Computing the modular equation

Transcription

1 Computing the modular equation Andrew V. Sutherland (MIT) Barcelona-Boston-Tokyo Number Theory Seminar in Memory of Fumiyuki Momose Andrew V. Sutherland (MIT) Computing the modular equation 1 of 8

2 The modular polynomial Let j(z) denote the classical modular function j : H C with q-expansion j(z) = 1/q q +... For a positive integer N, the minimal polynomial of the function j(nz) over the field C(j) is the modular polynomial of level N. Its coefficients actually lie in C[j], so we may regard it as a polynomial Φ N (X, Y ) in two variables. Its coefficients are algebraic integers, and they are rational. So they lie in Z. Andrew V. Sutherland (MIT) Computing the modular equation of 8

3 The modular equation Over C, elliptic curves E 1 and E are related by a cyclic isogeny of degree N if and only if Φ N (j(e 1 ), j(e )) = 0. Thus Φ N parameterizes pairs of N-isogenous elliptic curves. It (canonically) defines the modular curve Y 0 (N) = Γ 0 (N)\H. The moduli interpretation of Φ N remains valid over any field of characteristic prime to N. Andrew V. Sutherland (MIT) Computing the modular equation 3 of 8

4 Practical applications of modular polynomials Examples: Point-counting (SEA). Computing the endomorphism ring of an elliptic curve. Constructing elliptic curves with the CM method. Computing discrete logarithms. Constructing Ramanujan graphs. In most applications N is a prime l, and we actually wish to compute Φ l over a finite field F q. Andrew V. Sutherland (MIT) Computing the modular equation 4 of 8

5 Explicit computations History: level person (machine) year N = Smith 1878 N = 3 Smith 1879 N = 5 Berwick 1916 N = 7 Herrmann 1974 N = 11 Kaltofen-Yui (VAX ) 1984 Why is computing Φ N so difficult? Andrew V. Sutherland (MIT) Computing the modular equation 5 of 8

6 Explicit computations History: level person (machine) year N = Smith 1878 N = 3 Smith 1879 N = 5 Berwick 1916 N = 7 Herrmann 1974 N = 11 Kaltofen-Yui (VAX ) 1984 Why is computing Φ N so difficult? Φ l is big: O(l 3 log l) bits. Andrew V. Sutherland (MIT) Computing the modular equation 5 of 8

7 Example: Φ 11 (X, Y ) X 1 + Y 1 X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X pages omitted digits omitted Andrew V. Sutherland (MIT) Computing the modular equation 6 of 8

8 l coefficients largest average total kb 5.3kb 5.5MB kb 1kb 48MB kb 7kb 431MB kb 60kb 3.9GB kb 13kb 33GB kb 08kb 117GB kb 87kb 87GB kb 369kb 577GB kb 774kb 4.8TB* Size of Φ l (X, Y ) *Estimated Andrew V. Sutherland (MIT) Computing the modular equation 7 of 8

9 Algorithms to compute Φ l q-expansions: (Atkin?, Elkies 9, 98, LMMS 94, Ito 95, Morain 95, Müller 95, BCRS 99) Φ l : O(l 4 log 3+ɛ l) (via the CRT) Φ l mod q: O(l 3 log l log 1+ɛ q) (p > l + 1) Andrew V. Sutherland (MIT) Computing the modular equation 8 of 8

10 Algorithms to compute Φ l q-expansions: (Atkin?, Elkies 9, 98, LMMS 94, Ito 95, Morain 95, Müller 95, BCRS 99) Φ l : O(l 4 log 3+ɛ l) (via the CRT) Φ l mod q: O(l 3 log l log 1+ɛ q) (p > l + 1) isogenies: (Charles-Lauter 005) Φ l : O(l 5+ɛ ) (via the CRT) Φ l mod q: O(l 4+ɛ log +ɛ q) (q > 1l + 13) Andrew V. Sutherland (MIT) Computing the modular equation 8 of 8

11 Algorithms to compute Φ l q-expansions: (Atkin?, Elkies 9, 98, LMMS 94, Ito 95, Morain 95, Müller 95, BCRS 99) Φ l : O(l 4 log 3+ɛ l) (via the CRT) Φ l mod q: O(l 3 log l log 1+ɛ q) (p > l + 1) isogenies: (Charles-Lauter 005) Φ l : O(l 5+ɛ ) (via the CRT) Φ l mod q: O(l 4+ɛ log +ɛ q) (q > 1l + 13) evaluation-interpolation: (Enge 009) Φ l : O(l 3 log 4+ɛ l) (floating-point approx.) Φ l mod q: O(l 3 log 4+ɛ l) (reduces Φ l ) Andrew V. Sutherland (MIT) Computing the modular equation 8 of 8

12 A new algorithm to compute Φ l Bröker-Lauter-S (010), S (01) and Ono-S (in progress). We compute Φ l using isogenies and the CRT. Andrew V. Sutherland (MIT) Computing the modular equation 9 of 8

13 A new algorithm to compute Φ l Bröker-Lauter-S (010), S (01) and Ono-S (in progress). We compute Φ l using isogenies and the CRT. For suitable primes p we compute Φ l mod p in expected time O(l log 3+ɛ p). Andrew V. Sutherland (MIT) Computing the modular equation 9 of 8

14 A new algorithm to compute Φ l Bröker-Lauter-S (010), S (01) and Ono-S (in progress). We compute Φ l using isogenies and the CRT. For suitable primes p we compute Φ l mod p in expected time O(l log 3+ɛ p). Under the GRH, we find many suitable p with log p = O(log l). Φ l : O(l 3 log 3+ɛ l) (via the CRT) Φ l mod q: O(l 3 log 3+ɛ l) (via the explicit CRT) Computing Φ l mod q uses O(l log(lq)) space. Andrew V. Sutherland (MIT) Computing the modular equation 9 of 8

15 A new algorithm to compute Φ l Bröker-Lauter-S (010), S (01) and Ono-S (in progress). We compute Φ l using isogenies and the CRT. For suitable primes p we compute Φ l mod p in expected time O(l log 3+ɛ p). Under the GRH, we find many suitable p with log p = O(log l). Φ l : O(l 3 log 3+ɛ l) (via the CRT) Φ l mod q: O(l 3 log 3+ɛ l) (via the explicit CRT) Computing Φ l mod q uses O(l log(lq)) space. In practice the algorithm is much faster than other methods. It is probabilistic, but the output is unconditionally correct. Andrew V. Sutherland (MIT) Computing the modular equation 9 of 8

16 Some performance highlights Level records : Φ l. 0011: Φ l mod q : Φ f l Speed records 1. 51: Φ l in 8s Φ l mod q in 4.8s (vs 688s). 1009: Φ l in 830s Φ l mod q in 65s (vs 10700s) Single core CPU times (AMD 3.0 GHz), using prime q 56. Effective throughput when computing Φ 1009 mod q is 100Mb/s. Andrew V. Sutherland (MIT) Computing the modular equation 10 of 8

17 Isogenies For the rest of this talk l is a prime not equal to char F. Every l-isogeny φ : E 1 E is thus separable, and its kernel is a (cyclic) subgroup of E(F) of order l. Conversely, every subgroup of E(F) of order l is the kernel of an l-isogeny, which we may compute explicitly using Vélu s formulas (but this may be costly). Andrew V. Sutherland (MIT) Computing the modular equation 11 of 8

18 Isogenies For the rest of this talk l is a prime not equal to char F. Every l-isogeny φ : E 1 E is thus separable, and its kernel is a (cyclic) subgroup of E(F) of order l. Conversely, every subgroup of E(F) of order l is the kernel of an l-isogeny, which we may compute explicitly using Vélu s formulas (but this may be costly). We say that φ: E 1 E is horizontal if End(E 1 ) = End(E ). Otherwise φ is a vertical isogeny Horizontal isogenies are easy to compute. Vertical isogenies are not. Andrew V. Sutherland (MIT) Computing the modular equation 11 of 8

19 Complex multiplication Let E be an elliptic curve with End(E) O. For any (proper) O-ideal a, define the a-torsion subgroup E[a] = {P : αp = 0 for all α a}. E[a] is the kernel of an isogeny of degree N(a), and this yields a group action of the class group cl(o) on the set Ell O = {j(e) : End(E) O}. Andrew V. Sutherland (MIT) Computing the modular equation 1 of 8

20 Complex multiplication Let E be an elliptic curve with End(E) O. For any (proper) O-ideal a, define the a-torsion subgroup E[a] = {P : αp = 0 for all α a}. E[a] is the kernel of an isogeny of degree N(a), and this yields a group action of the class group cl(o) on the set Ell O = {j(e) : End(E) O}. Horizontal l-isogenies are the action of an ideal with norm l. A horizontal isogeny of large degree may be equivalent to a product of isogenies of smaller degree, via relations in cl(o). Under the ERH, small is O(log D ), where D = disc(o). Andrew V. Sutherland (MIT) Computing the modular equation 1 of 8

21

22 Isogeny graphs The l-isogeny graph G l has vertex set {j(e) : E/F q } and edges (j 1, j ) whenever Φ l (j 1, j ) = 0. The neighbors of j 1 F q are the roots of Φ l (j 1, Y ) that lie in F q. Andrew V. Sutherland (MIT) Computing the modular equation 13 of 8

23 Isogeny graphs The l-isogeny graph G l has vertex set {j(e) : E/F q } and edges (j 1, j ) whenever Φ l (j 1, j ) = 0. The neighbors of j 1 F q are the roots of Φ l (j 1, Y ) that lie in F q. Isogenous curves are either both ordinary or both supersingular, thus we may speak of the ordinary and supersingular components of G l. We will focus on the ordinary components of G l. We have an infinite family of graphs, one for each prime l, all with the same vertex set. Andrew V. Sutherland (MIT) Computing the modular equation 13 of 8

24 l-volcanoes An l-volcano is a connected undirected graph whose vertices are partitioned into levels V 0,..., V d. 1. The subgraph on V 0 (the surface) is a regular connected graph of degree at most. Andrew V. Sutherland (MIT) Computing the modular equation 14 of 8

25 l-volcanoes An l-volcano is a connected undirected graph whose vertices are partitioned into levels V 0,..., V d. 1. The subgraph on V 0 (the surface) is a regular connected graph of degree at most.. For i > 0, each v V i has exactly one neighbor in V i 1. All edges not on the surface arise in this manner. 3. For i < d, each v V i has degree l+1. Andrew V. Sutherland (MIT) Computing the modular equation 14 of 8

26 l-volcanoes An l-volcano is a connected undirected graph whose vertices are partitioned into levels V 0,..., V d. 1. The subgraph on V 0 (the surface) is a regular connected graph of degree at most.. For i > 0, each v V i has exactly one neighbor in V i 1. All edges not on the surface arise in this manner. 3. For i < d, each v V i has degree l+1. The integers l, d, and V 0 uniquely determine the shape. Andrew V. Sutherland (MIT) Computing the modular equation 14 of 8

27 The l-isogeny graph G l Some facts about G l (Kohel, Fouquet-Morain): The ordinary components of G l are l-volcanoes (provided they don t contain j = 0, 178). The curves in level V i of a given l-volcano all have the same endomorphism ring, isomorphic to an imaginary quadratic order O i. The order O 0 is maximal at l, and O i O 0 has index l i. Curves in the same l-volcano are necessarily isogenous, but isogenous curves need not lie in the same l-volcano. Andrew V. Sutherland (MIT) Computing the modular equation 15 of 8

28 A 3-volcano of depth Andrew V. Sutherland (MIT) Computing the modular equation 16 of 8

29 Running the rim

30 Running the rim

31 Running the rim

32 Running the rim

33 Running the rim

34 Running the rim

35 Running the rim

36

37 Mapping a volcano Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

38 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

39 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

40 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l 1. Find a root of H D (X) Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

41 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l Find a root of H D (X): 901 Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

42 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 = l 0 l, ( D ) = 1 l Enumerate surface using the action of α l0 Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

43 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

44 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

45 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

46 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

47 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

48 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

49 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate surface using the action of α l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

50 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Descend to the floor using Vélu s formula Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

51 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Descend to the floor using Vélu s formula: Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

52 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3 l 0 l, ( D l 0 ) = 1, α l = α k l Enumerate floor using the action of β l0 Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

53 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

54 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

55 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

56 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

57 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

58 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

59 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

60 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Enumerate floor using the action of β l Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

61 Mapping a volcano Example General requirements l = 5, p = 4451, D = 151 4p = t v l D, p 1 mod l t = 5, v =, h(d) = 7 l v, ( D ) = 1, h(d) l + l l 0 =, α 5 = α 3, β 5 = β 7 l 0 l, ( D ) = 1, α l l = α k 0 l, β 0 l = βl k Andrew V. Sutherland (MIT) Computing the modular equation 18 of 8

62 Interpolation Φ 5 (X, 901) = (X 701)(X 351)(X 3188)(X 970)(X 1478)(X 338) Φ 5 (X, 351) = (X 901)(X 15)(X 3508)(X 464)(X 976)(X 566) Φ 5 (X, 15) = (X 351)(X 501)(X 3341)(X 1868)(X 434)(X 676) Φ 5 (X, 501) = (X 15)(X 87)(X 3147)(X 55)(X 1180)(X 3144) Φ 5 (X, 87) = (X 501)(X 158)(X 150)(X 48)(X 1064)(X 087) Φ 5 (X, 158) = (X 87)(X 701)(X 945)(X 3497)(X 344)(X 91) Φ 5 (X, 701) = (X 158)(X 901)(X 843)(X 41)(X 3345)(X 4397) Andrew V. Sutherland (MIT) Computing the modular equation 19 of 8

63 Interpolation Φ 5 (X, 901) = X X X X X X + 36 Φ 5 (X, 351) = X X X X X + 93X Φ 5 (X, 15) = X X X X X + 084X Φ 5 (X, 501) = X X X X X X Φ 5 (X, 87) = X X X X X X Φ 5 (X, 158) = X X X X 3 + 5X X Φ 5 (X, 701) = X X X X X + 7X Andrew V. Sutherland (MIT) Computing the modular equation 19 of 8

64 Interpolation Φ 5 (X, Y ) = X 6 + (4450Y Y Y Y + 70Y + 397)X 5 (370Y Y Y Y Y + 33)X 4 (433Y Y Y Y Y + 11)X 3 (3499Y Y Y Y Y + 050)X ( 70Y Y Y Y + 905Y + 091)X (Y Y Y Y Y + 091Y + 108) Andrew V. Sutherland (MIT) Computing the modular equation 19 of 8

65 Computing Φ l (X, Y ) mod p Assume D and p are suitably chosen with D = O(l ) and log p = O(log l), and that H D (X) has been precomputed. 1. Find a root of H D (X) over F p. O(l log 3+ɛ l). Enumerate the surface(s) using cl(d)-action. O(l log +ɛ l) 3. Descend to the floor using Vélu. O(l log 1+ɛ l) 4. Enumerate the floor using cl(l D)-action. O(l log +ɛ l) 5. Build each Φ l (X, j i ) from its roots. O(l log 3+ɛ l) 6. Interpolate Φ l (X, Y ) mod p. O(l log 3+ɛ l) Time complexity is O(l log 3+ɛ l). Space complexity is O(l log l). Andrew V. Sutherland (MIT) Computing the modular equation 0 of 8

66 After computing Φ 5 (X, Y ) mod p for the primes: 4451, 6911, 9551, 8111, 54851, , 13491, , 11711, 80451, , , , , we apply the CRT to obtain Φ 5 (X, Y ) = X 6 + Y 6 X 5 Y (X 5 Y 4 + X 4 Y 5 ) (X 5 Y 3 + X 3 Y 5 ) (X 5 Y + X Y 5 ) (X 5 Y + XY 5 ) (X 5 + Y 5 ) X 4 Y (X 4 Y 3 + X 3 Y 4 ) (X 4 Y + X Y 4 ) (X 4 Y + XY 4 ) (X 4 + Y 4 ) (X 3 Y 5 + X 5 Y 3 ) X 3 Y (X 3 Y + X Y 3 ) (X 3 Y + XY 3 ) (X 3 + Y 3 ) X Y (X Y + XY ) (X + Y ) XY (X + Y ) Andrew V. Sutherland (MIT) Computing the modular equation 1 of 8

67 After computing Φ 5 (X, Y ) mod p for the primes: 4451, 6911, 9551, 8111, 54851, , 13491, , 11711, 80451, , , , , we apply the CRT to obtain Φ 5 (X, Y ) = X 6 + Y 6 X 5 Y (X 5 Y 4 + X 4 Y 5 ) (X 5 Y 3 + X 3 Y 5 ) (X 5 Y + X Y 5 ) (X 5 Y + XY 5 ) (X 5 + Y 5 ) X 4 Y (X 4 Y 3 + X 3 Y 4 ) (X 4 Y + X Y 4 ) (X 4 Y + XY 4 ) (X 4 + Y 4 ) (X 3 Y 5 + X 5 Y 3 ) X 3 Y (X 3 Y + X Y 3 ) (X 3 Y + XY 3 ) (X 3 + Y 3 ) X Y (X Y + XY ) (X + Y ) XY (X + Y ) (but note that Φ f 5 (X, Y ) = X 6 + Y 6 X 5 Y 5 + 4XY ). Andrew V. Sutherland (MIT) Computing the modular equation 1 of 8

68 The algorithm Given a prime l > and an integer q > 0: 1. Pick a discriminant D suitable for l.. Select a set of primes S suitable for l and D. 3. Precompute H D, cl(d), cl(l D), and CRT data. 4. For each p S, compute Φ l mod p and update CRT data. 5. Perform CRT postcomputation and output Φ l mod q. To compute Φ l over Z, just use q = p. For small q, use explicit CRT modq. For large q, standard CRT for large q. For q in between, use a hybrid approach. Andrew V. Sutherland (MIT) Computing the modular equation of 8

69 Explicit Chinese remainder theorem Suppose c c i mod p i for n distinct primes p i. Then c c i a i M i mod M, where M = p i, M i = M/p i and a i = 1/M i mod p i. If M > c, we can recover c Z. With M > 4 c, the explicit CRT computes c mod q directly via ( ) c = ci a i M i rm mod q, where r is the closest integer to c i a i /p i. Using an online algorithm, this can be applied to k coefficients c in parallel, using O ( log M + n log q + k(log q + log n) ) space. Montgomery-Silverman, Bernstein, S. Andrew V. Sutherland (MIT) Computing the modular equation 3 of 8

70 Complexity Theorem (GRH) For every prime l > there is a suitable discriminant D with D = O(l ) for which there are Ω(l 3 log 3 l) primes p = O(l 6 (log l) 4 ) that are suitable for l and D. Heuristically, p = O(l 4 ). In practice, lg p < 64. Theorem (GRH) The expected running time is O(l 3 log 3 l log log l). The space required is O(l log(lq)). Andrew V. Sutherland (MIT) Computing the modular equation 4 of 8

71 Complexity Theorem (GRH) For every prime l > there is a suitable discriminant D with D = O(l ) for which there are Ω(l 3 log 3 l) primes p = O(l 6 (log l) 4 ) that are suitable for l and D. Heuristically, p = O(l 4 ). In practice, lg p < 64. Theorem (GRH) The expected running time is O(l 3 log 3 l log log l). The space required is O(l log(lq)). The algorithm is trivial to parallelize. Andrew V. Sutherland (MIT) Computing the modular equation 4 of 8

72 An explicit height bound for Φ l Let l be a prime. Let h(φ l ) be the (natural) logarithmic height of Φ l. Asymptotic bound: h(φ l ) = 6l log l + O(l) (Paula Cohen 1984). Andrew V. Sutherland (MIT) Computing the modular equation 5 of 8

73 An explicit height bound for Φ l Let l be a prime. Let h(φ l ) be the (natural) logarithmic height of Φ l. Asymptotic bound: h(φ l ) = 6l log l + O(l) (Paula Cohen 1984). Explicit bound: h(φ l ) 6l log l + 18l (Bröker-S 009). Conjectural bound: h(φ l ) 6l log l + 1l (for l > 30). The explicit bound holds for all l. The conjectural bound is known to hold for 30 < l < Andrew V. Sutherland (MIT) Computing the modular equation 5 of 8

74 Other modular functions We can compute polynomials relating f (z) and f (lz) for other modular functions, including the Weber function f(τ) = η((τ + 1)/), ζ 48 η(τ) which satisfies j(τ) = (f(τ) 4 16) 3 /f(τ) 4. The coefficients of Φ f l are roughly 7 times smaller. This means we need 7 fewer primes. The polynomial Φ f l is roughly 4 times sparser. This means we need 4 times fewer interpolation points. Overall, we get nearly a 178-fold speedup using Φ f l. Andrew V. Sutherland (MIT) Computing the modular equation 6 of 8

75 Modular polynomials for l = 11 Classical: X 1 + Y 1 X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X 11 Y X pages omitted digits omitted Atkin: X 1 X 11 Y + 744X X X 9 Y X X 8 Y X X 7 Y X X 6 Y X X 5 Y X X 4 Y X X 3 Y X X Y X XY X + Y Y Weber: X 1 + Y 1 X 11 Y X 9 Y 9 44X 7 Y X 5 Y 5 88X 3 Y 3 + 3XY Andrew V. Sutherland (MIT) Computing the modular equation 7 of 8

76 Weber modular polynomials For l = 1009, the size of Φ f l is.3mb, versus 3.9GB for Φ l, and computing Φ f l takes.8s, versus 830s for Φ l. The current record is l = Working mod q, level l > has been achieved. The polynomials Φ f l for all l < 5000 are available for download: drew Andrew V. Sutherland (MIT) Computing the modular equation 8 of 8