slightly
different viewpoint and results, so we decided to combine to create, in our
view, an ultimately superior paper.

##  2\. Elliptic curves over $\mathbb{Q}_{p}$

In this section let $E$ be an elliptic curve over ${{\mathbb{Q}}}_{p}$ given
by a (not necessarily minimal) Weierstrass equation with coefficients in
${{\mathbb{Z}}}_{p}$. Denote by $E_{0}({{\mathbb{Q}}}_{p})$ the set of points
of $E({{\mathbb{Q}}}_{p})$ with non-singular reduction modulo $p$. We say that
$P\in E({{\mathbb{Q}}}_{p})$ has _bad reduction_ if $P\notin
E_{0}({{\mathbb{Q}}}_{p})$. There is a subgroup filtration

$\cdots\subset E_{2}({{\mathbb{Q}}}_{p})\subset
E_{1}({{\mathbb{Q}}}_{p})\subset E_{0}({{\mathbb{Q}}}_{p}),\quad
E_{i}({{\mathbb{Q}}}_{p})=\\{P\in E_{0}({{\mathbb{Q}}}_{p}):P\equiv O\bmod
p^{i}\\},\,i\geq 1.$

######  Definition 2.1.

If $P\in E({{\mathbb{Q}}}_{p})\setminus E_{1}({{\mathbb{Q}}}_{p})$ we set
$v_{p}(P)=0$. If $P\in E_{1}({{\mathbb{Q}}}_{p})$ we define

$v_{p}(P)=\sup\\{i:P\in E_{i}({{\mathbb{Q}}}_{p})\\}.$

######  Definition 2.2.

For $P\in E_{0}({{\mathbb{Q}}}_{p})$ and $k\in{{\mathbb{N}}}$ we denote by
$P\bmod p^{k}$ the image of $P$ in
$E_{0}({{\mathbb{Q}}}_{p})/E_{k}({{\mathbb{Q}}}_{p})$. We denote by
$\operatorname{ord}(P\bmod p^{k})$ its order.

######  Lemma 2.3.

Let $P=(x,y)\in E({{\mathbb{Q}}}_{p})$. Then
$v_{p}(P)=\max\\{0,-v_{p}(x)/2\\}.$

###### Proof.

If $v_{p}(x)\geq 0$ then $v_{p}(P)=0$ so the result holds. So assume
$v_{p}(x)<0$. As the rational function $x/y$ is a uniformising parameter at
$O$, we find that $v_{p}(P)=v_{p}(x/y)$. However, using $v_{p}(x)<0$ and the
Weierstrass equation, one finds that $2v_{p}(y)=3v_{p}(x)$, and the claim
easily follows. ∎

Lemma 2.3 gives a more explicit definition of the filtration which is often
used in texts (e.g. [26, Ex. VII.7.4]). We have the following inequality for
the valuation of a multiple of a point.

######  Lemma 2.4.

Let $P\in E_{1}({{\mathbb{Q}}}_{p})$. Then $v_{p}(nP)\geq v_{p}(P)+v_{p}(n)$,
with equality if $p\nmid n$.

###### Proof.

Hensel’s lemma [4, Lem. 2.1] shows that
$|E_{i}({{\mathbb{Q}}}_{p})/E_{i+1}({{\mathbb{Q}}}_{p})|=p$ for all $i\geq 1$,
thus this quotient is isomorphic to ${{\mathbb{Z}}}/p{{\mathbb{Z}}}$. The
result now easily follows. ∎

######  Remark 2.5.

Using the formal group law on $E$ [26, Thm. IV.6.4(b), Prop. VII.2.2], one can
show that equality in fact holds except possibly if $p=2,v_{p}(P)=1$ and
$p\mid n$. (See also [29, Thm. 3] for a version over number fields.) The
hypothesis is required for $p=2$. Take

$E:y^{2}+xy=x^{3}+4x+1,\quad P=(15/4,-83/8).$

Then $v_{2}(P)=1$, but one calculates that $v_{2}(2P)=4$. (The issue here is
that $E_{1}({{\mathbb{Q}}}_{2})$ has non-trivial $2$-torsion, so is not
isomorphic to $2{{\mathbb{Z}}}_{2}$.)

##  3\. Elliptic divisibility sequences

###  3.1. Basic properties

Now let $E/{{\mathbb{Q}}}$ be an elliptic curve given by a Weierstrass
equation (1.6) with coefficients $a_{i}\in{{\mathbb{Z}}}$. Let $P\in
E({{\mathbb{Q}}})$ be a non-torsion point. Throughout this section we consider
$E$ and $P$ as being fixed.

For any integer $n\geq 0$, define the $n$th division polynomial
$\psi_{n}\in{{\mathbb{Z}}}[x,y]$ as follows.

$\displaystyle\psi_{0}=0,\quad\psi_{1}=1,\quad\psi_{2}=2y+a_{1}x+a_{3},$
$\displaystyle\psi_{3}=3x^{4}+b_{2}x^{3}+3b_{4}x^{2}+3b_{6}x+b_{8},$
$\displaystyle\psi_{4}=\psi_{2}(2x^{6}+b_{2}x^{5}+5b_{4}x^{4}+10b_{6}x^{3}+10b_{8}x^{2}+(b_{2}b_{8}−b_{4}b_{6})x+b_{4}b_{8}−b_{2}^{6})$

where the $b_{i}$ are defined in [26, Chapter III], with subsequent
polynomials given by

$\begin{split}\psi_{2n+1}=\psi_{n+2}\psi_{n}^{3}-\psi_{n+1}^{3}\psi_{n-1},\quad
n\geq 2,\\\
\psi_{2n}\psi_{2}=\psi_{n}(\psi_{n+2}\psi_{n-1}^{2}-\psi_{n-2}\psi_{n+1}^{2}),\quad
n\geq 3,\end{split}$ (3.1)

and extend this to negative $n$ by setting $\psi_{n}=-\psi_{-n}$. These
formulas are equivalent to the recurrence relation

$\psi_{m+n}\psi_{m-n}\psi_{r}^{2}=\psi_{m+r}\psi_{m-r}\psi_{n}^{2}-\psi_{n+r}\psi_{n-r}\psi_{m}^{2}$
(3.2)

for any integers $m,n,r$. The sequence $\psi_{n}$ forms a divisibility
sequence in ${{\mathbb{Z}}}[x,y]$, i.e. $\psi_{n}\mid\psi_{m}$ for $n\mid m$.
One notion of an _elliptic divisibility sequence (EDS)_ in a commutative ring
would be a divisibility sequence satisfying (3.2). The study of EDS in
${{\mathbb{Z}}}$, in this sense, was begun by Ward [34], and a modern
exposition can be found in [10, Ch. 10]. We will use a slightly different kind
of EDS considered by Verzobio [32], which is better suited to our purpose.

We can interpret $x,y$ and each $\psi_{n}$ as rational functions on
$E({{\mathbb{Q}}})$. By [26, Ex. III.3.7], multiplication by $n$ is given as a
rational map by

$[n](P)=\left(\frac{x(P)\psi_{n}^{2}-\psi_{n-1}\psi_{n+1}}{\psi_{n}^{2}},\frac{\psi_{n-1}^{2}\psi_{n+2}-\psi_{n-2}\psi_{n+1}^{2}}{4y(P)\psi_{n}^{3}}\right).$

In particular $\psi_{n}$ is the square root of the denominator of the
$x$–coordinate; the problem for us is that in general there may be some common
factors between the numerator and denominator, so it will not be in lowest
terms. We want to work with the genuine denominator as it has better $p$-adic
properties (cf. Lemma 2.3).

######  Definition 3.1.

Define the sequence $e_{n}$ by $nP=(a_{n}/e_{n}^{2},b_{n}/e_{n}^{3})$ with
$\gcd(a_{n}b_{n},e_{n})=1$ and $e_{n}>0$. Writing
$\operatorname{sign}(t)=t/|t|$ for any $t\neq 0$, set

$\beta_{0}=0,\qquad\beta_{n}=\operatorname{sign}(\psi_{n}(P))\frac{e_{n}}{e_{1}},\qquad(n\in{{\mathbb{Z}}}\setminus\\{0\\}).$

The sequence $\beta_{n}$ is not in general an elliptic divisibility sequence
in the traditional sense, since it need not satisfy the recurrence relation
(3.2); differences can occur if $P$ admits primes of bad reduction. In [32]
Verzobio calls such sequences EDSB, as opposed to sequences of the form
$\psi_{n}(P)$ which he terms EDSA. He shows in [32, Thm. 1.9] that the
following weakened version of (3.2) does hold for an EDSB.

######  Proposition 3.2 (Verzobio).

Set

$M=M(P)=\operatorname{lcm}\\{\operatorname{ord}(P+E_{0}({{\mathbb{Q}}}_{p})):p\text{
prime}\\},$

where $\operatorname{ord}(P+E_{0}({{\mathbb{Q}}}_{p}))$ denotes the order of
the image of $P$ in the finite group
$E({{\mathbb{Q}}}_{p})/E_{0}({{\mathbb{Q}}}_{p})$. Let
$n,m,r\in{{\mathbb{Z}}}$ of which two are multiples of $M(P)$. Then

$\beta_{n+m}\beta_{n-m}\beta_{r}^{2}=\beta_{m+r}\beta_{m-r}\beta_{n}^{2}-\beta_{n+r}\beta_{n-r}\beta_{m}^{2}.$
(3.3)

######  Remark 3.3.

Here $M$ is the least positive integer such that $MP$ has everywhere good
reduction. It divides
$\prod_{p}\\#(E({{\mathbb{Q}}}_{p})/E_{0}({{\mathbb{Q}}}_{p}))$, which is the
product of the Tamagawa numbers of $E$ if the model is globally minimal.

Verzobio defines $\beta_{n}$ for $n\geq 0$ and proves the theorem under the
assumption $n\geq m\geq r>0$; in our notation this can be removed by using
$\beta_{-n}=-\beta_{n}$ and permuting the variables as appropriate.

To illustrate some of the nice $p$-adic properties of this sequence, we prove
that it is a strong divisibility sequence. We first make explicit Lemma 2.3.

######  Lemma 3.4.

For all primes $p$ we have $v_{p}(\beta_{n})=v_{p}(nP)-v_{p}(P)$.

###### Proof.

Immediate from the definition and Lemma 2.3. ∎

######  Lemma 3.5.

For all $n,m\in{{\mathbb{Z}}}$ we have
$\gcd(\beta_{m},\beta_{n})=|\beta_{\gcd(m,n)}|$.

###### Proof.

By Lemma 3.4, for any prime $p$ and any $V\in{{\mathbb{N}}}$ we have

$\\{n\in{{\mathbb{Z}}}:v_{p}(\beta_{n})\geq V\\}=\\{n\in{{\mathbb{Z}}}:nP\in
E_{V+v_{p}(P)}({{\mathbb{Q}}}_{p})\\}=q{{\mathbb{Z}}}$

for some $q\in{{\mathbb{N}}}$. In particular $p^{V}\mid\beta_{n}$ if and only
if $q\mid n$. Therefore

$p^{V}\mid\gcd(\beta_{m},\beta_{n})\iff q\mid\gcd(m,n)\iff
p^{V}\mid\beta_{\gcd(m,n)}.\qed$

We emphasise that an EDSA need not be a strong divisibility sequence if $P$
admits primes of bad reduction. The elegance of Verzobio’s EDSB is that it has
both good $p$-adic properties and comes within a whisker of satisfying the
recurrence relation.

###  3.2. Symmetry law

A central part of Ward’s work on elliptic divisibility sequences is a
_symmetry law_ [34, Thm. 8.1] (see [1, Thm. 1.11] for a modern formulation).
This says that an integral EDSA modulo a prime forms a periodic sequence of a
certain form. We prove a version of this for EDSBs for general prime powers.

######  Proposition 3.6.

Let $M$ be as in Proposition 3.2. Let $n,r\in{{\mathbb{Z}}}$ with $M\mid r$.
Let $p$ be a prime and let $k\in{{\mathbb{N}}}$. Suppose that $p^{k}$ divides
$\beta_{r}/\gcd(\beta_{r},\beta_{M})$. Then for all $\ell\in{{\mathbb{Z}}}$ we
have

$\beta_{n+\ell
r}\equiv\begin{cases}\left(\beta_{M+r}\beta_{M-r}\beta_{M}^{-2}\right)^{\frac{\ell(\ell-1)}{2}}(\beta_{n+r}\beta_{n}^{-1})^{\ell}\beta_{n}\bmod
p^{k},&\text{if }p^{k}\nmid\beta_{n},\\\ 0\bmod p^{k},&\text{if
}p^{k}\mid\beta_{n},\end{cases}$

where in the first case the quotients $\beta_{M+r}\beta_{M-r}/\beta_{M}^{2}$
and $\beta_{n+r}/\beta_{n}$ are $p$-adic units.

###### Proof.

Lemma 3.5 gives us

$|\beta_{\gcd(n,r)}|=\gcd(\beta_{n+\ell
r},\beta_{r})=\gcd(\beta_{n},\beta_{r})$ (3.4)

for every $\ell\in{{\mathbb{Z}}}$. This proves the proposition if
$p^{k}\mid\beta_{n}$, so assume that $p^{k}\nmid\beta_{n}$.

Taking $m=M$ in Proposition 3.2, and replacing $n$ by $n+\ell r$, we obtain

$\beta_{M+r}\beta_{M-r}\beta_{n+\ell
r}^{2}\equiv\beta_{n+(\ell+1)r}\beta_{n+(\ell-1)r}\beta_{M}^{2}\bmod\beta_{r}^{2},$
(3.5)

for any $\ell\in{{\mathbb{Z}}}$. We want to combine this with Lemma 3.5. Let

$\displaystyle C$
$\displaystyle=\frac{\beta_{M+r}\beta_{M-r}}{\beta_{M}^{2}},$ $\displaystyle
a_{\ell}$ $\displaystyle=\frac{\beta_{n+\ell r}}{\gcd(\beta_{n},\beta_{r})}.$
(3.6)

Since $M\mid r$, Lemma 3.5 shows that $C\in{{\mathbb{Z}}}$. Also (3.4) shows
that $a_{\ell}$ is an integer coprime to
$\beta_{r}/\gcd(\beta_{n},\beta_{r})$. Hence, dividing both sides of (3.5) by
$\beta_{n+\ell r}^{2}\beta_{M}^{2}$ gives

$C\equiv\frac{a_{\ell+1}a_{\ell-1}}{a_{\ell}^{2}}\bmod\frac{\beta_{r}^{2}}{\gcd(\beta_{n}\beta_{M},\beta_{r})^{2}}\quad\text{for
all }\ell\in{{\mathbb{Z}}},$ (3.7)

where every $a_{\ell}$ is coprime to the modulus. It follows by induction on
$\ell$ from (3.7) that

$a_{\ell}\equiv
C^{\frac{\ell(\ell-1)}{2}}a_{1}^{\ell}a_{0}^{1-\ell}\bmod\frac{\beta_{r}^{2}}{\gcd(\beta_{n}\beta_{M},\beta_{r})^{2}}.$

Multiplying by $\gcd(\beta_{n},\beta_{r})$ we obtain

$a_{\ell}\gcd(\beta_{n},\beta_{r})\equiv
C^{\frac{\ell(\ell-1)}{2}}(a_{1}a_{0}^{-1})^{\ell}a_{0}\gcd(\beta_{n},\beta_{r})\bmod\frac{\gcd(\beta_{n},\beta_{r})\beta_{r}^{2}}{\gcd(\beta_{n}\beta_{M},\beta_{r})^{2}}.$

Here $\beta_{r}/\gcd(\beta_{M},\beta_{r})$ divides the modulus, and so the
congruence holds modulo $p^{k}$. Inserting the definitions (3.6) proves the
first case in the proposition.

Finally, since $p^{k}\mid\beta_{r}/\gcd(\beta_{M},\beta_{r})$ and
$p^{k}\nmid\beta_{n}$, we see that $p$ divides the modulus in (3.7). Since
every $a_{\ell}$ is coprime to the modulus, we see that $C$ and
$\beta_{n+r}\beta_{n}^{-1}=a_{1}a_{0}^{-1}$ are $p$-adic units, as claimed in
the final part of the proposition. ∎

###  3.3. Periodicity

We now use the symmetry law to prove that $\beta_{n}$ is perodic modulo any
prime power, and hence modulo any integer. Versions of this appear in the
literature for differing definitions of EDS. Ward proved eventual periodicity
modulo any prime in [34, Thm. 11.1]. Shipsey proved a version modulo $p^{2}$
for primes of good reduction [23, Thm. 3.5.4]. Ayad proved it modulo any
integer, but assuming good reduction and avoiding $p=2$ or “rank of apparition
$2$” [3, Thm. D]. Silverman proved a version over finite fields [25, Thm. 1]
as well as a version modulo prime powers whenever the curve has good ordinary
reduction [25, Thm. 3]. Our version (Proposition 3.7) contains none of these
technical assumptions and is a general version of periodicity, for Verzobio’s
arguably more elegant EDSB.

Our result is the following, which shows periodicity modulo an arbitrary prime
power and gives an upper bound for the period. Note that the Chinese Remainder
Theorem then easily shows periodicity modulo an arbitrary integer.

######  Proposition 3.7.

Let $M$ be as in Proposition 3.2, let $k\in{{\mathbb{N}}}$, and let $p$ be a
prime. Let

$r(p^{k})=M\operatorname{ord}(MP\bmod p^{k+v_{p}(MP)})$ (3.8)

and

$\pi(p^{k})=\begin{cases}(p-1)p^{k-1}r(p^{k}),&\text{if }p\neq 2\text{ and
}\left(\frac{\beta_{M+r(p^{k})}\beta_{M-r(p^{k})}}{p}\right)=1,\\\
2(p-1)p^{k-1}r(p^{k}),&\text{otherwise}.\end{cases}$ (3.9)

Then for every $m\in{{\mathbb{Z}}}$ we have

$m\equiv n\bmod\pi(p^{k}){\hskip 5.0pt}\implies{\hskip
5.0pt}\beta_{m}\equiv\beta_{n}\bmod p^{k}.$

In other words the sequence $\beta_{m}\bmod p^{k}$ is periodic with period
dividing $\pi(p^{k})$.

We could slightly simplify the proof by defining
$\pi(p^{k})=2(p-1)p^{k-1}r(p^{k})$ in all cases. However it is of some
interest to find cases in which $4\nmid\pi(p^{k})$, because this allows us to
remove the condition $P\in E({{\mathbb{R}}})^{0}$ in some of our results (see
Theorem 1.6). This is our reason to include the first case in (3.9).

###### Proof.

For ease of notation we write $r=r(p^{k})$ throughout the proof.

We first observe that $rP\equiv O\bmod p^{k+v_{p}(MP)}$ by (3.8). That is we
have $k+v_{p}(MP)\leq v_{p}(rP)$, and hence by Lemma 3.4 and (3.8) we have

$p^{k}\text{ divides }\frac{\beta_{r}}{\gcd(\beta_{M},\beta_{r})}\quad\text{
and }\quad M\mid r.$ (3.10)

Let $n\in{{\mathbb{Z}}}$. By (3.10), the hypotheses of Proposition 3.6 are
satisfied. If $p^{k}\mid\beta_{n}$ then the result follows immediately;
suppose therefore that $p^{k}\nmid\beta_{n}$. Proposition 3.6 shows that

$\beta_{n+\ell
r}\equiv\left(\beta_{M+r}\beta_{M-r}\beta_{M}^{-2}\right)^{\frac{\ell(\ell-1)}{2}}(\beta_{n+r}\beta_{n}^{-1})^{\ell}\beta_{n}\quad\bmod
p^{k},$

for every $\ell\in{{\mathbb{Z}}}$, where
$\beta_{M+r}\beta_{M-r}\beta_{M}^{-2},\beta_{n+r}\beta_{n}^{-1}$ are $p$-adic
units. In particular $\gcd(\beta_{n},p^{k})=\gcd(\beta_{n+\ell
r},p^{k})=\gcd(\beta_{n},\beta_{r},p^{k})$.

Now $\\#({{\mathbb{Z}}}/p^{k}{{\mathbb{Z}}})^{\times}=(p-1)p^{k-1}$, and so if
$u\in{{\mathbb{Z}}}_{p}^{\times}$ then

$2(p-1)p^{k-1}\mid\ell\implies u^{\frac{\ell(\ell-1)}{2}}\equiv 1\bmod p^{k}.$

Moreover if $p\neq 2$ and $\left(\frac{u}{p}\right)=1$ then $u=v^{2}$ for
$v\in{{\mathbb{Z}}}_{p}^{\times}$. So

$(p-1)p^{k-1}\mid\ell,\,p\neq 2,\,\left(\frac{u}{p}\right)=1\implies
u^{\frac{\ell(\ell-1)}{2}}\equiv 1\bmod p^{k}.$

Thus by definition of $\pi(p^{k})$, if $\pi(p^{k})\mid\ell r$ then

$\left(\beta_{M+r}\beta_{M-r}\beta_{M}^{-2}\right)^{\frac{\ell(\ell-1)}{2}}(\beta_{n+r}\beta_{n}^{-1})^{\ell}\equiv
1\bmod p^{k},$

which implies

$\beta_{n+\ell r}\equiv\beta_{n}\bmod p^{k}.$

Writing $m=n+\ell r$ completes the proof. ∎

There is a simpler, but slightly weaker, bound for the period.

######  Lemma 3.8.

Let $M$ be as in Proposition 3.2, let $k\in{{\mathbb{N}}}$, and let $p$ be a
prime. Then the period of $\beta_{n}\bmod p^{k}$ divides

$\begin{cases}2M(p-1)p^{2(k-1)}\operatorname{ord}(MP\bmod p),&\text{if
}v_{p}(MP)=0,\\\ 2M(p-1)p^{2k-1},\quad&\text{otherwise}.\\\ \end{cases}$

###### Proof.

Let $Q=MP$. By Proposition 3.7, it suffices to show that

$\operatorname{ord}(Q\bmod p^{k+v_{p}(Q)})\,\text{ divides
}\,r_{1}(p^{k}):=\begin{cases}p^{k-1}\operatorname{ord}(Q\bmod p),&\text{if
}v_{p}(Q)=0,\\\ p^{k},\quad&\text{otherwise}.\\\ \end{cases}$

If $v_{p}(Q)=0$ then Lemma 2.4 implies that
$v_{p}(p^{k-1}\operatorname{ord}(Q\bmod p)Q)\geq
k-1+v_{p}(\operatorname{ord}(Q\bmod p)Q)\geq k.$ If $v_{p}(Q)>0$ then Lemma
2.4 yields $v_{p}(p^{k}Q)\geq k+v_{p}(Q)$. In both cases $r_{1}(p^{k})Q\equiv
0\bmod p^{k+v_{p}(Q)}$, as required. ∎

######  Remark 3.9.

By definition $M$ divides
$\prod_{p}|E({{\mathbb{Q}}}_{p})/E_{0}({{\mathbb{Q}}}_{p})|$, hence is bounded
uniformly with respect to $P$. Moreover $\operatorname{ord}(MP\bmod p)$
divides $|E_{0}({{\mathbb{Q}}}_{p})/E_{q}({{\mathbb{Q}}}_{p})|$. Thus Lemma
3.8 shows that the period of $\beta_{n}\bmod N$ can be bounded independently
of $P$ for all $N\in{{\mathbb{N}}}$, with the bound only depending on $E$ and
$N$.

###  3.4. Signs

Recall from Definition 3.1 that the sign of $\beta_{n}$ is the sign of the
sequence $\psi_{n}(P)$. The following is [27, Thm. 4] (see also [2] for a
generalisation.)

######  Proposition 3.10 (Silverman-Stephens).

There is a sign $\sigma\in\\{\pm 1\\}$ and an irrational number $\beta$ such
that for all $n\in{{\mathbb{N}}}$ we have

$\sigma^{n-1}\operatorname{sign}(\beta_{n})=\begin{cases}(-1)^{\lfloor
n\beta\rfloor},&\text{if}\leavevmode\nobreak\ P\in E(\mathbb{R})^{0},\\\
(-1)^{\lfloor n\beta\rfloor+\frac{n}{2}},&\text{if}\leavevmode\nobreak\
P\notin E(\mathbb{R})^{0}\leavevmode\nobreak\ \text{and}\leavevmode\nobreak\
n\leavevmode\nobreak\ \text{is\leavevmode\nobreak\ even,}\\\
(-1)^{\frac{n-1}{2}},&\text{if}\leavevmode\nobreak\ P\notin
E(\mathbb{R})^{0}\leavevmode\nobreak\ \text{and}\leavevmode\nobreak\
n\leavevmode\nobreak\ \text{is\leavevmode\nobreak\ odd.}\end{cases}$

If $P\in E(\mathbb{R})^{0}$ then $\beta$ is defined as follows. We fix an
${{\mathbb{R}}}$-analytic group isomorphism
$\psi:E({{\mathbb{R}}})^{0}\to{{\mathbb{R}}}^{\ast}_{>0}/e^{{{\mathbb{Z}}}}$ .
Then let $\beta=\log u$ where $u$ is a representative of $\psi(P)$ in
${{\mathbb{R}}}^{\ast}_{>0}$ with $e^{-1}<u<1$.

In Silverman and Stephens’ original statement of the theorem there is an
isomorphism $E({{\mathbb{R}}})\to{{\mathbb{R}}}^{\ast}/q^{{\mathbb{Z}}}$,
which maps $E({{\mathbb{R}}})^{0}$ to either
${{\mathbb{R}}}^{\ast}_{>0}/q^{{\mathbb{Z}}}$ if $q>0$ or
${{\mathbb{R}}}^{\ast}_{>0}/q^{2{{\mathbb{Z}}}}$ otherwise. Without loss of
generality we can assume that $E({{\mathbb{R}}})^{0}$ is mapped to
${{\mathbb{R}}}^{\ast}_{>0}/e^{{{\mathbb{Z}}}}$, or else we can compose our
isomorphism with $v\mapsto v^{-1/\log q}$ or $v^{-1/2\log q}$. When $P\in
E(\mathbb{R})^{0}$ their choice of $u$ then satisfies $e^{-1}<u<1$ as above.

We want to say something about the Diophantine approximation properties of the
irrational number $\beta$ from the theorem. Let $\exp_{E}:{{\mathbb{C}}}\to
E({{\mathbb{C}}})$ be the usual parametrisation of $E$ using the Weierstrass
$\wp$-function, see for example [26, Cor. VI.5.1.1]. Bosser and Gaudron [8,
Thm. 1.2] proved:

######  Proposition 3.11 (Bosser-Gaudron).

Let $z\in{{\mathbb{C}}}$ such that $\exp_{E}(z)\in
E({{\mathbb{Q}}})\setminus\\{O\\}$. Then we have

$\log|z|\gg_{E}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}-1}-\widehat{h}(\exp_{E}z),$

where $\widehat{h}$ is the canonical height, as in §1.6.

A remark about the definition of $\exp_{E}:{{\mathbb{C}}}\to
E({{\mathbb{C}}})$ may be helpful. The usual convention would be to normalise
this map so that in a certain sense the derivative of $\exp_{E}$ at the origin
is the identity. This is not necessary for our purposes, and the naive
parametrisation familiar from a first course on elliptic curves suffices. We
only use the fact that $\exp_{E}$ is a fixed ${{\mathbb{R}}}$-analytic
surjective additive group homomorphism, and Proposition 3.11 which holds
regardless of normalisation. We use these to prove

######  Lemma 3.12.

Suppose the point $P$ from the start of this section satisfies $P\in
E({{\mathbb{R}}})^{0}$. Let $\beta$ be as in Proposition 3.10, and let
$N\in{{\mathbb{Z}}}\setminus\\{0\\}$. Then

$\min_{M\in{{\mathbb{Z}}}}\log|N\beta-M|\gg_{E}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}-1}-\widehat{h}(NP).$

###### Proof.

Let $w\in{{\mathbb{C}}}^{*}$ such that $\exp_{E}(w)=P$, so that
$\exp_{E}(w{{\mathbb{R}}})=E({{\mathbb{R}}})^{0}$ and
$\psi(\exp_{E}(tw))=e^{t\beta+{{\mathbb{Z}}}}$ for any $t\in{{\mathbb{R}}}$.
For any $M\in{{\mathbb{Z}}}$ we deduce that

$\exp_{E}(N+\beta^{-1}M)=\phi^{-1}(e^{N\beta+M+{{\mathbb{Z}}}}).$

By the definition of $\beta$ we deduce
$\exp_{E}(N+\beta^{-1}M)=\phi^{-1}(u^{N}e^{{\mathbb{Z}}})$ which is $NP$ by
definition of $u$. That is,

$\exp_{E}^{-1}(NP)\supseteq\\{(N+\beta^{-1}M)w:M\in{{\mathbb{Z}}}\\}.$

Now by Proposition 3.11, any $t$ such that $tw\in\exp_{E}^{-1}(NP)$ has
$\log|t|\gg_{E}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}-1}-\widehat{h}(NP)$,
and so

$\min_{M\in{{\mathbb{Z}}}}\log|N\beta-M|\gg_{E}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}-1}-\widehat{h}(NP).\qed$

###  3.5. Main result

We now provide the main technical input required for the results stated in the
introduction (Proposition 3.19). Under certain assumptions, it stipulates the
existence of many prime-numbered elements of the sequence $\beta_{n}$ which
are divisible by primes to a certain valuation that are non-trivial with
respect to a given Dirichlet character. We require an effective version of
uniform distribution modulo $1$ for primes in an arithmetic progression
multiplied by an irrational. This is deduced from an exponential sum estimate.
To begin, we quote two standard results on exponential sums in primes from
Vaughan [31, Thm. 3.1, Lem. 3.1].

######  Lemma 3.13 (Vinogradov).

If $\alpha\in{{\mathbb{R}}},a\in{{\mathbb{Z}}},q\in{{\mathbb{N}}}$ with
$\gcd(a,q)=1,q\leq y,$ and $|\alpha-a/q|\leq q^{-2}$ then

$\sum_{\begin{subarray}{c}p\leq y\\\ p\text{ prime}\end{subarray}}(\log
p)e(\alpha p)\ll(\log y)^{4}(yq^{-1/2}+y^{4/5}+y^{1/2}q^{1/2}).$

######  Lemma 3.14 (Siegel–Walfisz for linear exponential sums).

Let $B>0$. If $\alpha\in{{\mathbb{R}}},a\in{{\mathbb{Z}}},q\in{{\mathbb{N}}}$
with $\gcd(a,q)=1,q\leq(\log y)^{B}$ and $|\alpha-a/q|\leq(\log y)^{B}/y$ then
there is $C_{B}>0$ such that

$\sum_{\begin{subarray}{c}p\leq y\\\ p\text{ prime}\end{subarray}}e(\alpha
p)=\frac{\mu(q)}{\varphi(q)}\sum_{m=1}^{y}e((\alpha-a/q)m)+O_{B}(y\exp(-C_{B}{\sqrt{\log
y}}))$

where $\mu$ is the Möbius function and $\varphi$ is the Euler totient
function.

We use these to estimate sums of the form $\sum_{\ell\leq y,\ell\text{
prime}}(\log\ell)e(\alpha\ell)$.

######  Lemma 3.15.

Suppose that we have
$\alpha\in{{\mathbb{R}}},a\in{{\mathbb{Z}}},q\in{{\mathbb{N}}},y\in{{\mathbb{R}}}$
such that

$\displaystyle\gcd(a,q)$ $\displaystyle=1,$ $\displaystyle q$
$\displaystyle\leq y$ $\displaystyle|\alpha-a/q|$ $\displaystyle\leq 1/qy.$
(3.11)

Then

$\sum_{\begin{subarray}{c}\ell\leq y\\\
\ell\text{prime}\end{subarray}}(\log\ell)e(\alpha\ell)\ll y(\log
y)^{-1}+\frac{y\log\log q}{q}.$ (3.12)

###### Proof.

If $q\leq(\log y)^{5}$ we apply Lemma 3.14; otherwise we apply Lemma 3.13.
Recalling the standard bound $\varphi(q)\gg\frac{q}{\log\log q}$ gives the
result. ∎

From this simple estimate we pass to a more difficult exponential sum.

######  Lemma 3.16.

Let $s,t\in{{\mathbb{N}}}$ with $\gcd(s,t)=1$ and let $\beta$ be as in
Proposition 3.10. For all $y\geq e^{e^{e}},j\in{{\mathbb{N}}}$ we have

$\sum_{\begin{subarray}{c}\ell\leq y\\\ \ell\equiv s\bmod t\\\ \ell\text{
prime}\end{subarray}}(\log\ell)e(j\ell\beta/2)\ll_{E}ytj\sqrt{\frac{\widehat{h}(P)}{\log
y}}\log\log\log y.$ (3.13)

###### Proof.

Fix $y\geq 1,j\in{{\mathbb{N}}}$. We use the formula

$\frac{1}{t}\sum_{m\in{{\mathbb{Z}}}/t{{\mathbb{Z}}}}e(m(n-s)/t)=\begin{cases}1,&n\equiv
s\bmod t,\\\ 0,&\text{otherwise},\end{cases}$

which is valid for all integers $n$. This gives

$\displaystyle\sum_{\begin{subarray}{c}\ell\leq y\\\ \ell\equiv s\bmod
t\end{subarray}}(\log\ell)e(j\ell\beta/2)$
$\displaystyle=\frac{1}{t}\sum_{m\in{{\mathbb{Z}}}/t{{\mathbb{Z}}}}e(-ms/t)\sum_{\begin{subarray}{c}\ell\leq
y\end{subarray}}(\log\ell)e((m/t+j\beta/2)\ell).$

We apply Lemma 3.15 to estimate the final sum in (3.13). We set

$\alpha=m/t+j\beta/2.$ (3.14)

We fix $a\in{{\mathbb{Z}}},q\in{{\mathbb{N}}}$ satisfying (3.11), noting that
the existence of such $(a,q)$ is guaranteed by Dirichlet’s approximation
theorem. Then (3.12) becomes

$\sum_{\ell\leq y}(\log\ell)e((m/t+j\beta/2)\ell)\ll\frac{y}{\log
y}+\frac{y\log\log q}{q}.$ (3.15)

For this to be useful we need to deduce from (3.11) and (3.14) a lower bound
on $q$. We are going to prove that

$\text{either}\quad y\leq t^{3/2}\quad\text{or}\quad
q\geq\frac{1}{tj}\sqrt{\frac{\log y}{\widehat{h}(P)}}.$ (3.16)

We start with the final condition in (3.11), and multiply it by $2tq$ to get

$\log(2t/y)\geq\min_{M\in{{\mathbb{Z}}}}\log|2tq\alpha-M|.$

The definition (3.14) gives

$\min_{M\in{{\mathbb{Z}}}}\log|2tq\alpha-M|=\min_{M\in{{\mathbb{Z}}}}\log|tjq\beta-M|,$

and by Lemma 3.12 with $N=tjq$ we have

$\min_{M\in{{\mathbb{Z}}}}\log|tjq\beta-M|\gg_{E}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}-1}-\widehat{h}(tjqP).$

Putting the last three displays together gives us

$\widehat{h}(tjqP){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}+1\gg_{E}}\log(y/2t).$

Recalling that $\widehat{h}$ is a quadratic form on
$E({{\mathbb{Q}}})\otimes{{\mathbb{R}}}$, we have
$\widehat{h}(tjqP)=(tjq)^{2}\widehat{h}(P)$ and so

${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}-1}+\log(y/t)\ll_{E}(tjq)^{2}\widehat{h}(P).$

Provided $y\geq t^{3/2}$, this implies that $\log
y\ll_{E}(tjq)^{2}\widehat{h}(P)$, which is (3.16).

We substitute (3.16) into (3.15) and recall that $\log\log\log y\geq 1$ by
assumption, to show that either

$\sum_{\ell\leq y}(\log\ell)e(\ell(m/t+j\beta/2))\ll_{E}y(\log
y)^{-1}+ytj\sqrt{\frac{\widehat{h}(P)}{\log y}}\log\log\log
y\quad\text{or}\quad y\leq t^{3/2}.$

In the latter case we have $\sum_{\ell\leq
y}(\log\ell)e(\ell(m/t+j\beta/2))\ll y\leq y^{1/3}t$ by the Prime Number
Theorem. So in either case

$\sum_{\ell\leq y}(\log\ell)e(\ell(m/t+j\beta/2))\ll_{E}y^{1/3}t+y(\log
y)^{-1}+ytj\sqrt{\frac{\widehat{h}(P)}{\log y}}\log\log\log y.$

Since $\widehat{h}(P)\gg_{E}1$ this implies (3.13). ∎

To apply the previous lemma we turn to the Erdős–Turán inequality [12, Thm.
III]:

######  Lemma 3.17 (Erdős–Turán).

For any $0\leq a<b\leq 1$, any real sequence $t_{m}$, any $M\in{{\mathbb{N}}}$
and any $H>0$ we have

$\left\lvert(b-a)M-\sum_{m=1}^{M}\mathbf{1}_{\\{t_{m}\\}\in[a,b)}\right\rvert\ll\frac{M}{H}+\sum_{1\leq
j\leq H}\frac{1}{j}\left\lvert\sum_{m=1}^{M}e(jt_{m})\right\rvert,$

where we write $\\{\,\cdot\,\\}$ for the fractional part, and
$\mathbf{1}_{\\{t_{m}\\}\in[a,b)}=1$ if ${\\{t_{m}\\}\in[a,b)}$ and $0$
otherwise.

We are now ready to prove our equidistribution result.

######  Proposition 3.18.

Suppose the point $P$ from the start of this section satisfies $P\in
E({{\mathbb{R}}})^{0}$. Let $s,t\in{{\mathbb{N}}}$ with $\gcd(s,t)=1$ and let
$\beta$ be as in Proposition 3.10. For any $0\leq a<b\leq 1$ and any
$\epsilon>0$ we have

$\\#\\{\text{primes }\ell\leq x:\ell\equiv s\bmod
t,\\{\ell\beta/2\\}\in[a,b)\\}=\\\
\left(\frac{b-a}{\varphi(t)}+O_{E,\epsilon}\left(\frac{t^{\epsilon}(\log\log\log
x)^{2}{\widehat{h}(P)}}{\log x}\right)^{1/4}\right)\frac{x}{\log x},$

where we write $\\{\,\cdot\,\\}$ for the fractional part. In particular for
any $\epsilon>0$ and any $\sigma\in\\{\pm 1\\}$ we have

$\\#\\{\text{primes }\ell\leq x:\ell\equiv s\bmod
t,(-1)^{\lfloor\ell\beta\rfloor}={\sigma}\\}=\\\
\left(\frac{1}{2\varphi(t)}+O_{E,\epsilon}\left(\frac{t^{\epsilon}(\log\log\log
x)^{2}{\widehat{h}(P)}}{\log x}\right)^{1/4}\right)\frac{x}{\log x}.$

###### Proof.

For the second part, we note that $(-1)^{\lfloor\ell\beta\rfloor}=1$ if and
only if $0\leq\\{\ell(\beta/2)\\}<1/2$. So it suffices to prove the first
claim in the proposition.

During the proof we will repeatedly use the fact that
$\widehat{h}(P)\gg_{E}1$, which holds by for example [26, Thm. VIII.9.10(a)].
If $t>(\log x)^{1/\epsilon}$ then the bound follows at once from this last
result and the Prime Number Theorem. We will assume from now on that
$t\leq(\log x)^{1/\epsilon}$.

Throughout the proof we write $e(y)=\exp(2\pi iy)$.

We first apply Lemma 3.17 with $M,t_{m}$ as follows. Denote the primes
$\ell\equiv s\bmod t,\ell\leq x$ by $\ell_{1},\dotsc,\ell_{M}$ and let
$t_{m}=\\{\ell_{m}\beta/2\\}$. There is $c>0$ such that for each $B>0$ with
$t\leq(\log x)^{B}$, we have

$M=\frac{x}{\varphi(t)\log x}+O\left(\frac{x}{\varphi(t)(\log
x)^{2}}\right)+O_{B}(x\exp(-c\sqrt{\log x})),$

by the Siegel-Walfisz theorem [20, Corollary 11.21, see also p5]. In
particular, setting $B=1/\epsilon$ and recalling that $t\leq(\log
x)^{1/\epsilon}$ and thus $\exp(c\sqrt{\log x})\gg_{\epsilon}t(\log x)^{2}$,
it follows that

${M}=\frac{x}{\varphi(t)\log x}+O\left(\frac{x}{\varphi(t)(\log
x)^{2}}\right),$

We substitute this into Lemma 3.17 to obtain

$\\#\big{\\{}m\leq
M:\\{\ell_{m}\beta/2\\}\in[a,b)\big{\\}}-\frac{(b-a)x}{\varphi(t)\log x}\\\
\ll\frac{x}{H\varphi(t)\log x}+\frac{x}{\varphi(t)(\log x)^{2}}+\sum_{1\leq
j\leq H}\frac{1}{j}\left\lvert\sum_{\begin{subarray}{c}\ell\leq x\\\
\ell\equiv s\bmod t\end{subarray}}e(j\ell\beta/2)\right\rvert.$ (3.17)

Our goal is to estimate the last sum above. As often happens it is convenient
to count primes weighted by the von Mangoldt function. By partial summation,

$\sum_{\begin{subarray}{c}\ell\leq x\\\ \ell\equiv s\bmod t\\\ \ell\text{
prime}\end{subarray}}e(j\ell\beta/2)=\frac{1}{\log
x}\sum_{\begin{subarray}{c}\ell\leq x\\\ \ell\equiv s\bmod t\\\ \ell\text{
prime}\end{subarray}}(\log\ell)e(j\ell\beta/2)\,+\\\
\int_{1}^{x}\frac{1}{y(\log y)^{2}}\sum_{\begin{subarray}{c}\ell\leq y\\\
\ell\equiv s\bmod t\\\ \ell\text{
prime}\end{subarray}}(\log\ell)e(j\ell\beta/2)\,\mathrm{d}y.$ (3.18)

It follows from Lemma 3.16 and (3.18) that for each non-zero integer $j$ we
have

$\sum_{\begin{subarray}{c}\ell\leq x\\\ \ell\equiv s\bmod t\\\ \ell\text{
prime}\end{subarray}}e(j\ell\beta/2)\ll_{E}\frac{x}{\log x}\cdot
tj\sqrt{\frac{\widehat{h}(P)}{\log x}}\log\log\log x.$

Together with (3.17) and the choice

$H=\left(\frac{\log
x}{\widehat{h}(P)}\right)^{1/4}\left(t\varphi(t)\log\log\log x\right)^{-1/2},$

this implies that

$\\#\big{\\{}m\leq
M:\\{\ell_{m}\beta/2\\}\in[a,b)\big{\\}}-\frac{(b-a)x}{\varphi(t)\log x}\ll\\\
\frac{x}{\log x}\cdot\left(\frac{1}{\varphi(t)\log
x}+\left(\frac{\widehat{h}(P)}{\log x}\right)^{1/4}\left(\frac{t\log\log\log
x}{\varphi(t)}\right)^{1/2}\right).$

The result follows since $\widehat{h}(P)\gg_{E}1$ and
$\varphi(t)\gg_{\epsilon}t^{1-\epsilon}$. ∎

Our main result is now as follows. In the statement
$\operatorname{ord}(\chi(p))$ denotes the multiplicative order of the root of
unity $\chi(p)$.

######  Proposition 3.19.

Let $\chi$ be a Dirichlet character with modulus $q(\chi)$. Let $\pi$ be the
period of $\beta_{n}\bmod q(\chi)$. Suppose that there exists
$\alpha\in{{\mathbb{N}}}$ such that

$\gcd(\alpha,\pi)=1$ (3.19)

and such that one of the following holds:

$\displaystyle\chi(|\beta_{\alpha}|)\neq 0,1,\quad\text{or}$
$\displaystyle\chi(-|\beta_{\alpha}|)\neq 0,1\text{ and
}4\nmid\pi,\quad\text{or}$ (3.20) $\displaystyle\chi(-|\beta_{\alpha}|)\neq
0,1\text{ and }P\in E(\mathbb{R})^{0}.$

Then for any $\epsilon>0$ and $x>\exp(\pi^{2})$ we have

$\\#\left\\{\text{primes }\ell\leq x:\operatorname{ord}(\chi(p))\nmid
v_{p}(\beta_{\ell})\text{ for some prime }p\nmid q(\chi)\right\\}\\\
\geq\left(\frac{1}{2\varphi(\pi)}+O_{E,\epsilon}\left(\frac{\pi^{\epsilon}(\log\log\log
x)^{2}{\widehat{h}(P)}}{\log x}\right)^{1/4}\right)\frac{x}{\log x}$

###### Proof.

From (3.20), there is $\tau\in\\{\pm 1\\}$ such that
$\chi(\tau|\beta_{\alpha}|)\neq 0,1$. We separate into two cases depending on
the real properties of $P$.

### Case 1. $P\in E(\mathbb{R})^{0}$:

From Proposition 3.10 we have
$\operatorname{sign}(\beta_{n})=\sigma^{n-1}(-1)^{\lfloor n\beta\rfloor}$ for
some $\sigma\in\\{\pm 1\\}$ and some irrational number $\beta$. Now consider
the set of primes

$\Lambda=\\{\ell\text{
prime}:\ell\equiv\alpha\bmod\pi,\,\operatorname{sign}(\beta_{\ell})=\tau\operatorname{sign}(\beta_{\alpha})\\}\\}.$

Let $\ell\in\Lambda$. Then by periodicity we have
$\beta_{\ell}\equiv\beta_{\alpha}\bmod q(\chi)$, so
$\chi(\beta_{\ell})=\chi(\beta_{\alpha})$ as $\chi$ is periodic modulo
$q(\chi)$. Moreover, we have arranged signs so that
$\chi(|\beta_{\ell}|)=\chi(\tau|\beta_{\alpha}|)\neq 0,1$. Hence as $\chi$ is
multiplicative we deduce the existence of a prime factor $p$ of
$|\beta_{\ell}|$ with $p\nmid q(\chi)$ and $\operatorname{ord}(\chi(p))\nmid
v_{p}(\beta_{\ell}).$ It thus suffices to note that
$\\{\ell\in\Lambda:\ell\leq x\\}$ satisfies the required lower bound by (3.19)
and Proposition 3.18.

### Case 2. $P\not\in E(\mathbb{R})^{0}$:

In order to handle a number of sub-cases simultaneously, we show that there is
$\iota\in\\{0,1,2,3\\}$ such that $\alpha+\iota\pi$ is odd and

$(-1)^{(\alpha+\iota\pi-1)/2}=\begin{cases}\tau\operatorname{sign}(\beta_{\alpha}),&\text{if
}\alpha\text{ is even},\\\ \tau(-1)^{(\alpha-1)/2},&\text{if }\alpha\text{ is
odd}.\end{cases}$ (3.21)

### Case 2.1. $2\mid\alpha$

Here $\pi$ is odd by (3.19). Choosing $\iota\in\\{1,3\\}$ we can arrange for
$\frac{\alpha+\iota\pi-1}{2}$ to be odd or even, and hence
$(-1)^{(\alpha+\iota\pi-1)/2}=-1$ or 1 to satisfy (3.21).

### Case 2.2. $2\nmid\alpha$ and $4\mid\pi$

Here we have $\tau=1$ by (3.20). Let $\iota=0$ and then
$(-1)^{(\alpha-1)/2}=\tau(-1)^{(\alpha-1)/2}$ as required for (3.21).

### Case 2.3. $2\nmid\alpha$ and $4\nmid\pi$

We can choose $\iota\in\\{0,2\\}$ so that $\iota\pi/2$ is odd or even as
needed. So we arrange $(-1)^{\iota\pi/2}=\tau$ which gives (3.21).

We now let $q=\operatorname{lcm}(4,\pi)$ and consider primes $\ell$ of the
form $\ell\equiv\alpha+\iota\pi\bmod q$. By Proposition 3.10 and (3.21) we
then have
$\operatorname{sign}(\beta_{\ell})=\tau\operatorname{sign}(\beta_{\alpha})$.
But $\beta_{\ell}\equiv\beta_{\alpha}\bmod q(\chi)$ by periodicity, so
$\chi(|\beta_{\ell}|)=\chi(\tau|\beta_{\alpha}|)\neq 0,1$ by (3.20) as $\chi$
is periodic modulo $q(\chi)$. We are now in a similar situation to Case 1.
Here (3.19) and the fact that $\alpha+\iota\pi$ is odd implies that
$\gcd(\alpha+\iota\pi,q)=1$. Together with the assumption that $\pi<\sqrt{\log
x}$ in the proposition, this allows us to apply the Siegel-Walfisz Theorem
[20, Corollary 11.21] to show that the set under consideration has size

$\frac{x}{\varphi(q)\log x}+O\left(\frac{qx}{(\log
x)^{2}}\right)\geq\left(\frac{1}{2\varphi(\pi)}+O\left(\frac{\pi}{\log
x}\right)\right)\frac{x}{\log x}.$

Using again the fact that $\pi<\sqrt{\log x}$, the claim follows. ∎

######  Remark 3.20.

Aside from finitely many exceptions, we expect that the primes $p$ constructed
in Proposition 3.19 satisfy the stronger condition $v_{p}(\beta_{\ell})=1$.
This is the condition referred to in §1.3 as being a “non-Wieferich prime for
base $P\in E$”.

##  4\. Brauer groups

The aim of this section is to prove Theorem 1.6. We begin with some
preliminaries on Brauer groups.

###  4.1. Recap of Brauer groups

For a scheme $X$ we denote by
$\operatorname{Br}X={{\mathrm{H}}}^{2}(X,\mathbb{G}_{\mathrm{m}})$ its
(cohomological) Brauer group. If $X$ is regular and integral and $D\subset X$
is a regular integral divisor, then there is an associated residue map

$\operatorname{\partial}_{D}:\operatorname{Br}(X\setminus
D)[\ell^{\infty}]\to{{\mathrm{H}}}^{1}(D,{{\mathbb{Q}}}/{{\mathbb{Z}}})$

where $\ell$ is any prime which is invertible on $X$. We say that
$b\in\operatorname{Br}(X\setminus D)$ whose order is invertible on $X$ is
_unramified_ at $D$ if $\operatorname{\partial}_{D}(b)=0$; in which case
Grothendieck’s purity theorem [9, Thm. 3.7.1] implies that
$b\in\operatorname{Br}X$.

For any $b\in\operatorname{Br}X$ and any point $x\in X$, there is a well-
defined specialisation $b(x)\in\operatorname{Br}\kappa(x)$. For a field $k$ we
denote by

$X(k)_{b}=\\{x\in X(k)\colon b(x)=0\in\operatorname{Br}k\\}$ (4.1)

the zero locus of $b$ on $k$-rational points. If only
$b\in\operatorname{Br}\kappa(X)$, then we abuse notation and write

$X(k)_{b}=\\{x\in X(k):b\text{ defined at }x,b(x)=0\in\operatorname{Br}k\\}.$

If $\dim X=1$, then this just means we implicitly remove the finitely many
points where $b$ is ramified. For a number field $k$, there is an exact
sequence

$0\to\operatorname{Br}k\to\bigoplus_{v}\operatorname{Br}k_{v}\to{{\mathbb{Q}}}/{{\mathbb{Z}}}\to
0$ (4.2)

where the last map is the sum of all local invariants
$\operatorname{inv}_{v}:\operatorname{Br}k_{v}\to{{\mathbb{Q}}}/{{\mathbb{Z}}}$
of $k$ [9, Thm. 13.1.8]. The local invariant is defined in terms of residues,
by applying the residue to $\operatorname{Br}\mathcal{O}_{v}$ then using
${{\mathrm{H}}}^{1}({{\mathbb{F}}}_{v},{{\mathbb{Q}}}/{{\mathbb{Z}}})=\operatorname{Hom}(\operatorname{Gal}(\bar{{{\mathbb{F}}}}_{v}/{{\mathbb{F}}}_{v}),{{\mathbb{Q}}}/{{\mathbb{Z}}})$
and evaluating the resulting homomorphism at the Frobenius element [9, Def.
13.1.7].

###  4.2. Specialisation of Brauer groups on elliptic curves

We now prepare for the proof of Theorem 1.6. Let $E$ be an elliptic curve over
${{\mathbb{Q}}}$ given by a Weierstrass equation with coefficients in
${{\mathbb{Z}}}$. Let $b\in\operatorname{Br}{{\mathbb{Q}}}(E)$ which we assume
is ramified at some rational point $P$. The residue of $b$ at $P$ is an
element of ${{\mathrm{H}}}^{1}({{\mathbb{Q}}},{{\mathbb{Q}}}/{{\mathbb{Z}}})$.
We associate to this a Dirichlet character $\chi$ as follows.

####  4.2.1. Associated Dirichlet character

Firstly the residue of $b$ at $P$ yields a group homomorphism via the
identification
${{\mathrm{H}}}^{1}({{\mathbb{Q}}},{{\mathbb{Q}}}/{{\mathbb{Z}}})=\operatorname{Hom}(\operatorname{Gal}(\bar{{{\mathbb{Q}}}}/{{\mathbb{Q}}}),{{\mathbb{Q}}}/{{\mathbb{Z}}})$.
Let $K/{{\mathbb{Q}}}$ be the cyclic extension determined by the kernel. By
the Kronecker–Weber Theorem, there is an embedding
$K\subseteq{{\mathbb{Q}}}(\mu_{q})$ where $q$ is the conductor of $K$. As
$\operatorname{Gal}({{\mathbb{Q}}}(\mu_{q})/{{\mathbb{Q}}})\cong({{\mathbb{Z}}}/q{{\mathbb{Z}}})^{\times}$
canonically, composing with
$\operatorname{Gal}({{\mathbb{Q}}}(\mu_{q})/{{\mathbb{Q}}})\to\operatorname{Gal}(K/{{\mathbb{Q}}})$
yields a homomorphism
$({{\mathbb{Z}}}/q{{\mathbb{Z}}})^{\times}\to{{\mathbb{Q}}}/{{\mathbb{Z}}}$.
Recalling that we chose an embedding
${{\mathbb{Q}}}/{{\mathbb{Z}}}\subset{{\mathbb{C}}}^{\times}$ in §1.6, we
obtain a primitive Dirichlet character $\chi$ modulo $q$ on extending to
${{\mathbb{Z}}}$. (In our work we will only care about the order of $\chi(p)$,
which is independent of the choice of embedding
${{\mathbb{Q}}}/{{\mathbb{Z}}}\subset{{\mathbb{C}}}^{\times}$.) For a prime
$p$, this satisfies

$\chi(p)=0\iff p\mid q,\quad\chi(p)=1\iff p\text{ is completely split in }K.$

For example, if $K={{\mathbb{Q}}}(\sqrt{D})$ where $D$ is a fundamental
discriminant, then we obtain the quadratic character
$m\mapsto\left(\frac{D}{m}\right)$ given by the Kronecker symbol.

####  4.2.2. Specialisation

Let $\mathcal{E}$ be the natural projective model for $E$ over
${{\mathbb{Z}}}$ determined by the Weierestrass equation. There exists a non-
empty regular open subscheme $\mathcal{E}^{\circ}\subseteq\mathcal{E}$ such
that $b\in\operatorname{Br}\mathcal{E}^{\circ}$.

We choose a finite set of primes $S$ of ${{\mathbb{Q}}}$ containing all primes
dividing $\operatorname{ord}(\chi)q(\chi)$, where $q(\chi)$ is the conductor
of $\chi$. We then have the following criterion for triviality of the
specialisation, which gives a direct way of evaluating Brauer group elements
via Dirichlet characters.

######  Proposition 4.1.

Assume that $b$ is ramified at $O$ with associated Dirichlet character $\chi$.
Let $p\notin S$ and $Q\in\mathcal{E}^{\circ}({{\mathbb{Q}}}_{p})$ with
$v_{p}(Q)\geq 1$. Then $b(Q)=0\in\operatorname{Br}{{\mathbb{Q}}}_{p}$ if and
only if $\operatorname{ord}(\chi(p))\mid v_{p}(Q)$.

###### Proof.

We let $\mathcal{O}$ and $\mathcal{Q}$ be the closure of $O$ and $Q$ in
$\mathcal{E}_{p}:=\mathcal{E}\otimes{{\mathbb{Z}}}_{p}$, respectively. Note
that $\mathcal{O}$ is a smooth subscheme of $\mathcal{E}_{p}$, since the
partial derivative with respect to $z$ is non-zero at $O$ modulo $p$. As
$v_{p}(Q)\geq 1$, by definition $Q\in E_{1}({{\mathbb{Q}}}_{p})$, so
$\mathcal{Q}\equiv\mathcal{O}\bmod p$. Thus
$\mathcal{Q}\cap\mathcal{O}=v_{p}(Q)O_{p}$ as a divisor on $\mathcal{Q}$,
where $O_{p}=(0:1:0)\bmod p$.

We now apply [9, Thm. 3.7.5] with
$X=(\mathcal{E}^{\circ}\otimes{{\mathbb{Z}}}_{p})\cup\mathcal{O},Y=\mathcal{O}$
and $f:\mathcal{Q}\to X$ the natural inclusion. This gives that the residue
$\operatorname{\partial}_{O_{p}}(f^{*}b)\in{{\mathrm{H}}}^{1}(O_{p},{{\mathbb{Q}}}/{{\mathbb{Z}}})$
is equal to the image of
$v_{p}(Q)\cdot(\operatorname{\partial}_{\mathcal{O}}b)$ under the map

${{\mathrm{H}}}^{1}(\mathcal{O},{{\mathbb{Q}}}/{{\mathbb{Z}}})\to{{\mathrm{H}}}^{1}(O_{p},{{\mathbb{Q}}}/{{\mathbb{Z}}}).$

Let
$\psi\in\operatorname{Hom}(\pi_{1}(\operatorname{Spec}{{\mathbb{Z}}}_{p}),{{\mathbb{Q}}}/{{\mathbb{Z}}})$
be the homorphism corresponding to $\operatorname{\partial}_{\mathcal{O}}b$.
The local invariant $\operatorname{inv}_{p}(f^{*}b)$ is the evaluation of
$\operatorname{\partial}_{O_{p}}(f^{*}b)$ at the Frobenius element. We thus
obtain

$\operatorname{inv}_{p}(f^{*}b)=v_{p}(Q)\psi(\operatorname{Frob}_{p}).$

But the Dirichlet character $\chi$ is defined by
$\chi(p)=\psi(\operatorname{Frob}_{p})$ after using our choice of embedding
${{\mathbb{Q}}}/{{\mathbb{Z}}}\subset{{\mathbb{C}}}^{\times}$. This gives

$\operatorname{inv}_{p}(f^{*}b)=0\quad\iff\quad\chi(p)^{v_{p}(Q)}=1.\qed$

###  4.3. Proof of Theorem 1.6

We now prove our main result. We first note that by Remark 3.9, the period
$\pi$ is bounded in terms of $E$ and $q(\chi)$ only. So we focus on the main
bound in the theorem.

We claim that we may assume that $b$ is actually ramified at $O$, rather than
just some multiple $mP$ of $P$. Indeed, let $b$ be ramified at $mP$ and
consider $t_{-mP}^{*}b$ where $t_{-mP}$ denotes translation by $-mP$. Then
$t_{-mP}^{*}b$ is ramified at $O$. Assume we have proved the theorem in this
case. Then for $n\in{{\mathbb{Z}}}$ we have $t_{-mP}^{*}b(nP)=0$ if and only
if $b(nP+mP)=0$, so the two sets being counted differ by translation by $m$.
This changes the size of the set by at most $m$. In conclusion, we may assume
that $m=0$ and $b$ is ramified at $O$. We will do so until the last step of
the proof, when we will verify that an error term of size $m$ can be absorbed
into the constant $C_{E,P,b}$.

We now begin the proof in earnest. Choose a finite set of primes $S$ which
contains all primes dividing $\operatorname{ord}(\chi)q(\chi)$ and all primes
$p$ at which $E$ has bad reduction. Let

$\displaystyle\mathcal{P}$ $\displaystyle=\\{\text{primes }p\notin
S:\operatorname{ord}(P\bmod p)\text{ is prime and
}\operatorname{ord}(\chi(p))\nmid v_{p}(\operatorname{ord}(P\bmod p)P)\\},$
$\displaystyle\Lambda$ $\displaystyle=\\{\operatorname{ord}(P\bmod
p):p\in\mathcal{P}\\},$ $\displaystyle T$ $\displaystyle=\\{p\text{
prime}:v_{p}(P)>0\\}.$ (4.3)

For $p\in\mathcal{P}$, we denote by $\ell_{p}=\operatorname{ord}(P\bmod p)$.
To prove the result, we require the following, which comes from our analysis
of the elliptic divisibility sequence $\beta_{n}$ associated to $P$. We let
$\pi$ denote the period of the sequence $\beta_{n}\bmod q(\chi)$.

######  Lemma 4.2.

For any $\epsilon>0$ and $x\gg_{E,\chi}1$ we have

${\\#\\{\ell\in\Lambda:\ell\leq
x\\}}\geq\left(\frac{1}{2\varphi(\pi)}+O_{\epsilon,E}\left(\frac{\pi^{\epsilon}(\log\log\log
x)^{2}{\widehat{h}(P)}}{\log x}\right)^{1/4}\right)\frac{x}{\log
x}-\\#T-\\#S.$

One might assume that the $O_{E}(\,\cdot\,)$ term is the largest error term
here, but at the end of this section it will actually be $\\#T$ which
contributes the most to our final bound.

###### Proof.

Consider the multiples $\ell P$ where $\ell$ runs over all primes. Let $p$ be
such that $v_{p}(\ell P)>v_{p}(P)$. Then we claim that either $\ell\in T$, or
$\ell=\operatorname{ord}(P\bmod p)$. Indeed, as $v_{p}(\ell P)>0$ we have
$\ell P\equiv O\bmod p$. As $\ell$ is prime, we see that either
$\ell=\operatorname{ord}(P\bmod p)$ or $P\equiv O\bmod p$. In the latter case
we have $p\in T$. In that case we also have $P\in
E_{v_{p}(P)}(\mathbb{Q}_{p}),$ $P\notin E_{v_{p}(P)+1}(\mathbb{Q}_{p})$ and
$\ell P\in E_{v_{p}(P)+1}(\mathbb{Q}_{p})$, and hence
$\ell=|E_{v_{p}(P)}(\mathbb{Q}_{p})/E_{v_{p}(P)+1}(\mathbb{Q}_{p})|$ which is
then $=p$ by Lemma 2.4. Thus $\ell\in T$ as claimed.

Now Remark 3.9, Proposition 3.19, and our assumptions in Theorem 1.6 imply
that there is a set of at least

$\left(\frac{1}{2\varphi(\pi)}+O_{E,\epsilon}\left(\frac{\pi^{\epsilon}(\log\log\log
x)^{2}{\widehat{h}(P)}}{\log x}\right)^{1/4}\right)\frac{x}{\log x}$

primes $\ell\leq x$ such that there exists $p\nmid q(\chi)$ with
$\operatorname{ord}(\chi(p))\nmid v_{p}(\beta_{\ell})$. For such primes we
have $v_{p}(\beta_{\ell})>0$ and hence $v_{p}(\ell P)>v_{p}(P)$ by Lemma 3.4.
Excluding the finitely many primes $\ell\in T$, we have
$\ell=\operatorname{ord}(P\bmod p)$ by the previous paragraph. So by Lemma 3.4
again we have $v_{p}(\beta_{\ell})=v_{p}(\ell P)$. Similarly, as
$\ell=\operatorname{ord}(P\bmod p)$, we see that by excluding at most $\\#S$
of the primes $\ell$ we may assume that $p\notin S$. Such primes now lie in
$\Lambda$, hence give the result. ∎

We now sieve modulo such primes. Our approach is inspired by the version of
the elliptic sieve given in [14, §4.4] via the large sieve. From a
philosophical perspective, we sieve with respect to the maps

$E({{\mathbb{Q}}})\to E({{\mathbb{Z}}}/p^{2}{{\mathbb{Z}}}),\quad
p\in\mathcal{P}.$

This is literally true providing $v_{p}(\ell_{p}P)=1$, but in general we have
no control over the size of this valuation, only its value modulo
$\operatorname{ord}\chi$ (cf. Remark 3.20). What we actually do is remove
suitable multiples of $P$ where we can control the valuation. This is a key
difference with our approach and that taken in [14, §4.4], as Kowalski only
needed to sieve modulo $p$. The precise result is as follows.

######  Lemma 4.3.

There exists a finite subset $\mathcal{N}\subset{{\mathbb{Z}}}$, depending
only on $E$ and $b$, as follows. Let $p\in\mathcal{P}$ and
$n\in{{\mathbb{Z}}}\setminus\mathcal{N}$ with
$n\equiv\ell_{p},2\ell_{p},\ldots,(p-1)\ell_{p}\bmod p\ell_{p}$. Then
$b(nP)\neq 0\in\operatorname{Br}{{\mathbb{Q}}}_{p}$.

###### Proof.

As $\gcd(p,n/\ell_{p})=1$, applying Lemma 2.4 to $\ell_{p}P\in
E_{1}({{\mathbb{Q}}}_{p})$ gives

$v_{p}(nP)=v_{p}(\ell_{p}P)+v_{p}((n/\ell_{p}))=v_{p}(\ell_{p}P),$

which is not divisible by $\operatorname{ord}(\chi(p))$ by the definition of
$\mathcal{P}$. The result follows from Proposition 4.1 provided we exclude the
finitely many points in
$(\mathcal{E}\setminus\mathcal{E}^{\circ})({{\mathbb{Q}}})$. ∎

We now stipulate that the condition in Lemma 4.3 cannot hold at “moderately
sized” primes $\ell\in\Lambda$, to deduce that the quantity in Theorem 1.6 is
at most

$\\#\mathcal{N}\cup\big{\\{}|n|\leq B:(p\in\mathcal{P}\text{ and }\log
B\leq\ell_{p}\leq B)\Rightarrow(n\not\equiv 0\bmod\ell_{p}\text{ or }n\equiv
0\bmod p\ell_{p})\big{\\}},$

were $B$ is a parameter, assumed to be sufficiently large in terms of $E$ and
$\chi$. This is bounded above by $N_{0}(B)+N_{1}(B)$ where

$\displaystyle N_{0}(B)=$ $\displaystyle\\#\\{|n|\leq B:n\not\equiv
0\bmod\ell\text{ for all $\ell\in\Lambda$ with }\log B\leq\ell\leq B\\},$
$\displaystyle N_{1}(B)=$ $\displaystyle\\#\\{|n|\leq B:n\equiv 0\bmod
p\ell_{p},\text{ for some $p\in\mathcal{P}$ with }\log B\leq\ell_{p}\leq
B\\}.$

######  Lemma 4.4.

$N_{1}(B)\ll B/\log B$.

###### Proof.

We have

$\displaystyle N_{1}(B)\ll\sum_{\begin{subarray}{c}\log B\leq\ell_{p}\leq
B\end{subarray}}\\#\\{|n|\ll B:p\ell_{p}\mid
n\\}\ll\sum_{\begin{subarray}{c}\log B\leq\ell_{p}\leq
B\end{subarray}}\frac{B}{p\ell_{p}}.$

However, as $\ell_{p}$ is the order of $P$ modulo $p$, by the Hasse bounds we
have

$\ell_{p}\leq|E({{\mathbb{F}}}_{p})|\leq p+1+2\sqrt{p},$

in particular $1/p\ll 1/\ell_{p}$. Extending the sum over all integers $n$
then gives

$N_{1}(B)\ll B\sum_{\begin{subarray}{c}\log B\leq\ell\leq B\\\
\ell\in\Lambda\end{subarray}}\frac{1}{\ell^{2}}\ll B\sum_{n\geq\log
B}\frac{1}{n^{2}}\ll B/\log B.\qed$

We thus turn our attention to $N_{0}(B)$, which we deal with using the Selberg
sieve.

######  Lemma 4.5.

$N_{0}(B)\leq\exp(\\#S+\\#T+O_{E,\epsilon}(\pi^{\epsilon}\widehat{h}(P)^{1/4}))\frac{B\log\log
B}{(\log B)^{1/2\varphi(\pi)}}.$

###### Proof.

We use the version of the Selberg sieve stated in [20, Thm. 3.6]. This gives

$N_{0}(B)\ll B\prod_{\begin{subarray}{c}\log B\leq\ell\leq\sqrt{B}\\\
\ell\in\Lambda\end{subarray}}\left(1-\frac{1}{\ell}\right).$

However, by Mertens’ theorem we have

$\prod_{\begin{subarray}{c}\ell\leq\log B\\\
\ell\in\Lambda\end{subarray}}\left(1-\frac{1}{\ell}\right)^{-1}\ll\prod_{\begin{subarray}{c}\ell\leq\log
B\end{subarray}}\left(1-\frac{1}{\ell}\right)^{-1}\ll\log\log B.$

Thus it suffices to show that

$\prod_{\begin{subarray}{c}\ell\leq\sqrt{B}\\\
\ell\in\Lambda\end{subarray}}\left(1-\frac{1}{\ell}\right)\leq\frac{\exp(\\#S+\\#T+O_{E,\epsilon}(\pi^{\epsilon}\widehat{h}(P)^{1/4}))}{(\log
B)^{1/2\varphi(\pi)}}.$

To do so, we note that

$\displaystyle\log\prod_{\begin{subarray}{c}\ell\leq\sqrt{B}\\\
\ell\in\Lambda\end{subarray}}\left(1-\frac{1}{\ell}\right)^{-1}$
$\displaystyle=-\sum_{\begin{subarray}{c}\ell\leq\sqrt{B}\\\
\ell\in\Lambda\end{subarray}}\log\left(1-\frac{1}{\ell}\right)\geq\sum_{\begin{subarray}{c}\ell\leq\sqrt{B}\\\
\ell\in\Lambda\end{subarray}}\frac{1}{\ell}.$

By partial summation this is

$\sum_{\begin{subarray}{c}\ell\leq\sqrt{B}\\\
\ell\in\Lambda\end{subarray}}\frac{1}{\sqrt{B}}+\int_{1}^{\sqrt{B}}\sum_{\begin{subarray}{c}\ell\leq
u\\\ \ell\in\Lambda\end{subarray}}\frac{1}{u^{2}}\,\mathrm{d}u,$

and Lemma 4.2 shows that this is

$\geq(1/2\varphi(\pi))\log\log
B-\\#S-\\#T+O_{E,\epsilon}(\pi^{\epsilon}\widehat{h}(P)^{1/4}).$

Exponentiating and taking reciprocals gives the claim, and hence the result. ∎

Combining these lemmas, and the fact that $\pi=O_{E,\chi}(1)$ as observed at
the start of Section 4.3, completes the proof of the bound in Theorem 1.6 with

$C_{E,P,b}=\exp(\\#T+O_{E,b}(\widehat{h}(P)^{1/4})),$ (4.4)

where $T$ is as in (4.3). At the start of the proof we assumed that $m=0$, at
the cost of an additive factor of size at most $m=O_{b}(1)$. This can be
absorbed into the implicit constant in (4.4), and completes the proof.∎

In order to get the last bound in Theorem 1.7, which depends explicitly on
$P$, we require the following supplement to Theorem 1.6.

######  Lemma 4.6.

Under the assumptions of Theorem 1.6, the constant from (4.4) satisfies

$C_{E,P,b}=\exp\left(O_{E,b}\left(\frac{\widehat{h}(P)}{\log\widehat{h}(P)}\right)\right).$

###### Proof.

By (4.4) it suffices to show that

$\\#T\ll_{E}\frac{\widehat{h}(P)}{\log\widehat{h}(P)}.$

We have $\\#T=\omega(\prod_{v_{p}(P)>0}p)=\omega(e_{1})$ where $e_{1}$ is as
in Definition 3.1 and we write $\omega(k)$ for the number of distinct prime
factors of $k$.

From Definition 3.1 we have $e_{1}\leq\sqrt{H(x(P))}$ where $H$ is the naive
height on $\mathbb{P}^{1}$. Now $\widehat{h}(P)=O_{E}(1)+\frac{1}{2}\log
H(x(P))$ by [26, Thm. VIII.9.3(e)]. So $\log e_{1}\leq
O_{E}(1)+\widehat{h}(P)$, and since $\\#T=\omega(e_{1})\ll\frac{\log
e_{1}}{\log\log e_{1}}$ and $\widehat{h}(P)\gg_{E}1$, by say [26, Thm.
VIII.9.10(a)], this completes the proof. ∎

##  5\. Examples and applications

In this section we give various examples and applications of Theorem 1.6,
including the proofs of the results from the introduction and a generalisation
of Example 1.3.

###  5.1. A worked example

Let

$E:\quad y^{2}+y=x^{3}-x.$ (5.1)

This curve has conductor $37$. Its Mordell-Weil group is ${{\mathbb{Z}}}$ with
generator $P=(0,0)$, which has everywhere good reduction. In particular $M=1$,
and Ward’s definition (EDSA) agrees with Verzobio’s definition (EDSB). The
elliptic divisibility sequence associated to $P$ starting at $\beta_{0}$ reads

$0,1,1,−1,1,2,−1,−3,−5,7,−4,−23,29,59,129,−314,−65,1529,−3689,\dots.$

However $P\notin E({{\mathbb{R}}})^{0}$ so Theorem 1.1 does not apply. Still,
we are able to show using Theorem 1.6 that the conclusion of Theorem 1.1
holds.

We apply Theorem 1.6 to the quaternion algebra $(-1,y)$. The associated
Dirichlet character is then just the non-principal Dirichlet character $\chi$
modulo $4$. Modulo $4$, the EDS starting at $\beta_{0}$ becomes

$0,1,1,3,1,2,3,1,3,3,0,1,1,3,1,2,3,1,3,3,0,\ldots$

which is periodic with period $\pi=10$. One now searches the sequence for
terms $\beta_{\alpha}$ with $\gcd(\alpha,10)=1$ and
$\chi(|\beta_{\alpha}|)=-1$; one finds that $\beta_{7}=-3$ suffices. Thus
Theorem 1.6 shows that

$\\#\\{n\in{{\mathbb{Z}}}\colon|n|\leq B,y(nP)\text{ is a sum of two
squares}\\}\ll_{\epsilon}B/(\log B)^{1/10-\epsilon}$

using $1/2\varphi(10)=1/10$. Alternatively, since $4\nmid\pi$, we also obtain
the result using simply $\beta_{1}=1$ and the fact that
$\chi(-|\beta_{1}|)=1$.

######  Remark 5.1.

The keen reader may notice that we did not fully justify our calculation that
the period equals $10$. Thankfully, this is not necessary. Namely, Lemma 3.8
shows that the period divides

$2\cdot(2-1)\cdot 2^{2}\cdot\operatorname{ord}(P\bmod 2)=2^{3}\cdot 5,$

whence $\gcd(\pi,7)=1$. (Note that our bound is correct up to powers of $2$
here.)

We take an example concerning higher order Dirichlet characters. Consider
again (5.1) and let $\chi$ be a Dirichlet character modulo $7$ of order $3$.
One finds that $\chi(|\beta_{5}|)=\chi(2)$ is non-trivial and that
$|E({{\mathbb{F}}}_{7})|=9$. But
$\gcd(5,2\cdot(7-1)|E({{\mathbb{F}}}_{7})|)=1$. Thus by Lemma 3.8 we may apply
Theorem 1.6, without even having to calculate the period directly (in fact one
finds that the period is $54=(7-1)|E({{\mathbb{F}}}_{7})|$, so our criterion
is again best possible up to powers of $2$). The corresponding cyclic
extension $K/{{\mathbb{Q}}}$ has polynomial $x^{3}-x^{2}-2x+1$; note that this
is totally real unlike the hypotheses in Theorem 1.2. We now apply Theorem 1.6
to the cyclic algebra $b=(\chi,x)\in\operatorname{Br}{{\mathbb{Q}}}(E)$, which
is easily checked to ramify at $O$ with Dirichlet character $\chi^{-2}=\chi$
(since $\operatorname{ord}_{O}(x)=-2$). We deduce that

$\\#\\{n\in{{\mathbb{Z}}}\colon|n|\leq B,x(nP)\text{ is a norm from }K\\}\ll
B/(\log B)^{\omega}$

for some $\omega>0$.

As we have seen, this $E$ does indeed satisfy the conclusion of Theorem 1.1.
We have counter-examples to similar looking statements (Example 1.3), but it
does not seem to be possible to bootstrap these to get counter-examples
involving the $y$-coordinate. In particular, we do not know the answer to the
following question without imposing additional assumptions on $E$ or the
associated EDSB.

######  Question 5.2.

Let $E$ be an elliptic curve over ${{\mathbb{Q}}}$ given by an integral
Weierstrass equation. Let $P\in E({{\mathbb{Q}}})$ have infinite order. Then
is

$\\#\\{n\in{{\mathbb{Z}}}\colon|n|\leq B,y(nP)\text{ is a sum of two
squares}\\}=o(B)?$

###  5.2. Proof of Theorem 1.2

We translate a statement about conic bundles into a statement about quaternion
algebras. We work over the local ring $R$ at $Q:=mP$. Restricting the conic
bundle to $\operatorname{Spec}R$ we obtain a conic over $R$. It is a classical
fact that any conic over $R$ can be diagonalised [13, Cor. I.3.4], so we may
write the equation for our conic bundle near $Q$ as

$sx^{2}+ty^{2}=z^{2},\quad\text{ where }s,t\in R.$

However, as we assumed that $X$ is non-singular it is checked that the
valuation of $st$ is at most $1$. Thus we may assume without loss of
generality that $t$ is a uniformiser in $R$ and that $s$ is a unit in $R$. Let
$D$ be the image of $s$ in $R/(t)={{\mathbb{Q}}}$. Since the fibre over $Q$
was assumed to be non-split with imaginary quadratic splitting field, it
follows that $D$ is negative. Moreover, up to a suitable change of variables,
we may assume that $D$ is a fundamental discriminant.

We now consider the quaternion algebra $b=(s,t)$ over ${{\mathbb{Q}}}(E)$,
which gives rise to a $2$-torsion element of
$\operatorname{Br}{{\mathbb{Q}}}(E)$. The residue of $b$ at $Q$ is
$D\in{{\mathbb{Q}}}^{\times}/{{\mathbb{Q}}}^{\times 2}$, since $t$ is a
uniformiser at $Q$ and $s$ is a unit. It follows that the associated Dirichlet
character is the Kronecker symbol
$\chi_{D}(\cdot)=\left(\frac{D}{\cdot}\right)$. As $D$ is negative we have
$\chi_{D}(-1)=-1$, in particular $\chi_{D}(-|\beta_{1}|)=-1$. As $P\in
E({{\mathbb{R}}})^{0}$, it now follows from Theorem 1.6 that

$\\#\\{|n|\leq B:b(nP)=0\in\operatorname{Br}{{\mathbb{Q}}}\\}\ll B/(\log
B)^{\omega}$

for some $\omega>0$. However, it is clear by construction that for all but
finitely many $R\in E({{\mathbb{Q}}})$, we have
$b(R)=0\in\operatorname{Br}{{\mathbb{Q}}}$ if and only if $\pi^{-1}(R)$ has a
rational point, and the result follows. ∎

###  5.3. Proof of Theorem 1.7

Let $L\subset K$ be a cyclic non-totally real subfield. If $y$ is a norm from
$K$, then it is certainly a norm from $L$. Thus it suffices to prove the
result when $K$ itself is a cyclic non-totally real extension of
${{\mathbb{Q}}}$. Let $\chi$ be a Dirichlet character corresponding to $K$ via
the Kronecker–Weber Theorem, and consider the cyclic algebra $b=(y,\chi)$. For
$Q\in E({{\mathbb{Q}}})$ with $y(Q)\neq 0$, we have $b(Q)=0$ if and only if
$y(Q)$ is a norm from $K$. The rational function $y$ has a pole of order $3$
at $O$, so it follows that the residue of $b$ at $O$ has Dirichlet character
$\chi^{-3}$. However $\chi$ is odd as $K$ has a complex embedding, so
$\chi^{-3}$ is also odd. As $\chi(-|\beta_{1}|)=-1$ and $P\in
E({{\mathbb{R}}})^{0}$, the main bound in the result thus follows from Theorem
1.6 with $m=0$. The final estimate for the implicit constant follows from
Lemma 4.6. ∎

###  5.4. Proof of Theorem 1.1

Follows from Theorem 1.7 for $K={{\mathbb{Q}}}(i)$. ∎

###  5.5. $x$–coordinate as sum of two squares

As the example (1.2) shows, there are elliptic curves such that $x(Q)$ is a
sum of two squares for every $Q\in E({{\mathbb{Q}}})$. We are able to obtain
upper bounds for this counting problem providing one imposes additional
assumptions on $E$ and $P$.

######  Theorem 5.3.

Let $E$ be an elliptic curve over ${{\mathbb{Q}}}$ given by an integral
Weierstrass equation. Let $P\in E({{\mathbb{Q}}})$ have infinite order with
$P\in E({{\mathbb{R}}})^{0}$. Assume that $x(mP)=0$ for some non-zero
$m\in{{\mathbb{Z}}}$. Then there exists $\omega=\omega(E,P)>0$ such that

$\\#\\{|n|\leq B\colon x(nP)\text{ is a sum of two squares}\\}\ll B/(\log
B)^{\omega}.$

###### Proof.

The relevant conic bundle is given by

$x_{1}^{2}+x_{2}^{2}=xx_{0}^{2}\quad\subset{{\mathbb{P}}}^{2}\times E.$

The fibre over $mP$ is non-split since $x(mP)=0$. Thus the result follows from
Theorem 1.2. ∎

This result applies for example to elliptic curves of the form

$y^{2}=x^{3}+ax^{2}+bx+c$

where $c$ is a square and one takes $P=(0,\sqrt{c})$, providing $P$ has
infinite order and lies in $E({{\mathbb{R}}})^{0}$.

###  5.6. Proof of Theorem 1.5

Let $G=E({{\mathbb{Q}}})^{\operatorname{tors}}\cap E({{\mathbb{R}}})^{0}$. For
the rest of this proof, let $S$ be the set of primes dividing $\\#G$. Choose
$P_{0}\in E({{\mathbb{Q}}})$, depending only on $E$, such that
$E({{\mathbb{Q}}})\cap E({{\mathbb{R}}})^{0}=\langle P_{0}\rangle\oplus G$
where $G$ is finite. Then

$\\{Q\in E({{\mathbb{Q}}})\cap E({{\mathbb{R}}})^{0}:\widehat{h}(Q)\leq
H\\}=\bigcup_{\begin{subarray}{c}k\in{{\mathbb{N}}},\,k\ll H^{1/2}\\\ p\mid
k\implies p\in S\end{subarray}}\\{Q\in\langle
kP_{0}+G\rangle:\widehat{h}(Q)\leq H\\}.$ (5.2)

Note that we can discard the case $\\#G=1$, since there the result follows
from Theorem 1.1. Then by Mazur’s theorem $\\#S=1$ or 2.

We now count points $Q\in E({{\mathbb{Q}}})\cap E({{\mathbb{R}}})^{0}$ such
that $y(Q)$ is a sum of two squares. To do this, we break the union in (5.2)
up into two parts according to the size of $k$. First, for small $k$ we will
apply Theorem 1.7, and then for large $k$ we will use a trivial bound.

The case $K={{\mathbb{Q}}}(i)$ of Theorem 1.7 implies that for each $P\in
E({{\mathbb{Q}}})\cap E({{\mathbb{R}}})^{0}$ of infinite order, we have

$\\#\left\\{Q\in\langle P\rangle:\begin{array}[]{l}\widehat{h}(Q)\leq
H,y(Q)\text{ is a }\\\ \text{sum of two
squares}\end{array}\right\\}\leq\exp\left(O_{E}\left(\frac{\widehat{h}(P)}{\log\widehat{h}(P)}\right)\right)\frac{H^{1/2}}{(\log
H)^{\omega}},$

for some $\omega>0$ which depends only on $E$. Let $\kappa$ be a positive
integer to be chosen later. By [26, Prop. VIII.9.6] we have
$\widehat{h}(kP_{0}+R)=C_{E,P_{0}}k^{2}$ for all torsion points $R$ and some
constant $C_{E,P_{0}}$ depending only on $E$ and $P_{0}$. Since $P_{0}$
depends only on $E$, it follows from the last display that

$\displaystyle\begin{split}\sum_{{k\in{{\mathbb{N}}},\,k\leq\kappa}}\\#\left\\{Q\in\langle
kP_{0}+G\rangle:\begin{array}[]{l}\widehat{h}(Q)\leq H,y(Q)\text{ is a }\\\
\text{sum of two squares}\end{array}\right\\}\\\
\leq\exp\left(O_{E}\left(\frac{\kappa^{2}}{\log\kappa}\right)\right)\frac{H^{1/2}}{(\log
H)^{\omega}}.\end{split}$ (5.3)

To handle large $k$ we claim that

$\sum_{\begin{subarray}{c}k\in{{\mathbb{N}}}\\\ \kappa<k\ll H^{1/2}\\\ p\mid
k\implies p\in S\end{subarray}}\\#\\{Q\in\langle
kP_{0}+G\rangle:\widehat{h}(Q)\leq
H\\}\ll_{E}\frac{H^{1/2}(\log\kappa)^{\\#S-1}}{\kappa}.$ (5.4)

We will prove this in the case $\\#S=2$, leaving the similar and slightly
simpler case $\\#S=1$ to the reader. Recalling that
$\widehat{h}(kP_{0}+R)=C_{E,P_{0}}k^{2}$ for all $R\in G$, we have

$\\#\\{Q\in\langle kP_{0}+G\rangle:\widehat{h}(Q)\leq
H\\}\ll_{E}H^{1/2}k^{-1}$

and so

$\displaystyle\sum_{\begin{subarray}{c}k\in{{\mathbb{N}}}\\\ \kappa<k\ll
H^{1/2}\\\ p\mid k\implies p\in S\end{subarray}}\\#\\{Q\in\langle
kP_{0}+G\rangle:\widehat{h}(Q)\leq H\\}$
$\displaystyle\ll_{E}\sum_{\begin{subarray}{c}a,b\in{{\mathbb{N}}}\cup\\{0\\},\\\
\kappa<p_{1}^{a}p_{2}^{b}\ll
H^{1/2}\end{subarray}}H^{1/2}p_{1}^{-a}p_{2}^{-b}$ $\displaystyle\leq
H^{1/2}\sum_{\begin{subarray}{c}j\in{{\mathbb{N}}}\\\ \kappa\leq 2^{j}\ll
H^{1/2}\end{subarray}}\sum_{\begin{subarray}{c}a,b\in{{\mathbb{N}}}\cup\\{0\\},\\\
2^{j-1}<p_{1}^{a}p_{2}^{b}\leq 2^{j}\end{subarray}}\frac{1}{2^{j-1}},$

and since there are at most $j$ pairs $(a,b)$ appearing in the final sum, this
is at most $H^{1/2}\sum_{{2^{j}\geq\kappa}}{j}/{2^{j-1}}$, which is
$O({H^{1/2}\log\kappa/\kappa})$ as required for (5.4).

Combining (5.4) with (5.2) and (5.3) gives

$\\#\left\\{Q\in E({{\mathbb{Q}}})\cap
E({{\mathbb{R}}})^{0}:\begin{array}[]{l}\widehat{h}(Q)\leq H,y(Q)\text{ is a
}\\\ \text{sum of two squares}\end{array}\right\\}\\\
\ll_{E}\frac{H^{1/2}(\log\kappa)^{\\#S-1}}{\kappa}+\exp\left(O_{E}\left(\frac{\kappa^{2}}{\log\kappa}\right)\right)\frac{H^{1/2}}{(\log
H)^{\omega}}.$

We choose $\kappa=(\epsilon_{E,K}\log\log H\log\log\log H)^{1/2}$ for some
small $\epsilon_{E,K}>0$, so that
$\frac{\kappa^{2}}{\log\kappa}\ll\epsilon_{E,K}\log\log H$, and we then obtain
the claimed result in the form

$\\#\left\\{Q\in E({{\mathbb{Q}}})\cap
E({{\mathbb{R}}})^{0}:\begin{array}[]{l}\widehat{h}(Q)\leq H,y(Q)\text{ is a
}\\\ \text{sum of two
squares}\end{array}\right\\}\ll_{E}\frac{H^{1/2}(\log\log\log
H)^{\\#S-3/2}}{(\log\log H)^{1/2}}.$

###  5.7. Unramified elements

Our results contain various technical assumptions. In the next two sections we
demonstrate that these are necessary in general. Firstly we show that for the
conclusion of Theorem 1.6, we need to impose ramification on the Brauer group
elements. (See (4.1) for the notation $E(k)_{b}$.)

######  Lemma 5.4.

Let $E$ be an elliptic curve over a number field $k$. Let
$b\in\operatorname{Br}E$ with $E(k)_{b}\neq\emptyset$. Then $E(k)_{b}$
contains a translate of a subgroup of finite index. In particular $E(k)_{b}$
has positive density in $E(k)$.

###### Proof.

By performing a translation, we may assume that $O\in E(k)_{b}$. As $b$ is
unramified, there exists a finite set of places $S$ such that
$E(k_{v})_{b}=E(k_{v})$ for every $v\notin S$ [9, Prop. 13.3.1(iii)].
Moreover, for any place $v$ by _loc. cit._ the evaluation map

$b:E(k_{v})\to\operatorname{Br}k_{v}$

is locally constant. In particular, there exists an open neighbourhood $O\in
U_{v}$ such that $U_{v}\subset E(k_{v})_{b}$. But $E(k_{v})$ is profinite, so
such an open neighbourhood may be refined to an open subgroup $U_{v}$ of
$E(k_{v})$, which neccessarily has finite index as $E(k_{v})$ is compact. So
set $A=E(k)\cap_{v\in S}U_{v}$. By construction, this is a subgroup of $E(k)$
of finite index. Moreover, for all $P\in A$ and all places $v$ we have
$b(P)=0\in\operatorname{Br}k_{v}$. It now follows from the Hasse principle for
$\operatorname{Br}k$ (4.2) that $A\subset E(k)_{b}$, as required. ∎

Let

$b\in\Be(E)=\ker(\operatorname{Br}E\to\prod_{v}\operatorname{Br}E_{k_{v}})$

where the product is over all places $v$ of $k$. It follows easily from (4.2)
that $b(P)=0\in\operatorname{Br}k$ for all $P\in E(k)$, so here
$E(k)_{b}=E(k)$ even if $b\neq 0$. Such elements exactly correspond to the
elements of $\Sha(E)$, providing it is finite (see [28, Thm. 6.2.3]).

For completeness, we give such an explicit example in the form of a conic
bundle. Our example is based on a variant of the well-known counter-example to
the Hasse principle $2y^{2}=x^{4}-17$ due to Reichardt and Lind.

######  Proposition 5.5.

Let $N$ be only divisible by primes which are $1\bmod 8$ and consider the
elliptic curve

$E:\quad y^{2}=x(x^{2}+N).$

Let $X$ be a smooth proper model for the the conic bundle over $E$ given by

$t_{0}^{2}-2t_{1}=xt_{2}^{2}.$

  1. (1)

The map $X({{\mathbb{Q}}})\to E({{\mathbb{Q}}})$ is surjective.

  2. (2)

For $N=17\times 593$, $E$ has positive rank and the conic bundle morphism
admits no section.

###### Proof.

(1) We use the equation for the curve $y^{2}=xz(x^{2}+Nz^{2})$ in weighted
projective space. The conic bundle $X$ then has the equations

$t_{0}^{2}-2t_{1}^{2}=xzt_{2}^{2},\quad\text{if }xz\neq 0$ (5.5)

and

$t_{0}^{2}-2t_{1}^{2}=(x^{2}+Nz^{2})t_{2}^{2},\quad\text{if }x^{2}+Nz^{2}\neq
0.$ (5.6)

We now verify that $X({{\mathbb{Q}}}_{v})\to E({{\mathbb{Q}}}_{v})$ is
surjective for all places $v$ of ${{\mathbb{Q}}}$. First note that
$X({{\mathbb{Q}}}_{v})\to E({{\mathbb{Q}}}_{v})$ is closed with respect to the
$v$-adic topology. So it just suffices to show that there is
${{\mathbb{Q}}}_{v}$-point over each fibre with $xz(x^{2}+Nz^{2})\neq 0$.

For $v=\infty$, there is clearly the real point $(\sqrt{2}:1:0)$ in (5.5).
This also gives a solution for any $p\equiv 1\bmod 8$, in particular for all
$p\mid N$. So let $p\nmid 2N$. Here we may choose a representative so that $p$
doesn’t simultaneously divide $x$ and $z$. If $v_{p}(x^{2}+Nz^{2})$ is even,
then from the equation of $E$ we find that $v_{p}(xz)$ is even, whence (5.5)
has a solution by a Hilbert symbol calculation. If $v_{p}(x^{2}+Nz^{2})$ is
odd, our assumptions imply that $v_{p}(xz)=0$ so again a Hilbert symbol
calculation shows that (5.5) has a solution.

Finally, for $p=2$, here $N\equiv 1\bmod 8$ is a square in
${{\mathbb{Q}}}_{2}^{\times}$, so making a change of variables we may assume
that $N=1$. Again from the equation of the curve, we may assume that $2$
doesn’t simultaneously divide $x$ and $z$. First suppose that $2\nmid xz$.
Then from the equation $v_{2}(x^{2}+z^{2})$ is even, which is a contradiction
as $x^{2}+z^{2}\equiv 2\bmod 8$. So assume without loss of generality that
$2\mid x$. Then $z,x^{2}+z^{2}$ are both odd, hence from the equation
$v_{2}(x)$ is even. Then $x^{2}+z^{2}\equiv 1\bmod 8$, in which case (5.6) has
a solution in ${{\mathbb{Q}}}_{2}$. So every fibre is everywhere locally
soluble, hence has a rational point. This proves (1).

(2) Here Sage verifies that $E$ has torsion subgroup isomorphic to
${{\mathbb{Z}}}/2{{\mathbb{Z}}}$. But it has the point $(1088:36040:1)$, which
must have infinite order (in fact Sage verifies by $2$-descent that
$\operatorname{rank}E({{\mathbb{Q}}})=2$). The conic bundle corresponds which
by (1) and (4.2) can only happen if $b$ is trivial. But, by the general theory
of $2$-descent for elliptic curves, the element $b$ corresponds to a
$2$-covering of $E$; this $2$-covering has the equation

$C_{2}:2w^{2}=2^{2}-4Nz^{4}$

(cf. [26, Ex. X.4.8]), which after a change of variables gives
$C_{2}:2w^{2}=z^{4}-N$. However this curve fails the Hasse principle; for
$N=17$ this is the well-known example of Reichardt and Lind, whereas in our
case $N=17\times 593$ this follows from a similar argument to Case I of the
proof of [26, Prop. X.6.5]. (The key point is that $2$ is not a quartic
residue modulo $17$, see [21, §1]). It thus follows that this $2$-covering is
non-trivial, so $b$ is non-trivial, as required. ∎

###  5.8. Ramified examples

Lemma 5.4 shows that to get any hope of obtaining a version of Theorem 1.6
there needs to be ramification. Still this assumption is not sufficient in
general, as was first shown for conic bundles in [7, §3]. In this section, we
build on this example and generalize the construction to higher order Brauer
group elements. We work over a number field $k$.

######  Definition 5.6.

Let $P\in E(k)$ and $n\in{{\mathbb{N}}}$. We denote by $E_{P}[n]$ the scheme
of points $Q\in E$ with $nQ=P$. This is a $E[n]=E_{O}[n]$ torsor.

######  Proposition 5.7.

Let $\ell$ be a prime, $E$ an elliptic curve over $k$, and $P\in E(k)$ a
primitive point of infinite order. Let $b\in\operatorname{Br}k(E)$ be ramified
with ramification locus in ${{\mathbb{Z}}}P\setminus\ell{{\mathbb{Z}}}P$,
whose residues have the same cyclic extension $K/k$. Assume that $K$ is a
subfield of the field of fractions of every irreducible component of
$E_{P}[\ell]$.

If $O\in E(k)_{b}$ then $E(k)_{b}$ contains a subgroup of finite index. In
particular $E(k)_{b}$ has positive density in $E(k)$.

###### Proof.

Choose a finite set of places $S$ containing the archimedean places, the
places ramified in $K$, and the places where $E_{P}[\ell]$ is not finite
étale.

If $v$ is completely split in $K$, then $b\otimes k_{v}$ is unramified, hence
$E(k_{v})_{b}=E(k_{v})$ providing $S$ is sufficiently large [16, Prop. 7.1].
So assume that $v$ is not completely split in $K$. We claim that

$\ell E(k)\subset E(k_{v})_{b}.$ (5.7)

To see this, assume instead that $\ell R\notin E(k_{v})_{b}$ for some $R\in
E(k)$. Then providing $S$ is sufficiently large, by [16, Prop. 7.1] we must
have $\ell R\equiv Q\bmod v$ where $Q\in E(k)$ is a ramification point of $b$.
Since $Q\in{{\mathbb{Z}}}P\setminus\ell{{\mathbb{Z}}}P$ by assumption, we
deduce that $\ell R\equiv qP\bmod v$ for some $q\in{{\mathbb{Z}}}$ with
$\ell\nmid q$. So $qP\bmod v$ is $\ell$-divisible. But $\ell\nmid q$, hence
$P\bmod v$ is also $\ell$-divisible. But as $E_{P}[\ell]$ is finite étale over
$v$, Hensel’s Lemma shows that $E_{P}[\ell](k_{v})\neq\emptyset$. However now
$K$ is a subfield of the field of fractions of every irreducible component of
$E_{P}[\ell]$, so we deduce that $K$ admits a place of degree $1$ over $v$.
This contradicts that $v$ is not completely split in $K$ and shows (5.7).

We have shown that $\ell E(k)\subset E(k_{v})_{b}$ for all $v\notin S$. For
the places in $S$ we proceed as in the proof of Lemma 5.4, using the fact that
$O\in E(k)_{b}$ to deduce that $E(k_{v})_{b}$ contains a subgroup of finite
index for all $v$. The result then follows from the fact that the intersection
of finitely many finite index subgroups has finite index. ∎

We now explain how to construct such explicit examples. Let $\ell$ be a prime
and $E/k$ an elliptic curve with primitive point $P$ of infinite order.
Consider the natural map $f:E\to{{\mathbb{P}}}^{1}$ given by projecting to the
$x$-coordinate. Let $K/k$ be a non-trivial cyclic extension. By the Faddeev
exact sequence [9, Thm. 1.5.2], there exists
$a\in\operatorname{Br}k({{\mathbb{P}}}^{1})$ whose ramification consists of
any given collection of $2$ distinct rational points and whose residue at
these points is $K/k$.

We therefore choose distinct non-Weierstrass points
$P_{1},P_{2}\in(\ell{{\mathbb{Z}}}+1)P$ and choose $a$ ramified at
$f(P_{1}),f(P_{2})$. We then define $b^{\prime}=f^{*}a$. This is ramified at
the points $\pm P_{i}$ with residues in $K/k$. However we may have
$E(k)_{b^{\prime}}=\emptyset$. So we set $b=b^{\prime}-b^{\prime}(O)$, which
now satisfies $O\in E(k)_{b}$.

It remains to arrange that $K$ is a subfield of the field of fractions of
every irreducible component of $E_{P}[\ell]$, for which we need to impose
further conditions on $E$ and $K$. We assume $E$ has full $\ell$-torsion,
which implies that $k$ contains all $\ell$th roots of unity. As $E_{P}[\ell]$
is an $E[\ell]$-torsor, we find that it corresponds to some element of

$\operatorname{H}^{1}(k,E[\ell])=\operatorname{H}^{1}(k,\mu_{\ell}^{2})=k^{\times}/k^{\times\ell}\times
k^{\times}/k^{\times\ell},$

where the last isomorphism is by Kummer theory. A pair $(\alpha,\beta)\in
k^{\times}/k^{\times\ell}\times k^{\times}/k^{\times\ell}$ corresponds to the
$\mu_{\ell}^{2}$-torsor given by

$x^{\ell}=\alpha,\quad y^{\ell}=\beta\qquad\subset\mathbb{A}^{2}_{k}.$ (5.8)

Now, the torsor $E_{P}[\ell]$ is non-trivial as $P$ is not $\ell$-divisible,
so without loss of generality $\alpha$ is not an $\ell$th power in the
notation of (5.8). But then the function fields of the irreducible component
of the scheme (5.8) are either $k(\sqrt[\ell]{\alpha})$ or
$k(\sqrt[\ell]{\alpha},\sqrt[\ell]{\beta})$. These contain the field
$K=k(\sqrt[\ell]{\alpha})$ which is non-trivial and cyclic of degree $\ell$.

Writing down explicit curves and Brauer group elements which satisfy
Proposition 5.7 is now relatively easy using explicit ramified cyclic algebras
on ${{\mathbb{P}}}^{1}$. This is how we found Example 1.3.

##  6\. Applicability

In this final section we verify that Condition (1) in Theorem 1.6 holds for
almost all Dirichlet characters, under suitable assumptions. Before restating
the condition, we recall our setup along with the notation: Fix an elliptic
curve $E$ over ${{\mathbb{Q}}}$ with $P\in E({{\mathbb{Q}}})$ a point of
infinite order with $\beta_{n}$ the associated EDSB. Let $\chi$ be a Dirichlet
character with modulus $q(\chi)$, and $\pi(\chi)$ be the period of the
sequence $\beta_{n}\bmod q(\chi)$.

Let us recall the technical condition.

$\textnormal{There exists }\alpha\in{{\mathbb{Z}}}\textnormal{ relatively
prime to }\pi(\chi)\textnormal{ such that
}\chi(|\beta_{\alpha}|)\notin\\{0,1\\}.$ (6.1)

We expect this to hold for all but finitely many Dirichlet characters, but it
seems completely out of reach to prove this at present. Since this section is
purely illustrative, we make numerous assumptions to simplify the statements
and the proof.

We assume $E$ does not have complex multiplication and that $P=(x,y)$ has
integer coordinates with everywhere good reduction. (This is satisfied by the
pair $(E,P)$ from §5.1, for example.) Under these assumptions, we have

$\beta_{n}=\psi_{n}(P),\ |\beta_{n}|=|e_{n}|.$

For odd Dirichlet characters some of our other conditions are more likely to
apply, so for simplicity we consider only even Dirichlet characters, which we
also assume to have prime modulus:

$\Sigma(D)=\\{\text{Dirichlet characters }\chi:\chi(-1)=1,q(\chi)\text{ is
prime},q(\chi)\leq D\\}.$

######  Theorem 6.1.

$\lim_{D\to\infty}\frac{\\#\\{\chi\in\Sigma(D):\chi\text{ satisfies
}\eqref{eqn:*2}\\}}{\\#\Sigma(D)}=1,$

i.e. $100\%$ of Dirichlet characters in $\Sigma(D)$ satisfy (6.1) as $D$ tends
to infinity.

###### Proof.

As we only consider even characters we have
$\chi(|\beta_{\alpha}|)=\chi(\beta_{\alpha})$. If an $\alpha$ satisfying (6.1)
exists, then considering the arithmetic progression $\alpha\bmod\pi(\chi)$
shows that there exists such an $\alpha$ with $\alpha$ prime. So let $\Omega$
be the set of all primes $\ell>3$ with $|\beta_{\ell}|\neq 1$ (there are
easily seen to be only finitely many such primes by Seigel’s theorem on
integral points on elliptic curves). For any subset $R\subseteq\Omega$, define
the sets

$\displaystyle\Phi(D,R)$
$\displaystyle\coloneqq\left\\{\chi\in\Sigma(D):\forall\ell\in R\textnormal{
either }\chi(\beta_{\ell})\in\\{0,1\\}\textnormal{ or
}\ell\mid\pi(\chi)\right\\},$ $\displaystyle\Phi^{\prime}(D,R)$
$\displaystyle\coloneqq\left\\{\chi\in\Sigma(D):\forall\ell\in R\textnormal{
either }\chi(\beta_{\ell})\in\\{0,\pm 1\\}\textnormal{ or
}\ell\mid\operatorname{ord}(P\bmod q(\chi))\right\\},$
$\displaystyle\Phi^{\prime\prime}(D,R)$
$\displaystyle\coloneqq\left\\{\chi\in\Sigma(D):\forall\ell\in R\textnormal{
either }\chi(\beta_{\ell})\in\\{\pm 1\\}\textnormal{ or
}\ell\mid\operatorname{ord}(P\bmod q(\chi))\right\\}.$

Note that $\Phi(D,\Omega)$ contains all characters in $\Sigma(D)$ that fail
(6.1). It suffices to show

$\lim_{D\to\infty}\frac{\\#\Phi(D,\Omega)}{\\#\Sigma(D)}=0.$ (6.2)

######  Lemma 6.2.

$\Phi(D,\Omega)\subseteq\Phi^{\prime}(D,\Omega)=\Phi^{\prime\prime}(D,\Omega)$.

###### Proof.

We first prove $\Phi(D,\Omega)\subseteq\Phi^{\prime}(D,\Omega)$. Suppose
$\chi\in\Phi(D,\Omega)$ but $\chi\notin\Phi^{\prime}(D,\Omega)$. Let
$q=q(\chi)$ be the modulus of $\chi$. Then there exists a prime $\ell$ such
that $\chi(\beta_{\ell})\neq 0,\pm 1$ and $\ell\nmid\operatorname{ord}(P\bmod
q)$, but $\ell\mid\pi(\chi)$. Let $\rho=\pi(\chi)/\ell^{v_{\ell}(\pi(\chi))}$.
Note that $\operatorname{ord}(P\bmod q)\mid\rho$ and so $q\mid\beta_{\rho}$.
For any integer $k$, we have the following implications,

$q\mid\beta_{\ell+k\rho}\implies\operatorname{ord}(P\bmod
q)\mid\ell+k\rho\implies\operatorname{ord}(P\bmod
q)\mid\ell\implies\operatorname{ord}(P\bmod q)=\ell.$

However, since $\ell\nmid\operatorname{ord}(P\bmod q)$ it follows
$\chi(\beta_{\ell+k\rho})\neq 0$ for any $k\in{{\mathbb{Z}}}$. Note that
$\gcd(\pi(\chi),\ell+\rho)=\gcd(\pi(\chi),\ell-\rho)=1$ by construction of
$\rho$. Hence, there exists $k_{1},k_{2}\in{{\mathbb{Z}}}$ such that

$\ell_{1}=\ell+\rho+k_{1}\pi(\chi),\quad\ell_{2}=\ell-\rho+k_{2}\pi(\chi)$

are both primes in $\Omega$ and $\ell_{1},\ell_{2}\nmid\pi(\chi)$. Then we
must have $\chi(\beta_{\ell_{1}}),\chi(\beta_{\ell_{2}})=1$ since
$\chi\in\Phi(D,\Omega)$. By periodicity, $\chi(\beta_{\ell\pm\rho})=1$ as
well. Using Proposition 3.2 (noting that $M=1$ in our case) with
$n=\ell,m=\rho$ and $r=1$, we have

$\beta_{\ell+\rho}\beta_{\ell-\rho}\equiv\beta_{\rho+1}\beta_{\rho-1}\beta_{\ell}^{2}\bmod
q$ (6.3)

Since $\chi(\beta_{\ell+\rho}\beta_{\ell-\rho})=1$ and
$\chi(\beta_{\ell}^{2})\neq 0,1$, it follows that
$\chi(\beta_{\rho+1}\beta_{\rho-1})\neq 0,1$. Using Proposition 3.2 again with
$n=\ell+2\rho,m=\rho,r=1$, we have

$\beta_{\ell+3\rho}\beta_{\ell+\rho}\equiv\beta_{\rho+1}\beta_{\rho-1}\beta_{\ell+2\rho}^{2}\bmod
q.$

Hence, either $\chi(\beta_{\ell+2\rho})\neq 0,1$ or
$\chi(\beta_{\ell+3\rho})\neq 0,1$. In either case, after choosing
$k_{1},k_{2}\in{{\mathbb{Z}}}$ such that

$\ell+2\rho+k_{1}\pi(\chi),\quad\ell+3\rho+k_{2}\pi(\chi)$

are both primes in $\Omega$ (we use the assumption $\ell>3$ here), we obtain a
prime $\ell_{0}\in\Omega$ such that $\chi(\beta_{\ell_{0}})\neq 0,1$ and
$\ell_{0}\nmid\pi(\chi)$, which contradicts $\chi\in\Phi(D,\Omega)$. This
finishes the proof that $\Phi(D,\Omega)\subseteq\Phi^{\prime}(D,\Omega)$.

The containment
$\Phi^{\prime\prime}(D,\Omega)\subseteq\Phi^{\prime}(D,\Omega)$ is clear. To
show $\Phi^{\prime}(D,\Omega)\subseteq\Phi^{\prime\prime}(D,\Omega)$, it
suffices to prove the following implication

$\chi(\beta_{\ell})=0\implies\ell\mid\operatorname{ord}(P\bmod q)$ (6.4)

for all $\ell\in\Omega$. If $\chi(\beta_{\ell})=0$, then
$\operatorname{ord}(P\bmod q)\mid\ell$. However, since
$\operatorname{ord}(P\bmod q)\neq 1$, we must have $\operatorname{ord}(P\bmod
q)=\ell$. This establishes (6.4), and hence
$\Phi^{\prime}(D,\Omega)=\Phi^{\prime\prime}(D,\Omega)$. ∎

######  Lemma 6.3.

Let $\ell$ be a prime such that the $\ell$-adic Galois representation for $E$
$\rho_{\ell}\colon\operatorname{Gal}(\bar{{{\mathbb{Q}}}}/{{\mathbb{Q}}})\to\operatorname{GL}_{2}({{\mathbb{Z}}}/\ell{{\mathbb{Z}}})$
is surjective. Then

$\limsup_{D\to\infty}\frac{\\#\\{\chi\in\Sigma(D):\ell\mid\operatorname{ord}(P\bmod
q(\chi))\\}}{\\#\\{\chi\in\Sigma(D)\\}}\leq\frac{\ell}{\ell^{2}-1}.$

###### Proof.

To calculate the limsup, we can ignore finitely many characters. Hence, we
will ignore characters whose modulus is ramified in the extension
${{\mathbb{Q}}}(E[\ell])$. Let $q$ be a prime unramified in
${{\mathbb{Q}}}(E[\ell])$ such that $\ell\mid\operatorname{ord}(P\bmod q)$.
This implies that $E({{\mathbb{F}}}_{q})[\ell]\neq 0$, which is equivalent to

$\det(I_{2}-\rho_{\ell}(\operatorname{Frob}_{q}))=0.$ (6.5)

There are $\ell(\ell+1)(\ell-1)^{2}$ elements in
$\operatorname{GL}_{2}({{\mathbb{Z}}}/\ell{{\mathbb{Z}}})$, and among them
there are $\ell^{3}-\ell^{2}$ many elements
$x\in\operatorname{GL}_{2}({{\mathbb{Z}}}/\ell{{\mathbb{Z}}})$ that satisfy
the equation $\det(I_{2}-x)=0$. Thus, by the Chebotarev density theorem the
proportion of primes $q$ that satisfy (6.5) is

$\frac{\ell^{3}-\ell^{2}}{\ell(\ell+1)(\ell-1)^{2}}=\frac{\ell}{\ell^{2}-1}.$

Let $\Omega_{\ell}$ denote the set of primes that satisfy (6.5). Recall that
if $\ell\mid\operatorname{ord}(P\bmod q)$, then $q\in\Omega_{\ell}$. As there
are $q-1$ Dirichlet characters of modulus $q$, the limit in question is less
than or equal to

$\lim_{D\to\infty}\frac{\\#\\{\chi\in\Sigma(D):q(\chi)\in\Omega_{\ell}\\}}{\\#\\{\chi\in\Sigma(D)\\}}=\lim_{D\to\infty}\frac{\displaystyle\sum_{q\in\Omega_{\ell},\;q\leq
D}q-1}{\displaystyle\sum_{q\leq D}q-1}=\frac{\ell}{\ell^{2}-1}$

where the last equality follows from simple application of the Chebotarev
density theorem and partial summation. ∎

We now show (6.2). To do so we consider a finite subset $R\subset\Omega$, then
take the limit over all $R$. We divide the quantity of interest into two parts
as

$\displaystyle\frac{\\#\Phi^{\prime\prime}(D,R)}{\\#\Sigma(D)}\leq$
$\displaystyle\frac{\\#\left\\{\chi\in\Sigma(D):\chi(\beta_{\ell})\in\\{\pm
1\\}\textnormal{ for some }\ell\in R\right\\}}{\\#\Sigma(D)}$
$\displaystyle+\frac{\\#\\{\chi\in\Sigma(D):\ell\mid\operatorname{ord}(P\bmod
q(\chi))\;\forall\ell\in R\\}}{\\#\Sigma(D)}.$

We start with the first part. Fix some $\ell\in R$ and let $q\leq D$ be any
prime not dividing $\beta_{\ell}$. Let $N$ be the order of $\beta_{\ell}$ in
$({{\mathbb{Z}}}/q{{\mathbb{Z}}})^{\times}/\\{\pm 1\\}$. Then the map

$\\{\chi\textnormal{ modulus
}q:\chi(-1)=1\\}\to\mu_{N},\quad\chi\mapsto\chi(\beta_{\ell})$

is surjective. Hence

$\frac{\\#\\{\chi\textnormal{ modulus
}q:\chi(-1)=1,\;\chi(\beta_{\ell})\in\\{\pm 1\\}\\}}{\\#\\{\chi\textnormal{
modulus }q:\chi(-1)=1\\}}=\frac{2}{N}.$ (6.6)

Recall that by the definition of $\Omega$ we have $|\beta_{\ell}|\neq 1$. It
follows that if $q>|\beta_{\ell}|$, then
$N\geq\log((q-1)/2)/\log|\beta_{\ell}|$. By taking $q$ very large compared to
$\ell$ and sorting characters by their modulus, as well as safely ignoring
characters of small modulus, one finds that

$\lim_{D\to\infty}\frac{\\#\left\\{\chi\in\Sigma(D):\chi(\beta_{\ell})\in\\{\pm
1\\}\textnormal{ for some }\ell\in R\right\\}}{\\#\Sigma(D)}=0.$

So, we are left with only the second part. Since $E$ does not have complex
multiplication, the $\ell$-adic Galois representation
$\rho_{\ell}\colon\operatorname{Gal}(\bar{{{\mathbb{Q}}}}/{{\mathbb{Q}}})\to\operatorname{GL}_{2}({{\mathbb{Z}}}/\ell{{\mathbb{Z}}})$
is surjective outside a finite set of primes by Serre’s open image theorem
[26, Thm. III.7.9]. Hence, shrinking $\Omega$ by finitely many primes if
necessary, we can assume that $\rho_{\ell}$ is surjective for all
$\ell\in\Omega$. Thus Lemma 6.3 gives

$\lim_{D\to\infty}\frac{\\#\Phi^{\prime\prime}(D,R)}{\\#\Sigma(D)}\leq\min\left(\frac{\ell}{\ell^{2}-1}\right)_{\ell\in
R}.$

Hence using Lemma 6.2 and letting $R\to\Omega$ gives

$\lim_{D\to\infty}\frac{\\#\Phi(D,\Omega)}{\\#\Sigma(D)}\leq\lim_{D\to\infty}\frac{\\#\Phi^{\prime\prime}(D,\Omega)}{\\#\Sigma(D)}\leq\lim_{R\to\Omega}\lim_{D\to\infty}\frac{\\#\Phi^{\prime\prime}(D,R)}{\\#\Sigma(D)}=0.\qed$

## References

  * [1] A. Akbary, J. Bleaney, S. Yazdani, On symmetries of elliptic nets and valuations of net polynomials. _J. Number Theory_ 158 (2016), 185–216.
  * [2] A. Akbary, M. Kumar, S. Yazdani, Soroosh, The signs in elliptic nets. New York J. Math. 23 (2017), 1237–1264.
  * [3] M. Ayad, Périodicité (mod $q$) des suites elliptiques et points $S$-entiers sur les courbes elliptiques. _Ann. Inst. Fourier_ 43 (1993), no. 3, 585–618.
  * [4] T. Browning, D. Loughran, Sieving rational points on varieties. Trans. Amer. Math. Soc. 371 (2019), no. 8, 5757–5785.
  * [5] J. Brüdern, K. Matomäki, R. Vaughan, T. Wooley, Analytic Number Theory. Oberwolfach Rep. 16 (2019), 3141–3205. doi: 10.4171/OWR/2019/50
  * [6] B. M. Bekker, Y. G. Zarkhin, Division by 2 of rational points on elliptic curves. St. Petersburg Math. J. 29 (2018), no. 4, 683–713.
  * [7] J. Berg, M. Nakahara, Rational points on conic bundles over elliptic curves. Math. Z. 300 (2022), no. 3, 2429–2449.
  * [8] V. Bosser, É. Gaudron, Logarithmes des points rationnels des variétés abéliennes. Canadian Journal of Mathematics, 71(2) (2019), 247-298.
  * [9] J.-L. Colliot-Thélène, A. Skorobogatov, _The Brauer–Grothendieck group_ , Ergebnisse Mathematik 3.F., Springer, 2021.
  * [10] G. Everest, A. van der Poorten, I. Shparlinski, T. Ward, _Recurrence sequences_. Mathematical Surveys and Monographs, 104. American Mathematical Society, Providence, RI, 2003.
  * [11] G. Everest, J. Reynolds, S. Stevens, Shaun. On the denominators of rational points on elliptic curves. Bull. Lond. Math. Soc. 39 (2007), no. 5, 762–770.
  * [12] P. Erdős, P. Turán. On a problem in the theory of uniform distribution. Indag. Math. 10 (1949), 38–41.
  * [13] D. Husemoller, J. Milnor, _Symmetric bilinear forms_. Springer-Verlag, New York-Heidelberg, 1973\.
  * [14] E. Kowalski, _The large sieve and its applications._ Cambridge Tracts in Mathematics, 175. Cambridge University Press, Cambridge, 2008.
  * [15] D. Loughran, The number of varieties in a family which contain a rational point. _J. Eur. Math. Soc._ , 20(10) (2018), 2539–2588.
  * [16] D. Loughran, L. Matthiesen, Frobenian multiplicative functions and rational points in fibrations. _J. Eur. Math. Soc._ , to appear, arXiv:1904.12845.
  * [17] D. Loughran, A. Smeets, Fibrations with few rational points. _Geom. Funct. Anal._ 26 (2016), no. 5, 1449–1482.
  * [18] D. Loughran on Mathoverflow, https://mathoverflow.net/questions/374689/sum-of-fibonacci-sequence-evaluated-at-a-dirichlet-character
  * [19] W. McCallum, W. Stein, J. Voight, Rational and Integral Points on Higher Dimensional Varieties. Lecture notes for ARCC workshop held at AIM in Palo Alto, December 11-20, 2002. https://aimath.org/WWN/qptsurface2/
  * [20] H. L. Montgomery, R. C. Vaughan, _Multiplicative number theory. I. Classical theory._ Cambridge Studies in Advanced Mathematics, 97. Cambridge University Press, Cambridge, 2007.
  * [21] B. Poonen, An explicit algebraic family of genus-one curves violating the Hasse principle. _J. Théor. Nombres Bordeaux_ 13 (2001), no. 1, 263–274.
  * [22] J.-P. Serre, Spécialisation des éléments de $\operatorname{Br}_{2}({{\mathbb{Q}}}(T_{1},\ldots,T_{n}))$, _C. R. Acad. Sci. Paris Sér. I Math._ 311 (1990), no. 7, 397–402.
  * [23] R. Shipsey, Elliptic Divisibility Sequences. _Ph.D. Thesis_ , (2000).
  * [24] J. H. Silverman, Wieferich’s criterion and the $abc$-conjecture. _J. Number Theory_ 30 (1988), no. 2, 226–237.
  * [25] J. H. Silverman, $p$-adic properties of division polynomials and elliptic divisibility sequences. _Math. Ann._ 332 (2005), no. 2, 443–471.
  * [26] J. H. Silverman, _The arithmetic of elliptic curves_. Second edition. _Graduate Texts in Mathematics_ 106. Springer, Dordrecht, (2009).
  * [27] J. H. Silverman, N. Stephens, The sign of an elliptic divisibility sequence. _J. Ramanujan Math. Soc._ 21 (2006), no. 1, 1–17.
  * [28] A. Skorobogatov, Torsors and rational points. Cambridge University press, 2001.
  * [29] K. E. Stange, Integral points on elliptic curves and explicit valuations of division polynomials. _Canad. J. Math._ 68 (2016), no. 5, 1120–1158.
  * [30] Z.-W. Sun on Mathoverflow, https://mathoverflow.net/questions/301624/does-each-prime-p3-have-a-quadratic-nonresidue-which-is-a-mersenne-number
  * [31] R. C. Vaughan, The Hardy-Littlewood Method. Cambridge University press, 1997.
  * [32] M. Verzobio, A recurrence relation for elliptic divisibility sequences. Riv. Math. Univ. Parma 3 (2022), no. 1, 223–242.
  * [33] J. F. Voloch, Elliptic Wieferich primes. _J. Number Theory_. 81 (2000), no. 2, 205–209.
  * [34] M. Ward, Memoir on elliptic divisibility sequences. _Amer. J. Math._ 70 (1948), 31–74.