On the computation of quadratic $2$-class groups

W

IEB

B

OSMA

P

ETER

S

TEVENHAGEN

On the computation of quadratic 2-class groups

Journal de Théorie des Nombres de Bordeaux, tome

8, n

o

_{2 (1996),}

p. 283-313

<http://www.numdam.org/item?id=JTNB_1996__8_2_283_0>

© Université Bordeaux 1, 1996, tous droits réservés.

L’accès aux archives de la revue « Journal de Théorie des Nombres de Bordeaux » (http://jtnb.cedram.org/) implique l’accord avec les condi-tions générales d’utilisation (http://www.numdam.org/conditions). Toute uti-lisation commerciale ou impression systématique est constitutive d’une infraction pénale. Toute copie ou impression de ce fichier doit conte-nir la présente mention de copyright.

Article numérisé dans le cadre du programme Numérisation de documents anciens mathématiques

On the

_computation

of

_quadratic

_{2-class groups}

par WIEB BOSMA ET PETER STEVENHAGEN

RÉSUMÉ. Nous décrivons un algorithme dû à Gauss, Shanks et _{Lagarias qui}

étant donné un entier D ~ _0,1 mod 4 non carré et la factorisation de _D, détermine la structure du _{2-sous-groupe} de _Sylow du groupe des classes de l’ordre _quadratique de déterminant _{D ;} la _complexité de cet _algorithme est

en _{temps polynomial probabiliste} en log |D|.

ABSTRACT. We describe an _algorithm due to _Gauss, Shanks and _Lagarias

that, given a _{non-square integer} D ~ _{0, 1} mod 4 and the factorization of _D,

computes the structure of the _{2-Sylow subgroup} of the class _group of the

quadratic order of discriminant D in random _polynomial time in _{log |D|.}

1. Introduction.

Let D =

_{o, I}

mod 4 be a _non-square

integer,

and denote

by

Cl(D)

the strict

class group of the

quadratic

order O =

Z[(D

₊

B/D)/2]

of discriminant D.

The group

Cl(D)

may be identified with the class group of

primitive

integral

binary

quadratic

forms of discriminant

D,

and this

_yields

a

description

that

is very useful for

explicit

computations.

There do exist

_algorithms

that

compute

CI(D)

in a time that is

subexponential

in the

length log D

of the

input;

see

[3]

and

[5,

7]

for the

_respective

cases D &#x3E; 0 and D 0.

_However,

these

_algorithms

are far from

_{polynomial-time,}

and it is

_unlikely

that

_they

will be used in the near future for discriminants D

having

more

_than,

_say,

50 decimal

_digits.

The

_algorithm

in this paper

only

computes

the

2-Sylow

subgroup

C(D) =

CI(D)2

of the class _group. It runs in random

_polynomial

time

_{[8, j}

_]

if the factorization of D is

_given

as

_part

of the

_input,

and it handles most

50-digit

discriminants in a matter of seconds. In contrast to the situation for

_algorithms

that

_compute

the full class group

C1(D),

it turns out that

not

_only

the size of

_D,

but also the number of

_prime

factors of D and the

Class. Math. : _{Primary 11Y40, 11R11; Secondary 11E16,} 11E20.

Mots-clés : Quadratic _ 2-class groups, - _ , binary and ternary quadratic - forms.

’depth’

of the

_resulting

class group

greatly

influence the

_running

time. For

instance,

consider the

_501-digit

discriminant

which is the

_product

of five

_primes

_exceeding

101°°

that are 1 mod 4 and

squares modulo each other. It is chosen in such a _way that

C(D) ~

C4

_{X C128}

has

_high

4-rank. It takes less than a second to find the

_elementary

abelian

2-groups

C(173.

D~ ^-_’

Cfl t3£

C( -43. D).

Now consider the

_sample

of 2-class groups

with

_{approximate timings}

on a Sun MP670 workstation indicated in

brack-ets. We see that the

_algorithm

takes more time if the

_resulting

2-class group is ’further’ from

elementary 2-abelian,

and that the real

quadratic

case D &#x3E; _{0 appears} to be somewhat harder than the

_imaginary

quadratic

case. We will

_give

a

complete

_quantitative

explanation

for both

obser-vations. Note that

_computation

of _{the full class group for any} of these discriminants is

_{currently completely}

unfeasible.

The basis of our

algorithm

is a method to solve the

_duplication

_equation

2x = _c in

quadratic

class groups that is due to Gauss

[6,

section

286}.

It has

been

_implemented

and used to

_compute

various

_imaginary

_quadratic

2-class groups

C(D)

by

Shanks

D.

All of Shanks’s

examples

were

cyclic

or almost

cyclic,

and he did not

_give

an

algorithm

to handle

_general

D.

_Doing

so is

essentially

a matter of linear

_algebra,

as was shown

by

Lagarias

[],

who

ana-lyzed

the

_algorithm

from the

_point

of view of its

_{computational}

_complexity

but referred to

_[]

for a

practical

implementation.

There does not seem to be

a

_{complete description}

of the mathematical content of the

_algorithm

in the

existing literature,

and this _paper intends to _{fill this gap. It} turns out that a

careful

_description

of the mathematics leads to

_something

which is not too

far from an actual

_{implementation}

in a

high

level

_{programming language}

like that of

_Moreover,

it

_naturally

_yields

an

algorithm

that

in-cludes the

_improvements

of Shanks

_regarding

the Gaussian solution of the

duplication

equation

and avoids the unnecessary

coprimality

assumptions

The

algorithm

has been

successfully

exploited

[]

in the verification of the heuristics of the second author

_{[9, ] regarding}

the

_solvability

in

_integers

of the

_negative

Pell

_{equation x2 -}

_{dy2 =}

-1. This verification involved the

computation

of

_C(D)

for several millions of

_{large, highly}

_non-cyclic

real

quadratic

2-class _groups.

The

_description

of the actual

_algorithm

is contained in section 3 of this paper. It is

preceded by

a _summary of the basic results on

binary

quadratic

forms and followed

_by

a worked

_{example illustrating}

some technical

_points

of the

_algorithm.

The

_algorithm

itself is

_essentially

a matter of linear

algebra

once one knows how to

_generate

the 2-torsion

_subgroup

of

_CI(D)

and how to solve the

_equation

2x = _c for elements _c in the

principal

genus

2Cl(D).

The

_{’division-by-2-algorithm’}

used in

_solving

2x = _c is based _on

the reduction

_theory

of

_ternary

_quadratic

forms. As this reduction

_theory

is

_considerably

less well known than the

_{corresponding theory}

for

_binary

quadratic forms,

a concise

_description

of it has been included as section 5. It is used in section

_6,

which deals with the solution of the

_duplication

_equation

that forms the backbone of the

_algorithm.

A final section 7 comments on

the

_performance

of the

_algorithm.

We thank Andreas

_Meyer

for

_detecting

a number of

_typos

in an earlier

version of this _paper.

2.

_Quadratic

_{class groups.}

Let D =

_0,1

mod 4 be an

_integer

that is not a _square. The class _group

CI(D)

of discriminant D is defined to be the

_quotient

_{of the group of} in-vertible ideals of the

_quadratic

order

_C~D

=

Z[(D+B/D)/2]

by

the

_subgroup

of

_principal

ideals

_having

a

totally

_{positive generator.}

Note that the

posi-tivity requirement

is

_{automatically}

fulfilled for

_{negative D,}

and that

_CI(D)

is the

_(strict)

class _group of the

_quadratic

field

_{Q( m)}

if D is

_fundamental,

i.e.,

if D is the discriminant of the field

_C~(~).

The relative ease with which one can

perform

computations

in

CI(D)

comes from an alternative

description

in terms of

_binary

_quadratic

forms which is due to Gauss. Consider the set

_.~D

of

_primitive

_integral

_binary

quadratic

forms of discriminant

_D,

_i.e.,

forms Q =

(a,

b,

c)

=

ax 2 +bxy+cy 2

in two

_{variabIes x, y}

with

coefficients a,

b,

c E Z that

_satisfy

_gcd(a,

_b,

_c)

= 1

and b2 -

4ac = D. For D

_0,

_we

_require

in addition that a is

positive.

The group

SL2 (Z)

of

_integral

2 x 2-matrices of determinant 1 has a natural

right

action on

_FD

defined

_by

_{QS(x, y)}

=

Q(sx

₊

_{ty, ux}

₊

vy)

for S =

group

Cl(D)

under the map

The _power of

_{~ in}

the map above is

only

there to

’preserve

orientation’ and vanishes for

_negative

D.

_By

_transport

of

_structure,

_{XD /SL(Z)}

be-comes a _{group that} we

_identify

with

CI{D) . Accordingly,

we

speak

of the

class rather than of the orbit of a form in

_{Cl(D) .}

In the case that D is a

square, which we have excluded so

_far,

the orbit _space can be

made into a _group

_by

Gauss’s

_original

method that we will discuss later

in this section.

_Following

Gauss

_[6,

end of section

_249],

we will write the group

operation

in

C1(D)

additively.

This appears to be the most

conve-nient notation for

_{computational}

purposes, as most

_computations

in class groups use

_techniques

_coming

from linear

_algebra,

and it is in line with the

common _usage to treat _{divisor class groups} as additive

_objects.

As the forms

_(a,

_b,

_c)

and

_(a,

b +

_2ka,

c + kb

_-I-1~2a)

are in the same class

for all k E

_Z,

_every class contains a form

(a, b, c)

with

bi

_~ It is not

hard to show

_[2,

_propositions

5.3.4 and

_5.6.3]

that _every class contains a

quadratic

form

_(a,

_b,

_c)

with

so it follows that

_CI(D)

is finite for all

_D,

square or not. Given a form

in one can

efficiently

_compute

[8]

a unimodular transformation that

reduces this form to one of the

finitely

_many forms

(a,

b,

c) satisfying lbl

jai

_.JiDi73.

However,

it is not in

_{general possible}

to decide

_efficiently

whether two

_quadratic

forms are in the same class in

Cl(D).

This is a

serious

_difEculty

that

_prevents

us from

_working

_directly

in the class _group itself.

Instead,

one has a finite set of reduced forms

_4DD

that maps

surjec-tively

to the _{class group}

_Cl(D),

and one works with these reduced forms as

_{representatives}

of the classes of

Cl(D).

For D

_0,

an

_appropriate

def-inition of reduced forms ensures that the _map

lb D -

Cl(D)

is a

bijection

and the situation is

_{perfectly satisfactory.}

For D &#x3E; 0

_however,

there are

usually

many reduced forms

mapping

to the same class in

CI(D),

and in

this case an

_arbitrary

form in can be

_efficiently

reduced to a form in

q.D,

but not to an element of

Cl(D).

As an

_example,

one can think of the

form

_{(-l, 0, d)}

for d &#x3E; 0 that

_represents

the unit element in

_Cl(4d)

if and

only

if the

_negative

Pell

_{equation x2 -}

_dy2

= -1 is solvable in

integers.

This

_example

is of fundamental

_importance

in

_0.

In the case of _non-square discriminants

_D,

our _map shows that the

to the unit element in

_Cl(D).

The

_opposite

form

_(a,

_-b,

_c)

of

_(a,

_b,

_c)

is

the inverse of the class of

_(a,

b,

c)

as _{it maps} to the

_conjugate

ideal class in

_Cl(D).

If we work out how the

_{multiplication}

of ideals translates into

a

_composition

formula for

quadratic forms,

we find

[2, 5.4.6]

that the sum

of the classes of the

_primitive

_quadratic

forms

_(a,,

_bi,

_cl)

and

_(a2,

b2,

C2)

in

CI(D)

contains a form

(a3,

_b3,

C3) satisfying

It was shown

by

Dirichlet that the forms can be chosen in such a _way

inside their

equivalence

class that one

only

needs to

_perform

_compositions

for which d

_{= 1,}

known as

_compositions

of ’concordant forms’. In

_fact,

it suffices

_[4,

lemma

_3.2]

to have a

_composition

of concordant forms

_{(al, b, cl)}

and

_(a2,

_b,

_C2)

_having

the same middle coefficient b that satisfies

b2 -= D

mod

4ala2-

In this

_situation,

one has _ci = and _c2 = for _some

_integer

c,

and

_(2.2)

yields

an

identity

that is known as Dirichlet

_composition

of forms.

Together

with the reduction of

arbitrary

forms to forms in a finite set

the

_composition

formulae

provide

us with a

_{computational}

model for

the class group. More

precisely,

there is for each D a finite set

4~D

of reduced forms of discriminant D that is

_usually

too

_large

to be enumerated. Given a form F E one can

efficiently

find some form

Fred

E

_40D

that is in the same class. Given

_tPD,

the

_composition

formula

(2.2)

makes it

_possible

to

_compute

_efficiently

a reduced form

F3

=

Fi

o

F2

E

_{q. D}

whose class in

_CI(D)

is the sum of the classes of

Fl

and

F2.

The

_opposite

of a reduced form is

trivially

computed,

so we can

perform

the

’group

operations’

of

_CI(D)

on the level of

_However,

since

_equivalence

cannot

be tested

_efficiently

when D is

_large

and

_{positive, passing}

from

_{16 D}

to

_Cl(D)

is an

_entirely

non-trivial matter. It is

_exactly

this

_complication

which led Shanks

_[,

p.

849]

to believe that one cannot

_always

decide

_efficiently

whether certain 2-torsion classes in

_CI(D)

are

actually

trivial. We will come

back to this

_problem,

which will turn out ot be

_{non-existent,}

in section 3. The

_ambiguity

between forms and their classes will however necessitate a

careful formulation of our

_algorithm

in section

_3,

where we

_compute

the

2-primary

part

of

_CI(D)

while

_working

with

_representing

forms.

As we will be interested in

duplication

in the class group in later

_sections,

we mention the

_following

_important

_example

of concordant

_composition.

2.4. DUPLICATION LEMMA. Let be

_{a form of}

discriminant

D with

gcd(a,

b)

= 1.

If A, v

_E Z

satisfy

Aa + vb =

_1,

then _we have

2[(a,

b,

c)]

=

[(a2, b -

2vac,

c’)]

E

_CI(D)

_for

some

_integer

c’. In

_particular,

we have

2j(a, b, c)~

=

I(a2,b,c/a)] if a

divides c. E3

This lemma can be used in the

_opposite

direction to solve the

equation

2(PJ

=

[Q]

for a form

_Q

that

_represents

a

square k2

_coprime

to 2D.

_Indeed,

suppose we have

Q(u, v)

=

k2

for certain u, v _E

Z,

and _assume without loss

of

_generality

that u and v are

_coprime.

Transforming

Q

by

a unimodular

matrix S =

~vt~,

we obtain an

equivalent

form

Qs

satisfying

0)

=

k2,

so we have

Qs

=

(k2,

l,

m)

for certain

l,

m E Z. The form

_(k,

_l,

_km)

of

discriminant l2

-

4k2m

= D is

primitive

since

gcd(k, l)

=

gcd(k, 2D)

=

1,

and the

duplication

lemma shows that we have

2((k, l, km)] =

[(k2, l,

n)]

=

IQ]

-In section

_6,

we will

employ

the

original

description

of Gauss of the

group structure on

Cl(D),

which is

_quite

different from the one we have

given

above and also works for square discriminants. In this

description,

a

form

_Q

=

(a3,

b3,

c3)

of discriminant D is the

_composition

of _two

_primitive

quadratic

forms

_(a,,

_bl,

_cl)

and

_(a2,

_b2,

_C2)

of discriminant D if there exist bilinear relations

over Z that

yield

the

identity

and

_satisfy

an

’orientability

condition’ that

distinguishes

the forms

bi,

cl)

and

_(a2,

_b2,

_C2)

in

_(2.5)

from their

_opposite

forms

_{(al, -bl, cl)}

and

_(a2,

_-b2,

_C2)

-Write

I I

for the subdeterminants of our bilinear relations. An

elementary

computa-tion

_[4,

exercise

_3.1]

shows that if

_(2.5)

holds for a form

Q

of discriminant

D,

then we

_necessarily

have

612

=

tai

and

613

=

~a2.

The

orientability

con-dition is that the

_+-sign

holds in both cases. Note that the

_preceding

defi-nition for the

_composition

of forms is indeed defined on

SL2(Z)-equlvalence

If

_Q

is a

_composition

as

specified above,

the determinants

6jj

satisfy

and the coefficients of

_Q

are

Conversely,

given

primitive

forms

_Q,

=

(al,b1,cI)

and

Q2

=

(a2, b2, c2)

and

_integers

_{Si, ti}

for which

_(2.6)

and

_(2.7)

_hold,

we have

bi -

_4a,cl

= b2

-4aZC2

= D for _some discriminant D and

((a3, b3,

=

[Qll

₊

(Q2 E Cl(D).

For _non-square

_D,

Gauss’s definition

_yields

the same _group structure on

CI(D)

as the Dirichlet

_composition

(2.3).

This is immediate from the

ob-servation that the identities

_(2.6)

and

_(2.7)

are satisfied for the forms in

(2.3)

if one takes the bilinear relations

_equal

to

In the

_particular

case where we want to

_duplicate

a form in

CI(D),

the

identities

_(2.6)

_suggest

that we should take _S2 = _S3 and _t2 = _t3. The result

will be used in section 6 to prove the correctness of the

_algorithm

to solve the

_duplication

_equation

2x = c E

_2Cl(D).

2.8. LEMMA. Let F =

(a, b, c)

be a

_primitive

quadratic form of

discrimi-nant

_D,

and suppose we are

_{given integers}

_{si, ti}

for

i =

_{1, 2, 3}

_satisfying

the identities

Then the class

_2[F]

E

_CI(D)

contains the

_form

If a and b are

_coprime

in this

_lemma,

we can find A and v

satisfying

Aa+ vb =

1 and take

3.

_Computing

quadratic

2-class groups.

Let D -

_{0, 1}

mod 4 be a _non-square

_integer

for which we have a

complete

factorization. We want to

_compute

the strict 2-class _{group C} C Cl of the

quadratic

order of discriminant D. The

_computation

is

_essentially

a matter of linear

_algebra

over the field of 2 elements

F2.

For this _reason, we take

the values of all

_quadratic

characters in this section to lie in

_F2

rather than in the

multiplicative

group

(-1).

The factorization of D

_provides

us with the two basic

_ingredients

of our

algorithm.

The first is an

F2-basis

of the character group

_~D

of

C/2C

=

Cl/2CI, commonly

known as the _group of _genus characters of Cl. The

second is a

_generating

set of

_ambiguous

_{forms, i.e.,}

a set of forms whose classes

_generate

the 2-torsion

_subgroup

_C[2]

=

Cl[2]

of C c Cl. The classes

in Cl of the elements of our set will not in

_general

form an

_F2-basis

for

_C(2~.

Let d be the discriminant of the field We have D = for _some

integer

f &#x3E;

1 that

equals

the index of the

quadratic

order of discriminant D inside the maximal order in

For an odd

_prime

divisor _p of

D,

we write _{xp :}

_{(Z /DZ)* -}

F2

for the

quadratic

character of

_{conductor p}

and xd =

(~) :

(Z/DZ)* -

F2

for the

quadratic

character

_{corresponding}

to the field

_{Q(@) .}

The group of field characters

Xd

corresponding

to D is _{the group}

of Dirichlet characters on

(Z/DZ)*.

Here _{p ranges} over the odd

_prime

divisors of d. If d is

_odd,

the characters _xp form a basis of

_3id

and their

product equals

~d. If d is even, the

product

of xd and all characters xp is a

quadratic

character of

_2-power

conductor associated to the

_quadratic

field of discriminant -4 or ~8. This

character,

which we denote

correspondingly

by

x-4, X8 or _x-8, and the characters xp now form a basis for In

all _cases, the order of

_3Cd

_equals

_2’,

with t the number of distinct

_prime

divisors of d. The abelian field

_{corresponding}

to

_~d

is the genus field of

the

_quadratic

field

_{Q( vD).}

It is the maximal abelian extension of that is unramified at all finite

_primes

and abelian over

_Q.

The full group

3CD

of genus characters associated to the discriminant D has a similar

_definition,

but

_special

care is needed to obtain the correct

characters of

_2-power

conductor.

_Writing

_{3C’ D}

_{for the group of characters}

of

_{f ,}

we have

A basis of

3CD

is obtained

_by

_adding

to a basis for

_3id

the characters _xp

for the odd

_prime

divisors of

f

that do not divide d and the characters

X-4 and x8 as

specified

in the definition above. One finds that if D has u

distinct

_prime

_divisors,

then

~D

has dimension u + 1 if D is divisible

_by

32

_(and

contains all

_quadratic

characters of

_2-power

_{conductor), u -}

I for D = 4 mod 16

_(when

d is odd and

_{f -}

2 mod

₄₎

and u otherwise. The abelian field

GD

corresponding

to

_3CD

is _{the genus field of the}

_quadratic

order of discriminant D. It the maximal abelian extension of

_Q

that is contained in the

_ring

class field of conductor

_f

of

_{Q( v’Ï5).}

_By

class field

theory,

the Galois _group is

_canonically

_isomorphic

to

CI/2CI

=

C/2C,

and _it follows that there is _a

perfect

_pairing

of

F2-vector

spaces

More

_explicitly,

the value of a

_{character X}

E

_~D

on a class

[Q]

E Cl is the

common

x-value

of the

_integers

_coprime

to D that are

represented

by

Q.

One deduces that the value of a

character X

E

3ED

of conductor k on the

class of

_(a,

b,

c)

in Cl

_equals

If the conductor k

_{of x}

is a

prime

_power

dividing

D,

as in the case of the

’basis characters’ of

_{3i D}

mentioned

_above,

the

_primitivity

of the form

im-plies

that at least one of these conditions is satisfied. Our

_algorithm

will

only

use such basis characters. For

general X

E

_3CD,

one uses its

representa-tion on the basis.

Alternatively,

one can

replace

a form of

discriminant

_D

by

an

equivalent

form

(a, b, c)

_satisfying

gcd(a, D)

=

1,

cf.

[4,

_ex.

2.18].

An element E Cl is in the

_principal

_{genus 2CI if and}

_only

if all characters

of

_3ED

vanish on

_it,

so the genus characters enable us to decide

_efficiently

whether an element of Cl is in 2CI. In section

_6,

we will _prove the

_following.

3.4. DIVISION-BY-2-ALGORITHM. Given a

_form

_Q

whose class lies in

_2CI,

we can

_efficiently

_find

a

form

P

e 1’D

satisfying

=

tQ]

_E Cl.

The class of the form P in 3.4 is

_only

determined up to

composition

with classes from

_CI[21,

and all we know is that the form P found

by

the

algo-rithm lies in one of these classes. Even when

Q

is in the trivial

class,

there

is no

_guarantee

that P will be in the trivial class.

Apart

from an

explicit description

of the character group of

C/2C,

the

factorization of D also

_yields

_generators

for the

_subgroup

_C[2]

of

_ambiguous

ideal classes in Cl. This is due to the well known fact that

_C[2]

consists of classes of invertible

OD-ideals

I C

_OD

of index

_dividing

D. We can

take classes of ideals of

_prime

_power index as

_generators.

If _{p is} an odd

prime

dividing

D,

say there is an invertible

_OD-ideal

_Ip

=

Z ~ pk +

Z ’

_(D

+

~)/2

of index

_pk

in the order

_{O D .}

As this ideal is

_equal

to its

conjugate

in

_{OD ,}

its class in

_Cl(D)

is a 2-torsion element. It is the class of the

quadratic

form

For D - 0 mod

_4,

_say

_{2111 D}

with t &#x3E;

_2,

we have an

ambiguous

form

that is the

_principal

form for D == 4 mod 16. If D is divisible

_by

_32,

there is another

_ambiguous

form

that is needed to

_complete

our

_generating

set of

_ambiguous

forms.

_Thus,

if

we start with the set of forms _prime, we obtain a

_generating

set

So

by leaving

out

_QZ

for D - 4 mod 16 and

_including

_Q2

for D - 0 mod 32. If D has u distinct

_prime

_divisors,

then

_So

has u + 1 elements if D is

divisible

_by

_32,

it has u - 1 elements for D - 4 mod

_16,

and u elements

otherwise. This is

_exactly

the

F-dimension

of the character group

3ED,

and as the

_cardinality

of

C[2]

_equals

#(C/2C) =

we conclude

that there is

_exactly

one non-trivial relation in Cl between the elements of

_So.

For

_{negative D,}

the

_triviality

of the ideal class

_{((~)] _ ((~))}

E Cl

yields

the desired relation in all cases but one

(the

_easy case d =

-4).

We

can then form an

F2-basis

for

C[2]

from

So

by

leaving

out an

_appropriate

element. For D &#x3E; 0

_however,

the relation between the

_ambiguous

ideal classes is much more subtle. If the fundamental unit _eD E

_OD

is of norm

ambiguous

ideal class

_((1+ED)]

= 0

yields

the desired relation. The

problem

is of course that ED is

usually

too

_large

to be

_computable

in

_practice.

For this reason, we have to start our

_algorithm

for D &#x3E; 0 with a

_generating

set

_So

for

_C[21,

not an

_F2-basis.

This difference between the real and

the

_imaginary

case accounts for the

_slightly

_{larger running}

times of the

algorithm

for

_positive

D. The relation between the

_generators

of

_C[2]

for D &#x3E; 0 can be obtained as a

by-product

of the

_computation

of C. From

the relation we can determine the

_sign

of the norm of _eD without

_explicitly

computing

ED. This feature of the

algorithm

is

exploited

in

[].

The

_computation

of C

_{proceeds by}

the construction of an

F2-basis

for

the left

_argument

of the character

_pairing

For the

_right

_argument

we have our basis X of characters of

_prime

power conductor indicated above. The basis B C

0D

of forms whose classes

yield

a basis for

C/2C

will be constructed as a

disjoint

union of sets

_Aj

( j

=

1, 2, ... )

in such _{a way} that the classes of the forms _in

Bi

=

form a basis for the canonical

_image

of

C[2’]

in

_C/2C.

The basis

_A,

for the

_image

of the 2-torsion

_subgroup

_C[2]

will be formed from the set

_So

of

_ambiguous

forms. More

_generally,

we will _carry a set

_Si

of

2’+’-torsion

forms

_along

at

_stage

i.

_{Roughly speaking,}

the character

_pairing

is used to

’split’

the set

_Si

into a set of basis forms and a set of forms that map

to 2C. We divide the latter forms

_by

2

_using

our

_algorithm

3.4 to obtain the set

_,S’z+z

of

2i+2-torsion

forms needed at the next level. We continue until the union

_Uj

_Aj

_yields

a basis for

C/2C.

We are then done

_by

the

following elementary

lemma on abelian

_2-groups.

3.5. LEMMA. Let G be a

finite

abelian

2-group, X

a basis

for

_{its group}

_of

quadratic

characters,

and suppose we have a

disjoint

union B =

Aj

of

finite

sets

_Aj

C G such that the

_following

holds:

a. the 2-torsion

subgroup

G[2] is

generated

by

the elements with

b. the matrix a

non-singular

_{square matrix.}

Then B maps to an

_FZ

-basis

_for

_G/2G,

the elements in

_Aj

have exact order

2i

in G and the natural map

Proof.

The

_{non-singularity}

of the character matrix in

_(b)

_implies

that the elements in B _map to a basis for

G/2G,

so these elements

_generate

the

group G. As

G[2]

and

G/2G

have the same

F2-dimension,

the elements of

the form

_2j-laj

_{with aj}

E

_Aj

that occur in

_(a)

_necessarily

form a basis

for

_G(2~.

In

_particular,

the elements of

_Aj

have exact order

2-~

In order

to obtain the

_{required isomorphism}

for

G,

we have to show that _{for any}

relation = 0 _E G with coefficients

kb

_E

Z,

we have

ord2(kb) &#x3E; j(b)

for all b E B.

_{Here j(b)}

denotes the

_{index j}

for which b is in

_{Aj .}

_Suppose

that,

on the

_contrary,

the

_integer

n = is

positive.

Then we can

_multiply

our relation

_by

2n-1

and write it as

By

definition

_{of n,}

the

_expressions

in brackets are

_integral

and not all even.

This

_implies

that we would have a non-trivial relation between the basis

elements of

_{G[2] .}

Contradiction. D

Note that the conclusion of the lemma

_implies

that the subset

_Bi

_{= U~=l}

_Aj

C G _maps to a basis of the canonical

_image

of

G[2Z1

in

G/2G.

We now describe an inductive

algorithm

that

_computes

sets of forms

A~

C

_0D

such that the

_hypotheses

of lemma 3.5

_apply

to their classes in G = C. We noted

already

that the

problem

with

working

with forms is that

we cannot decide whether two different forms are different as elements of C.

However,

the forms in the sets

_Aj

that are

_computed

_by

our

_algorithm

are

constructed in such a _way that the

_quadratic

character values of each two

of these forms are distinct. This means that B =

Aj

_can indeed

by

viewed as a subset of G =

C,

_as

required by

3.5.

Thus,

_we do _{not run} into

the

_problem

encountered

_by

Shanks

_[,

_p.

_{849] .}

The sets of forms

SZ

that

are constructed

_during

the

_algorithm

do not in

_general

_map

_injectively

to

C.

Our

_algorithm

_computes

more than

_just

a set of forms

_Aj

at

_{stage j.}

The data it stores after i

_steps

are the

_following:

1. a

_ah’sjoint

union

_U"=1

_Aj

of finite sets of forms

_Aj,

_together

with

a collection of forms

Si

such that

C[2]

is

_{generated by}

elements of the form

_I

_{with aj} E

_Aj

and

2’[s]

with 8 E

_Si.

2. a subset

_XZ

C X of characters such that the matrix is

a

_non-singular

_square matrix.

Initialization. At the initial

_{stage i}

=

0,

we have

_{Bo -}

and our

Induction

_step.

_Suppose

we have X at

_stage

i. Then the set

Bi

is

not a set of

_generators

for

_C,

and we

_proceed

to the next

_stage

as follows.

Consider the character matrix

whose columns

_X(a)

E

Ff

_give

the

_{’complete quadratic}

character’ of the forms a E

_By

_(2),

the elements

_{X (a)}

for a

E Bi

are

_independent

in and we can _compose each of the elements of

Si

with forms from

_Bz

to

obtain that all characters in

_Xi

vanish on it. After

doing

_so, we still have

(1)

for our modified set

_SZ,

and the new columns

X (s)

for s E

Si

span a

subspace

Tl C

Ff

that is

_linearly

_disjoint

from the space

spanned by

the columns

_X(a)

with a E

B;.

We choose

_Ai+l

C ,Si

such that the columns

X(a)

with a E form a basis of

_V,

and we

_pick

a set of characters

Y

C X such that the matrix is

_{non-singular.}

We

_clearly

have Yi

1

Xi

=

0,

and _{we set}

_Xi+I

=

Xi

_to obtain

(2)

for

_{stage i}

_{+ 1.}

The

_remaining

forms in are now

_composed

with forms from

Ai+1

in such a _way that the characters in

_{X ~ Xi}

also vanish on them. Then

all characters in X vanish on these modified

forms,

so their classes are in

2C. We now

apply

our

division-by-2-algorithm

3.4 to each of the modified

forms in and take the solutions obtained as the set

_Si+,.

If s is in

_Si,

we can

by

construction write

[s]

E C as a sum of classes

[az+lj

with E and

2[sz+lj

with E We conclude that the

sets

_{12’[s] :}

s E and _ai+1 E _si+l E

generate

the same

subgroup

of

C [2j ,

so we have

(1)

for

_{stage i}

+ 1 as well.

Termination. The

_algorithm

terminates at

_{stage i}

if we have

_{Xi =}

X.

This is bound to

_happen

as we have

_Xi

= X if and

only

if C is annihilated

by

2i.

To see

this,

_suppose first that C is annihilated

by

2z.

Condition

(1)

then

_implies

that the elements

_generate

_C[2],

so the number

~Bz

of such elements is at least

_equal

to

_{dimC[2] =}

_{~X .}

It follows from

(2)

that we have

~Xz -

~Bz &#x3E; #X,

so

_{Xi -}

X.

_Conversely,

if we find

X2

= X at

stage i,

then C is annihilated

by

2’

as it can _be

_{generated by}

a

set

_Bi

of

2’-torsion

elements.

We conclude that after lV

_steps,

with

2N

the _exponent of

_C,

we have

found a basis B =

A~

for C that satisfies the

conditions

of lemma 3.5.

This finishes the

_description

of the

_algorithm.

In the actual

_{implementation}

of the

_algorithm,

we used a refinement that ensures that the final character matrix becomes lower

trian-gular.

Instead of

_taking

for

_Ai+l

some subset of

Si

whose

X-image

_spans

V,

one

alternately picks

a character and constructs a form to

_produce

Yi

and

Ai+I,

as follows.

Let Si

be our set of

_forms,

modified such that all

charac-ters in

Xi

vanish on

Si,

and look at the submatrix

MI =

of

Mi .

We

set Yi =

S

=

A;+i

and do the

following

until all entries of

Mi’

equal

zero. Pick a form a

E Si

and a

_{character X}

E X -

_Xi

such that

x(c~) ~

0,

add X

to the set

Yi

and move the form a from

S2

to

_Ai+1.

Com-pose the

remaining

forms s E

_,Sz

that have 0 with a-this

_yields

a new set

SZ and

continue with the new, smaller matrix This process, which is called

echelonization,

produces

a

non-singular

lower-triangular

ma-trix for the

_ordering

of forms and characters

_suggested

above.

Moreover,

it

_replaces

_sZ

_by

a set of forms with classes in

_2C,

and

Si+l

is constructed from this set

_applying

3.4.

At the final

_{stage i}

= N of the

algorithm,

there is _no need _to

apply

the

division-by-2-algorithm

3.4 to

_compute

a set

_SN

of

2 N+ ’-torsion

forms. In the

_imaginary

case D

_0,

this is clear since we can take

_So

to be a basis

and find

_{SN - 0.}

In the real case D &#x3E;

_0,

we have to work with

an extra

_generator

in

_So.

At the final

_stage

_N,

we

_compute

from a

set

_AN

that

_completes

our basis B and a

single

form sD E 2C to which

we can

apply

3.4 to find the

_single

element of

_sN.

As

_[SDI

is divisible

_by

2 in a _{group of}

_exponent

2~,

we have o. We _can, at the cost

of a little extra

_{administration,}

carry not

_only

the set

_Si

_along

at

_stage

_i,

but also for each s

E Si

the

_{representation}

of

_2’[s]

in terms of our

_original

2-torsion

_generators

in

_So.

This is

_simply

done

_by

_keeping

track of how the forms in

_Si+l

are constructed at

_{stage i}

from the

_previous

set If we do

so, the relation 0 for D &#x3E; 0

_provides

us with the

dependency

between the

_ambiguous

forms in

_{So .}

_If,

for some _reason, we would have even more

_generators

in

_Sa,

we could in the same _way find a

_complete

set

of relations between them.

Given an element c E

_C,

the

_explicit

_knowledge

of the character

_pairing

with

_respect

to the basis B for C enables us to write c on the basis B. From

the

_pairing,

one

_computes

a sum

bo E

C of elements in B C C that has the

same

quadratic

character values as c = _Co. This

yields

Co =

bo

+

2ci

for some class _cl E C that can be found

by

3.4. One

inductively

_computes

sums

bi EC

of elements in B such that ci for I =

_{0,1, ... ,}

N - 1.

The desired

_{representation}

for c is then c =

The number k of divisions

_by

2

_performed

_by

the

_algorithm

to

_compute

C

can

_easily

be derived from the group structure of C: for any factor

(Z/2-~Z)

in the

_{representation}

of lemma 3.5 one has to

_{perform j -}

1 divisions

by

2.

However,

since for D &#x3E; 0 there is at any

stage

in the

_algorithm

one more

generator

than the rank of the group

necessitates,

the number of divisions

Writing h

=

#C

for the 2-class number of D and _{r E}

{u -

_{2, u -}

1, u}

for

the 2-rank of

_C,

we find

This

_explains

the observation in the introduction that our

_algorithm

usually

needs more time for real class _groups than for

comparable

_imaginary

class

groups.

4. A worked

_example.

In order to illustrate the abstract

_description

in the

_{previous section,}

we

compute

by

way of

example

the real

quadratic

2-class group C of

discrimi-nant

which has 7 distinct

_prime

factors. We use the notation from the

_previous

section.

In our

_example,

the group of field characters

_3Cd

corresponding

to D has order

23

and is

_{generated by}

the

_quadratic

characters _{X13, X9[, X137} and

The

_product

of these four characters

_corresponds

to the field

and vanishes on

_C,

so we can form an

F2-basis

of

3id

by dropping

_X149 from our set of

_generators.

_By

_(3.1),

we can

complete

this to a basis X for the

group of genus characters

~D

on C

by

adding

the characters _{X-4, X7} and

Our initial set

_So

of

_ambiguous

forms consists of a form

_Qp

for each

odd

_prime

divisor of D and the form

_Q2

=

(4, 0, -D/16)

at 2.

We initialize our

algorithm

by

taking

Bo

=

Xo = 0

and

_compute

the

character matrix

_Mo

=

_using

(3.3).

This

yields

The _space V

_spanned

_by

the columns of

Mo

is

_{3-dimensional,}

and the 3 x 3-submatrix

corresponding

to the forms

_{Q2, Q7}

and

_Q13

and the set

lower-triangular

matrix,

we choose the 3 basis elements in

A,

as the classes

of the forms

These elements span the

image

C2

of

C[2]

in

C/2C.

We obtain

BI

=

Al

_U

Bo

=

Al

and

Xi

=

Xo

_U

Yo

=

Yo.

The 4

_remaining

forms

_{Q4i, Q97, Q137}

and

_Q149

from

So

are now

com-posed

with forms from

_Al

to make all characters vanish on

_them,

and we use our

division-by-2-algorithm

to

_compute

the forms _slj E

Si

from the

_duplication

_equations

The matrix

_M1

of character values in the next iteration

_step

is

_readily

evaluated as

Only

the column of S14 lies outside the space

spanned by

the columns of the forms in Thus

A2

contains a

single element,

for which we take

As _{x41 is} the

_only

character that does not vanish on _aI2, we take

Yl -

and obtain a set

_{X2 = Yo}

U

Y1

of

_cardinality

4. The three

_remaining

forms in

_Sl

are now

composed

with forms in

B2

=

Al n A2

_to make them divisible

The next matrix of character values

M2

becomes

All 3 columns of the forms

_S2

lie in the space

spanned by

the columns of the forms in

_B2

=

A,

U A2.

This

immediately yields

Y2 = 0

=

A3,

_{so we}

have

_{X3 - X2}

and

_{B3 - B2, and 83}

contains 3 forms that are

computed

from the

_equations

The character matrix

_M3

becomes

which has maximal rank 6. This means that we have found the structure of our _group to be

_C23

x

C4

x

Cr6.

In order to obtain a lower

triangular

character

_matrix,

we take our final two

_generators

of order 16 as

and add

Y3

=

IX137, X971

in the

suggested

order to _our character basis.

and our

_algorithm

terminates. The elements _aij listed in the

_top

row form an ordered basis of

C,

_i.e.,

the sets

_{Ai =}

_satisfy

the

_hypotheses

of lemma 3.5 for G = C.

In the final

_stage

of the

_algorithm,

it turns out that the character column

of the form S32 E

_S3

lies in _{the space}

_{generated by}

the

_previous

_columns,

so we have to

_compute

_S33 before we find that the character matrix has

maximal rank. In the cases where we are

lucky enough

to obtain

_already

a

character matrix of full rank before the final column has been

_computed,

our

algorithm

_suppresses the

_computation

of the form

corresponding

to this

final column. This saves an

application

of the

division-by-2-algorithm.

For

large

positive

discriminants,

the

_resulting

_gain

can be considerable.

As observed in the

_{previous section,}

the

_{’superfluous generator’}

₃₃₂ in the final

_stage

of our

algorithm

is not

_entirely

useless: it carries information

on the _{relation between the}

_ambiguous

forms in the initial set

So .

More

explicitly,

the character values of S32 tell us that the element

is in 2C. As C is of

_exponent

_16,

this

_implies

that SD is annihilated

by

8.

Using

the definition of _Sij and the order relations

_{2iaij =}

_0,

the

_resulting

relation

8S32

+

8a4l

= 0 is

easily

traced back to

yield

This is the

_unique

non-trivial relation between the initial

_generators

_Qp.

We noted

_already

that such relations can in

_principle

be found from the

fundamental unit In this

_fairly

small

_example

it is still

_possible

to

compute

~D

_explicitly.

It has norm

_1,

and we have

where each

_{of t, u, v}

is an

_integer

of

approximately

230 decimal

_digits.

We

find that

_(eD

+

_{1 ) /t}

is an element of norm 13 - 97 -

412 ,

from which we can

read off the relation indicated above.

5.

_{Ternary quadratic}

forms.

This section describes the reduction

_theory

of

_ternary

_quadratic

forms

that is the basis of the

_{division-by-2-algorithm}

in section 6.

Let n &#x3E; 1 be an

_integer,

and L = Zn _an n-dimensional lattice with

End(L)

=

M.(Z),

we have an associated

quadratic

form F =

FA

_on L

defined

_by

_{F(X) _}

_{(AX, X). Writing}

A as a matrix with

_respect

to the standard basis of

_L,

we have

For n = 2 and n =

3,

we use

variables x,

y and z. If A ranges over the

integral

symmetric

~n

x

_n)-matrices,

then

_FA

_ranges over the

quadratic

forms F = for which the ’mixed coefficients’ Cij with

i 54 j

are even.

We define the determinant

_det(F)

of a form F

_{corresponding}

to a

sym-metric matrix A

_by

_det(F)

=

det~A).

In

particular,

the determinant of a

quadratic form Q

=

ax2

₊

2bxy

₊

Cy2

is for us

equal

to

There is a natural

right

action of

_GLn(Z)

on the set of

_quadratic

forms in n variables

by

’coordinate transformations’. If a form F

corresponds

to a

_symmetric

matrix A and S E

_{GLn (Z)}

is a coordinate

_change,

then

Fs

=

(ASX, SX) =

(ST AsX,

X) clearly

corresponds

to the matrix

ST AS.

Here

S~’

denotes the

_transpose

of S.

Two

_quadratic

forms F and G are said to be

_equivalent

if there exists

a unimodular transformation S E

SLn(Z)

such that

Fs

= G. Note that

-idL

acts

_trivially

and has determinant

_(20131)~?

so the

GLn(Z)-orbits

and

the

_{SLn (Z)-orbits}

of forms coincide in odd dimension. The

_adjoint

A* of a matrix A = is the matrix

where the

_{(i, j )-minor}

_mij of A is the determinant of the matrix that is

obtained from A

_by

_deleting

the i-th row and the

j-th

column. If A is

invertible,

one has

This

_{immediately yields}

the

_general

identities det A* = and A*B* _

_(AB)*,

and an _easy check

yields

the useful

identity

For a

quadratic

form F

corresponding

to a

_symmetric

_{matrix A,}

the

_adjoint

form F* of F is the form

_{corresponding}

to A* .

_Passing

to the

_adjoint

is

compatible

with the action of

_SLz(Z)

in the sense that we have

(FS)* =

For n =

2,

_we have Gauss’s

binary

quadratic

forms

_(a,

_2b,

_c)

=

ax2

₊

2bxy+Cy2

with even middle coefficient

corresponding

to

_symmetric

matrices

Identity

(2.1)

tells us that _every form of determinant A is

_equivalent

to a form with first coefficient

lal

Moreover,

a unimodular

transformation that

_yields

such an

_equivalent

form can be

_efficiently

com-puted

E8] .

For n = 3 _we obtain

ternary

forms,

and for forms of non-zero determinant the reduction

_{theory proceeds}

_by

a combination of

binary

reduction of both

the form itself and its

_adjoint.

_Suppose

the

_ternary

form F of determinant

0

_corresponds

to a

_symmetric

matrix A = with

adjoint

A*

_{= (Ai j )i~~-1.}

Then we can use suitable unimodular transformations of

the form

/ - B.

as if we were to reduce the

_quadratic

form

_F(x,

_y,

₀₎

=

a, lX2

₊

_2al2XY

₊

a22y2

of determinant alla2z -

ai2 =

A33,

and

produce

a

_ternary

form

F with

_unchanged

_adjoint

coefficient

A33

but with all

satisfying

lalli [

0.

Similarly, by

applying

the unimodular matrix

to F we leave _all invariant and

_change

F*

_by

an

_application

of

Choosing

the coefficients of

Sl

as if

reducing

the

_quadratic

form F*

_(0,

_y,

_{x) =}

A3gx2 - 2A23XY

+

A 22 y2,

which has determinant

f3gf22 -

f23 -

AFall

by

(5.1),

we can

satisfy

the

inequality

IA331 [

Alternating

these two

_{transformations,}

we

_get

smaller values of

lalll

and

~A33I

until

both

_inequalities

_{laill :5}

_4A33/3

and

_A33I

_V41allAF113

hold at the

A semi-reduced form remains semi-reduced under unimodular

transforma-tions of the form

and we can use these to

_produce

a reduced

_ternary

form. There are two

possibilities,

depending

on whether the coefficient all of our semi-reduced

form is zero or not.

In case _all = 0 _we also have

A33

= _al2 =

0,

and therefore

AF

= -aI3a22.

Looking

at the effect of

_S2

on

F,

we see that an

_appropriate

choice of

S2

yields

a form with

A semi-reduced form with alI = 0

satisfying

(5.3)

is said to be reduced. For

_given

_OF,

there are

only

_finitely

_many

possible

values of _al3 and _a22, so the number of reduced forms of

_given

determinant with _all = 0 is finite. For a semi-reduced form with

_{all =1=}

_0,

we

_apply

_S2

with suitable _{312 to}

obtain

As

_A33

does not

_vanish,

a

simple

_inspection

of the action of

on F* shows that we can further achieve

A semi-reduced form with

_{all =1=}

0

_satisfying

_(5.4)

and

_(5.5)

is called

re-duced. It is

_again

true that there are

only finitely

_{many reduced forms of}

given

determinant with 0.

Indeed,

we have

bounded

_the coefficients

al2 and

A13 ~ A23,

a A33

in terms of

AF,

and the

following

elementary

completion

lemma shows that in our

situation,

these coefficients and

AF

5.6. LEMMA.

_Suppose

we are

_given

rational numbers

~,

all, aI2,

A13,

A23

and

A33

satisfying ðalIA33 =1=

0. Then there exists a

_unique

rational

symmetric

(3

x

3)-matrix

A = with determinant A and

adjoint

A* =

(Aij )3

i. e.,

there is a

_unique

_way to

_define

the starred entries in

such that A is rational and

_symmetric

with determinant A and

_adjoint

A* .

Proof.

As al l is non-zero, we can define _a22

_by

the relation

We now use

_{A33 #}

0 to define

_{An, A12, A22}

as the

_unique

solutions to the

equations

and form the rational

_symmetric

matrix B = It is clear that if

matrices A and A* of the

_required

sort

_exist,

then the relations

_(5.7)

hold

by

(5.1)

and A is

_uniquely

determined

_by

the

_equality

A* = B. Let us

therefore,

in accordance with

_(5.7),

define the rational

_symmetric

matrix A =

by

the

identity

~A = B* .

_Passing

_to the

adjoint

yields

6,2 A*

=

det(B) -

B,

so we see from

(*)

that we have

d2

=

det(B)

and

A* = B. Thus A has the _correct

adjoint,

and from AA = B* = A** _{we see}

that its determinant

_equals

A. C7

As _every

_ternary

form is

_equivalent

to a reduced

_form,

we see that the

number of

_equivalence

classes of

ternary

forms of determinant A is finite for every A. As an

example

that we will need in the next

_section,

let us

take A = -1 and determine the

equivalence

classes. The entries of the

symmetric

matrices

_{corresponding}

to the

_ternary

form F and its

_adjoint

will

_again

be denoted

_by

_{aij and}

_Aij,

_{respectively.}

By

(5.2),

a semi-reduced

_ternary

form F of determinant A = -1 has

either an =

A33 =

_{0 or}

)all) = IA331

‘

= 1. In the

case _{al l} =

A33 =

0