ALGORITHMS FOR ALGEBRAIC CURVES

ALGORITHMS FOR ALGEBRAIC CURVES SUMMARY OF LECTURE 7 I consider the problem of computing in Pic 0 (X) where X is a curve (absolutely integral, projective, smooth) over a field K. Typically K is a finite field. In that case Pic 0 (X) is finite. 1. HOW IS X GIVEN? There are several options. We will assume that we are given a plane, projective, possibly singular, curve C. The equation of C is E(X, Y, Z) = 0 where E is an homogeneous, absolutely irreducible polynomial of degree d. We assume that i : X C is the desingularization map. So i is everywhere locally an isomorphism, except above the singularities of C. We do not ask for a fully explicit description of X and i. We only need, for every branch P X above every singular point S C, A local parameter (a uniformizing parameter) t P at P. The expansions of affine coordinates (e.g. x = X/Z and y = Y/Z) as series in K[[t P ]]. Example : Take (1) E(X, Y, Z) = Y 2 Z X 2 (X + Z). Let U be the open subset of C given by the inequality Z 0. We have an affine equation E U (x, y) = y 2 x 2 (x + 1) for the affine curve U. To find the singularities on X we solve the system E = 0, (2) The only singularity is E X = 0, E Y = 0, E Z = 0. S = (0 : 0 : 1) in that case. This point lyes in U. To desingularize at S we set t = y x, 1

2 SUMMARY OF LECTURE 7 and find These equations define a morphism x = t 2 1, y = t 3 t. i : A 1 = Spec K[t] U, that extends to i : X = P 1 C. We set V = i ( 1) (U) = A 1. We have two points P and Q on V X above S C. These are the two branches above the singularity S. They correspond to the ideals (t 1) and (t + 1) in K[t]. A uniformizing parameter at P is thus t P = t 1, and the expansions of x and y at P are x = 2t P + t 2 P, Similarly, a uniformizing parameter at Q is y = 2t P + 3t 2 P + t 3 P. t Q = t + 1, and the expansions of x and y at Q are x = 2t Q + t 2 Q, y = 2t Q 3t 2 Q + t 3 Q. We have finite expansions here. But it will not be always the case. In general one founds the singular points on C using elimination theory to solve the system in (2). To find the uniformizing parameter and series expansion one may use the Puiseux-Newton algorithm [PotRyb], at least when the characteristic is zero or large enough. One also can use a generic algorithm to compute normal closures such as the Round 2 algorithm. This works without restriction on the base field. See for example Diem s habilitation thesis [Die]. 2. POINTS, PLACES, DIVISORS Smooth points on C are given by their projective coordinates. For example the point T = ( 1 : 0 : 1) on the curve C given by Equation (1) is smooth. There is a single point on X above it. The branches above singular points are listed. There are finitely many such branches. For each of them we have a local parameter and expansions of the affine coordinates as series in this local parameter. Places of degree bigger than one may be given in two different but equivalent ways. If the place is contained in some affine open subset V X, we may describe it by a generating set for the corresponding ideal in O X (V ). Assuming that the place lyes above a smooth place of

ALGORITHMS FOR ALGEBRAIC CURVES 3 C, we would rather give a generating set for the corresponding ideal in O C (U), where U is an affine open subset of C. If we come back to our example we may consider the ideal I = (x 1, y 2 2) O C (U) = K[x, y]/e U (x, y). This is a place of degree two if 2 is not a square in K. We may also describe a place by its splitting field and a list of the geometric points in the place. If we come back to the example above we may consider the splitting field L = K[u]/(u 2 2) and the two geometric points (1 : u : 1) and (1 : u : 1). We then characterize the place as the Zariski closure of any of these two geometric points. Divisors are given as linear combinations of places. 3. LOCAL PARAMETER AT A SMOOTH POINT It will often be necessary to compute a uniformizing parameter at a point P on X. We assume here that P lyes above a smooth point on C, which we will call S. Without loss of generality we may assume that S belongs to the open subset U with equation Z 0. Then either x x S or y y S is a local parameter at P. Indeed if ( ) E U x (S) 0 then y ys is a local parameter at S. And if ( ) E U y (S) 0 then x xs is a local parameter at S. Example : on the curve given by Equation (1) the point T = ( 1, 0) U is smooth since ( ) EU (T ) = 3x 2 T 2x T = 1 0. x And y y T = y is a local parameter at T. We set t T = y y T = y. We can easily express u = x x T = x + 1 as a series u = u 0 + u 1 t T + u 2 t 2 T + K[[t T ]] in the local parameter t T. This amounts to computing the root of the polynomial u 3 2u 2 + u t 2 T in K[[t T ]] having zero constant term. Such a root exists and is unique according to Hensel s lemma. Indeed the proof of this lemma also gives a linear algebra algorithm to compute the successive coefficients in the series u. We compute this expansion using the following commands in MAGMA >Q := RationalField(); >L<t> := PowerSeriesRing(Q); >R<u> := PolynomialRing(L); >f:=u^3-2*u^2+u-t^2; >Roots(f); [ <t^2 + 2*t^4 + 7*t^6 + 30*t^8 + 143*t^10 + 728*t^12 + 3876*t^14 + 21318*t^16 + 120175*t^18 + 690690*t^20 + O(t^22), 1>, <1 - t - 1/2*t^2-5/8*t^3 - t^4-231/128*t^5-7/2*t^6-7293/1024*t^7-15*t^8-1062347/32768*t^9-143/2*t^10-42010995/262144*t^11-364*t^12-3506302275/4194304*t^13-1938*t^14-151973158605/33554432*t^15-10659*t^16-54200780036595/2147483648*t^17-120175/2*t^18-2469463609737495/17179869184*t^19 + O(t^20), 1>, <1 + t - 1/2*t^2 + 5/8*t^3 - t^4 + 231/128*t^5-7/2*t^6 + 7293/1024*t^7-15*t^8 + 1062347/32768*t^9-143/2*t^10 + 42010995/262144*t^11 -

4 SUMMARY OF LECTURE 7 ] 364*t^12 + 3506302275/4194304*t^13-1938*t^14 + 151973158605/33554432*t^15-10659*t^16 + 54200780036595/2147483648*t^17-120175/2*t^18 + 2469463609737495/17179869184*t^19 + O(t^20), 1> The series we are interested in is the first one u = x + 1 = y 2 + 2y 4 + 7y 6 + 30y 8 + 143y 10 + 728y 12 + 3876y 14 + O(t 16 ). 4. FORMS AND FUNCTIONS ON X Let h be a positive integer. The K-vector space of homogeneous polynomials in X, Y, Z, with degree h, is H 0 (P 2, O P 2(h)). It has dimension (h + 1)(h + 2)/2. Any function on P 2 is the quotient of two forms of the same degree. Any function on X is the the quotient of two forms F/G of the same degree, such that G restricted to X is non zero (G is not a multiple of the equation E of C). So a function on X can be given as the quotient of two homogeneous polynomials in the projective coordinates X, Y, and Z. Given such a function, it will often be useful to compute its divisor. For example if C is the projective curve given by Equation (1) then we consider the function y = Y Z and look for its divisor (y) on X. The support of the positive part (y) + of (y) lies above the intersection locus of C with the line Y = 0. Such an intersection can be computed using elimination theory (e.g. resultants). We find that it consists of the two points S = (0 : 0 : 1) and T = ( 1 : 0 : 1). We have two branches (called P and Q) on X above S. And one single branch above T. At each of these three branches, we know a uniformizing parameter and expansions of x and y in this parameter. So we can embed y in these three local rings and compute the valuations. The support of the negative part (y) of (y) lies above the intersection locus of C with the line Z = 0. We find that this intersection consists of the one points O = (0 : 1 : 0). This is a smooth point. We have a single branch above it. In the end we find that the divisor of y is (y) = P + Q + T 3O. 5. LINEAR SERIES ON X Let h be a positive integer. The K-vector space of homogeneous polynomials in X, Y, Z, with degree h, is H 0 (P 2, O P 2(h)). It has dimension (h + 1)(h + 2)/2. Let F in H 0 (P 2, O P 2(h)) be such that the pull back f of F onto X is non-zero. This condition means that F is not a multiple of the equation E of X. Let = (f) be the divisor of f. This is the (pull back on X of the) intersection divisor between C and the projective curve D with degree h and equation F (X, Y, Z) = 0. So is an effective divisor of degree dh according to Bézout s theorem. If G

ALGORITHMS FOR ALGEBRAIC CURVES 5 is another form in H 0 (P 2, O P 2(h)), we denote by g the pull back of G on X. Then the quotient G/F defines a function on P 2. And the quotient g/f is a function on X. We thus obtain a map (3) H 0 (P 2, O P 2(h)) H 0 (X, O X ( )) G It is natural to ask if this map is surjective. In other words, do we obtain a complete linear series by pulling back homogeneous forms onto X? The answer is no in general, but we have a partial result called the Brill-Noether theorem. The image of the map in (3) contains H 0 (X, O X ( C)) where C is a divisor on X called the conductor. The conductor C is an effective divisor on X. It is the closed subscheme of X defined by the sheaf of O X -ideals g f. C = Ann OC (O X /O C ). Locally, for U an affine open subset of C, and V = i ( 1) (U) X, the O X (V )-ideal C(V ) is the annihilator C(U) = Ann OC (U)(O X (V )/O C (U)). This is an ideal of O C (U) by definition. This is also an ideal of O X (V ). Indeed, let c be in C(U) and let b be in O X (V ). Then we prove that bc lyes in C(U). First of all bc belongs to O C (U) because b is in O X (V ) and c is in the annihilator of the quotient O X (V )/O C (U). Then bc lies in this annihilator also because for every b in O X (V ) the product bcb = c(bb ) belongs to O C (U) because bb is in O X (V ) and c is in the annihilator of the quotient O X (V )/O C (U). In fact C(U) is the largest ideal in O C (U) O X (V ) that is also an ideal of O X (V ). The degree of C is 2δ where (d 1)(d 2) δ = g 2 is the difference between the arithmetic genus of C and the geometric genus g of X. The support of C is the set of branches on X above singular points on C. Computing the multiplicity of C at a given branch may be a bit difficult, see [Gor], but we have at least an upper bound for these multiplicities, namely (d 1)(d 2). The conductor measures how singular C is. A practical consequence of all that is that we can compute the complete linear series H 0 (X, O X ( D)) for any divisor D such that D C, and any intersection divisor = C.D between C and a degree h 1 projective curve D. We start from a basis G 1, G 2,..., G I of H 0 (P 2, O P 2(h)). We can take for (G i ) 1 i I the set of all monomial X a Y b Z c with a + b + c = h. We evaluate every G i at every place in D and obtain a matrix with I columns and deg(d) lines. Let H 1, H 2,..., H J be a basis for the kernel of this matrix. Then the H j /F form a basis of H 0 (X, O X ( D)).

6 SUMMARY OF LECTURE 7 Notice that in order to evaluate the G i at every place in the support of D, we use the expansions of the affine coordinates as series in the local parameters at these places. Note also that the dimension of H 0 (X, O X ( D)) is at least dh deg(d) g + 1 and is equal to this number when it is g. Example : we come back to the curve given by Equation (1). The only singularity is S = (0, 0) U = Spec K[x, y]/e U (x, y). The inverse image of U by i is V = A 1 = Spec K[t] X = P 1. So O X (V ) = K[t] and O C (U) = K[x, y] and the map i induces the inclusion K[x, y] K[t] with x = t 2 1 and y = t 3 t. We look for the ideal annihilator C(V ) of the K[t 3 t, t 2 1]-module K[t]/K[t 3 t, t 2 1]. This is a K[t 3 t, t 2 1]-ideal. And also a K[t]-ideal. Its support must be contained in {(t 1), (t+1)}. Indeed, if we invert t 2 1, the quotient module K[t]/K[t 3 t, t 2 1] becomes trivial. So C(V ) = (t 1) a (t + 1) b where a and b are two positive integers. A basis for the K-vector space K[t]/K[t 3 t, t 2 1] is (1, t). If we multiply 1 by t 2 1 we find t 2 1 which is in K[t 3 t, t 2 1]. If we multiply t by t 2 1 we find t 3 t which is in K[t 3 t, t 2 1] also. So t 2 1 belongs to C(V ). We note that C(V ) cannot be equal to (t 1) or to (t + 1) because t does not belong to K[t 3 t, t 2 1]. So we have found the conductor C(V ) = (t 2 1)K[t] K[t 3 t, t 2 1] K[t]. The degree of the conductor is 2 and indeed g = 0 and (d 1)(d 2)/2 = 1. 6. COMPUTING ANY COMPLETE LINEAR SERIES Given two effective divisors A and B on X, we want to compute H 0 (X, O X (A B)). We may assume that deg(a) deg(b), otherwise the linear space is trivial. We pick a large enough integer h and compute H 0 (X, O X ( C)) where C is the conductor and is the divisor of any form of degree h having non-zero pull-back on X. We use the methods in section 5 to compute this space. We compute H 0 (X, O X ( C A)) as a subspace of H 0 (X, O X ( C)). To this end we pick a basis f 1,..., f I of H 0 (X, O X ( C)) and we evaluate each f i at every place in A. We thus obtain a matrix with deg(a) lines and I columns. Computing the kernel of this matrix gives H 0 (X, O X ( C A)). The dimension of this latter space is dh deg(c) deg(a) g + 1. We assume that we have chosen h large enough to ensure that dh deg(c) + deg(a) + g. So the dimension of H 0 (X, O X ( C A)) is positive. We pick a non-zero function f in H 0 (X, O X ( C A)) and compute is divisor (f) = + C + A + D,

ALGORITHMS FOR ALGEBRAIC CURVES 7 where D is an effective divisor of degree dh deg(c) deg(a). We now compute H 0 (X, O X ( C D B)) as a subspace of H 0 (X, O X ( C)). We proceed as before. The map H 0 (X, O X ( C D B)) H 0 (X, O X (A B)) is a bijection. g g f, 7. COMPUTING IN Pic 0 (X) We choose a degree g origin divisor D 0. For example we may take D 0 = go where O is a point in X(K). Every class x in Pic 0 (X) contains a divisor of the form D x D 0 where D x is a degree g effective divisor. Indeed let E be any divisor in x. It has degree zero. So H 0 (X, O X (E + D 0 )) has dimension g g + 1. Let f be a non-zero function in this space. Let (f) = E D 0 + D x be the divisor of f. The divisor D x is a degree g effective divisor and D x D 0 is linearly equivalent to E. So it belongs to x. So every class in Pic 0 (X) will be represented as a difference D x D 0. This representation might not be unique. To test whether D x D 0 is linearly equivalent to D y D 0 we compute the linear space H 0 (X, O X (D x D y )). This space is non-zero if and only if D x is linearly equivalent to D y. Now we want to compute the class of the sum D x D 0 + D y D 0. We want a divisor of the form D z D 0 in this class, with D z effective of degree g. To find such a D z we compute the linear space H 0 (X, O X (D x + D y D 0 )) and pick a non-zero function (f) in it. The divisor of f is (f) = D x D y + D 0 + D z where D z is an effective degree g divisor such that D z D 0 is linearly equivalent to D x D 0 + D y D 0. This is exactly what we want. Finally, we want to compute the opposite of the class of D x D 0. We want a divisor of the form D y D 0 in this opposite class, where D y is effective of degree g. To find such a D y we compute the linear space H 0 (X, O X (2D 0 D x )) and pick a non-zero function (f) in it. The divisor of f is (f) = 2D 0 + D x + D y where D y is an effective degree g divisor such that D y D 0 is linearly equivalent to D 0 D x. This is exactly what we want. 8. DISCRETE LOGARITHM? We may try to compute discrete logarithms in Pic 0 (X). We are given two classes u and v in Pic 0 (X) and look for an integer k such that v = ku. Note that Pic 0 (X) is commutative but not necessarily cyclic. We try to mimic the linear sieve algorithm. We assume, to simplify, that X has a K-rational point O. We choose a positive integer b g and consider all places p 1, p 2,..., p I of degree b on X. For every place p i we call w i the class of p i deg(p i )O in Pic 0 (X). We call B the set of all w i for 1 i I. We look for the module of relations Λ Z 2+I between u, v, and the (w i ) 1 i I.

8 SUMMARY OF LECTURE 7 We pick uniform random independent variables e, f, (k i ) 1 i I in [0, o[ where o is the order of Pic 0 (X) if we know it. If we don t know the order of Pic 0 (X), we take for o a large enough integer (much larger than the upper-bound (q + 1 + 2 q) g for the cardinality of Pic 0 (X)). We compute the sum eu + fv + k i w i = x Pic 0 (X), 1 i I using the methods in Section 7 and fast exponentiation. The result x is given as the class of D x go where D x is an effective degree g divisor. We hope that D x is a b-smooth divisor. This means that all the places in the support of D x have degree b. In that case x is a sum of elements in B. So we obtain a relation in Λ. We collect enough such relations. If we have obtained a generating set for Λ, we compute the Hermite normal and deduce the cardinality o of Pic 0 (X) and the discrete logarithm Log u v if it exists. The running time of this algorithms depends on the density of b-smooth divisors among effective divisors of degree g. It is natural to choose b = g. For a fixed finite F q and letting the genus of X tend to infinity, Florian Hess [Hes] has proven that this running time is exp(g 1/2+o(1) ). REFERENCES [Coh] H. Cohen. A course in computational algebraic number theory. Graduate Texts in Mathematics, 138. Springer, Berlin, 1993. [Die] C. Diem. On arithmetic and the discrete logarithm problem in class groups of curves. Available on-line at: http://www.math.uni-leipzig.de/~diem/preprints/english.html [Gor] D. Gorenstein. An arithmetic theory of adjoint plane curves. Trans. Amer. Math. Soc. 72 (1952), 414 436. [Gat] J. Von Zur Gathen and J. Gerhard. Modern Computer Algebra. Cambridge University Press. [Hes] F. Hess. Computing relations in divisor class groups of algebraic curves over finite fields. Available on-line at: http://page.math.tu-berlin.de/~hess/personal/bibliography.html [Liu] Q. Liu. Algebraic geometry and arithmetic curves. Oxford University Press. [PotRyb] A. Poteaux and M. Rybowicz. Complexity Bounds for the rational Newton-Puiseux Algorithm over Finite Fields. Applicable Algebra in Engineering, Communication and Computing, Volume 22, Issue 3, May 2011, Pages 187-217.