Generalized class polynomials

The Hilbert class polynomial has as roots the j-invariants of elliptic curves whose endomorphism ring is a given imaginary quadratic order. It can be used to compute elliptic curves over finite fields with a prescribed number of points. Since its coefficients are typically rather large, there has been continued interest in finding alternative modular functions whose corresponding class polynomials are smaller. Best known are Weber’s functions, which reduce the size by a factor of 72 for a positive density subset of imaginary quadratic discriminants. On the other hand, Bröker and Stevenhagen showed that no modular function will ever do better than a factor of 100.83. We introduce a generalization of class polynomials, with reduction factors that are not limited by the Bröker–Stevenhagen bound. We provide examples matching Weber’s reduction factor. For an infinite family of discriminants, their reduction factors surpass those of all previously known modular functions by a factor at least 2.


Introduction
The Hilbert class polynomial H D [j] of the imaginary quadratic order O of discriminant D is the minimal polynomial of the j-invariant of an elliptic curve with endomorphism ring O.It is a defining polynomial of the ring class field of O and can be used for constructing elliptic curves over a finite field with a given number of points.Its coefficients are however rather large, which limits its practical usefulness.Already in 1908, Weber [37] therefore introduced alternative class invariants to be used instead of j, which resulted in class polynomials with coefficients that have roughly 1/72 of the digits of the coefficients of the Hilbert class polynomial for certain discriminants.
We introduce generalized (multivariate) class polynomials, define an appropriate notion of their reduction factor, and show that this notion indeed gives a measure of their "size" compared to the Hilbert class polynomial (Section 3).Contrary to classical class polynomials, the reduction factors of generalized class polynomials are not limited by the Bröker-Stevenhagen bound.
We give a family of generalized class polynomials for which we prove that the reduction factor matches Weber's 72 for a large range of values of D, including infinitely many values of D where no reduction of 36 or better was previously known (Section 4).We also give an example that possibly achieves the factor 120 (Remark 7.6).
Though the focus of this paper is on introducing the generalized class invariants and studying their height, we also give a preliminary analysis indicating that the height reduction leads to a speed-up in their computation (Section 6), and we show how to use them for constructing elliptic curves over finite fields (Section 5).
Acknowledgements.The authors would like to thank Karim Belabas, Peter Bruin, Andreas Enge, David Kohel, Filip Najman, and Andrew Sutherland for helpful discussions and Edgar Costa for helping us use the LMFDB.The authors would further like to thank the organisers Samuele Anni, Valentijn Karemaker, and Elisa Lorenzo García of AGC 2 T 2021 for the inspiring setting in which the first ideas for this project came to be.Finally, the authors would like to thank the anonymous referees for their many comments that led to improvements of the exposition.The first-listed author is supported by the Research Foundation -Flanders (FWO) under a PhD Fellowship Fundamental Research.

Generalized class polynomials
Definition 2.1.By a modular curve over Q we mean a smooth, projective, geometrically irreducible curve C over Q together with a map ψ : H → C(C) from the upper half space H ⊂ C with the following property.There exists a positive integer N such that for every function f ∈ Q(C), the function f • ψ is a modular function for Γ(N ) with all q-expansion coefficients in Q ab .
We identify f with f • ψ and we identify ψ with the induced morphism of curves X(N ) → C.
For an order O in an imaginary quadratic number field K, we denote by K O the associated ring class field.Let f be a modular function and τ ∈ H imaginary quadratic, say a root of aX 2 + bX + c for coprime integers a, b, c.The pair (f, τ ) is called a class invariant for the imaginary quadratic order O = Z[aτ ] if f (τ ) lies in the ring class field K O .The discriminant D of the class invariant is the discriminant of O.The Galois group G of K(f (τ ))/K is isomorphic via the Artin map to a quotient of the Picard group Cl(O).Associated to a class invariant is its minimal polynomial over K, also known as the class polynomial, Under additional restrictions, class polynomials can sometimes be shown to have coefficients in Q (cf.[9,Thm. 4.4], [13,Thm. 5.4]); in that case we call the class polynomials real.Oftentimes, a modular function admits class invariants for an infinite family of discriminants, determined by a certain congruence condition ( [31], [9,Thm. 4.3]).Sometimes the discriminant uniquely determines the class polynomial for a given modular function.
Example 2.2.The modular j-function admits a unique class polynomial for any discriminant D < 0, called the Hilbert class polynomial H D [j] := H τ [j].It can be seen as a function on P 1 whose zeros are the j-invariants of elliptic curves with CM by the imaginary quadratic order of discriminant D and whose poles are restricted to the point at infinity.
We propose a generalization of class polynomials, seen as functions on modular curves of higher genus, for which the classical class polynomials can be viewed as the genus zero case.We will mostly restrict ourselves to the case of genus one, as this will make notation considerably less complicated.We discuss the arbitrary genus case in Section 7. Let C be a modular curve over Q with a smooth Weierstrass model y 2 + a 1 xy + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 , and suppose that (x, τ ), (y, τ ) are class invariants for some imaginary quadratic τ ∈ H.
In fact, up to scaling by an element of K × , there exists a unique function Definition 2.5.We call F τ [C] as in (2.4) a generalized class function for τ .The associated generalized class polynomial is the unique We note that the polynomial H τ [C] depends on the choice of x and y, but we leave this out of the notation.In Section 7 (and in particular Definition 7. If the Heegner point P is the point at infinity, then a m = 0. Otherwise, the point −P is a zero of F .In particular, if P = −(0, 0), then a 0 = 0.
For N ∈ Z >0 , we denote by X 0 (N ) the smooth, projective, geometrically irreducible curve over Q with function field consisting of the modular functions for the modular group Γ 0 (N ) = { a b c d ∈ SL 2 (Z) | b ≡ 0 (mod N )} that have rational qexpansion.We denote by X 0 + (N ) the quotient of X 0 (N ) by the Fricke-Atkin-Lehner involution z → −N/z, and write η(z) for the Dedekind η-function Example 2.7.Consider the genus one modular curve C := X 0 + (119).Its conductor as an elliptic curve is 17 (Cremona label 17a4) 1 .A Weierstrass model for E is given 1 One way to deduce this is as follows.Using the command J0(119).decomposition() in SageMath [36] one finds that C has conductor 17.For each of the Weierstrass models of the now finitely many possible curves [23], there are finitely many options for the divisor of the function w 7,17 given by (2.9).The curve C has two rational CM points (both of discriminant −19), so given a possible Weierstrass model together with a possible divisor for w 7,17 , one can first determine w 7,17 as a function of the Weierstrass coordinates x, y by evaluating in one CM point, and then determine whether it has the expected value in the other CM point.This process excludes all but one of the options, and we at once in fact deduce both the Weierstrass model (2.8) and the relation between w 7,17 and x and y (2.10).by 2   (2.8) where x, y ∈ Q(C) have respective q-expansions x = q −2 + q −1 + 1 + q + 2q 2 + 2q 3 + 3q 4 + 3q 5 + 4q 6 + 5q 7 + . . ., y = q −3 + 1 + 2q + 2q 2 + 4q 3 + 4q 4 + 7q The curve X 0 + (119) has two cusps, and they are both rational.In the given Weierstrass model, these correspond to the point (0, 0) and the point at infinity.Numerical examples of generalized class polynomials specifically for X 0 + (119) are given in Section 4.5.We will treat this curve as our main test case in the rest of the paper.In the case C = P 1 , we denote this number also by r(ψ) and our notation and terminology coincide with that of [4].The number r(ψ) −1 is denoted by c(ψ) in [8] and by c(ψ) in [9].Bröker and Stevenhagen [4, Theorem 4.1] 3 show r(ψ) ≤ 32768/325 ≤ 100.83.Under Selberg's eigenvalue conjecture, one can even prove r(ψ) ≤ 96.The best known ψ achieves r(ψ) = 72.This result does not however apply directly to r(C).For example, we have

Estimates and reduction factors
Our main example C = X 0 + (119) therefore achieves r(C) = 1 2 (7 + 1)(17 + 1) = 72.For (hyper)elliptic modular curves C we get r(C) ≤ 201.65 (or r(C) ≤ 192 under Selberg's eigenvalue conjecture), by applying the bounds to the x-function.Surprisingly, all elliptic curve quotients of X 0 (N ) we found so far have r ≤ 72 (Section 4.7).In Section 7 we will discuss higher-genus curves, which allow for unbounded r(C). 2 We note that a slightly "simpler" Weierstrass model v 2 + uv + v = u 3 − u 2 − u exists by taking u = x and v = −y − 2x, but the given model (2.8) turns out to yield slightly better practical reduction factors (see Section 4.5). 3The arXiv version v1 of [4] has weaker bounds than the final publication and needs to be combined with [21,Appendix 2] to get the same result.
Remark 3.3.In the applications we have in mind, the reduction factor is the main source of improvement in computational efficiency.It is important to note, however, that this number r(C) does not tell the complete story, even in the "classical" setting (C ∼ = P 1 ), for example for the following reasons.
(1) There are many challenges when computing class polynomials, and even more with generalized class polynomials.See Section 6. (2) In the CM method (Section 5), we will want to find a j-invariant in F p from a point in C(F p ).This is done using the minimal polynomial of the jfunction over Q(C), known as the modular polynomial (Lemma 5.1).This works best if the degree of j over Q(C) is small.For example, this degree is 1 for C = X 0 (N ), is 2 for C = X 0 + (N ), and ranges from 1 to 20 in [9, Table 7.1], making X 0 + (119) a good choice in this respect.(3) If the (generalized) class polynomial is not real, then its coefficients lie in an imaginary quadratic extension of Q; roughly doubling its bit size.This issue can be avoided by imposing additional restrictions on C or τ , see Sections 4.2 and 4.3.
On the other hand, there are two important tricks that may be used in complementary directions, providing computational improvements beyond the reduction factor r(C): (1) Under some constraints, typically when all primes dividing the level of the modular curve ramify in the CM field, both the degree and height of the class polynomial are cut in half.This happens for example in the record-computation of [14] for the Atkin invariant A 71 when 71 divides the discriminant, leading to class polynomials that are 2 2 • 36 = 144 times smaller than the Hilbert class polynomial (note that the reduction factor r(A 71 ) is 36 in this case).The same trick also applies to generalized class polynomials, see Section 4.4, which in the case of X 0 + (119) leads to a factor 2 2 • 72 = 288 in size reduction.
(2) When the class number is composite, one can decompose the ring class field into a tower of fields whose defining polynomials have smaller degrees, also leading to a significant speed-up in the CM method [35].
These last two tricks only work when the class number is composite.We expect both of them to work well for generalized class polynomials, so will mainly restrict to the case of prime class number in our examples, as this more clearly illustrates the role of the parameter r(C).
The goal of the rest of this section is to show under some hypotheses that the reduction factor r(C) is indeed an asymptotic reduction factor of the size of the polynomials involved.For that, we will first introduce the appropriate notions of "size".

3.2.
Measures of polynomials and heights of their roots.For a polynomial A ∈ C[X], let |A| 1 (resp.|A| ∞ ) be the sum (resp.maximum) of the absolute values of the coefficients of A. The Mahler measure of a polynomial Lemma 3.4.We have Proof.The first two inequalities are by definition and the third is Equation ( 6) of [24].For its converse, observe that we have |AB| 1 ≤ |A| 1 |B| 1 , and hence also |A| 1 ≤ |a| i max{2, 2|α i |} ≤ 2 n M(A).Then take logarithms.
For an element α in a number field L of degree n, we define its (absolute logarithmic) height to be where the sum ranges over the Archimedean and non-Archimedean absolute values, suitably normalized (that is, those denoted Remark 3.6.Another measure for the complicatedness of A would be its total bit size, or the sum s of the logarithms of the absolute values of the nonzero coefficients.We will instead focus on |A| ∞ for the following reasons.First of all, for computational purposes, it is more useful to look at p = deg(A) • log |A| ∞ , as the required precision (or number of primes with the CRT approach) is proportional to log |A| ∞ and the number of computations to do with that precision is proportional to deg(A).
Secondly, we get the impression from numerical computations that s is close to p.For example, the value of s/p is spread out over the interval (0.75, 0.9) for the larger discriminants in both Section 4.5 and Example 7.4.
Finally, it is hard to prove lower bounds on s other than s ≥ log |A| ∞ , as it seems to already be hard to show that a sufficient proportion of coefficients is nonzero.

Proof of the height reduction.
Theorem 3.7.Let C be a modular curve over Q and suppose that C is an elliptic curve of rank 0 with Weierstrass coordinates x and y.Suppose that τ ∈ H ranges over a sequence of imaginary quadratic points for which C yields real generalized class polynomials H τ [C], and with where d is the degree of K O over K(ψ(τ )).
Remark 3.9.We argue that the hypothesis (3.8) is very reasonable.Under GRH, we have where D is the discriminant of O (see [22, 9.Theorem 1 and 11. on page 371], suitably extended to arbitrary D.) Moreover, [8, §6.2] gives the approximation log , where the sum ranges over reduced primitive quadratic forms Q = ax 2 + bxz + cz 2 of discriminant D. We now give a heuristic lower bound of this sum on average over all |D| ≤ X.We have , where this time the sum is taken over all reduced quadratic forms of negative discriminant > −X (using the heuristic that imprimitive forms have a negligible contribution).As we are only computing a lower bound, we may restrict to a ≤ X/8.Then b ranges from −a to a, and c ranges from a or a + 1 to (X + b 2 )/(4a) ; a range that contains at least X/(8a) integers.This yields at least roughly X/4 values of b and c for each a, hence D S(D) is roughly at least (X/4) a 2 ≤X/8 a −1 ≥ 1 8 X log(X).It follows that the average S(D) is at least proportional to log |D|.Thus, for "average" S(D), we have that log |H τ [j]| ∞ is at least proportional to |D| log |D|.Combined with (3.10), (3.5), and Lemma 3.4, we find for such D that h(j(τ ))/ log(log(#Cl(O))) is at least proportional to log |D|/(log(log |D|)) 2 .We thus see that (3.8) indeed holds for "average" S(D).
Theorem 3.7 is the analogue of the following result.Theorem 3.11 (cf.Enge-Morain [8]).Let f be a modular function and suppose that τ ∈ H ranges over a sequence of imaginary quadratic points for which (f, τ ) is a class invariant with h(j(τ )) → ∞.Then d The goal of the remainder of Section 3 is to prove Theorem 3.7.We start with a proof of Theorem 3.11.
Proof.Let m be the degree of K(f (τ )) over K and let n = dm be the degree of K O over K.By Lemma 3.4 and (3.5), we get by [19,Proposition B.3.5(b)].Altogether, this gives the result.Proposition 3.13.Let C be a modular curve over Q and suppose that C is an elliptic curve of rank 0 with Weierstrass coordinates x and y.For every imaginary quadratic τ ∈ H for which C yields a real generalized class polynomial H τ [C], let m be the degree of K(ψ(τ )) over K and let d ∈ {1, 2} be the degree of for some constant B that only depends on C and the choice of Weierstrass model.
Proof.We first put the equation for C in a nice form.We have C : y 2 + g(x)y = f (x).Without loss of generality we have g = 0 and f ∈ Z[X] monic of odd degree such that f (z) ≤ −1 for all real z ≤ 0. Indeed, we obtain g = 0 by the substitution y = y + 1 2 g(x), then do scalings x = vx and y = wy to make f integral and (thanks to its odd degree) monic, and then do a substitution x = x + c to make f (z) ≤ −1 for all z ≤ 0. This affects H τ [C] = A + BY and H τ [x] as follows.The first substitution changes A into A + 1 2 g(X)B, the second changes A into A(vX) and B into wB(vX), and the third changes A into A(X + c).Each of these substitutions change log(max{|A| 1 , |B| 1 }) at most by O(m), as does clearing the denominators afterwards.
Next, we relate a norm of 4) (which is minus the Heegner point) is torsion by our assumption that C has rank 0. There are finitely many torsion points in C(Q), hence finitely many possibilities for the polynomial T We claim that s = ±1.If not, take a prime p | s and consider the highest-weight term of (H τ [C] mod p), where X has weight 2 and Y has weight deg(f ).This gives rise to the highest-degree term of (N (H τ [C]) mod p), which is therefore nonzero, a contradiction.

Now we use interpolation to bound
. We will choose interpolation points z = g(i) ≤ 0. Note that for z ≤ 0 we have Interpolation then gives, for P ∈ {A, B}: , For the lower bound, note that Proof of Theorem 3. (as in the proof of Theorem 3.11).The product of these two limits gives the result.
Remark 3.15.Theorem 3.7 states that asymptotically the effect of the choice of a model of the curve C is negligible, as is the effect of replacing f by 2f or f + 1 or any other element of Q(f ) in Theorem 3.11.
However, in practice the error terms can be quite large and depend on these choices.For example, if f is integral over Z , then f has zero constant coefficient.This can make a difference in practical examples as it forces the coefficients at the beginning and end to be small, though this improvement is negligible asymptotically by the theorems.See also Remark 3.6.

4.
Class invariants for X 0 (N ) and X 0 + (N ) In this section we assume that C is a quotient over Q of X 0 (N ); in other words, C is a smooth, projective, geometrically irreducible curve over Q with function field consisting only of modular functions for Γ 0 (N ) that have rational q-expansion.We will show how to obtain generalized class functions for every discriminant D < 0 that is square modulo 4N (Section 4.1).
In some cases we get further reductions from class invariants generating subfields of K O or from real class polynomials (Sections 4.2-4.4).
In Sections 4.5-4.6 we study what this means for X 0 + (119) and in Section 4.7 we look for more examples of elliptic curve quotients of X 0 (N ).4.1.Class invariants for X 0 (N ).The following result does not require C to be an elliptic curve, except that (unless C is an elliptic curve) one needs to read the definitions in Section 7 for the parts about generalized class polynomials.The Galois orbit of ψ(τ ) can be computed as follows.There exists an N -system, that is, there exist τ 1 , . . ., τ n ∈ H such that (τ i Z + Z) i is a system of representatives of Cl(O) and such that τ i is a root of a i X 2 + b i X + c i with gcd(a i , N ) = gcd(a i , b i , c i ) = 1 and b i ≡ b mod 2N .Moreover, for any such choice, we have For any f ∈ Q(C), Theorem 4 of Schertz [31] states f (τ ) ∈ K O ∪ {∞} and gives the Gal(K O /K)-orbit as {g(N τ i ) : i}, under an additional condition on the function f (1/z).However, the condition on f (1/z) is not needed, as stated in Theorems 3.9 and 4.4 of [13].This proves the result.

Real class polynomials from ramification.
There are some situations in which we can actually get real class polynomials, cutting the total required bit size in half.The first such situation is when all primes dividing N ramify.Then the Gal(K O /K)-orbit of ψ(τ ) is stable under complex conjugation, and hence we may take The complex conjugate of ψ(τ ) is ψ(−τ ) by the fact that the q-expansion coefficients are real.Here −τ is a root of aX 2 − bX + c, and as N | b, we can choose the N -system in Proposition 4.1 in such a way that −τ = τ i for some i.This proves the result.

4.3.
Real class polynomials from X 0 + (N ).The second situation in which we get real class polynomials is when working with quotients of X 0 + (N ).Proposition 4.3 (based on Theorem 3.4 of Enge-Schertz [10]).In the situation of Proposition 4.1, suppose furthermore that C is a quotient of X 0 + (N ), and that gcd(c/N, N ) = 1.
Then the Gal(K O /K)-orbit of ψ(τ ) is stable under complex conjugation, and hence we may take Proof.The complex conjugate of ψ(τ ) is ψ(−τ ) by the fact that the q-expansion coefficients are real.As ψ is invariant under the Fricke-Atkin-Lehner involution, this in turn is ψ(τ ) with τ = N/τ , a root of (c/N )X 2 + bX + N a.As c/N is coprime to N , we can choose the N -system in Proposition 4.1 in such a way that τ = τ i for some i.This proves the result.
To use this result, we will need gcd(c/N, N ) = 1, which can be achieved most of the time, as follows.The negative fundamental discriminants that are a square modulo 4N (which are not in one of the exceptions of Lemma 4.4) have density in the set of all fundamental negative discriminants.
Proof.Being a discriminant is the condition of being 0 or 1 modulo 4. It is equivalent to being a square modulo 4.This is independent of being a square modulo p i that does not suffer from (1), which is happens for the (p i − 1)/2 residue classes modulo p i that are nonzero squares modulo p i , and the p i −1 nonzero residue classes modulo p 2 i that are zero modulo p i .As p i (p i − 1)/2 + p i − 1 = (p 2 i + p i − 2)/2, we get the first statement.
Being a fundamental discriminant means being nonzero modulo the squares of all odd primes and being 1, 5, 8, 9, 12, 13 modulo 16.This happens for ζ(2) −1 (1 − 1/4) −1 616 of all negative integers.In order to restrict this to products that satisfy the conditions of Lemma 4.4, we have to adjust the Euler product exactly by the given factor.

4.4.
Lower-degree class polynomials from ramification.In the case where all primes dividing N ramify, we get an even greater size reduction.The point ψ(τ ) will then be defined over a subfield, cutting the degree of its minimal polynomial in half.This in turn also cuts the height of the coefficients of this polynomial in half, as we get d ≥ 2 in Theorem 3.7.The amount of work required for computing the class polynomial, as well as the bit size of the polynomial (Remark 3.6), is related to the degree times the logarithm of the largest coefficient, and this product is reduced by a factor ≥ 2 × 2 × r(C) = 4r(C).If a i are the ideals τ i Z + Z of an N -system, then a i and a i n yield the same point ψ(τ i ), while a −1 i and a −1 i n yield ψ(τ i ).Proof.This is exactly what we get when applying [12,Theorem 9] to the coordinate functions f of C.

4.5.
Numerical results for X 0 + (119).For the rest of this section we will return to our main Example 2.7, so set N = 119 = 7 • 17.For any τ as in Proposition 4.3, we have . By scaling, we may assume that the coefficients of H τ [C] are integral and coprime, and that the leading coefficient (i.e. the coefficient of the monomial of highest degree as a function on C) is positive, and this uniquely determines For any discriminant D < 0 coprime to N such that D is a square modulo N , there are two generalized class polynomials (depending on the choice of τ ).We experimentally computed both of these for all fundamental discriminants of prime class number < 100.The main reason for restricting to prime class number is to exclude the two tricks of Remark 3.3; for these discriminants, the reduction factor thus provides a fair comparison with the Hilbert class polynomial.The method we employ numerically evaluates class invariants by their q-expansions, and finds a minimal polynomial relation (2.3) using lattice basis reduction (LLL).We leave faster methods for future research, but see Section 6 for the first ideas.Since the q-expansions can only be evaluated up to finite precision, this does not result in provably correct polynomials, although -based on heuristic estimates -they are highly unlikely to be incorrect.
A few examples of computed polynomials are listed in Table 1.Here, for the given discriminant D, we consistently chose τ such that its primitive equation is −15139 29 x 15 + 1028x 14 − 40x 13 y + 37342x Still assuming that H τ [C] is scaled such that it has coprime coefficients in Z, we denote by  The values of the practical reduction factor r A (τ ) seem to be around their expected asymptotic value r(C) = 72 (represented by the horizontal grey line), though the convergence is not apparent; especially compared to, e.g.some classical class polynomials [8, Fig. 1].However, in practical applications (see Section 5), the class numbers employed are typically several orders of magnitude higher (cf.e.g.[35]), so here we expect the speed of convergence not to cause major deviations in expected running times (cf.Section 6).For small class numbers, one can in practice even take advantage of this phenomenon by constructing generalized class polynomial with surprisingly good practical reduction factors by selecting a basis of L(∞D) different from 1, x, y, x 2 , xy, . . .(see Example 7.4).

4.6.
Comparison with existing class invariants.Real class invariants typically arise subject to congruence conditions on the discriminant.For example, Weber's functions with reduction factor 72 are not known to give class invariants for discriminants ≡ 5 (mod 8).The reduction factors obtained by class invariants coming from the family of (double) eta quotients w n and w p,q (such as the Weber function w 2 , as well as the function w 7,17 of Example 2.7) have been extensively studied; cf.most notably [9].These modular functions are not known to yield class invariants if D is not a square modulo 4n or 4pq.Hence, to the best of our knowledge, they also are not applicable to discriminants ≡ 5 (mod 8) as soon as n, p or q is even.Excluding these cases, the (double) eta quotient with highest known reduction factor is w 9 , with a reduction factor of 36 [9,Table 7.1].
A less-studied generalization are multiple eta quotients [12], which are quotients of products of 2 k eta functions.As far as we know these do not yield reduction factors better than 36 for k > 1.
The only other known family of "good" class invariants (in the sense that they have large reduction factors) are the Atkin functions A p for prime numbers p, defined to be the smallest-degree functions in L(∞D), where D is the unique cusp of X 0 + (p).The "best" known one here is A 71 , again with a reduction factor of 36, owing to the fact that X 0 + (71) has genus zero [14, §3]).The curve C = X 0 + (119) has a reduction factor r(C) = 72 and yields real class invariants whenever D is a square modulo 4 • 7 • 17 and not divisible by 7 2 or 17 2 .The set of such D has density > 28.98% among the set of all negative discriminants (by Lemma 4.5).Out of these discriminants, one-fourth are ≡ 5 (mod 8).Hence, for at least 28.98% • 1 4 > 7.24% of imaginary quadratic discriminants, the reduction factor exceeds the previously best known reduction factors by a factor of at least two.
Remark 4.7.One should note that the above comparison does not take into account the discussion of Remark 3.3.Most importantly, the reduction factor is not synonymous with the true size reduction of the class polynomials.Indeed, as noted in that remark, the record-breaking CM construction [35] uses the Atkin invariant A 71 of reduction factor 36, because the effective size reduction of class polynomials is by a factor of roughly 2 2 • 36 = 144 for certain discriminants.However, by Section 4.4, the same trick applies to generalized class polynomials, leading for X 0 + (119) to a size reduction of 2 2 • 72 = 288, again for a positive density subset of discriminants.In Figure 2 we plot the practical reductions in bit size we found compared to the Hilbert class polynomial using this trick.Remark 4.8.Note that the "classical" class polynomial H τ [x], arising from the function x on X 0 + (119) by itself attains a reduction factor of 36 for the same 28.98% of discriminants.This beats all previously-known class invariants for a smaller subset (≈ 1.2%) of discriminants: those that additionally are non-square modulo both 3 and 71.This x can be viewed as a generalisation of the Atkin functions This shows that the search for generalized class invariants can even uncover new "classical" class invariants.4.7.More modular curves of genus one.We searched for more elliptic curves that could be used, and the results are in Tables 2, 3, and 4. In our search, we used the fact that X 0 (N ) is well-studied and that there is an isomorphism X 0 (N ) → X 0 (N ) : z → N z.Surpisingly, we found lots of elliptic curves with reduction factor 72 and no elliptic curves with a greater reduction factor.
In Section 7, we will allow curves of higher genus, which do achieve arbitrarily high values of r(C).Moreover, our search is by no means exhaustive, as Tables 2 and 3 restrict to maps φ : X → C of degree ≤ 2 and Table 4 only looks at one curve X = X 0 (N ) per isomorphism class of curves C. For example, the curve C = X 0 + (119) has r(C) = 72.However, in the Cremona database, it is listed as 17a4, and comes with a modular parametrization φ 17 : X 0 (17) → C of degree 1, which has r(φ 17 ) = 18.This is why C does not appear in Table 4.
Finally, the tables are restricted to quotients of X 0 (N ).Letting go of X 0 (N ), we find that the genus-one modular curves 7C in the Pauli-Cummins database [6] all achieve r(C) ∈ {84, 96, 108}.We have not pursued these curves yet, as Proposition 4.1 does not apply to them.
For each curve C with which we would like to apply the generalized CM method, the polynomial Ψ C ∈ Z[X, Y, Z] can be precomputed and stored.Next we need a criterion for which discriminants D yields class invariants.For example, if C = X 0 + (N ) then this is given by Proposition 4.1.Now, given a desired characteristic polynomial of Frobenius x 2 − tx + q such that D = t 2 − 4q satisfies this criterion, we have the following algorithm for sufficiently large |D|.
(1) Compute a generalized class function F of discriminant D as well as its Heegner point Q. (2a) Find a zero P = (x, y) ∈ C(F q ) of F that is neither −Q nor a common root of the polynomials f 1 , . . ., f dj of Lemma 5.1.(2b) Find all roots j 0 ∈ F q of the polynomial Ψ C (x, y, Z) ∈ F q [Z].
(3) For each j 0 , construct an elliptic curve E/F q with j(E) = j 0 and all of its twists up to isomorphism over F q .Return one with q +1−t rational points.The main advantage compared to the classical CM method, both in terms of memory and speed, is expected to be in the (dominant) first step (1) (see Section 6).Out of the computationally non-dominant steps, only (2a) is less straightforward.One way to proceed would be as follows.
(i) Compute (iii) Solve for the corresponding value of y using the linear polynomial H τ [C](x, Y ), or continue with both solutions y coming from the Weierstrass equation.
Remark 5.2.The polynomial F x is very close to the classical class polynomial H τ [x]; indeed, it has the same roots, together with one additional root at the xcoordinate of the Heegner point of F .The norm computation in step (i) is however computationally asymptotically dominated by the computation of F .
6.The computational benefits of our invariants 6.1.Space complexity of the functions.The advantage of using generalized class functions lies in their size.This already gives a serious advantage when storing one or more class polynomials for later use, e.g. for various values of q in the CM method.Additionally, one would expect the smaller size to make the generalized class polynomials less expensive to compute.Again for C a modular elliptic curve with a given Weierstrass model, we present a preliminary analysis of the cost of computing a generalized class polynomial H τ [C] when compared to the "classical" class polynomial H τ [x] (though recall that the latter already dominates all previously-known class invariants along a positive density subset of discriminants for C = X 0 + (119), cf.Section 4.6).6.2.Speed of complex analytic computation.We now explain how to adapt the complex analytic approximation algorithm to generalized class polynomials.
To compute the classical class polynomial H τ [x] one first evaluates x(τ ) and all its conjugates, which are of the form x i (τ i ), where x i and τ i can be obtained using Shimura's reciprocity law [18] or N -systems [31].Then one multiplies the linear polynomials X − x i (τ i ) together in a binary tree using fast multiplication algorithms.
As H τ [C] has roughly half the height, we only need half the precision at each step.This gives a great speed-up when evaluating x i (τ i ), but then we also need to compute y i (τ i ).Fortunately that should only take a fraction of the time required for computing x i (τ i ), as we can first compute it to low precision and then obtain as many digits as desired quickly using The binary tree step is harder to analyze.Instead of having polynomials A(X) = i∈S (X − x i (τ )) to multiply for various subsets S ⊂ {1, 2, . . ., n}, we will have pairs (F, Q) with F = A(X) + B(X)Y and div(F ) = i∈S Instead of a single multiplication A 1 A 2 to go from S 1 and S 2 to S 3 = S 1 S 2 , we now need to compute the point with the elliptic curve group law) and a function F 3 with div(F 3 ) = i∈S The following formula can be used: , where (6.1) and where the reduction modulo Y 2 − f (X) keeps the outcome of degree ≤ 1 in Y .
We can multiply F 1 with F 2 using three multiplications of half the degree, by the same trick that is used in Karatsuba multiplication.Indeed, let to get F 1 F 2 = (C +Df )+(E −C −D)Y .So computing F 3 involves three polynomial multiplications of half the degree of F 1 and F 2 , as well as various multiplications and long divisions by fixed-degree polynomials and various additions and subtractions.The most serious computations in the binary tree are now done with half the degree and half the number of digits, but three times as often, which takes 3/16th of the time with naive multiplication and still less than 3/4 of the time with quasi-lineartime multiplication.The impact of the extra additions and subtractions, as well as the extra multiplications by a linear polynomial in X and Y and long division by the denominator of (6.1) requires further analysis, but we expect this to be minor.Regardless, for large discriminants, the main bottleneck is in memory complexity (as noted in [7, Section 7]), and here we obtain an improvement of a factor of 1/2 when passing from 6.3.Adapting the CRT method.6.3.1.Overview of CRT class polynomial computation.We now heuristically estimate the expected speed-up when computing H τ [C] instead of H τ [x] using the (currently state-of-the-art) CRT method for class polynomial computation [14,34,35].We restrict to the case of C such that all q-expansion coefficients of x and y are rational, and will analyse some steps only in the main case where C is a quotient of X 0 + (N ).To keep our exposition simple, we will not treat the main improvement and gcd(ac/N, N ) = gcd(a, b, c) = 1.In line with Lemma 2 of [14] we could even take c = N by replacing a by ac/N .We take z = −b+ √ D 2a , n = azZ + N Z, and a = zZ + Z. Then we have O = azZ + Z, and we find that n is an invertible O-ideal with O/n ∼ = Z/N Z.In fact, we find na = zZ + N Z and hence Exactly as in Section 4.3 of [14], we list the j-values of elliptic curves over F p with endomorphism ring O, and arrange them into unoriented [n]-isogeny cycles.If C is a quotient of X 0 + (N ) over Q, then for each edge of this graph, we find the f -value from the two j-values of the end points.(In the case where the [n]-isogeny cycles are 2-cycles, we only get one f -value per 2-cycle and we get a lower-degree class polynomial In practice, we could do this for f = x exactly as in [14], and then solve for y using Ψ C (x, y, j) = 0, which is linear in y.The only additional work compared to what is done in [14] is computing and solving the linear equation to get y, which is much faster than all the other steps.
In particular, Step 1 takes much less than twice as long with C than with x, while we need to do it only half as often, which leads to a speed-up.Further research into these modular polynomials is needed in order to determine the exact gain.
To also make this work for quotients of X 0 (N ) that are not quotients of X 0 + (N ), one would need to compute oriented [n]-isogeny cycles.
The main computational tool at the beginning of Section 4.1 is the modular polynomial Φ ,f , which we generalize from f to C as follows.
Let Φ ,C be a Gröbner basis of the ideal in Q[X 1 , Y 1 , X 2 , Y 2 ] of polynomials that vanish on {(ψ(z), ψ( z)) : z ∈ H}, with respect to the lexicographic ordering with X 1 > Y 1 > X 2 > Y 2 .To get from ψ(z) to all possible values of ψ( z), one substitutes ψ(z) for (X 1 , Y 1 ), and then solves first for X 2 and then for Y 2 .For each C and this works for all but a finite set of primes p.Such multivariate modular polynomials would need to be precomputed.One possible starting point for computing these would be [25,26], which compute multivariate (Hilbert) modular polynomials, each with a different method.For yet another approach to computing modular polynomials, see [3].
We expect the reduction factor to also give a reduction of the size of these multivariate modular polynomials, but on the other hand, we need two of them: one to solve for x of an isogenous curve, and one to evaluate in x and get y.As evaluating is faster than solving, we expect the use of these modular polynomials to take much less than twice as long (and we need to do it only half as often, because we have half as many primes).
The 'Trace Trick' of [14, Section 4.2] enables the use of the Weber function f in the CRT method.In case we would also need this trick, for some more exotic curves C, we could consider applying it with arbitrary functions f ∈ Q(C) such as f = ax + by for small integers a and b.In loc.cit. the relevant trace is computed with much fewer primes, so it is ok to apply this with the lower reduction factor of f .We did not yet consider the general algorithm of [14,Section 4.4].It is the method that works for all class invariants, but is only practical under additional restrictions.We do not have examples of generalized class invariants where this trick is needed.The challenging step to generalize is factoring a large-degree function in Q(C) in order to obtain the small class functions.6.3.4.Constructing a function from its roots.In the CRT setting the multiplications and long-divisions by small-degree polynomials of Section 6.2 only take time O(nM (log(p))) per level, which is asymptotically dominated by the O(M (n log(p)) time of the multiplications of large-degree polynomials.Therefore, Step 2 seems to take about 1.5 times as long per prime p for H τ [C] when compared to H τ [x].6.3.5.The total running time.Concluding this preliminary analysis, we estimate the cost of computing H τ [C] to be significantly lower compared to H τ [x], though further research, in particular into (the implementation of) modular polynomials for C is required to determine the exact gain.This is beyond the scope of the current paper, which focuses on introducing the generalized class functions and their height reduction.We plan to give a more detailed account and an implementation in future work.

General curves and bases
Now suppose that our modular curve C is not necessarily an elliptic curve.Let D be an effective divisor over Q on C and let B = {b 0 , b 1 , . ..} be a Q-basis of L(∞D) ordered by ascending degree.
Example 7.1.One systematic way to choose a Q-basis of L(∞D) is as follows.First choose x ∈ L(∞D) \ Q of some degree d. (For example, one can take x = f with d = 1 in the classical case, and x = x with d = 2 in the elliptic case.)Now, let y 0 = 1 and choose y j for j = 1, 2, . . ., d − 1 in such a way that y j ∈ L(m j D) \ y k x e : k < j, e ∈ Z , where m j is minimal such that this set is non-empty.This way we obtain a vector y = (y 0 , . . ., y d−1 ) of d functions.(For example, in the classical case we have y = 1, and in the elliptic case we chose y = (1, y).)Then B = {x e y j : e ∈ Z ≥0 , j ∈ {0, 1, 2, . . ., d − 1}} is a basis of L(∞D).We order this basis by ascending degree de + m j , and if two elements have the same degree, then we put the one with lowest j first.
The Example 7.4.It turns out that, already for the case of elliptic curves, allowing the freedom of the choice of basis of may in reality lead to potentially better practical reduction factors.Revisiting our main example C := X 0 + (119), denote by w := w 7,17 the function (2.9) and by z := x + y the sum of the Weierstrass coordinates for the model (2.8).Now consider the basis B := {1, x, z, w, xz, wx, wz, w 2 , wxz, w 2 x, . ..} of L(∞D).The resulting generalized class polynomials corresponding to the discriminants of Table 1 are listed in Table 5.We get practical reduction factors in Figure 3 that are better than those in Figure 1.
A likely explanation for this improvement is that now not only the poles, but also the zeroes are as much restricted to the cusps of X 0 + (119) as possible.Indeed, the points O = (0 : 1 : 0) and P = (0, 0) are the cusps, while 2P and 3P are rational CM points.Now div(w) = 4(P ) − 4(O), div(x) = (P ) + (3P ) − 2(O), and div(y) = 2(P ) + (2P ) − 3(O).In particular, the function w is a modular unit.As explained in Remark 3.15, modular units in the classical setting give better practical reduction factors than non-units, even though the reduction factors are asymptotically the same.Table 5.Some conjecturally correct generalized class functions for the curve C = X 0 + (119) using the L(∞D)-basis B := {1, x, z, w, xz, wx, wz, w 2 , wxz, w 2 x, . ..}. Theorem 7.5.Let C : y 2 + g(x)y = f (x) with f, g ∈ Q[X] be a hyperelliptic curve such that 4f (x) + g(x) 2 has odd degree and Jac(C)(Q) is finite.Set D to be the unique point at infinity and choose the basis B = {1, x, x 2 , y, xy, x 2 y, . ..} of L(∞D).Then Theorem 3.  Remark 7.6.Our proofs of Theorems 3.7 and 7.5 heavily rely on the fact that Heegner points are torsion.To completely remove the assumption on ranks, one would therefore need to bound the Heegner points, even in the rank-one case.Moreover, the proofs rely on the hyperelliptic equation where we use that |a| ≤ |a + bi| for real numbers a and b.Though we expect an analogue of these results to hold for general modular curves, this would require additional ideas.Do note that such an analogue would yield arbitrarily high reduction factors for generalized class polynomials by (3.2).For example, for C = X 0 + (239) of genus 3 we already obtain r(C) = 120, exceeding the Bröker-Stevenhagen bound.

Definition 2 . 6 .
3) we will allow more general divisors D and bases B, leading to more general functions F τ [C, B] and polynomials H τ [C, B].We call the point P = σ∈G σ(ψ(τ )) ∈ C(K) the Heegner point of the class function F .
Proof.For the existence of a, b, c, take an arbitrary square root b of D modulo 4N , let a = 1, and c = (b 2 − D)/4.Then the existence of an N -system is [31, Proposition 3].

Proposition 4 . 2 (
based on Enge-Morain[9]).Let C = (C, ψ) be a quotient over Q of X 0 (N ) and let D < 0 be a discriminant divisible by N if N is odd and by 4N if N is even.There exist a, b, c ∈ Z with a, c > 0, N | b, c, gcd(a, N ) = 1, and b 2 − 4ac = D. Choose such a, b, c, let τ ∈ H be a root of aX 2 + bX + c, with order O = Z[aτ ], which has discriminant D.

Lemma 4 . 4 .
If D is a square modulo 4N and D = F 2 D 0 for a negative fundamental discriminant D 0 and a positive integer F coprime to N , then there exist a, b, c as in Proposition 4.1 with gcd(c/N, N ) = 1.More generally, let D < 0 be a square modulo 4N .Then there exist a, b, c as in Proposition 4.1 with gcd(c/N, N ) = 1 if and only if all of the following do not hold.

Lemma 4 . 5 . 2 i + p i − 2 2p 2 i
Let N be the product of distinct odd primes p 1 , . . ., p k .The negative discriminants that are a square modulo 4N and not in one of the exceptions of Lemma 4.4 have density k i=1 p in the set of all negative discriminants.

Proposition 4 . 6 (
based on Enge-Schertz[12]).Let C = (C, ψ) be a quotient over Q of X 0 (N ) and let D = F 2 D 0 < 0 be such that N | D, gcd(F, N ) = 1, andD ∈ {N, 4N }.There exist a, b, c ∈ Z with a > 0, N | b, c = N , b 2 −4ac = D,and gcd(a, b, c) = 1.Choose such a, b, c, let τ ∈ H be a root of aX 2 + bX + c, with order O = Z[aτ ], which has discriminant D. Let n = ((−b + √ D)/2, a), and let K [n] O be the subfield of K O fixed by the image of n under the Artin map.Then [n] has order 2 in Cl(O) and ψ(τ ) ∈ C(K [n] O ), where K O has degree 2 over K [n] O .We get m ≤ #Cl(O)/2 in the definition of H τ [C], we get H τ [C] ∈ Q[X, Y ], and we get and d ≥ 2 in Theorem 3.7.

the
practical reduction factor of τ .Under the assumption h(j(τ ))/ log(log(n)) → ∞ for n = #Cl(O) (cf.Theorem 3.7) we have d −1 r A (τ ) → r(C).Experimentally obtained practical reduction factors, plotted against both the class number n and log(|H τ [j]| ∞ )/ log(log(n)), can be seen in Figure1.To visualize the role of the class number and the hypothesis h(j(τ ))/ log(log(n)) → ∞, the points of higher class number are given a darker color in the second figure.
function x is, up to multiplicative and additive constants, equal to the Atkin function A 191 .The reduction factors are r(C) = 96, r(s) = 48, and r(A 191 ) = 32.As in Section 2, let τ ∈ H imaginary quadratic and assume that (b i , τ ) is a class invariant for every b i ∈ B. Then, again unique up to scaling, we obtain a non-zero function F τ [C, B] = k i=0 a i b i ∈ K(C) (a i ∈ K) with k minimal such that k i=0 a i b i (τ ) = 0. Definition 7.3.We call this F τ [C, B] the generalized class function for the triple C, B, τ .If B is as in Example 7.1 then we again refer to the associated polynomial H τ [C, B] ∈ K[X, Y 1 , . . ., Y d ] (of total degree ≤ 1 in Y 1 , . . ., Y d and such that H τ [C, B](x, y 1 , . . ., y d ) = F τ [C, B]) as the generalized class polynomial.