# Distribution of elliptic curves with rank 2?

An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how common (or rare) are rank-2 elliptic curves defined over $$\mathbb{F}_{q}$$ for a prime power $$q$$.

(They don't seem rare. For a fixed prime $$p$$ of 64 bits, I sampled 1000 random curves defined over $$\mathbb{F}_p$$ and got 170 curves of rank 2. Same experiment with a 128-bit $$p$$ yields 208 such curves. )

• It's not true that we only use curves with cyclic group structure: Pairing-friendly curves have full $\ell$‑torsion defined over a small extension! It might not always be obvious with the way things are written down, but there's always an $E[\ell]=\mathbb Z/\ell\times\mathbb Z/\ell$ somewhere under the hood. Jun 14, 2022 at 6:53

For prime $$p$$, let us denote by $$C(p)$$ the probability that a random elliptic curve $$E/\mathbb{F}_p$$ satisfies that $$E(\mathbb{F}_p)$$ is cyclic (this depends slightly on how one defines a “random” elliptic curve, but most reasonable ways—choosing the isomorphism class at random, choosing the $$j$$-invariant at random and then a random twist, choosing the short Weierstrass coefficients at random, etc.—should give basically the same result asymptotically). Then I claim that, for large $$p$$, we have: $$C(p) = \prod_{\ell |p-1} \Big(1-\frac{1}{\ell^3-\ell}\Big) + o(1), \tag{1}$$ where the product is over all the prime divisors of $$p-1$$ (and one could write a more precise bound for the error term if one wanted). This implies in particular that: $$\limsup_{p\to\infty} C(p) = 1-\frac{1}{2^3-2} = \frac{5}{6} \approx 0.833,$$ and: $$\liminf_{p\to\infty} C(p) = \prod_{\ell} \Big(1-\frac{1}{\ell^3-\ell}\Big) \approx 0.788.$$
This is because $$E$$ is non-cyclic (I don't think “rank 2” is a very good name for this) if and only if there exists a prime $$\ell$$ such that $$E$$ has full $$\ell$$-torsion over $$\mathbb{F}_p$$, or equivalently, such that the Frobenius endomorphism of $$E$$ acts as the identity on $$E[\ell]$$.
Now, standard equidistribution results (see e.g. Theorem 2 in this paper of Castryk and Hubrechts) say that, for fixed $$\ell$$ and large $$p$$, the Frobenius acting on $$E[\ell]$$ is essentially uniformly distributed among $$2\times 2$$ matrices of determinant $$p$$ over $$\mathbb{F}_\ell$$ as $$E$$ ranges over elliptic curves over $$\mathbb{F}_p$$. This means that the probability of getting the identity is $$0$$ if $$p\not\equiv 1\pmod\ell$$, and $$1/\#\mathop{\textrm{SL}}_2(\mathbb{F}_\ell) = 1/(\ell^3-\ell)$$ otherwise.
This gives formula $$(1)$$, and the lim inf and lim sup results are obtained by choosing large primes $$p$$ that are congruent to $$1$$ (resp., something else) modulo all the primes $$\ell$$ from $$3$$ to some arbitrarily large bound.
(And as you can see, the probability you get depends much more on what the factors of $$p-1$$ look like than on the size of $$p$$ per se).
• The rank of a $\mathbb{Z}$-module $M$ is usually defined as the dimension of the $\mathbb{Q}$-vector space $M\otimes_{\mathbb{Z}} \mathbb{Q}$,which for a torsion module is always zero. Jun 21, 2022 at 8:36