The complex AGM, periods of elliptic curves over C and complex elliptic logarithms
aa r X i v : . [ m a t h . N T ] F e b The complex AGM, periods of elliptic curvesover C and complex elliptic logarithms John E. CremonaThotsaphon ThongjunthugOctober 25, 2018
Abstract
We give an account of the complex Arithmetic-Geometric Mean (AGM),as first studied by Gauss, together with details of its relationship withthe theory of elliptic curves over C , their period lattices and complexparametrisation. As an application, we present efficient methods for com-puting bases for the period lattices and elliptic logarithms of points, forarbitrary elliptic curves defined over C . Earlier authors have only treatedthe case of elliptic curves defined over the real numbers; here, the multi-valued nature of the complex AGM plays an important role. Our method,which we have implemented in both MAGMA and
Sage , is illustrated withseveral examples using elliptic curves defined over number fields with realand complex embeddings.
Let E be an elliptic curve defined over C , given by a Weierstrass equation E : Y = 4( X − e )( X − e )( X − e ) , where the roots e j ∈ C are distinct. As is well known, there is an isomorphism(of complex analytic Lie groups) C / Λ ∼ = E ( C ), where Λ is the period lattice of E :specifically, we take Λ to be the lattice of periods of the invariant differential dX/Y on E . It is a discrete rank 2 subgroup of C , spanned by a Z -basis { w , w } with w /w / ∈ R . The isomorphism is given by the map z (mod Λ) P = ( ℘ Λ ( z ) , ℘ ′ Λ ( z )) ∈ E ( C )(with 0 (mod Λ) O ∈ E ( C ), the base point at infinity) where ℘ Λ denotes theclassical elliptic Weierstrass function associated to the lattice Λ. The inverse ofthis map, P z (mod Λ) , from E ( C ) to C / Λ, is called the elliptic logarithm , and we say that any z ∈ C representing its class modulo Λ is an elliptic logarithm of P . Two naturalquestions are:1. How can we compute a basis for the period lattice Λ of E , given a Weier-strass equation? 1. Given a point P = ( x, y ) ∈ E ( C ), how can we compute its elliptic loga-rithm z ∈ C ?For elliptic curves over R , these questions have been answered satisfactorilyand are well-known. Algorithms for computing Z -bases for period lattices ofelliptic curves defined over R , and elliptic logarithms of real points on suchcurves, may be found in the literature (see, for example, [3, Algorithm 7.4.8]or [5, § arithmetic-geometric mean (AGM), and allowone to compute both values rapidly with a high degree of precision. The theorybehind this method is described succinctly by Mestre in [2]. The situation forelliptic curves over C , however, is less satisfactory.In this paper, we will give a complete method for computing period latticesand elliptic logarithms for elliptic curves over C , by generalising the real algo-rithm. To this end, we will first explain the connection between the followingthree classes of objects: • Complex AGM sequences, as first studied by Gauss and explored in depthmore recently by Cox [4]; • Chains of lattices in C ; • Chains of 2-isogenies between elliptic curves defined over C .These will be defined precisely below. This connection will allow us to derivean explicit formula (see Theorems 19 and 21 below), based on so-called optimal complex AGM values, for a Z -basis of the period lattice of any elliptic curvedefined over C . We then develop our method further to give an iterative method(Algorithm 28) for computing elliptic logarithms of complex points.Our approach to the computation of periods follows closely that of Bost andMestre [2] in the real case. However, in that case there is only a single chain of2-isogenies which needs to be considered, and a unique AGM sequence, whileover C we find it convenient to consider a whole class of such sequences. Theconnection between these three types of sequence has some independent interest.We note that the recent paper [7] and thesis [8] by Dupont also presentsrelated methods for evaluating modular functions using the complex AGM, in-cluding explicit complexity results (see [8, Prop. 3.3]). The results in [7] mayalso be used to compute complex periods, as these are given by elliptic integralswith complex parameters.In the next three sections of the paper we consider in turn complex AGMsequences (as are described well in Cox [4]), then lattice chains and finallychains of 2-isogenies. Then we give the first application, to the computationof a basis for the period lattice (see Theorem 21). The following section givesa new proof of a result about the complete set of values of the (multi-valued)complex AGM, slightly more general than the version in [4]. Then in Section 8we develop the elliptic logarithm algorithm (Algorithm 28). The paper endswith a set of illustrative examples, using curves defined over number fields withreal and complex embeddings, and remarks on the algorithms’ efficiency.Our algorithms have been implemented by the authors both in Sage (see[10]) and in
MAGMA (see [1], code available from the second author).The results of this paper form part of the PhD thesis [11] of the second au-thor. The proofs are in some cases different: in [11] both the periods and elliptic2ogarithms are expressed more traditionally, as integrals over the Riemann sur-face E ( C ); however the resulting iterative algorithms are identical. The secondauthor acknowledges the support of the Development and Promotion of Scienceand Technology Talent Project (DPST) of the Ministry of Education, Thailand. Let ( a, b ) ∈ C be a pair of complex numbers satisfying a = 0 , b = 0 , a = ± b. (1)We say that ( a, b ) is good if ℜ ( b/a ) ≥
0, or equivalently, | a − b | ≤ | a + b | ; (2)otherwise the pair is said to be bad . Clearly, only one of the pairs ( a, b ), ( a, − b )is good, unless ℜ ( b/a ) = 0 (or equivalently, | a − b | = | a + b | ), in which case bothare good.An arithmetic-geometric mean (AGM) sequence is a sequence (( a n , b n )) ∞ n =0 ,whose pairs ( a n , b n ) ∈ C satisfy the relations2 a n +1 = a n + b n , b n +1 = a n b n for all n ≥
0. It is easy to see that if any one pair ( a n , b n ) in the sequencesatisfies (1) then all do, and we will make this restriction henceforth.From any given starting pair ( a , b ) there are uncountably many AGM se-quences, obtained by iterating the procedure of replacing ( a n , b n ) by the arith-metic mean a n +1 = ( a n + b n ) / b n +1 = √ a n b n , witha choice of the square root for b n +1 at each step. However, we usually preferto consider the entire sequence as a whole. We say that an AGM sequence is good if the pairs ( a n , b n ) are good for all but finitely many n . A good AGMsequence in which ( a n , b n ) are good for all n > optimal , and strongly optimal if in addition ( a , b ) is good. If an AGM sequence is not good,then we say that it is bad .It is easy to check that ( a n +1 , ± b n +1 ) are both good if and only if a n /b n is real and negative, in which case ( a n , b n ) is certainly bad. In an optimalsequence, this situation can only occur for n = 0. In consequence, for everystarting pair ( a , b ) there is exactly one optimal AGM sequence, unless a /b is real and negative, in which case there are two, with different signs of b ,with the property that the ratios a n /b n in one of the sequences are the complexconjugates of those in the other.The following proposition is from Cox (see [4]); the proof of parts (1) and (2)is elementary, and we refer the reader to [4]; part (3) appears deeper, and wewill give a proof below after relating the different AGM values to a certain setof periods of an elliptic curve. Note that Cox defines the notion of “good” morestrictly than above (when ℜ ( a/b ) = 0 he requires ℑ ( a/b ) >
0, so that exactlyone of ( a, ± b ) is good in every case), but in view of the preceding remarks thisdoes not affect the following result. Proposition 1.
Given a pair ( a , b ) ∈ C satisfying (1) , every AGM sequence (( a n , b n )) ∞ n =0 starting at ( a , b ) satisfies the following: . lim n →∞ a n and lim n →∞ b n exist and are equal;2. The common limit, say M , is non-zero if and only if the sequence is good;3. | M | attains its maximum (among all AGM-sequences starting at ( a , b ) )if and only if the sequence is optimal. For an AGM sequence (( a n , b n )) ∞ n =0 starting at ( a , b ), we will denote thecommon limit lim n →∞ a n = lim n →∞ b n by M S ( a , b ), where S ⊆ Z > is theset of all indices n for which the pair ( a n , b n ) is bad. For example, M ∅ ( a , b )denotes the common limit for the optimal AGM sequence. To avoid ambiguitieswhen a /b is negative real, we may agree to choose b so that ℑ ( a /b ) > S is a finite set. To ease notation, we shallwrite M ∅ ( a , b ) simply as M ( a , b ). In this paper, a lattice will always be a free Z -module of rank 2, embedded as adiscrete subgroup of C . Elements of lattices will often be called periods, since inour application the lattices will arise as period lattices of elliptic curves definedover C .The following definition, as well as Lemma 2, only depend on the algebraicstructure of lattices. We define a chain of lattices (of index ) to be a sequenceof lattices (Λ n ) ∞ n =0 which satisfies the following conditions:1. Λ n ⊃ Λ n +1 for all n ≥ n : Λ n +1 ] = 2 for all n ≥ / Λ n is cyclic for all n ≥
1; equivalently, Λ n +1 = 2Λ n − for all n ≥ n ≥ n +1 = h w i + 2Λ n (3)for some w ∈ Λ n \ n − . Given an initial lattice Λ , there are three possibilitiesfor Λ . When n ≥
1, one of the three sublattices of index 2 is excluded, since it iscontained in 2Λ n − (which would contradict the last condition in the definition),and so there are only two possible choices for Λ n +1 . The number of such chainsstarting with Λ is uncountable; we will distinguish a countable subset of theseas follows. Let Λ ∞ = ∞ \ n =0 Λ n . Then Λ ∞ is free of rank at most 1; the rank cannot be 2, since for all n ,[Λ : Λ ∞ ] ≥ [Λ : Λ n ] = 2 n , so [Λ : Λ ∞ ] is infinite. We say that the chain is good if Λ ∞ has rank 1; in thiscase a generator for Λ ∞ will be called a limiting period of the chain. We willfirst show that the limiting period is primitive , in the sense that it is not in m Λ for any m ≥
2. 4 emma 2.
Let (Λ n ) ∞ n =0 be a good chain with Λ ∞ = h w ∞ i . Then1. w ∞ is primitive; equivalently, Λ / Λ ∞ is free of rank ;2. Λ n = h w ∞ i + 2 n Λ for all n ≥ .Proof. Suppose that w ∞ = mw for some m ≥ w ∈ Λ . If m is odd, thensince Λ / Λ n has order 2 n which is prime to m , we see that mw ∈ Λ n = ⇒ w ∈ Λ n for all n , so that w ∈ Λ ∞ . Hence (by definition of w ∞ ), m = 1.Next suppose that w ∞ = 2 w for some w ∈ Λ . By definition of w ∞ , we thenhave w / ∈ Λ ∞ , and hence there exists n > w / ∈ Λ n . This impliesthat w ∞ ∈ Λ n \ n . But since w ∞ ∈ Λ n +1 , we haveΛ n +1 = h w ∞ i + 2Λ n = h w i + 2Λ n +1 ⊆ , which contradicts the definition of a chain. This proves the first statement.The second statement follows from the fact that Λ n / n Λ is cyclic of order2 n , and is generated by w ∞ modulo 2 n Λ , since w ∞ is primitive.So far, our notion of a good chain has been defined as a property of the chainas a whole, and only used the abstract structure of lattices as free Z -modules.Using the next definition, we will see that this property can also be seen interms of the individual steps Λ n ⊃ Λ n +1 , when the lattices are embedded in C .In view of (3), the choice of Λ n +1 is determined by the class of w modulo 2Λ n .For n ≥
1, we say that Λ n +1 ⊂ Λ n is the right choice of sublattice of Λ n ifΛ n +1 = h w i + 2Λ n where w is a minimal element in Λ n \ n − (with respectto the usual complex absolute value). Lemma 3.
Let (Λ n ) ∞ n =0 be a good chain with Λ ∞ = h w ∞ i . Then w ∞ is minimalin Λ n for all but finitely many n ≥ .Proof. Since Λ is discrete, the number of periods w ∈ Λ with 0 < | w | < | w ∞ | is finite. Each of these periods lies in only finitely many Λ n by minimality of w ∞ in Λ ∞ , so there exists n such that w ∞ is minimal in Λ n and hence also in Λ n for all n ≥ n .The following proposition yields an alternative notion of a good chain. Fornow we remark that this is analogous to the definition of a good AGM sequencein the previous section; more of its analogues will be seen in later sections. Proposition 4.
A chain of lattices (Λ n ) ∞ n =0 is good if and only if Λ n +1 ⊂ Λ n is the right choice for all but finitely many n ≥ .Proof. Let (Λ n ) ∞ n =0 be a good chain with Λ ∞ = h w ∞ i . Then by Lemma 3,there exists an integer n such that w ∞ is minimal in Λ n for all n ≥ n . SinceΛ n +1 = h w ∞ i + 2Λ n for all n , then by definition, Λ n +1 ⊂ Λ n is the right choicefor all n ≥ n .Conversely, suppose that Λ n +1 ⊂ Λ n is the right choice for all n ≥ n (where n ≥ n = 1. Let w ∈ Λ be a minimal element. Then w is certainly primitive (as an element of Λ ,5hough not necessarily in Λ ). We claim that w ∈ Λ n for all n ≥
1, so that thechain is good with limiting period w .To prove the claim, suppose that w ∈ Λ j for all j ≤ n . Then Λ n = h w i +2 n − Λ , since the latter is contained in the former and both have index 2 n − inΛ . Hence Λ n = h w , n − w i , where w ∈ Λ is such that Λ = h w , w i . Theright sublattice of Λ n +1 is clearly h w i + Λ n , by minimality of w (which is acandidate since w ∈ Λ n \ n − ); in particular, w ∈ Λ n +1 , as required. Let us define a lattice chain to be optimal if Λ n +1 ⊂ Λ n is the right choice for all n ≥
1. We will see that there is in general just one optimal chain for eachof the three choices of Λ ⊂ Λ . In order to make the statement more precise,however, some preparation is necessary.We say that a lattice Λ ⊂ C is rectangular if it has an “orthogonal” Z -basis { w , w } , meaning one which satisfies ℜ ( w /w ) = 0. For example, theperiod lattice of an elliptic curve defined over R with positive discriminant isrectangular, where an orthogonal basis is given by the least real period and theleast imaginary period. In general, rectangular lattices are homothetic to theperiod lattices of this family of elliptic curves.If { w , w } is any Z -basis for a lattice Λ, the three non-trivial cosets of 2Λin Λ are C j = w j + 2Λ for j = 1 , ,
3, where w = w + w . By a minimal cosetrepresentative in Λ we mean a minimal element of one of these cosets. Minimalcoset representatives are always primitive; for they are certainly not in 2Λ, andif w = mw ′ with m ≥ | w ′ | < | w | while w ′ is in the same coset as w . Lemma 5.
In each coset C j the minimal coset representative is unique up tosign, except in the case of a rectangular lattice with orthogonal basis { w , w } where the coset C has four minimal vectors, ± ( w ± w ) .Proof. For a rectangular lattice with orthogonal basis { w , w } , it is easy to seethat the minimal coset representatives are as stated. Conversely, suppose thatthe lattice Λ has a coset C with at least two pairs of minimal elements, ± w and ± w ′ . Then w , w = ( w ± w ′ ) / ∈ Λ are easily seen to be orthogonal.If w ≡ w ≡ w (mod 2Λ). But then | w | < | w + w | = | w | , contradicting minimality of w in its coset. Hence w w w w (mod 2Λ) since w = w + w ≡ w − w w , w , w do represent the threenon-trivial cosets modulo 2Λ. Now if { w , w } was not a Z -basis, there wouldexist a non-zero period w = αw + βw with 0 ≤ α, β <
1. But then one of w , w − w , w − w , w − w is in the same coset as w , and all are smaller,contradiction.Our algorithm for computing periods of elliptic curves will in fact computeminimal coset representatives. Although these are individually primitive, toensure that we thereby obtain a Z -basis for the lattice, the following lemma isrequired. Lemma 6.
For j = 1 , , , let w j be minimal coset representatives for a non-rectangular lattice Λ ⊂ C ; that is, minimal elements of the three non-trivialcosets of in Λ . Then any two of the w j form a Z -basis for Λ , and w = ± ( w ± w ) . roof. We may assume that | w | ≤ | w | ≤ | w | . Then w is minimal in Λ and w is minimal in Λ \ h w i . Hence (replacing w by − w if necessary) τ = w /w is in the standard fundamental region for SL ( Z ) acting on the upper half-plane, { w , w } is a Z -basis, and w = w ± w ; the sign depends on that of ℜ ( τ ).The following proposition shows that the limiting period of an optimal chainis closely related to minimal coset representatives. Proposition 7.
A good chain of lattices (Λ n ) ∞ n =0 with Λ ∞ = h w ∞ i is optimalif and only if w ∞ is a minimal coset representative of in Λ .Proof. Suppose that w ∞ is a minimal coset representative. Then it is clear thatΛ n +1 = h w ∞ i + 2Λ n ⊂ Λ n is the right sublattice for all n ≥
1, since w ∞ iscertainly minimal in Λ n \ n − .Conversely, suppose that the sequence is optimal. Let w be a minimal el-ement of Λ \ , so that w is a minimal coset representative for the uniquenon-trivial coset of 2Λ which is contained in Λ . Note that w is unique up tosign, unless Λ is rectangular in which case (for one of the cosets) there will betwo possibilities for w up to sign. By optimality, the sublattice Λ ⊂ Λ is theright choice. In particular, if Λ is not rectangular, then we must therefore haveΛ = h w i + 2Λ . This, however, may not hold in the rectangular case, but itwill hold if we replace w by the other choice of minimal coset representative.Now we claim that Λ n = h w i +2Λ n − for all n ≥
2. We already know this for n = 2. If the claim is true for n , then certainly w ∈ Λ n \ n − (since w / ∈ ),so the (unique) good choice of sublattice of Λ n is h w i + 2Λ n . By optimality,this is Λ n +1 , and so the claim holds for n + 1. Thus w ∈ T ∞ n =0 Λ n = h w ∞ i , andindeed, w = ± w ∞ , since w is primitive.Combining Lemma 5 with Proposition 7, we have the following conclusion. Corollary 8.
Every non-rectangular lattice Λ has precisely three optimal sub-lattice chains, whose limiting periods are the minimal coset representatives ineach of the three non-zero cosets of in Λ . Every rectangular lattice Λ hasprecisely four optimal sublattice chains. In this section we establish a link between AGM sequences and lattice chains.The first step is to associate a pair of nonzero complex number ( a, b ) (with a = ± b ) to each “short” lattice chain Λ ⊃ Λ ⊃ Λ in such a way that ( a, b ) isgood in the sense of Section 2 if and only if Λ is the right choice of sublatticeof Λ , in the sense of Section 3.We establish bijections between the following sets:1. “short” lattice chains Λ ⊃ Λ with Λ / Λ cyclic of order 4;2. triples ( E, ω, H ) where E is an elliptic curve defined over C , ω a holomor-phic differential on E , and H ⊂ E ( C ) a cyclic subgroup of order 4;3. unordered pairs of nonzero complex numbers a, b with a = b , where thepairs a, b and − a, − b are identified.7or each short lattice chain Λ ⊃ Λ , if we set Λ = Λ + 2Λ then (Λ , Λ , Λ )satisfy the conditions for the first three terms in a lattice sequence as definedearlier. Hence we will usually think of a short lattice chain as a triple Λ ⊃ Λ ⊃ Λ , even though Λ is uniquely determined by the other two.To each short lattice chain we associate the elliptic curve E = C / Λ withdifferential ω = dz and subgroup H = (1 / / Λ . Conversely, to a triple( E, ω, H ) we associate the chain Λ ⊃ Λ where Λ is the lattice of periods of ω (so that E ( C ) ∼ = C / Λ ), and Λ is the sublattice such that H ∼ = (1 / / Λ under this isomorphism.Each triple ( E, ω, H ) has a model of the form E { a,b } : Y = 4 X ( X + a )( X + b ) , for some unordered pair a, b ∈ C ∗ such that a = b , where ω = dX/Y , and H is the subgroup generated by the point P { a,b } = ( ab, ab ( a + b )) . The four points P {± a, ± b } are the solutions to 2 P = T = (0 , ∈ E { a,b } ( C )[2].Interchanging { a, b } and {− a, − b } does not affect the curve and interchanges P { a,b } and P {− a, − b } = − P { a,b } so does not change H . On the other hand,changing the sign of just one of a, b changes H to the other cyclic subgroup oforder 4 containing T . Hence the pair { a, b } has the properties stated and iswell-defined up to changing the signs of both a and b ,Conversely, given { a, b } with ab = 0 and a = ± b , we recover the triple( E { a,b } , ω, H ), which is unchanged by either interchanging a and b or negatingboth.If we only consider elliptic curves up to isomorphism, we may ignore thedifferential ω , scale the equations arbitrarily, and consider lattices only up tohomothety. Now we can identify pairs { a, b } and { ua, ub } for all u ∈ C ∗ . Theequation for E { a,b } can be scaled so that ab = 1, giving the homogeneous form E f : Y = 4 X ( X + f X + 1) , where f = a + b ab = ab + ba = ± . In this model, the points ± P { a,b } generating the distinguished subgroup H now have coordinates (1 , ± √ f ). Thus the pair E, H uniquely determinesa complex number f ∈ C \ {± } . We call this f the modular parameter for thelevel 4 structure, since (as we will see below) it is in fact the value of a modularfunction for the congruence subgroup Γ (4). Proposition 9.
The above constructions give a bijection between these sets:1. “short” lattice chains Λ ⊃ Λ up to homothety;2. pairs ( E, H ) where E is an elliptic curve defined over C with H ⊂ E ( C ) a distinguished cyclic subgroup of order , up to isomorphism (where iso-morphisms preserve the distinguished subgroups);3. complex numbers f ∈ C \ {± } . . points in the open modular curve Y (4) = Γ (4) \H , where H denotes theupper half-plane.Remark. It would appear that considering pairs (
E, P ), where P is a pointof exact order 4 in E ( C ), would give a refinement to the level 4 structure,corresponding to points on the modular curve Y (4) = Γ (4) \H , since [Γ (4) :Γ (4)] = 2. However, this is an illusion: since every E has an automorphism[ −
1] which takes P to − P , the set of pairs ( E, H ) (up to isomorphism) may beidentified with the space of pairs (
E, P ) (also up to isomorphism). Similarly,since Γ (4) = ( ± I )Γ (4), we may identify Y (4) and Y (4). Proof.
Bijections between all sets except the last have already been established.Up to homothety, the lattice Λ is determined by τ ∈ H modulo the actionof the modular group Γ = SL(2 , Z ): for any oriented basis w , w of Λ (where“oriented” means w /w ∈ H ) we associate τ = w /w ∈ H . All oriented bases w ′ , w ′ of Λ have the form w ′ = aw + bw w ′ = cw + dw with γ = (cid:18) a bc d (cid:19) ∈ Γ, and τ ′ = w ′ /w ′ = ( aτ + b ) / ( cτ + d ). To allow forthe additional level 4 structure, we restrict to oriented bases w , w such thatΛ = h w i + 4Λ , so that w ′ , w ′ is only admissible if w ≡ ± w ′ (mod 4Λ ), orequivalently ( c, d ) ≡ (0 , ±
1) (mod 4). This uniquely determines the Γ (4)-orbitof τ and not just its Γ-orbit.Let Y (4) = Γ (4) \H denote the open modular curve associated to Γ (4), and X (4) its completion, obtained by including the three cusps (represented by ∞ ,0 and 1 / ∈ P ( Q )), which has genus 0. Hence the function field of X (4) is gen-erated by a single function. Since the j -invariant of E f is 256( f − / ( f − f = f ( τ ) is a suitable function. This establishes the claim concern-ing f , and completes the proof of the proposition. Remark.
There is an involution on each of these sets, which preserves the level 2structure but interchanges the two possible associated level 4 structures. In eachof the sets this takes the following forms: replace Λ by the other sublattice Λ ′ of index 2 in Λ such that Λ / Λ ′ is cyclic; replace H by the other subgroup H ′ which is cyclic of order 4 and contains T = (0 , a, b ;or change f to − f . This involution comes from the nontrivial automorphism ofthe cover X (4) → X (2) of degree 2; the function field of X (2) is generatedby f . Remark.
Since (cid:18) (cid:19) Γ (4) (cid:18) (cid:19) − = Γ(2), the function field of X (4)may also be generated by λ (2 τ ) where λ ( τ ) is the classical Legendre ellipticfunction which generates the function field of X (2). A calculation shows that f ( τ ) = 2(1 + λ (2 τ )) / (1 − λ (2 τ )). One interpretation of this is that insteadof parametrizing short lattice chains by the parameter τ ∈ Y (4) correspondingto Λ with Γ (4)-structure, we could instead have used the parameter 2 τ ∈ Y (2)to parametrize the middle lattice Λ with full level 2-structure given by thesublattices Λ and Λ . The reason for ordering bases this way is to maintain consistency with other sections.
9e now state the main result of this section.
Theorem 10.
Let Λ ⊃ Λ ⊃ Λ be a short lattice chain corresponding tothe unordered pair { a, b } and modular parameter f . Then the following areequivalent:1. Λ is the right choice of sublattice of Λ ;2. the pair ( a, b ) is good;3. ℜ ( f ) ≥ .Proof. Equivalence of the second and third conditions is immediate from f = a/b + b/a since ( a, b ) is good if and only if ℜ ( a/b ) ≥
0. (In terms of the Legendrefunction, the equivalent condition is that | λ (2 τ ) | ≤ is the right choice of sublattice if Λ = h w i + 2Λ = h w i + 4Λ , where w isthe minimal period in its coset modulo 2Λ . We now characterize this conditionin terms of the imaginary part of τ ∈ H . Lemma 11.
Let w , w be any oriented basis for Λ such that Λ = h w i + 4Λ ,and let τ = w /w . The following are equivalent:1. ℑ τ is maximal, over all τ in its Γ (4) -orbit;2. | cτ + d | ≥ for all coprime c, d ∈ Z such that ( c, d ) ≡ (0 , ±
1) (mod 4) ;3. | w | is minimal, over all primitive periods of Λ such that Λ = h w i +4Λ ;4. | τ + d/ | ≥ / for all odd d ∈ Z .Proof. Equivalence of the first two statements follows from ℑ ( γτ ) = ℑ τ / | cτ + d | for γ = (cid:18) a bc d (cid:19) . Since | cτ + d | ≥ ⇐⇒ | cw + dw | ≥ | w | , the third statementis also equivalent to these. For the last statement, consider the geometry of theupper half-plane: the region given by these conditions are the same: (4) statesthat τ lies on or above all the semicircles centred on rationals with denominator 4and with radius 1 /
4, while (2) says that τ lies above all semicircles centredat rationals − d/c with radius 1 /c for which ( c, d ) ≡ (0 , ±
1) (mod 4); as thesemicircles for c > c = 4, this is no stronger.We denote by F (4) the set of τ which satisfy these conditions; that is, thosefor which ℑ τ is maximal in a Γ (4)-orbit. The subset of F (4) consisting of τ such that 0 ≤ ℜ τ ≤ (4). Since Γ (4)has index 2 in Γ (2), the region F (4) decomposes into two components, whichwe denote F ± (4): the first is F + (4) = F (2), consisting of all τ lying on orabove all semicircles of radius 1 / (2) is the subset of F (2) consisting of τ suchthat 0 ≤ ℜ τ ≤
1. Secondly, F − (4) = F (4) \ F (2). The boundary between theseis F + (4) ∩ F − (4), which consists of the union of the semicircles | τ + d/ | = 1 / d ∈ Z .The lemma above shows that Λ is the right choice if and only if the τ forwhich ℑ τ is maximal over all τ in its Γ (4)-orbit is also maximal in the largerΓ (2)-orbit; in other words, given that τ ∈ F (4), we in fact have τ ∈ F + (4).The following lemma then completes the proof of the theorem.10 emma 12. Let τ ∈ F (4) . Then ℜ f ( τ ) ≥ ⇐⇒ τ ∈ F + (4) . Proof.
This will follow by continuity from the following facts, for τ ∈ F (4) with0 ≤ ℜ τ ≤ ℜ f ( τ ) = 0 if and only if τ lies on the semicircle | τ − | = 1 which separatesthe interiors of F ± (4).2. ℜ f ( τ ) > τ ∈ F + (4).For the first fact implies that ℜ f ( τ ) has constant nonzero sign on the twointeriors. Since f ( γτ ) = − f ( τ ) for γ ∈ Γ (2) \ Γ (4), the signs are different inthe two interiors; and the second fact establishes that ℜ f ( τ ) is positive in theinterior of F + (4).Let f = f ( τ ). Let the roots of X ( X + f X + 1) be e = 0 , e , e . Since e e = 1, we have ℜ f = 0 if and only if ℜ e = ℜ e = 0 with the imaginaryparts ℑ e , ℑ e of opposite sign; so e , e , e collinear, with 0 in between theother two roots. Conversely, if the e j are colinear with 0 in the middle then(since e e = 1) it follows that ℜ f = 0. However, this alignment of the rootshappens precisely when the period lattice Λ is rectangular, with orthogonalbasis w , w + w , which is when τ lies on the semicircle as claimed. Thisestablishes the first fact.Finally, one can check that for i ∈ F + (4) we have f ( i ) = 3 / √ > λ (2 i ) = (3 − √ / (3 + 2 √
2) so that | λ (2 i ) | < From now on we will use standard Weierstrass models of elliptic curves ratherthan the special forms E { a,b } used above. Thus, let E be an elliptic curve over C given by a Weierstrass equation E : Y = 4( X − e (0)1 )( X − e (0)2 )( X − e (0)3 ) , (4)where the roots e (0) j are distinct, and P j =1 e (0) j = 0. We consider the orderingof the roots e (0) j as fixed, with the point T = ( e (0)1 ,
0) of order 2 as distinguished.Let a = ± q e (0)1 − e (0)3 , b = ± q e (0)1 − e (0)2 ;the choice of signs will be discussed below. Via a shift of the X -coordinatewe have E ∼ = E { a ,b } , and the choice of signs determines the point P =( e (0)1 + a b , a b ( a + b )) of order 4 such that 2 P = T .Now consider arbitrary AGM sequences (( a n , b n )) ∞ n =0 starting from ( a , b ).As in [2], for n ≥ e ( n )1 = a n + b n , e ( n )2 = a n − b n , e ( n )3 = b n − a n . (5)These equalities also hold for n = 0, and for all n ≥ e ( n ) j are distinct,and satisfy P j =1 e ( n ) j = 0. Hence each AGM sequence determines a sequence11 E n ) ∞ n =0 of elliptic curves defined over C , where E n is given by the Weierstrassequation E n : Y n = 4( X n − e ( n )1 )( X n − e ( n )2 )( X n − e ( n )3 ) . (6)Each has a distinguished 2-torsion point T n = ( e ( n )1 , n ≥
1, define a 2-isogeny ϕ n : E n → E n − via ( x n , y n ) ( x n − , y n − ),where x n − = x n + ( e ( n )3 − e ( n )1 )( e ( n )3 − e ( n )2 ) x n − e ( n )3 ,y n − = y n − ( e ( n )3 − e ( n )1 )( e ( n )3 − e ( n )2 )( x n − e ( n )3 ) ! . (7)Now ker( ϕ n ) = h ( e ( n )3 , i , and ϕ n ( T n ) = T n − = ϕ n (( e ( n )2 , . The dual isogeny ˆ ϕ n : E n − → E n has kernel h T n − i 6 = ker( ϕ n − ), so is distinctfrom ϕ n − . Each composite ϕ n ◦ ϕ n +1 has cyclic kernel, since ϕ n ( ϕ n +1 ( T n +1 )) = ϕ n ( T n ) = T n − = O. Similarly, by tracing the images of T n , we see that all composites of the ϕ n havecyclic kernels.This chain of -isogenies may be depicted thus: · · · E n o o (cid:15) (cid:15) ϕ n / / E n − ϕ n o o (cid:15) (cid:15) / / · · · E o o / / (cid:15) (cid:15) E o o The number j next to each arrow originating from E n denotes the point ( e ( n ) j , E (0) dependson many choices. The definition of a , b depends first on which root is la-belled e (0)1 (which determines T and hence E ), and the order of labelling of e (0)2 and e (0)3 . Secondly, the signs for a , b were arbitrary; changing just one ofthem changes P and hence E . So, as in the previous section, the unordered pair { a , b } determines the short isogeny chain E → E → E , with {− a , − b } determining the same short chain. Finally, for each a , b , there are many AGMsequences, which determine the rest of the chain.Note that we can rewrite e ( n +1) j given by (5) as e ( n +1)1 = e ( n )1 + 2 a n b n , e ( n +1)2 = e ( n )1 − a n b n , e ( n +1)3 = − e ( n )1 . If ( a n , b n ) is replaced by ( a n , − b n ) for n ≥
1, we see that this interchanges e ( n +1)1 and e ( n +1)2 but leaves e ( n +1)3 unchanged. This does not change the curve E n +1 ;it only changes the labelling of its roots, which then changes E n +2 .Hence we have established a bijection between12 The set of all AGM sequences starting at ( a , b ), and • The set of all isogeny chains starting with the short chain E → E → E .We now consider what happens when n → ∞ . From (5), we havelim n →∞ e ( n )1 = 2 M , lim n →∞ e ( n )2 = lim n →∞ e ( n )3 = − M , (8)where M = M S ( a , b ) for some set S ⊆ Z > . The “limiting curve” E ∞ for thesequence ( E n ) ∞ n =0 is the singular curve E ∞ : Y ∞ = 4 (cid:18) X ∞ − M (cid:19) (cid:18) X ∞ + 13 M (cid:19) . (9)Proposition 1 implies the following. Proposition 13.
The singular point of E ∞ is a node if and only if the AGMsequence ( a n , b n ) is good. For each n ≥
0, we have E n ( C ) ∼ = C / Λ n , where Λ n is the lattice of periods ofthe differential dX n /Y n . From the definition of ϕ n (see (7)), it can be verifiedthat each ϕ n is normalised , in the sense that ϕ ∗ n (cid:18) dX n − Y n − (cid:19) = dX n Y n (10)for all n ≥
1. Hence ϕ n corresponds to the map C / Λ n → C / Λ n − induced fromthe identity map C → C . Since each ϕ n is a 2-isogeny and the composites ofthe ϕ n have cyclic kernels, it is clear that (Λ n ) is a lattice chain in the sense ofSection 3.This establishes the commutativity of the diagram (Figure 1), which showsthe relationship between chains of lattices and chains of 2-isogenies. For brevitywe denote z ( ℘ Λ ( z ) , ℘ ′ Λ ( z )) by z ℘ n ( z ). · · · / / C id / / (cid:15) (cid:15) C (cid:15) (cid:15) / / · · ·· · · / / C / Λ n / / ℘ n (cid:15) (cid:15) C / Λ n − ℘ n − (cid:15) (cid:15) / / · · ·· · · / / E n ϕ n / / E n − / / · · · Figure 1: A chain of isogenies linked with a chain of latticesConversely, given any lattice chain (Λ n ) starting from Λ , we may recoverthe sequence of curves E n and the chain of 2-isogenies linking them: first, Λ determines which root of E is labelled e (0)1 ; then Λ determines the choice of13igns in the definition of a , b ; and finally the AGM sequence starting with( a , b ) is determined by the Λ n for n ≥ a , b ), and the set of all isogeny chains starting with the short chain E → E → E : namely, the set of all lattice chains starting with the shortchain Λ ⊃ Λ ⊃ Λ . Proposition 14.
With the above notation, for all n ≥ ,1. E n ∼ = E { a n ,b n } ;2. Λ n ⊃ Λ n +1 ⊃ Λ n +2 is a short chain in the sense of Section 3;3. Λ n +2 is the right choice of sublattice of Λ n +1 if and only if ( a n , b n ) is agood pair;4. the lattice chain (Λ n ) is good (respectively, optimal) if and only if thesequence (( a n , b n )) is good (respectively, optimal).Proof. For (1), replace x n by x n + e ( n )1 in the equation for E n to obtain theequation for E { a n ,b n } . The rest is then is clear, using Theorem 10. Let E be an elliptic curve over C of the form (4). We keep the notation of thepreceding section; in particular, the period lattice of E is Λ . Each primitiveperiod w ∈ Λ determines a good lattice chain (Λ n ) where Λ n = h w i + 2 n Λ ,and conversely, since ∩ n Λ n = h w i . So we have a bijection between the set ofprimitive periods of Λ (up to sign) and good lattice chains. Each good latticechain in turn determines a good AGM sequence (( a n , b n )) starting at a pair( a , b ) such that E ∼ = E { a ,b } .We now show that the period w may be expressed simply in terms of thelimit of the associated AGM sequence. It will follow that every primitive pe-riod w of E may be obtained from the limit of an appropriately chosen goodAGM sequence. Conversely, we may express the set of all limits of AGM se-quences starting at ( a , b ) in terms of periods of E . We will also show thatoptimal AGM sequences give periods which are minimal in their coset mod-ulo 4Λ , and super-optimal sequences (where the initial pair ( a , b ) also good)give periods which are minimal modulo 2Λ . By Lemma 6, we will be then ableto express a Z -basis for Λ in terms of specific AGM values. Proposition 15.
Let (Λ n ) be a good lattice sequence with limiting period w (generating ∩ Λ n , and defined up to sign). Then for all z ∈ C \ Λ we have lim n →∞ ℘ Λ n ( z ) = (cid:18) πw (cid:19) (cid:18) ( zπ/w ) − (cid:19) lim n →∞ ℘ ′ Λ n ( z ) = − (cid:18) πw (cid:19) (cid:18) cos( zπ/w )sin ( zπ/w ) (cid:19) . roof. Since w is primitive, there exists w ∈ C such that Λ n = h w , n w i forall n ≥
0. In the standard series expansion ℘ Λ n ( z ) = 1 z + X = w ∈ Λ n (cid:18) z − w ) − w (cid:19) , we set w = m w + m n w with m , m not both zero. As n → ∞ all termswith m = 0 tend to zero, leavinglim n →∞ ℘ Λ n ( z ) = X m ∈ Z z − mw ) − (cid:18) πw (cid:19) . Using the expansion π / sin ( πz ) = P m ∈ Z / ( z − m ) , this simplifies to theformula given.For lim n →∞ ℘ ′ Λ n ( z ), we may either differentiate this, or apply the same ar-gument to the series expansion of ℘ ′ Λ n ( z ). Corollary 16.
In the above notation, let (Λ n ) be a (good) lattice chain, withlimiting period w , associated to the elliptic curve E and the (good) AGMsequence (( a n , b n )) with non-zero limit M = M S ( a , b ) . Then M = ± π/w , sothat the period w may be determined up to sign by w = ± π/M S ( a , b ) . Proof.
For all n ≥ ℘ Λ n ( w /
2) = e ( n )1 . Letting n → ∞ and using theproposition we find that23 M = lim n →∞ e ( n )1 = 23 (cid:18) πw (cid:19) , from which the result follows.The ambiguity of sign in this result will not matter in practice: changingthe sign of w does not change the lattice chain, and neither does changing thesigns of both a , b (and hence the sign of M S ( a , b )).For fixed ( a , b ), the value of M S ( a , b ) depends on the set S of indices n for which ( a n , b n ) is bad. Changing S , we obtain different AGM sequences, anddifferent lattice chains, but these all start with the same short chain (Λ n ) n =0 ,and the periods given by π/M S ( a , b ) are all in the same coset modulo 4Λ .We may now establish the result stated above as Proposition 1(3): Corollary 17. | M S ( a , b ) | attains its maximum (among all AGM-sequencesstarting at ( a , b ) ) if and only if the sequence is optimal.Proof. By Corollary 16, M S ( a , b ) is maximal (in absolute value) if and onlyif the limiting period w = π/M S ( a , b ) is minimal. By Proposition 7, this isif and only if the lattice chain is optimal. By Proposition 14(4), this in turn isif and only if the AGM sequence is optimal. Corollary 18.
1. The optimal value M = M ( a , b ) gives a period w = π/M which is minimal in its coset modulo . . | M ( a , b ) | ≥ | M ( a , − b ) | ⇐⇒ | a − b | ≤ | a + b | .3. If ( a , b ) is good, then π/M ( a , b ) is minimal in its coset modulo .Proof. Changing the sign of b (only) does not change Λ (or E ), but doeschange Λ . The effect on w , therefore, is to change its coset modulo 4Λ whilenot affecting its coset modulo 2Λ . By Proposition 10, Λ is the right choiceif and only if ( a , b ) is good. Hence, to obtain a period minimal in its cosetmodulo 2Λ , and not just modulo 4Λ , we choose the sign of b so that thepair ( a , b ) is good, and then take an optimal AGM sequence. Theorem 19 (Periods of Elliptic Curves over C , first version) . Let E be anelliptic curve over C given by the Weierstrass equation Y = 4( X − e )( X − e )( X − e ) , with period lattice Λ . Set a = √ e − e and b = √ e − e , where the signs arechosen so that ( a , b ) is good (i.e., | a − b | ≤ | a + b | ), and let w = πM ( a , b ) , using the optimal value of the AGM. Then w is a primitive period of E , andis a minimal period in its coset modulo .Define w , w similarly by permuting the e j ; then any two of w , w , w forma Z -basis for Λ .Proof. Everything has been established except the last part. Letting e , e inturn play the role of e gives minimal periods in each of the cosets modulo 2Λ,so Lemma 6 applies. Algorithm 20 (Computation of a period lattice basis) .Input:
An elliptic curve E defined over C , and roots e j ∈ C for j = 1 , , Output:
Three primitive periods of E , which are minimal coset representatives,any two of which form a Z -basis for the period lattice of E .1. Label one of the roots as e , and the other two arbitrarily as e , e ;2. Set a = √ e − e with arbitrary sign, and then b = ±√ e − e with thesign chosen such that | a − b | ≤ | a + b | .3. Output w = π/M ( a , b ), using the optimal value of the AGM.4. Repeat with each root e j in turn playing the role of e .Instead of computing w , w by permuting the e j as in Theorem 19, we mayalternatively obtain all w j by using a single ordering of the roots and threedifferent AGM computations.Starting with an arbitrary ordering of the roots,say ( e , e , e ), define a and b as before, up to sign, by a = e − e and b = e − e ; and also define c (upto sign) by c = e − e , so that a = b + c . We would like to determine thesigns of a, b, c so that all three of the following conditions hold: | a − b | ≤ | a + b | , | c − ib | ≤ | c + ib | , | a − c | ≤ | a + c | . (11)16e claim that this is always possible. To see this, first choose the sign of a arbitrarily. Then choose the signs of b and c so that the first and the thirdconditions in (11) hold. Finally, if the second condition fails, one can easilycheck that if e and e are interchanged and a, b, c replaced (in order) by ia , ic , ib , then all three inequalities will hold.We can now state an alternative theorem for obtaining a Z -basis for theperiod lattice Λ of E . Theorem 21 (Periods of Elliptic Curves over C , second version) . Let E be anelliptic curve over C given by the Weierstrass equation Y = 4( X − e )( X − e )( X − e ) , with period lattice Λ . Order the roots ( e , e , e ) of E , so that the signs of a = √ e − e , b = √ e − e , c = √ e − e may be chosen to satisfy all theconditions of (11) . Define w = πM ( a, b ) , w = πM ( c, ib ) , w = iπM ( a, c ) . Then each w j is a primitive period, minimal in its coset modulo , and anytwo of the w j form a Z -basis for Λ .Proof. Let ( e , e , e ) be an order of the roots of E . Interchanging e and e if necessary, define a = √ e − e , b = √ e − e , c = √ e − e , with the signschosen so that all three inequalities in (11) hold.Now w = π/M ( a, b ) is primitive and minimal in its coset as before, since( a, b ) is good. Using ( e ′ , e ′ , e ′ ) = ( e , e , e ), we find that ( a ′ , b ′ ) = ( c, ib )is good, and set w = π/M ( a ′ , b ′ ) = π/M ( c, ib ); and using ( e ′′ , e ′′ , e ′′ ) =( e , e , e ), we see that ( a ′′ , b ′′ ) = ( ia, ic ) is good, and set w = π/M ( a ′′ , b ′′ ) = πi/M ( a, c ).We complete this section by considering two special cases, which arise whenconsidering elliptic curves defined over the real numbers, separating the casesof positive discriminant (rectangular period lattice) and negative discriminant. Recall that if | a − b | = | a + b | , then both ( a , ± b ) are good and ℜ ( b /a ) = 0.In this case, e − e e − e = ( b /a ) is real and negative. Geometrically, this means that the e j are collinear on thecomplex plane with e in the middle.To see what the associated period lattice looks like, let w = π/M ( a , b ) and w ′ = π/M ( a , − b ). Then w, w ′ are both minimal elements in the same cosetmodulo 2Λ . By Lemma 5, the periods w , w = ( w ± w ′ ) / Z -basis for Λ , and the period lattice is rectangular. Alternatively, we couldobtain a Z -basis for Λ by computing two periods (as in Theorem 19) using thetwo other roots of E which are not “in the middle” in the role of e .17inally, we note that whenever the e j are collinear, we can “rotate” themby a multiplying by a suitable constant in C ∗ so that the scaled roots e ′ j are allreal. Then one could use an algorithm for computing period lattices of ellipticcurves over R (e.g. [3, Algorithm 7.4.7]) to compute the period lattice of theelliptic curve ( Y ′ ) = 4( X ′ − e ′ )( X ′ − e ′ )( X ′ − e ′ ). The period lattice of ouroriginal elliptic curve is then obtained after suitable scaling. This may be moreefficient in practice, since only real arithmetic would be needed in the AGMiteration.If the e j are all real (as is the case for an elliptic curve defined over R withpositive discriminant), we may order them so that e > e > e and obtain arectangular basis for the period lattice by setting w = π/M ( √ e − e , √ e − e ) , w = πi/M ( √ e − e , √ e − e ) (12)with all square roots positive; then w and w /i are both real and positive.These familiar formulas may be found in [3, Algorithm 7.4.7] or [5, (3.7.1)]. If the roots of E are such that (cid:12)(cid:12)(cid:12)(cid:12) e − e e − e (cid:12)(cid:12)(cid:12)(cid:12) = 1 with e − e = ± ( e − e ) , then geometrically the e j lie on an isosceles triangle having e as the vertexwhere the sides of equal length intersect. As before, one can rotate this triangleby a suitable constant in C ∗ so that e ∈ R , and e , e are complex conjugates.This yields a new elliptic curve E ′ , defined over R , whose Weierstrass equationhas only one real root.Again, one could use an algorithm for computing period lattices of ellipticcurves over R (e.g. [3, Algorithm 7.4.7]) to compute the period lattice of E ′ .This is of the form Λ ′ = h w ′ , w ′ i , for some w ′ , w ′ satisfying w ′ ∈ R , ℜ ( w ′ ) = w ′ . The period lattice Λ = h w , w i of E , with ℜ ( w /w ) = 1 /
2, can then beobtained by a suitable scaling of w ′ , w ′ . This will be illustrated in Example 4.For real curves with negative discriminant, we present here a simplificationof the purely real algorithm given in [3]. Let e be real and e , e complexconjugates, ordered so that ℑ e >
0. Set a = √ e − e = x + yi ; since e − e lies in the upper half-plane, we may choose the sign of a so that x, y >
0. Set r = p x + y > b = √ e − e = x − yi . Now we may obtain a realperiod w + from w + = π/M ( a , b ) = π/M ( x + yi, x − yi ) = π/M ( x, r ) , and an imaginary period w − from w − = π/M ( − a , b ) = πi/M ( y − xi, y + xi ) = πi/M ( y, r ) . Note that both AGMs appearing here, M ( x, r ) and M ( y, r ), are classical (realand positive). These periods span a sublattice of index 2 in the period lattice,for which a Z -basis may be taken to be w = w + and w = ( w + + w − ) /
2, where ℜ ( w /w ) = 1 /
2. 18
The complete set of AGM values
In 1800, Gauss described the complete set of values of M S ( a, b ) as S rangesthrough all finite sets. The proof given by Cox in [4, Theorem 2.2] uses thetaand modular functions related to the modular functions which appeared earlierin this paper. Other proofs are also available in the literature, for example byGeppert [9].We will give here a slightly more general form of the result than that statedin [4], and give an alternative proof which brings out clearly the relation withperiod lattices of elliptic curves.In the following statement, we set P S ( a, b ) = π/M S ( a, b ) (for any finite S ⊆ Z > ) and P ( a, b ) = π/M ( a, b ). Theorem 22.
For a, b ∈ C ∗ with a = ± b , let E { a,b } be the elliptic curve over C given by the Weierstrass equation E { a,b } : Y = 4 X ( X + a )( X + b ) , and let Λ be its period lattice. Let c = √ a − b , with the sign chosen so thatthe pair ( a, c ) is good, and set w = P ( a, b ) , w = iP ( a, c ) . Then
Λ = Z w + Z w , and the set of values of P S ( a, b ) is precisely the set ofprimitive elements of the coset w + 4Λ . More precisely, we have the following: { P S ( a, b ) } = { w ∈ w + 4Λ , w primitive } ; { P S ( a, − b ) } = { w ∈ w + 2 w + 4Λ , w primitive } ; { P S ( − a, − b ) } = { w ∈ − w + 4Λ , w primitive } ; { P S ( − a, b ) } = { w ∈ − w + 2 w + 4Λ , w primitive } . Thus, the complete set of all values of P S ( ± a, ± b ) is the set of primitive elementsof the coset w + 2Λ .Proof. Since Λ is invariant under translations of the X -coordinate, we may applyTheorem 21 to see that Λ = Z w ′ + Z w where w (as given) is a minimal cosetrepresentative, and either • ( a, b ) is good and w ′ = w ; or • ( a, b ) is bad and w ′ = w ± w .In either case, Λ = Z w + Z w .Now the values of P S ( a, b ) are precisely the primitive periods in the samecoset as w = P ( a, b ) modulo 4Λ. Secondly, P S ( − a, − b ) = − P S ( a, b ) = − w , sothe values of P S ( − a, − b ) are the primitive periods in the coset − w (mod 4Λ),as required. Next, P ( a, − b ) is the minimal period in the coset w + 2 w + 4Λ,since this is the other coset modulo 4Λ contained in w + 2Λ, so the valuesof ± P S ( a, − b ) are also as stated. Corollary 23.
Let a, b, c ∈ C ∗ satisfy a = b + c . Define w = π/M ( a, b ) and w ′ = πi/M ( a, c ) , where ( a, c ) is a good pair. Then . Λ = Z w + Z w ′ is a lattice in C ;2. the set of values of π/M S ( a, b ) is the set of primitive elements of the coset w + 4Λ ; that is, the set { uw + vw ′ | u, v ∈ Z , gcd( u, v ) = 1 , u − ≡ v ≡ } ;
3. the set of values of π/M S ( ± a, ± b ) is the set of primitive elements of thecoset w + 2Λ ; that is, the set { uw + vw ′ | u, v ∈ Z , gcd( u, v ) = 1 , u − ≡ v ≡ } . We now extend the method for computing periods of elliptic curves in Section 6to give a method for computing elliptic logarithms of points on elliptic curves.Let E be an elliptic curve over C given by a Weierstrass equation as before,and Λ the lattice of periods of the differential dX/Y on E , so that E ( C ) ∼ = C / Λ. An elliptic logarithm of P ∈ E ( C ) is a value z P ∈ C such that P =( ℘ Λ ( z P ) , ℘ ′ Λ ( z P )). Note that z P is only well-defined modulo Λ. We wish to havean algorithm which can compute the numerical value of the complex number z P ,to any required precision, from the coefficients of E and the coordinates of P (which we assume are given exactly, or are available to arbitrary precision).Construct as before an isogeny chain ( E n ) with E = E , with associatedlattice chain (Λ n ) (with Λ = Λ) and AGM sequence ( a n , b n ). We will assumethat the chain is super-optimal with | a n − b n | < | a n + b n | for all n ≥
0. (Thisis possible except when Λ is rectangular, and even then is possible for two ofthe three super-optimal sequences). Let w , w be a Z -basis for Λ such thatΛ n = h w , n w i for all n ≥
0. We have 2-isogenies ϕ n : E n → E n − for n ≥ C / Λ n → C / Λ n − . Consider sequences of points ( P n ) ∞ n =0 where P n ∈ E n ( C ) satisfy ϕ n ( P n ) = P n − for all n ≥
1. Such a sequence will be called coherent if there exists z ∈ C such that P n = ℘ n ( z ) for all n ≥
0; here, as above, we write ℘ n ( z )for ( ℘ Λ n ( z ) , ℘ ′ Λ n ( z )). If such a z exists, it is uniquely determined modulo ∩ Λ n =Λ ∞ = h w i .In general there are uncountably many point sequences with a fixed startingpoint P , since for each P n ∈ E n ( C ) there are two points P n +1 ∈ E n +1 ( C ) with ϕ n +1 ( P n +1 ) = P n . However, only countably many of these are coherent, since ℘ − ( P ) is a coset of Λ in C , and hence countable.For example, taking z = 0 shows that the trivial sequence ( O n ), where O n isthe base point on E n , is coherent. Also, the sequence with P n = T n = ( e ( n )1 , z = w / P n ), for each n let C n = ℘ − n ( P n ) ⊂ C be thecomplete set of all the elliptic logarithms of P n , which is a coset of Λ n in C .Since Λ n +1 has index 2 in Λ n , each C n is the disjoint union of two cosets of Λ n +1 ,20ne of these being C n +1 ; the other is the set of elliptic logarithms of the secondpoint P ′ n +1 ∈ E n +1 ( C ) such that ϕ n +1 ( P ′ n +1 ) = P n . Thus we have C ⊃ C ⊃ · · · ⊃ C n ⊃ C n +1 ⊃ . . . . The point sequence is coherent if and only if C ∞ = ∩ ∞ n =0 C n = ∅ , in which case C ∞ is a coset of Λ ∞ in C .An argument similar to that used above for Lemma 3 shows the following. Lemma 24.
The sequence ( P n ) is coherent if and only if C n +1 contains thesmallest element of C n for almost all n ≥ . Proposition 25.
With notation as above, let ( P n ) be a coherent point sequencedetermined by z ∈ C . Assume that z Λ ∞ . Then for n sufficiently large, wehave P n = O n , and write P n = ( x n , y n ) . Let P ∞ = ( x ∞ , y ∞ ) ∈ E ∞ ( C ) be thelimit point, defined by ( x ∞ , y ∞ ) = lim n →∞ ( x n , y n ) . Set M = π/w , and t ∞ = − y ∞ / ( x ∞ + M / . Then t ∞ = 0 , ∞ , and (modulo Λ ∞ ) we have z = 1 M arctan (cid:18) Mt ∞ (cid:19) = w π arctan (cid:18) πw t ∞ (cid:19) . (13) Proof.
Since z Λ ∞ , for all n ≫ z Λ n , so that P n = O n . Propo-sition 15 gives expressions for the coordinates of P ∞ = ( x ∞ , y ∞ ) ∈ E ∞ ( C ) interms of M , s = sin( zπ/w ) and c = cos( zπ/w ): x ∞ = M (cid:18) s − (cid:19) ; y ∞ = − M cs . Note that s = 0, since z Λ ∞ ; also, s = ± c = 0) since 2 z Λ ∞ . Thus x ∞ + M / M /s = 0, and t ∞ = − y ∞ / ( x ∞ + M /
3) =
M c/s = 0, givingformula (13). Taking different values of the multiple-valued function arctanchanges z by integer multiples of w ; so this formula gives a well defined valuefor z modulo Λ ∞ , as desired.This result does also apply when z = ± w / ∞ ), for then s = ± c = 0, so x ∞ + M / M and y ∞ = 0, giving t ∞ = 0 and z = w ; this isthe case we used above to compute periods.Proposition 25, and in particular formula (13), is the key to our ellipticlogarithm algorithm, in which we will compute a sequence ( t n ) iteratively suchthat lim t n = t ∞ . However, we derived (12) by starting from a value of z ∈ C ,rather than from the coordinates of a point P = ℘ ( z ) ∈ E ( C ). In order toproduce an algorithm for computing z from the coordinates of P , we must showhow to construct inductively a suitable coherent sequence of points, so that thelimits x ∞ , y ∞ and t ∞ exist. We will do this in the next subsection. Remark.
Our formula (13) is similar to the one used in Cohen’s algorithm [3,Algorithm 7.4.8] for computing elliptic logarithms of real points on elliptic curves21efined over R . The variable denoted c n in [3] is related to our t n (defined below)by c n = t n + a n ; setting c ∞ = lim n →∞ c n , so that c ∞ = t ∞ + M , we can rewrite z P as z P = ± M arcsin (cid:18) Mc ∞ (cid:19) , which is similar (up to sign) to the output of Cohen’s algorithm. This approachleaves an ambiguity of the sign of z P , which is resolved in [3] by considering thesign of y at the end, something which is only possible in the real case. Using t ∞ instead of c ∞ avoids the ambiguity. Let P = ( x, y ) ∈ E ( C ), where as above E is the elliptic curve with equation E : Y = 4( X − e )( X − e )( X − e ) . In order to compute the elliptic logarithm z P of P using (13), we need to finda suitable coherent point sequence ( P n ) starting at P = P . We iterativelycompute P , P , . . . , using the explicit formulas for the isogenies ϕ n ; at eachstage there are two possible choices for P n , determined by choosing a specificsign for a square root. The main issue is how to make these choices in such away that the sequences converge.It is simpler in practice to use alternative models for the elliptic curves inthe sequence, in which the isogeny formulas are simpler. We introduce thesenow. Let E ′ be the curve with equation E ′ : R = ( T + a ) / ( T + b ) . We regard E ′ as a projective curve in P × P , with points at infinity given by( t, r ) = ( ∞ , ± , ( ± bi, ∞ ).Define a map α : E ′ → E by ( t, r ) ( x, y ) = ( t + e , − rt ( t + b )),where as usual a = e − e and b = e − e . This map is unramified andhas degree 2; it sends ( ∞ , ± O E , ( ± bi, ∞ ) ( e , , ± a/b ) ( e , ± ai, ( e , a , b for the arithmetic and geometric means of a, b as usual, set e ′ = ( a + b ) / a + 6 ab + b ) / ,e ′ = ( a − b ) / a − ab + b ) / ,e ′ = ( b − a ) / − ( a + b ) / , so that E has with Weierstrass equation E : Y = 4( X − e ′ )( X − e ′ )( X − e ′ ) . Now E ′ ∼ = E via the isomorphism θ given by ( t, r ) ( x , y ) where( x , y ) = ( 12 ( t + r ( t + a ) + 16 ( a + b )) , t ( t + r ( t + a ) + 12 ( a + b )) , The sign of y here is chosen to avoid a minus sign in the elliptic logarithm formula (13). x , y ) ( t, r ) = (cid:18) y x + a + b , x + 5 a − b x + 5 b − a (cid:19) . The composite α ◦ θ − : E → E ′ → E is the 2-isogeny denoted ϕ in Section 5.Given a complete 2-isogeny chain ( E n ) n ≥ with E = E , as in Section 5, wedefine for each n ≥ E ′ n with equation R n = ( T n + a n − ) / ( T n + b n − ),isomorphic to E n via θ n (defined as for θ = θ as above); these fit into acommutative diagram · · · / / E ′ n ϕ ′ n / / θ n (cid:15) (cid:15) E ′ n − / / θ n − (cid:15) (cid:15) · · · / / E ′ θ (cid:15) (cid:15) α ❅❅❅❅❅❅❅❅ · · · / / E n ϕ n / / E n − / / · · · / / E ϕ / / E where ϕ ′ n : E ′ n → E ′ n − is the 2-isogeny which makes the diagram commute. Alittle algebra shows that ϕ ′ n is given by r n − = t n + a n − a n − t n + a n − b n − = a n − r n − a n − − b n − r n + a n − , t n − = t n r n . For any point sequence ( P n ) (with P n ∈ E n ( C ) and ϕ n +1 ( P n +1 ) = P n forall n ≥
0) we set P ′ n = ( r n , t n ) = θ − n ( P n ) ∈ E ′ n ( C ) for n ≥
1. Since α ( P ′ ) = P ,we have r = x − e x − e , and t = − y r ( x − e ) = √ x − e ;note that these equations determine r (and then t ) up to sign. Next, from ϕ ′ n ( P ′ n ) = P ′ n − for n ≥
2, we have r n = a n − ( r n − + 1) b n − r n − + a n − , and t n = r n t n − ;again, these determine ( r n , t n ) up to sign.Hence we may construct all possible point sequences ( P ′ n ) with P ′ n ∈ E ′ n ( C )for n ≥
1, starting from P = ( x , y ) ∈ E ( C ) with y = 0, by initialising r = r x − e x − e , and t = − y r ( x − e )to determine P ′ = ( r , t ), and then iterating the following to obtain P ′ n =( r n , t n ) for n ≥ r n = s a n − ( r n − + 1) b n − r n − + a n − , and t n = r n t n − . Suitable choices of signs of r n will be discussed below, which will ensure thatthese sequences converge. Then we will have r ∞ = lim r n = 1 and t ∞ = lim t n satisfying x ∞ = t ∞ + 23 M , y ∞ = − t ∞ ( t ∞ + M ) , M = AGM( a, b ) as usual. It follows that t ∞ = − y ∞ / x ∞ + M / , as in the statement of Proposition 25. We now show that we do obtain coherent, convergent sequences, provided thatfor all (or all but finitely many) n we choose the sign of r n so that ℜ ( r n ) ≥ Proposition 26.
With the notation of the previous section, assume that theAGM sequence satisfies ℜ ( a n /b n ) > for all n ≥ .If ℜ r n ≥ for all n ≥ , then the point sequence ( P n ) = ( θ n ( r n , t n )) deter-mined by the iteratively defined sequence of pairs ( r n , t n ) is coherent.The same conclusion holds if ℜ r n ≥ for all but finitely many n ≥ .Proof. Recall that Λ n is the period lattice of E n for n ≥
0, with Z -basis w , w such that w = π/M ( a , b ) generates ∩ n Λ n , and Λ n = h w , n w i for all n ≥ n there exists z n ∈ C , uniquely determined modulo Λ n , such that x n = ℘ Λ n ( z n ) and y n = ℘ ′ Λ n ( z n ). We wish to show that the z n may be chosenindependently of n .Since r n = 12 x n + 5 a n − − b n − x n + 5 b n − − a n − , we may regard r n as the value at z n of an elliptic function f n of degree 2 withrespect to Λ n . Similarly its square, r n = x n − − e ( n − x n − − e ( n − , is the value at z n of f n , which is an elliptic function with respect to the largerlattice Λ n − . It follows that f n ( z + 2 n − w ) = − f n ( z )for all z ∈ C and all n ≥ ℘ n (0) = O E = θ n (( ∞ , ℘ n ( w /
2) = ( e ( n )1 ,
0) = θ n ((0 , a n − /b n − )) , we have f n (0) = 1 and f n ( w /
2) = a n − /b n − for all n ≥ R n of the right half-plane under f n , for n ≥
1. Since f n ( w /
2) = a n − /b n − and ℜ ( a n − /b n − ) >
0, this contains w / n . Let R on denote the connected component of R n which contains w / R n and R on are invariant under translation by w (by periodicity of f n ),and R n is the union of all translates of R on by multiples of 2 n w . The preimageof the left half-plane under f n is L n = R n + 2 n − w , which is the union of thetranslates of R on by odd multiples of 2 n − w .24onsider a point P n = ℘ n ( z n ) ∈ E n ( C ), where z n ∈ R on . Its preimagesin E n +1 ( C ) are ℘ n +1 ( z n ) and ℘ n +1 ( z ′ n ), where z ′ n = z n + 2 n w . One of z n , z ′ n lies in R n +1 , the other in L n +1 . Since w / ∈ R ok for all k , one can show that R on ⊂ R on +1 (see Lemma 27 below). Hence, in fact, z n ∈ R on +1 and z ′ n ∈ L n +1 .Hence, by choosing the sign of each r n for n ≥ n ≥ P n = ℘ n ( z n ), where z n ∈ R o doesnot depend on n . Hence the associated point sequence is coherent, as required.For the last part, if ℜ r n > n > n ≥
0, then we simply apply theabove argument to E n and ( P n ) n ≥ n , noting that P n is a lift of P to E n ( C ),and that every elliptic logarithm of P n is also one of P . Lemma 27.
In the notation of Proposition 26, R on ⊂ R on +1 for all n ≥ .Proof. It suffices to show that ℜ f n +1 ( z ) has constant sign for z ∈ R on , since thissign is positive for z = w / ∈ R on . If not, then there exists z ∈ R on such that ℜ f n +1 ( z ) <
0, so f n +1 ( z ) is real and negative. We show this to be impossible.We have r n − = a n − r n − a n − − b n − r n + a n − = h n ( r n − ) = g n ( r n − ) , say, where h n is the linear fractional transformation z a n − z − a n − − b n − z + a n − , and g n ( z ) = h n ( z ). This implies that f n ( z ) = g n +1 ( f n +1 ( z )) = h n +1 ( f n +1 ( z ) ) . To complete the proof we show that the image of the negative real axisunder h n is contained in the left half-plane, for all n ≥
1. Let t ∈ R be negative,and set s = 2 t − < −
1, and α = a n − /b n − ; then h n ( t ) = sα − α − s , and we leave it to the reader to check that this has negative real part when s < − ℜ α > ℜ r n > n ≥ ℜ r = 0; this occurs if and only if x lies on the open linesegment between e and e . We summarise this section with the following algorithm.
Algorithm 28 (Complex Elliptic Logarithm) . Given an elliptic curve E definedover C by the Weierstrass equation Y = 4( X − e )( X − e )( X − e ), and anon-2-torsion point P ∈ E ( C ), compute an elliptic logarithm of P . Input: E , with roots e , e , e , and P = ( x , y ) ∈ E ( C ), with y = 0.25. Set a = √ e − e and b = √ e − e , choosing the numbering of theroots (if necessary) and the signs so that | a − b | < | a + b | .2. Set r = p ( x − e ) / ( x − e ), with ℜ r ≥ t = − y / (2 r ( x − e )) (so t = x − e ).4. Repeat the following, for n = 1 , , . . . :(a) set a n = a n − + b n − , b n = p a n − b n − , choosing the sign of b n so that | a n − b n | < | a n + b n | ;(b) set r ← p a n ( r + 1) / ( b n − r + a n − ), with ℜ r > t ← rt .until | a n /b n − | and | r − | are sufficiently small. Set M = lim a n . Output: z P = 1 M arctan (cid:18) Mt (cid:19) . Note that the output value of z P may not be in the fundamental paral-lelogram of the period lattice Λ. However, assuming that the usual range forthe arctan function is used, where − π/ < ℜ arctan( x ) ≤ π/
2, we will have z P = xw + iyw with x, y ∈ R and − / < x ≤ / P of order 2, choose the labelling of the roots so that P = ( e , z P = w / π/ (2 M ) where M = M ( √ e − e , √ e − e ). For elliptic curves defined over R there is some advantage in adapting the algo-rithm to use real arithmetic where possible, even though the algorithm as givenabove works perfectly well in this situation. We divide into cases as in sections6.2 and 6.3 above. Order the roots, which are all real, as in section 6.2, so that e > e > e ; thereal and imaginary periods w , w are then given by (12).Let P = ( x , y ) ∈ E ( R ) with 2 P = 0 (so y = 0). If P is in the connectedcomponent of the identity of E ( R ) then x > e , and it is immediate from theformulae given above that as well as all a n , b n being real and positive, so tooare all r n , and the t n are real and with constant sign (opposite to that of y ).Hence z P , the output of the algorithm, is real and in the interval | z P | < w / e > x > e , so that P is in the other real component.Now z P = x P + w / x P is real, and it suffices to compute x P . To dothis we may replace P by P ′ = P + ( e ,
0) which is in the identity componentand has elliptic logarithm equal to x P . A short calculation shows that we maycompute x P using the usual iteration, with the positive real initial values r ′ = a / √ e − x ; t ′ = r ′ y / x − e ) . .6.2 Curves with negative discriminant As in 6.3, we order the roots so that e is real and ℑ e >
0. Set a = √ e − e = x + yi where x, y >
0. The real period is w = π/M ( a , b ) = π/M ( x, R ) where R = | a | . Now let √ x − e = u + iv with u, v >
0, and then set the initialvalues of r and t to r = ( u + iv ) / ( u − iv ) and t = − y / u + v ).Applying the first step in the iteration, we find that a = x and b = R , andalso that r = p ux/ ( ux + vy ), where the quantity inside the square root is realand positive, so we may take r > t = r t which is also real andwith the opposite sign to y . Now the rest of the iteration may be carried outusing real values for all quantities, and again the output value z P is real andsatisfies | z P | < w / In the following examples, we will illustrate our method for computing the periodlattices of elliptic curves over C , and the elliptic logarithms of complex points.These examples were computed both using the MAGMA implementation by thesecond author and also using the
Sage implementation by the first author; a
Sage script which reproduces these examples is available at [6].All complex numbers in our examples were first computed to 100 decimalplaces (though we only show the first 20 decimal places below, to save space) andthen to 200, 400 places and up to 1600 decimal places: this allows us to illustratethe rapid convergence in practice, where each iteration doubles the number ofcorrect decimal places. In all these examples, no more than 11 iterations wererequired to obtain 1600 decimal places, making the computations essentiallyinstantaneous in practice. Note that in all our examples the input consists ofexact algebraic values of e , e (and e = − e − e ) in either Z [ i ] or Z [ √ a, b ) to a given relativebit-precision, in terms of log( a/b ).Note also that we had to implement functions for computing optimal AGMvalues, as the standard AGM function in MAGMA does not always return anoptimal one, and this was also true of
Sage until version 4.3.2 when our newimplementation (jointly written with Robert Bradshaw) was released.
Example 1.
Let E be the elliptic curve over C given by the Weierstrass equa-tion E : Y = 4( X − e )( X − e )( X − e )with e = 3 − i, e = 1 + i, e = − i. Observe that P j =1 e j = 0. We will compute the period lattice of E using themethod described in Theorem 21. To do this, first we let E = E and calculate a = √ e − e , b = √ e − e , c = q a − b , a , b , c are chosen so that (11) holds: | a − b | ≤ | a + b | , | a − c | ≤ | a + c | , | c − ib | ≤ | c + ib | . In this example, one can verify that such a , b , c are a = 2 . . . . − i . . . .b = 1 . . . . − i . . . .c = 2 . . . .. In fact, all conditions in (11) are strictly inequalities in this case, as the periodlattice of E is non-rectangular. Using Theorem 21 with optimal AGM values,we compute w = 1 . . . . + i . . . .w = 1 . . . . − i . . . .w = − . . . . + i . . . . ;any two of w j form a Z -basis for Λ (the period lattice of E ), and, as expected,these w j are minimal coset representatives of 2Λ in Λ.Computing each w j to 100 (respectively 200, 400, 800, 1600) decimal placesrequires only 7 (respectively 8, 9, 10, 11) basic AGM iterations. We verifiedthat the first 100 (respectively 200, 400, 800) decimal places are unchangedwhen recomputed to higher precision, and also that the equality w = w + w held to the required number of decimal places in each case.Next, we compute an elliptic logarithm of the point P = (2 − i, i ) ∈ E ( C )(which has infinite order). Using a , b as above, Algorithm 28 gives z P = − . . . . + i . . . .. The number of iterations required for 100, . . . , 1600 decimal places is the sameas for the AGM itself, namely 7,. . . ,11.Note that z P is only well-defined modulo Λ. Depending on the basis forΛ, the value z P obtained using Algorithm 28 may not lie in the fundamentalparallelogram spanned by that basis. In our case, one can check that z P = ( − . . . . ) w − (0 . . . . ) w ≡ (0 . . . . ) w + (0 . . . . ) w , and so z P is not in the fundamental parallelogram spanned by { w , w } . Finally,one may verify that, to the given precision, we have, as expected, ℘ Λ ( z P ) = x ( P ) , ℘ ′ Λ ( z P ) = y ( P ) , and also ℘ Λ ( w /
2) = e , ℘ Λ ( w /
2) = e , ℘ Λ ( w /
2) = e , with ℘ ′ Λ ( w j /
2) = 0 for all j = 1 , ,
3. 28 xample 2 (Rectangular Lattice) . Let E be the elliptic curve over C given bythe Weierstrass equation E : Y = 4( X − e )( X − e )( X − e )with e = 1 + 3 i, e = − − i, e = 3 + 9 i. Observe that P j =1 e j = 0 and the e j are collinear. By letting E = E andcomputing a , b , c as before, we have a = 1 . . . . − i . . . .b = − . . . . − i . . . .c = 2 . . . . − i . . . .. This time, however, we have | a − b | = | a + b | , while the other two relations in(11) are strict inequalities. Hence we have two minimal elements (up to sign) inone coset of 2Λ in Λ (where Λ is the period lattice of E ), and Λ is rectangular.To obtain an orthogonal basis for Λ, we first let w, w ′ = π/M ( a , ± b ): w = − . . . . + i . . . .w ′ = 1 . . . . + i . . . .. One can check that | w | = | w ′ | . Let w = ( w + w ′ ) / w = ( w − w ′ ) /
2. Then w , w form an orthogonal basis for Λ, as in Lemma 5: w = 0 . . . . + i . . . .w = − . . . . + i . . . .. Note that ℜ ( w /w ) = 0, as required for orthogonality.Let z P be an elliptic logarithm of the point P = (3 + 2 i, − i ) ∈ E ( C )(which P has infinite order). Algorithm 28 gives z P = − . . . . − i . . . . ≡ (0 . . . . ) w + (0 . . . . ) w . Finally, we verify that (within the working precision) ℘ Λ ( z P ) ≈ x ( P ) , ℘ ′ Λ ( z P ) ≈ y ( P ) , and also ℘ Λ ( w / ≈ e ,℘ Λ ( w / ≈ e ,℘ Λ ( w/ ≈ e , and ℘ ′ Λ ( w / ≈ ℘ ′ Λ ( w / ≈ ℘ ′ Λ ( w/ ≈ . xample 3. Let K = Q ( θ ) where θ is a root of the polynomial x −
2. Let E be the elliptic curve defined over K given by the Weierstrass equation E : Y = 4( X − θ )( X − X + 1 + θ ) . Note that K has one real embedding and one pair of complex embeddings. Let E , E be the real and complex embedding of E respectively, with equations E : Y = 4( X − √ X − X + 1 + √ E : Y = 4( X − ω √ X − X + 1 + ω √ √ ω = exp(2 πi/
3) is a cube root of unity.Now E has three real roots, so the period lattice of E is rectangular. Infact, by letting e (0)1 = √ , e (0)2 = 1 , e (0)3 = − − √
2, we can compute a , b , c satisfying (11) as a = 1 . . . .b = 0 . . . .c = 1 . . . .. One sees that | c − ib | = | c + ib | . As before, we compute w = πM ( c , ib ) = 2 . . . . − i . . . .w ′ = πM ( c , − ib ) = ¯ w, and let w , w = ( w ± w ′ ) /
2. Then w , w form an orthogonal basis for theperiod lattice of E . In this example, we have w = ℜ ( w ) and w = i ℑ ( w ).Secondly, the period lattice of E is non-rectangular, since the roots of E are not collinear. In fact, by letting e (0)1 = − − ω √ , e (0)2 = 1 , e (0)3 = ω √ a , b , c satisfy (11)), we have a = 1 . . . . − i . . . .b = 0 . . . . − i . . . .c = 1 . . . . − i . . . .. One can check that all conditions in (11) are strict inequalities, which alsoconfirms that the period lattice of E is non-rectangular. By Theorem 21, wefinally obtain w = 1 . . . . + i . . . .w = 2 . . . . − i . . . .w = − . . . . + i . . . . with w ≈ w + w . Example 4.
Let E be the elliptic curve over C given by the Weierstrass equa-tion E : Y = 4( X − e )( X − e )( X − e )30ith e = − − i, e = 3 + i, e = − i. Observe that P j =1 e j = 0 and | e − e | = | e − e | . Thus e , e , e form anisosceles triangle. Letting E = E and computing a , b , c as before, we have a = 1 . . . . − i . . . .b = 0 . . . . − i . . . .c = 2 . . . . − i . . . .. Hence by Theorem 21, we obtain w = 0 . . . . + i . . . .w = 1 . . . . − i . . . .w = − . . . . + i . . . . with w ≈ w + w . In addition, one can check that ℜ ( w /w ) = 1 / E . We finally verify that ℘ Λ ( w j / ≈ e j for j = 1 , ,
3, and ℘ ′ Λ ( w / ≈ ℘ ′ Λ ( w / ≈ ℘ ′ Λ ( w / ≈ . References [1] W. Bosma, J. Cannon, and C. Playoust. The Magma algebra system. I. Theuser language. J. Symbolic Comput., (1997), 235–265.[2] J.-B. Bost and J.-F. Mestre,
Moyenne arithm´etico-g´eom´etrique et p´eriodesdes courbes de genre et
2, Gaz. Math. (1988), 36–64.[3] H. Cohen, A course in computational algebraic number theory , Grad. Textsin Math., , Springer-Verlag, 1993.[4] D. A. Cox,
The arithmetic-geometric mean of Gauss , Enseign. Math. (2) (1984), 275–330.[5] J. E. Cremona, Algorithms for modular elliptic curves , second ed., Cam-bridge University Press, 1997.[6] J. E. Cremona and T. Thongjunthug,
The complex AGM, periods of ellipticcurves over C and complex elliptic logarithms , preprint and auxiliary files at http://arxiv.org/abs/1011.0914 .[7] R. Dupont, Fast evaluation of modular functions using Newton iterationsand the AGM , Mathematics of Computation
80, No. 275 (2011), 1823–1847.[8] R. Dupont,
Moyenne Arithm´etico-G´eom´etrique, suites de Bor-chardt et Applications , Ph.D. thesis, ´Ecole Polytechnique (2006): .[9] H. Geppert,
Zur Theorie des arithmetisch-geometrischen Mittels , Math.Ann. (1928), 162–180. 3110] W. A. Stein et al., Sage Mathematics Software (Version 5.6) , The SageDevelopment Team, 2013, .[11] T. Thongjunthug,