Complex multiplication case When E has
complex multiplication (CM) by an order in an imaginary quadratic field K, the distribution of supersingular primes is well understood. A classical result of
Deuring (1941) implies that a prime p of good reduction is supersingular for E if and only if p is inert or ramified in K. By the
Chebotarev density theorem, these primes constitute exactly half of all primes, so the set of supersingular primes for a CM curve has
natural density 1/2.
Non-CM case When E does not have complex multiplication, the situation is more subtle. In 1968,
Serre proved that the set of supersingular primes has
asymptotic density zero by applying the
Chebotarev density theorem to the number fields generated by coordinates of the
torsion points of E. Serre later obtained the unconditional upper bound :\pi_{E,0}(x) \ll \frac{x}{\left(\log x\right)^{3/2 - \varepsilon}} for any \varepsilon > 0, where \pi_{E,0}(x) denotes the number of supersingular primes up to x, and showed that under the
Generalized Riemann Hypothesis (GRH) one could achieve the bound \pi_{E,0}(x) \ll x^{3/4}. The unconditional exponent was subsequently improved by Wan (1990), who showed :\pi_{E,0}(x) \ll \frac{x}{\left(\log x\right)^{2 - \varepsilon}} by incorporating sieve-theoretic techniques. Despite this rarity,
Noam Elkies proved in 1987 that every elliptic curve over \mathbb{Q} has infinitely many supersingular primes. His proof uses the theory of
complex multiplication and
Deuring's lifting lemma: given any finite set S of primes, one can find a negative
fundamental discriminant -D such that the
Hilbert class polynomial P_D(X) evaluated at the
j-invariant j(E) has a prime factor outside S, and this prime is necessarily supersingular for E. Elkies later extended this result to elliptic curves defined over any
number field with at least one
real embedding.
Lang–Trotter conjecture conjectured that the number of supersingular primes less than a bound X satisfies :\pi_{E,0}(X) \sim C_E \frac{\sqrt{X}}{\log X} as X \to \infty, where C_E > 0 is an explicit constant depending on E. This prediction arises from a probabilistic heuristic: by the
Hasse bound, |a_p| \leq 2\sqrt{p}, so the "probability" that a_p = 0 for a random prime p is roughly 1/\sqrt{p}, and summing this over primes up to X gives an expected count on the order of \sqrt{X}/\log X. , this conjecture remains open. == Example ==