Elliptic Curves with Full 2-Torsion and Maximal Adelic Galois Representations

In 1972, Serre showed that the adelic Galois representation associated to a non-CM elliptic curve over a number field has open image in GL_2(\hat{Z}). In Greicius' thesis, he develops necessary and sufficient criteria for determining when this representation is actually surjective and exhibits such an example. However, verifying these criteria turns out to be difficult in practice; Greicius describes tests for them that apply only to semistable elliptic curves over a specific class of cubic number fields. In this paper, we extend Greicius' methods in several directions. First, we consider the analogous problem for elliptic curves with full 2-torsion. Following Greicius, we obtain necessary and sufficient conditions for the associated adelic representation to be maximal and also develop a battery of computationally effective tests that can be used to verify these conditions. We are able to use our tests to construct an infinite family of curves over Q(alpha) with maximal image, where alpha is the real root of x^3 + x + 1. Next, we extend Greicius' tests to more general settings, such as non-semistable elliptic curves over arbitrary cubic number fields. Finally, we give a general discussion concerning such problems for arbitrary torsion subgroups.


Introduction and Statement of Results
Let E be an elliptic curve over a number field K. For m a positive integer, let E[m] denote the group of m-torsion points of E over K. It is well known that E[m] ≃ Z/mZ × Z/mZ, and since [m] is defined over K the Galois group G K := Gal(K/K) acts on E[m]. This can be phrased as a Galois representation ρ E,m : G K → GL 2 (Z/mZ). We call this the "mod m" Galois representation. Now fix a prime ℓ. Taking the inverse limit over powers of ℓ, we obtain the Tate module of E, T ℓ (E) := lim ← − Z/ℓ n Z Correspondingly, we have the "ℓ-adic" Galois representation ρ E,ℓ ∞ : G K → GL 2 (Z ℓ ).
Taking the product of these over all primes, we finally obtain the "adelic" Galois representation In [Ser72], Serre famously proved that for elliptic curves without complex multiplication, the image of ρ E is always open in GL 2 ( Z). In particular, this implies that ρ E,ℓ ∞ is surjective for all sufficiently large ℓ. He also showed that for an elliptic curve defined over Q, ρ E is never surjective.
Naturally, this raised the question of whether ρ E could be surjective for elliptic curves defined over number fields other than Q. In [Gre10], Greicius proves necessary and sufficient abstract criteria for ρ E (G K ) to be the full group GL 2 ( Z). He then develops numerical tests applying to semistable elliptic curves over the field Q(α), where α is the real root of x 3 + x + 1 = 0, which can be effectively used to verify these criteria. Through the tests he is able to give the first explicit example of an elliptic curve over a number field with surjective adelic Galois representation. In doing so, the main challenge is to show that the ℓ-adic representation is surjective for all ℓ.
Despite the difficulty of finding explicit examples of surjective adelic representations, it turns out that much is known on average. Zywina, building on work of Duke and Jones in [Duk97] and 1 [Jon10], proved that almost all (in the sense of density) elliptic curves have surjective adelic Galois representation ( [Zyw10a,Zyw10b]). In fact, his work shows that for any rational family of elliptic curves, even when there are obstructions to the surjectivity of ρ E such as the presence of torsion defined over K, the generic member has maximal Galois representation. However, his methods are ineffective in that they do not explicitly produce any such elliptic curves.
In this paper, we first consider the question of determining the image of Galois for explicit elliptic curves under certain hypotheses of torsion. More specifically, let E/K be an elliptic curve with full 2-torsion over K, so that E[2](K) ∼ = Z/2Z × Z/2Z. Then the action of G K on E[2] is trivial, so the image of the 2-adic Galois representation ρ E,2 ∞ : G K → GL 2 (Z 2 ) lies in the kernel of the reduction mod 2 map. In this case the adelic Galois representation clearly cannot be surjective. Writing V k (ℓ) = I + ℓ k Mat 2×2 (Z ℓ ), the remarks above imply that ρ E factors through the map Following Greicius, we first prove necessary and sufficient abstract criteria, analogous to Theorem 3.1 in [Gre10], for the adelic Galois representation to be maximal given that the elliptic curve has full two-torsion over its field of definition, K.
Theorem 1.1. Let K be a number field. Then ρ E surjects onto V 1 (2) × ℓ>2 GL 2 (Z ℓ ) if and only if the following three conditions are satisfied: (1) ρ E,ℓ ∞ is surjective for each ℓ ≥ 3 and ρ E,2 ∞ surjects onto V 1 (2), Remark. Note that the third condition cannot be satisfied when K is an abelian extension of Q, so the simplest number field K where this can be satisfied is a non-Galois cubic extensions.
This theorem is not hard to prove; it is more difficult to test algorithmically if the first two conditions above are satisfied. In the case where K is the number field that Greicius considers, the first condition can be checked using his methods for most ℓ, but the case of the 2-adic representation is significantly different, as there is no GL 2 (Z/2Z)-module structure on the image. In Section 2.3, we develop new methods for handling this case. The second condition is also unique to the twotorsion case, and requires some work to obtain a feasible computation. Using the tests developed by Greicius, as well as the ones mentioned above, we implemented a computer program to check maximality of adelic representations. Simply iterating through coefficients, we found the following curve which has maximal adelic image.
As mentioned, Greicius's tests depend upon special properties of the E and K: they apply only to semistable elliptic curves with non-integral j-invariant, and also only to cubic fields K with trivial narrow class group and possessing a totally positive unit u such that u − 1 is also a unit. More precisely, Greicius uses these conditions to prove that all primes ℓ failing condition 1 of Theorem 1.1, outside an easily computable finite set, satisfy a certain divisibility condition relating to the reduction of E at primes of good reduction. In Section 4, we prove analogous results applying to all elliptic curves with non-integral j-invariant over arbitrary cubic number fields.
Using them, we obtain the following examples. First, we give an example of a non-Galois cubic field K and an elliptic curve E/K with full 2-torsion over K which has maximal adelic Galois image, but is not semistable.
Example 1.4. Let β be the unique real root of x 3 + 4x 2 + 7x − 4 and K = Q(β). The adelic representation ρ E associated to the elliptic curve Lastly, we give an example of non-galois cubic field K with nontrivial narrow class group and a semistable elliptic curve E/K with surjective adelic representation.
Example 1.5. Let β be the unique real root of x 3 + 8x 2 − 3x + 1 and K = Q(β). Then the adelic representation ρ E corresponding to While we focus on two-torsion in the paper, our tests may be easily generalized to higher torsion. In the final section, we discuss how to compute the ℓ-adic image in the presence of ℓ-torsion. As a demonstration, we compute the 7-adic Galois representation for an elliptic curve over Q with a single cycle of 7-torsion points over Q. In this case, the maximum possible image of Galois is the pre-image of the "half-Borel" subgroup under the projection GL 2 ( Z) → GL 2 (F 7 ).
The computations in this paper were done using Magma and Sage. Throughout this paper, we include references to the code that we have written. We indicate this by using the typewriter font. These scripts along with their outputs are available at [CFLTL].

The Criteria
We begin with the proof of Theorem 1.1.
2.1. Proof of Theorem 1.1. Throughout, we will assume that our elliptic curves have full 2torsion over K, i.e., the mod 2 image of the representation is trivial. As mentioned in the introduction, In this section we develop a criterion for proving that the Galois representation of an elliptic curve with full 2-torsion surjects onto G.
Our approach is modeled on that in [Gre10], in which the author proves a criterion for an elliptic curve to have surjective adelic Galois representation and then uses it to compute the first known example of such a curve. To do so, he first develops a fairly abstract criterion for a subgroup of a product of profinite groups to be the whole group, and then interprets it in the case of a Galois representation associated to an elliptic curve. We summarize this result in the following lemma.
Lemma 2.1 ([Gre10], Lemma 2.2 and Proposition 2.5). Let G α be a collection of profinite groups such that for α = α ′ , we have Quo(G α ) ∩ Quo(G α ′ ) = ∅, where Quo(G α ) denotes the set of isomorphism classes of finite, nonabelian simple quotients of G α . If H ⊆ G = α G α is a closed subgroup that surjects onto each G α and surjects onto G ab , then H = G.
Applying this to our situation, we know that is a closed subgroup. The condition on Quo(G α ) is easily satisfied; we are in the same situation as Corollary 2.7 of [Gre10], except now we have replaced GL 2 (Z 2 ) with V 1 (2). In fact, Quo(V 1 (2)) = ∅, as V 1 (2) is a pro-2 group, so the condition is still satisfied. Therefore, in order to show that ρ E (G K ) is the entire group, we must show the ρ E,ℓ ∞ is surjective for ℓ = 2, that ρ E (G K ) surjects onto V 1 (2), and that ρ E (G K ) surjects onto the abelianization of V 1 (2) × ℓ>2 GL 2 (Z ℓ ).
In order to check the first two conditions, we apply the following two lemmas which are known as the Refinement Lemmas.
Proof. The surjectivity for the 2-adic and 3-adic representations follows from the two parts of Lemma 2.2, respectively.
Furthermore, if we assume that K ∩ Q cyc = Q, then, by the non-degeneracy of the Weil pairing, the determinant map is surjective. The hypothesis in our corollary implies that ρ E,ℓ (G K ) contains SL 2 (F ℓ ), so ρ E,ℓ ∞ (G K ) contains SL 2 (Z ℓ ). As the determinant is surjective, this implies that ρ E,ℓ ∞ is surjective.
In order to show that ρ E (G K ) surjects onto the abelianization, we must compute the abelianization of V 1 (2)× ℓ>2 GL 2 (Z ℓ ). Equivalently, we wish to compute its commutator subgroup. We note that we only need to do this for each ℓ separately. For any group G, we denote the commutator subgroup of G by G ′ . We recall the computation for ℓ odd.
The only task then is to compute V 1 (2) ′ .
Proof. As V 1 (2)/V 2 (2) is abelian, we know the commutator is contained in V 2 (2). As usual, we know that SL 2 (Z 2 ) contains the commutator, so we have an inclusion above in one direction. We First, we would like to show that modulo 8, the image of V 1 (2) ′ contains U 2 (2). In other words, we would like to compute the commutator of V 1 (2)/V 3 (2).
So we see that the abelianization map of G is the product ρ E,4 × det, and its image is the index two subgroup of V 2 /V 4 × Z * where det (on the first factor) and reduction mod 2 (on the second factor) agree.
We would like to interpret surjectivity onto G ab in a field-theoretic manner. As we noted, showing that the determinant map is surjective is a matter of requiring that K ∩ Q cyc = Q. In order for ρ E (G K ) to surject onto G ab in our case, we need the following: Proof. We have already remarked that K ∩ Q cyc = Q is equivalent to the surjectivity of the determinant map.
Observe that K(E[4]) is the fixed field of ρ E,2 ∞ (G K ) ∩ (I + 4V 1 (2)). Furthermore, K(E[4]) ∩ K cyc ⊃ K(i) by properties of the Weil pairing. The abelianization map can be restated as the product of the quotient maps from G K to Gal(K(E[4])/K) and Gal(K cyc /K) given by restriction to the respective fields; under this interpretation, the condition is simply that the image of an element σ ∈ G K must agree under the restriction of both factors to K(i).
We know that if L and M are extensions of K, then Gal(LM/K) is Gal(L/K) × Gal(L∩M )/K Gal(M/K), and the result follows. Therefore, if K(E[4]) ∩ K cyc = K(i), then the Galois group of the compositum already surjects onto G ab . Conversely, if the intersection is any greater, then the map cannot be surjective because its image is constrained to agree on the Galois group of the intersection over K, which strictly contains K(i).
2.2. Checking condition 2. As the second condition of Theorem 1.1 cannot be directly computed, we must develop an easier criterion to check. Greicius does not have to do this, as his version of the second condition is that K( √ ∆) ∩ K cyc = K, so all that must be checked is if √ ∆ ∈ K cyc . We avoid working with K(E[4]) directly, as that would be computationally intensive. Instead, we develop a test in which we only see if certain elements of K are squares. We use the following notation. Let T be a set of numbers. Define P T to be the set containing all products of non-empty subsets of elements of T . For example, if T = {2, 3}, then P T = {2, 3, 6}. We define ∆ to be the discriminant of E.
Our curves are not of that form, but using the change of variables from pg. 41 -43 of [Sil09], the same result holds for all elliptic curves in Weierstrass form. Assume is square-free, be one of them. As L ⊂ K cyc , choose n such that L ⊂ K(µ n ). Since K ∩ Q cyc = Q, Gal(K(µ n )/K) ∼ = Gal(Q(µ n )/Q). So we may consider Q L ′ := Q(µ n ) Gal(K(µn)/L) ⊂ Q(µ n ). By the fundamental theorem of Galois theory, L ′ ⊂ L. So L ∩ Q cyc = Q. This implies that √ d ∈ Q cyc , and hence d ∈ Q cyc ∩ O K = Z. We may assume that d is positive, as i ∈ M .
By the criterion of Neron-Ogg-Shafarevich, a prime ideal p ⊂ O K ramifies in K(E[4])/K only if p ∈ S ′ . Therefore, we must have that d ∈ P S . Since , all quadratic subextensions of K(E[4])/K are generated by an element of P T . Therefore, L = K( √ t) for some t ∈ P T . Now, K( √ t) = K( √ s) if and only if t/s is a square of K, which completes the proof of our lemma.
2.3. 2-adic surjectivity. We now outline our algorithm for checking that the 2-adic image is the full group V 1 (2). We assume that the 2-adic image surjects onto V 1 (2)/V 2 (2); this is easily checked by, for instance, computing the degree of the field extension K(E[4])/K. In contrast, computing directly the degree of the extension K(E[8])/K is infeasible, as we want examples where this extension has degree 256.
In what follows, let p be a prime of K not dividing 2∆, where ∆ is the discriminant of E (so that the 2-adic Galois representation is unramified at these primes). Let E p denote the reduction of E at p. Let Frob p denote the Frobenius element at p for the extension K/K. Proposition 2.9. Under the hypothesis above, the 2-adic Galois representation associated to E has maximal image if the following is satisfied: there exists a prime p ⊂ O K such that #(O K /p) ≡ 5 (mod 8) and E (mod p) has full four-torsion over O K /p.
Computing this for all such S, we find five distinct matrices: Note that this set generates a subgroup of size 8 in V 2 (2)/V 3 (2) consisting of those matrices with determinant congruent to 1 (mod 8). Therefore, we immediately see that (under our hypotheses) the image of Galois, contains an index two subgroup of V 2 (3)/V 2 (3) and hence also Moreover, equality is achieved in both cases if and only if the mod 8 image of Galois has an element with determinant congruent to 5 (mod 8) in V 2 (2)/V 3 (2). Since the 8-torsion of E injects into the 8-torsion of E p , the first condition implies that in some basis for but has determinant congruent to 5 (mod 8).
2.4. Proof of Example 1.2. In this section we apply the results of Section 2 and give an example of an elliptic curve over K = Q(α) with surjective adelic Galois representation It is clear from the definition of E that E has full 2-torsion over K. As the conductor of E is squarefree, E is semistable. We now check that the three conditions of Theorem 1.1 are satisfied.
As an ideal the discriminant of E is where the ideals on the right hand side of the above equation are prime ideals which lie above 2, 6857, 167, 31, and 3, respectively.
Using Magma, one can compute that [K(E[4]) : K] = 16. We now show that K(E[4]) ∩ K cyc = K(i). This will make use of Lemma 2.8. To apply the theorem, we make some computational preliminaries to explicitly write out K(E[4]). Note that the division polynomial of E will factor as the product of 3 quadratic factors f 1 , f 2 , and f 3 . From Section 5.5 of [Ade01] and the fact that We also have that In the notation of Lemma 2.8, we have S = {2, 3, 31, 167, 6857} and 4 : s i = 0 or 1}\{1}. Lemma 2.8 implies that if for all possible pairs of β ∈ S 1 and γ ∈ T 1 if γ/β is not a square in K, then K(E[4]) ∩ K cyc = K(i). Writing a script in Magma iterating through all 465 pairs of (β, γ) yields that this condition is indeed satisfied (see ex12 sq.txt and the corresponding ex12 sq res.txt in [CFLTL]). Therefore we have K(E[4]) ∩ K cyc = K(i).
Let H := ρ E (G K ). Denote by H ℓ the image of H under π ℓ : H → GL 2 (Z ℓ ), and similarly denote by H(ℓ) the image of H under r ℓ : H → GL 2 (Z/ℓZ). Since [K(E[4]) : K] = 16, the mod 4 image H(4) is maximal. This and the fact that K(E[4]) ∩ K cyc = K(i) imply that the abelianization map is surjective. We will also need this fact in proving that ρ E,2 ∞ is surjective.
We now verify the first condition in Theorem 1.1. That is, H ℓ = GL 2 (Z ℓ ) for ℓ ≥ 3 and Equation (1) gives the primes of bad reduction. For all primes of bad reduction which are not the ideal (2), we have v(j E ) = −2. To show that H ℓ = GL 2 (Z ℓ ) for all ℓ = 2, 3, 31, we will make use of a combination of Proposition 3.5, Corollary 3.8, and Remark 3.9 in [Gre10] which we state below: Proposition 2.10. Let K be a number field with a real embedding and a trivial narrow class group and satisfying Fix an ℓ = 2, 31. Assume that H(ℓ) = GL 2 (F ℓ ). Let v be the prime ideal (1 − 2α) which lies over 13. Then # E v (k v ) = 16 and hence by Proposition 2.10, ℓ | 16. Since ℓ is prime, we must have ℓ = 2, a contradiction. Therefore H(ℓ) = GL 2 (F ℓ ) for all ℓ = 2, 31.
We now use the following result which is a corollary of Lemma 2.3.
Remark. We have written code in Sage that automates the checking we did above and gives the prime ideals that one needs to satisfying the given conditions (see check sage.sws in [CFLTL]).

Constructing an Infinite Family
where α is the real root of x 3 + x + 1. In this section, we apply our criteria to obtain an infinite family of elliptic curves with maximal adelic image given full two-torsion over K. To do so, we obtain families of curves satisfying each of the requisite conditions: We are able to find congruence conditions on the coefficients of our elliptic curves ensuring each of these conditions, which we may then piece together using the Chinese remainder theorem.
Throughout this section, with b, c ∈ Z, let E b,c be the elliptic curve defined by 3.1. A family of semistable elliptic curves. Since the criteria we use for verifying maximality apply only to semistable curves, we must first find infinite families of semistable elliptic curves of the desired form. Such a family is furnished by the following proposition.
Proposition 3.1. Suppose that one of the following two conditions is satisfied: (i) b ≡ 5 (mod 12) and c ≡ 4 or 8 (mod 12).
Proof. Since O K is a unique factorization domain, we will speak freely of primes of K as numbers.
We establish the result for case (i). The proof for case (ii) is identical.
We also easily check that 2 is inert in K. Hence it suffices to prove that A is coprime to 2 and 1 − α. The former is clear. For the latter, observe that But b ≡ 2 (mod 3) and c ≡ 1 or 2 (mod 3), so 1 + b + c ≡ 0 (mod 3).
So we see that A and B are coprime, hence {A, B, C} are pairwise coprime. Now we note that for this Weierstrass form, ∆ = 16(ABC) 2 and c 4 = 16(A 2 − AB + B 2 ) If p = (2) is a prime dividing ∆, then it divides exactly one of A, B, C. Supposing that p | A, we see that The only prime left to consider is p = (2). Making the change of variables (x, y) → (4x, 8y + 4α 2 x), and noting that α 4 = −α(α + 1), we obtain the Weierstrass equation x.
Since A = α 2 + bα + c, we see that A − α − α 2 is divisible by 4, and hence the coefficients are in O K . For this Weierstrass form, ∆ = (ABC) 2 /16 and c 4 = A 2 − AB + B 2 . Since 2 | B and 2 ∤ A, we see that E is semistable at 2 as well.
3.2. A family with maximal mod 4 image. In this section, fix an elliptic curve E b,c . To verify maximal 2-adic image, we must first have maximal mod 4 image and then apply Proposition 2.9. That ρ 4 (G K ) is maximal is equivalent to [K(E[4]) : K] = 16. We will describe a procedure that may be used to determine congruence conditions on b and c which ensure that E has maximal mod 4 image. As an example, we prove the following: We emphasize that the congruence condition given in the proposition is just one of many possibilities. We begin with a general discussion. Recall that where x 1 , x 2 , x 3 are the x-coordinates of 4-torsion points not differing by a 2-torsion point. We may take x 1 , x 2 , x 3 to be the roots of the quadratics x 2 − 32(α 2 + α + 1)x + 16((b + c)α 2 + (c − 2)α + (c − b + 1)) which we obtained by factoring the 4-division polynomial for E, whose discriminants are, respectively, − 1)).
In addition, So to ensure this, it suffices to find prime ideals p 1 , p 2 , p 3 , p 4 such that for each i = 1, 2, 3, 4, we have d i is a non-square in (O K /p i ) × and d j is a square for j = i. If this is the case, then the product of any non-empty subset of d 1 , d 2 , d 3 , d 4 will fail to be a square in hence is obviously not a square in O K . Once ideals satisfying these conditions are found for a particular curve E : where b, c ∈ O K , then they will work for any curve 1 p 2 p 3 p 4 ) and c ≡ c ′ (mod p 1 p 2 p 3 p 4 ). We carried out this program by computer search (see test primes.sws in [CFLTL]). Many examples were found, but for brevity we simply list one.
3.3. A family with K(E[4]) ∩ K cyc = K(i). In this section, we describe congruence conditions on b, c which ensure that E b,c satisfies the field intersection condition Let d 1 , d 2 , d 3 , and d 4 be as Section 3.2. Collecting terms together, we find the following expressions.
(2) and d 4 = −64(α 2 + α + 1)d 3 . (3) Our key observation is that d 4 can be divisible by only a few rational primes, which limits the possible intersection by Lemma 2.8. This is made precise in the proof of the proposition below.
Proof. Let ∆ b,c denote the discriminant of E b,c . Assume that b, c are such that K(E b,c [4]) ∩ K cyc = K(i). Then by Lemma 2.8, K( √ n) = K( √ m), where n is an integer and m is a product of some subset of d 1 , d 2 , d 3 , d 4 . As n and m can only differ by a square of K, we have that some prime of Q divides m, hence some prime p of Q must divide d 1 d 2 d 3 d 4 .
Note that any prime of K dividing d 1 , d 2 , d 3 must ramify in K( √ d i )/K, and hence must divide ∆ b,c (as we already have that 2 | ∆ b,c ). For primes of K not lying above 31, dividing ∆ b,c is equivalent to dividing d 4 . So p | d 1 d 2 d 3 d 4 implies that either p | d 4 or p = 31 and p | ∆ b,c .

3.4.
A family with maximal ℓ-adic image. The tests for the remaining conditions can be easily modified into congruence conditions, as they all involve finding primes p of K such that O K /p and E (mod p) satisfy certain properties, all of which do not change if we fix the values of b, c (mod p ∩ Z). We will simply state the primes used, as the calculations are analogous to those in Section 1.2.
To show that the mod 8 representation is maximal for E b 0 ,c 0 , we consider the prime p = (3α 2 +2). As p ∩ Z = 29, the same is true for any curve with b, c ≡ b 0 , c 0 (mod 29).
To show that the mod 9 representation is surjective for E b 0 ,c 0 , we use the prime p = (2α 2 +α+4), which lies above 47. If b, c ≡ b 0 , c 0 (mod 47), the mod 9 representation is surjective for E b,c .
Putting this together, we get, just as in the previous section, that the image of the mod ℓ representation is maximal for all ℓ.
3.5. Proof of Theorem 3. We have already developed congruence conditions for each condition. We gather them together here. For convenience, we use the notation "cyc p " to refer to the mod p congruence condition in Proposition 3.3.

Non-Semistable Elliptic Curves and Nontrivial Narrow Class Group
Here we show how to extend Greicius's test for the surjectivity of the mod ℓ representation to arbitrary elliptic curves E with non-integral j E -invariant over arbitrary cubic number fields K. In particular, we do not need to suppose that the elliptic curve E is semistable over K.
To fix notation, we let Σ K denote the set of primes of K for a number field K. We let S E ⊆ Σ K be the set of primes of bad reduction of the elliptic curve E/K, and we let S ℓ be the set of primes above the rational prime ℓ. For a prime v ∈ Σ K , we let I v ⊆ G K denote the inertia subgroup at v. If w is a prime lying over v, we denote by f (w/v) and e(w/v), the residue degree and ramification index of w over v, respectively. If a Galois extension is unramifed at v, we denote by Frob v the Frobenius element of v in the Galois group of that extension. We let U v denote the v-adic units, O v the completion of O K at v, and m v the maximal ideal of O v . We let U K denote the group of units of O K , and we let U + K denote the subgroup of totally positive units. For a modulus m, in the sense of class field theory, we let U m,1 = U K ∩ K m,1 . All of this notation is identical to that of [Gre10] where applicable.
By a half-Borel subgroup of GL 2 (F ℓ ) we mean a subgroup stabilizing a subspace of F 2 ℓ and acting trivially on either the subspace or the quotient by it. In other words, some conjugate of the subgroup lies in the set of matrices of the form * * 0 1 or 1 * 0 * .
Remark. Throughout this section, words such as "larger," "smaller," and "bounded" are used in the sense of divisibility rather than absolute value.
To begin, we recall some useful results from [Gre10]. In [Gre10, Lemma 3.4], Greicius summarizes some results from [Ser72] on the inertia representation for the case of semistable elliptic curves. We restate these results, but note that most of the results only depend on the curve being semistable at a particular prime.
Lemma 4.1 ([Ser72]). Let K be a number field, ℓ a rational prime, and E/K an elliptic curve with j-invariant j E . Fix v ∈ Σ K and w ∈ Σ K with w | v.
Suppose for the next two that ℓ is unramified in K.
(ii) If v ∈ S ℓ , and E has ordinary reduction at v, then the image of D w is contained in a Borel subgroup, and I w acts via the trivial character and via a character of order p − 1. (iii) If v ∈ S ℓ , and E has supersingular reduction at v, then the image of I w is a non-split Cartan subgroup.
Suppose, furthermore, that E is semistable at v. As in [Gre10], we have the following:

Proposition 4.2. Suppose E/K is an elliptic curve with j-invariant j E , and suppose ℓ is a prime that does not ramify in
Proof. By Lemma 4.1(v), we know that the mod ℓ image contains an element of order ℓ. It thus must either contain SL 2 (F ℓ ) or be contained in a Borel subgroup (see [Ser98], IV.3.2, Lemma 2). As ℓ does not ramify in K, the intersection of K with Q(µ ℓ ∞ ) is Q, so the determinant modulo ℓ is surjective. Therefore, in the former case, the image is GL 2 (F ℓ ).
Remark. In practice, we find elliptic curves with one v such that v(j E ) = −1, so that v works for all ℓ. However, one can extend the result to other elliptic curves, if necessary by checking explicitly other ℓ using Proposition 2.12. Also note that if ℓ = 2, 3 (or just ℓ = 2 if E has full 2-torsion over K), we only need v to be potentially multiplicative, since, as we will see below, E becomes semistable over an extension of degree divisible only by the primes 2 and 3.
Assuming ℓ ∤ v(j E ) for v multiplicative, let us suppose that the mod ℓ representation is not surjective. It follows that the representation ρ E,ℓ takes the form Note that the Borel subgroup and hence the characters depend purely on the 1-dimensional vector subspace of E[ℓ] left invariant by that subgroup. We call these the isogeny characters relative to that subspace.
In fact, the pair of isogeny characters is independent of which subspace we choose. Although we will not truly need this fact until Lemma 4.10, we prove it now. In [Gre10], Greicius shows that in the situation above, if E is semistable, and K satisfies certain technical properties, then one of these isogeny characters is unramified. In that case, because the narrow class group of K is trivial, that character is trivial. Greicius uses this to show that ℓ divides the number of points modulo any prime of good reduction.
As stated earlier, we would like to extend his results ruling out all but finitely many ℓ to nonsemistable curves and more general K. In order to do this, we would like to analyze how much the two characters χ 1 , χ 2 can ramify.
First, we briefly note what happens at semistable primes not dividing ℓ.
Lemma 4.4. Suppose that ρ ℓ : ) is contained in a Borel subgroup. Then the isogeny characters are unramified at any v / ∈ S ℓ at which E has semistable reduction.
Proof. If E has good reduction at v, then ρ ℓ itself is unramified. If E has multiplicative reduction at v, we know by Lemma 4.1 that the image of I v has order dividing ℓ. As the characters have codomain F × ℓ , which has order ℓ − 1, the characters are trivial on I v . 4.1. Non-semistability. Next, we would like to tackle the primes at which E is not semistable. We will only cover those primes not dividing ℓ, then assume at the end that ℓ is a rational prime not lying under any prime of additive reduction.
We say that an elliptic curve E/K is Legendre over K if E is isomorphic over K to a curve in Legendre form y 2 = x(x − 1)(x − λ). If the elliptic curve y 2 = f (x), where f is a cubic polynomial over K, has full 2-torsion over K, then we can write the equation in the form with a, b, c ∈ K. Over K, the curve can be written in Legendre form, but that does not mean that the curve is Legendre over K. More precisely, we have the following well known fact (see Proposition III.1.7 in [Sil09]). In order to deal with non-semistability, we would like to know over what field the curve becomes semistable. An explicit form of the semistable reduction theorem states that this is true for an abelian variety if we adjoin the 12-torsion (see for example, [Abb00, Proposition 5.10]). However, in the case of elliptic curves, we have the following lemma Lemma 4.6. Suppose E/K is an elliptic curve with full 2-torsion over K and additive reduction at v ∈ Σ K . Then: • If E has potentially good reduction at v, then there is an extension L/K of ramification index at most 2 over which E has good reduction.
• If E has potentially multiplicative reduction at v, then there is an extension L/K of ramification index at most 4 over which E has multiplicative reduction. Furthermore, suppose E is Legendre over L/K. If v does not ramify in L, then the above indices are 1 and 2, respectively.
Proof. By the proof of Proposition 5.4 in [Sil09, Chapter VII], a Legendre curve has good reduction at all primes of potentially good reduction, and otherwise has multiplicative reduction at v after adjoining the square root of a uniformizer at v. Finally, a curve with full 2-torsion becomes Legendre over an at most quadratic extension of K.
We know that over some extension L/K, one of the characters is trivial. Therefore, we could count the points over the residue fields of L and take the greatest common divisor of these values. We should note first that computing in number fields is ineffective and impractical. Therefore, it makes more sense to compute [L : K] and then take the unique finite field of that degree (over the residue field of K), then compute the number of points of our elliptic curve over that finite field.
In order to trivialize one of the characters, one could take a field over which E is semistable. Over this extension and under the conditions above, one of our characters would be unramified at every finite prime not dividing ℓ. It would follow that that character becomes trivial over the narrow Hilbert class field of this extension. However, the analysis of primes dividing ℓ does not work over this field, which means that we must find a different method.
We put bounds on the ramification of non-semistable primes at each of these characters. Then, since the extensions defined by the characters are abelian, they have conductors by class field theory, and we can use these bounds on the ramification indices to control the conductor of this extension. Therefore, assuming one of the characters is unramified at all primes of semistable reduction, the character is trivialized over the ray class field associated to this conductor.
One advantage is that the splitting of primes in the ray class field is described explicitly by the Artin reciprocity law, so we can actually bound the order of the image of the Frobenius element under the character. Note that Magma can compute the order of a given ideal in the ray class group, so this method can be easily implemented. Finally, note that once we fix the field K, the computation of the ray class group for different moduli m is very easy by the exact sequence , the only difficult part being computing the narrow class group. Conversely, the method outlined above involves computing an ideal class group that depends on the modulus and hence on the elliptic curve. Therefore, if one is working with many elliptic curves over the same field, our method works much better.
We suppose for simplicity from now on that 2 does not ramify in K. We also suppose for the next two sections that the mod ℓ representation is contained in some (fixed) Borel subgroup, hence has isogeny characters χ i for i = 1, 2.

Curves with full 2-torsion.
Lemma 4.7. Let E/K have full 2-torsion over K. Suppose v / ∈ S ℓ . Then the following are true (1) If v / ∈ S 2 , each character χ i is not wildly ramified at v, and if v ∈ S 2 , each character is ramified of index dividing 4.
(2) If v ∈ S 2 does not ramify in an extension over which E is Legendre, or is of potentially good reduction, the index is 2 (or 1 if both happen).
Proof. By Lemma 4.4, we know that if E has semistable reduction at v, then both characters are unramified at v. By Lemma 4.6, the curve becomes semistable at v over an extension of degree 4 obtained by first putting the curve in Legendre form (which happens over some quadratic extension) and then adjoining the square root of a uniformizer at v. If it is potentially good at v, this happens after obtaining Legendre form. Over this extension, E is semistable at v, so both of the isogeny characters are unramified at v by Lemma 4.4. If v ∤ 2, this means that the extension is not wildly ramified at v. If v | 2, the above follows immediately from the description of the field over which E becomes semistable at v in Lemma 4.6.
We recall that for a place v and an abelian extension L/K, there is a "conductor" of the extension at v, which is the smallest power m k v of m v , the maximal ideal at v, such that 1 + m k v is in the kernel of the local Artin map. The conductor of a character χ i is the conductor of the extension defined by χ i . The global conductor is the product of the local conductors. An abelian extension of given global conductor is contained in the ray class field associated to that conductor, and a character with that global conductor is trivial over that ray class field. We say that the conductor of L/K outside a set S ⊆ Σ K is the product of the local conductors at all v / ∈ S.
Proposition 4.8. Suppose E is Legendre over L/K. For v ∈ S 2 , let r(v) = 3 if v ramifies in L or E has potentially multiplicative reduction at v, 0 otherwise. Let s(v) = 1 if f (v/2) = 1, v ramifies in L, and E has potentially multiplicative reduction at v, and 0 otherwise. Then let if E has additive potentially good reduction at v, v does not ramify in L, and v ∤ 2, 1 if E has additive reduction at v and v ∤ 2 otherwise.
Then if we let m f = v∈Σ K v i(v) and m the product of m f with all real places, the conductor of the extension defined by χ i is at most m outside S ℓ .
Proof. Lemma 4.7 gives us bounds on the ramification of the extension defined by the characters. We need only translate these into bounds on the conductor of the extension.
As mentioned, the extension is unramified at any primes of semistable reduction. We also know the extension is unramified at v if v does not ramify in L and is potentially good. Furthermore, as the index is a power of 2, it is tamely ramified at all primes other than 2. This means that the conductor has exponent at most 1 at that prime.
In the case of v | 2, we use the description of the local Artin map to compute the conductor. The image of U v under the local Artin map is the inertia group at v in the extension, and we know that this image is of order bounded by 4 (respectively, 2), so its kernel has index at most 4 (respectively, 2). We thus wish to classify subgroups of U v of index at most 4 or 2. Since 2 is not ramified in K, the v-adic exponential converges for |x| v < 1/2, meaning that 1 + m 2 v O v , is isomorphic to O v as a topological group. This latter is pro-cyclic, hence has a unique open subgroup of given index. If the index is at most 4, and f (v/2) > 1, then has order at least 4, so this kernel contains 1 + m 3 v O v , and the conductor is at most m 3 v at v. In the case that the index is only bounded by 4 (by the previous proposition), and f (v/2) = 1, has order 4, so the conductor is bounded by m 4 v at v. Remark. If one does not wish to compute L above, one can always suppose that v ramifies in L. Then r(v) is always 3, and s(v) = 1 if v(j) < 0 and f (v/2) = 1, and s(v) = 0 otherwise. This is what we did in our calculations. However, we included the most general result for completeness, and because it may reduce the computation time for much larger fields. 4.3. General curves. We now do not assume the curve has full 2-torsion in order to apply our results to the search for curves whose adelic representation is surjective. Once again, we suppose from now on for simplicity that 3 does not ramify in K.
We know that after passing to a degree 6 extension, the curve has full 2-torsion. It follows that, after passing to an extension of degree at most 24, our curve becomes semistable. We therefore get the same bounds for ramification indices as in Lemma 4.7, but we must multiply each of them by 6. We translate these into bounds on the conductor of the character: Proposition 4.9. For v ∈ S 2 , let r(v) = 2 if E has potentially good reduction at v and r(v) = 3 if E has potentially multiplicative reduction at v.
if E has additive reduction at v and v ∤ 6, 2 if E has additive reduction at v and v ∈ S 3 , if E has additive reduction at v and v ∈ S 2 .
Then if we let m f = v∈Σ K v i(v) and m the product of m f with all real primes, then the conductor of the extension defined by χ i is at most m outside S ℓ .
Proof. Once again, if E is semistable at v, there is no ramification. If v ∤ 6, then the ramification is not wild at v, so the conductor has power at most 1 at v. As for v | 3, the v-adic logarithm shows that 1 + m v O v ∼ = O v as topological groups (assuming that 3 does not ramify in K), so the kernel of the character must contain 1 + m Finally, if v | 2, then (assuming 2 does not ramify in K), the group 1 + m 2 v O v is pro-cyclic, ) has order f (v/2), so the exponent of the conductor is at most 2 + ⌈r(v)/f (v/2)⌉ if the 2-part of the ramification index is at most 2 r(v) . The values of r(v) follow from the values from the previous section, but with ramification indices multiplied by 6. 4.4. Cubic Fields. Next, we deal with v ∈ S ℓ . In [Gre10], Greicius uses Corollary 3.6 to analyze this case. This relies on the fact that K = Q(α), α 3 + α + 1 = 0, α ∈ R has trivial narrow class group and the fact that there exists a totally positive unit u of K such that u − 1 is also a unit. To extend his result, we prove the following proposition for general cubic fields: Then one of the characters χ i is unramified at every semistable v ∈ S ℓ .
Proof. We divide our argument into cases based on the splitting of ℓ in K.
Case 1: ℓ is inert. Then there is a unique place v of K above ℓ. As the image of ρ ℓ contains an element of order ℓ, the image cannot be contained in a non-split Cartan subgroup, so E has ordinary or bad reduction at v by Lemma 4.1(iii). In each case, Lemma 4.1 tells us that the image of inertia is a half-split Cartan subgroup or a half-Borel subgroup, implying that the character is unramified at v.
Case 2: ℓ splits completely. Suppose (ℓ) = pqr. By the previous case, we see that each prime above ℓ is unramified at at least one of the characters. By the pigeonhole principle, one of the characters, say χ i , is unramified at at least two of the primes above ℓ. Suppose without loss of generality that it is unramified at q and r, and suppose it is ramified at p.
As #F × ℓ = ℓ − 1, which is prime to p, the character χ i is not wildly ramified at p. Its conductor is therefore at most mp, by either Proposition 4.8 or Proposition 4.9, respectively. It follows that χ i factors through the ray class field L mp , i.e. it factors through C mp K under the Artin map. Now, we have an exact sequence Suppose that χ i is ramified at p. By the hypothesis, u ik − 1 is prime to ℓ, hence not divisible by m f p, for all ik ≤ dr. For i such that k ∤ i ≤ dr, we know that u i − 1 is not divisible by m f p. Therefore, we know that u has order greater than dr in U + K /U mp,1 , and the same is true of its image as ℓ does not lie below any primes of additive reduction, hence any primes dividing m. This means that As u has order greater than dr, the cokernel of U + K /U mp,1 → (O K /m f p) × has order less than ℓ/d.
Let D denote this cokernel. By our exact sequence above, D is also equal to the kernel of the surjection C mp ℓ has index at most d, hence is of order at least ℓ/d. But we have already shown that D has order less than ℓ/d, so it cannot surject onto a group of order at least ℓ/d. This contradiction shows that χ i cannot be ramified at p.
Case 3: ℓ splits as pq where f (p/ℓ) = 1. Then one of the characters is unramified at q, so we apply the same argument with that character at p to show that it cannot be ramified at p.
This completes the proof.
Remark. If K = Q, the lemma is automatically true because only Case 1 can occur.
We now combine our results into the following.
Theorem 4.11. Let E/K be an elliptic curve over a cubic field K not Galois over Q. If E has full 2-torsion over K, let m be as in Proposition 4.8, and otherwise, let m be as in Proposition 4.9. Let ℓ be a prime of Q such that: (1) ℓ does not ramify in K (2) There is a prime v at which E has semistable reduction and such that ℓ ∤ v(j E ) < 0 (3) ℓ does not lie below any primes of K at which E is not semistable (4) We have u is a positive fundamental unit of K, and k is the order of u in U + K /U m,1 If ρ ℓ (G K ) GL 2 (F ℓ ), then one of the characters χ i is trivial over the ray class field L m of K of conductor m.
Proof. By Proposition 4.2, the first two conditions on ℓ imply that the characters exist. Proposition 4.8 or Proposition 4.9, respectively, shows that character has conductor m outside of S ℓ . The third condition means that E is semistable at all of S ℓ , so Lemma 4.10 implies that one of the characters χ i is unramified at all of S ℓ . As it is unramified at S ℓ , we know that m is its conductor, and thus it is trivial over L m .
Corollary 4.12. Let m, E/K, and ℓ be as above, and let n be the order of v in #C m K , where v ∤ m is a prime of good reduction. Let l v be the unique degree n extension of k v . Then if ρ E,ℓ (G K ) = GL 2 (F ℓ ), we have ℓ | # E v (l v ) (equivalently, the reduced curve has an ℓ-torsion point).
Remark. Note that this is also true if we replace n by one of its multiples, since then we only get a larger l v . In particular, if we do not wish to compute the order of v in the ray class group, we can just let n always equal #C m K .
This gives us an efficient way to test for surjective image. In searching for examples, we restricted our attention to those E with multiplicative reduction at a prime v such that v(j E ) = −1. For the other ℓ, we use Proposition 2.12.
Remark. We can replace (2) in each criterion with v potentially multiplicative, as explained in Remark 4. Therefore, in most generality, our method extends to arbitrary elliptic curves with non-integral j-invariant over arbitrary cubic (and quadratic) fields K.

Further examples.
In this section we briefly mention two examples that result from our theory developed above. These examples were found using Theorem 4.11 and Corollary 4.12 and methods similar to Section 3.4 of [Gre10] and Example 1.2. Due to the similarities, we content ourselves with just briefly mentioning the proof.

Remarks on higher torsion
Although we initially raised the problem of explicitly computing Galois representations for elliptic curves with arbitrary specified torsion data, we have primarily worked with 2-torsion in this paper. After all, it is significantly easier to produce examples of elliptic curves with 2-torsion, and to work with explicit formulas for the 2-division-polynomials. This is advantageous, for example, in verifying that the "mod 4" Galois representation is maximal (i.e. [K(E[4]) : K] = 16), and in producing the appropriate congruence conditions in Section 3 However, many of our methods can be applied to elliptic curves with more general torsion, as we now demonstrate. We will be content to give a discussion of examples, rather than attempting to write out fully general results.
As we have observed, torsion data for E/K amounts to giving some restrictions on the "mod ℓ k " representation ρ E,ℓ k (G K ) ⊂ GL 2 (Z/ℓ k Z).
We are interested in knowing when the adelic Galois representation is maximal given such a restriction. One has to take different steps to verify that the ℓ-adic Galois representation is maximal, and also account for a different abelianization map. The latter is equivalent to computing the commutator subgroup of the desired ℓ-adic image, which is reduced to a finite computation by the refinement lemmas. Likewise, one verifies that the ℓ-adic image is maximal by checking that the "mod ℓ k " image is maximal and that the image of the Galois representation also contains the entire kernel of the reduction map ρ E,ℓ k+1 (G K ) → ρ E,ℓ k (G K ). The first matter depends on the particular nature of the torsion data given; for instance, we consider the case of full ℓ-torsion over K, in which case there is nothing to check, but if there is just one cycle of ℓ-torsion points then one is looking for a "half-Borel" subgroup. We will not discuss the various cases, but instead focus on the problem of passing from finite to infinite: assuming that ρ E,ℓ k (G K ) is known, how may we check that ρ E,ℓ ∞ is the pre-image of ρ E,ℓ k (G K ) under the reduction mod ℓ k map? In the paper, we simply used the four-division polynomials for E, but this is infeasible for large ℓ, so we indicate a method by analyzing Frobenius elements. Note that the Chebotarev Density Theorem certainly implies that if the ℓ-adic Galois representation is maximal as desired, then a positive density of such elements must exist.
We illustrate by considering a particular example. Suppose E/K has exactly one ℓ-torsion cycle for some prime ℓ > 2. Suppose we want to show that ρ E,ℓ ∞ (G K ) is the full pre-image of the half-Borel subgroup 1 * 0 * ⊂ GL 2 (Z/ℓZ).
By Serre's refinement lemma, it suffices to show that this half-Borel is in fact the mod ℓ image, and to show that ρ E,ℓ 2 (G Q ) ⊃ I + 2Mat 2×2 (Z/ℓZ). To address the first question, we see that the mod ℓ image must be the half-Borel or the half-Cartan: 1 * 0 * or 1 0 0 * Now, suppose σ = Frob p is found whose action on the ℓ-torsion points has characteristic polynomial factoring as T 2 − a p T + p ≡ (T − 1) 2 (mod ℓ).
We would like to know whether or not σ is contained in the half split-Cartan subgroup. Since (ρ E,ℓ (σ) − I) 2 ≡ 0 (mod ℓ), if it is contained in the half split-Cartan then σ = I + ℓM for some M ∈ GL 2 (Z ℓ ). The characteristic polynomial of M is then T 2 − a p − 2 ℓ T + 1 + p − a p ℓ 2 .
In particular, ℓ 2 | 1 + p − a p . So if this ever fails, we know that ρ E,ℓ was not contained in the split Cartan. We now address the second question, which is a generalization of the arguments in [LT76], p. 56-57. This group I + 2Mat 2×2 (Z/ℓZ) is an abelian group isomorphic to (Z/ℓZ) 4 ; we must obtain four independent elements.
We recall the following fact: if the characteristic polynomial of a 2 × 2 matrix with coefficients in Z ℓ factors with distinct roots when considered modulo ℓ, then it is diagonalizable over Z ℓ . Note that it is not sufficient for the roots to be distinct modulo ℓ 2 (indeed, the polynomial may very well have four roots in Z/ℓ 2 Z).
Step One. It is easy to obtain diagonalizable, non-scalar elements. As outlined in the paper, we may compute the characteristic polynomial of a Frobenius element at σ = Frob p : T 2 − a p T + p, where a p = p + 1 − #E(F p ). Suppose this polynomial factors mod ℓ 2 as a product of two linear polynomials with distinct roots λ 1 , λ 2 such that λ 1 ≡ λ 2 (mod ℓ). Then ρ E,ℓ ∞ (Frob p ) may be diagonalized over Z ℓ , so it will have the form σ ≡ λ 1 + ℓ 2 x 1 0 0 λ 2 + ℓ 2 x 2 .
Remark. This can only fail if the image of Galois mod ℓ is trivial, since this only fails to occur when the image is contained in the normalizer of a non-split Cartan. This is impossible under our torsion assumptions. On the other hand, the image mod ℓ is trivial only for small ℓ, in particular ℓ = 2 for K = Q.
Step Two. Next, suppose that a Frobenius element σ is found with characteristic polynomial as above, but such that λ ℓ−1 1 ≡ λ ℓ−1 2 (mod ℓ 2 ). Then we are guaranteed that σ ℓ−1 is a scalar matrix. Adopting the basis with respect to which the matrix from the previous part is diagonal, we see that in this basis we would have all diagonal matrices. (The point is that we have no way of telling in which bases the diagonal matrices obtainable in (1) are diagonalizable. However, scalar matrices are scalar in every basis! We cannot obtain scalar matrices by the method in (1) since their eigenvalues are obviously guaranteed not to be distinct modulo ℓ.) Step Three. Now, suppose that we have produced σ ∈ ρ ℓ ∞ with σ = I + ℓM , for some M ∈ GL 2 (Z ℓ ). The characteristic polynomial of M is then and if this is irreducible (mod ℓ) then we know that σ cannot be put into upper-triangular form in any basis. Adjusting by diagonal elements already obtained, we obtain an element of the form where b, c = 0. It remains to discuss how to produce such a sigma. Suppose σ = Frob p is found with characteristic polynomial factoring as T 2 − a p T + p ≡ (T − 1) 2 (mod ℓ).
which implies that (σ − I) 2 ≡ 0 (mod ℓ). If σ is congruent to the identity modulo ℓ, then we know that σ = I + ℓM . We test this in the example below by checking for full ℓ-torsion in E(F ℓ ). An alternative approach is to observe that σ ℓ must be congruent to the identity modulo ℓ, and we can compute its characteristic polynomial from that of σ (We have σ ℓ = Aσ + B by using the relation of the characteristic polynomial, and similarly obtain another linear relation for σ 2ℓ ).
Step Four. Finally, we observe that we may conjugate any element of G by any other element. We have already shown that we have all diagonal matrices, and the previous part guarantees a matrix of the form I + ℓ 0 b c 0 (mod ℓ 2 ). Conjugating this by ( 1 0 0 u ) where u = 1, we obtain 0 u −1 b uc 0 .