Recovering the level of distribution x^{1/2} for the orders of y^2 = x^3 - x modulo p

Abstract

Iwaniec and Jimenez Urroz (Ann. Sc. Norm. Super. Pisa 9 (2010), 815-832) proved that for >> x/(log x)^2 primes p <= x, p = 1 (mod 4), the order of the reduction modulo p of the elliptic curve y^2 = x^3 - x is eight times an integer with at most two prime factors. Xie (arXiv:2504.18732, Remark 4.1) pointed out that the proof of their level-of-distribution estimate is incorrect: the inclusion-exclusion that converts a rational divisibility condition d | N(pi - 1) into congruences in Z[i] produces ideals of norm up to d^2, so that the Bombieri-Vinogradov theorem for Q(i) only gives level x^{1/4 - epsilon}. This note shows that the estimate is nevertheless true at level x^{1/2} (log x)^{-B}: a square-free ideal factors as (c) g with c its rational part, its norm equals c times its least positive integer d(a), the ideals with large c are rare, and their contribution is bounded trivially by counting lattice points. The same argument applies to the switched sequence of the Chen-type part of the proof. Consequently the theorem of Iwaniec and Jimenez Urroz holds as stated, and Lemma 3.3 of Xie's paper holds with level x^{1/2 - epsilon}; this improves her bounds for orders over prime power fields: |E(F_{p^2})| / (4 |E(F_p)|) has at most three prime factors, and Omega(|E(F_{p^l})| / |E(F_p)|) <= floor(2.05 (l - 1) + 1.2) for odd primes l, for >> x/(log x)^2 primes. The archive contains the manuscript (LaTeX source and PDF, 10 pages), self-contained Python scripts (interval-arithmetic certification of the weighted-sieve functional, linear-sieve functions, a first-principles numerical check of the inclusion-exclusion bookkeeping at x = 10^8, and the exploration of the almost-prime bound as a function of the level), the resulting data tables and figure, and the raw outputs. Development repository: https://github.com/Ruqing1963/cm-orders-level-half (tag v1.0).