Computing modular polynomials with the Chinese Remainder Theorem

Transcription

1 Computing modular polynomials with the Chinese Remainder Theorem Andrew V. Sutherland Massachusetts Institute of Technology ECC 009 Reinier Bröker Kristin Lauter Andrew V. Sutherland (MIT) Computing modular polynomials 1 of 5

2 Isogenies An isogeny φ : E 1 E is a morphism of elliptic curves, a rational map that preserves the identity. Andrew V. Sutherland (MIT) Computing modular polynomials of 5

3 Isogenies An isogeny φ : E 1 E is a morphism of elliptic curves, a rational map that preserves the identity. Over a finite field, E 1 and E are isogenous if and only if #E 1 (F q ) = #E (F q ). Andrew V. Sutherland (MIT) Computing modular polynomials of 5

4 Some applications of isogenies Isogenies make hard problems easier: Counting the points on E Polynomial time (SEA). Constructing E with the CM method. D h(d) 5, 000, 000 (CRT approach). Computing the endomorphism ring of E. Subexponential time (heuristically, Bisson-S 009). These algorithms all rely on modular polynomials Φ l (X, Y ). Andrew V. Sutherland (MIT) Computing modular polynomials 3 of 5

5 Isogenies in elliptic curve cryptography Isogenies allow the discrete logarithm problem to be transferred from one elliptic curve to another. This raises a few questions: 1. How efficiently can we compute isogenies?. Are all isogenous curves created equal? Andrew V. Sutherland (MIT) Computing modular polynomials 4 of 5

6 Isogenies in elliptic curve cryptography Isogenies allow the discrete logarithm problem to be transferred from one elliptic curve to another. This raises a few questions: 1. How efficiently can we compute isogenies?. Are all isogenous curves created equal? The endomorphism ring End(E) is critical to both questions. (Bröker-Charles-Lauter 008, Jao-Miller-Venkatesan 005, 009). Andrew V. Sutherland (MIT) Computing modular polynomials 4 of 5

7 Properties of isogenies Degree The kernel of φ : E 1 E is a finite subgroup of E 1 (F). When φ is separable, we have ker φ = deg φ. An l-isogeny is a (separable) isogeny of degree l. For prime l, the kernel is necessarily cyclic. Orientation We say that φ : E 1 E is horizontal if End(E 1 ) = End(E ). Otherwise φ is vertical. Andrew V. Sutherland (MIT) Computing modular polynomials 5 of 5

8 CM-action Let E/F q be an ordinary elliptic curve. Then End(E) = O O K, for some imaginary quadratic field K. Andrew V. Sutherland (MIT) Computing modular polynomials 6 of 5

9 CM-action Let E/F q be an ordinary elliptic curve. Then End(E) = O O K, for some imaginary quadratic field K. The class group cl(o) acts on the set {j(e/f q ) : End(E) = O}. Horizontal l-isogenies are the action of an ideal with norm l. Andrew V. Sutherland (MIT) Computing modular polynomials 6 of 5

10 CM-action Let E/F q be an ordinary elliptic curve. Then End(E) = O O K, for some imaginary quadratic field K. The class group cl(o) acts on the set {j(e/f q ) : End(E) = O}. Horizontal l-isogenies are the action of an ideal with norm l. A horizontal isogeny of large degree may be equivalent to a sequence of isogenies of small degree, via relations in cl(o). Andrew V. Sutherland (MIT) Computing modular polynomials 6 of 5

11 CM-action Let E/F q be an ordinary elliptic curve. Then End(E) = O O K, for some imaginary quadratic field K. The class group cl(o) acts on the set {j(e/f q ) : End(E) = O}. Horizontal l-isogenies are the action of an ideal with norm l. A horizontal isogeny of large degree may be equivalent to a sequence of isogenies of small degree, via relations in cl(o). Under the ERH this is always true, and small = O(log D ). Andrew V. Sutherland (MIT) Computing modular polynomials 6 of 5

12 Isogenies from kernels Any finite subgroup G of E(F) determines a separable isogeny with G as its kernel Given G, we can compute φ explicitly via Vélu s formula. The complexity depends both on the size of ker φ, and the field in which the points of ker φ are defined. When working in F q, we assume the coefficients of φ lie in F q. But ker φ may lie in an extension of degree up to l 1. Andrew V. Sutherland (MIT) Computing modular polynomials 7 of 5

13 The classical modular polynomial Φ l The symmetric polynomial Φ l Z[X, Y ] has the property Φ l ( j(e1 ), j(e ) ) = 0 E 1 and E are l-isogenous. Andrew V. Sutherland (MIT) Computing modular polynomials 8 of 5

14 The classical modular polynomial Φ l The symmetric polynomial Φ l Z[X, Y ] has the property Φ l ( j(e1 ), j(e ) ) = 0 E 1 and E are l-isogenous. The l-isogeny graph has vertex set {j(e) : E/F q } and edges (j 1, j ) whenever Φ l (j 1, j ) = 0 (in F q ). The neighbors of j are the roots of Φ l (X, j) F q [X]. Andrew V. Sutherland (MIT) Computing modular polynomials 8 of 5

15 The classical modular polynomial Φ l The symmetric polynomial Φ l Z[X, Y ] has the property Φ l ( j(e1 ), j(e ) ) = 0 E 1 and E are l-isogenous. The l-isogeny graph has vertex set {j(e) : E/F q } and edges (j 1, j ) whenever Φ l (j 1, j ) = 0 (in F q ). The neighbors of j are the roots of Φ l (X, j) F q [X]. Φ l is big: O(l 3 log l) bits. Andrew V. Sutherland (MIT) Computing modular polynomials 8 of 5

16 Andrew V. Sutherland (MIT) Computing modular polynomials 9 of 5

17 Andrew V. Sutherland (MIT) Computing modular polynomials 10 of 5

18 l coefficients largest average total kb 5.3kb 5.5MB kb 1kb 48MB kb 7kb 431MB kb 60kb 3.9GB kb 13kb 33GB kb 08kb 117GB kb 87kb 87GB kb 369kb 577GB kb 774kb 4.8TB* Size of Φ l (X, Y ) *Estimated Andrew V. Sutherland (MIT) Computing modular polynomials 11 of 5

19 Algorithms to compute Φ l q-expansions: (Atkin?, Elkies 9, 98, LMMS 94, Morain 95, Müller 95, BCRS 99) Φ l : O(l 4 log 3+ɛ l) (via the CRT) Φ l mod p: O(l 3 log l log 1+ɛ p) (p > l + 1) Andrew V. Sutherland (MIT) Computing modular polynomials 1 of 5

20 Algorithms to compute Φ l q-expansions: (Atkin?, Elkies 9, 98, LMMS 94, Morain 95, Müller 95, BCRS 99) Φ l : O(l 4 log 3+ɛ l) (via the CRT) Φ l mod p: O(l 3 log l log 1+ɛ p) (p > l + 1) isogenies: (Charles-Lauter 005) Φ l : O(l 5+ɛ ) (via the CRT) Φ l mod p: O(l 4+ɛ log +ɛ p) (p > 1l + 13) Andrew V. Sutherland (MIT) Computing modular polynomials 1 of 5

21 Algorithms to compute Φ l q-expansions: (Atkin?, Elkies 9, 98, LMMS 94, Morain 95, Müller 95, BCRS 99) Φ l : O(l 4 log 3+ɛ l) (via the CRT) Φ l mod p: O(l 3 log l log 1+ɛ p) (p > l + 1) isogenies: (Charles-Lauter 005) Φ l : O(l 5+ɛ ) (via the CRT) Φ l mod p: O(l 4+ɛ log +ɛ p) (p > 1l + 13) evaluation-interpolation: (Enge 009) Φ l : O(l 3 log 4+ɛ l) (floating-point) Φ l mod m: O(l 3 log 4+ɛ l) (reduces Φ l ) Andrew V. Sutherland (MIT) Computing modular polynomials 1 of 5

22 A new algorithm to compute Φ l We compute Φ l using isogenies and the CRT. Andrew V. Sutherland (MIT) Computing modular polynomials 13 of 5

23 A new algorithm to compute Φ l We compute Φ l using isogenies and the CRT. For certain p we can compute Φ l mod p in expected time O(l log 3+ɛ p). Andrew V. Sutherland (MIT) Computing modular polynomials 13 of 5

24 A new algorithm to compute Φ l We compute Φ l using isogenies and the CRT. For certain p we can compute Φ l mod p in expected time O(l log 3+ɛ p). Under the GRH, we find many such p with log p = O(log l). Φ l : O(l 3 log 3+ɛ l) (via the CRT) Φ l mod m: O(l 3 log 3+ɛ l) (via the explicit CRT) Computing Φ l mod m uses O(l log(lm)) space. Andrew V. Sutherland (MIT) Computing modular polynomials 13 of 5

25 A new algorithm to compute Φ l We compute Φ l using isogenies and the CRT. For certain p we can compute Φ l mod p in expected time O(l log 3+ɛ p). Under the GRH, we find many such p with log p = O(log l). Φ l : O(l 3 log 3+ɛ l) (via the CRT) Φ l mod m: O(l 3 log 3+ɛ l) (via the explicit CRT) Computing Φ l mod m uses O(l log(lm)) space. In practice the algorithm is much faster than other methods. It is probabilistic, but the output is unconditionally correct. Andrew V. Sutherland (MIT) Computing modular polynomials 13 of 5

26 Performance highlights Level records 1. l = 5003: Φ l. l = 10007: Φ l mod m 3. l = 5001: Φ f l Each in less than 4 hours elapsed time ( 1 CPU-days), using m 56. Speed records 1. l = 51 : Φ l in 40s Φ l mod m in 5.5s. l = 1009: Φ l in 38s Φ l mod m in 408s 3. l = 1009: Φ f l in 3.s Single core CPU times (AMD 3.0 GHz), using m 56. Effective throughput when computing Φ 1009 mod m is 100Mb/s. Andrew V. Sutherland (MIT) Computing modular polynomials 14 of 5

27

28 Mapping a volcano Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

29 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

30 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

31 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l 1. Find a root of H D (X) Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

32 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l Find a root of H D (X): 901 Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

33 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 = l 0 l, ( D ) = 1 l Enumerate surface using the action of α l0 Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

34 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

35 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

36 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

37 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

38 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

39 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

40 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

41 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Descend to the floor using Vélu s formula Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

42 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Descend to the floor using Vélu s formula: Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

43 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate floor using the action of β l0 Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

44 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

45 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

46 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

47 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

48 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

49 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

50 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

51 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

52 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Andrew V. Sutherland (MIT) Computing modular polynomials 15 of 5

53 Interpolation Φ 5 (X, 901) = (X 701)(X 351)(X 3188)(X 970)(X 1478)(X 338) Φ 5 (X, 351) = (X 901)(X 15)(X 3508)(X 464)(X 976)(X 566) Φ 5 (X, 15) = (X 351)(X 501)(X 3341)(X 1868)(X 434)(X 676) Φ 5 (X, 501) = (X 15)(X 87)(X 3147)(X 55)(X 1180)(X 3144) Φ 5 (X, 87) = (X 501)(X 158)(X 150)(X 48)(X 1064)(X 087) Φ 5 (X, 158) = (X 87)(X 701)(X 945)(X 3497)(X 344)(X 91) Φ 5 (X, 701) = (X 158)(X 901)(X 843)(X 41)(X 3345)(X 4397) Andrew V. Sutherland (MIT) Computing modular polynomials 16 of 5

54 Interpolation Φ 5 (X, 901) = X X X X X X + 36 Φ 5 (X, 351) = X X X X X + 93X Φ 5 (X, 15) = X X X X X + 084X Φ 5 (X, 501) = X X X X X X Φ 5 (X, 87) = X X X X X X Φ 5 (X, 158) = X X X X 3 + 5X X Φ 5 (X, 701) = X X X X X + 7X Andrew V. Sutherland (MIT) Computing modular polynomials 16 of 5

55 Interpolation Φ 5 (X, Y ) = X 6 + (4450Y Y Y Y + 70Y + 397)X 5 (370Y Y Y Y Y + 33)X 4 (433Y Y Y Y Y + 11)X 3 (3499Y Y Y Y Y + 050)X ( 70Y Y Y Y + 905Y + 091)X (Y Y Y Y Y + 091Y + 108) Andrew V. Sutherland (MIT) Computing modular polynomials 16 of 5

56 Computing Φ l (X, Y ) mod p Assume D and p are suitably chosen with D = O(l ) and log p = O(log l), and that H D (X) has been precomputed. 1. Find a root of H D (X) over F p. O(l log 3+ɛ l). Enumerate the surface(s) using cl(d)-action. O(l log +ɛ l) 3. Descend to the floor using Vélu. O(l log 1+ɛ l) 4. Enumerate the floor using cl(l D)-action. O(l log +ɛ l) 5. Build each Φ l (X, j i ) from its roots. O(l log 3+ɛ l) 6. Interpolate Φ l (X, Y ) mod p. O(l log 3+ɛ l) Time complexity is O(l log 3+ɛ l). Space complexity is O(l log l). Andrew V. Sutherland (MIT) Computing modular polynomials 17 of 5

57 After computing Φ 5 (X, Y ) mod p for the primes: 4451, 6911, 9551, 8111, 54851, , 13491, , 11711, 80451, , , , , we apply the CRT to obtain Φ 5 (X, Y ) = X 6 + Y 6 X 5 Y (X 5 Y 4 + X 4 Y 5 ) (X 5 Y 3 + X 3 Y 5 ) (X 5 Y + X Y 5 ) (X 5 Y + XY 5 ) (X 5 + Y 5 ) X 4 Y (X 4 Y 3 + X 3 Y 4 ) (X 4 Y + X Y 4 ) (X 4 Y + XY 4 ) (X 4 + Y 4 ) (X 3 Y 5 + X 5 Y 3 ) X 3 Y (X 3 Y + X Y 3 ) (X 3 Y + XY 3 ) (X 3 + Y 3 ) X Y (X Y + XY ) (X + Y ) XY (X + Y ) Andrew V. Sutherland (MIT) Computing modular polynomials 18 of 5

58 After computing Φ 5 (X, Y ) mod p for the primes: 4451, 6911, 9551, 8111, 54851, , 13491, , 11711, 80451, , , , , we apply the CRT to obtain Φ 5 (X, Y ) = X 6 + Y 6 X 5 Y (X 5 Y 4 + X 4 Y 5 ) (X 5 Y 3 + X 3 Y 5 ) (X 5 Y + X Y 5 ) (X 5 Y + XY 5 ) (X 5 + Y 5 ) X 4 Y (X 4 Y 3 + X 3 Y 4 ) (X 4 Y + X Y 4 ) (X 4 Y + XY 4 ) (X 4 + Y 4 ) (X 3 Y 5 + X 5 Y 3 ) X 3 Y (X 3 Y + X Y 3 ) (X 3 Y + XY 3 ) (X 3 + Y 3 ) X Y (X Y + XY ) (X + Y ) XY (X + Y ) (but note that Φ f 5 (X, Y ) = X 6 + Y 6 X 5 Y 5 + 4XY ). Andrew V. Sutherland (MIT) Computing modular polynomials 18 of 5

59 The algorithm Given a prime l > and an integer m > 0: 1. Pick a discriminant D suitable for l.. Select a set of primes S suitable for l and D. 3. Precompute H D, cl(d), cl(l D), and CRT data. 4. For each p S, compute Φ l mod p and update CRT data. 5. Perform CRT postcomputation and output Φ l mod m. To compute Φ l over Z, just use m = p. For small m, use explicit CRT modm. For large m, standard CRT for large m. For m in between, use a hybrid approach. Andrew V. Sutherland (MIT) Computing modular polynomials 19 of 5

60 Chinese remaindering Let S = {p 1,..., p n}, M = Q p i, M i = M/p i, and a i M 1 i mod p i. For each coefficient c of Φ l, let c i c mod p i and assume 4 c < M. Standard CRT: c P c i a i M i mod M. Explicit CRT mod m [Bernstein]: X c ci a i M i rm mod m where r is the closest integer to P c i a i /M i. Online algorithm: process each c i as it is computed, then discard it! Assuming log p i = O(log l): Space complexity: O(l log(lm). Time complexity: O(l 3 log 3+ɛ l + l 3 M(log m)) With hybrid approach, time is O(l 3 log 3+ɛ l) independent of m. See arxiv.org/abs/ for more details. Andrew V. Sutherland (MIT) Computing modular polynomials 0 of 5

61 Complexity Theorem (GRH) For every prime l > there is a suitable discriminant D with D = O(l ) for which there are Ω(l 3 log 3 l) primes p = O(l 6 (log l) 4 ) that are suitable for l and D. Heuristically, p = O(l 4 ). In practice, lg p < 64. Theorem (GRH) The expected running time is O(l 3 log 3 l log log l). The space required is O(l log(lm)). Andrew V. Sutherland (MIT) Computing modular polynomials 1 of 5

62 An explicit height bound for Φ l Let l be a prime. Let h(φ l ) be the (natural) logarithmic height of Φ l. Asymptotic bound: h(φ l ) = 6l log l + O(l) (Paula Cohen 1984). Andrew V. Sutherland (MIT) Computing modular polynomials of 5

63 An explicit height bound for Φ l Let l be a prime. Let h(φ l ) be the (natural) logarithmic height of Φ l. Asymptotic bound: h(φ l ) = 6l log l + O(l) (Paula Cohen 1984). Explicit bound: h(φ l ) 6l log l + 17l (Bröker-S 009). Conjectural bound: h(φ l ) 6l log l + 1l (for l > 30). The explicit bound holds for all l. The conjectural bound is known to hold for 30 < l < Andrew V. Sutherland (MIT) Computing modular polynomials of 5

64 Other modular functions We can compute polynomials relating f (z) and f (lz) for other modular functions, including the Weber f-function. The coefficients of Φ f l are roughly 7 times smaller. This means we need 7 fewer primes. The polynomial Φ f l is roughly 4 times sparser. This means we need 4 times fewer interpolation points. Overall, we get nearly a 178-fold speedup using Φ f l. Andrew V. Sutherland (MIT) Computing modular polynomials 3 of 5

65 Modular polynomials for l = 11 Classical: X 1 + Y 1 X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X pages omitted digits omitted Atkin: X 1 X 11 Y + 744X X X 9 Y X X 8 Y X X 7 Y X X 6 Y X X 5 Y X X 4 Y X X 3 Y X X Y X XY X + Y Y Weber: X 1 + Y 1 X 11 Y X 9 Y 9 44X 7 Y X 5 Y 5 88X 3 Y 3 + 3XY Andrew V. Sutherland (MIT) Computing modular polynomials 4 of 5

66 Performance comparison function l floating-point CRT ratio classical j Weber f floating-point vs. CRT (3.0 GHz AMD Phenom CPU seconds, m 56 ) Andrew V. Sutherland (MIT) Computing modular polynomials 5 of 5