Computing mo dular curves via quaternions David R Kohel National University of Singap ore January Based on a talk given at the Fourth CANT Conference Number Theory and Cryptography University of Sydney December x1 Intro duction Mo dular curves are of central interest for b oth the theoretical and compu tational investigation of elliptic curves In the course of proving Fermats Last Theorem Wiles and TaylorWiles established that a large class of elliptic curves are parameterized by a mo dular curve Cremona has develop ed eective algorithms and p erformed extensive computations of these parametriza tions In a dierent direction Elkies has used explicit mo dels for mo dular curves to make signicant practical improvements to a theoretical p olynomial time algorithm of Scho of for computing the trace of Frob enius on an elliptic curve over a nite eld This has made it p ossible to compute the numb er of p oints on elliptic curves over nite elds whose cardinality measures hundreds of decimal digits In order to apply this algorithm one must precompute a large numb er of explicit mo dels for mo dular curves One approach to the problem of computing mo dels for mo dular curves is to pro duce a basis for the space of weight two cusp forms Such forms corresp ond to dierentials on the curve by which one can construct the canonical mor phism to pro jective space When a curve is of genus greater than two and not hyp erelliptic the canonical morphism is an emb edding and gives a nonsingular mo del for the curve For the purp oses of computation it serves to have the additional informa tion of the Hecke mo dule structure on dierentials This gives information on the decomp osition of the Jacobian and on curves covered by the mo dular curve In particular we exploit the explicit action of the canonical involution to decomp ose the cusp forms into invariant and antiinvariant eigenspaces The investigation of parametrizations of curves of higher genus is aided by a Hecke mo dule decomp osition of the space of dierentials It will b e the purp ose of this article to discuss certain isomorphisms of Hecke mo dules dened in very dierent contexts and to describ e isomorphisms among them The relation b etween sup ersingular elliptic curves and the ideal theory in a quaternion algebra app ears in the classical work of Deuring which in the mo dern theory is prop erly stated as an equivalence of categories The basis problem of Eichler provides the means of relating the ideal theory to mo d ular forms Using this theory Pizer describ es an algorithm for computing mo dular forms The metho d of graphs of Oesterle and Mestre rephrases the theory of quaternion ideals in terms of sup ersingular elliptic curves This gives an intuitive metho d for relating the Hecke mo dule dened as a subgroup of the divisor group of a mo dular curve with the space of mo dular forms of weight two In this work they express the Hecke op erator T n in terms of the adjacency op erator of a graph of sup ersingular elliptic curves Via the ab ove mentioned equivalence of categories the ideas of Oesterle and Mestre translate into the computationally simpler world of the ideal theory of a quaternion algebra Us ing a metho d which is in essence that of Pizer one can compute an array of quadratic forms determining the Brandt morphism For any n the Hecke op erator T n can b e extracted as the Brandt matrix of nth representation numb ers of these quadratic forms In section two we discuss quaternion algebras and their ideal theory and follow in section three with a discussion of the equivalence b etween sup ersingular elliptic curves and certain ideals over a maximal order In section four we recall the main ideas of the metho d of graphs of Mestre and Oesterle Section ve intro duces the Brandt morphism given in terms of the Brandt matrix of theta functions for quadratic forms asso ciated to the mo dule of homomorphisms of a basis of ideals We conclude with a discussion in section six of the computational asp ects of computing mo dular curves using the ideal theory of quaternions As an app endix to this article we give a table of characteristic p olynomi als of the Hecke op erators which suce to determine the decomp osition of the Jacobian of corresp onding mo dular curve We further give examples of com putations of the ring of mo dular functions combining several ideas from the article of Elkies For any given level one can make improvements to this approach A signicant advantage however is that this approach is systematic thus suitable for implementation or for proving b ounds for the computational complexity x2 Quaternion algebras over Q A quaternion algebra A over Q is a central simple algebra of dimension four over Q The numb er theory of these algebras is analogous to that of numb er elds In particular we have an noncommutative theory for each of the following ob jects and concepts from commutative numb er theory Maximal orders There exist innitely many maximal orders of any quater nion algebra however they fall in nitely many isomorphism classes Ideal theory We can study the onesided and twosided ideals of a given maximal order in a quaternion algebra Again these fall into nitely many classes Ramication and splitting The quaternion algebra A is said to split at the rational prime l if A A Q is isomorphic to M Q Otherwise l l l A is said to ramify at l and A is a division algebra Likewise A is said to l split or ramify at innity if A R is a matrix algebra or a division algebra Quaternion algebras are analogous to quadratic extensions of Q In fact the analogy go es further every element x of A not in the center generates a quadratic extension of Q Example The matrix algebra M Q is a quaternion algebra which we call the split quaternion algebra over Q Let x b e the element and set K Q x Then K is isomorphic to the ring Q X X X Every maximal order is conjugate to the order M Z Example Let A Q Q i Q j Q k b e the quaternion algebra dened by the relations i j k ij j i Then A ramies at and at innity and O Z Zi Zj Z where i j k is the unique maximal order up to isomorphism x3 Sup ersingular elliptic curves Let k b e an algebraically closed eld of characteristic l An elliptic curve E is sup ersingular if and only if its endomorphism ring O EndE is an order in a quaternion algebra Moreover A O Q is ramied at l and at innity and O is a maximal order in A Let E b e a xed sup ersingular elliptic curves over k Then the map F HomE F determines a bijection of the set of isomorphism classes of sup ersin gular elliptic curves with the isomorphism classes of lo cally free rank one right O mo dules This is prop erly stated as an equivalence of categories as follows Theorem Let k be an algebraic closure of a nite eld let S be the category of supersingular el liptic curves over k and let E be an object in S Then the functor Hom E to the category of local ly free rank one right modules over S O EndE is an equivalence of categories Consequences We note a few consequences of the theorem Under the equivalence isogenies of elliptic curves corresp ond to nonzero O mo dule homomorphisms Isomorphism of ob jects is functorial thus the nite set of isomorphism classes in each category are in bijective cor resp ondence Given any right O mo dule of the form HomE F we can cho ose any element Then the dual determines an emb edding b HomE F O EndE as an ideal of O By the equivalence of categories every lo cally free rank one right mo dule over O is isomorphic to one of the form HomE F and all of its emb eddings in O are determined in this way The degree of a morphism I J of right O mo dules is dened which we refer to as the norm N in the category I The norm may b e dened lo cally or as the squarero ot of jJ I j For nite extensions k F the functor F HomE F where l is the Frob enius morphism gives an equivalence of sup ersingular elliptic curves over k with an appropriately dened category of pairs One can dene the j invariant of an ideal I To make the latter well dened we must sp ecify an orientation O k as describ ed in Rib et An orientation is a homorphism to k with the kernel equal to the unique prime ideal containing p The image is a quadratic extension over the prime eld in which the j invariant of I lies In its full generality we take a category of sup ersingular elliptic curves with level N structure and ideals of an Eichler order of index N in the maximal order In terms of computations the two categories are quite dierent The j invariant of an elliptic curve is trivial to compute while the endomorphism ring and isogenies are generally dicult In contrast determining homomorphisms and the endomorphism ring is easy for ideals and determining the j invariant of an O ideal is presumably of comparable diculty to that of determining the j invariant mo dulo l of a binary quadratic lattice x4 Metho d of graphs Following Mestre we asso ciate a graph to a set S of representatives of the isomorphism classes of S Fix an integer n Let S b e the set of vertices and let the edges E b e the isogenies E F of degree n with cyclic kernel up to isomophism of F Dene i t - E S S - i t E F This denes a directed multigraph For an edge E F the curve E i is called the initial vertex and F t is called the terminal vertex For a prime n p the numb er of edges with initial vertex E are p in numb er in bijection with the p cyclic subgroups of E p ZpZ ZpZ Due to automorphisms of E fewer edges may terminate