Using the Charlap-Coley-Robbins polynomials for computing isogenies

TL;DR

This paper explores the use of Charlap-Coley-Robbins polynomials for computing elliptic curve isogenies, providing properties, formulas, and addressing issues with derivatives in modular polynomial methods.

Contribution

It introduces properties and formulas for Charlap-Coley-Robbins polynomials to improve isogeny computations, and investigates alternative modular polynomial approaches.

Findings

Properties of Charlap-Coley-Robbins polynomials established

Formulas for computing isogenous curves derived

Analysis of alternative modular polynomial methods conducted

Abstract

The SEA algorithm for computing the cardinality of elliptic curves over finite fields in many characteristic uses modular polynomials. These polynomials come into different flavors, and methods to compute them flourished. Once equipped with some modular polynomials for prime $\ell$, algebraic formulas are used to compute a curve $\mathcal{E}^*/\mathbb{F}_q$ that is $\ell$-isogenous to the curve of interest $\mathcal{E}$. These formulas involve derivatives of the modular polynomial that may sometime vanish. One way to overcome this problem is to use alternative trivariate polynomials $U_\ell$, $V_\ell$, and $W_\ell$ introduced by Charlap, Coley and Robbins to overcome some difficulties in the first versions of Elkies's approach. We give properties of these polynomials, as well as formulas to compute the isogenous curve that were sketched by Atkin. Also we investigate another suggestion of Atkin using modular polynomials associated to a power product of Dedekind's $\eta$ function.

Equations

$$[n](X,Y)=\left(\frac{{\varphi }_n(X,Y)}{{\psi }_n(X,Y{)}^2},\frac{{\omega }_n(X,Y)}{{\psi }_n(X,Y{)}^3}\right)$$

$${\varphi }_n=X{\psi }_n^2-{\psi }_{n+1}{\psi }_{n-1},4Y{\omega }_n={\psi }_{n+2}{\psi }_{n-1}^2-{\psi }_{n-2}{\psi }_{n+1}^2$$

$$f_{n}(X)=\left\{\begin{array}[]{ll}\psi_{n}(X,Y)&\mathrm{for}\;n\;\mathrm{odd}\\ \psi_{n}(X,Y)/(2Y)&\mathrm{for}\;n\;\mathrm{even}\end{array}\right.$$

$$f_{-1}=-1,f_0=0,f_1=1,f_2=1,$$

$$f_3(X,Y)=3X^4+6A{X}^2+12BX-A^2$$

$$f_4(X,Y)=X^6+5A{X}^4+20B{X}^3-5A^2{X}^2-4ABX-8B^2-A^3.$$

$$E_2(q)=1-24\sum _{n=1}^{\infty }{\delta }_1(n)q^n,$$

$$E_4(q)=1+240\sum _{n=1}^{\infty }{\delta }_3(n)q^n,$$

$$E_6(q)=1-504\sum _{n=1}^{\infty }{\delta }_5(n)q^n,$$

$$F^{\prime }(q)=\frac{1}{2i\pi }\frac{dF}{d\tau }=q\frac{dF}{dq}=\sum _{n\ge n_0}n{a}_n{q}^n.$$

$$\Delta =\frac{E_4^3-E_6^2}{1728},j=\frac{E_4^3}{\Delta },j-1728=\frac{E_6^2}{\Delta },$$

$$\frac{j^{\prime }}{j}=-\frac{E_6}{E_4},\frac{j^{\prime }}{j-1728}=-\frac{E_4^2}{E_6},j^{\prime }=-\frac{E_4^2{E}_6}{\Delta },\frac{{\Delta }^{\prime }}{\Delta }=E_2,$$

$$3{E_4}^{\prime }=E_4{E}_2-E_6,2{E_6}^{\prime }=E_6{E}_2-E_4^2,12{E_2}^{\prime }=E_2^2-E_4.$$

$$A=-3E_4(q),B=-2E_6(q).$$

$$A^{\ast }=-3{\ell }^4{E}_4(q^{\ell }),B^{\ast }=-2{\ell }^6{E}_6(q^{\ell }).$$

$${\sigma }_1=\frac{\ell }{2}(\ell E_2(q^{\ell })-E_2(q))=-\frac{\ell }{2}{\mathcal{F}}_{\ell }(q).$$

$$A-A^{\ast }=5(6{\sigma }_2+2A{\sigma }_0),$$

$$B-B^{\ast }=7(10{\sigma }_3+6A{\sigma }_1+4B{\sigma }_0),$$

$${\partial }_{\sigma }=\frac{\partial U}{\partial \sigma },{\partial }_4=\frac{\partial U}{\partial E_4},{\partial }_6=\frac{\partial U}{\partial E_6}.$$

$$(\ell +1)U=\sigma {\partial }_{\sigma }+2E_4{\partial }_4+3E_6{\partial }_6.$$

$$\ell {\partial }_{\sigma }$$

$$(\ell -1){\partial }_4$$

$$(\ell -2){\partial }_6$$

$$-\frac{4\ell (3E_4^2{\partial }_6+2E_6{\partial }_4)-{\partial }_{\sigma }({\ell }^2{E}_4+4{\sigma }^2)}{{\ell }^4{\partial }_{\sigma }}.$$

$${\sigma }^{\prime }{\partial }_{\sigma }+E_4^{\prime }{\partial }_4+E_6^{\prime }{\partial }_6=0.$$

$${\sigma }^{\prime }=\frac{\ell }{2}({\ell }^2{\tilde{E}}_2^{\prime }-E_2^{\prime })=\frac{\ell }{24}({\ell }^2({\tilde{E}}_2^2-{\tilde{E}}_4)-(E_2^2-E_4)).$$

$${\sigma }^{\prime }=\frac{\ell }{24}\left(\frac{4{\sigma }^2}{{\ell }^2}+\frac{4\sigma }{\ell }{E}_2-({\ell }^2{\tilde{E}}_4-E_4)\right),$$

$$\sigma {\partial }_{\sigma }+2E_4{\partial }_4+3E_6{\partial }_6,$$

$$(\ell +1)U{E}_2+\frac{\ell {\partial }_{\sigma }}{4}\left(\frac{4{\sigma }^2}{{\ell }^2}-({\ell }^2{\tilde{E}}_4-E_4)\right)-2E_6{\partial }_4-3E_4^2{\partial }_6=0$$

$${\tilde{E}}_6=-\frac{N}{{\ell }^6{\partial }_{\sigma }^3}$$

$${\sigma }^{\prime \prime }{\partial }_{\sigma }+{\sigma }^{\prime }({\sigma }^{\prime }{\partial }_{\sigma \sigma }+E_4^{\prime }{\partial }_{\sigma 4}+E_6^{\prime }{\partial }_{\sigma 6})$$

Full text

The author is on leave from Délégation Générale pour l’Armement.

1. Introduction

Computing isogenies is the central ingredient of the Schoof-Elkies-Atkin (SEA) algorithm that computes the cardinality of elliptic curves over finite fields of large characteristic [20, 2, 10] and also [4]. More recently, it is used in post-quantum cryptography [8, 13, 6, 12] among others, as well as the cryptosystems [9, 19, 11].

Given a curve $\mathcal{E}/\mathbb{F}_{q}$, we need to compute $\ell$-isogenous curves for (small) prime $\ell$’s, starting from a root of some degree $\ell+1$ modular polynomial $\Psi_{\ell}(X,Y)$ in $X=j(\mathcal{E})$. The coefficients of the isogenous curve $\mathcal{E}^{*}/\mathbb{F}_{q}$ together with the kernel polynomial of the isogeny are computed from partial derivatives of $\Psi_{\ell}(X,Y)$. This method works except in cases where one of the derivatives is zero. This is a theoretical as well as practical problem. An alternative to this is to use the original approach of Elkies [10], namely using algebraic relations for $A^{*}$ and $B^{*}$. Another choice is to use the CCR polynomials $(U_{\ell},V_{\ell},W_{\ell})$ introduced in [7], for the price of finding the roots of three degree $\ell+1$ polynomials instead of $1$. Several methods for computing these polynomials, as well as rational representations of $A^{*}$ and $B^{*}$ are given in [15] (as well as the cited references in this article).

The aim of our work (which is closely related to  [15]) is to give formulas to compute the necessary parameters for Elkies’s algorithms, using partial derivatives of $U_{\ell}$, in the spirit of Atkin and following the suggestion in [2]. The same work is done for the alternate polynomial $U^{a}$ suggested by Atkin when $\ell\equiv 11\bmod 12$.

The content is as follows. We review the SEA algorithm in Section 2, including formulas for Eisenstein series and introduce the CCR polynomials in Section 3. Section 4 is the central part of the article, working out the formulas giving the coefficients of the isogenous curve.

2. Schoof/Elkies/Atkin

2.1. Prerequisites

2.1.1. Division polynomials

For $\mathcal{E}:y^{2}=x^{3}+Ax+B$, multiplication of a point $(X,Y)$ by positive $n$ on $\mathcal{E}$ is given by

[TABLE]

where the polynomials satisfy

[TABLE]

and $\phi_{n},\psi_{2n+1},\psi_{2n}/(2Y),\omega_{2n+1}/Y,\omega_{2n}$ belong to $\mathbb{Z}[A,B,X]$. It is customary to simplify this using

[TABLE]

with first values

[TABLE]

[TABLE]

[TABLE]

The degree of $f_{n}$ is $(n^{2}-1)/2$ for odd $n$ and $(n^{2}-4)/2$ for even $n$. If $X$ has weight $1$, $A$ weight 2 and $B$ weight 3, all monomials in $f_{n}$ have the same weighted degree equal to the degree of $f_{n}$.

2.1.2. Modular functions and such

Letting $q=\exp(2i\pi\tau)$, one defines

[TABLE]

[TABLE]

[TABLE]

where $\delta_{r}(n)$ denotes the sum of the $r$-th powers of the divisors of $n$. The series $E_{4}$ and $E_{6}$ are modular forms of weight $4$ and $6$ respectively. The function $E_{2}$ is not a modular form, but note that $\mathcal{F}_{n}(\tau)=E_{2}(\tau)-nE_{2}(n\tau)$ is a modular form of weight 2 for $\Gamma_{0}(n)$ and trivial multiplier (see [18] and [3]).

When $F(q)=\sum_{n\geq n_{0}}a_{n}q^{n}$, we introduce the operator

[TABLE]

Several identities are classical:

[TABLE]

[TABLE]

to which we add the Ramanujan differential system:

[TABLE]

2.2. Schoof’s approach

Let $\mathcal{E}/\mathbb{F}_{q}$ be an elliptic curve of cardinality $m=p+1-t$ with $|t|\leq 2\sqrt{q}$ by Hasse’s theorem. Schoof gave the first deterministic polynomial time algorithm to compute $m$. The idea is to use the action of the Frobenius of $\mathcal{E}$ on $\ell$-division points to find $t$ via the characteristic equation $\phi^{2}-[t]\phi+[q]=0$ modulo $(f_{\ell},\ell)$.

2.3. Using isogenies

Elkies and Atkin gave subsequent improvements to make Schoof’s algorithm efficient (and probabilistic) and usable in practice. Elkies described how to use isogenies to find factors of small degree of $f_{\ell}(X)$ over a finite field, provided the Frobenius equation splits modulo $\ell$. Using modular polynomials, Elkies worked out a procedure to compute all the parameters needed to build a degree $\ell$ isogeny from $\mathcal{E}:Y^{2}=X^{3}+AX+B$ to some curve $\mathcal{E}^{*}:Y^{2}=X^{3}+A^{*}X+B^{*}$ and the kernel polynomial of the isogeny, thereby giving the factor we need. Atkin designed his own route towards the same goal, putting the emphasis on the use of more modular equations for $X_{0}(\ell)$ and its quotients.

One has (after renormalization):

[TABLE]

With a compatible scaling, we get

[TABLE]

More importantly, writing $\sigma_{r}$ for the power sums of the roots of $U_{\ell}$, we have

[TABLE]

Beyond this, Elkies proved that

[TABLE]

[TABLE]

together with an induction relation satisfied by other $\sigma_{k}$ for $k>3$. As a consequence $A^{*}$ and $B^{*}$ belong to $\mathbb{Q}[\sigma_{1},A,B]$ since $\sigma_{2}$ and $\sigma_{3}$ do.

Given these quantities, there are several algorithms to get the isogeny. We refer to [5] for this.

3. The polynomials of Charlap-Coley-Robbins

3.1. Theory

We start from an elliptic curve $\mathcal{E}:Y^{2}=X^{3}+AX+B$ and we fix some odd prime $\ell$, putting $d=(\ell-1)/2$. Our aim is to find the equation of an $\ell$-isogenous curve $\mathcal{E}^{*}:Y^{2}=X^{3}+A^{*}X+B^{*}$.

Theorem 3.1**.**

There exist three polynomials $U_{\ell}$, $V_{\ell}$, $W_{\ell}$ in $\mathbb{Z}[X,Y,Z,1/\ell]$ of degree $\ell+1$ in $X$ such that $U_{\ell}(\sigma_{1},A,B)=0$, respectively $V_{\ell}(A^{*},A,B)=0$, $W_{\ell}(B^{*},A,B)=0$.

Let us turn our attention to the properties of these polynomials.

Theorem 3.2**.**

When $\ell>3$, the polynomials $U_{\ell}$, $V_{\ell}$, $W_{\ell}$ live in $\mathbb{Z}[X,Y,Z]$.

Proposition 3.3**.**

Assigning respective weights 1, 2, 3 to $X$, $Y$, $Z$, the monomials in $U_{\ell}$, $V_{\ell}$ and $W_{\ell}$ have generalized degree $\ell+1$.

3.2. Computing isogenous curves over finite fields

When using $U_{\ell}$, $V_{\ell}$, $W_{\ell}$, we need to find the roots of three polynomials of degree $\ell+1$ instead of $1$. In general, if $U_{\ell}$ has rational roots (it should be 1, $2$ or $\ell+1$), then this is the case for each of $V_{\ell}$, $W_{\ell}$. For each triplet of solutions $(\sigma_{1},z_{1},z_{2})$ we need to test whether this leads to an isogeny or not. To speed up things, we may compute rational fractions for $A^{*}$ and $B^{*}$ as explained in [16] (see also [17, §7]). Another path was sketched by Atkin in [2], and this is what we describe next.

4. Revisiting CCR à la Atkin

The idea is to generalize the approach in [1, 2, 14], that is exploit $q$-series identities to get the parameters $(\sigma,A^{*},B^{*})$, where we write $\sigma$ for $\sigma_{1}$ from now on.

4.1. Properties of $U_{\ell}$

We write for readability $U=U_{\ell}$ and

[TABLE]

and propagate the notation to double derivatives.

The polynomial $U$ is homogeneous with weights, so that

[TABLE]

Note that partial derivatives of $U$ are also homogeneous polynomials and we find

[TABLE]

4.2. Getting the isogenous curve from CCR polynomials

4.2.1. Finding $\tilde{E}_{4}$

Proposition 4.1**.**

The value of $\tilde{E}_{4}$ is given by

[TABLE]

Proof: We differentiate (using (1)) $U(\sigma,E_{4},E_{6})=0$ to get

[TABLE]

We differentiate $\sigma=\ell/2(\ell\tilde{E}_{2}-E_{2})$ leading to

[TABLE]

Replace $\ell\tilde{E}_{2}$ by $2\sigma/\ell+E_{2}$ to get

[TABLE]

that we plug in (9) together with the expressions for ${E_{4}}^{\prime}$ and ${E_{6}}^{\prime}$ from equation (4) to get a polynomial of degree 1 in $E_{2}$ whose coefficient of $E_{2}$ is

[TABLE]

which we recognize in (5). Therefore, we get

[TABLE]

from which we deduce $\tilde{E}_{4}$ since $U(\sigma,E_{4},E_{6})=0$. $\Box$

4.2.2. Finding $\tilde{E}_{6}$

Proposition 4.2**.**

The value of $\tilde{E}_{6}$ may be written

[TABLE]

where $N$ is some polynomial of degree 3 in $\ell$ and given at the end of the proof.

Proof: We differentiate (9).

[TABLE]

We compute in sequence

[TABLE]

[TABLE]

which give us the value

[TABLE]

to be used in (11). Differentiating relations of (4), we get

[TABLE]

to be used in lines (12) and (13) respectively. We replace $\tilde{E}_{4}$ by its value from (10), and $\tilde{E}_{2}$ using $\sigma=(\ell/2)(\ell\tilde{E}_{2}-E_{2})$. This finally yields an expression as polynomial in $E_{2}$:

[TABLE]

The unknown $\tilde{E}_{6}$ is to be found in $C_{0}$ only.

By luck(?)

Proposition 4.3**.**

The coefficients $C_{1}$ and $C_{2}$ vanish for a triplet such that $U_{\ell}(\sigma,E_{4},E_{6})=0$.

Sketch of the proof: The strategy to prove this is the same in both cases. Replace $\partial_{\sigma\sigma}$, $\partial_{44}$ and $\partial_{66}$ by their values from (6). Factoring the resulting expressions yields the same factor $\sigma\partial_{\sigma}+2E_{4}\partial_{4}+3E_{6}\partial_{6}$, which cancels $C_{1}$ and $C_{2}$. We add a SageMath script for the convenience of the reader as an appendix to this work. $\Box$

We are left with

[TABLE]

where $N$ is a polynomial in degree 3 in $\ell$

[TABLE]

The coefficient $c_{2}$ is heavy looking and we give slightly factored as a polynomial in $E_{4}$:

[TABLE]

4.2.3. Numerical example

Consider $E:Y^{2}=X^{3}+X+3$ over $\mathbb{F}_{1009}$ and $\ell=5$. Using

[TABLE]

we select $\sigma=584$ and compute

[TABLE]

from which $\tilde{E}_{4}=497$, $A^{*}=441$. After tedious computations, we find $B^{*}=997$.

4.3. The case $\ell\equiv 11\bmod 12$

In this case, Atkin suggests to replace $\sigma$ with $f(q)=(\eta(q)\eta(q^{\ell}))^{2}$, where $\eta$ is Dedekind’s function. The corresponding modular polynomial $U_{\ell}^{a}$ can be computed using the techniques described in [15]. For instance (using the basis with $E_{4}$, $E_{6}$ and $\Delta$):

[TABLE]

[TABLE]

which is sparser than $U_{11}(X)$.

4.3.1. Some properties of $U_{\ell}^{a}$

Let $v_{2}$ (resp. $v_{3}$) be the maximal power of $1/2$ (resp. $1/3$) of the coefficients of $U_{\ell}^{a}(X)$ that we found experimentally

[TABLE]

It seems that $f/12$ should be a more sensible choice, leading to $12^{\ell+1}U_{\ell}^{a}(X/12)$ having integer coefficients.

We have formulas analogous to (6), due the corresponding homogeneous property

[TABLE]

4.3.2. Computing $\sigma$, $\tilde{E}_{4}$ and $\tilde{E}_{6}$

Proposition 4.4**.**

The value of $\sigma$ is

[TABLE]

Proof: Remark that $f^{12}=\Delta(z)\Delta(\ell z)$ and therefore we deduce the discriminant $\tilde{\Delta}=f^{12}/\Delta$ of the isogenous curve. We have also (using (3)):

[TABLE]

from which we deduce $f^{\prime}$. Again, $U_{\ell}^{a}$ is homogeneous with weight $\ell+1$, so that we have identities similar to those for $\sigma$. In particular

[TABLE]

Starting from $f^{\prime}\partial_{f}+E_{4}^{\prime}\partial_{4}+E_{6}^{\prime}\partial_{6}=0$, and replacing by the known values, we find

[TABLE]

which is

[TABLE]

and this gives us the result. $\Box$

Proposition 4.5**.**

The value of $\tilde{E}_{4}$ is given by

[TABLE]

where $M$ is a polynomial given at the end of the proof.

Proof: We differentiate $f^{\prime}$ to obtain:

[TABLE]

We inject this together and the diagonal derivatives of (14) and $\tilde{E}_{2}=(E_{2}+2\sigma/\ell)/\ell$ into

[TABLE]

to get a polynomial of degree 2 in $E_{2}$ whose coefficients of degree 2 and 1 turn out to vanish. We are left with

[TABLE]

where

[TABLE]

Finally, we remark that $B^{*}$ satisfies

[TABLE]

the latter relation coming from applying the Atkin-Lehner involution to the modular form for $\sigma_{1}$. The gcd of these two polynomials should reveal $B^{*}$. In the rare case where this gcd has degree 2 (which would imply two elliptic curves being isogenous to $E$), we would be forced to use higher differentials, which would look like a formidable task.

4.3.3. Numerical example

Consider $E:Y^{2}=X^{3}+X+3$ over $\mathbb{F}_{1009}$. The polynomial $U_{11}^{a}$ has two roots: $65$ and $333$. We take $f=65$. We first compute $\sigma=75$. Then $\tilde{E}_{4}=532$. The gcd of the two polynomials in (21) has degree 1 and root $B^{*}=460$.

5. Conclusions

We have completed the task suggested by Atkin for using the CCR polynomials in building isogenies. All these formulas require $O(\ell^{2})$ multiplications in the base field, due to the computation of partial derivatives of polynomials of degree $O(\ell)$. Note that this is the same cost as using the rational fractions giving $A^{*}$ and $B^{*}$, but less storage is needed.

As a consequence, we have several algorithms and formulas to be used, depending on the practical problem to be solved.

Appendix A A script to check the computations

This SageMath [21] script can also be downloaded from the author’s web page.

⬇

# This script is devoted to the computation and verification of several

# identities related to CCR polynomials using the notations of the preprint.

# one ring to rule them all

R.<ell,E2,E4,E6,sigma,E4t,E6t,d4,d6,s,ds,ds4,ds6,d46,f,df,df4,df6>

=PolynomialRing(Rationals(),18)

########## The CCR case

# returns ell^-4 * ds^-1 * (-12ellE4^2d6 + …)*

def check_E4t():

E4p=(E2*E4 - E6)/3

E6p=(E2*E6-E4^2)/2

E2p=(E2^2-E4)/12

E2t=(E2+2*sigma/ell)/ell

sigp=ell/24*(4*sigma^2/ell^2+4*sigma/ell*E2-(ell^2*E4t-E4))

tmp=sigp*ds+E4p*d4+E6p*d6

tmp=tmp.numerator()

**print**(”degree(tmp,␣E2)=”, tmp.degree(E2))

*# check that coeff of E2 is zero*

c1=tmp.coefficient({E2:1})

*# is a multiple of (2*E4*d4 + 3*E6*d6 + f*df), hence 0*

**print**(”c1=”, c1.factor())

*# find sigma as a root of constant coefficient*

e4t=tmp.coefficient({E2:0})

e4t=-e4t.coefficient({E4t:0})/e4t.coefficient({E4t:1})

*# sig contains the value of sigma*

**return** e4t.factor()

# returns

# ell^-6 * ds^-3 * sigma^-1 * E6^-1 * E4^-1 * (-18ell^3E4^5E6d6^2ds+…)*

def check_E6t():

e4t=check_E4t()

E4p=(E2*E4 - E6)/3

E6p=(E2*E6-E4^2)/2

E2p=(E2^2-E4)/12

E2t=(E2+2*sigma/ell)/ell

sigp=ell*(4*sigma^2/ell^2+4*sigma/ell*E2-(ell^2*e4t-E4))/24

*# more derivatives*

E4pp=1/3*(E2p*E4+E2*E4p-E6p)

E6pp=1/2*(E2p*E6+E2*E6p-2*E4*E4p)

*# crucial values*

E4tp=1/3*(E2t*e4t-E6t)

E2tp=(E2t^2-e4t)/12

E2pp=1/12*(2*E2*E2p-E4p)

E2tpp=1/12*(2*E2t*E2tp-E4tp)

sigpp=ell*(ell^3*E2tpp-E2pp)/2

*# inject diagonal derivatives*

dss = (ell*ds    -2*E4*ds4 -3*E6*ds6)/sigma

d44 = ((ell-1)*d4-sigma*ds4-3*E6*d46)/(2*E4)

d66 = ((ell-2)*d6-sigma*ds6-2*E4*d46)/(3*E6)

*# starting point*

tmp=      sigpp*ds+sigp*(sigp*dss+E4p*ds4+E6p*ds6)

tmp=tmp + E4pp*d4+E4p*(sigp*ds4+E4p*d44+E6p*d46)

tmp=tmp + E6pp*d6+E6p*(sigp*ds6+E4p*d46+E6p*d66)

tmp=tmp.numerator()

c2=tmp.coefficient({E2:2})

**print**(”E6t.c2=”, c2.factor())

c1=tmp.coefficient({E2:1})

**print**(”E6t.c1=”, c1)

c0=tmp.coefficient({E2:0})

e6t=-c0.coefficient({E6t:0})/c0.coefficient({E6t:1})

**return** e6t.factor()

########## The case of ell = 11 mod 12, Atkin’s variant

def check11_sigma():

# R.<ell,E2,E4,E6,sigma,d4,d6,f,df>=PolynomialRing(Rationals(),9)

tmp=2*E4*d4+3*E6*d6+f*df

E4p=(E2*E4 - E6)/3

E6p=(E2*E6-E4^2)/2

E2p=(E2^2-E4)/12

E2t=(E2+2*sigma/ell)/ell

fp=f/12*(ell*E2t+E2)

tmp=fp*df+E4p*d4+E6p*d6

tmp=tmp.numerator()

*# check that coeff of E2 is zero*

c1=tmp.coefficient({E2:1})

*# is a multiple of (2*E4*d4 + 3*E6*d6 + f*df), hence 0*

**print**(”c1=”, c1.factor())

*# find sigma as a root of constant coefficient*

sig=tmp.coefficient({E2:0})

sig=-sig.coefficient({sigma:0})/sig.coefficient({sigma:1})

*# sig contains the value of sigma*

**return** sig.factor()

# returns

# (-1) * df^-3 * f^-2 * ell^-2 * E6^-1 * E4^-1 * (-36ellE4^5E6d6^2df+…)*

def check11_E4t():

sig=check11_sigma()

E4p=(E2*E4 - E6)/3

E6p=(E2*E6-E4^2)/2

E2p=(E2^2-E4)/12

E2t=(E2+2*sig/ell)/ell

fp=f/12*(ell*E2t+E2)

fpp=f/12^2*((ell*E2t+E2)^2+ell^2*(E2t^2-E4t)+(E2^2-E4))

E4pp=1/3*(E2p*E4+E2*E4p-E6p)

E6pp=1/2*(E2p*E6+E2*E6p-2*E4*E4p)

*# inject diagonal derivatives*

dff = (    ell*df-2*E4*df4 -3*E6*df6)/f

d44 = ((ell-1)*d4-f*df4-3*E6*d46)/(2*E4)

d66 = ((ell-2)*d6-f*df6-2*E4*d46)/(3*E6)

tmp=       fpp*df+ fp*(fp*dff+E4p*df4+E6p*df6)

tmp=tmp + E4pp*d4+E4p*(fp*df4+E4p*d44+E6p*d46)

tmp=tmp + E6pp*d6+E6p*(fp*df6+E4p*d46+E6p*d66)

tmp=tmp.numerator()

**print**(”degree(tmp,␣E2)=”, tmp.degree(E2))

c2=tmp.coefficient({E2:2})

**print**(”E4t.c2=”, c2.factor())

c1=tmp.coefficient({E2:1})

**print**(”E4t.c1=”, c1)

c0=tmp.coefficient({E2:0})

e4t=-c0.coefficient({E4t:0})/c0.coefficient({E4t:1})

**return** e4t.factor()