The Birch and Swinnerton Dyer conjecture and Cryptography: Research

proposal

Amod Agashe amod@math.utexas.edu

The research we plan to do is broadly in the area of arithmetic algebraic geometry and consists of two independent parts. The first revolves around a conjectural formula of Birch and Swinnerton-Dyer, and is discussed in Section 1. The second involves applications of arithmetic algebraic geometry to cryptography and is the subject of Section 2. The two sections are independent of each other.

1 The Birch and Swinnerton-Dyer conjecture

1.1 Introduction

Now that the Shimura-Taniyama-Weil conjecture has been proved, perhaps the main outstanding problem in the area of arithmetic algebraic geometry is the Birch and Swinnerton-Dyer (BSD) conjecture. This conjecture was made over thirty years ago by Birch and Swinnerton-Dyer for elliptic curves; it was extended to abelian varieties by Tate, and to motives by Deligne, Beilinson, Bloch and Kato. As Cassels remarks, a fundamental problem of number theory is: given a set of polynomial equations with rational coefficients, find all of its rational solutions and investigate their structure; in many cases, the BSD conjecture predicts the existence of such solutions and describes their structure without actually finding the solutions. Thus the BSD conjecture addresses some basic questions in number theory. It also gives a relation among several fundamental invariants of an abelian variety defined over a number field. In particular, it proposes a formula for the order of the Shafarevich-Tate group of the abelian variety, a mysterious invariant that arises in the calculation of the Mordell-Weil group using descent, and elsewhere. The importance and centrality of this conjecture is underscored by the fact that the Clay Mathematical Institute selected it as one of the seven millenium prize problems. A lot of progress has been made on the BSD conjecture by the works of Coates, Wiles, Gross, Zagier, Rubin, Kolyvagin, Kato, et al.; but a large part of the conjecture is still not proved.

We consider a particular case of the BSD conjecture. Let A be an abelian variety defined over Q. Attached to A is a complex-valued function L_{A}(s) defined on the part of the complex plane where Re(s) is sufficiently large. It is called the L-function of A and is obtained by packaging information about the number of points of A over finite fields. Suppose that the function L_{A}(s) extends to an analytic function on the entire complex plane and let r be the order of vanishing of L_{A}(s) at s = 1; we call r the analytic rank of A. Then the first part of the BSD conjecture asserts that the rank of the Mordell-Weil group A(Q) is r; assume this is true. Let (P_{1}, …, P_{r}) be a basis of A(Q) modulo torsion, and let (P′_{1}, …, P′_{r}) be a basis of Â(Q) modulo torsion, where Â is the dual abelian variety of A. Then the regulator of A is defined as R_{A} =|det⟨P_{i}, P′_{j}⟩|, where ⟨, ⟩ is the canonical Néron-Tate height pairing (take R_{A} = 1 if r = 0). The Shafarevich-Tate group of A, denoted � _{A}, consists of equivalence classes of principal homogeneous spaces of A that are locally trivial everywhere; it is conjectured to be finite. Assume that the Shafarevich-Tate group is finite, and that the first part of the BSD conjecture is true. Then the second part of the BSD conjecture, as generalized by Tate and reformulated by Gross (e.g., see [Lan91, III.5]) asserts the formula:

\frac{lim_{s→1}(s − 1)^{−r}L_{A}(s)}{Ω_{A}R_{A}} =^{?} \frac{|� _{A}| ∏_{p} |Φ_{p}(A)|}{|A(Q)_{tor}||Â(Q)_{tor}|},  (1)

where Φ_{p}(A) is the component group of the special fiber (at the prime p) of the Néron model of A, the symbol Ω_{A} denotes the volume of A(R) calculated using a set of generators of the group of invariant differentials on the Néron model of A, and if G is a finite group, then we let |G| denote its order. We call Ω_{A} the real volume of A. Note that in this section, we shall use the symbol =^{?} to denote an equality which is conjectural. The formula above shall be called the BSD formula.

Note that the BSD conjecture derives global arithmetic information from analytic data that is obtained from local arithmetic information. Thus the BSD conjecture is a version of the local-to-global principle in number theory.

We consider the BSD formula for a certain class of abelian varieties. Let N be a positive integer and X_{0}(N) be the modular curve over Q associated with the problem of parametrizing elliptic curves with a cyclic subgroup of order N. The differentials on X_{0}(N) correspond to cusp forms of weight 2 and level N; hence N will often be referred to as the level. Let J_{0}(N) denote the Jacobian of X_{0}(N), an abelian variety defined over Q whose points correspond to degree-zero divisor classes on X_{0}(N). If A is a quotient of J_{0}(N), then the L-function of A extends to an analytic function on the complex plane. My research focuses on the case where L_{A}(1) is non-zero; in this case the Mordell-Weil group and the Shafarevich-Tate group of A are both finite (by results of [KL89]).

So in this case, formula (1) becomes:

\frac{L_{A}(1)}{Ω_{A}} =^{?} \frac{|� _{A}| ∏_{p|N} |Φ_{p}(A)|}{|A(Q)||Â(Q)|}  (2)

It is known that L_{A}(1)/Ω_{A} is a rational number [Shi77] and, when A is an elliptic curve, there are formulas to calculate this rational number as well as all the invariants in (2) except |� _{A}| (e.g., see [Cre97]). Also, one can use Euler systems to bound the order of � _{A} from above in terms of the order conjectured by (2) (staying away from certain primes), as in the work of Kolyvagin and of Kato (e.g., see [Rub98, Thm 8.6]).

For certain such quotients A of J_{0}(N), in [Aga99] and [AS01a], we express L_{A}(1)/Ω_{A} as an easily computable rational number. By comparing this expression for L_{A}(1)/Ω_{A} to the right hand side of the BSD formula, we have obtained partial results towards proving the formula. While the long term goal is to prove (or disprove!) the BSD formula, the immediate goal is to obtain more partial results as evidence for the formula.

In subsection 1.2, we discuss some material that is used in the rest of the section. Subsections 1.3, 1.4, and 1.5 can be read independently after subsection 1.2.

1.2 Preliminaries

We first discuss the notion of visibility, which was introduced by B. Mazur [CM00]. Let J be an abelian variety and A be any abelian subvariety of J, both defined over Q. Then the subgroup of � _{A} visible in J is Vis_{J}(� _{A}) = ker(� _{A} → � _{J}). An element of � _{A} is said to be visible in J if it lies in Vis_{J}(� _{A}). The following result is due to W. Stein [AS01c]; a similar result was earlier announced by B. Mazur.

Theorem 1.1. Let A and B be abelian subvarieties of J_{0}(N) such that A(Q) is finite. Suppose p is an odd prime such that

p ∤ N · #A(Q)_{tor} · #B(Q)_{tor} · ∏_{ℓ|N} c_{A,ℓ} · c_{B,ℓ},

where c_{A,ℓ} (resp., c_{B,ℓ}) is the order of the component group of A (resp., B) at the prime ℓ. Suppose furthermore that p | #(A ∩ B). Then there is an injection B(Q)/pB(Q) ↪ Vis_{J_{0}(N)}(� (A)).

Next, we introduce some notation that will be used in Sections 1.3 and 1.4. The Hecke algebra, denoted T, is the subring of endomorphisms of J_{0}(N) generated by the Hecke operators. We have an isomorphism H_{1}(X_{0}(N), Z) ⊗ R ⟶^{≃} Hom_{C}(H^{0}(X_{0}(N), Ω^{1}), C), given by integrating differentials along cycles. Under this isomorphism, let e ∈ H_{1}(X_{0}(N), Z) ⊗ R be the element that corresponds to the map which takes a differential ω to − ∫_{0}^{i∞} ω.

Suppose that I is an ideal of the Hecke algebra and A is the quotient abelian variety J_{0}(N)/IJ_{0}(N), defined over Q. In the BSD formula for A, the volume of A(R) is calculated using the Néron differentials. However, to get a formula or to do computations, it is more convenient to compute the volume using a set of generators of the subgroup of differentials that correspond to the cusp forms with integral Fourier expansion that are annihilated by I. The former volume is a multiple of the latter volume by a rational constant c_{A}, which we call the generalized Manin constant; when A is an elliptic curve, it is the usual Manin constant.

1.3 Shimura quotients

Let f be a newform of level N and I_{f} = Ann_{T}f. Let A_{f} denote the quotient abelian variety J_{0}(N)/I_{f}J_{0}(N), it will be called the Shimura quotient attached to f, and was introduced by Shimura in [Shi94]. These quotients are of great interest; for example, the Shimura-Taniyama-Weil conjecture, which was recently proved, asserts that every elliptic curve over Q is isogenous to some Shimura quotient.

We show in [AS01a] that: ^{1} 1

Theorem 1.2. Suppose that L_{A_{f}} (1) ≠ 0. Then

\frac{L_{A_{f}} (1)}{Ω_{A_{f}}} = \frac{1}{c_{A_{f}}} [H_{1}(A_{f}, Z)^{+} : Te/I_{f}e] ,  (3)

with notation as in §1.2, and where [H_{1}(A_{f}, Z)^{+} : Te/I_{f}e] is the absolute value of the determinant of a change of basis matrix from H_{1}(A_{f}, Z)^{+} to Te/I_{f}e, both considered as lattices in H_{1}(A_{f}, Q)^{+}.

If we compare the formula (3) for L_{A_{f}} (1)/Ω_{A_{f}} to the BSD formula (2), then we get:

\frac{|� _{A_{f}}| ∏_{p|N} |Φ_{p}(A_{f})|}{|A_{f}(Q)||Â_{f}(Q)|} =^{?} \frac{1}{c_{A_{f}}} [H_{1}(A_{f}, Z)^{+} : Te/I_{f}e] .  (4)

1Is it a good idea to state such results as a theorem in a research proposal?

Even though the lattice index [H_{1}(A_{f}, Z)^{+} : Te/I_{f}e] in formula (3) might seem mysterious at first, it can be calculated and used for theoretical results: in [AS01a] we prove that

c_{∞}· |A_{f}(Q)| · |Â_{f}(Q)| · [H_{1}(A_{f}, Z)^{+} : Te/I_{f}e] ∈ Z,

where c_{∞} is the number of connected components of A_{f}(R). As c_{∞} is known to be a power of 2, this is strong evidence towards formula (4). In the rest of this subsection, we study formula (4) in more detail.

1.3.1 Equivariant BSD formula

Each term in the formula (4) is the order of a module over T/I_{f}, so there might be an equivariant version of the formula involving Fitting ideals (Fitting ideals are discussed in [Lan93, XIX, § 2]). If M is a module over T/I_{f}, let Fit(M) denote its (first) Fitting ideal. Let L_{1} be the ideal of T/I_{f} given by L_{1} = Fit(C_{A_{f}}) · Fit(� _{A}) · ∏_{p|N} Fit(Φ_{p}(A_{f})), where C_{A_{f}} is the Manin module (see [AS01b] for details).

An equivariant version of the BSD formula was given in [Gro82] for elliptic curves with complex multiplication by a maximal order. This was vastly generalized in [BF01] as an equivariant Tamagawa number conjecture. These conjectures seems to suggest that L_{1} is a principal ideal and is generated by c_{A_{f}} · L_{A_{f}} (1)/Ω_{A_{f}}. However, note that by formula (3), c_{A_{f}} · L_{A_{f}} (1)/Ω_{A_{f}} = [H_{1}(A_{f}, Z)^{+} : Te/I_{f}e], and the latter lattice index is itself the order of a module over T/I_{f}; let L_{2} denote the Fitting ideal of this module. So it might be that L_{1} is not a principal ideal, but just equal to L_{2}.

Calculations regarding the conjectures in [Gro82] have been done in [BG85], and M. Flach has recently informed us that he has done calculations regarding the conjectures in [BF01] for elliptic curves with complex multiplication by non-maximal orders. We plan to do analogous calculations (possibly in collaboration with W. Stein) ^{2} to check with of the above two possibili- 2 ties could be true. The equivariant form of the conjecture is not only an interesting generalization, but might suggest ways to prove formula (4).

2Will: let me know if you agree with putting your name. Also, it is not clear to me how one would do such calculations. In your calculation of the component group, can you also calculate the action of the Hecke operators (on modular symbols you can, but I am not sure with the method of graphs)? Also, one has to get a handle on Shah, which is not easy. If you think the calculations are completely infeasible, let me know. –Amod

1.3.2 Is |� _{A_{f}}| a perfect square?

One can compute all of the terms in the BSD formula (4) except |� _{A_{f}} |, and hence get a conjectural value for |� _{A_{f}} |. It can be shown that if p is a prime that does not divide the degree of the polarization of A_{f} obtained from the canonical polarization of J_{0}(N), then the exponent of the highest power of p that divides |� _{A_{f}}| has to be even. This was indeed found to be true (for odd primes) for the conjectural values obtained in calculations of W. Stein [AS01a], and provides evidence for the BSD formula.

However, even when an odd prime p divides the degree of the modular polarization of A_{f}, in the calculations (performed for prime levels up to 5573), one finds that the exponent of the highest power of p that divides |� _{A_{f}} | is again even. It is not true in general that the order of the Shafarevich-Tate group (assuming it is finite) of an abelian variety over Q is a perfect square, e.g., one finds counterexamples in [PS99]. Is it true though, that for Shimura quotients with L_{A_{f}} (1) ≠ 0, the order of � _{A_{f}} is a perfect square? To show that it is a perfect square, by [Tat63, Thm. 3.3], all we have to do is display a polarization (actually just an isogeny coming from an invertible sheaf; the latter need not be ample) of degree coprime to the the degree of the modular polarization of A_{f}.

J. Tate raised the question: what can one say about the greatest common divisor of all polarizations of an abelian variety, say over Q? Later B. Poonen communicated to us an example where this gcd is not one. However in that example, the endomorphism ring of the abelian variety was Z, whereas Shimura quotients have large endomorphism rings. Also, when a prime p divides the degree of the modular polarization of A_{f}, we can often use Theorem 1.1 to show that p ||� _{A_{f}} |; however, note that the theorem actually says that in fact an even power of p divides |� _{A_{f}} | (assuming the parity conjecture and the first part of the BSD conjecture). This seems to indicate that for Shimura quotients with L_{A_{f}} (1) ≠ 0, the order of � _{A_{f}} might always be a perfect square; this result would be interesting in itself, and considering the data we obtained, this would give additional evidence of the BSD formula. We plan to investigate this question along the lines mentioned above.

1.3.3 Higher analytic rank

We gave a formula for the left hand side of formula (1) for Shimura quotients for which the analytic rank is 0; we would like to similarly obtain a formula even when the analytic rank is non-zero. As far as we know, the only case when something is known regarding this is when the analytic rank is 1. The theory of Jochnowitz congruences (e.g, see [Joc94], [BD99, Thm. 1.3]) conjecturally relates the “algebraic part” of the derivative of the L-function of an eigenform to the “algebraic parts” of the values at s = 1 of the Lfunctions of certain other eigenforms. Also, for an elliptic curve E, ^{3} the 3 Gross-Zagier formula [GZ86] relates L′_{E}(1)/Ω_{E} to the Neron-Tate height of a Heegner point. We plan to explore these two themes with the hope of finding a formula for the left hand side of formula (1) for Shimura quotients for which the analytic rank is non-zero.

1.4 Winding quotients of prime level

Recall the notation of Section 1.2. The Hecke algebra T acts on H_{1}(X_{0}(N), Z)⊗ R. Let I_{e} be the annihilator ideal of e with respect to this action. The quotient abelian variety J_{e}(N) = J_{0}(N)/I_{e}J_{0}(N) is called the winding quotient of level N. It was introduced by L. Merel in his proof of the uniform boundedness conjecture [Mer96]. Any quotient of J_{0}(N) with non-zero special L-value is a quotient of J_{e}(N); so the winding quotient is of special interest from the point of view of the BSD formula.

We focus on the case where the level N is a prime p and let J_{e} = J_{e}(p). In [Aga99, Prop 2.1], we show:

Theorem 1.3.

\frac{L_{J_{e}}(1)}{Ω_{J_{e}}} = \frac{1}{c_{J_{e}}} · \frac{|\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} | |\frac{H_{e}^{+}}{ℑe} |}{n},  (5)

where H = H_{1}(X_{0}(N), Z), H_{e} = H[I_{e}], Ĥ_{e} = H[Ann_{T}I_{e}], “+” denotes the subgroup invariant under the action of the complex conjugation involution, ℑ is the Eisenstein ideal [Maz77] and n = numr(\frac{p−1}{12}).

If we compare the formula (5) for L_{J_{e}}(1)/Ω_{J_{e}} to the BSD formula (2), then we get:

\frac{|� _{J_{e}}||Φ_{p}(J_{e})|}{|J_{e}(Q)||Ĵ_{e}(Q)|} =^{?} \frac{1}{c_{J_{e}}} · \frac{|\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} | |\frac{H_{e}^{+}}{ℑe} |}{n}.  (6)

By [Eme01] and [Maz77, III.4.1], we have |Φ_{p}(J_{e})|=|J_{e}(Q)|=|Ĵ_{e}(Q)|= n. Also, assume for the moment that the Manin constant is 1, as conjectured (see Section 1.5; in any case, the only prime that can divide c_{J_{e}} is 2, so the statements in the rest this section would be true away from the prime 2). Then formula (6) becomes:

3Check conditions on E.

|� _{J_{e}}| =^{?} |\frac{H^{+}}{Ĥ_{e}^{+} + H_{e}^{+}} | |\frac{H_{e}^{+}}{ℑe} | .  (7)

Using modular symbols, we computed (see [Aga00]) the two factors on the right hand side of the formula above, the first one for prime levels up to 397 and the second one for prime levels up to 1447. In the rest of this section, we discuss formula (7) in more detail.

1.4.1 The factor |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} |

We call a prime a congruence prime of J_{e} if it is the residue characteristic of some prime (ideal) of congruence between a modular form (of weight 2 and level N) annihilated by I_{e} and a modular form in the complementary subspace (i.e., one whose special L-value is zero).

The factor |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} | is closely related to congruence primes of J_{e}, as

can be guessed from its form. The primes that divide the factor |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} |

are the congruence primes of J_{e} and possibly the prime 2. Thus, looking at formula (5), we have shown that congruence primes of J_{e} divide the “algebraic part” of the special L-value; this result is similar to results that congruences between eigenforms give congruences between the “algebraic parts” of the associated special L-values (see, e.g., [Maz79], [Vat99]).

In view of results of [Eme01], we can use Theorem 1.1 to show that when a congruence prime ℓ of J_{e} is odd, not equal to p, and not “Eisenstein”, then

ℓ divides |� _{J_{e}}|. This would show that primes dividing the factor |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} |

divide |� _{J_{e}}| under some mild hypotheses, as predicted by (7). We hope to

work harder to show in fact that |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} | itself divides |� _{J_{e}}|; this would

be strong evidence for formula (7).

As a concrete example, a calculation shows that 5 divides |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} |

when the level is 389, and is the only odd prime doing so. In [AS01c] it is shown that 5^{2} divides |� _{J_{e}(389)}|. So away from the prime 2, |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} |

divides |� _{J_{e}}| for level 389.

Now assuming the parity conjecture and the first part of the BSD conjecture (for L-functions vanishing to any order at s = 1), the result of [AS01c] actually shows that the square of a congruence prime of J_{e} (that satisfies the mild hypotheses mentioned above) divides |� _{J_{e}}|. So the question arises:

does |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} | divide |\frac{H_{e}^{+}}{ℑe} |? For example, at level 389, we find that the

odd part of |\frac{H_{e}^{+}}{ℑe} | is 5, hence the answer to the question is yes (again, away

from 2). It might be that the group \frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} can be written as a subgroup

or quotient group of \frac{H_{e}^{+}}{ℑe}, which would settle the question. As another line of attack, one can try to see if the arguments of [Vat99] and others on congruences between “algebraic parts” of special L-values would generalize to give congruences modulo squares of congruence primes. This would also help settle the question, as usually only the first power of a congruence prime

of J_{e} would be expected to divide |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} |, as is the case in the example

of level 389.

In our calculations, performed way back in 1997, we found that 389 was

the only level up to 397 for which an odd prime divided |\frac{H^{+}}{Ĥ_{e}^{+}+H_{e}^{+}} |. With

the availability of faster computing power and better software, we hope to do more calculations to get a better idea of this factor.

1.4.2 The factor |\frac{H_{e}^{+}}{ℑe} |

This factor is quite mysterious and deserves further study. In fact, we believe that the mystery behind the BSD formula lies in this factor. We computed |\frac{H_{e}^{+}}{ℑe} | for prime level up to 1447. We found that for all these levels except

for the levels 1091, 1283 and 1429, whenever a prime divided |\frac{H_{e}^{+}}{ℑe} |, it was a congruence prime of J_{e}.

L. Merel has suggested that perhaps the inverse limit of the group H_{e}^{+}/ℑe with respect to the level is trivial. We are trying to show this using the explicit description of the group H_{e}^{+}/ℑe using modular symbols, along the lines of [Par99, ]. ^{4} In other words, the second factor may be related 4 to congruences with forms of higher level, and then one can hope to use Theorem 1.1 to show that |\frac{H_{e}^{+}}{ℑe} | divides |� _{J_{e}}|.

As an example, for the level 1091, the odd part of |\frac{H_{e}^{+}}{ℑe} | is 49. There was a congruence modulo 7 between the newform corresponding to J_{e}(1091), which is actually a Shimura quotient also, and a newform at level 2·1091; however the congruence is modulo a maximal ideal which is not in the support of [H_{1}(A_{f}, Z)^{+} : Te/I_{f}e], so if the equivariant version of the BSD formula (see Section 1.3.1) is true, then this may not be good enough to use Theorem 1.1 to show that 49 does indeed divide � _{J_{e}(1091)}.

4Check section number.

This question is related to the issue of visibility (recall the discussion in Section 1.2). We showed in [Aga99, Thm 1] that if we assume the BSD formula (6) for J_{e}(1091), then the element of order 7 in � Ĵ_{e} predicted by this formula is not visible in J_{0}(1091). In view of Theorem 1.1, the discussion of the previous paragraph can be rephrased as the question: does this element become visible in J_{0}(2 · 1091)? It is not clear if one can always find congruences with modular forms of higher level (say using Ribet’s level raising criterion [Rib90]) whose L-functions have strictly positive even analytic rank (as would be needed in order to use Theorem 1.1), considering that one expects that asymptotically, the density of levels N such that the analytic rank of J_{0}(N)^{+} is positive is zero.

As another example, W. Stein [AS01c] has shown that the (conjectural) example in [CM00] of the element of order 3 in the Shafarevich-Tate group of an elliptic curve E of conductor 5389 which was not visible in J_{0}(5389) becomes visible in J_{0}(7 · 5389), and in fact 9 ||� _{E}|.

We plan to analogously look at the example of J_{e}(1091), as well as other examples, to get a better idea of whether the primes dividing |\frac{H_{e}^{+}}{ℑe} | have anything to do with congruences at the same level or higher level (possibly in collaboration with W. Stein).

1.4.3 A strategy for proving the BSD formula

Our strategies mentioned above might show that the conjectural order of � _{J_{e}} as predicted by the BSD formula divides the (actual) order of � _{J_{e}}. As mentioned in the introduction, one can use Euler systems to bound the order of � _{J_{e}} from above in terms of the BSD conjectural order. Thus one hopes to show that the BSD conjectural order of � _{J_{e}} bounds the (actual) order of � _{J_{e}} from below as well as from above (in particular cases, for example) and thus prove the BSD formula. Finally it should not be difficult to transfer the techniques used for the winding quotient to Shimura quotients with non-vanishing special L-value.

1.5 The Manin constant, congruence primes and the modular degree

1.5.1 The generalized Manin constant

Suppose that I is an ideal of the Hecke algebra and A is the quotient abelian variety J_{0}(N)/IJ_{0}(N), defined over Q. Recall the definition of the generalized Manin constant of A, denoted c_{A}, from Section 1.2. In any formula for L_{A}(1)/Ω_{A} that we have derived (Theorems 1.2 and 1.3), the constant c_{A} appears; hence it is necessary to study c_{A} from the viewpoint of the BSD formula. We have conjectured in [AS01b] that c_{A} = 1 if A factors through the new quotient of J_{0}(N), generalizing the conjecture of Manin for the case when A is an elliptic curve.

It is known that that c_{A} is an integer [Edi91] [AS01b] and that the only primes that can divide it are the prime 2 and the primes whose squares divide N [Maz78, Cor 4.1] [AS01b].

If A is an elliptic curve, then by [AU96] a prime p can divide c_{E} only if it divides N. Let r_{E} be the biggest integer such that f_{E}, the newform corresponding to E, is congruent modulo r_{E} to a modular form (of weight 2 and level N) which has integral Fourier expansion and which is orthogonal to f_{E} (with respect to the Petersson inner product). A prime that divides r_{E} is called a congruence prime. In [AS01b], we extended the techniques of [AU96] to show that if a prime p divides the Manin constant, and if p^{2} does not divide N, then p is a congruence prime.

One still does not have a direct generalization of the result of [AU96] which would say that the only primes that can divide the generalized Manin constant are the primes that divide N. We are working on that, by trying to generalize the techniques of [AU96].

Regarding the conjecture that the generalized Manin constant is 1, the main part that is left to be proved is that primes whose squares divide N do not divide the (generalized) Manin constant either. One approach to this problem is to construct good models for X_{0}(N) when N is not necessarily square free, e.g., this has been done in certain cases in [Edi89].

1.5.2 Congruence primes and the modular degree

Let E be a strong modular elliptic curve of conductor N. The degree of the modular parametrization of E is called the modular degree and is denoted δ_{E}. Ribet pointed out [Zag85] that the modular degree divides r_{E} and the question has been raised [FM99] about what one can say in the other direction. It is not true that r_{E} = δ_{E}; counterexamples were found in [AS01b].

We conjectured in [AS01b] that the only primes that can divide r_{E}/δ_{E} are the primes whose square divides N; this was recently proved by K. Ribet. There seems to be some evidence based on a few computations of W. Stein that a refined version of the conjecture may also be true: if p is a prime such that p^{r} | \frac{r_{E}}{δ_{E}}, then p^{(r+1)} | N. We plan to investigate this.

Just as for the Manin constant, one approach to this problem is to generalize the methods used by K. Ribet to prove our original conjecture (these methods are similar to those in [MR91]), by constructing good models for X_{0}(N) when N is not necessarily square free. Another possible approach is via a formula in [AU96, p. 279] which relates the Manin constant, congruence primes, the modular degree, and the order of a group related to the cokernel of the modp q-expansion map.

2 Cryptography

To be written.

References

[Aga99] Amod Agashé, On invisible elements of the Tate-Shafarevich group, C. R. Acad. Sci. Paris Sér. I Math. 328 (1999), no. 5, 369–374.

[Aga00] A. Agashe, The Birch and Swinnerton-Dyer formula for modular abelian varieties of analytic rank zero, Ph.D. thesis, University of California, Berkeley (2000), http://www.math.berkeley.edu/˜ amod.

[AS01a] A. Agashe and W. A. Stein, The Birch and Swinnerton-Dyer formula for Shimura quotients of analytic rank zero, preprint (2001).

[AS01b] A. Agashe and W. A. Stein, The generalized Manin constant, congruence primes, and the modular degree, in preparation (2001).

[AS01c] A. Agashe and W. A. Stein, Visibility of Shafarevich-Tate groups of abelian varieties, preprint (2001).

[AU96] Ahmed Abbes and Emmanuel Ullmo, À propos de la conjecture de Manin pour les courbes elliptiques modulaires, Compositio Math. 103 (1996), no. 3, 269–286.

[BD99] M. Bertolini and H. Darmon, Euler systems and Jochnowitz congruences, Amer. J. Math. 121 (1999), no. 2, 259–281.

[BF01] D. Burns and M. Flach, Equivariant Tamagawa numbers for motives, preprint (2001).

[BG85] J. P. Buhler and B. H. Gross, Arithmetic on elliptic curves with complex multiplication. II, Invent. Math. 79 (1985), no. 1, 11–29.

[CM00] J. E. Cremona and B. Mazur, Visualizing elements in the Shafarevich-Tate group, Experiment. Math. 9 (2000), no. 1, 13– 28.

[Cre97] J. E. Cremona, Algorithms for modular elliptic curves, second ed., Cambridge University Press, Cambridge, 1997.

[Edi89] B. Edixhoven, Stable models of modular curves and applications, Thèse de doctorat à l’université d’Utrecht (1989), http://www.maths.univ-rennes1.fr/˜ edix/publications/prschr.html.

[Edi91] B. Edixhoven, On the Manin constants of modular elliptic curves, Arithmetic algebraic geometry (Texel, 1989), Birkhäuser Boston, Boston, MA, 1991, pp. 25–39.

[Eme01] M. Emerton, Optimal quotients of modular Jacobians, preprint (2001).

[FM99] G. Frey and M. Müller, Arithmetic of modular curves and applications, Algorithmic algebra and number theory (Heidelberg, 1997), Springer, Berlin, 1999, pp. 11–48.

[Gro82] Benedict H. Gross, On the conjecture of Birch and Swinnerton-Dyer for elliptic curves with complex multiplication, Number theory related to Fermat’s last theorem (Cambridge, Mass., 1981), Birkhäuser Boston, Mass., 1982, pp. 219–236.

[GZ86] B. Gross and D. Zagier, Heegner points and derivatives of L-series, Invent. Math. 84 (1986), no. 2, 225–320.

[Joc94] N. Jochnowitz, A p-adic conjecture about derivatives of L-series attached to modular forms, p-adic monodromy and the Birch and Swinnerton-Dyer conjecture, Amer. Math. Soc., Providence, RI, 1994, pp. 239–263.

[KL89] V. A. Kolyvagin and D. Y. Logachev, Finiteness of the Shafarevich-Tate group and the group of rational points for some modular abelian varieties, Algebra i Analiz 1 (1989), no. 5, 171–196.

[Lan91] S. Lang, Number theory. III, Springer-Verlag, Berlin, 1991, Diophantine geometry.

[Lan93] S. Lang, Algebra, third ed., Addison-Wesley Publishing Co., Reading, Mass., 1993.

[Maz77] B. Mazur, Modular curves and the Eisenstein ideal, Inst. Hautes Études Sci. Publ. Math. (1977), no. 47, 33–186 (1978).

[Maz78] B. Mazur, Rational isogenies of prime degree (with an appendix by D. Goldfeld), Invent. Math. 44 (1978), no. 2, 129–162.

[Maz79] B. Mazur, On the arithmetic of special values of L functions, Invent. Math. 55 (1979), no. 3, 207–240.

[Mer96] Loïc Merel, Bornes pour la torsion des courbes elliptiques sur les corps de nombres, Invent. Math. 124 (1996), no. 1-3, 437–449.

[MR91] B. Mazur and K. A. Ribet, Two-dimensional representations in the arithmetic of modular curves, Astérisque (1991), no. 196-197, 6, 215–255 (1992), Courbes modulaires et courbes de Shimura (Orsay, 1987/1988).

[Par99] Pierre Parent, Bornes effectives pour la torsion des courbes elliptiques sur les corps de nombres, J. Reine Angew. Math. 506 (1999), 85–116.

[PS99] B. Poonen and M. Stoll, The Cassels-Tate pairing on polarized abelian varieties, Ann. of Math. (2) 150 (1999), no. 3, 1109–1149.

[Rib90] K. A. Ribet, Raising the levels of modular representations, Séminaire de Théorie des Nombres, Paris 1987–88, Birkhäuser Boston, Boston, MA, 1990, pp. 259–271.

[Rub98] Karl Rubin, Euler systems and modular elliptic curves, Galois representations in arithmetic algebraic geometry (Durham, 1996), Cambridge Univ. Press, Cambridge, 1998, pp. 351–367.

[Shi77] G. Shimura, On the periods of modular forms, Math. Ann. 229 (1977), 211–221.

[Shi94] G. Shimura, Introduction to the arithmetic theory of automorphic functions, Princeton University Press, Princeton, NJ, 1994, Reprint of the 1971 original, Kan Memorial Lectures, 1.

[Tat63] John Tate, Duality theorems in Galois cohomology over number fields, Proc. Internat. Congr. Mathematicians (Stockholm, 1962), Inst. Mittag-Leffler, Djursholm, 1963, pp. 288–295.

[Vat99] V. Vatsal, Canonical periods and congruence formulae, Duke Math. J. 98 (1999), no. 2, 397–419.

[Zag85] D. Zagier, Modular parametrizations of elliptic curves, Canad. Math. Bull. 28 (1985), no. 3, 372–384.