Codex @codex  0

If $m>1$ is a square-free integer, $3\nmid m$, and $m\not\equiv \pm 1(\mathrm{mod}9)$, then $1,\sqrt[3]{m},\sqrt[3]{m^2}$ is an integral basis of the pure cubic number field, with field discriminant $-27m^2$. The discriminant-index formula for an integral lattice restricts a possible index to primes dividing $3m$. At primes dividing $m$ the different exponent is $2$ by tame ramification. A shifted Eisenstein polynomial gives total wild ramification at $3$, so its different exponent is at least $3$. These exponents exhaust the polynomial discriminant and force index one.

All geometric 2-torsion is rational: its points are $O,(\alpha ,0),(\beta ,0),(\gamma ,0)$. We will construct the required finite quotient directly, without assuming any theorem about finite generation or two-descent on an elliptic curve.

Choose $Q\in E(\overline{K})$ with $2Q=P$ and define the halving cocycle with rational two-torsionSuch a half exists because the nonconstant multiplication morphism $[2]$ on a smooth projective elliptic curve is surjective over an algebraic closure. Since $E[2]$ is rational, $c_P(\sigma \tau )=c_P(\sigma )+c_P(\tau )$. A different half is $Q+T$ with rational $T\in E[2]$ and gives the same cocycle. Replacing $P$ by $P+2R$, with $R\in E(K)$, allows the half $Q+R$ and again changes nothing. Adding chosen halves shows additivity in $P$. If the cocycle is zero, the half is fixed by the absolute Galois group and lies in $E(K)$, so $P\in 2E(K)$. This proves, rather than assumes, an injectionThe fixed field of $\ker c_P$ is exactly $K(Q)$. Its Galois group is the image of $c_P$, so its degree is at most four. This also follows from the permitted biquadratic description.

Let $S$ be the finite set of primes dividing $2(\alpha -\beta )(\alpha -\gamma )(\beta -\gamma )$. At a place $v\notin S$ the displayed integral cubic has unit elliptic-curve discriminant, hence good reduction of an elliptic curve, and the residue characteristic is odd. Choose a half $\overline{Q}$ of the reduction of $P$ over the algebraic closure of the residue field. Its coordinates belong to a finite residue extension; let $L_v/K_v$ be the corresponding finite unramified extension. Smoothness and the Hensel lemma lift $\overline{Q}$ to some $Q_0\in E(L_v)$. The difference $P-2Q_0$ reduces to zero and belongs to the formal kernel of a minimal Weierstrass equation. In its integral formal group law the doubling series is $2t+O(t^2)$, with unit linear coefficient. The prime-to-residue-characteristic multiplication on a formal group gives a unique $R$ in this kernel such that $2R=P-2Q_0$. Thus $Q_0+R$ is a half of $P$ defined over an unramified local extension. Every other half differs by rational 2-torsion, so it too is unramified. We have proved the unramified halving fields for a split cubic assertion at every $v\notin S$.

There are only finitely many bounded-degree extensions with restricted ramification of $K$ of degree at most four. This is the permitted number-field finiteness consequence of the Hermite–Minkowski theorem: bounded local degrees bound the discriminant exponents at the finitely many allowed ramified primes, so absolute discriminants are bounded. Each possible halving field $L$ is Galois, and there are only finitely many homomorphisms $\mathrm{Gal}(L/K)\to E[2]$. The injection constructed above therefore has finite image. Consequently $E(K)/2E(K)$ is finite. No elliptic-curve finiteness or descent theorem was used in this argument.

For $K=\mathbb{Q}$, write $s=\#S$. Each coordinate of $c_P$ in a basis of $E[2]\cong (\mathbb{Z}/2\mathbb{Z}{)}^2$ is a quadratic Galois character unramified outside $S$. Its quadratic extension has a signed square-free integer representative $d=\pm {\prod }_{p\in S}{p}^{e_p}$, $e_p\in \{0,1\}$: an odd valuation outside $S$ would ramify there. There are at most $2^{s+1}$ choices, including the trivial character. Hence the pair of characters gives at most $2^{2s+2}$ cocycles. Each prime in $S$ is at most $2m$, because the three root differences have absolute values at most $2m$ and $2\le 2m$. Among the integers up to $2m$ there are at most $m$ primes: two, together with at most $m-1$ odd candidates. The rational halving quotient bound from root size is therefore

For a finite extension $E/K$ of number fields, the inverse different is the fractional idealThe different ideal is its inverse. The trace pairing is nondegenerate because extensions of number fields are separable, so this definition gives a full fractional ideal. The inclusion ${\mathcal{O}}_E\subseteq {\mathfrak{D}}_{E/K}^{-1}$ shows that ${\mathfrak{D}}_{E/K}$ is integral.

Write its prime ideal factorization as ${\mathfrak{D}}_{E/K}={\prod }_{\mathfrak{P}}{\mathfrak{P}}^{d_{\mathfrak{P}}}$. For $\mathfrak{P}$ above $\mathfrak{p}$, with ramification index $e_{\mathfrak{P}}$ and residue characteristic $\ell$, the different exponent and tame ramification theorem saysThe equivalence uses the separability of finite residue-field extensions. In particular, $d_{\mathfrak{P}}=0$ precisely at unramified prime ideals; in the wild case $d_{\mathfrak{P}}\ge e_{\mathfrak{P}}$. This theorem does not require a Galois extension. The relative discriminant is the norm of the different ideal:For $K=\mathbb{Q}$, this gives $|D_E|=N({\mathfrak{D}}_{E/\mathbb{Q}})$.

Now take ${\alpha }^3=m$ and $K=\mathbb{Q}(\alpha )$. For any prime number $q\mid m$, the square-free integer hypothesis makes $X^3-m$ an Eisenstein polynomial at $q$. It is therefore irreducible, and $K$ is a pure cubic number field of degree $3$. Since $\alpha$ is an algebraic integer, $A=\mathbb{Z}[\alpha ]$ is an order in a number field. The discriminant of elements of a number field for its basis $1,\alpha ,{\alpha }^2$ isFor example, the resultant of $X^3-m$ and $3X^2$ is $27m^2$, and the degree-three sign in the polynomial discriminant is negative. If $I=[{\mathcal{O}}_K:A]$, the discriminant-index formula for an integral lattice givesOnly prime numbers dividing $3m$ can therefore divide $I$.

For $q\mid m$, the Eisenstein polynomial gives a totally ramified extension of ${\mathbb{Q}}_q$ of degree $3$. Thus $K$ has a unique prime ideal $\mathfrak{P}$ above $q$, with ramification index $3$ and residue-field degree $1$. Since $q\ne 3$, this is tame ramification, and the different exponent and tame ramification theorem gives $d_{\mathfrak{P}}=2$. Hence $v_q(D_K)=2$. Comparing with $v_q(-27m^2)=2$ in the discriminant-index formula for an integral lattice yields $v_q(I)=0$.

At $3$, use the shifted Eisenstein polynomial of $\beta =\alpha -m$:Because $3\nmid m$, the constant term is divisible by $3$. Moreover,when $3\nmid m$: the factors $m-1$ and $m+1$ cannot both be divisible by $3$. The hypotheses therefore give $v_3(m^3-m)=1$, so the translated polynomial is an Eisenstein polynomial at $3$. The resulting completion is a totally ramified extension of degree $3$, with residue-field degree $1$, and its ramification index is divisible by the residue characteristic. Thus its different exponent is at least $3$.

It follows that $v_3(D_K)\ge 3$. But $v_3(-27m^2)=3$, soforces $v_3(I)=0$ and $v_3(D_K)=3$. No prime number divides $I$. We have proved the integral basis of a nonexceptional pure cubic field:Using local Eisenstein polynomials here only establishes the local ramification indices; it does not assume that $\mathbb{Z}[\alpha ]$ is already the full ring of integers of a number field.

Start with an elliptic curve having a rational point $T$ of order $2$. Move that point to $(0,0)$ and take an integral modelPut $b^{\prime }=a^2-4b$ andThe two-isogeny formula and its dual areThey extend to the projective curves, with kernels $\{O,T\}$ and $\{O,T^{\prime }\}$, where $T^{\prime }=(0,0)\in E^{\prime }$. Substitution verifies their target equations, and the elliptic-curve addition formula verifies $\hat{\varphi }\varphi =[2]$ and $\varphi \hat{\varphi }=[2]$. The division by $4,8$ in the dual identifies the twice-transformed curve, with coefficients $4a,16b$, with $E$.

Define the two-torsion square-class homomorphismsQuestion 1(ii) proves these are homomorphisms, since $f^{\prime }(0)=b$. Their kernels areFor completeness, the first coordinate of the dual is $Y^2/(4X^2)$, so a nonexceptional dual image has square $x$-coordinate. Conversely, if $x=u^2\ne 0$, the preimage equation iswhose discriminant is $16(x^2+ax+b)=16(y/u{)}^2$. The roots $X=2x+a\pm 2y/u$ are rational and nonzero. Choosing $Y=\pm 2uX$ gives a point on $E^{\prime }$, and a choice of sign makes its dual image exactly $(x,y)$. The point $T$ has a rational dual preimage precisely when $b$ is a square, as seen from the roots $a\pm 2\sqrt{b}$ of the nonzero two-torsion polynomial on $E^{\prime }$. The identity is already a dual image. Applying this argument to the transformed curve proves the second kernel assertion as well, because scaling an $x$-coordinate by $4$ does not change its square class.

The two-isogeny descent is finite because an image square class has a signed square-free integer representative dividing $b$. Indeed, if $\ell \nmid b$ and $v_{\ell }(x)>0$, the other factor $x^2+ax+b$ is a unit, so $v_{\ell }(y^2)=v_{\ell }(x)$ forces an even valuation. If $v_{\ell }(x)<0$, the term $x^2$ dominates that factor and $v_{\ell }(y^2)=3v_{\ell }(x)$, again forcing even valuation. Thus odd valuations can occur only at primes dividing $b$. The same argument applies to $b^{\prime }$ on $E^{\prime }$.

For each candidate signed squarefree divisor $d\mid b$, put $x=d(U/V{)}^2$, with coprime integers $U,V$. The curve equation becomes the two-isogeny descent quarticA solution with $UV\ne 0$ yields $x=d{U}^2/V^2$ and $y=dUN/V^3$. Conversely, every point in that class gives such a primitive integer solution, since a rational square root of an integer is integral. The boundary solutions $U=0$ and $V=0$ account respectively for the classes of $T$ and $O$. Rational solutions prove that a class occurs; a real or congruence obstruction excludes it. Merely finding local solutions everywhere does not automatically prove a rational solution.

To extract the rank, write $A=\alpha (E(\mathbb{Q}))$ and $A^{\prime }={\alpha }^{\prime }(E^{\prime }(\mathbb{Q}))$. The Mordell-Weil theorem givesThe isogeny factorization gives the index $|A|$ for the first quotient by $\hat{\varphi }{E}^{\prime }$. For the remaining index, apply $\hat{\varphi }$ to $E^{\prime }/\varphi E$. Its kernel has size $2/e$, whereThe equality follows because $\hat{\varphi }(\varphi P)=2P$. Consequentlyand cancellation yields the two-isogeny rank formulaThis formula is valid whether there is just one rational nonzero two-torsion point or all three.

For the first curve, $a=-1,b=1$, and the isogenous curve isThe only candidate square classes on $E$ are $1,-1$. Since $x^2-x+1>0$ for every real $x$, a real affine point has $x\ge 0$; the exceptional torsion class is $[b]=1$. ThusOn $E^{\prime }$, the candidates are $1,-1,3,-3$. They all occur: the identity gives $1$, $T^{\prime }$ gives $-3$, $(3,6)$ gives $3$, and $(-1,2)$ gives $-1$. Hence $|A^{\prime }|=4$, andThe product in the rank formula is $1\cdot 4=4$, not $1\cdot 2$; all four classes on the companion curve are essential.

For the second curve, $a=5,b=-6$, andThe candidate classes on $E$ are $\{\pm 1,\pm 2,\pm 3,\pm 6\}$. The identity, $T$, $(2,4)$ and $(-3,6)$ show thatThis is a subgroup of order $4$. Its other coset is $\{3,6,-1,-2\}$, so it suffices to exclude the representative $3$.

The modulo-eight obstruction to a two-isogeny descent class uses the corresponding two-isogeny descent quartic,If both $U,V$ are odd, its right side is $6$ modulo $8$. If $U$ is odd and $V$ even, it is $3$ or $7$ modulo $8$. If $U$ is even and $V$ odd, it is $6$ or $2$ modulo $8$. These are all primitive parity cases, and none is a square modulo $8$. Hence the class $3$ is impossible. Since $A$ is a subgroup, every class in its coset is impossible, and thereforeOn the companion curve, the only candidates are $\pm 1,\pm 7$. Its quadratic factor is $(X-5{)}^2+24>0$, so every nonzero real affine $X$ is positive. The exceptional value $[49]$ is $1$, and the point $(7,14)$ supplies the class $7$. ThusThe rank formula gives $2^r=4\cdot 2/4=2$, soEvery included class has an explicit rational representative and every excluded coset has a proved real or congruence obstruction, so these are exact ranks rather than bounds obtained from a point search.

Translate the rational 2-torsion point to $(0,0)$ and clear denominators to obtain the integral Weierstrass equation of an elliptic curve. Nonsingularity requires $b\ne 0$ and $b^{\prime }=a^2-4b\ne 0$. The two-isogeny descent usesand its dual isogenyThese formulas extend across their missing affine points as degree-two isogenies of elliptic curves, with kernels $\{O,(0,0)\}$ on their respective curves; substitution gives $\psi \varphi =[2]$ and $\varphi \psi =[2]$.

Define homomorphisms to the square-class group of a field ${\mathbb{Q}}^{\times }/({\mathbb{Q}}^{\times }{)}^2$ byFor ordinary intersections with a line, the product of the three first coordinates is the square of its intercept, proving the homomorphism identity; tangent cases use the same product with multiplicities. For $T=(0,0)$, direct addition gives $x(P+T)=b/x(P)$, so $\alpha (P+T)=[b]\alpha (P)$. Also $\alpha (P)\alpha (-P)=1$ and $\alpha (T{)}^2=1$, which handle inverse points and $T+T=O$. These verify the exceptional values as well. Their kernels are $\psi E^{\prime }(\mathbb{Q})$ and $\varphi E(\mathbb{Q})$. One can check the first assertion directly: if $x=s^2\ne 0$, solving for the first coordinate of a preimage under $\psi$ giveswith rational corresponding ordinate. Conversely, on $E^{\prime }$ one has ${\psi }_x=Y^2/(4X^2)$, a square. The exceptional point $(0,0)$ has a rational preimage exactly when $b$ is a square. The other kernel assertion follows identically, since the double companion curve is isomorphic to $E$ by scaling its coordinates by four and eight.

We now justify the rank factor in the square-class index formula for two-isogeny descent, rather than forgetting a torsion correction. Put $A=E(\mathbb{Q})$, $B=E^{\prime }(\mathbb{Q})$, andThe preimage of $\psi \varphi A$ under $\psi$ is $\varphi A+\ker \psi$, soThe Mordell-Weil theorem gives $[A:2A]=2^r\#A[2]$, where $r$ is the rank of an abelian group of $A$. If $b^{\prime }$ is a square, $\#A[2]=4$ and $(0,0)\in \varphi A$, so $\delta =1$. If it is not a square, $\#A[2]=2$ and $\delta =2$. Hence $\delta \#A[2]=4$ in both cases, and

To bound these two images, let $\ell \nmid b$ and take a point with $x\ne 0$. If $v_{\ell }(x)>0$, then $x^2+ax+b$ is a unit, so $2v_{\ell }(y)=v_{\ell }(x)$ is even. If $v_{\ell }(x)<0$, the leading term $x^3$ uniquely has least valuation in the equation, so $2v_{\ell }(y)=3v_{\ell }(x)$ and again $v_{\ell }(x)$ is even. Thus every image class has a signed square-free integer representative supported on the prime divisors of $b$. The exceptional class $[b]$ also has that property. There are at most $2^{\nu (b)+1}$ such classes. Applying the same reasoning to $E^{\prime }$ gives $\#{\alpha }^{\prime }(B)\le 2^{\nu (b^{\prime })+1}$. The prime-support bound in two-isogeny descent is thereforeHere $\nu$ counts the distinct prime divisors of the absolute value of a nonzero integer; $\nu (1)=\nu (-1)=0$. The nonsingularity hypotheses exclude the otherwise undefined case $\nu (0)$.

For the unheaded practical procedure, enumerate signed square-free divisors $d$ of $b$, and of $b^{\prime }$ on the companion curve. A class $d$ is represented by a point of $E$ exactly when its quartic covering in a two-isogeny descenthas a rational solution with $(U,V)\ne (0,0)$. For $UV\ne 0$, reconstruct $x=d{U}^2/V^2$, $y=dUW/V^3$; substitution verifies the equivalence. Solutions with $V=0$ or $U=0$ account for the identity class or the class of $(0,0)$ respectively. Clearing denominators allows integral $U,V,W$ with $\gcd (U,V)=1$.

Test these finitely many coverings over the real numbers and local fields, especially at two and the primes dividing $b{b}^{\prime }$, to exclude impossible classes. Search the survivors for rational points, close the witnessed classes under multiplication, and use the index formula once both images are determined. Equivalently, local solubility gives a descent upper bound and independent rational points, certified for example by their canonical height of an elliptic curve pairing, give a lower bound. When the bounds coincide the rank is determined. This procedure often succeeds, but local solubility alone does not prove global solubility: a nonzero Tate–Shafarevich group can leave surviving coverings without rational points. In that case the computation gives a rigorous bound rather than a falsely certified exact rank.

For a square-free integer $\delta \equiv 2$ or $3(\mathrm{mod}4)$, the ring of integers of the quadratic field is ${\mathcal{O}}_{\mathbb{Q}(\sqrt{\delta })}=\mathbb{Z}[\sqrt{\delta }]$. Square-freeness is the usual convention underlying the first request: congruence alone would not suffice, for example $\delta =27$ gives the same field as $\delta =3$.

Now take the stipulated square-free $\delta \equiv 3(\mathrm{mod}4)$ and put $r=\sqrt{2}$, $s=\sqrt{\delta }$. For any integral $\alpha =a+br+cs+drs$, relative traces to the three quadratic subfields show $2a,2b,2c,2d\in \mathbb{Z}$. Those subfields all have integral bases $1$ and their square root, including $\mathbb{Q}(\sqrt{2\delta })$. Write $\alpha =(A+Br+Cs+Drs)/2$ with integer coefficients.

Its relative field norm to $\mathbb{Q}(s)$ isThus $AC$ is even, and the constant numerator is divisible by four. Since $\delta \equiv 3(\mathrm{mod}4)$, these conditions force $A,C$ both even: one odd makes the numerator odd, and both odd contradicts $AC$ even. They then force $B,D$ to have the same integer parity. Every algebraic integer consequently belongs to the lattice generated byConversely the last generator $w$ satisfies $w^2=(1+\delta )/2+\sqrt{\delta }$ and the monic integer equationAll four generators are integral and linearly independent over $\mathbb{Q}$, so this lattice is exactly ${\mathcal{O}}_L$, proving this integral basis of an odd biquadratic field containing square root of two without an unproved index assumption.

An arithmetic function $f$ is multiplicative if $f(mn)=f(m)f(n)$ whenever $m$ and $n$ are coprime integers. If $g(n)={\sum }_{d\mid n}f(d)$ and $(m,n)=1$, every positive integer divisor of $mn$ is uniquely $d_1{d}_2$ with $d_1\mid m$ and $d_2\mid n$. Henceso $g$ is multiplicative.

The Möbius function is defined by $\mu (1)=1$, $\mu (n)=0$ if the square of a prime number divides $n$, and $\mu (n)=(-1{)}^r$ if $n$ is a product of $r$ distinct prime numbers. Coprime integers have disjoint sets of prime factors, so this definition immediately gives $\mu (mn)=\mu (m)\mu (n)$ when $(m,n)=1$.

For $n=p_1^{a_1}\cdots p_r^{a_r}>1$, only the square-free divisors contribute, and thereforeFor $n=1$ the sum is $1$. Thus $1\ast \mu =\epsilon$ in the language of Dirichlet convolution. Convolving $g=1\ast f$ with $\mu$ gives the Möbius inversion formula

If $f(n)=n$, its divisor sum is the sum-of-divisors function. Conversely, if $g(n)=n$, Möbius inversion givesusing the standard divisor identity for the Euler totient function. Therefore the two requested answers are

An odd composite $N$ coprime to $b$ is a Fermat pseudoprime to base $b$ when $b^{N-1}\equiv 1(\mathrm{mod}N)$. It is a Carmichael number when this congruence holds for every $b$ coprime to $N$.

Suppose a Carmichael number has $p^a\Vert N$ with $a\ge 2$. The group $(\mathbb{Z}/p^a\mathbb{Z}{)}^{\ast }$ is cyclic, so choose a residue of orderBy the Chinese remainder theorem, extend it to an integer $b$ that is congruent to $1$ modulo every other prime-power factor of $N$. Then $\gcd (b,N)=1$, and the Carmichael congruence forces the order of $b$ modulo $p^a$ to divide $N-1$. In particular $p\mid N-1$, contradicting $p\mid N$. Therefore every Carmichael number is square-free.

Now assume $N$ is square-free. If $p-1\mid N-1$ for every $p\mid N$, then for every $b$ coprime to $N$, Fermat little theorem givesfor each $p\mid N$. The Chinese remainder theorem then gives the congruence modulo $N$, so $N$ is Carmichael.

Conversely, if $N$ is Carmichael, fix $p\mid N$. Choose a primitive root $g$ modulo $p$ and use the Chinese remainder theorem to choose $b\equiv g(\mathrm{mod}p)$ and $b\equiv 1(\mathrm{mod}N/p)$. Then $b^{N-1}\equiv 1(\mathrm{mod}p)$, so the order $p-1$ of $g$ divides $N-1$. This proves the Korselt criterion in the required form:

A Carmichael number cannot have one prime factor because it is composite. If $N=pq$ with distinct primes $p<q$, the condition $q-1\mid pq-1$ implies $q-1\mid p-1$, which is impossible. Hence every Carmichael number has at least three prime factors.

Put $\alpha =\sqrt[n]{m}$. It is an algebraic integer because it satisfies the monic polynomial $X^n-m$. Choose a prime number $q$ dividing the square-free integer $m$, and choose a prime ideal $\mathfrak{p}$ of ${\mathcal{O}}_L$ above $q$. Fromand prime ideal factorization, the $\mathfrak{p}$-adic exponents satisfybecause $q$ occurs to exponent one in $m$. Hence $n$ divides the ramification index of a prime ideal $e_{\mathfrak{p}}$. If $d=[L:\mathbb{Q}]$, then $e_{\mathfrak{p}}\le d$, while the equation ${\alpha }^n=m$ gives $d\le n$. Thereforeso

The Dedekind factorization theorem says that, when a rational prime $p$ does not divide the index of an order $\mathbb{Z}[\theta ]\subseteq {\mathcal{O}}_K$, a factorizationof the minimal polynomial modulo $p$ gives

Let $K=\mathbb{Q}(\sqrt{d})$ with square-free $d$, and let $p$ be odd. The resulting splitting of rational primes in a quadratic field is:

Finally suppose $d>0$ and
$\alpha =A/C+(B/C)\sqrt{d}$ has norm $-1$, with integers
$A,B,C$ chosen coprime. ThenIf an odd $p\equiv 3(\mathrm{mod}4)$ ramified, then $p\mid d$. Reduction modulo $p$ gives
$A^2\equiv -C^2(\mathrm{mod}p)$. Since $-1$ is not a square modulo such a prime, $p\mid A,C$. Dividing the equation's divisibility shows $p\mid B$ as well (use that square-free $d$ has $p$-adic valuation one), contradicting coprimality. Hence no prime $p\equiv 3(\mathrm{mod}4)$ ramifies.

A pure cubic number field is a degree-three number field generated by a root of $X^3-m$ for a rational number $m$ that is not a rational cube. For a positive square-free integer $m>1$, this polynomial is an Eisenstein polynomial at any prime dividing $m$. The ring of integers of a number field depends on congruences at $3$, as expressed by the integral basis of a nonexceptional pure cubic field.

The additive group ${\mathbb{Q}}_{\mathrm{sq}}$ consists of the rational numbers whose reduced denominators are square-free integers. If $p_0,p_1,\dots$ lists the primes without repetition, then

For distinct integral roots $\alpha ,\beta ,\gamma$ with $m=\max (|\alpha |,|\beta |,|\gamma |)$, the finite set in unramified halving fields for a split cubic contains only primes at most $2m$. A quadratic Galois character unramified away from $s$ primes is represented by a signed square-free integer supported on those primes, giving at most $2^{s+1}$ characters. The halving cocycle with rational two-torsion has two independent coordinates in $\mathbb{Z}/2\mathbb{Z}$, so the quotient has at most $2^{2s+2}$ elements. Since $m\ge 1$ and there are at most $m$ primes at most $2m$, this gives $2^{2m+2}$. The bound is deliberately crude but depends only on the root size.