Ben Smith

Renaud Dubois

Keywords: Variétés abéliennes, isogénies, équations modulaires, algorithmes Higher-dimensional modular equations, applications to isogeny computations and point counting Abelian varieties, isogenies, modular equations, algorithms

Titre: Équations modulaires en dimension supérieure, applications au calcul d'isogénies et au comptage de points Résumé: L'objectif de cette thèse est de généraliser la méthode d'Elkies, un ingrédient fondamental de l'algorithme SEA pour le comptage de points d'une courbe elliptique sur un corps fini, au cas des variétés abéliennes polarisées de dimension supérieure. Les équations modulaires jouent un rôle central dans cette étude. Premièrement, nous donnons un algorithme de calcul d'isogénies entre surfaces abéliennes à partir d'équations modulaires. Deuxièmement, nous obtenons des bornes de degré et de hauteur pour les équations modulaires en fonction de leur niveau. Troisièmement, nous décrivons un algorithme rigoureux permettant d'évaluer des équations modulaires pour les surfaces abéliennes via des approximations complexes. Combiner ces résultats permet d'obtenir un algorithme de comptage de points de meilleure complexité pour les surfaces abéliennes principalement polarisées avec multiplication réelle.

Résumé étendu en français

Le problème du comptage de points pour les courbes elliptiques consiste, étant donnée une courbe elliptique E sur un corps fini F q , à calculer le nombre de points de E définis sur F q . Ses analogues en dimension supérieure demandent, étant donnée une variété abélienne polarisée A sur F q , de calculer le polynôme caractéristique de l'endomorphisme de Frobenius π A de A. Une des motivations principales pour étudier le problème du comptage de points provient de la cryptographie à clés publiques, qui utilise des courbe elliptiques et des Jacobiennes de dimension 2 dont le nombre de points est (quasiment) premier [START_REF] Miller | Uses of elliptic curves in cryptography[END_REF][START_REF] Koblitz | Elliptic curve cryptosystems[END_REF][START_REF] Koblitz | Hyperelliptic cryptosystems[END_REF]. Au-delà de cette application, le problème du comptage a un intérêt intrinsèque en théorie algorithmique des nombres.

L'algorithme de Schoof [START_REF] Schoof | Elliptic curves over finite fields and the computation of square roots mod p[END_REF][START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF] pour les courbes elliptiques, et ses généralisations en dimensions supérieures [Pil90, GH00, GKS11, GS12, Abe18], permettent de résoudre le problème du comptage de points en temps polynomial en log(q). Pour une série de petits premiers , cet algorithme calcule le polynôme caractéristique de π A modulo en étudiant l'action de π A sur le sous-groupe de -torsion A[ ]. On conclut ensuite à l'aide du théorème chinois et des bornes de Hasse-Weil [Sil09, §V.1, Thm. 1.1], [START_REF] Milne | Abelian varieties[END_REF]Thm. 19.1]. La méthode de Schoof est l'état de l'art pour le comptage de points en grande caractéristique, sauf dans le cas des courbes elliptiques où une amélioration importante existe.

Pour calculer le nombre de points d'une courbe elliptique E sur F q modulo , Elkies [START_REF] Elkies | Elliptic and modular curves over finite fields and related computational issues[END_REF] montre que l'on peut, environ une fois sur deux, remplacer E[ ], noyau de l'endomorphisme [ ], par le noyau d'une -isogénie de source E. Celle-ci est calculée à l'aide du polynôme modulaire elliptique Φ de niveau , une équation bivariée qui relie les j-invariants de courbes elliptiques -isogènes [Cox13, §11.C]. On peut résumer les prérequis de la méthode d'Elkies en trois points :

• Un algorithme de calcul d'isogénies permettant, à partir de Φ et de deux courbes elliptiques -isogènes E, E , de calculer le noyau de l'isogénie correspondante [START_REF] Elkies | Elliptic and modular curves over finite fields and related computational issues[END_REF][START_REF] Bostan | Fast algorithms for computing isogenies between elliptic curves[END_REF] ;

• Des bornes de complexité (degré et taille des coefficients) pour le polynôme Φ , fournies par un résultat de Cohen [START_REF] Cohen | On the coefficients of the transformation polynomials for the elliptic modular function[END_REF] explicité par la suite [START_REF] Bröker | An explicit height bound for the classical modular polynomial[END_REF][START_REF] Pazuki | Modular invariants and isogenies[END_REF] ;

• Un moyen d'évaluer efficacement le polynôme Φ et ses dérivées, soit en précalculant ces polynômes [START_REF] Enge | Computing modular polynomials in quasi-linear time[END_REF][START_REF] Bröker | Modular polynomials via isogeny volcanoes[END_REF], soit de manière directe [START_REF] Sutherland | On the evaluation of modular polynomials[END_REF].

La méthode d'Elkies permet de réduire le degré des polynômes manipulés au cours de l'algorithme de comptage. L'algorithme obtenu est de meilleure complexité asymptotique en moyenne que la méthode de Schoof [START_REF] Shparlinski | On the distribution of Atkin and Elkies primes[END_REF][START_REF] Shparlinski | On the distribution of Atkin and Elkies primes for reductions of elliptic curves on average[END_REF], et le gain en pratique pour des données de taille cryptographique est clair. La méthode d'Elkies entre, avec d'autres idées dues à Atkin, dans la composition de l'algorithme SEA pour le comptage de points des courbes elliptiques [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF], implanté dans de nombreux logiciels de calcul formel et théorie des nombres comme Pari/GP ou Magma. Les polynômes modulaires elliptiques et l'algorithme d'Elkies apparaissent également dans les algorithmes fondés sur les graphes d'isogénies de courbes elliptiques [START_REF] Kohel | Endomorphism rings of elliptic curves over finite fields[END_REF].

Le but de cette thèse est de généraliser la méthode d'Elkies aux variétés abéliennes de dimension supérieure, notamment dans deux cas où la méthode de Schoof est bien étudiée : les surfaces abéliennes principalement polarisées, avec ou sans multiplication réelle. Le rôle du polynôme modulaire elliptique Φ est alors joué par les équations modulaires de Hilbert et de Siegel, respectivement, dont des exemples sont connus [START_REF] Bröker | Modular polynomials for genus 2[END_REF][START_REF] Milio | A quasi-linear time algorithm for computing modular polynomials in dimension 2[END_REF][START_REF] Martindale | Hilbert modular polynomials[END_REF][START_REF] Milio | Modular polynomials on Hilbert surfaces[END_REF]. D'un point de vue géométrique, ces équations modulaires définissent le lieu, dans les espaces de modules correspondants, des surfaces abéliennes liées par une isogénie de type fixé. Le langage des variétés de Shimura PEL [START_REF] Milne | Introduction to Shimura varieties[END_REF] permet à la fois d'unifier ces deux exemples et d'en considérer de vastes généralisations.

Les contributions de cette thèse remplissent les trois prérequis de la méthode d'Elkies évoqués précédemment :

• Le chapitre 3 présente un algorithme de calcul d'isogénies entre surfaces abéliennes principalement polarisées, à partir des équations modulaires de Hilbert ou Siegel ;

• Le chapitre 5 présente des bornes de degré et de hauteur (i.e. de taille de coefficients) pour les équations modulaires dans le cadre général des variétés de Shimura PEL ;

• Le chapitre 6 présente un algorithme d'évaluation des équations modulaires de Hilbert et de Siegel pour les surfaces abéliennes via des approximations complexes.

Les chapitre 2 présente les espaces de modules de variétés abéliennes et les équations modulaires, et est nécessaire pour la suite de la thèse. Le chapitre 4 donne des résultats reliant la hauteur d'une fraction rationnelle à celles de ses évaluations, et est nécessaire pour le chapitre 5.

Enfin, le chapitre 7 combine les résultats précédents et les applique au problème du comptage de points. Nous obtenons en particulier un algorithme de comptage pour les surfaces abéliennes principalement polarisées à multiplication réelle (fixée) qui est, sous heuristiques et à facteurs constants près, de même complexité asymptotique que l'algorithme SEA pour les courbes elliptiques.

Ces résultats ont donné lieu à des prépublications : [KPR19, [START_REF] Kieffer | Height bounds for polynomial and rational fractions from their values[END_REF][START_REF] Kieffer | Degree and height estimates for modular equations on PEL Shimura varieties[END_REF] et [START_REF] Kieffer | Evaluating modular polynomials in genus two[END_REF] correspondent approximativement aux chapitres 3, 4, 5 et 6 respectivement. Le chapitre 6 reprend également une partie des résultats l'article [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF] à paraître. La suite de ce résumé présente les résultats principaux des différents chapitres.

Chapitre 3 : Calcul d'isogénies entre surfaces abéliennes

Ce chapitre étend l'algorithme de calcul d'isogénies à partir des polynômes modulaires, connu dans le cas des courbes elliptiques, au cas des surfaces abéliennes principalement polarisées avec ou sans multiplication réelle. Présentons ici le second cas : on s'intéresse, pour un premier , à calculer une -isogénie ϕ (de degré 2 ) entre deux surfaces abéliennes principalement polarisées A et A . Soit A 2 l'espace de modules correspondant ; il est birationnel à P 3 , et son corps des fonctions est engendré par les trois invariants d'Igusa notés j 1 , j 2 , j 3 . L'application de Kodaira-Spencer relie les déformations possibles de l'isogénie ϕ, qui se calculent à l'aide des équations modulaires de Siegel et de leurs dérivées, à l'application dϕ : T 0 (A) → T 0 (A ) induite par ϕ sur les espaces tangents à A et A en zéro.

Nous explicitons cette application de Kodaira-Spencer dans le cas des Jacobiennes de courbes de genre 2 : concrètement, une formule explicite permet d'évaluer certaines fonctions modulaires de Siegel vectorielles, les dérivées des invariants d'Igusa, en termes des coefficients d'une équation de courbe hyperelliptique de genre 2. Le résultat suivant en découle.

Théorème 1. Soit un nombre premier, et soit k un corps de caractéristique 0 ou > 8 + 7. Soit U l'ouvert de A 2 formé des surfaces abéliennes A sans automorphismes supplémentaires et telles que j 3 (A) = 0. On suppose qu'il existe un algorithme permettant d'évaluer les dérivées des équations modulaires de Siegel de niveau en un point de U × U sur k où elles sont définies, utilisant C eval ( ) opérations dans k. Soit ϕ : A → A une -isogénie définie sur k telle que A, A soient dans U et telle que la sous-variété de A 2 × A 2 définie par les équations modulaires soit normale en (A, A ). Alors, étant donnés les invariants d'Igusa de A et A , on peut calculer une représentation explicite de l'isogénie ϕ en utilisant O(C eval ( )) + O( ) opérations dans k.

Chapitre 4 : Hauteurs de fractions rationnelles et interpolation

Ce chapitre présente tout d'abord la notion de hauteur pour les polynômes et fractions rationnelles à coefficients dans un corps de nombres L. Cette quantité positive reflète la taille des coefficients. Par exemple, lorsque L = Q et F ∈ Q(X), on écrit F = P/Q avec P, Q ∈ Z[X] premiers entre eux ; alors la hauteur h(F ) de F est donnée par le maximum des log |c|, lorsque c parcourt les coefficients non nuls de P et Q.

Ce chapitre présente ensuite des résultats, nécessaires au chapitre 5, reliant la hauteur d'un polynôme ou d'une fraction rationnelle à la hauteur de ses évaluations en certains points ; cela permet de borner h(F ) lorsque F est une fraction rationnelle obtenue par interpolation, comme les équations modulaires. On considère ici des points d'évaluation x i entiers et (presque) consécutifs, on se donne H telle que h(F (x i )) ≤ H pour tout i, et l'on recherche en particulier des énoncés où h(F ) est bornée en O(H).

Théorème 2. Soit L un corps de nombres de degré d L sur Q, soit A, B un intervalle de Z, et notons D = B-A et M = max {|A| , |B|}. Soit F ∈ L(X) une fraction rationnelle de degré au plus d ≥ 1. Soit S ⊂ A, B ne contenant pas de pôle de F , soit η ≥ 1, et soit H ≥ max {4, log(2M )}. Supposons de plus que 1. h(F (x)) ≤ H pour tout x ∈ S. Chapitre 5 : Bornes de degré et de hauteur pour les équations modulaires Ce chapitre fournit des bornes de degré et de hauteur pour les équations modulaires dans le cadre général des variétés de Shimura PEL. On considère la variété de Shimura associée à un certain groupe réductif G et un choix de niveau, des composantes connexes S, T de cette variété, et un choix d'invariants sur ces composantes connexes. Les variétés algébriques S et T sont des espaces de modules pour les variétés abéliennes complexes munies d'une polarisation, d'endomorphismes, et d'une structure de niveau de types fixés.

Pour un élément adélique δ de G, les équations modulaires de niveau δ sont des fractions rationnelles multivariées définissant la correspondance de Hecke de niveau δ dans le produit S × T . Cette correspondance de Hecke décrit, au niveau des variétés abéliennes, un certain nombre d (δ) d'isogénies de degré noté l (δ). Nous montrons que le degré et la hauteur des équations modulaires de niveau δ est bornée en termes de d (δ) et l (δ).

Chapitre 6 : Évaluation des équations modulaires pour les surfaces abéliennes

Ce chapitre présente un algorithme d'évaluation des équations modulaires de Siegel et de Hilbert pour les surfaces abéliennes, ainsi que de leurs dérivées, en un point défini sur un corps de nombres (ou un corps fini, par relèvement). Cet algorithme est fondé sur des approximations complexes, et fait notamment intervenir le calcul rapide de certaines formes modulaires, les thêta-constantes en dimension deux.

Le calcul rapide de ces thêta-constantes repose classiquement sur deux heuristiques, à savoir la correction de certains choix de signes dans les formules de duplication, et la bonne convergence d'itérations de Newton. Un résultat auxiliaire de ce chapitre permet de lever la première heuristique : les choix de signes habitullement utilisés dans l'algorithme de calcul de thêta-constantes en dimension deux sont en effet corrects. La seconde ne pose pas de problèmes expérimentalement.

En dehors de ces heuristiques, l'utilisation de l'arithmétique d'intervalles permet de certifier les résultats obtenus par l'algorithme d'évaluation des équations modulaires. Un cas particulier s'énonce comme suit.

Théorème 4 (Sous heuristiques relatives au calcul rapide de thêta-constantes en dimension deux). Soit un nombre premier, et (j 1 , j 2 , j 3 ) ∈ Q 3 un triplet de hauteur O(1) où les dénominateurs des équations modulaires de Siegel de niveau ne s'annulent pas. Alors on peut évaluer ces équations modulaires et leurs dérivées en (j 1 , j 2 , j 3 ) en utilisant O( 6 ) opérations binaires.

Ce coût est à comparer au coût de stockage des équations modulaires sous forme de fractions rationnelles, que l'on estime de Θ( 15 log ) au vu des résultats du chapitre 5 : lorsque la dimension de l'espace de modules associé est au moins deux, le précalcul des équations modulaires ne semble pas la stratégie à adopter.

Dans le cas des équations modulaires de Hilbert, le coût de l'algorithme d'évaluation peut décroître jusqu'à O( 2 ) opérations binaires seulement. Dans ce cas, la manipulation des équations modulaires devient asymptotiquement négligeable devant le reste de l'algorithme de comptage de points.

Notation and conventions

Here we gather notations appearing in the thesis. When appropriate, we indicate the page where a more precise definition can be found.

We also adopt the following conventions concerning the words variety, degree, and lattice. Let k be a field.

• An algebraic variety over k is an integral (i.e. reduced and irreducible) separated scheme of finite type over k.

• The degree of a rational fraction F ∈ k(X) is max{deg(P ), deg(Q)}, where P, Q ∈ k(X) are coprime and F = P/Q. The degree of a polynomial P ∈ k[X 1 , . . . , X n ] is its total degree. The degree of a rational fraction F ∈ k(X 1 , . . . , X n ) is the maximum of the total degrees of its numerator and denominator.

• Let V be a finite-dimensional vector space over Q. A lattice in V is a subgroup of V (Q) generated by a basis of V over Q; a lattice in V (R) is a subgroup of V (R) generated by a basis of V (R) over R; if p is a prime number, a lattice in V (Q p ) is a subgroup of the form i∈I Z p e i where (e i ) i∈I is a basis of V (Q p ) over Q p ; and finally, a lattice in V (A f ) (see notation below) is a product of lattices in V (Q p ) for each p that are equal to V (Z p ) for all p but finitely many. Set of k-points of the algebraic variety V Ω 1 (V )

General notation

Vector space of global differential forms on V log + (x) log(max {1, x}), where x ∈ R f = O X g(n 1 , n 2 , . . .)

There exists C > 0 depending on X such that f (n 1 , n 2 , . . .) ≤ C max {1, g(n 1 , n 2 , . . .)} for all values of n 1 , n 2 , . . . ≥ 0 f = O X g(n 1 , n 2 , . . .)

There exist C, k > 0 depending on X such that f ≤ C max 1, g(n 1 , . . .) log + (g(n 1 , . . .)) k for all values of n 1 , n 2 , . . . ≥ 0 Chapter 1 Chapter 1

Introduction

This thesis is about higher-dimensional modular equations. These equations encode isogenies between polarized abelian varieties; from a geometrical point of view, they define subvarieties of certain moduli spaces consisting of pairs of isogenous abelian varieties.

The first examples of modular equations are the elliptic modular polynomials, which encode isogenies between abelian varieties of dimension 1, i.e. elliptic curves. Let ≥ 1 be a prime number. The elliptic modular polynomial of level , denoted by Φ ∈ Z[X, Y ], satisfies the following property: if k is an algebraically closed field of characteristic distinct from , and E, E are elliptic curves over k, then there exists an isogeny ϕ : E → E of degree if and only if the equality Φ (j (E), j (E )) = 0 holds, where j denotes the usual j-invariant.

This introductory chapter presents the construction of elliptic modular polynomials ( §1.1) before reviewing existing applications in algorithmic number theory and cryptography ( §1.2), in particular Elkies's method for counting points on elliptic curves over finite fields. Other examples of modular equations in dimension 2, i.e. for abelian surfaces, have also been computed, and we give an overview of the state of the art on this subject ( §1.3). Finally we present the plan of the thesis ( §1.4). Our contributions aim to generalize properties and algorithms from the case of elliptic modular polynomials to higher dimensions. Combining our results yields an asymptotically faster point-counting algorithm based on Elkies's method for principally polarized abelian surfaces with real multiplication.

Elliptic modular polynomials

Throughout this introduction, we assume familiarity with elementary properties of elliptic curves, as presented in Silverman's book [START_REF] Silverman | The arithmetic of elliptic curves[END_REF]. In particular, elliptic curves are algebraic curves, and can be defined over any field, such as finite fields. Over C, elliptic curves are identified with their sets of C-points, which are complex tori. We also assume familiarity with classical modular forms; see for instance [START_REF] Diamond | A first course in modular forms[END_REF][1][2].

Perhaps the easiest way to define elliptic modular polynomials is to work over C. We recall the necessary facts about the moduli space of complex elliptic curves in §1.1.1. Then we define the elliptic modular polynomials and list some of their properties in §1.1.2.

The moduli space of complex elliptic curves

Denote by H 1 the Poincaré upper half plane,

H 1 = {z ∈ C : Im(z) > 0} .
The elliptic modular group Γ(1) = SL 2 (Z) acts on H 1 on the left in the following way: if γ = ( With every τ ∈ H 1 , one associates the lattice Λ(τ ) = Z ⊕ τ Z ⊂ C and the complex elliptic curve E(τ ) = C/Λ(τ ). The map τ → E(τ ) induces a bijection between the quotient Γ(1)\H 1 and the set of isomorphism classes of complex elliptic curves. We say that Γ(1)\H 1 is a moduli space for complex elliptic curves.

The quotient Γ(1)\H 1 can be compactified by adding one point called the cusp. The resulting compactification, denoted by X(1), is the modular curve of level one over C. As every compact Riemann surface, X(1) is an algebraic curve over C. Rational functions X(1) → C are identified with modular functions of weight zero and level Γ(1) on H 1 .

An isomorphism X(1) P 1 is given by the j-invariant τ → j (τ ). Consider the theta constants θ 0 , θ 1 : H 1 → C defined as follows:

θ 0 (τ ) = n∈Z exp(πiτ n 2 ), θ 1 (τ ) = n∈Z (-1) n exp(πiτ n 2 ).
Then the j-invariant is defined by j = 256 (θ 8 0 -θ 4 0 θ 4 1 + θ 8 1 ) 3 θ 8 0 θ 8 1 (θ 4 0 -θ 4 1 ) 2 .

(1.2)

In particular, the j-invariant generates the function field of X(1) over C. Therefore every modular function of weight zero and level Γ(1) can be expressed as a rational function in j with coefficients in C. On X(1), the j-invariant has only one pole located at the cusp; therefore one can consider the j-invariant as a quantity attached to elliptic curves, with the property that two complex elliptic curves have equal j-invariants if and only if they are isomorphic.

Far-reaching generalizations of the modular curve X(1) are given by the PEL Shimura varieties of finite level (see chapter 2). PEL Shimura varieties are moduli spaces for abelian varieties with certain polarization, endomorphism, and level structures. They provide a convenient unified language to study higher-dimensional modular equations.

Elliptic modular polynomials

Recall that an isogeny ϕ : E → E between complex elliptic curves is a surjective morphism with finite kernel. The degree of ϕ is its degree as a rational map; and the kernel of ϕ is its kernel as a group morphism from E(C) to E (C), which has cardinality deg(ϕ).

Let us restrict to isogenies of prime degree; every isogeny is a composition of these. If an isogeny ϕ has prime degree , then the kernel of ϕ is a cyclic group isomorphic to Z/ Z; we say that ϕ is an -isogeny. For every τ ∈ H 1 , the identity map on C induces an -isogeny E(τ ) → E(τ / ). Moreover every -isogeny over C is isomorphic to an isogeny of this form.

One can check that the function τ → j (τ / ) is a modular function of weight zero for the congruence subgroup

Γ 0 ( ) = {( a b c d ) ∈ SL 2 (Z) : b = 0 mod } (1.3)
of Γ(1). Therefore, for every τ ∈ H 1 , the polynomial

P (τ ) = γ∈Γ 0 ( )\Γ(1) Y -j 1 γτ ∈ C[Y ]
is well-defined. The roots of P (τ ) are the j-invariants of all elliptic curves that are -isogenous to E(τ ); more precisely, the roots of P (τ ) counted with multiplicities are the j-invariants of the elliptic curves of the form E(τ )/K, where K runs through the + 1 cyclic subgroups of the -torsion subgroup E(τ )[ ].

One checks that the coefficients of P are modular functions of weight zero and level Γ(1) with poles at the cusp only. Therefore, there exists a polynomial Φ ∈ C[X, Y ] such that for every τ ∈ H 1 , we have Φ (j (τ ), Y ) = P (τ ) = γ∈Γ 0 ( )\Γ(1) Y -j 1 γτ .

(1.4)

This bivariate polynomial Φ is the elliptic modular polynomial of level .

Let us list some of its properties.

1. The coefficients of Φ lie in fact in Z: one way to see this is to show that the Fourier expansions of the coefficients of P have integer coefficients [START_REF] Cox | Primes of the form x 2 + ny 2[END_REF]Thm. 11.18 (i)].

2. The polynomial Φ is symmetric in X and Y . This comes from the existence of the dual isogeny: for every -isogeny ϕ : E → E , the dual of ϕ is an -isogeny E → E [Cox13, Thm. 11.18 (iii)].

3. The degree of Φ is + 1 in both variables. Indeed, its degree in Y is [Γ(1) : Γ 0 ( )] = + 1, and Φ is symmetric.

4. Define the height of Φ , denoted by h(Φ ), as follows: h(Φ ) is the maximum value of log |c|, where c runs through the nonzero coefficients of Φ . Then, as grows to infinity, we have h(Φ ) ∼ 6 log .

This asymptotic result was first proved by Cohen [START_REF] Cohen | On the coefficients of the transformation polynomials for the elliptic modular function[END_REF], and explicit bounds from above for h(Φ ) are also known [START_REF] Bröker | An explicit height bound for the classical modular polynomial[END_REF][START_REF] Pazuki | Modular invariants and isogenies[END_REF].

5. Let k be an algebraically closed field of characteristic distinct from , and let E, E be two elliptic curves over k. Then the equality Φ (j (E), j (E )) = 0 holds if and only if E and E are -isogenous over k. By construction, this property holds true over C, and extends to every characteristic zero field by Lefschetz's principle (every field k that is finitely generated over Q embeds in C) [START_REF] Silverman | The arithmetic of elliptic curves[END_REF]§VI.6]. The general argument uses the language of moduli schemes: one invokes the smoothness of the moduli space of elliptic curves with level structure over Z[1/ ] [DR73, §IV, Thm. 2.5] to lift -isogenies from k to characteristic zero.

Given the above bounds on the degree and height of Φ , the cost of storing Φ on a computer is O( 3 log ). This becomes quickly too large to fit Φ on a page, but is reasonable enough to store large databases of these polynomials: for instance, Sutherland [Sut] has a database of all elliptic modular polynomials of prime levels up to 1000. As an example, we have

Φ 2 (X, Y ) = X 3 -X 2 Y 2 + 1488X 2 Y -162000X 2 + 1488XY 2 + 40773375XY + 8748000000X + Y 3 -162000Y 2 + 8748000000Y -157464000000000.
Several methods are available to compute elliptic modular polynomials in quasi-linear time in their size. One method consists in computing complex approximations of its coefficients using eq. (1.4) [START_REF] Enge | Computing modular polynomials in quasi-linear time[END_REF]. An essential subroutine of this algorithm is to compute theta constants, and hence the j-invariant by eq. (1.2), in quasi-linear time: for every precision N ≥ 1 and every τ ∈ H 1 lying in a certain fundamental domain for SL 2 (Z), the theta-constants θ 0 (τ ), θ 1 (τ ) can be computed up to an error of 2 -N in quasilinear time in N [START_REF] Dupont | Fast evaluation of modular functions using Newton iterations and the AGM[END_REF]. Another method to compute Φ consists in using the Chinese remainder theorem (CRT), and computing Φ modulo several prime numbers p by generating sufficiently many pairs of -isogenous curves over F p [START_REF] Bröker | Modular polynomials via isogeny volcanoes[END_REF]. Both methods are suitable to evaluate Φ (x 0 , Y ), for a given x 0 in a finite field or number field; the CRT method even achieves memory improvements in this case [START_REF] Sutherland | On the evaluation of modular polynomials[END_REF].

Other kinds of modular polynomials for elliptic curves can be defined, using other modular functions than the j-invariant, for example the Weber f -function, whose congruence subgroup has index 24 in SL 2 (Z). Their heights are smaller by a constant factor (see [START_REF] Enge | Comparing invariants for class polynomials of imaginary quadratic fields[END_REF] for an explanation of this phenomenon in the case of class polynomials of imaginary quadratic fields), but the asymptotic complexity of manipulating them is similar.

Algorithmic applications

This section presents several algorithms using elliptic modular polynomials. We focus on elliptic curves over finite fields, although some of the algorithms also apply to other base fields or rings. Let p be a prime number, and let q = p r be a power of p.

Let E be an elliptic curve over the finite field F q , and let = p be a prime. A direct use of the elliptic modular polynomial of level is to compute all elliptic curves (up to isomorphism) that are -isogenous to E: one computes the roots of Φ (j(E), Y ) ∈ F q [Y ], using for instance the Cantor-Zassenhaus algorithm [vG13, §14]. The polynomial Φ can also be used to compute isogenies: given two -isogenous elliptic curves E, E over F q , an algorithm of Elkies [START_REF] Elkies | Elliptic and modular curves over finite fields and related computational issues[END_REF] recovers an -isogeny ϕ : E → E as an explicit rational map, at least when p is large with respect to and E, E are sufficiently generic. Elkies's algorithm is an essential part of the SEA point counting algorithm for elliptic curves over finite fields [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF]. Note that Elkies's algorithm has a converse: given a cyclic subgroup K ⊂ E(F q ) of order , one can compute an equation for the elliptic curve E/K as well as rational fractions describing the -isogeny E → E/K using Vélu's formulae [START_REF] Vélu | Isogénies entre courbes elliptiques[END_REF].

The first part of this section presents the point counting problem and the SEA algorithm, starting with Schoof's algorithm ( §1.2.1), then presenting Elkies's improvement ( §1.2.2). The second part discusses other applications of modular polynomials in algorithmic number theory ( §1.2.3) and cryptography ( §1.2.4).

Schoof's point counting algorithm

The point counting problem for elliptic curves is the following: given an elliptic curve E over F q , compute # E(F q ). Counting points has applications in cryptography (see §1.2.4), and also in algorithmic number theory, for instance to compute Euler factors of L-functions attached to elliptic curves. Schoof's algorithm solves the point counting problem in polynomial time in log(q).

Let π E be the Frobenius endomorphism of E, and consider its characteristic polynomial [Sil09, §V, Thm. 2.3.1]:

χ E = X 2 -t E X + q ∈ Z[X],
where t E ∈ Z is the trace of Frobenius. If we consider Z as a subset of End(E), the polynomial

χ E is equal to (X -π E )(X -π E ) where π E denotes the dual of Frobenius; hence χ E (π E ) = 0. Computing χ E is equiv- alent to computing # E(F q ) since #E(F q ) = q + 1 -t E .
The Weil conjectures, in this case Hasse's theorem [Sil09, §V, Thm. 2.4], state that the roots of χ E in C all have absolute value √ q. Therefore the Hasse bound holds:

|t E | ≤ 2 √ q.
(1.5)

Schoof's algorithm [START_REF] Schoof | Elliptic curves over finite fields and the computation of square roots mod p[END_REF] computes t E mod for a series of distinct prime numbers = p, then recovers t E ∈ Z using the Chinese remainder theorem and eq. (1.5). The trace t E is recovered uniquely as soon as the product of 's is greater than 4 √ q. By the prime number theorem, this bound can be reached using O(log q) prime numbers ∈ O(log q).

Let us now turn to the computation of t E mod , where = p is a prime number. Let

T (E) = lim ← - n→∞ E[ n ]
be the -adic Tate module of E, which is a free Z -module of rank 2.

Then χ E , seen as a polynomial with coefficients in Z , is the characteristic polynomial of π E seen as an automorphism of T (E) [Sil09, §III, Prop. 8.6].

In particular, t E mod is the unique element t ∈ Z/ Z satisfying the relation t π

E (P ) = π 2 E (P ) + qP (1.6)
for every -torsion point

P ∈ E[ ](F q ).
One usually avoids computing all -torsion points on E, and rather tests eq. (1.6) on the formal -torsion point P 0 with coefficients in the coordinate ring of E[ ]\{0}. One computes π E (P 0 ), π 2 E (P 0 ) and qP 0 using square-and-multiply algorithms, the latter using the addition law on E, for instance [Sil09, §II, Alg. 2.3]. Using asymptotically fast algorithms for polynomial multiplication [vG13, §8-9], the cost of finding t E mod is then O( 2 log q) operations in F q . The 2 factor comes from the degree of defining equations for E[ ]\{0}; in other words this 2 stands for the order of the subgroup of E used to compute t E mod . Overall, the complexity of Schoof's algorithm is O(log 5 (q)) binary operations.

Elkies's method and the SEA algorithm

Let = p be an odd prime number. Given Weierstrass models of twoisogenous elliptic curves E, E over F q , E :

x 2 = y 3 + ax + b, E : y 2 = x 3 + a x + b ,
Elkies's algorithm [START_REF] Elkies | Elliptic and modular curves over finite fields and related computational issues[END_REF] attemps to compute an -isogeny ϕ : E → E as an explicit rational map. For simplicity, assume that the polynomial Φ (j (E), Y ) has simple roots over F q , and that E and E have no extra automorphisms. Then Elkies's algorithm succeeds as soon as p > 4 -1.

The result yields an equation for the subgroup ker(ϕ) of E[ ], which is defined over F q and cyclic of order .

In the context of Schoof's algorithm, assume that the discriminant of χ E is a nonzero square modulo . Then the endomorphism π E restricted to E[ ] diagonalizes over Z/ Z: in some basis of E[ ], the matrix of π E is of the form λ 0 0 µ for some distinct eigenvalues λ, µ ∈ (Z/ Z) × such that λµ = q. There are exactly two cyclic subgroups of E[ ] which are stable under π E , i.e. defined over F q . Assume, as above, that Φ (j (E), Y ) has only simple roots over F q . Then Elkies's method to compute t E mod is the following:

1. Compute the two roots α, β of Φ (j (E), Y ) belonging to F q ;

2. Construct an elliptic curve E over F q such that j (E ) = α;

3. Compute the kernel of an -isogeny ϕ : E → E using Elkies's algorithm;

4. Compute the eigenvalue of π E on ker(ϕ), say λ;

5. Output t E = λ + q/λ mod .

Step 4 uses the formal point of ker(ϕ)\{0} in a similar way to Schoof's algorithm; it costs O( log q) operations in F q since ker(ϕ) has order , and dominates the rest of the algorithm. Heuristically, Elkies's method applies for about half of the auxiliary primes , called Elkies primes. If enough Elkies primes can be found, then the resulting point-counting algorithm has a complexity of O(log 4 (q)) binary operations. It is known that enough Elkies primes can be found on average, when considering either all elliptic curves over F q [START_REF] Shparlinski | On the distribution of Atkin and Elkies primes[END_REF], or (under the generalized Riemann hypothesis) the reductions of a given elliptic curve E defined over Q modulo primes [START_REF] Shparlinski | On the distribution of Atkin and Elkies primes for reductions of elliptic curves on average[END_REF].

The Schoof-Elkies-Atkin (SEA) point counting algorithm [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF] adds a number of practical improvements to Elkies's method, and has the same asymptotic complexity. In particular, Atkin's method consists in studying the factorization patterns of Φ (j (E), Y ) to obtain partial information about t E mod . This information is used in an exponential-time sieve which reduces the number of Elkies primes to consider. Other improvements consist in using chains of -isogenies [START_REF] Fouquet | Isogeny volcanoes and the SEA algorithm[END_REF], or even Schoof's method, to compute t E modulo powers of when is small.

Let us now describe Elkies's isogeny algorithm. Fixing Weierstrass models specifies differential forms ω, ω on E, E respectively, defined by the formula dx/2y [Sil09, §III.1]. By duality, the Weierstrass models define bases of the tangent spaces T 0 (E), T 0 (E ) of E and E at the neutral point. The tangent map dϕ :

T 0 (E) → T 0 (E ),
when written in these bases, is a scalar c ∈ F × q called the normalization factor of ϕ. We have ϕ * ω = cω.

If c is known, then one can write differential equations satisfied by the rational functions defining ϕ [START_REF] Bostan | Fast algorithms for computing isogenies between elliptic curves[END_REF]. These equations can be solved in power series using Newton iterations: computing n terms of the solutions costs O(n) operations in F q . Elkies's algorithm concludes with a rational reconstruction step using the extended Euclidean algorithm [vG13, §12.3]. The degrees of the rational fractions describing ϕ are in O( ), hence the cost of Elkies's algorithm once c is determined is O( ) operations in F q .

The assumption that p > 4 -1 appears since one has to perform divisions by 2, 3, . . . , 4 -1 during the Newton iterations.

Computing the normalization factor c involves explicit formulae about modular functions, in particular the derivative j := 1 2iπ dj dτ of the j-invariant, which is a modular function of weight 2. Assume, for the moment, that E, E are defined over C. Then, given a modular function f of weight k, the quantity f (E, ω) is well-defined: choose τ ∈ H 1 and an isomorphism η :

E ∼ -→ E(τ ), let ω(τ ) be the differential form given by 2πi dz on E(τ ) = C/Λ(τ ), let r ∈ C × be such that η * ω(τ ) = rω, and set f (E, ω) = r k f (τ ),
which is indeed independent of τ and η. The classical theory of complex elliptic curves [Sil09, §VI.1] gives the equalities

E 4 (E, ω) = -48a, E 6 (E, ω) = 864b,
where E 4 and E 6 denote the normalized Eisenstein series of weights 4 and 6 respectively. Moreover

j (E, ω) = - E 6 (E, ω) E 4 (E, ω) j(E) = 2 9 3 5 a 2 b 4a 3 + 27b 2 .
(1.7)

Since E, E are -isogenous over C, there exists a τ ∈ H 1 and a commu-

tative diagram E E E(τ ) E(τ / ). ϕ η η z →z
where η, η are isomorphisms. Let r, r ∈ C × such that

η * ω(τ ) = rω, η * ω(τ / ) = r ω(τ ).
Then the normalization factor of ϕ is c = r r -1 . The crucial equality comes from differentiating the relation Φ j (τ ), j (τ / ) = 0 with respect to τ :

∂ X Φ j (E), j (E ) j (τ ) + 1 ∂ Y Φ j (E), j (E ) j (τ / ) = 0,
where ∂ X and ∂ Y denote derivation with respect to X and Y in Z[X, Y ], respectively. Hence

c 2 ∂ X Φ j (E), j (E ) j (E, ω) + 1 ∂ Y Φ j (E), j (E ) j (E , ω ) = 0. (1.8)
Equation (1.8) is entirely algebraic, using eq. (1.7) to evaluate the modular function j . It is also valid when E, E are defined over F q ; a simple way to see this is to lift the isogeny ϕ to characteristic zero. Under our assumptions, the derivative of Φ with respect to Y does not vanish; moreover j (E , ω ) = 0 because E has no extra automorphisms. Therefore eq. (1.8) allows us to compute the normalization factor of ϕ up to sign, which is enough for the rest of Elkies's algorithm.

Recall that the modular polynomial Φ has degree O( ) in both variables X and Y , and height O( log ). Recall also that ∈ O(log q). Therefore, assuming that Φ has been precomputed, evaluating the derivatives of Φ at (j (E), j (E )) costs O( 2 ) operations in F q ; it is the most costly step in Elkies's isogeny algorithm, but is still dominated by root finding and Frobenius computations in the context of the SEA algorithm.

Other applications of modular polynomials

Besides Elkies's algorithm, elliptic modular polynomials have other algorithmic applications. To present them, it is convenient to introduce theisogeny graph G( , F q ), where = p is a prime. The vertices of G( , F q ) are elliptic curves defined over F q up to F q -isomorphism, and can be labeled by j-invariants in F q . Two vertices v 1 , v 2 are linked by an edge if and only if there exists an -isogeny between them. The graph G( , F q ) is undirected and without multiple edges. More generally, if L is a list of primes not containing p, we define G(L, F q ) as the superposition of the graphs G( , F q ) for ∈ L. A subscript E denotes the connected components of these graphs containing the elliptic curve E.

Kohel's thesis [START_REF] Kohel | Endomorphism rings of elliptic curves over finite fields[END_REF] shows that isogeny graphs of elliptic curves have a very particular shape. Let E be an elliptic curve over F q , and denote by O = End Fq (E) the ring of endomorphisms of E defined over F q . There are two possibilities, depending on the trace of Frobenius t E [Wat69, Thm. 4.1]:

1. If |t E | < 2
√ q, then O is isomorphic to an order in an imaginary quadratic field F ; this case includes all ordinary elliptic curves (for which t E is prime to p), and also all supersingular elliptic curves over F q when q is not a square.

If |t

E | = 2 √ q, then
O is isomorphic to a maximal order in a certain quaternion algebra.

In case 1, let ∆ be the discriminant of F = O ⊗ Q, and let ∆ be the Legendre symbol. Denote by Z F the ring of integers in F . Each vertex of G( , F q ) E can be given a depth, which is an integer between 0 and d max , the -adic valuation of

[Z F : Z[π E ]]. Each vertex of depth d is connected to • 1 vertex of depth d -1 and vertices of depth d + 1, if 0 < d < d max ; • 1 vertex of depth d -1, if 0 < d = d max ; • 1 + ∆ vertices of depth 0, if 0 = d = d max ; • 1 + ∆ vertices of depth 0 and -∆ of depth 1, if 0 = d < d max .
We say that G( , F q ) E is an -volcano; the vertices of depth zero form the crater or surface of the volcano, and vertices of depth d max form the floor.

A typical example is depicted on fig. 1.1. depth 0 depth 1 • • • • • • • • • • • • Fig. 1.1. An -volcano with = 3, d max = 1, and ∆ = 1.
In case 2, the graphs G( , F q ) E do not have a volcano structure. Instead, they have the Ramanujan property [START_REF] Pizer | Ramanujan graphs and Hecke operators[END_REF]: they are "optimal" expander graphs, therefore random walks in these graphs mix rapidly. Under the generalized Riemann hypothesis, one can also obtain expander graphs out of isogeny volcanoes, by considering the surface of G(L, F q ) E when L is sufficiently large [START_REF] Jao | Expander graphs based on GRH with an application to elliptic curve cryptography[END_REF].

The elliptic modular polynomial Φ allows us to navigate -isogeny graphs by computing all vertices adjacent to a given one. Various numbertheoretic algorithms rely on this fact. From now on, when k is a field and O is an imaginary quadratic order, we denote by Ell(O, k) the set of kisomorphism classes of elliptic curves over k whose ring of endomorphisms over k is isomorphic to O. [START_REF] Kohel | Endomorphism rings of elliptic curves over finite fields[END_REF]. Given the rigid structure of -volcanoes, one can compute the depth of a given vertex v in G( , F q ) by following three paths from v and stopping when one of them reaches the floor. If E is an elliptic curve over F q representing v, this depth equals the -adic valuation of Z F : End Fq (E) .

Computing depths

2. Finding isogeny chains [START_REF] Fouquet | Isogeny volcanoes and the SEA algorithm[END_REF]. In the SEA algorithm, if is a very small Elkies prime (say = 2 or 3), it is interesting to use a chain ofisogenies to compute the trace of Frobenius modulo r , where r is the length of the chain. Walking along the surface of the corresponding isogeny volcano allows us to compute chains of arbitrary lengths.

3. Explicit CM theory. Let O be an imaginary quadratic order, and assume that Ell(O, F q ) is nonempty. The theory of complex multiplication (CM) defines a simply transitive action of the class group Cl(O) on Ell(O, F q ) [Wat69, Thm. 4.5]. Let = p be a prime that splits in two distinct invertible O-ideals, = l 1 l 2 . Then, for every elliptic curve E ∈ Ell(O, F q ), the elliptic curves

[l 1 ] • E and [l 2 ] • E are the images of two -isogenies with domain E; all three elliptic curves E, [l 1 ] • E and [l 2 ] • E lie on the surface of G( , F q ) E .
Moreover, the actions of [l 1 ] and [l 2 ] can be distinguished by computing the Frobenius eigenvalue on the kernel of the corresponding -isogeny. Therefore the action of Cl(O) on Ell(O, F q ) can be computed explicitly, by walking along the surface of -isogeny volcanoes (using depth computations) and using Elkies's algorithm described in §1.2.2.

4.

Computing Hilbert class polynomials [START_REF] Sutherland | Computing Hilbert class polynomials with the Chinese remainder theorem[END_REF]. Let O be an imaginary quadratic order. The Hilbert class polynomial of O, denoted by H O , is a monic polynomial with coefficients in Z whose complex roots are the j-invariants of all the elements of Ell(O, C). It is a defining polynomial for the ring class field of O over F = O ⊗ Q. A possible strategy to compute H O is to compute it modulo several primes p and using the Chinese remainder theorem. The roots of H O mod p are given by the j-invariants of elements in Ell(O, F p ), and can be enumerated using the explicit CM action.

5.

Computing elliptic modular polynomials [START_REF] Bröker | Modular polynomials via isogeny volcanoes[END_REF][START_REF] Sutherland | On the evaluation of modular polynomials[END_REF]. Isogeny volcanoes can also be used to compute modular polynomials via interpolation and Chinese remainders, as mentioned in §1.1.2. For instance, knowing all the vertices of a graph G(3, F q ) E of the shape given in fig. 1.1 would allow us to reconstruct Φ 3 (X, Y ) mod p, by interpolating Φ 3 (x, Y ) for each j-invariant x on the surface, then Φ 3 (X, Y ).

In this algorithm, the vertices of G( , F q ) E are enumerated using the explicit CM action of ideals of small norms.

6.

Computing endomorphism rings of elliptic curves. Let E be an ordinary elliptic curve over F q . Computing #E(F q ) determines the endomorphism algebra of E; afterwards, walking in isogeny graphs gives additional information about the precise endomorphism ring of E over F q . For instance, if is a small prime, computing the depth of E in G( , F q ) E is an efficient way of determining the -adic valuation of the conductor of End Fq (E). For larger primes, one can use the explicit CM theory to rule out candidates for End Fq (E). Kohel [START_REF] Kohel | Endomorphism rings of elliptic curves over finite fields[END_REF] uses these observations to design an exponential-time algorithm (under the generalized Riemann hypothesis) for computing End Fq (E). A probabilistic subexponential time algorithm (under heuristics), using so-called smooth relations in ideal class groups, also exists [START_REF] Bisson | Computing the endomorphism ring of an ordinary elliptic curve over a finite field[END_REF].

Relevance to cryptography

The number-theoretic algorithms involving elliptic modular polynomials have applications in two areas of public-key cryptography. The first area is elliptic curve cryptography, which relies on the hardness of the discrete logarithm problem in the group E(F q ), where E is an elliptic curve over F q . The second area is isogeny-based cryptography, which relies on the hardness of finding paths in isogeny graphs. Elliptic curve cryptography is widespread in real life; isogeny-based cryptography is younger and less used in industry, but attracts interest because of its conjectured resistance to quantum attacks.

Elliptic curve cryptography.

Let G be a finite group of order n which is effective, in the sense that its elements can be encoded in a computer and the basic operations (multiplication, equality tests) can be performed algorithmically. Let g ∈ G and 0 ≤ a ≤ n -1. Then computing g a is easy: using a square-and-multiply algorithm, it can be done in O(log n) operations in G. Conversely, the discrete logarithm problem asks, given g ∈ G and h ∈ g , to compute a such that g a = h. For a generic group G, the best known classical algorithms to do so have complexity O( √ n), which is exponential in log n [START_REF] Pollard | A Monte Carlo method for factorization[END_REF]. This exponential complexity gap makes the discrete logarithm problem suitable for use in public-key cryptography.

Another computational problem closely related to discrete logarithms is the Diffie-Hellman problem: given g, g a , g b ∈ G, compute g ab . For a generic G, the best known classical algorithms to solve the Diffie-Hellman problem also are in O( √ n); but the problem becomes easy if one can com-pute discrete logarithms in G. The well-known Diffie-Hellman key exchange protocol [DH76], the first published example of a public-key cryptographic protocol, relies on the hardness of the Diffie-Hellman problem.

In concrete implementations, one has to choose a group G. In general, one should choose n = # G to be either prime or "almost" prime, in order to avoid generic attacks based on Chinese remainders [START_REF] Pohlig | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance[END_REF]. The idea of elliptic curve cryptography, introduced by Koblitz [Kob87] and Miller [START_REF] Miller | Uses of elliptic curves in cryptography[END_REF], is to take G = E(F q ) where E is an elliptic curve over F q . For a generic E, the best known classical algorithms to compute discrete logarithms in E(F q ) are in O( √ q). This compares favorably with the case of multiplicative groups of finite fields, where subexponential attacks are known [START_REF] Pomerance | Fast, rigorous factorization and discrete logarithm algorithms[END_REF]. We refer to [START_REF] Guillevic | Discrete logarithms. In Guide to Pairing-Based Cryptography[END_REF] for a review of the discrete logarithm problem, both in the generic and finite field cases.

Several algorithms are available to generate suitable elliptic curves, say of prime order. One can run the SEA algorithm (recall §1.2.2) on a family of candidates, for instance chosen at random, until finding one of prime order. Since the SEA algorithm computes #E(F q ) modulo small primes, one can abort the algorithm early if a small factor of #E(F q ) is detected. Another strategy is to use the CM method, first described in [START_REF] Atkin | Elliptic curves and primality proving[END_REF], which constructs elliptic curves such that #E(F q ) is completely determined, at the cost of some loss of control on q: if O is an imaginary quadratic order whose Hilbert class polynomial H O is known, and E is an elliptic curve over F q such that j (E) is a root of H O , then the trace of Frobenius of E is determined up to sign.

On the destructive side, isogenies can be used to attack the discrete logarithm problem on a given elliptic curve E: one tries to find an isogeny chain from E to another elliptic curve where the discrete logarithm problem is easier to solve [START_REF] Galbraith | Extending the GHS Weil descent attack[END_REF].

The discrete logarithm problem, even in generic groups, can be solved in polynomial time on a quantum computer by Shor's algorithm [START_REF] Shor | Algorithms for quantum computation: discrete logarithms and factoring[END_REF]. Therefore elliptic curve cryptography may become insecure as quantum computers develop.

Isogeny-based cryptography. Let G be a finite connected graph, let v 0 be a vertex of G, and assume that there exists an algorithm to compute the neighbors of a given vertex of G. If G has good expansion properties, then one can efficiently sample vertices in G with a close to uniform distribution by following random walks from v 0 . Conversely, given a random vertex v of G, finding a path from v 0 to v is a hard problem in general. Informally, isogeny-based cryptography relies on the hardness of this problem when G is an isogeny graph over a finite field: G can be either a supersingular graph of -isogenies for some fixed , or a superposition of isogeny cycles of different prime degrees. Isogeny-based primitives are one of the families of cryptographic proposals (along with, for instance, lattice-based or codebased primitives) that are conjectured to be quantum-resistant.

Examples of isogeny-based protocols are given by the Charles-Goren-Lauter hash function [START_REF] Charles | Cryptographic hash functions from expander graphs[END_REF], which uses a supersingular graph of 2isogenies; the SIDH key exchange protocol [START_REF] De Feo | Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies[END_REF], which uses supersingular graphs of 2-and 3-isogenies; and the CSIDH key exchange protocol [dKS18, CLM + 18], which uses a superposition of isogeny cycles for supersingular curves over a prime field F p . Isogeny-based cryptography is a very active research area, with recent cryptographic proposals such as verifiable delay functions [START_REF] De Feo | Verifiable delay functions from supersingular isogenies and pairings[END_REF] and digital signatures [dG19].

For performance reasons, these protocols rely on computing isogenies from their kernels using Vélu's formulae to navigate isogeny graphs, instead of finding roots of modular polynomials.

State of the art in higher dimensions

After elliptic curves, it is natural to study abelian varieties, which are by definition complete group varieties over a field; elliptic curves correspond to abelian varieties of dimension one. Abelian varieties are fundamental objects in algebraic geometry and number theory. They appear for instance in the study of algebraic curves: much information about a smooth algebraic curve of genus g can be obtained from its Jacobian, which is an abelian variety of dimension g. Abelian varieties have a very rich theory, that we do not develop here: we refer to [START_REF] Mumford | Abelian varieties[END_REF][START_REF] Milne | Abelian varieties[END_REF][START_REF] Milne | Jacobian varieties[END_REF], and [START_REF] Birkenhake | Complex abelian varieties[END_REF] for the complex theory.

Modular equations of Siegel and Hibert type

Just as elliptic modular polynomials encode -isogenies between elliptic curves for a fixed prime , higher-dimensional modular equations encode isogenies of a fixed type between abelian varieties. To define these modular equations, one works with moduli spaces of abelian varieties, for instance over C, as we did for elliptic curves in §1.1. In order to obtain well-behaved moduli spaces, one considers isomorphism classes of abelian varieties endowed with an additional structure called a polarization. A polarization on an abelian variety A is a certain equivalence class of ample line bundles on A; it can also be seen as an isogeny from A to its dual abelian variety A, and the polarization is called principal if this isogeny is an isomorphism.

In the dimension 2 case, i.e. for abelian surfaces, two moduli spaces are of particular interest.

1. The Siegel moduli space A 2 classifies principally polarized abelian surfaces. As an algebraic variety, A 2 can be defined over Q, and is birational to P 3 , by results of Igusa [START_REF] Igusa | On Siegel modular forms of genus two[END_REF]: in other words, isomorphism classes of principally polarized abelian surfaces are generically classified by three invariants. For each prime , the Siegel modular equations of level encode the presence of -isogenies between principally polarized abelian surfaces [START_REF] Bröker | Modular polynomials for genus 2[END_REF][START_REF] Milio | A quasi-linear time algorithm for computing modular polynomials in dimension 2[END_REF]; the degree of these isogenies is 2 .

2. Let F be a fixed quadratic field. The Hilbert moduli space A 2,F classifies principally polarized abelian surfaces with real multiplication by Z F , the ring of integers of F . As an algebraic variety, A 2,F has dimension 2. For each totally positive prime β ∈ Z F , the Hilbert modular equations of level β encode the presence of β-isogenies [START_REF] Martindale | Hilbert modular polynomials[END_REF][START_REF] Milio | Modular polynomials on Hilbert surfaces[END_REF]; the degree of these isogenies is

N F/Q (β).
In practice, one makes a choice of invariants on A 2 or A 2,F ; then the modular equations can be seen as explicit multivariate rational fractions. For instance, a standard choice of invariants on the Siegel moduli space A 2 is given by the three Igusa invariants, denoted by j 1 , j 2 , j 3 . The modular equations of Siegel type and level are given by three polynomials Ψ ,m ∈ Q(j 1 , j 2 , j 3 )[Y ] for 1 ≤ m ≤ 3, with the following property: there exist an open subvariety U of A 2 such that for every two points z, z of U(C), the equalities

     Ψ ,1 j 1 (z), j 2 (z), j 3 (z), j 1 (z ) = 0 ∂ X Ψ ,1 j 1 (z), j 2 (z), j 3 (z), j 1 (z ) • j 2 (z ) = Ψ ,2 j 1 (z), j 2 (z), j 3 (z), j 1 (z ) ∂ X Ψ ,1 j 1 (z), j 2 (z), j 3 (z), j 1 (z ) • j 3 (z ) = Ψ ,3 j 1 (z), j 2 (z), j 3 (z), j 1 (z )
hold if and only if the principally polarized abelian surfaces associated with z and z are -isogenous.

Several examples of modular equations for abelian surfaces have already been computed, but they tend to have frightening sizes due to their large number of variables, degrees, and heights. Writing down the Siegel modular equations uses approximately 1 MB for = 2, and approximately 410 MB for = 3; the computations for = 5 have not been carried out to our knowledge. As in the case of elliptic modular polynomials, one can consider variants of modular equations using invariants of abelian surfaces with level structure. For instance, Siegel modular equations in terms of theta constants in dimension 2 (instead of Igusa invariants) have smaller coefficients, and have been computed up to = 7 [Mil].

The most efficient algorithms to compute Siegel or Hilbert modular equations currently use complex approximations [START_REF] Milio | A quasi-linear time algorithm for computing modular polynomials in dimension 2[END_REF][START_REF] Milio | Modular polynomials on Hilbert surfaces[END_REF]. As in the elliptic case, an essential subroutine in these algorithms is to compute theta constants in quasi-linear time in the precision [START_REF] Dupont | Moyenne arithmético-géométrique, suites de Borchardt et applications[END_REF][START_REF] Labrande | Computing theta functions in quasi-linear time in genus 2 and above[END_REF].

Applications

In terms of applications, the literature on modular polynomials for abelian surfaces is much less developed than for their elliptic counterparts.

The point counting problem. Prior to this thesis, no generalization of Elkies's isogeny algorithm was known for abelian surfaces. In the literature, the asymptotically fastest point counting algorithms for abelian surfaces over finite fields are based on Schoof's method, which admits generalizations to abelian varieties of any dimension [START_REF] Pila | Frobenius maps of abelian varieties and finding roots of unity in finite fields[END_REF]. Schoof's method uses the action of Frobenius on kernels of endomorphisms of abelian varieties: multiplication by in the generic case [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF], and real multiplication if available [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF].

Atkin's point counting method, which studies the factorization patterns of modular equations, has also been generalized to dimension 2 [BGLG + 16], but this result does not affect the asymptotic complexity of point counting algorithms. Moreover, the complexity of this method has not been worked out, as no bounds from above for the degree and heights of modular equations for abelian surfaces appear in the literature.

Isogeny graphs. The structure of isogeny graphs of -isogenies between principally polarized abelian surfaces over F q can be quite intricate, but isogeny graphs of β-isogenies between ordinary principally polarized abelian surfaces with real multiplication are still volcanoes [START_REF] Brooks | Isogeny graphs of ordinary abelian varieties[END_REF][START_REF] Martindale | Isogeny graphs, modular polynomials, and applications[END_REF]. However, the chosen method to navigate isogeny graphs in dimension 2 is often to compute isogenies from their kernels using higher-dimensional analogues of Vélu's formulae instead of using modular equations; these formulae are available both for -and β-isogenies [LR12, CR15, CE15, DJRV17].

Given the current state of knowledge, there are several reasons for preferring to compute isogenies from their kernels: the complexity of manipulating modular equations is unclear, finding directions in isogeny graphs is hard due to the lack of explicit kernels, and the databases of precomputed modular equations are small. The drawback is that the kernel has to be computed in the first place, and computing the full -torsion subgroup of an abelian surface is costly.

Results and plan of the thesis

The contributions of this thesis aim to better understand modular equations in higher dimensions and algorithms using them. A particular focus is placed on modular equations of Hilbert and Siegel type for principally polarized abelian surfaces. In short, this thesis provides the three necessary ingredients to generalize Elkies's point counting method to the case of abelian surfaces:

1. An isogeny algorithm which, given isogenous abelian surfaces, computes an isogeny between them as an explicit rational map;

2. General complexity bounds for modular equations, i.e. height and degree bounds, in terms of their level;

3. An evaluation algorithm for modular equations and their derivatives.

Combining these results also shows that one can efficiently navigate isogeny graphs for abelian surfaces using modular equations. Let us now detail the contents of each chapter.

Chapter 2. We give an introduction to PEL Shimura varieties, which are moduli spaces for complex abelian varieties with specified polarization, endomorphism, and level structures. This formalism encompasses the different moduli spaces mentioned in chapter 1, and we detail its connection with the classical language of Siegel half spaces and modular forms. Adopting the language of Shimura varieties allows us to give a unified definition of modular equations, of which elliptic modular polynomials, and Siegel or Hilbert modular equations for abelian surfaces are special cases.

Chapter 3. This chapter presents an analogue of Elkies's isogeny algorithm in dimension 2 using modular equations of either Hilbert or Siegel type, and corresponds to the preprint [START_REF] Kieffer | Computing isogenies from modular equations in genus two[END_REF]. Let us present the Siegel case here: we want to compute an -isogeny ϕ between principally polarized abelian surfaces A and A . The Kodaira-Spencer map relates the possible deformations of ϕ, which can be computed from derivatives of Siegel modular equations, with the tangent map dϕ : T 0 (A) → T 0 (A ) induced by ϕ on the tangent spaces of A and A at zero. We make the Kodaira-Spencer map explicit in the case of Jacobians of genus 2 curves: concretely, an explicit formula yields the value of certain vector-valued Siegel modular functions, namely derivatives of Igusa invariants, in terms of the coefficients of a hyperelliptic curve equation. This explicit formula is the dimension 2 analogue of eq. (1.7) for the derivative of the j-invariant in the case of elliptic curves. The result is the following. Chapter 4. This chapters contains prerequisites to the results of chapter 5, and corresponds to the preprint [START_REF] Kieffer | Height bounds for polynomial and rational fractions from their values[END_REF]. The first part presents the notion of heights of polynomials and rational fractions over a number field. This nonnegative quantity reflects the size of the coefficients. For instance, if F ∈ Q(X), one can write F = P/Q where P, Q ∈ Z[X] are coprime; then the height h(F ) of F is the maximum of log |c|, where c runs through the nonzero coefficients of P and Q.

The second part presents results relating the height of a polynomial or rational fraction with the heights of its evaluations at certain points; this allows us to bound h(F ) from above when F is a rational fraction obtained from an interpolation process, and will be applied to modular equations in chapter 5. We take evaluation points to be (almost) consecutive integers x i , we are given H ≥ 0 such that h(F (x i )) ≤ H for every i, and we are particularly looking for results where h(F ) is in O(H).

Theorem 1.4.2. Let L be a number field of degree d L over Q, let A, B be an interval in Z, and write D = B -A and M = max {|A| , |B|}. Let F ∈ L(X) be a rational fraction of degree at most d ≥ 1. Let S be a subset of A, B containing no pole of F , let η ≥ 1, and let H ≥ max {4, log(2M )}. Moreover, assume that 1. h(F (x)) ≤ H for every x ∈ S.

S contains at least

D/η elements. 3. D ≥ max {ηd 3 H, 4ηdd L }. Then h(F ) ≤ H + C L ηd log(ηdH) + d log(2M ) + log(d + 1),
where C L is a constant depending only on L. One can take C Q = 960.

Chapter 5. This chapter gives degree and height bounds for modular equations in the general setting of PEL Shimura varieties in terms of their level. The associated preprint is [START_REF] Kieffer | Degree and height estimates for modular equations on PEL Shimura varieties[END_REF]. Let us use the notation of chapter 2: we consider the PEL Shimura variety associated with a certain reductive group G and a choice of level, connected components S, T of this Shimura variety, and a choice of invariants on these connected components. The algebraic varieties S and T are moduli spaces for complex abelian varieties with PEL structure.

Let δ be an adelic element of G. The modular equations of level δ are multivariate rational fractions defining the Hecke correspondence of level δ in the product S × T . In the modular interpretation, this Hecke correspondence describes a certain number d (δ) of isogenies of degree denoted by l (δ) between abelian varieties with PEL structure. We show that the degrees and heights of modular equations of level δ are bounded above in terms of d (δ) and l (δ).

Theorem 1.4.3. With the notation above, there exist constants C 1 and C 2 (independent of δ) with the following property. Let δ be an adelic element of G, and let F be a rational fraction obtained as a coefficient of one of the modular equations of level δ. Then the total degree of F is bounded above by C 1 d (δ), and the height of F is bounded above by C 2 d (δ) log l (δ).

In the case of Siegel modular equations of level for principally polarized abelian surfaces, we have d (δ) = 3 + 2 + + 1 and l (δ) = 2 . Thus the degree of Siegel modular equations of level is O( 3 ), and their height is O( 3 log ). In the case of elliptic modular polynomials, theorem 1.4.3 recovers Cohen's bounds [START_REF] Cohen | On the coefficients of the transformation polynomials for the elliptic modular function[END_REF] up to constant factors.

Chapter 6. This chapter corresponds to the preprint [START_REF] Kieffer | Evaluating modular polynomials in genus two[END_REF]. We present an evaluation algorithm for Siegel and Hilbert modular equations in dimension 2 and their derivatives at a given point defined over a number field. The algorithm also applies to finite fields, by considering lifts to characteristic zero. We use complex approximations, and rely on fast algorithms to compute theta constants in dimension 2.

Computing theta constants in dimension 2 in quasi-linear time in the demanded precision relies on two heuristics, namely the correctness of certain sign choices in duplication formulae, and the convergence of certain Newton iterations. An auxiliary result of this chapter removes the first heuristic: the sign choices usually made in the algorithm to compute theta constants are indeed correct. The complete proof appears in the accepted paper [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF]. The second heuristic is valid in practice.

Apart from the computation of theta constants, our evaluation algorithm for modular equations is made provably correct by a rigorous analysis of precision losses. In particular we obtain the following result.

Theorem 1.4.4 (Under heuristics relative to the computation of theta constants in dimension 2). Let be a prime, and let (j 1 , j 2 , j 3 ) ∈ Q 3 be a tuple of height O(1) where the denominators of Siegel modular equations of level do not vanish. Then one can evaluate these modular equations and their derivatives at (j 1 , j 2 , j 3 ) using O( 6 ) binary operations.

One should compare this cost to the cost of storing Siegel modular equations in full, which we estimate to be Θ( 15 log ) given the results of chapter 5: when the dimension of the associated moduli space is greater than one, evaluating modular equations on the fly seems superior to precomputing them.

In the case of Hilbert modular equations encoding β-isogenies where β has norm over Q, the cost of the evaluation algorithm can decrease to O( 2 ) binary operations only. If this happens in the context of Elkies's method, then manipulating modular equations becomes asymptotically negligible when compared to the rest of the point counting algorithm.

Chapter 7. We conclude this thesis by applying the results of all preceding chapters to the point counting problem for abelian surfaces. In particular, we obtain a heuristic point counting algorithm for principally polarized abelian surfaces over finite fields with real multiplication by a fixed real quadratic field F which, under heuristics and up to constant factors depending on F , has the same asymptotic complexity as the SEA algorithm for elliptic curves.

Chapter 2

Moduli spaces of abelian varieties and modular equations

Modular equations, such as the elliptic modular polynomials presented in §1.1, can be defined as equations relating certain modular functions defined on moduli spaces of abelian varieties. This chapter starts with reminders on abelian varieties ( §2.1), then presents the language of PEL Shimura varieties, which are moduli spaces for abelian varieties with certain polarization, endomorphism, and level structures ( §2.2). The moduli spaces that are used to define modular equations of Siegel and Hilbert type for abelian surfaces, namely the Siegel threefold and Hilbert surfaces, are special cases of PEL Shimura varieties ( §2.3). Using this language, we define modular equations in the general setting of PEL Shimura varieties as equations defining Hecke correspondences ( §2.4). The modular polynomials mentioned in chapter 1 are all special cases of this definition. This unified language will be useful in chapter 5, where we prove size bounds for all modular equations in terms of their level.

Reminders on abelian varieties

By definition, an abelian variety over a field k is a complete group variety over k. In order to study abelian varieties, we endow them with polarizations. Depending on the context, a polarization on A can be seen either as an isogeny from A to its dual abelian variety A, or as an equivalence class of ample line bundles on A. An important special case is that of principal polarizations, when the isogeny A → A is an isomorphism. Elliptic curves, as well as Jacobians of smooth curves in general, are canonically endowed with a principal polarization.

When k = C, it is possible to describe abelian varieties as complex tori of the form C g /Λ, where g ≥ 1 is the dimension and Λ ⊂ C g is a lattice. In this case we have an additional way of describing polarizations, namely as a symplectic form taking integer values on Λ.

Endowing an abelian variety A with a polarization yields a "positivity structure" on its endomorphism algebra, given by the Rosati involution. For instance, it makes sense to talk about real endomorphisms of A, i.e. endomorphisms that are invariant under the Rosati involution. Polarizations also allow us to classify isogenies: the notion of -isogenies between polarized abelian varieties is defined in terms of pullbacks of polarizations. Similarly, if O is an order in a totally real field F of degree g over Q, and β ∈ O is totally positive, then we can define the notion of β-isogenies between abelian varieties of dimension g with real multiplication by O.

References for this section are [START_REF] Mumford | Abelian varieties[END_REF][START_REF] Milne | Abelian varieties[END_REF][START_REF] Milne | Jacobian varieties[END_REF], and also [START_REF] Birkenhake | Complex abelian varieties[END_REF] for abelian varieties over C.

Abelian varieties and polarizations

Let g ≥ 1 be an integer, let k be a field, and let k be an algebraic closure of k. Let A, B be abelian varieties of the same dimension g over k.

Recall that a group variety over k is, by definition, an algebraic variety over k endowed with a k-rational neutral point and suitable morphisms defined over k encoding the group operations. Abelian varieties are smooth varieties [START_REF] Milne | Abelian varieties[END_REF]§1], and also abelian groups [Mil86a, Cor. 2.4]; we will use the additive notation. If x ∈ A(k), we denote by t x the translation by x: t x : A → A, y → y + x.

If x ∈ A(k), then this morphism is defined over k.

An isogeny A → B is a group morphism that has finite kernel (or equivalently, is surjective [Mil86a, Prop. 8.1]). For every integer n = 0, the multiplication-by-n map on A, denoted by [n] A , is an isogeny of degree n 2g [Mil86a, Thm. 8.2]. If n is prime to the characteristic of k, then the n-torsion subgroup A[n] := ker([n] A ) of A is an étale group scheme, and the group of its k-points is isomorphic to (Z/nZ) 2g .

Since A is smooth, there is a correspondence between line bundles and divisors on A. One can define three different notions of equivalence for line bundles on A defined over k. Recall that a line bundle L on A is very ample if the global sections of L define a projective embedding of A, and that L is ample if some positive power of L is very ample. Lefschetz's theorem [Mum70, §III.17] states that for every ample line bundle L on A, its third power L ⊗3 is very ample.

Two line bundles

The dual of A, denoted by A, is also an abelian variety of dimension g over k [START_REF] Milne | Abelian varieties[END_REF]§9]. There is a canonical bijection between A(k) and Pic 0 (A). For every line bundle L on A, the map

φ L : A → A, x → (t * x L) ⊗ L -1
is a group morphism by the theorem of the square [START_REF] Milne | Abelian varieties[END_REF]§6] A polarization on A is an isogeny ϕ : A → A such that there exists an ample line bundle L over A defined over k such that ϕ = φ L . A polarization is called principal if it is an isomorphism. In other words, a polarization on A is an algebraic equivalence class of ample line bundles on A, and we often make a choice of such a line bundle. Yet another way of looking at polarizations is to view ϕ as a symmetric correspondence on A × A.

Jacobians

If C is a smooth curve of genus g over k, then its Jacobian, denoted by Jac(C), is an abelian variety of dimension g defined over k [START_REF] Milne | Jacobian varieties[END_REF]. The k-points of Jac(C) are identified with linear equivalence classes of degree zero divisors on C. Let K be a divisor of degree g on C (for instance the canonical divisor, when g = 2). Then a generic divisor of degree zero on C can be written as

[P 1 + • • • + P g -K]
where P 1 , . . . , P g ∈ C(k) are uniquely determined up to permutation. This defines a birational map between the g-th symmetric power C <g> of C, which is also a smooth variety of dimension g, and the Jacobian variety Jac(C) [Mil86b, Thm. 5.1].

If P ∈ C(k), then we have an embedding

η P : C → Jac(C), Q → [Q -P ].
(2.1)

The morphism η P induces an isomorphism

η * P : Ω 1 (Jac(C)) → Ω 1 (C)
between the spaces of global differential forms on C and Jac(C). The isomorphism η * P does not depend on the choice of P , hence η * P is defined over k [Mil86b, Prop. 2.2]. The image η P (C) is a divisor on Jac(C), called the theta divisor ; its algebraic equivalence class does not depend on P . The associated line bundle is ample, and defines a canonical principal polarization on Jac(C) [START_REF] Milne | Jacobian varieties[END_REF]Thm. 6.6].

Example 2.1.1. Recall that an elliptic curve over k is a smooth curve of genus 1 endowed with a base point. An elliptic curve E is canonically isomorphic to its Jacobian, and therefore E is a principally polarized abelian variety of dimension 1. If 0 E denotes the neutral point of E, then L := L([0 E ]) (in the usual Riemann-Roch notation) is an ample line bundle such that φ L is the principal polarization of E. Since L ⊗3 is very ample, its global sections induce a projective embedding of E; we obtain the existence of Weierstrass models of E in this way.

In the case g = 2, every principally polarized abelian surface A over k is either isomorphic to the product of two elliptic curves with their canonical principal polarizations, or isomorphic to the Jacobian of a smooth genus 2 hyperelliptic curve over k [START_REF] Oort | Principally polarized abelian varieties of dimension 2 and 3 are Jacobian varieties[END_REF]. A hyperelliptic curve of genus g over k is the normalization of a plane curve with equation

y 2 = P (x)
where P is a polynomial of degree 2g + 1 or 2g + 2 with simple roots. If g = 3, then the threefold A is either the Jacobian of a plane quartic curve, the Jacobian of a genus 3 hyperelliptic curve, or a product of principally polarized abelian varieties of lower dimensions.

Abelian varieties over C

Every abelian variety A of dimension g over C is isomorphic to a complex torus of the form C g /Λ, where Λ ⊂ C g is a lattice, i.e. a discrete free abelian group of rank 2g [Mum70, §I.1]. A matrix whose columns generate such a lattice Λ is called a period matrix of A.

Conversely, every algebraizable complex torus is an abelian variety; this condition is not automatic, and holds if and only if the generating matrix of Λ satisfies certain symmetry and positivity conditions called the Riemann relations [BL04, §4.2]. One can deduce from these relations that every abelian variety of dimension g over C admits a period matrix of the form (I g τ ) where τ belongs to the Siegel upper half space H g , i.e. τ ∈ Mat g×g (C) is symmetric and Im(τ ) is positive definite.

Let A = C g /Λ be a complex abelian variety, and let L be a line bundle on A. Since the pullback of L to C g is trivial, the line bundle L can be described in terms of factors of automorphy for the lattice Λ; we refer to [BL04, §2.1-2.2] for the precise definition. Starting from any factor of automorphy of L, one can construct a real-valued alternating form ψ L on C g taking integer values on Λ. In fact, the alternating form ψ L can be identified with the first Chern class of L [BL04, Thm. 2.1.2], so that two line bundles on A are algebraically equivalent if and only if their associated alternating forms are equal. The form ψ L has the property that ψ L (iu, iv) = ψ L (u, v) for every u, v ∈ C g , and the line bundle L is a polarization if and only if the form (u, v) → ψ L (u, iv) is symmetric and positive definite [BL04, §4.1]. Conversely, if ψ is an alternating form on C g such that ψ(Λ, Λ) ⊂ Z and ψ(iu, iv) = ψ(u, v) for every u, v ∈ C g , then ψ is the first Chern class of a line bundle on A.

Let ψ be a polarization on A, seen as an alternating form. Then there exists a Z-basis of Λ in which the matrix of ψ takes the form

     (0) D 1 . . . Dg -D 1 . . . -Dg (0)     
for some positive integers D 1 | • • • |D g , uniquely determined by ψ. The tuple (D 1 , . . . , D g ) is called the type of the polarization ψ. The type of ψ can also be seen as the isomorphism class of the finite group Λ ⊥ /Λ, where

Λ ⊥ = {u ∈ C g : ∀v ∈ Λ, ψ(u, v) ∈ Z} .
The notion of polarization type can be extended to abelian varieties over any field k, at least when the degree of the polarization is prime to the characteristic of k.

Endomorphisms and isogenies

Let A be an abelian variety of dimension g over a field k endowed with a polarization φ : A → A. We denote by End(A) (resp. End k (A)) the ring of endomorphisms of A defined over k (resp. k). Scalar multiplications define an embedding Z → End k (A), and the ring End(A) is torsion-free. The endomorphism algebra of A is End 0 (A) := End(A) ⊗ Z Q.

The Rosati involution. The polarization φ defines a Rosati involution on the algebra End 0 (A) [START_REF] Milne | Abelian varieties[END_REF][START_REF] Bostan | Algorithmes efficaces en calcul formel[END_REF], defined formally as

f → f † := φ -1 • f • φ. An endomorphism f of A is called real if f † = f . The map L → φ -1 • φ L (2.2)
is a bijection between NS(A) ⊗ Q and the subspace End 0 (A) † of real endomorphisms of A [Mil86a, Prop. 17.2], carrying tensor product to addition. If φ is a principal polarization, then the Rosati involution leaves End(A) stable, and the map (2.2) is a bijection between NS(A) and End(A) † . In the case k = C, if we write A = C g /Λ, then endomorphisms of A are identified with endomorphisms of C g as a C-vector space (i.e. g × g matrices) leaving Λ stable; and the Rosati involution is adjunction with respect to the symplectic form ψ attached to the polarization [START_REF] Birkenhake | Complex abelian varieties[END_REF]§5].

The Rosati involution can be used to classify the possible endomorphism algebras of abelian varieties. The involution † is always a positive involution Isogeny types. Let (A, L) and (A , L ) be polarized abelian varieties; here we consider polarizations as line bundles. Let ≥ 1. We say that an isogeny ϕ : A → A is an -isogeny if ϕ * L is algebraically equivalent to L ⊗ ; equivalently, ϕ is an -isogeny if ϕ * L ∈ NS(A) corresponds to the real endomorphism ∈ End 0 (A) † under the bijection (2.2). An -isogeny has degree 2g . If A and A have dimension 1, we recover the usual notion of -isogenies between elliptic curves.

[Mum70, §21, Thm. 1]. Recall that if B is a finite-dimensional Q- algebra, a
When more endomorphisms are present, there are other isogeny types to consider. Let F be a totally real field of degree g over Q, and let O be an order in F . Let (A, L) and (A , L ) be principally polarized abelian varieties of dimension g, and assume that we are given real multiplication embeddings

ι : O → End(A) † , ι : O → End(A ) † .
We say that A, A have real multiplication by O. Let β ∈ O. We say that an isogeny ϕ : A → A is a β-isogeny if

• the line bundle ϕ * L ∈ NS(A) corresponds to the real endomorphism ι(β) ∈ End(A) † , and

• the isogeny ϕ is compatible with the real multiplication embeddings, in other words we have ϕ

• ι(α) = ι (α) • ϕ for every α ∈ O.
A necessary condition for a β-isogeny to exist is that β ∈ O is totally positive [DJRV17, Thm. 1.1].

The theory of PEL Shimura varieties

Motivating the definition

Consider the modular curve X(1), introduced in §1.1.1. It is a compactification of the quotient SL 2 (Z)\H 1 , where the modular group SL 2 (Z) acts on the upper half plane H 1 as in eq. (1.1). More generally, modular curves of higher level are obtained as compactifications of quotients of the form Γ\H 1 , where

Γ ⊂ SL 2 (Z) is a congruence subgroup. Recall that a subgroup Γ ⊂ SL 2 (Z) is congruence if it contains a subgroup of the form Γ(N ) = {γ ∈ SL 2 (Z) : γ = ( 1 0 0 1 ) mod N } , (2.3)
for some N ≥ 1. An example is given by the group Γ = Γ 0 ( ) where is a prime, defined by eq. (1.3).

A drawback of this classical definition is that it is not immediately clear what the generalizations of H 1 and SL 2 (Z) should be in order to obtain moduli spaces of abelian varieties of higher dimensions. The goal of this section is to present another way of defining modular curves which is better suited for generalization. Our presentation is heavily inspired by Milne [START_REF] Milne | Introduction to Shimura varieties[END_REF][4][5][6][7].

Another interpretation of H 1 . The action of SL 2 (Z) on H 1 is the restriction of a "larger" action by the group GL 2 (R) + consisting of all real 2 × 2 matrices with positive determinant. The action of GL 2 (R) + on H 1 is transitive. Let us fix i ∈ H 1 as a base point. The stabilizer of i in GL 2 (R) + is the subgroup

K ∞ = a b -b a : a, b ∈ R, (a, b) = (0, 0) ,
and we have a bijection

GL 2 (R) + /K ∞ H 1 , γ → γi.
As a quotient of Lie groups, GL 2 (R) + /K ∞ has a natural structure of a real differentiable manifold which corresponds to that of H 1 .

In turn, we can give an "intrinsic" definition of the subgroup K ∞ . By definition, the group GL 2 (R) + acts on the real vector space V (R) = R 2 (we think of V as the algebraic variety A 2 over Q, hence the notation). Moreover V (R) has a natural complex structure, meaning an endomorphism x 0 of V (R) such that x 0 • x 0 = -1: take

x 0 = ( 0 1 -1 0 )
in the canonical basis (e 1 , e 2 ) of V (R). We check the following facts.

1. The group GL 2 (R) + acts on the set of complex structures on V (R) by conjugation: if x is a complex structure on V (R) and γ ∈ G(R) + , we set γx

:= γ • x • γ -1 .
2. The stabilizer of x 0 under this action is K ∞ ; this is the intrisic definition of K ∞ we were looking for.

3. The orbit of x 0 under the action of GL 2 (R) + consists of all complex structures x = ( s t u v ) such that t > 0. To explain point 3, we define a symplectic form ψ on V by setting ψ(e 1 , e 2 ) = -1.

Then the complex structure x 0 is positive for ψ, meaning that the bilinear form defined by (u, v) → ψ(u, x 0 (v)) on V (R) × V (R) is symmetric and positive definite; indeed, its matrix in the canonical basis is the identity. The action of GL 2 (R) on V is compatible with ψ, in the sense that for every γ ∈ GL 2 (R), there exists λ ∈ R × such that ∀u, v ∈ V (R), ψ(γu, γv) = λψ(u, v).

Therefore, if we set x = γx 0 , the bilinear form (u, v) → ψ(u, x(v)) is still symmetric. Moreover, GL 2 (R) + is connected: therefore, if γ ∈ GL 2 (R) + , we have λ > 0 and hence the symmetric bilinear form ψ(u, x(v)) is positive definite. The point 3 above states that the orbit of x 0 under GL 2 (R) + consists of all complex structures on V (R) that are positive for ψ.

Turning things around, we start from the vector space V endowed with the symplectic form ψ; we define G = GL 2 as the algebraic group of automorphisms of V that are compatible with ψ; and we fix a complex structure x 0 on V (R) that is positive for ψ. Then the upper half plane H 1 , with its usual action of GL 2 (R) + , is identified with the orbit of x 0 under the action of GL 2 (R) + by conjugation.

Another interpretation of congruence subgroups. The definition of congruence subgroups of SL 2 (Z) also seems rather arbitrary: why consider the subgroups Γ(N ) in the first place? In fact, these subgroups arise naturally when working with adeles.

Let P Q denote the set of prime numbers. Recall that the ring of finite adeles A f of Q is defined as a restricted product over P Q :

A f = p∈P Q (Q p ; Z p ), (2.4)
where Q p and Z p denote the field of p-adic numbers and the ring of padic integers, respectively. The elements of A f are tuples (x p ) p∈P Q such that x p ∈ Q p for all p, and x p ∈ Z p for all p but finitely many. The ring A f is endowed with the adelic topology: a basis of neighborhoods of 0 ∈ A f consists of open sets of the form p U p , where U p ⊂ Q p is an open set containing 0, and U p = Z p for every p but finitely many. If G is any affine algebraic group over Q (for instance G = GL 2 ), we can define G(A f ) as a topological group. To do so, choose a closed immersion η of G in an affine space A n Q , for some n ≥ 1. This choice allows us to define G(Z) η and G(Z p ) η for every prime p, as the sets of solutions in Z (resp. Z p ) of the equations defining G; these sets depend on η, hence the subscript. Then we form the restricted product

G(A f ) η = p∈P Q G(Q p ) ; G(Z p ) η .
and we declare that a basis of neigborhoods of 1 ∈ G(A f ) η consists of products of the form p U p , where U p ⊂ G(Q p ) is an open set containing 1, and U p = G(Z p ) η for every p but finitely many.

If η is another choice of closed immersion of G into an affine space, then η(G) and η (G) are isomorphic over Q. Therefore they are isomorphic over Z[1/D], for some D ≥ 1. The subsets G(Z p ) η and G(Z p ) η of G(Q p ) are the same for every prime p not dividing D, therefore G(A f ) η = G(A f ) η as topological spaces. Thus G(A f ) is well defined.

We return to the special case G = GL 2 , and denote by GL 2 (Q) + the subset of GL 2 (Q) consisting of matrices with positive determinant. Recall the usual notation

Z = p∈P Q Z p = lim ← - n→∞ Z/nZ. Proposition 2.2.1. For every congruence subgroup Γ ⊂ SL 2 (Z), there exists a compact open subgroup K of GL 2 (A f ) contained in GL 2 ( Z) such that Γ = GL 2 (Q) + ∩ K. Conversely, for every compact open subgroup K of GL 2 (A f ) that is contained in GL 2 ( Z), the intersection GL 2 (Q) + ∩ K is a congruence subgroup of SL 2 (Z).
Proof. This is [START_REF] Milne | Introduction to Shimura varieties[END_REF]Prop. 4.1], with the additional remark that

GL 2 (Z) ∩ GL 2 (Q) + = SL 2 (Z).
In particular, we have SL 2 (Z) = GL 2 (Q) + ∩K 0 , with K 0 = GL 2 ( Z). We already know that the quotient SL 2 (Z)\H 1 can be rewritten as the double quotient SL 2 (Z)\ GL 2 (R) + /K ∞ , where K ∞ is the stabilizer of the complex structure x 0 on V (R).

Proposition 2.2.2. The map

SL 2 (Z)\ GL 2 (R) + /K ∞ → GL 2 (Q) + \ GL 2 (R) + × GL 2 (A f ) / K ∞ × K 0 γ → γ, ( 1 0 0 1 ) is a bijection.
Proof. First, we have to explain how the double quotient on the right is formed: K ∞ acts on GL 2 (R) + by multiplication on the right, K 0 acts on GL 2 (A f ) by multiplication on the right, and GL 2 (Q) + acts by multiplication on the left simultaneously on GL 2 (R) + and GL 2 (A f ). By [Mil05, Thm. 5.17 and Lem. 5.20] (the assumption that K is sufficiently small is not actually needed there; moreover SL 2 is simply connected as an algebraic group [START_REF] Milne | Algebraic groups[END_REF]Ex. 18.20]), the determinant induces a bijection

GL 2 (Q) + \ GL 2 (A f )/K 0 → det GL 2 (Q) + ) \ det GL 2 (A f ) / det(K 0 ) = Q × + \A × f / Z × .
From description of A f given in eq. (2.4), we see that

A × f = Q × + Z × . Therefore the double quotient Q × + \A × f / Z × is
trivial, and every element of GL 2 (R) + × GL 2 (A f ) has a representative of the form γ, ( 1 0 0 1 ) for some γ ∈ GL 2 (R) + modulo the action of GL 2 (Q) + and K 0 .

To conclude, we only have to show that for every γ, γ ∈ GL 2 (R) + , the pairs γ, ( 1 0 0 1 ) and γ , ( 1 0 0 1 ) are equal in the double quotient if and only if γ and γ are equal modulo SL 2 (Z). This is straightforward given

that SL 2 (Z) = GL 2 (Q) + ∩ K 0 .
Note that the double quotient on the right hand side of proposition 2.2.2 would make sense for algebraic groups other than GL 2 : we have succeeded in finding another definition of the quotient SL 2 (Z)\H 1 that is suitable for generalization. It remains to find out which algebraic groups give rise to moduli spaces of polarized abelian varieties.

The modular interpretation of SL 2 (Z)\H 1 . Finally, we take another look at the well-known fact that SL 2 (Z)\H 1 parametrizes isomorphism classes of elliptic curves over C. The elliptic curve associated with τ ∈ H 1 is E(τ ) = C/Λ(τ ), where Λ(τ ) = Z ⊕ τ Z. Consider the bijection

η τ : V (R)/Z 2 → C/Λ(τ ), e 1 → 1, e 2 → -τ.
Then, after simple computations with 2 × 2 matrices, we obtain: Proposition 2.2.3. Let γ ∈ GL 2 (R) + , and let τ = γi ∈ H 1 . Then the pullback under η τ of the multiplication-by-i map on C is the complex structure γx 0 on V (R).

In other words, we have a distiguished lattice Λ 0 = Z 2 ⊂ V (R); and for every complex structure x ∈ GL 2 (R) + /K ∞ , the elliptic curve associated with x is the quotient V (R)/Λ 0 , with x as a complex structure.

We can also describe the natural principal polarization of E(τ ). Recall that V is endowed with the symplectic form ψ such that ψ(e 1 , e 2 ) = -1. When restricted to Λ 0 × Λ 0 , the form ψ takes values in Z, and corresponds via η τ to the polarization of E(τ ).

In order to construct moduli spaces of polarized abelian varieties of higher dimensions, it is promising to start from a Q-vector space V of higher dimension, endowed with a symplectic form ψ and a complex structure x 0 that is positive for ψ, and to consider the algebraic group G of automorphisms of V compatible with this data (and possibly additional endomorphisms of V , if we want to classify abelian varieties with an endomorphism structure). Then we construct double quotients of the form

G(Q) + \ G(R) + × G(A f ) / K ∞ × K
where K ∞ is the stabiliser of x 0 , the subgroup K ⊂ G(A f ) is compact and open, and the "plus" subscripts encode some connectedness condition. We arrive at the definition of a PEL Shimura variety.

Simple PEL Shimura varieties of type (A) or (C)

We continue to follow Milne's exposition of the theory of Shimura varieties [START_REF] Milne | Introduction to Shimura varieties[END_REF], which is itself inspired from Deligne's presentation of Shimura's works [START_REF] Deligne | Travaux de Shimura[END_REF].

Notation. If G is a connected affine algebraic group over Q, then • G der is the derived group of G,

• Z is the center of G,

• G ad = G/Z is the adjoint group of G,

• T = G/G der is the largest abelian quotient of G,

• ν : G → T is the natural quotient map,

• G ad (R) + is the connected component of the identity in G ad (R) for the real topology,

• G(R) + is the preimage of G ad (R) + in G(R), and finally

• G(Q) + = G(Q) ∩ G(R) + .
Note that Z, G der , T and G ad are algebraic groups, i.e. exist as schemes. Defining them is not as direct as in the case of "abstract" groups. First, there exists a subgroup Z of G such that for every Q-algebra R, the group Z(R) is the center of the group G(R) [START_REF] Milne | Algebraic groups[END_REF]Prop. 1.92]. Then the quotient G ad exists by [START_REF] Milne | Algebraic groups[END_REF]Thm. 5.14], and has following property: if k is an algebraically closed field containing Q, then G ad (k) = G(k)/Z(k) [START_REF] Milne | Algebraic groups[END_REF]Prop. 5.47]. The group G der is defined as the smallest normal subgroup N of G such that G/N is commutative; G der can also be characterized as the subgroup of G generated by commutators [START_REF] Milne | Algebraic groups[END_REF]Prop. 6.18]. Finally, T is also defined as a scheme-theoretic quotient.

For instance, if G = GL 2 , we have G der = SL 2 ; Z = G m ; G ad = PGL 2 ; T = G m ; ν = det; and G(R) + , G(Q) + are the sets of real (resp. rational) 2 × 2 matrices with positive determinant. This coincides with the notation used in §2.2.1. PEL data. Let us introduce the data necessary to define a PEL Shimura variety. As indicated in §2.2.1, it consists of a Q-vector space V equipped with a symplectic form, certain endomorphisms, and a class of complex structures, that are "compatible" in a way. Following Milne [Mil05, §8], we start with the endomorphism algebra of V ; it is a finite-dimensional Qalgebra B endowed with a positive involution denoted by * . We also assume that B is simple, meaning that its only two-sided ideals are 0 and B.

The center F of B is a number field; let F 0 ⊂ F be the subfield of invariants under * . We make the technical assumption that B is either of type (A) or (C) [START_REF] Milne | Introduction to Shimura varieties[END_REF]Prop. 8.3]: this means that for every embedding θ of F 0 in an algebraic closure Q of Q, the algebra with positive involution (B ⊗ F 0 ,θ Q, * ) is isomorphic to a product of factors of the form, respectively,

(A) Mat n×n (Q) × Mat n×n (Q) with (a, b) * = (b t , a t ), or (C) Mat n×n (Q) with a * = a t .
Let (V, ψ) be a faithful symplectic (B, * )-module. In other words, V is a finite-dimensional Q-vector space equipped with a faithful B-module structure and a nondegenerate alternating Q-bilinear form ψ such that for all b ∈ B and for all u, v ∈ V , ψ(b * u, v) = ψ(u, bv).

(2.5)

Let GL B (V ) denote the group of automorphisms of V respecting the action of B, and let G be its (reduced) algebraic subgroup defined by

G(Q) = g ∈ GL B (V ) : ψ(gx, gy) = ψ(µ(g)x, y) for some µ(g) ∈ F × 0 .
The group G is affine, connected, and reductive, and its derived group is G der = ker(µ) ∩ ker(det) [START_REF] Milne | Introduction to Shimura varieties[END_REF]Prop. 8.7]. We warn the reader that our G is denoted by G 1 in [Mil05, §8 of the 2017 version]. In Milne's terminology, our G will define a Shimura variety (so that the results of [Mil05, §5] apply), but not strictly speaking a PEL Shimura variety. This choice of reductive group will allow us to consider more Hecke correspondences later on.

Let x be a complex structure on V (R), meaning an endomorphism of V (R) such that x 2 = -1. We say that x is positive for ψ if it commutes with the action of B and if the bilinear form (u, v) → ψ u, x(v) on V (R) is symmetric and positive definite. In particular, x ∈ G(R) and µ(x) = 1. Such a complex structure x 0 exists [START_REF] Milne | Introduction to Shimura varieties[END_REF]Prop. 8.14]. Define X + to be the orbit of x 0 under the action of G(R) + by conjugation. We call the tuple (B, * , V, ψ, G, X + ) a simple PEL Shimura datum of type (A) or (C), or simply a PEL datum. To simplify notations, we abbreviate PEL data as pairs (G, X + ), the underlying data (V, ψ) and (B, * ) being implicit.

Example 2.2.4. In the example V = Q 2 studied in §2.2.1, there were no endomorphisms of V to consider. This corresponds to taking B = Q with the involution * being the identity map; in this case (B, * ) is indeed a simple Q-algebra with positive involution of type (C). The bilinear form ψ satisfies eq. (2.5) by Q-linearity. All automorphisms of V respect the action of B, and the space of symplectic forms on Q 2 is one-dimensional, hence G = GL 2 . The rest of the definitions coincide with those of §2.2.1.

Remark 2.2.5. Let (G, X + ) be a PEL datum. One can show that the space X + is a hermitian symmetric domain [START_REF] Milne | Introduction to Shimura varieties[END_REF]Cor. 5

K (G, X + )(C) = G(Q) + \(X + × G(A f ))/K = G(Q) + \(G(R) + × G(A f ))/K ∞ × K. (2.6)
Actually, this quotient will be the set of C-points of the Shimura variety, hence the notation. In the first line of (2.6), the group G(Q) + acts on X + and G(A f ) by conjugation and left multiplication respectively, and K acts on G(A f ) by right multiplication. When the context is clear, we omit (G, X + ) from the notation. The set Sh K (C) is given the quotient topology obtained from the real topology on G(R) + and the adelic topology on G(A f ).

In order to describe Sh K (C) more explicitly, we study its connected components. The projection to the second factor induces a map with connected fibers from Sh K (C) to the double quotient Lem. 5.13]. Thus, the Shimura variety Sh K (C) has a natural structure of a complex analytic space, and is an algebraic variety by the theorem of Baily and Borel [START_REF] Milne | Introduction to Shimura varieties[END_REF]Thm. 3.12].

G(Q) + \G(A f )/K, which is finite [Mil05, Lem. 5.12]. Let C be a set of representatives in G(A f ) for this double quotient. The connected component S c of Sh K (C) indexed by c ∈ C can be identified with Γ c \X + , where Γ c = G(Q) + ∩ cKc -1 is an arithmetic subgroup of Aut(X + ) [Mil05,
Since G der is simply connected, by [Mil05, Thm. 5.17 and Lem. 5.20] (as above, the assumption that K is sufficiently small is not necessary), the map ν induces an isomorphism

G(Q) + \G(A f )/K ν(G(Q) + )\T (A f )/ν(K).
Therefore the set of connected components of Sh K (C) is a finite abelian group. Moreover, each connected component is itself a Shimura variety with underlying group G der [Mil05, Rem. 5.23].

A fundamental theorem states that the Shimura variety Sh K (G, X + ) exists as an algebraic variety defined over the reflex field E(G, X + ), which is a number field contained in C, depending only on the PEL datum [START_REF] Milne | Introduction to Shimura varieties[END_REF][12][13][14]. The field of definition of the individual connected components of Sh K (C) depends on K, and is a finite abelian extension of E(G, X + ).

Example 2.2.6. By §2.2.1, the modular curve X(1) = SL 2 (Z)\H 1 is the PEL Shimura variety associated with (G, X + ) = (GL 2 , H 1 ) and congruence subgroup K 0 = GL 2 ( Z), choosing the identity matrix as the unique element of C. Let us also recover the classical modular curves of higher level as special cases of PEL Shimura varieties.

Choose an integer N ≥ 1, and for every

p ∈ P Q , denote by v p (N ) the p-adic valuation of N . Let K N be the compact open subgroup of GL 2 (A f ) defined by K N = γ ∈ G(A f ) : ∀ p ∈ P Q , γ p ∈ GL 2 (Z p ) and γ p = ( 1 0 0 1 ) mod p vp(N ) .
It is a subgroup of GL 2 ( Z) defined by congruence conditions modulo the prime divisors of N .

If N > 1, then the group of connected components of Sh K N (C) is not trivial. Still, choosing the identity matrix as an element of C identifies one of the connected components of Sh K N (C) with the quotient Γ(N )\H 1 : indeed, by (2.3), we have

Γ(N ) = GL 2 (Q) + ∩ K N . This quotient is the classical modular curve X(N ) of level N ; one can check that X(N ) is defined over the cyclotomic field Q(ζ N ).

Modular interpretation of PEL Shimura varieties

Our motivation in constructing PEL Shimura varieties is to obtain moduli spaces of complex abelian varieties with polarization, endomorphism, and level structures. This modular interpretation of PEL Shimura varieties is usually formulated in terms of isogeny classes of abelian varieties (see for instance [START_REF] Milne | Introduction to Shimura varieties[END_REF]Thm. 8.17]). In order to obtain a modular intepretation in terms of isomorphism classes of abelian varieties in the spirit of [START_REF] Carayol | Sur la mauvaise réduction des courbes de Shimura[END_REF]§2.6], as in the case of elliptic curves, we fix

• A PEL datum (G, X + ),
• A lattice Λ 0 ⊂ V (see p. 14 for our conventions on lattices),

• A compact open subgroup K ⊂ G(A f ) which is assumed to stabilize the adelic lattice Λ 0 = Λ 0 ⊗ Z ⊂ V (A f ), • A set C ⊂ G(A f ) of representatives for the finite double quotient G(Q) + \G(A f )/K.
Finally, let O be the largest order in B stabilizing Λ 0 . As in §2.2.2, for every c ∈ C, we write Γ c = G(Q) + ∩ cKc -1 . We also denote by

S c = Γ c \X + the connected component of Sh K (G, X + )(C) associated with c.
The local-global principle for lattices holds: the map Λ → Λ = Λ ⊗ Z is a bijection between lattices in V and lattices in V (A f ), and its inverse is intersection with V (Q). The assumption that K stabilizes Λ 0 does not imply a loss of generality, because every compact open subgroup of G(A f ) stabilizes some lattice in V (A f ).

We define a polarized lattice to be a pair (Λ, φ) where Λ is a free Zmodule of finite rank and φ : Λ × Λ → Z is a nondegenerate alternating form. Given a polarized lattice (Λ, φ), we can extend φ to the Q-vector space Λ ⊗ Q, and we define

Λ ⊥ = {v ∈ Λ ⊗ Q : ∀w ∈ Λ, φ(v, w) ∈ Z}.
Then Λ ⊥ /Λ is a finite abelian group called the polarization type of (Λ, φ). We say that φ is a principal polarization on Λ if Λ ⊥ = Λ.

A modular interpretation in terms of lattices. Using the data above, we define a standard polarized lattice for each connected component of the Shimura variety Sh K (C), as follows.

Definition 2.2.7. For each c ∈ C, we define

Λ c = c( Λ 0 ), and Λ c = Λ c ∩ V (Q).
The action of c, or any other element of G(A f ), on adelic lattices is easily defined locally at each prime. Since c respects the action of B on V (A f ), the order O is again the stabilizer of Λ c , and thus of

Λ c . Let λ c ∈ Q × + be such that ψ c := λ c ψ satisfies ψ c (Λ c × Λ c ) = Z. We call (Λ c , ψ c
) with its structure of O-module the standard polarized lattice associated with (Λ 0 , c).

Choose c ∈ C, and let (Λ c , ψ c ) be the standard polarized lattice associated with (Λ 0 , c). We consider tuples (Λ, x, ι, φ, ηK) where

• Λ is a free Z-module of rank dim V , • x ∈ End(Λ ⊗ R) is a complex structure on Λ ⊗ R, • ι is an embedding O → End Z (Λ), • φ : Λ × Λ → Z is a nondegenerate alternating Z-bilinear form on Λ, • ηK is a K-orbit of Z-linear isomorphisms of O-modules Λ 0 → Λ ⊗ Z,
satisfying the following condition of compatibility with (Λ c , ψ c ):

( ) There exists an isomorphism of O-modules a : Λ → Λ c , carrying ηK to cK and x to an element of X + , such that

∃ζ ∈ µ(Γ c ), ∀u, v ∈ Λ, φ(u, v) = ψ c ζa(u), a(v) .
For short, we call such a tuple a lattice with PEL structure defined by (Λ 0 , c), or simply a lattice with PEL structure when the dependency on (Λ 0 , c) is understood.

By definition, an isomorphism between two lattices with PEL structure denoted by (Λ, x, ι, φ, ηK) and

(Λ , x , ι , φ , η K) is an isomorphism of O- modules f : Λ → Λ that sends x to x , sends ηK to η K, and such that φ(u, v) = φ ζf (u), f (v) for some ζ ∈ µ(Γ c ).
For every lattice with PEL structure (Λ, x, ι, φ, ηK), the compatibility condition ( ) implies in particular that the complex structure x is positive for φ, the adjunction involution defined by φ coincides with * on B, the action of B on Λ ⊗ Q leaves the complex structure x invariant, and the polarized lattices (Λ, φ) and (Λ c , ψ c ) have the same polarization type.

Proposition 2.2.8. Let c ∈ C, and let Z c be the set of isomorphism classes of lattices with PEL structure defined by (Λ 0 , c). Then the map

Z c -→ S c (Λ, x, ι, φ, ηK) -→ [axa -1 , c] where a is as in ( ) (2.7)
is well-defined and bijective. The inverse map is

[x, c] → (Λ c , x, ι, ψ c , cK).
where ι is the natural action of O on Λ c .

Proof. We check that 1. The map (2.7) is well defined. The complex structure axa -1 belongs to X + because of condition ( ). We show that, up to action of Γ c by conjugation, it does not depend on the choice of a. Indeed, if a is another choice of isomorphism, then a = qa where q is an automorphism of Λ c leaving ψ c invariant (modulo multiplication by some ζ ∈ µ(Γ c )) and respecting the action of B; so q is an element of G(Q). Also, the automorphism q sends cK to cK, and carries

X + to X + , hence q ∈ G(Q) + ∩ cKc -1 = Γ c by [Mil05, Prop. 5.7].
2. Isomorphic lattices with PEL structure map to the same point. Let (Λ, x, ι, φ, ηK) and (Λ , x , ι , φ , η K) be two such lattices, and let f be an isomorphism between them. If a : Λ → Λ c is as in ( ), then af : Λ → Λ c is also a valid isomorphism. The complex structures on V (R) constructed from (Λ, x, a) and (Λ , x , af ) are the same.

3. If two lattices with PEL structure map to the same class, then they are isomorphic. Let (Λ, x, ι, φ, ηK) and (Λ , x , ι , φ , η K) be two lattices with PEL structure, and choose isomorphisms a, a as in ( ). By assumption, the complex structures axa -1 and a x a -1 on V (R) differ by conjugation by an element q ∈ Γ c . Then a -1 qa : Λ → Λ is the required isomorphism.

4. The map (2.7) is surjective. Let [x, c] ∈ S c . Then [x, c
] is the image of the lattice with PEL structure given by (Λ c , x, ι, ψ c , cK) where ι is given by the natural action of O on Λ c : indeed, the identity Λ c → Λ c satisfies condition ( ).

A modular interpretation in terms of abelian varieties. Recall from §2.1.3 that every complex abelian variety is isomorphic to a complex torus of the form C g /Λ for some lattice Λ ⊂ C g ; in fact Λ = H 1 (A, Z). The inclusion Λ ⊂ C g defines a natural complex structure on Λ ⊗ R. Under this identification, endomorphisms of A correspond to endomorphisms of Λ that respect the complex structure, and we have seen that a polarization of A can be seen as a certain symplectic form taking integer values on Λ.

Let A be a complex abelian variety, and let Λ = H 1 (A, Z) be the lattice attached to A under the above equivalence of categories. Recall that for every prime number p, the Tate module T p (A) is defined as the projective limit of the torsion subgroups A[p n ] as n tends to infinity:

T p (A) = lim ← - n→∞ A[p n ] = lim ← - n→∞ Λ/p n Λ = Λ ⊗ Z p .
Therefore Λ ⊗ Z is canonically isomorphic to the global Tate module T (A) of A, defined as

T (A) = p prime T p (A).
Fix c ∈ C, and let (Λ c , ψ c ) be the standard polarized lattice associated with (Λ 0 , c). We define a complex abelian variety with PEL structure defined by (Λ 0 , c) to be a tuple (A, φ, ι, ηK) where

• (A, φ) is a complex polarized abelian variety of dimension dim V , • ι is an embedding O → End(A), • ηK is a K-orbit of Z-linear isomorphisms of O-modules Λ 0 → T (A),
satisfying the following condition of compatibility with (Λ c , ψ c ):

( ) There exists an isomorphism of O-modules a : H 1 (A, Z) → Λ c , carrying φ to ψ c , carrying ηK to cK, and such that the complex structure induced by a on V (R) belongs to X + .

If (A, φ, ι, ηK) is a complex abelian variety with PEL structure defined by (Λ 0 , c), then condition ( ) implies that A and (Λ c , ψ c ) have the same polarization type, and that the Rosati involution on End(A) ⊗ Q (which is adjunction with respect to φ) restricts to * on B. In particular, ι takes values in End(A) † .

An isomorphism between complex abelian varieties with PEL structure (A, φ, ι, ηK) and (A , φ , ι , η K) is an isomorphism of complex polarized abelian varieties f : (A, φ) → (A, φ ) respecting the action of O and sending ηK to η K.

The difference with the setting of proposition 2.2.8 is that isomorphisms of complex abelian varieties with PEL structure must respect the polarizations exactly, rather than up to an element of µ(Γ c ). In general, µ(Γ c ) = {1}, but there is the following workaround. If ε ∈ F × lies in the center of B, then multiplication by ε defines an element in the center of G(Q). Therefore it makes sense to define

E K = {ε ∈ F × : ε ∈ K} = {ε ∈ F × : ε ∈ Γ c }, for every c ∈ G(A f ).
Proposition 2.2.9. Let c ∈ C, and let (Λ c , ψ c ) be the standard polarized lattice associated with

(Λ 0 , c). If µ(E K ) = µ(Γ c ), then the map [x, c] → V (R)/Λ c , ψ c , ι, cK ,
where V (R) is seen as a complex vector space via x, and ι is the action of O on V (R)/Λ c induced by the action of B on V (R), is a bijection between S c and the set of isomorphism classes of complex abelian varieties with PEL structure defined by (Λ 0 , c).

Proof. When defining Z c as in proposition 2.2.8, we can impose ζ = 1 in condition ( ) and strengthen the notion of isomorphism between lattices with PEL structure to respect the polarizations exactly. Indeed, multiplying the isomorphism a of ( ) by ε ∈ E K leaves everything invariant except the alternating form, which is multiplied by µ(ε). The result follows then from the equivalence of categories between lattices and complex abelian varieties outlined above.

Remark 2.2.10. The group µ(E K ) always has finite index in µ(Γ c ). Indeed, if Z × F 0 denotes the unit group of F 0 , then we have

µ(E K ) ⊂ µ(Γ c ) ⊂ Z × F 0 and µ(E K ) contains a subgroup of finite index in Z × F 0 , namely all the squares of elements in Z × F 0 ∩ K. By [Che51, Thm. 1], there exists a compact open subgroup M of µ(K) such that Z × F 0 ∩M = µ(E K ). Define K = K ∩µ -1 (M ). Then E K = E K , and for every c ∈ G(A f ) we have G(Q) + ∩ cK c -1 = {γ ∈ Γ c : µ(γ) ∈ µ(E K )}.
Therefore the hypothesis of proposition 2.2.9 will be satisfied for the smaller congruence subgroup K .

Example 2.2.11. Let us detail the modular interpretation of the classical modular curve of level N ≥ 1 introduced in example 2.2.6, keeping the notation used there. We take Λ 0 = Z 2 , so that O = Z, and

K N ⊂ GL 2 ( Z) indeed stabilizes Λ 0 .
We focus on the connected component associated with c = I 2 . Then the standard polarized lattice defined by (Λ 0 , c) is (Λ c , ψ c ) = (Λ 0 , ψ), and the polarization ψ on Λ 0 is principal. Since Γ c = Γ(N ) ⊂ SL 2 (Z), we have µ(Γ c ) = {1}, so proposition 2.2.9 applies.

In the definition of a complex abelian variety with PEL structure, we can ignore the action of O = Z which is always present. Giving a Z-linear isomorphism Λ 0 → T is the same as specifying a Z p -basis of T p (A) for every prime p, and two such isomorphisms differ by an element of K N if and only if the induced maps

(Z/N Z) 2 → A[N ] are equal. Therefore, a level structure for K N is simply an isomorphism η : (Z/N Z) 2 → A[N ].
Finally, let (A, φ) be a principally polarized abelian variety of dimension 1 over C (i.e. a complex elliptic curve) endowed with an isomorphism η :

(Z/N Z) 2 → A[N ], and let Λ = H 1 (A, Z). Let u 1 , u 2 ∈ A[N ] = Λ/N Λ be the images of e 1 = (1, 0
) and e 2 = (0, 1) by η. We claim that condition ( ) holds if and only if

φ(u 1 , u 2 ) = -1 mod N (2.8)
Since ( ) imples ψ(e 1 , e 2 ) = -1, eq. (2.8) is indeed satisfied. Conversely, if (2.8) holds, then the isomorphism a : Λ → Λ 0 that we want to construct will be given by a Z-basis (u 1 , u 2 ) of Λ such that φ(u 1 , u 2 ) = -1 and (u 1 , u 2 ) reduces to u 1 , u 2 mod N . Such a basis exists because φ is principal and the reduction map SL 2 (Z) → SL 2 (Z/N Z) is surjective. The complex structure induced by a on Λ 0 ⊗ R belongs to X + because X + is the set of all complex structures on Λ 0 ⊗ R that are positive for ψ, as we computed in §2.2.1.

Therefore, by proposition 2.2.9, the connected component

S c = Γ(N )\H 1 of Sh K N (C) classifies isomorphism classes of elliptic curves (A, φ) over C endowed with an isomorphism η : (Z/N Z) 2 → A[N ] such that φ η(0, 1), η(1, 0) = 1 mod N.
This is indeed the usual modular interpretation of the classical modular curve of level N .

Modular forms on PEL Shimura varieties

The definition of elliptic modular polynomials given in §1.1.2 uses a particular function, the j-invariant, on the modular curve X(1) = SL 2 (Z)\H 1 . This invariant has an expression in terms of modular forms: we have

j = 1728 E 3 4 E 3 4 -E 2
is intimately related with the fact that the graded C-algebra of modular forms for

SL 2 (Z) is C[E 4 , E 6 ].
The notion of modular forms can be generalized to PEL Shimura varieties, and this section attempts to present this generalization without going into technical details. Modular forms can be used to construct coordinate functions: by the fundamental theorem of Baily and Borel [START_REF] Baily | Compactification of arithmetic quotients of bounded symmetric domains[END_REF], modular forms on a given PEL Shimura variety realize projective embeddings of its connected components.

Let (G, X + ) be a PEL datum, and let K ∞ ⊂ G(R) + be the stabilizer of a fixed complex structure

x 0 ∈ X + . Attached to this data is a certain canonical character of K ∞ [BB66, §1.8], denoted by ρ : K ∞ → C × . Let K be a compact open subgroup of G(A f ). A modular form of weight w ∈ Z on Sh K (G, X + )(C) is a function f : G(Q) + \ G(R) + × G(A f ) /K → C
that satisfies suitable growth and holomorphy conditions [Mil90, Prop. 3.2], and such that

∀x ∈ G(R) + , ∀g ∈ G(A f ), ∀k ∞ ∈ K ∞ , f ([xk ∞ , g]) = ρ(k ∞ ) w f ([x, g]).
The weight of f is denoted by wt(f ). We also say that f is of level K.

Let S be a connected component of Sh K (C), or a union of these, and let L be its field of definition. A modular form of weight w on S is the restriction of a modular form of weight w on Sh K (C) to the preimage of S in G(Q) + \ G(R + )×G(A f ) /K by the natural projection. There is a canonical notion of modular forms on S being defined over L [Mil90, Chap. III]. A modular function on S is the quotient of two modular forms of the same weight, the denominator being nonzero on each connected component of S.

The following result is well-known; as we could not find a precise reference, we present a short proof.

Theorem 2.2.12. Let S be a connected component of Sh K (G, X + )(C), and let L be its field of definition. Then the graded L-algebra of modular forms on S defined over L is finitely generated. Moreover there exists a weight w ≥ 1 such that modular forms of weight w defined over L realize a projective embedding of S. Every element of the function field L(S) is a quotient of two modular forms of the same weight defined over L.

Proof. Choose an element c ∈ C ⊂ G(A f ) defining the connected compo- nent S, so that S = Γ c \X + where Γ c = G(Q) + ∩ cKc -1 . Assume first that the congruence subgroup K of G(A f
) is sufficiently small, so that Γ c is torsion free. By the Baily-Borel theorem [BB66, Thm. 10.11], there exists an ample line bundle M C on S such that for every w ≥ 1, the algebraic sections of M ⊗w C are exactly the modular forms of weight w on S. In fact, M C is the inverse determinant of the tangent bundle on S [BB66, §7.3]. Since S has a model over L, there exists a line bundle M on S defined over L such that M ⊗ L C = M C . This is a special case of a general result on the rationality of automorphic vector bundles [Mil90, Chap. III, Thm. 4.3]. For every w ≥ 1, the L-vector space of modular forms of weight w on S defined over L is H 0 (S, M ⊗w ). Since M ⊗ L C is ample, M is ample too, and this implies the conclusions of the theorem.

In general, we can always find a congruence subgroup K of finite index in K such that the arithmetic subgroups [START_REF] Milne | Introduction to Shimura varieties[END_REF]Prop. 3.5], and we can assume that K is normal in K. Let S be a connected component of Sh K (C) lying over S, and let L be its field of definition. Then the conclusions of the theorem hold for S . We can identify the modular forms on S defined over L with the modular forms on S defined over L that are invariant under the action of a subgroup of K/K (we refer to §2.4.3 for the definition of this action). Therefore the conclusions of the theorem also hold for S by Noether's theorem [START_REF] Noether | Der Endlichkeitssatz der Invarianten endlicher Gruppen[END_REF] on invariants under finite groups.

G(Q) + ∩ cK c -1 for c ∈ G(A f ) are torsion free
We can also consider modular forms that are symmetric under certain automorphisms of Sh K . Let Σ be a finite group of automorphisms of V as a Q-vector space that leaves the symplectic form ψ invariant, and also acts on B in such a way that

∀u ∈ V, ∀b ∈ B, ∀σ ∈ Σ, σ(bu) = σ(b)σ(u).
This implies that the elements of Σ commute with the involution * , and hence leave F 0 stable. Under these assumptions, each element σ ∈ Σ induces an automorphism of G defined over Q, also denoted by σ. Assume further that these automorphisms leave G(R) + , X + , K, K ∞ , ν and the character ρ invariant. Then Σ can be seen as a finite group of automorphisms of S, and one can check as in [START_REF] Milne | Introduction to Shimura varieties[END_REF]Thm. 13.6] that these automorphisms are defined over L. For every modular form f of weight w on S defined over L, and every σ ∈ Σ, the function

σ • f : [x, g] → f [σ -1 (x), σ -1 (g)]
is a modular form of weight w on S defined over L. We say that f is

symmetric under Σ if σ • f = f for every σ ∈ Σ.
Proposition 2.2.13. Let Σ be a finite group of automorphisms of G as above. Then the graded L-algebra of symmetric modular forms on S defined over L is finitely generated, and every symmetric modular function on S defined over L is the quotient of two symmetric modular forms of the same weight defined over L.

Proof. This results from theorem 2.2.12 and Noether's theorem.

Example 2.2.14. When S is the classical modular curve of level N ≥ 1, we can identify the modular forms on S with the classical modular forms of level N . Our PEL datum is (G, X + ) = (GL 2 , H 1 ), and we fix i ∈ H 1 as a base point, so that

K ∞ = R × • SO 2 (R).
Recall that a classical modular form of level N and weight w on H 1 is a holomorphic function g : H 1 → C that is holomorphic at infinity and such that for every τ ∈ H 1 and every matrix γ = ( a b c d ) ∈ Γ(N ), we have

g(γτ ) = (γ * τ ) w g(τ )
where

γτ := aτ + b cτ + d and γ * τ := cτ + d.
We have seen in example 2.2.6 that S is the connected component of Sh K N (G, X + )(C) associated with the identity matrix

I 2 ∈ G(A f ). Every element of G(Q) + \G(R) + × G(A f )/K above S has a representative of the form [γ, I 2 ] where γ ∈ G(R) + .
Given a classical modular form g of level Γ(N ), we can check that the function

f : [γ, I 2 ] → (γ * i) -w g(γi)
is a modular form of weight w on S; here the character ρ :

K ∞ → C × is given by ρ λ cos θ sin θ -sin θ cos θ = λ -1 e iθ
for every λ ∈ R × and θ ∈ R. Conversely, let f be a modular form on S.

Let τ ∈ H 1 , and choose a matrix γ ∈ G(R) + such that τ = γi. Then the quantity

g(τ ) = (γ * i) w f ([γ, I 2 ])
does not depend on the choice of γ, and g is a classical modular form of level N . Under this identification, the modular form f is defined over Q(ζ N ) if and only if the Fourier coefficients of g belong to this number field; this is a special case of very general results relating different notions of "rationality" for modular forms [Mil05, Chap. III, §2], [START_REF] Harris | Arithmetic vector bundles and automorphic forms on Shimura varieties[END_REF][START_REF] Harris | Arithmetic vector bundles and automorphic forms on Shimura varieties[END_REF].

Examples of PEL Shimura varieties

In this section, we present two examples of PEL Shimura varieties playing a central role in the rest of this thesis, namely the Siegel and Hilbert moduli spaces. For correct choices of congruence subgroups and connected components, Siegel moduli spaces classify isomorphism classes of principally polarized abelian varieties over C; and the Hilbert moduli space associated with a totally real number field F of degree g classifies isomorphism classes of principally polarized abelian varieties of dimension g over C with real multiplication by Z F . Both types of moduli spaces admit classical descriptions as quotients of hermitian symmetric domains. We link these classical descriptions to their definitions as Shimura varieties as we did in §2.2.1 in the case of modular curves.

In the special case of moduli spaces for abelian varieties of dimension g = 2 (i.e. abelian surfaces), explicit generators for the graded algebra of Siegel modular forms are known by works of Igusa [START_REF] Igusa | Arithmetic variety of moduli for genus two[END_REF][START_REF] Igusa | On the ring of modular forms of degree two over Z[END_REF]. Similar results are available for a few examples of Hilbert surfaces.

References for this section are [van08], [START_REF] Milne | Introduction to Shimura varieties[END_REF]§6], [START_REF] Birkenhake | Complex abelian varieties[END_REF]§8] for Siegel moduli spaces, and [START_REF] Van Der Geer | Hilbert modular surfaces[END_REF][START_REF] Bruinier | Hilbert modular forms and their applications[END_REF], [START_REF] Birkenhake | Complex abelian varieties[END_REF]§9] for Hilbert moduli spaces.

Siegel moduli spaces

Let g ≥ 1 be an integer. We want to build a moduli space for principally polarized abelian varieties of dimension g over C. We start from the vector space V = Q 2g endowed with the symplectic form ψ defined by

∀u, v ∈ V, ψ(u, v) = u t 0 -Ig Ig 0 v.
The symplectic form ψ is a principal polarization on the lattice Λ 0 = Z 2g . The endomorphism algebra is chosen to be B = Q, with * being the trivial involution; (B, * ) is simple of type (C). Finally, the complex structure

x 0 = 0 Ig -Ig 0 is positive for ψ.
The algebraic group associated with this data is the general symplectic

group G = GSp 2g . Let µ : G → G m be the morphism such that ∀g ∈ GSp 2g (Q), ∀u, v ∈ V, ψ(gu, gv) = µ(g)ψ(u, v).
The symplectic group Sp 2g is, by definition, the kernel of µ. Since Sp 2g (R) is connected [Mil05, Thm. 5.2 and Prop. 8.7], the group GSp 2g (R) + consists of all elements g ∈ GSp 2g (R) such that µ(g) > 0. The orbit X + of x 0 under the action of GSp 2g (R) by conjugation consists of all complex structures on V (R) that are positive for ψ [START_REF] Milne | Introduction to Shimura varieties[END_REF]§6]. Finally, one can show that the reflex field of Siegel spaces is Q [START_REF] Milne | Introduction to Shimura varieties[END_REF]§14]. When g = 1, we recover the PEL data from §2.2.1 associated with classical modular curves.

The classical description of Siegel spaces. Reasoning as in the case of elliptic curves ( §2.2.1), we attach to each complex structure x ∈ X + the unique matrix τ (x) ∈ Mat g×g (C) with invertible imaginary part satisfying the following property: under the isomorphism η x : V (R) → C g whose matrix in the canonical bases is (I g -τ (x)), the pullback of the natural complex structure on C g is x. In particular, the matrix attached to x 0 is τ (x 0 ) = iI g . Lemma 2.3.1. For each x ∈ X + , the matrix τ (x) is symmetric and its imaginary part is positive definite; in other words τ (x) belongs to the Siegel upper half space H g . Proof. Let η x, * ψ denote the pushforward of ψ under η x ; it is an R-bilinear form on C g . Let (e 1 , . . . , e g ) be the canonical basis of C g . Then the matrix of η x, * ψ in the R-basis of C g given by (e 1 , . . . , e g , ie 1 , . .

. , ie g ) is (in g × g blocks) 0 Im(τ ) -1 Im(τ ) -t -Im(τ ) -t (Re(τ ) -Re(τ ) t ) Im(τ ) -1 .
The relation η x, * ψ(iu, iv) = η x, * ψ(u, v) implies that Re(τ ) is symmetric, and the fact that the bilinear form ψ(u, iv) is symmetric and positive definite implies that Im(τ ) is symmetric and positive definite.

Lemma 2.3.2. Let γ = ( a b c d ) ∈ GSp 2g (R) + (
written in g × g blocks), and let x ∈ X + . Then we have

τ (γx) = (aτ (x) + b)(cτ (x) + d) -1 . Proof. We have a commutative diagram V (R) V (R) C g V (R) V (R) C g . γ -1 γx ηx x i γ -1 ηx
Therefore, γx is the pullback of the multiplication by i under the isomorphism

V (R) → C g whose matrix is (I g -τ (x)) γ -1 . Since γ ∈ GSp 2g (R),
this matrix is, up to a scalar in R × , equal to

(I g -τ (x)) d t -c t -b t a t = (τ (x) t c t + d t , -τ (x) t a t -b t ).
(2.9) By lemma 2.3.1, we know that τ (x) ∈ H g . By [BL04, Prop. 8.2.2] the matrix cτ (x) + d is invertible, and moreover (aτ (x) + b)(cτ (x) + d) -1 ∈ H g is also symmetric. Starting from eq. (2.9), we act on C g by (τ (x) t c t + d t ) -1 , and we obtain:

∀γ ∈ GSp 2g (R) + , τ (γx) = (aτ (x) + b)(cτ (x) + d) -1 .
The modular interpretation of Siegel spaces.

The maximal compact open subgroup of G(A f ) leaving the lattice Λ 0 ⊗ Z stable is K 0 = GSp 2g ( Z).
The PEL Shimura variety Sh K 0 (C) has only one connected component identified with Γ\H g , where

Γ = GSp 2g (Q) + ∩ K 0 = Sp 2g (Z).
The action of Γ on H g is given by the formula from lemma 2.3.2. By proposition 2.2.9, the quotient Sp 2g (Z)\H g is a moduli space for principally po- where e 1 , . . . , e 2g denote the canonical basis of Q 2g . Then the polarization ψ has type (D 1 , . . . , D g ) on Λ. Let K be a compact open subgroup of G(A f ) that stabilizes Λ ⊗ Z, and let S denote the connected component of Sh K (C) defined by the identity matrix in G(A f ). Then S is identified with Γ\H g , where

Γ = GSp 2g (Q) + ∩ K = Sp 2g (Q) ∩ K.
By proposition 2.2.9, the variety S is a moduli space for polarized abelian varieties A of dimension g over C with polarization type (D 1 , . . . , D g ) and level K structure, such that H 1 (A, Z) is isomorphic to the standard polarized lattice (Λ 0 , ψ) with its natural level K structure.

Siegel modular forms in dimension 2

Given the classical description of Siegel spaces from §2.3.1, modular forms on Siegel spaces can be identified with certain holomorphic functions on the Siegel half space H g . This identification is the higher-dimensional analogue of example 2.2.14.

Let us focus on the case of the modular group Sp 2g (Z), where g ≥ 2 is an integer. For every γ = ( a b c d ) ∈ GSp 2g (R) + and every τ ∈ H g , we write

γτ = (aτ + b)(cτ + d) -1 and γ * τ = cτ + d.
Let W be a finite-dimensional vector space over C, and let

ρ : GL g (C) → GL(W )
be an irreducible holomorphic representation of GL g (C) on W . A Siegel modular form of dimension g and weight ρ is a holomorphic function f :

H g → W satisfying the transformation rule ∀γ ∈ Sp 2g (Z), ∀τ ∈ H g , f (γτ ) = ρ(γ * τ )f (τ ).
We say that f is scalar-valued if dim W = 1, and vector-valued otherwise.

A Siegel modular function is only required to be meromorphic instead of holomorphic. Since g ≥ 2, there is no need to enforce a holomorphy condition at the cusps: Koecher's principle [START_REF] Van Der Geer | Siegel modular forms and their applications[END_REF]Thm. 4.4] asserts that it is automatically satisfied. If w ≥ 0 is an integer, W = C, and ρ = det w , then the Siegel modular forms of weight ρ can be identified with the modular forms on Sp 2g (Z)\H g of weight w in the sense of §2.2.4. We also call these functions (scalar-valued) Siegel modular forms of weight w. More precisely, we fix τ 0 = iI g ∈ H g as a base point. Then, if h is a classical Siegel modular form of weight w for Sp 2g (Z), the function

f : [γ, I 2g ] → (γ * τ 0 ) -w h(γτ 0 )
is a modular form in the sense of Shimura varieties. Conversely, given a modular form f of weight w on Sp 2g (Z)\H g in the sense of §2.2.4, the function h :

H g → C given by ∀γ ∈ GSp 2g (R) + , h(γτ 0 ) = (γ * τ 0 ) w f ([γ, I 2g ])
is well defined, and is a classical Siegel modular form of weight w for Sp 2g (Z).

By theorem 2.2.12, scalar-valued Siegel modular forms realize a projective embedding of the quotient Sp 2g (Z)\H g .

Remark 2.3.3. We have seen in the proof of theorem 2.2.12 that modular forms on a PEL Shimura variety S, at least when the congruence subgroup is small enough, have a geometric interpretation as the algebraic sections of a certain line bundle, namely the inverse determinant of the tangent bundle of S. Siegel modular forms, scalar-valued or not, also have a geometric interpretation as sections of vector bundles constructed from the Hodge bundle E on Sp 2g (Z)\H g [van08, §10 and §13] (strictly speaking, E should be considered as a vector bundle on Γ\H g for some suitable normal subgroup Γ of Sp 2g (Z) of finite index, endowed with an action of Sp 2g (Z)/Γ). The fiber of E at τ ∈ H g is identified with the vector space Ω 1 (A(τ )) of global differential forms on A(τ ), where A(τ ) = C g /(Z g ⊕ τ Z g ) denotes the principally polarized abelian variety of dimension g attached to τ in the modular interpretation.

Concretely, if A is a principally polarized abelian variety of dimension g over C, if ω is a basis of Ω 1 (A), and if f is a Siegel modular form of weight ρ on H g , then the quantity f (A, ω) makes sense. This fact will play an important role in chapter 3.

A convenient way to manipulate Siegel modular forms is to write down Fourier expansions [van08, §4]. Let f be a Siegel modular form on H g of any weight ρ, with underlying vector space W . If s ∈ Mat g×g (Z) is symmetric, then f (τ + s) = f (τ ) for every τ ∈ H g . Hence f (τ ) has a Fourier expansion in terms of the quantities exp(2πiτ k,l ) where τ k,l is an entry of the matrix τ . This Fourier expansion is often written in the form

f (τ ) = n∈Mat g×g (Q) symmetric exp 2πi Tr(nτ ) a n (f ).
The Fourier coefficient a n (f ) ∈ W can be nonzero only when n is halfintegral (meaning that the coefficients of n lie in 1 2 Z, and its diagonal coefficients lie in Z), and moreover n is positive as a symmetric matrix.

In the special case W = C, the modular form f is defined over Q if and only if all its Fourier coefficients a n (f ) are rational numbers; see for instance [START_REF] Harris | Arithmetic vector bundles and automorphic forms on Shimura varieties[END_REF]Thm. 6.4]. We say that f is defined over Z if its Fourier coefficients are all integers.

In the special case g = 2, we write for τ ∈ H 2 :

τ = z 1 (τ ) z 3 (τ ) z 3 (τ ) z 2 (τ )
, and q j = exp 2πiz j (τ ) for 1 ≤ j ≤ 3.

The terms appearing in Fourier expansions of Siegel modular forms in dimension 2 are of the form a q n 1 1 q n 2 2 q n 3 3 with a ∈ C, n 1 ≥ 0, n 2 ≥ 0, and n 2 3 ≤ 4n 1 n 2 (note that n 3 can still be negative). Hence the Fourier expansion of a Siegel modular form in dimension 2 is an element of the power series ring

C[q 3 , q -1 3 ][[q 1 , q 2 ]].
Explicit generators for g = 2. We start by defining the theta constants on H g for any

g ≥ 1 [van08, §7]. Given a, b ∈ {0, 1} g , we write θ a,b (τ ) = m∈Z g exp πi m + a 2 t τ m + a 2 + m + a 2 t b 2 .
(2.10)

The pair (a, b) is called the theta characteristic of the theta constant θ a,b .

Theta constants are holomorphic functions on H g , and are identically zero unless they are even, i.e. a t b ∈ Z is even. Even theta constants are not modular forms for the full Siegel modular group Sp 2g (Z), but they satisfy certain transformation properties under Sp 2g (Z) which make them convenient building blocks. Every scalarvalued Siegel modular function of any weight on H g has an expression in terms of quotients of theta constants [Igu72, Thm. 9 p. 222]. Moreover, for each 1 ≤ g ≤ 3, the stronger result that every scalar-valued Siegel modular form is a polynomial in the theta constants holds [Igu64, Igu66, FSM19]. In the case g = 1, we recover the "genus 1" theta constants θ 0 and θ 1 defined in §1.1.1 as the theta constants with characteristics (0, 0) and (0, 1).

In the case g = 2, we introduce the following indexation of theta constants

[Dup06, §6.2]: write a = (a 1 , a 2 ) ∈ {0, 1} 2 and b = (b 1 , b 2 ) ∈ {0, 1} 2 . Then we define θ 8a 2 +4a 1 +2b 2 +b 1 := θ a,b .
There are ten even genus 2 theta constants, denoted with this convention by τ → θ j (τ ) for j ∈ {0, 1, 2, 3, 4, 6, 8, 9, 12, 15}. Let us present the construction of explicit generators of the graded algebra of scalar-valued Siegel modular forms for g = 2 in terms of theta constants.

Definition 2.3.4 ([Str10, §II.7.1]). Let T ⊂ {0, 1} 4 be the set of ten even theta characteristics for g = 2.

• A Göpel quadruple is a subset C ⊂ T of four characteristics such that c∈C c ∈ 2Z 4 ; there are 15 Göpel quadruples.

• A syzygous triple is a set of three theta characteristics {b, c, d} ⊂ T that is a subset of a Göpel quadruple; there are 60 syzygous triples.

• If {b, c,
b 1 + b 2 + c 1 + c 2 + d 1 + d 2 + b 1 c 1 + b 2 c 2 + b 4 c 2 + b 1 c 3 -b 2 c 4 + b 1 d 1 -b 3 d 1 + c 1 d 1 + b 2 d 2 + c 2 d 2 + c 4 d 2 + c 1 d 3 -b 2 b 3 c 1 -b 2 b 4 c 2 -b 1 b 2 c 3 -b 2 b 3 d 1 -b 3 c 1 d 1 -b 1 c 3 d 1 -b 2 c 3 d 1 -b 2 b 4 d 2 -b 4 c 2 d 2 -b 1 b 2 d 3 -b 1 c 1 d 3 -b 2 c 1 d 3 .
Finally, we define the holomorphic functions h j on H 2 for j ∈ {4, 6, 10, 12} as follows:

h 4 = c∈T θ 8 c , h 6 = {b,c,d} syzygous ε(b, c, d)(θ b θ c θ d ) 4 , h 10 = c∈T θ 2 c , and
h 12 = C Göpel quadruple c∈T \C θ 4 c .
For each j ∈ {4, 6, 10, 12}, the function h j is a Siegel modular form of weight j for Sp 4 (Z), and is defined over Q.

Theorem 2.3.5 ( [START_REF] Igusa | Arithmetic variety of moduli for genus two[END_REF]). The modular forms h 4 , h 6 , h 10 , h 12 are algebraically independent, and generate the graded Q-algebra of scalar-valued Siegel modular forms of even weight in dimension 2.

We refer to [START_REF] Bolza | Darstellung der rationalen ganzen Invarianten der Binärform sechsten Grades durch die Nullwerthe der zugehörigen θ-Functionen[END_REF] for the correspondence between Igusa's language in [START_REF] Igusa | Arithmetic variety of moduli for genus two[END_REF] and the modular functions h j from definition 2.3.4. Remark 2.3.6. Other normalizations of these generators are present in the literature. For instance, in order to normalize Fourier expansions, one defines ψ 4 := 2 -2 h 4 , ψ 6 := 2 -2 h 6 , χ 10 := -2 -12 h 10 , and χ 12 := 2 -15 h 12 . (2.11)

We warn the reader that different definitions appear in the literature: our χ 10 is -4 times the modular form χ 10 appearing in Igusa's paper [START_REF] Igusa | On the ring of modular forms of degree two over Z[END_REF], and our χ 12 is 12 times Igusa's χ 12 . The Fourier expansions of the modular forms ψ 4 , ψ 6 , χ 10 and χ 12 are

ψ 4 (τ ) = 1 + 240(q 1 + q 2 ) + 240q 2 3 + 13440q 3 + 30240 + 13340q -1 3 + 240q -2 3 q 1 q 2 + O q 2 1 , q 2 2 , ψ 6 (τ ) = 1 -504(q 1 + q 2 ) + -504q 2 3 + 44352q 3 + 166320 + 44352q -1 3 -504q -2 3 q 1 q 2 + O q 2 1 , q 2 2 , χ 10 (τ ) = q 3 -2 + q -1 3 q 1 q 2 + O(q 2 1 , q 2
2 ), and

χ 12 (τ ) = q 3 + 10 + q -1 3 q 1 q 2 + O q 2 1 , q 2 2 .
The absence of constant terms in the Fourier expansions of χ 10 and χ 12 indicates that they are cusp forms, hence the different notation.

The Siegel modular form χ 10 satisfies the following important property: the abelian surface A(τ ) = C 2 /(Z 2 ⊕τ Z 2 ) attached to τ ∈ H 2 is the product of two elliptic curves over C if and only if χ 10 (τ ) = 0 [START_REF] Igusa | On Siegel modular forms of genus two[END_REF]. Otherwise, this abelian surface is isomorphic to the Jacobian of a genus 2 hyperelliptic curve over C.

The Igusa invariants, defined in [Str10, §II.2.1] as

j 1 := h 4 h 6 h 10 = -2 -8 ψ 4 ψ 6 χ 10 , j 2 := h 12 h 2 4 h 2 10 = 2 -5 ψ 2 4 χ 12 χ 2 10
, and

j 3 := h 5 4 h 2 10 = 2 -14 ψ 5 4 χ 2 10
are Siegel modular functions of weight zero. By theorems 2.2.12 and 2.3.5, they realize a birational morphism defined over Q from the Siegel threefold Sp 4 (Z)\H 2 , viewed as an algebraic variety, to the projective space P 3 . Igusa invariants are well-defined for all Jacobians of genus 2 curves over C. A stronger result than theorem 2.3.5 is to describe the structure of the graded ring of Siegel modular forms in dimension 2 that are defined over Z. This is also done by Igusa [START_REF] Igusa | On the ring of modular forms of degree two over Z[END_REF], who gives a set of fourteen generators, the first ones being ψ 4 , ψ 6 , χ 10 and χ 12 . We will not need the explicit list in this thesis, only the following consequence of Igusa's result.

Proposition 2.3.7. Let f be a scalar-valued Siegel modular form of even weight k defined over Z. Then

12 k f ∈ Z[h 4 , h 6 , h 10 , h 12 ].
Vector-valued Siegel modular forms in dimension 2. In order to describe vector-valued modular forms explicitly in dimension 2, we recall the usual classification of irreducible representations of GL 2 (C).

Let n ≥ 0 be an integer. We denote by Sym n the n-th symmetric power of the standard representation of GL 2 (C) on C 2 . Explicitly, Sym n is a representation on the vector space C n [x] of polynomials of degree at most n, with

Sym n ( a b c d ) P (x) = (bx + d) n P ax + c bx + d .
We take (x n , . . . , x, 1) as the standard basis of C n [x]. Then we can write endomorphisms of C n [x] as matrices, and we have

Sym 2 ( a b c d ) =   a 2 ab b 2 2ac ad + bc 2bd c 2 cd d 2   .
Proposition Writing Sym n as a representation on C n [x] allows us to multiply Siegel modular forms; hence, they naturally generate a graded C-algebra. In contrast with the case of scalar-valued modular forms, this graded algebra is not finitely generated [van08, §25].

We conclude this section with two examples of vector-valued Siegel modular forms in dimension 2. The first example is given by the derivatives of modular functions of weight zero, for instance Igusa invariants.

Proposition 2.3.9. Let f be a Siegel modular function on H 2 of weight zero. Then the meromorphic function

df dτ := 1 2πi ∂f ∂z 1 x 2 + ∂f ∂z 3 x + ∂f ∂z 2 is a Siegel modular function of weight Sym 2 .
This result can be proved by differentiating the relation f (γτ ) = f (τ ) with respect to τ , for every γ ∈ Sp 4 (Z); but the proof is not very enlighening. We refer to chapter 3 for a geometric interpretation of proposition 2.3.9, which is fundamental in the isogeny algorithm.

The second example is that of a Siegel modular form of weight det 8 Sym 6 which will also play a fundamental role in chapter 3.

Example 2.3.10. Following Ibukiyama [START_REF] Ibukiyama | Vector-valued Siegel modular forms of symmetric tensor weight of small degrees[END_REF], let E 8 ⊂ R 8 denote the lattice of half-integer vectors v = (v 1 , . . . , v 8 ) subject to the conditions

8 k=1 v k ∈ 2Z and ∀ 1 ≤ k, l ≤ 8, v k -v l ∈ Z. Set a = (2, 1, i, i, i, i, i, 0) and b = (1, -1, i, i, 1, -1, -i, i) ∈ C 8 . Using the notation v, w := 8 k=1 v k w k ,
we write for 0 ≤ j ≤ 6 and τ ∈ H 2 :

Θ j (τ ) := v,v ∈E 8 v, a j • v , a 6-j • v, a v , a v, b v , b 4 • exp πi v, v z 1 (τ ) + 2 v, v z 3 (τ ) + v , v z 2 (τ ) .
Finally, we define

f 8,6 (τ ) := 1 111456000 6 j=0 6 j Θ j (τ ) x j .
Then f 8,6 is a nonzero Siegel modular form of weight det 8 Sym 6 . This definition provides an explicit, but slow, method to compute the first coefficients of the q-expansion; using the expression of f 8,6 in terms of theta series as in [START_REF] Cléry | Covariants of binary sextics and vector-valued Siegel modular forms of genus two[END_REF] would be faster. We have

f 8,6 (τ ) = (4q 2 3 -16q 3 + 24 -16q -1 3 + 4q -2 3 )q 2 1 q 2 + • • • x 6 + (12q 2 3 -24q 3 + 24q -1 3 -12q -2 3 )q 2 1 q 2 + • • • x 5 + (-q 3 + 2 -q -1 3 )q 1 q 2 + • • • x 4 + (-2q 3 + 2q -1 3 )q 1 q 2 + • • • x 3 + (-q 3 + 2 -q -1 3 )q 1 q 2 + • • • x 2 + (12q 2 3 -24q 3 + 24q -1 3 -12q -2 3 )q 1 q 2 2 + • • • x + (4q 2 3 -16q 3 + 24 -16q -1 3 + 4q -2 3 )q 1 q 2 2 + • • • .

Hilbert moduli spaces

Let F be a fixed totally real number field of degree g over Q, and let O be an order in the ring of integers Z F . Recall that a principally polarized abelian variety A of dimension g has real multiplication by O if A is endowed with an embedding η : O → End(A) † .

Our goal is to construct a moduli space of principally polarized abelian varieties of dimension g with real multiplication by Z F . Let ∂ -1 F denote the inverse different of F , i.e. the dual of Z F for the trace form:

∂ -1 F = x ∈ F : ∀y ∈ Z F , Tr F/Q (xy) ∈ Z . Consider the lattice Λ 0 = Z F ⊕ ∂ -1 F ⊂ F 2 . The symplectic form ψ on F 2 defined by ∀a, b, c, d ∈ F, ψ (a, b), (c, d) = Tr F/Q (ad -bc)
is a principal polarization on Λ 0 ; the fractional ideal ∂ -1

F was chosen to ensure precisely this. We let B = F , with * the trivial involution (which is indeed positive since F is totally real), act on F 2 by multiplication. The Q-algebra (B, * ) is simple of type (C). Let V = F 2 ; then (V, ψ) is a symplectic (B, * )-module, and the order of B fixing Λ 0 is precisely Z F .

The algebraic group associated with this data is G = GL 2 (F ). The g real embeddings σ 1 , . . . , σ g of F induce an identification

G(R) = g i=1 GL 2 (R),
and the subgroup G(R) + consists of matrices with totally positive determinant; in other words G(R) + = g i=1 GL 2 (R) + . Finally, we consider the complex structure x 0 ∈ G(R) on V (R) (R 2 ) g given by x 0 = ( 0 1 -1 0 ) 1≤i≤g , which is positive for ψ. Let X + be the G(R) + -conjugacy class of x 0 . The pair (G, X + ) is called a Hilbert Shimura datum. Its reflex field is Q: see [van88, §X.4] in the case g = 2, and [Mil05, Ex. 12.4] in general.

The classical description of Hilbert moduli spaces. Given the description of G(R) + above, and the identification of the orbit of ( 0 1 -1 0 ) under GL 2 (R) + with the upper half plane H 1 (recall §2.2.1), the domain X + can be identified with H g 1 endowed with the action of GL 2 (R) + on each coordinate. Explicitly, the action of GL 2 (F ) on H g 1 is the following: for every γ = ( a b c d ) ∈ GL 2 (F ) and (τ 1 , . . . , τ g ) ∈ H g 1 , we have

γ • (τ 1 , . . . , τ g ) = σ j (a)τ j + σ j (b) σ j (c)τ j + σ j (d) 1≤j≤g .
In the notation of §2.2.2, the morphism µ in the case of the algebraic group GL 2 (F ) is the determinant. As in remark 2.2.10, we can make a choice of compact open subgroup

K ⊂ G(A f ) such that G(Q) + ∩K contains exactly those matrices γ ∈ GL(Z F ⊕ ∂ -1
F ) (i.e. automorphisms of Λ 0 , whose determinant is a priori a unit of Z F ) whose determinant is a square. Let S be the connected component of Sh K (G, X + )(C) associated with the identity matrix in G(A f ). Then we have a natural bijection

S SL(Z F ⊕ ∂ -1 F )\H g 1 . The group Γ(1) F := SL(Z F ⊕ ∂ -1
F ) is called the Hilbert modular group. By proposition 2.2.9, the connected component S classifies isomorphism classes of principally polarized abelian varieties A of dimension g over C, with real multiplication by Z F , satisfying the compatibility condition ( ). In this case, the compatibility condition is the following: there exists an isomorphism of

Z F -modules H 1 (A, Z) → Λ 0 carrying the principal polarization to ψ [van88, §IX.1].
The Hilbert embedding. Given the modular interpretation of Hilbert moduli spaces, there should exist a forgetful map, called the Hilbert embedding, from SL(Z F ⊕ ∂ -1 F )\H g 1 to the Siegel moduli space Sp 2g (Z)\H g . This map is constructed by choosing an isomorphism between the lattices Z F ⊕ δ -1 F ⊂ F 2 and Z 2g ⊂ Q 2g that respects the symplectic forms, or in other words a symplectic basis of Z F ⊕ ∂ -1 F . The map H g 1 → H g between the sets of acceptable complex structures depends on this choice of basis, but the induced map on the moduli spaces does not.

The concrete matrix calculations are as follows. Choose a Z-basis (e 1 , . . . , e g ) of Z F , and embed F in R g via (σ 1 , . . . , σ g ). Let R ∈ GL g (R) be the matrix whose (k, l)-th entry is σ k (e l ); then we have Z F = R Z g , and

Z F ⊕ ∂ -1 F = R 0 0 R -t Z 2g . Moreover, the map R 0 0 R -t : Z 2g → Z F ⊕∂ -1
F respects the symplectic forms. The associated Hilbert embedding is

H R : H g 1 → H g (τ 1 , . . . , τ g ) → R t Diag(τ 1 , . . . , τ g )R,
(2.12) and the associated map on modular groups, also denoted by H R , is

H R : SL(Z F ⊕ ∂ -1 F ) → Sp 2g (Z) a b c d → R t 0 0 R -1 a σ b σ c σ d σ R -t 0 0 R -1 .
with the notation y σ = Diag σ 1 (y), . . . , σ g (y) ∈ Mat g×g (R) when y ∈ F .

Remark 2.3.11. The Hilbert embedding is not always a true embedding. For instance, when g = 2 (so that F is a real quadratic field), the induced map between moduli spaces is generically 2-1: if (A, η) is a principally polarized abelian surface with real multiplication by Z F , and η := η • σ where σ denotes real conjugation in F , then (A, η) and (A, η) are not isomorphic in general but map to the same point in the Siegel threefold.

If g = 2, the image of the Hilbert embedding is a surface contained in the Siegel threefold, called the Humbert surface associated with the real quadratic field F (or rather Z F ). Examples of equations of Humbert surfaces in terms of Igusa invariants can be computed when the discriminant of F is small [START_REF] Gruenewald | Computing Humbert surfaces and applications[END_REF].

Hilbert modular forms in dimension 2

Keep the notation of §2.3.3. For all γ ∈ ( a b c d ) ∈ Γ(1) F and τ = (τ 1 , . . . , τ g ) ∈ H g , we write

γτ := σ j (a)τ j + σ j (b) σ j (c)τ j + σ j (d) 1≤j≤g and γ * τ := g i=1 σ j (c)τ j + σ j (d) .
Let w 1 , . . . , w g be integers. A Hilbert modular form of weight (w 1 , . . . , w g ) for F is a holomorphic function f : H g 1 → C such that for every γ ∈ Γ(1) F and every τ ∈ H g 1 , we have

f (γτ ) = g j=1 σ j (c)τ j + σ j (d) w j f (τ ).
As in the case of Siegel modular forms of degree g ≥ 2, Koecher's principle makes enforcing holomorphy conditions at the cusps unnecessary [Bru08, Thm. 1.20]. Since every irreducible (finite-dimensional, holomorphic) representation of GL 1 (C) g has dimension one, there is no need to consider vector-valued modular forms in the Hilbert case.

For every w ≥ 1, Hilbert modular forms for F of parallel weight w, i.e. weight (w, . . . , w), are identified with modular forms of weight w on the Shimura component S = Γ(1) F \H g 1 described in §2.3.3. Explicitly, we choose τ 0 = (i, . . . , i) ∈ H g 1 as a base point; if h is a classical Hilbert modular form of weight (w, . . . , w) for F , then the function

f : [γ, (I 2 ) g ] → (γ * τ 0 ) -w h(γτ 0 )
is a modular function of weight w on S in the sense of §2.2.4.

The goal of this section is to describe certain generators of graded rings of Hilbert modular forms explicitly, as we did in §2.3.2 in the case of Siegel modular forms. Such generators depend on F , and they are known for a few examples of real quadratic fields F of small discriminants; we focus on the example of F = Q( √ 5). Explicitly, Hilbert modular forms can be described in terms of Fourier expansions, and also through their relations to Siegel modular forms via the Hilbert embedding.

For the moment, let F be a general real quadratic field. We fix an embedding of F in R, so that the real embeddings σ 1 and σ 2 are the identity and the real conjugation (denoted by σ), respectively. Let Σ = {1, σ} be the Galois group of F . Then Σ acts on the Q-vector space V = F 2 , and satisfies the hypotheses listed in §2.2.4; hence it makes sense to consider Hilbert modular forms that are symmetric under Σ. We check that a Hilbert modular form f is symmetric if and only if

f (τ 1 , τ 2 ) = f (τ 2 , τ 1 ) for every τ 1 , τ 2 ∈ H 1 .
Let (e 1 , e 2 ) be a Z-basis of Z F and let R = ( e 1 e 2 e 1 e 2 ) be the matrix defining the associated Hilbert embedding H R , as in §2.3.3. Proposition 2.3.12. Let k ∈ Z, n ∈ N, and let f :

H 2 → C n [x] be a Siegel modular form of weight ρ = det k Sym n . Define the functions g i : H 2 1 → C for 0 ≤ i ≤ n by the following equality: ∀t ∈ H 2 1 , n i=0 g i (t) x i = ρ(R)f H R (t) .
Then each g i is a Hilbert modular form of weight (k+i, k+n-i). Moreover, if n = 0, then the Hilbert modular form

g 0 = det(R) k H * R f is symmetric.
Proof. It is straightforward to check the transformation rule using the formula for H R given in §2.3.3. The heart of the computation is that on diagonal matrices r 1 0 0 r 2 , the representation det k Sym n splits: the coefficient before x i is multiplied by (r 1 r 2 ) k r i 1 r n-i 2 . In the case n = 0, we observe that real conjugation in F induces a symplectic automorphism of the lattice Z F ⊕ ∂ -1 F ; this implies that there exists a matrix

γ σ ∈ Sp 4 (Z) such that H R (τ 2 , τ 1 ) = γ σ H R (τ 1 , τ 2 ) for ev- ery τ 1 , τ 2 ∈ H 1 . Symmetry follows from the fact that det(γ σ ) = 1.
As a consequence, the pullbacks of Igusa invariants to H 2 1 under H R are symmetric Hilbert modular functions of weight (0, 0). They define a birational map from the Humbert surface to the subvariety of C 3 cut out by the Humbert equation.

Remark 2.3.13. If h is a Siegel modular form of weight Sym 2 obtained as the derivative of a Siegel modular form of weight zero as in proposition 2.3.9, say f (τ ), we can check that for every

(τ 1 , τ 2 ) ∈ H 2 1 , ρ(R)h H R (τ 1 , τ 2 ) = 1 2πi ∂ ∂τ 1 f H R (τ 1 , τ 2 ) x 2 + ∂ ∂τ 2 f H R (τ 1 , τ 2 ) .
In general, if f is a Hilbert modular form of weight (0, 0), then its partial derivatives with respect to τ 1 and τ 2 are Hilbert modular forms of weight (2, 0) and (0, 2) respectively; this is consistent with the result of proposition 2.3.12.

In the special case F = Q( √ 5), we take e 1 = 1 and e 2 = (1 -√ 5)/2, and we still take

R = e 1 e 2 e 1 e 2 ∈ GL 2 (R).
(2.13) Hilbert modular forms for F have Fourier expansions in terms of

w 1 = exp 2πi(e 1 τ 1 + e 1 τ 2 ) and w 2 = exp 2πi(e 2 τ 1 + e 2 τ 2 ) .
We use this notation and the term w-expansions to avoid confusion with q-expansions of Siegel modular forms. A Hilbert modular form is defined over Z if its Fourier coefficients are all integers. If (a, b) ∈ Z 2 \ {(0, 0)}, a nonzero coefficient before w a 1 w b 2 can appear in the w-expansion of a Hilbert modular form only when ae 1 + be 2 is a totally positive element of Z F . Since e 1 = 1 and e 2 has negative norm, for a given a, only finitely many b's can appear. Therefore we can consider of w-expansions as elements of the power series ring

C[w 2 , w -1 2 ][[w 1 ]].
Theorem 2.3.14 ( [START_REF] Nagaoka | On the ring of Hilbert modular forms over Z[END_REF]). The graded C-algebra of symmetric Hilbert modular forms of even parallel weight for F = Q( √ 5) is generated by three elements G 2 , F 6 , F 10 of respective weights 2, 6 and 10, with w-expansions

G 2 (τ 1 , τ 2 ) = 1 + (120w 2 + 120)w 1 + 120w 3 2 + 600w 2 2 + 720w 2 + 600 + 120w -1 2 w 2 1 + O(w 3 1 ), F 6 (τ 1 , τ 2 ) = (w 2 + 1)w 1 + w 3 2 + 20w 2 2 -90w 2 + 20 + w -1 2 w 2 1 + O(w 3 1 ), F 10 (τ 1 , τ 2 ) = (w 2 2 -2w 2 + 1)w 2 1 + O(w 3 1 ).
The ring of Hilbert modular forms of even parallel weight defined over Z is generated by G 2 , F 6 , F 10 , and

F 12 = 1 4 (F 2 6 -G 2 F 10 ).
As a consequence, we can give an analogue of proposition 2.3.7 in the case of Hilbert modular forms for Q( √ 5), whose proof is immediate given theorem 2.3.14.

Proposition 2.3.15. Let f be a symmetric Hilbert modular form of even weight k for the real quadratic field

Q( √ 5). Then 2 k f ∈ Z[G 2 , G 6 , F 10 ].
The Gundlach invariants for

F = Q( √ 5) are g 1 = G 5 2 F 10 and g 2 = G 2 2 F 6 F 10 .
They define a birational map from the associated Humbert surface to C 2 . By proposition 2.3.12, the pullbacks of the Siegel modular forms ψ 4 , ψ 6 , χ 10 and χ 12 via the Hilbert embedding H R are symmetric Hilbert modular forms of even weight. Their expressions in terms of G 2 , F 6 , F 10 can be computed using linear algebra on Fourier expansions [LY11, Prop. 3.2]: in our case we have

q 1 = w 1 , q 2 = w 1 w 2 , q 3 = w 2 .
In the following result, we take into account the fact that our choice of normalization for the Siegel modular forms χ 10 and χ 12 (recall §2.3.2) differs from that of [START_REF] Lauter | Computing genus 2 curves from invariants on the Hilbert moduli space[END_REF].

Proposition 2.3.16 ([LY11, Thm. 4.4]). In the case F = Q( √ 5), with R as in (2.13), we have

H * R ψ 4 = G 2 2 , H * R ψ 6 = G 3 2 -864F 6 , H * R χ 10 = -F 10 , H * R χ 12 = -12(3F 2 6 -2G 2 F 10 ),
As another example, we study the pullback of the modular form f 8,6 from example 2.3.10 via H R .

Proposition 2.3.17. Let R be as in eq. (2.13), and define the functions b

i (t) on H 2 1 for 0 ≤ i ≤ 6 by ∀t ∈ H 2 1 , det 8 Sym 6 (R)f 8,6 H R (t) = 6 i=0 b i (t) x i .
Then b 2 and b 4 are identically zero, and

b 2 3 = 4F 10 F 2 6 , b 1 b 5 = 36 25 F 10 F 2 6 - 4 5 F 2 10 G 2 , b 0 b 6 = -4 25 F 10 F 2 6 + 1 5 F 2 10 G 2 , b 3 b 2 0 b 3 5 + b 3 1 b 2 6 = 123F 3 10 F 6 - 32 25 F 2 10 F 2 6 G 2 2 + 288 125 F 10 F 4 6 G 2 - 3456 3125 F 6 6 .
Proof. By proposition 2.3.12, each coefficient b i is a Hilbert modular form of weight (8+i, 14-i). We can check that σ exchanges b i and b 6-i . From the qexpansion of f 8,6 , we can compute the w-expansions of the b i 's; then, we use linear algebra to identify symmetric combinations of the b i 's of parallel even weight in terms of the generators G 2 , F 6 , F 10 from theorem 2.3.14. In particular we find that b 2 b 4 = 0; since b 2 and b 4 are exchanged by σ, both are identically zero.

Modular equations

In this section, we define modular equations in the setting of PEL Shimura varieties as equations describing Hecke correspondences. All the types of modular equations described in chapter 1, namely elliptic modular polynomials and modular equations of Siegel and Hilbert type for abelian surfaces, can be recovered as special cases of the general definition.

The example of elliptic modular polynomials

In chapter 1, we defined the classical modular polynomial Φ , where is a prime, as follows. We start with the modular invariant j , which generates the function field of the moduli space S = SL 2 (Z)\H 1 over Q. Then, we look at the function τ → j (τ / ), which is invariant under the action of the congruence subgroup

Γ 0 ( ) = {( a b c d ) ∈ SL 2 (Z) : b = 0 mod } .
Then the coefficients of the polynomial

P (τ ) = γ∈Γ 0 ( )\ SL 2 (Z) Y -j 1 γτ ∈ C[Y ]
are modular functions for SL 2 (Z). The polynomial Φ is the unique polynomial in C[X, Y ] satisfying the relation Φ (j (τ ), Y ) = P (τ ) for every τ ∈ H 1 .

In order to introduce the definition of modular equations in a broader sense, we translate the definition of Φ in the language of PEL Shimura varieties. Recall that the underlying algebraic group in the case of modular curves is G = GL 2 . Note that for every τ ∈ H 1 , we have

τ / = δτ with δ = ( 1 0 0 ) ∈ G(Q) + , and moreover Γ 0 ( ) = SL 2 (Z) ∩ δ -1 SL 2 (Z)δ .
Geometrically, we consider the diagram

Γ 0 ( )\H 1 Γ 0 ( )\H 1 S S τ →δτ (2.14)
where

Γ 0 ( ) = δ SL 2 (Z)δ -1 ∩ SL 2 (Z). It gives a morphism Γ 0 ( )\H 1 → S × S, τ → (τ, δτ ).
The product S × S is then birational to P 1 × P 1 via (j, j). The modular curve Γ 0 ( )\H 1 is birational to its image in P 1 ×P 1 , and the elliptic modular polynomial of level is as an equation for this image.

In the modular interpretation, the lattice Z ⊕ δτ Z contains the lattice Z ⊕ τ Z as a sublattice of index , so the elliptic curves attached to τ and δτ are indeed -isogenous.

Recall from example 2.2.14 that if g is a classical modular form, then the function

f : [γ, I 2 ] → (γ * i) -w g(γi)
is a modular form on S in the sense of §2.2.4: the function

f is left-invariant under G(Q) + , right-invariant under a compact subgroup K of G(A f ) (with K = K 0 = GL 2 ( Z) if g was modular for SL 2 (Z))
, and satisfies a certain transformation rule under right action by the subgroup

K ∞ ⊂ G(R) + .
Under this correspondence, we can consider j as a modular form on S in the sense of §2.2.4. Then, if τ = γi ∈ H 1 , we have

j (δτ ) = j [δγ, I 2 ] = j [γ, δ -1 ] .
Therefore, the classical modular function τ → j (δτ ) for Γ 0 ( ) corresponds to the modular function

j δ -1 : G(Q) + \ G(A f ) × G(R) + → C [x, g] → j [x, gδ -1 ] . The function j δ -1 is right-invariant under K δ -1 := δ -1 K 0 δ. Define K as the compact open subgroup K 0 ∩ K δ -1 of G(A f ).
The diagram (2.14) can be rewritten as

Sh K (GL 2 , H 1 )(C) Sh δK δ -1 (GL 2 , H 1 )(C) S S. [x,g] →[x,gδ -1 ]
(2.15)

Let K be a normal subgroup of finite index in K 0 contained in K . We let K 0 act (on the left) on the set of modular functions for K as follows: if k ∈ K 0 and f is such a function, we define

k • f : [x, g] → f ([x, gk]).
The subgroup K of K 0 is contained in the stabilizer of j δ -1 . Therefore the coefficients of the polynomial

Q := γ∈K 0 /K Y -γ • j δ -1
are modular functions of level K 0 . In the world of classical modular forms, Q corresponds exactly to P , as inversion induces a bijection between right cosets of Γ 0 ( ) in SL 2 (Z) and left cosets of K in K 0 . The general definition of modular equations uses analogues of diagram (2.15), which make sense for a general Shimura variety and any δ ∈ G(A f ); these diagrams are called Hecke correspondences.

Hecke correspondences

Let us fix a PEL datum (B, * , V, ψ, G, X + ) as in §2.2.2, as well as a compact open subgroup K ⊂ G(A f ). Following §2.4.1, we look at the diagram

Sh K (G, X + )(C) Sh δ -1 K δ (G, X + )(C) Sh K (G, X + )(C) Sh K (G, X + )(C) [x,g] →[x,gδ]
(2.16)

where δ ∈ G(A f ), and K := K ∩ δKδ -1 . The induced map We define the degree of H δ to be the index

H δ : Sh K (C) → Sh K (C) × Sh K (C)
d (δ) = [K : K ] = [K : K ∩ δKδ -1 ].
This index is finite as both K and K are compact open subgroups of G(A f ), and is the degree of the projection map Sh K → Sh K . One can also consider H δ as a map from Sh K to its d (δ)-th symmetric power, send-

ing z ∈ Sh K to the set {z ∈ Sh K : (z, z ) ∈ H δ }.
It is easy to see how H δ behaves with respect to connected components of Sh K (C): if z lies in the connected component indexed by t ∈ T (A f ) (in the notation of §2.2.2), then its images under H δ all lie in the connected component indexed by t ν(δ).

We call the Hecke correspondence H δ absolutely irreducible if for every connected component S of Sh K (C) with field of definition L, the preimage of S in Sh K is absolutely irreducible as a variety defined over L (or equivalently, connected as a variety over C). A sufficient condition for H δ to be absolutely irreducible is that ν(K ) = ν(K).

Modular interpretation of Hecke correspondences. In the modular interpretation, Hecke correspondences describe isogenies of a certain type between polarized abelian varieties. Let Λ 0 , C, and O be as in §2.2.3, and write In order to construct the lattices associated with [x, c] via the Hecke correspondence H δ , we partition the orbit cK into the K -orbits

K = d(δ) i=1 κ i K , where κ i ∈ G(A f ) for 1 ≤ i ≤ d (δ). Let c ∈ C,
cκ i K for 1 ≤ i ≤ d (δ). Each cκ i δ ∈ G(A f ) is then a Z-linear embedding of O-modules Λ 0 → V (A f ); it is well defined up to right multiplication by δ -1 K δ, hence by K. Let Λ i ⊂ V (Q) be the lattice such that Λ i ⊗ Z
is the image of this embedding. There is still a natural action of O on Λ i .

The decomposition cκ i δK = q i c K, with q i ∈ G(Q) + and c ∈ C, is well defined, and the element c does not depend on i.

Proposition 2.4.1. Let δ ∈ G(A f ), let z = [x, c] ∈ S c
, and construct Λ i , q i , c as above. Then the image of z under the Hecke correspondence H δ in the modular interpretation of proposition 2.2.9 is given by the d (δ) isomorphism classes of tuples with representatives

Λ i , x, λ c λ c ψ c µ(q -1 i ) • , • , cκ i δK for 1 ≤ i ≤ d (δ).
Proof. By construction, the images of [x, c] under the Hecke correspondence are the points [q -1 i x, c ] of Sh K (C). The relation cκ i δK = q i c K shows that the map q -1 i sends the lattice Λ i to Λ c . This map also respects the action of O, and sends the complex structure x to q -1 i x. Finally, it sends the polarization

(u, v) → ψ c (u, v) on Λ i to (u, v) → ψ c µ(q i )u, v on Λ c .
After multiplying δ by a unique suitable element in Q × + , which does not change H δ , we can assume that δ( Λ 0 ) ⊂ Λ 0 and δ( Λ 0 ) ⊂ p Λ 0 for every prime p; we say that δ is normalized with respect to Λ 0 . In this case, we define the isogeny degree of H δ as the unique integer l (δ) ≥ 1 such that l (δ) -1 det(δ) is a unit in Z. In other words,

l (δ) = # Λ 0 /δ( Λ 0 ) . For a general δ ∈ G(A f ), we set l (δ) = l (λδ) where λ ∈ Q × + is chosen such that λδ is normalized with respect to Λ 0 . Corollary 2.4.2. Let δ ∈ G(A f ).
Then, in the modular interpretation of proposition 2.2.9, the Hecke correspondence H δ sends an abelian variety A with PEL structure to d (δ) abelian varieties A 1 , . . . , A d(δ) such that for every 1 ≤ i ≤ d (δ), there exists an isogeny A i → A of degree l (δ).

Proof. We can assume that δ is normalized with respect to Λ 0 . Then, in proposition 2.4.1, each Λ i for 1 ≤ i ≤ d (δ) is a sublattice of Λ c endowed with the same complex structure x. Moreover, for every

1 ≤ i ≤ d (δ), we have Λ c /Λ i Λ 0 /δ( Λ 0 ), so the index of each Λ i in Λ c is l (δ).
Example 2.4.3. In the case of the classical modular curve of level one, we have G = GL 2 and K = K 0 = GL 2 ( Z). Consider the Hecke correspondence of level δ = ( 0 0 1 ) ∈ GL 2 (A f ), where is a prime. In this case

K = K ∩ δKδ -1 = {( a b c d ) ∈ GL 2 ( Z) : b = 0 mod };
this is the Hecke correspondence considered in §2.4.1. The Hecke correspondence H δ is absolutely irreducible since ν(K 0 ) = ν(K ) = Z × . We have d (δ) = + 1 and l (δ) = . In the classical modular interpretation, H δ sends an elliptic curve E to the quotients of E by the + 1 cyclic subgroups of E[ ]; these quotient isogenies are dual to the isogenies given in corollary 2.4.2.

A relation between degrees. For later purposes, we state an inequality relating d (δ) with a power of l (δ).

Since K ⊂ G(A f ) is open, there exists a smallest integer N ≥ 1 such that g ∈ G(A f ) ∩ GL( Λ 0 ) : g = 1 mod N Λ 0 ⊂ K,
which we call the level of K with respect to Λ 0 .

Proposition 2.4.4. There exists a constant C depending on K and Λ 0 such that for every δ ∈ G(A f ), we have

d (δ) ≤ C l (δ) (dim V ) 2 . We can take C = N (dim V ) 2 ,
where N is the level of K with respect to Λ 0 .

Proof. We can assume that δ is normalized with respect to Λ 0 . Then the subgroup K ∩ δKδ -1 contains all the elements g ∈ G(A f ) ∩ GL( Λ 0 ) that are the identity modulo Λ = l (δ)N Λ 0 . In other words we have a morphism of groups K → GL(Λ 0 /N l (δ)Λ 0 ) whose kernel is contained in K ∩ δKδ -1 . This yields the result since

# GL(Λ 0 /N l (δ)Λ 0 ) ≤ (N l (δ)) (dim V ) 2 .
Remark 2.4.5. The upper bound on d (δ) given in proposition 2.4.4 is far from optimal in many cases: for instance, if δ is normalized with respect to Λ 0 , if l (δ) is prime to N , and if moreover δ normalizes the image of K in GL(Λ 0 /N Λ 0 ), then d (δ) ≤ l (δ) (dim V ) 2 . But in general, the level of K does enter into account. As an example, take G = GL 2 , δ = ( 0 1 1 0 ), and

K = ( a b c d ) ∈ GL 2 ( Z) : a = d = 1 mod N and c = 0 mod N .
Then d (δ) = N even though l (δ) = 1. In the modular interpretation, the Hecke correspondence H δ has the effect of forgetting the initial K-level structure entirely.

Modular equations on PEL Shimura varieties

When defining the elliptic modular polynomial Φ , besides choosing the Hecke correspondence, one uses a particular generator of the function field of the modular curve, namely the j-invariant. In the general case, we also fix a choice of invariants on Shimura varieties. Fix a PEL datum (B, * , V, ψ, G, X + ) as above, let K ⊂ G(A f ) be a compact open subgroup, and let Σ be a finite group of automorphisms of V as in §2.2.4. Let n be the complex dimension of X + ; we assume that n ≥ 1. Let S, T be connected components of Sh K (G, X + )(C), and let L be their field of definition.

Since the field L(S) of modular functions on S has transcendence degree n over L, the field L(S) Σ of modular functions on S that are symmetric under Σ also has transcendence degree n over L. Choose a transcendence basis (j 1 , . . . , j n ) of L(S) Σ over L, and another symmetric function j n+1 that generates the remaining finite extension, whose degree is denoted by e. On S, the function j n+1 satisfies a minimal relation of the form E(j 1 , . . . , j n+1 ) = 0

(2.17)

where

E = e k=0 E k (J 1 , . . . , J n ) J k n+1 ∈ L[J 1 , . . . , J n+1 ] and E is irreducible. If L(S) Σ is purely transcendental over L (if Σ = {1},
this means that S is birational to P n ), then we can take j n+1 = 1, ignore eq. (2.17), and work with n invariants only. This simplification will happen for our three main examples of PEL Shimura varieties, namely the modular curve X(1), the Siegel threefold, and the Hilbert surface for F = Q( √ 5). We proceed similarly to define coordinates on T : no confusion will arise if we also denote them by j 1 , . . . , j n+1 . We refer to the data defined up to now as a choice of PEL setting.

Given a PEL setting, let δ ∈ G(A f ) define an absolutely irreducible Hecke correspondence H δ that intersects S × T nontrivially. We want to define explicit polynomials with coefficients in L(S), called the modular equations of level δ, describing H δ in the product S × T . To do this, we mimic the definition of elliptic modular polynomials in the language of PEL Shimura varieties given in §2.4.1. As in §2.4.2, we write

K = K ∩ δKδ -1 .
Let K be a normal subgroup of finite index in K, contained in K , and stabilized by Σ. Let S be the preimage of S in Sh K (C) (which is possibly not connected). There is a left action of K Σ on the space of modular functions on S , given by

(k, σ) • f : [x, g] → σ • f ([x, gk]).
The modular functions that are invariant under K {1} (resp. K Σ) are exactly the functions on H δ ∩ (S × T ) defined over C (resp. the functions on S defined over C and invariant under Σ). The modular functions

j i,δ : [x, g] → j i ([x, gδ])
for 1 ≤ i ≤ n + 1 are defined over L and generate the function field of H δ ∩ (S × T ). We define the decreasing chain of subgroups

K Σ = K 0 ⊃ K 1 ⊃ • • • ⊃ K n+1 ⊃ K
as follows: for each 1 ≤ i ≤ n + 1, the subgroup K i is the stabilizer of the modular functions j 1,δ , . . . , j i,δ .

Galois theory applied to the Galois covering S → S tells us that for every 1 ≤ i ≤ n + 1, the field L(j 1 , . . . , j n+1 , j 1,δ , . . . , j i,δ ) is the function field of the preimage of S in the Shimura variety Sh K i , and consists of all modular functions on S defined over L that are invariant under K i . In other words, we have a tower of function fields:

L(j 1 , . . . , j n+1 , j 1,δ , . . . , j n+1,δ ) = L(H δ ∩ (S × T )) . . . L(j 1 , . . . , j n+1 , j 1,δ ) L(S) Σ , degree d n+1 degree d 2 degree d 1 where d i = [K i-1 : K i ] for 1 ≤ i ≤ n + 1.
The modular equations of level δ are defining equations for the successive extensions in the tower.

Definition 2.4.6. The modular equations of level δ on S × T are the tuple (Ψ δ,1 , . . . , Ψ δ,n+1 ) defined as follows: for each 1 ≤ m ≤ n + 1, Ψ δ,m is the multivariate polynomial in the m variables Y 1 , . . . , Y m defined by

Ψ δ,m = γ∈K 0 /K m-1 m-1 i=1 γ i Y i -γ i • j i,δ γm∈K m-1 /Km Y m -γγ m • j m,δ ,
where the middle product is over all γ i ∈ K 0 /K i such that γ i = γ modulo K i-1 , but γ i = γ modulo K i . The expression for Ψ δ,m makes sense, because multiplying γ on the right by an element in K m-1 only permutes the factors in the last product. Definition 2.4.6 generalizes the definition of elliptic modular polynomials; the precise formula is inspired from preexisting definitions of modular equations for abelian surfaces [BL09, Mil15, Mar20, MR20]. We will return to these examples in §2.4.4.

Let us give elementary properties of modular equations. We need a technical lemma.

Lemma 2.4.7. Let γ, γ ∈ K 0 and 1 ≤ i ≤ n + 1. Assume that the equality γ • j i,δ = γ • j i,δ holds on one connected component of S . Then it holds on all connected components of S .

Proof. Write γ = (k, σ) and γ = (k , σ ) where k, k ∈ K and σ, σ ∈ Σ. Let c ∈ C ⊂ G(A f ) be an element defining the connected component S in Sh K (C), so that S = Γ c \X + with Γ c = G(Q) + ∩ cKc -1 . By assumption, there exists an element g ∈ G(A f ) such that g = c in the double quotient space G(Q) + \G(A f )/K, and ∀x ∈ X + , j i,δ [σ -1 (x), σ -1 (gk)] = j i,δ [σ -1 (x), σ -1 (gk )] .
(2.18)

Since H δ is absolutely irreducible, we have

G(Q) + \G(A f )/K = G(Q) + \G(A f )/K .
Using the description of connected components of a PEL Shimura variety in §2.2.2, and the fact that the action of Σ leaves ν invariant, we find that there exist γ 1 , γ 2 ∈ G(Q) + such that gk = γ 1 σ(c) mod σ(K ) and gk = γ 2 σ (c) mod σ (K ). Then eq. (2.18) is equivalent to the following:

∀x ∈ X + , j i,δ [x, c] = j i,δ [σ -1 (γ -1 2 γ 1 σ(x)), c] . (2.19)
Note that γ -1 2 γ 1 is well-defined and independent of g, up to multiplication on the left by an element of G(Q) + ∩ σ (cK c -1 ), and multiplication on the right by an element of G(Q) + ∩ σ(cK c -1 ). Therefore eq. (2.19) holds for each g ∈ G(A f ) such that g = c in G(Q) + \G(A f )/K. In other words, the equality γ • j i,δ = γ • j i,δ holds on every connected component of S .

Proposition 2.4.8. Let 1 ≤ m ≤ n + 1, and let γ ∈ K 0 /K m-1 . Then, up to multiplication by an element in L(j 1 , . . . , j n+1 , γ • j 1,δ , . . . , γ • j m-1,δ ) × , we have

Ψ δ,m (γ • j 1,δ , . . . , γ • j m-1,δ , Y m ) = γm∈K m-1 /Km Y m -γγ m • j m,δ .
Proof. By definition 2.4.6, the above equality holds true after multiplying the right hand side by

f = m-1 i=1 γ i ∈K 0 /K i γ i =γ γ i =γ mod K i-1 γ • j i,δ -γ i • j i,δ .
The function f a product of nonzero modular functions on S defined over L. In order to show that f ∈ L(j 1 , . . . , j n+1 , γ • j 1,δ , . . . , γ • j m-1,δ ), we check that f is invariant under the action of γK m-1 γ -1 . By definition of the subgroups K i , no factor of f is identically zero on S . Therefore f is invertible by lemma 2.4.7.

Let 1 ≤ m ≤ n + 1. Proposition 2.4.8 implies that up to scaling, the univariate polynomial Ψ δ,m (j 1,δ , . . . , j m-1,δ , Y m ) is the minimal polynomial of j m,δ over the field L(j 1 , . . . , j n+1 , j 1,δ , . . . , j m-1,δ ). In other words, when the multiplicative coefficient does not vanish, which is generically the case, Ψ δ,m provides all the possible values for j m,δ once j 1 , . . . , j n+1 and j 1,δ , . . . , j m-1,δ are known. In particular, modular equations vanish on H δ as promised.

We could also define other modular equations Φ δ,m for which there is true equality in proposition 2.4.8, as in the case of elliptic modular polynomials, but they have a more complicated expression. In practice, using the polynomials Ψ δ,m is more convenient as they are typically smaller.

Proposition 2.4.9. Let 1 ≤ m ≤ n + 1. The coefficients of Ψ δ,m lie in L(j 1 , . . . , j n+1 ). The degree of

Ψ δ,m in Y m is [K m : K m-1 ], and for each 1 ≤ i < m, the degree of Ψ δ,m in Y i is at most [K i : K i-1 ] -1.
Proof. It is clear from definition 2.4.6 that the action of K 0 leaves Ψ δ,m invariant. Hence the coefficients of Ψ δ,m are functions on S invariant under Σ and defined over L, so the first statement holds. The second part is obvious.

In general, using a nontrivial Σ increases the degree of modular equations. This has a geometric interpretation: modular equations describe the Hecke correspondence H δ and its conjugates under Σ simultaneously.

Let J 1 , . . . , J n+1 be indeterminates, and let 1 ≤ m ≤ n + 1. By the equation (2.17) satisfied by j n+1 on S, there exists a unique element of the ring L(J 1 , . . . , J n )[J n+1 , Y 1 , . . . , Y m ] of degree at most e -1 in J n+1 which, when evaluated at J i = j i for 1 ≤ i ≤ n + 1, yields Ψ δ,m . In the sequel, we also denote it by Ψ δ,m . Therefore the coefficients of Ψ δ,m will be either functions on S, i.e. elements of L(j 1 , . . . , j n+1 ), or multivariate rational fractions in the indeterminates J 1 , . . . , J n+1 that are polynomial in J n+1 of degree at most e -1, depending on the context. Remark 2.4.10. In several cases, the function j 1,δ already generates the whole extension of function fields, so that

K 1 = • • • = K n+1 = K , Ψ δ,1 = γ 1 ∈K 0 /K Y 1 -γ 1 • j 1,δ ,
and for every 2

≤ m ≤ n + 1, Ψ δ,m = γ∈K 0 /K γ 1 =γ Y 1 -γ 1 • j 1,δ Y m -γ • j m,δ .
(2.20)

In this case, for each 2 ≤ m ≤ n + 1, we have

Ψ δ,m (j 1,δ ) = ∂ Y 1 Ψ δ,1 (j 1,δ ) • (Y m -j m,δ ),
where ∂ Y 1 denotes derivative with respect to Y 1 . Therefore Ψ δ,m is just the expression of j m,δ as an element of L(S)

Σ [ j 1,δ ] in a compact representation inspired from [GHK + 06].
In this case, we will often keep only the (negative of the) constant term in (2.20), and consider the modular equations Ψ δ,m for 2 ≤ m ≤ n + 1 as "univariate" polynomials, i.e. elements of the ring L(J 1 , . . . , J n )[J n+1 , Y ] of degree at most e -1 in J n+1 , defined by the relations

Ψ δ,m (j 1 , . . . , j n+1 ) = γ∈K 0 /K γ • j m,δ γ 1 =γ Y -γ 1 • j 1,δ .
(2.21)

Then, we simply have

j m,δ = Ψ δ,m (j 1,δ )/∂ Y 1 Ψ δ,1 (j 1,δ ).

Modular equations for abelian surfaces

To conclude chapter 2, we show that modular equations of Siegel and Hilbert type in dimension 2 [BL09, Mil15, Mar20, MR20] are special cases of modular equations as defined above.

Modular equations of Siegel type. We saw in §2.3.1 that the Siegel threefold Sp 4 (Z)\H 2 is the PEL Shimura variety associated with the algebraic group G = GSp 4 (Q), with compact open subgroup K = GSp 4 ( Z). The Shimura variety Sh K is connected, defined over Q, and its function field is generated by the three algebraically independent Igusa invariants j 1 , j 2 , j 3 . Let be a prime, and consider the Hecke correspondence of level δ = I 2 0 0 I 2 as a 4 × 4 matrix in 2 × 2 blocks.

The subgroup K ∩ δKδ -1 ∩ G(Q) + of Sp 4 (Z) is usually denoted by Γ 0 ( ), and the degree of H δ is

d (δ) = 3 + 2 + + 1.
The Hecke correspondence H δ is absolutely irreducible, and describes all principally polarized abelian surfaces -isogenous to a given one; the degree of these isogenies is l (δ) = 2 . In this case, the function j

Ψ ,m ∈ Q(J 1 , J 2 , J 3 )[Y ] for 1 ≤ m ≤ 3.
They have been computed for = 2 and = 3 [START_REF] Milio | A quasi-linear time algorithm for computing modular polynomials in dimension 2[END_REF].

By the dictionary between modular forms in the sense of PEL Shimura varieties and classical modular forms, we have the following formulae between meromorphic functions on Sp 4 (Z)\H 1 [START_REF] Bröker | Modular polynomials for genus 2[END_REF][START_REF] Milio | A quasi-linear time algorithm for computing modular polynomials in dimension 2[END_REF]:

Ψ ,1 j 1 (τ ), j 2 (τ ), j 3 (τ ) = γ∈Γ 0 ( )\ Sp 4 (Z) Y -j 1 1 γτ ,
and for m ∈ {2, 3},

Ψ ,m j 1 (τ ), j 2 (τ ), j 3 (τ ) = γ∈Γ 0 ( )\ Sp 4 (Z) j m 1 γτ γ =γ Y -j 1 1 γ τ .
Modular equations of Hilbert type. As we saw in §2.3.3, the Hilbert surface Γ F (1)\H 2 1 for the quadratic field

F = Q( √ 5
) is identified with a connected component S of the PEL Shimura variety associated with the algebraic group G = GL 2 (F ) and a well-chosen congruence subgroup K of GL(Λ 0 ⊗ Z), where

Λ 0 = Z F ⊕ ∂ -1
F . Let Σ be the group of order two generated by the real conjugation σ in F . The algebraic variety S is defined over Q, and the field of symmetric modular functions on S is generated by the two algebraically independent Gundlach invariants g 1 , g 2 .

Let β ∈ Z F be totally positive and prime, and let

δ = β 0 0 1 ∈ G(A f ).
The Hecke correspondence H δ is absolutely irreducible, and has degree d (δ) = N F/Q (β) + 1. In the modular interpretation, H δ parametrizes β-isogenies between abelian surfaces with real multiplication by Z F ; the degree of these isogenies is l (δ) = N F/Q (β). One can check that H δ intersects S × S nontrivially. Being able to consider this Hecke correspondence is the reason for our choice of G in §2.2.2. The associated modular equations are called the Hilbert modular polynomials of level β in Gundlach invariants, denoted by

Ψ β,m ∈ Q(J 1 , J 2 )[Y ] for m ∈ {1, 2} [MR20]
. They have been computed up to N F/Q (β) = 59 [Mil]; since the Gundlach invariants are symmetric, they describe both βand σ(β)-isogenies. In order to write out Hilbert modular equations of level β in terms of classical Hilbert modular forms, we define

Γ 0 (β) = {( a b c d ) ∈ Γ F (1) : β|b} ,
and for all λ ∈ F and τ = (τ 1 , τ 2 ) ∈ H 2 1 , we write λτ := (λτ 1 , λτ 2 ).

Then we have the following equalities of meromorphic functions on H 2 1 :

Ψ β,1 g 1 (τ ), g 2 (τ ) = γ∈Γ 0 (β)\(Γ F (1) Σ) Y -g 1 1 β γτ , and
Ψ β,2 g 1 (τ ), g 2 (τ ) = γ∈Γ 0 (β)\(Γ F (1) Σ) g 2 1 β γτ γ =γ Y -g 1 1 β γ τ .
Other types of Hilbert modular equations for Q( √ 5) using nonsymmetric invariants have also been defined and computed [START_REF] Martindale | Hilbert modular polynomials[END_REF].

Finally, we can also consider modular equations of Hilbert type using pullbacks of the three Igusa invariants under the Hilbert embedding as invariants on S. The equation (2.17) satisfied by j 1 , j 2 , j 3 on S is the Humbert equation attached to

F . When F = Q( √ 5
), there is no reason to use Hilbert modular equations in Igusa invariants in practice, as they have a larger number of variables and larger degrees compared to the modular equations in Gundlach invariants; their only advantage is that they can be defined for every real quadratic field F .

Chapter 3

Computing isogenies between abelian surfaces

This chapter corresponds to the preprint [START_REF] Kieffer | Computing isogenies from modular equations in genus two[END_REF]. We present an algorithm solving the following problem: given two principally polarized abelian surfaces A and A over a field k which are isogenous, compute such an isogeny explicitly. More precisely, we assume that either 1. A and A are -isogenous, where is a prime (the Siegel case); or 2. A and A have real multiplication by Z F , where F is a fixed real quadratic field, and are β-isogenous where β ∈ Z F is a totally positive prime (the Hilbert case).

We refer to §2.1.4 for the definition of -and β-isogenies. During the algorithm, we make several genericity assumptions on A and A ; in particular we assume that A and A are Jacobians of genus 2 hyperelliptic curves over k. We also assume that the characteristic of k is sufficiently large with respect to or β. We give precise statements in theorems 3.5.2 and 3.5.3. While the Siegel and Hilbert cases do not cover all possible isogenies between principally polarized abelian surfaces, they "almost" do so, and the isogeny algorithm can be adapted to the cases when End(A) † is not maximal or when β ∈ Z F is totally positive but not prime; see [DJRV17, Thm. 1.1] for the full classification.

Our algorithm is the generalization of the isogeny algorithm for elliptic curves described in §1.2.2 to the case of modular equations of Siegel and Hilbert type for abelian surfaces: the crucial step is to compute the action of the isogeny on differential forms using derivatives of modular equations. This computation has a geometric interpretation in terms of the Kodaira-Spencer isomorphism, and this formulation yields a clear roadmap to generalize the isogeny algorithm to higher dimensions.

Using the results of this chapter, one can already implement toy examples of Elkies's point counting method on abelian surfaces using precomputed modular equations of small levels. However, the key issue of the complexity of manipulating modular equations is left aside for the moment. We return to this question in chapter 5, where we present general size bounds for modular equations in terms of their level, and in chapter 6, where we investigate the complexity of evaluating modular equations of Siegel and Hilbert type, i.e. providing the input to the isogeny algorithm.

Principle of the algorithm

Let us describe the outline of our algorithm in the case of -isogenies from a geometric point of view, in any dimension g. The central object is the Hecke correspondence

H = (H ,1 , H ,2 ) : A g, → A g × A g
where A g, denotes the moduli space of principally polarized abelian varieties of dimension g endowed with the kernel of an -isogeny, and A g denotes the moduli space of principally polarized abelian varieties of dimension g. In the modular interpretation, the map H is given by (A, K) → (A, A/K). Over C, the map H takes the form

Γ 0 ( )\H g → Sp 2g (Z)\H g × Sp 2g (Z)\H g τ → (τ, τ / ),
where the subgroup Γ 0 ( ) ⊂ Sp 2g (Z) is defined by

Γ 0 ( ) = ( a b c d ) ∈ Sp 2g (Z) : b = 0 mod . (3.1)
If g = 2, then H is exactly the Hecke correspondence used in §2.4.4 to construct the Siegel modular equations of level . Let ϕ : A → A be an -isogeny, so that (A, A ) lies in the image of H . Assume further that (A, A ) are sufficiently generic, so that H ,1 and H ,2 are étale at (A, A ). Denote by T A (A g ) the tangent space of A g at A, and denote by T 0 (A) the tangent space of A at its neutral point. Then there is a close relation between two maps:

• the deformation map D(ϕ) : T A (A g ) → T A (A g ) defined as D(ϕ) := dH ,2 • (dH ,1 ) -1 , and
• the tangent map dϕ : T 0 (A) → T 0 (A ).

This relation stems from a canonical isomorphism, called the Kodaira-Spencer map, between T A (A g ) and the vector space Sym 2 T 0 (A) [START_REF] André | On the Kodaira-Spencer map of abelian schemes[END_REF]. Therefore, in any dimension g, an isogeny algorithm could run as follows.

1. Compute the deformation map at (A, A ) by differentiating certain modular equations giving a local model of A g, and A g .

2.

Compute dϕ from the deformation map using an explicit version of the Kodaira-Spencer isomorphism, i.e. an explicit way to map a pair (A, w) where w ∈ Sym 2 T 0 (A) to the corresponding point of T A (A g ) in the local model of A g .

3. Reconstruct ϕ as a rational map by solving a differential system in power series and performing a multivariate rational reconstruction.

In step 3, the characteristic p of k should be large with respect to . If p is too small, then a standard solution [START_REF] Joux | Counting points on elliptic curves in medium characteristic[END_REF] is to lift the isogeny to the ring of Witt vectors of k, which has characteristic zero, and to control the padic precision losses in step 3. This outline follows the steps of the isogeny algorithm for elliptic curves ( §1.2.2), albeit in a very abstract formulation.

We mention that the genericity assumption on (A, A ) can be removed if one is willing to work with A g as a Deligne-Mumford stack, rather than a scheme over k; then the maps H ,1 and H ,2 are étale everywhere. We refer to [START_REF] Kieffer | Computing isogenies from modular equations in genus two[END_REF]§4] for an account on this formalism. In practice, working with stacks would involve adding a level structure of level n ≥ 3 prime to and keeping track of automorphisms. For simplicity, we choose to keep the genericity hypothesis.

In the case g = 2, we consider the local model of A g given by the Igusa invariants, defined in §2.3.2; the local model of A g, in step 1 is given by the Siegel modular equations of level (recall §1.3.1 and §2.4.4). This choice introduces further singularities, which can be avoided by choosing other models of A g ; this would be necessary for instance if A or A is a product of elliptic curves, so that its Igusa invariants are not defined. In order to compute the deformation map, it is enough to evaluate the Siegel modular equations of level and their derivatives at (A, A ). In step 2, we choose to encode a basis of T 0 (A) as the choice of a hyperelliptic curve equation C such that A = Jac(C). Then, the explicit Kodaira-Spencer isomorphism is simply an expression for certain Siegel modular forms, namely derivatives of Igusa invariants, in terms of the coefficients of the curve (see theorem 3.2.15). Since the curve C embeds in its Jacobian, we are able to compute with power series in only one variable in step 3.

An explicit Kodaira-Spencer map

Let C be a genus 2 hyperelliptic curve over C. Then a choice of hyperelliptic equation for C defines a basis ω of the space of global differential forms on C, hence on Jac(C). As we saw in remark 2.3.3, any Siegel modular form f with values in a vector space W can be evaluated on the pair (Jac(C), ω). This gives rise to a map, denoted by Cov(f ), from an open subset of C 6 [x] to W . We show that Cov(f ) is a covariant of the hyperelliptic equation; the main result of this section is an algorithm to obtain this covariant explicitly given the q-expansion of f . These calculations have also been done in [START_REF] Cléry | Covariants of binary sextics and vector-valued Siegel modular forms of genus two[END_REF].

The existence of the Kodaira-Spencer isomorphism translates into the fact that derivatives of Igusa invariants are modular forms of weight Sym 2 (recall proposition 2.3.9). The explicit Kodaira-Spencer isomorphism that we are looking for is the expression of their associated covariants in terms of the coefficients of the curve.

We use the following notation. If m is a matrix, we denote the transpose of m by m t , and we denote the inverse of m t by m -t . We denote the diagonal n × n matrix with diagonal entries x 1 , . . . , x n by Diag(x 1 , . . . , x n ).

Hyperelliptic equations

Let C be a smooth hyperelliptic equation of genus 2 over C:

C : v 2 = E C (u),
with deg E C ∈ {5, 6}. Then C is naturally endowed with the basis of differential forms

ω(C) = u du v , du v . (3.2)
Recall from §2.1.2 that the Jacobian Jac(C) is a principally polarized abelian surface over C. Choosing a base point P on C gives an embedding

η P : C → Jac(C), Q → [Q -P ].
The pullback map η * P on the spaces of differential forms is an isomorphism which is independent of P . Therefore we can see ω(C) as a basis of differential forms on Jac(C). This basis depends on the particular hyperelliptic equation chosen. Proposition 3.2.2. Let A be a principally polarized abelian surface over C that is not a product of two elliptic curves, and let ω be a basis of Ω 1 (A).

Then there exists a unique hyperelliptic curve equation C of genus 2 over C such that Jac(C), ω(C) is isomorphic to (A, ω).

Proof. Since A is not a product of elliptic curves, there exists a genus 2 curve equation C 0 over C such that A is isomorphic to Jac(C 0 ). Then ω differs from ω(C 0 ) by a linear transformation in GL 2 (C). By lemma 3.2.1, we can make a suitable change of variables on C 0 to find the correct C. The curve C is unique because every isomorphism between hyperelliptic curves comes from a matrix r as in lemma 3.2.1.

Let g ≥ 1. Recall that the complex abelian variety of dimension g attached to τ ∈ H g is A(τ ) = C g /Λ(τ ), where Λ(τ ) = Z g ⊕ τ Z g . Recall also that for every τ ∈ H g and every γ = ( a b c d ) ∈ Sp 2g (Z) in g × g blocks, we write γτ = (aτ + b)(cτ + d) -1 and γ * τ = cτ + d.

There is a natural basis of differential forms on A(τ ) given by

ω(τ ) = (2πi dz 1 , . . . , 2πi dz g ), (3.3)
where z 1 , . . . , z g are the coordinates of C g . This basis of differential forms satisfies a simple transformation rule under the action of Sp 2g (Z).

Proposition 3.2.3 ([BL04, Rem. 8.1.4]). Let τ ∈ H g , and let γ ∈ Sp 2g (Z).

Then there exists an isomorphism

η γ,τ : A(τ ) → A(γτ ), z → (γ * τ ) -t z.
Similarly, let F be a totally real number field of degree g, seen as a subset of R g via its g real embeddings. By §2.3.3, for every τ = (τ 1 , . . . , τ g ) ∈ H g 1 , the abelian variety of dimension g with real multiplication by

Z F attached to τ is A F (τ ) = C g /Λ F (τ ), where Λ F (τ ) = Z F ⊕ Diag(τ 1 , . . . , τ g )∂ -1
F . The tuple of differential forms ω(τ ) defined as in eq. (3.3) also defines a basis of differential forms on A F (τ ). Definition 3.2.4. Let us return to the case g = 2. The bases of differential forms defined above allow us to define particular curve equations attached to a point of H 2 or H 2 1 . 1. Let τ ∈ H 2 , and assume that χ 10 (τ ) = 0. Then, by proposition 3.2.2, there exists a unique hyperelliptic equation C(τ ) over C such that

Jac(C(τ )), ω(C(τ )) A(τ ), ω(τ ) .
We call C(τ ) the standard curve attached to τ . We define the functions a i (τ ) on H 2 for 0 ≤ i ≤ 6 as the coefficients of C(τ ):

C(τ ) : y 2 = 6 i=0 a i (τ )x i .
2. Let F be a real quadratic field, and let R ∈ GL 2 (R) be a matrix defining a Hilbert embedding ( §2.3.3). Let τ ∈ H 2 1 , and assume that χ 10 (H R (τ )) = 0. Then, by proposition 3.2.2, there exists a unique hyperelliptic equation C F (τ ) over C such that

Jac(C F (τ )), ω(C F (τ ))
A F (τ ), ω(τ ) .

We call C F (τ ) the standard curve with real multiplication by Z F attached to τ ; this is an abuse of language, since the Jacobian of C F (τ ) has real multiplication by Z F , not the curve itself. Finally, one can relate the curves C F (τ ) and C(H R (τ )) for every τ ∈ H 2 1 .

Proposition 3.2.6. Let F, R be as above. Then for every τ ∈ H 2 1 , left multiplication by R t on C 2 induces an isomorphism A F (τ ) → A(H R (τ )).

Proof. As above, we view F as a subset of R 2 via its two real embeddings. By definition of R, we have

Z F = R Z 2 and ∂ -1 F = R -t Z 2 . Then a direct computation shows that ∀t ∈ H 2 1 , Λ(H R (τ )) = R t Λ F (τ ).
Proposition 3.2.7. Let F, R be as above. Then for every τ ∈ H 2 1 , we have

C F (τ ) = det -2 Sym 6 (R) C(H R (τ )).
Proof. Combine proposition 3.2.6 and lemma 3.2.1.

Covariants

As indicated in remark 2.3.3, if f is a Siegel modular form of weight ρ in dimension g, if A is a principally polarized abelian variety of dimension g over C, and if ω is a basis of Ω 1 (A), then f (A, ω) is well defined. To compute this quantity, choose τ ∈ H g and an isomorphism η : A → A(τ ). Let r ∈ GL g (C) be the matrix of the pullback η * : Ω 1 (A(τ )) → Ω 1 (A) in the bases ω(τ ) and ω. Then

f (A, ω) = ρ(r)f (τ ).
We can check using proposition 3.2.3 that f (A, ω) does not depend on the choice of τ and η. As a consequence, for every Siegel modular form f in dimension 2, we have a map

Cov(f ) : C → f Jac(C), ω(C) .
We apply the results of §3.2.1 to show that Cov(f ) is a covariant of the curve equation. A recent reference on covariants is [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF]. Definition 3.2.8. Let ρ : GL 2 (C) → GL(V ) be a finite-dimensional holomorphic representation of GL 2 (C). A covariant, or polynomial covariant, of weight ρ is a map

C : C 6 [x] → V
which is polynomial in the coefficients, and such that the following transformation rule holds: for every r ∈ GL 2 (C) and

P ∈ C 6 [x],
C det -2 Sym 6 (r) P = ρ(r) C(P ).

(3.4)

If dim V ≥ 2, then C is said to be vector-valued, and otherwise scalarvalued. A fractional covariant is a map satisfying (3.4) which is only required to have a fractional expression in terms of the coefficients.

As for Siegel modular forms, it is enough to consider covariants of weight det k Sym n for k ∈ Z and n ∈ N. What we call a vector-valued covariant of weight det k Sym n is called in [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF] a covariant of order n and degree k + n/2; what we call a scalar-valued covariant of weight det k is called in [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF] an invariant of degree k. The reason for this change of terminology is the following. Proposition 3.2.9. Let ρ be a representation of GL 2 (C) as above. If f is a Siegel modular function of weight ρ, then Cov(f ) is a fractional covariant of weight ρ. Conversely, if F is a fractional covariant of weight ρ, then the meromorphic function τ → F (C(τ )) is a Siegel modular function of weight ρ. These operations are inverse of each other.

Proof. If f is a Siegel modular function, then Cov(f ) is well defined on a Zariski open set of C 6 [x] and is algebraic. Therefore Cov(f ) has a fractional expression in terms of the coefficients. It is easy to check the transformation rules using lemma 3.2.1 and proposition 3.2.5. Proposition 3.2.9 gives a bijection between Siegel modular functions and fractional covariants, but we need more. The following theorem establishes a relation between Siegel modular forms and polynomial covariants, and was first proved in [CFv17, §4].

Theorem 3.2.10. Let f be a Siegel modular form. Then Cov(f ) is a polynomial covariant. Moreover, if f is a cusp form, then Cov(f /χ 10 ) is also a polynomial covariant. Sketch of proof. The main difficulty is that singular hyperelliptic equations form a codimension 1 subset of all degree 6 polynomials: therefore, if f is a Siegel modular form, then the proof of proposition 3.2.9 only shows that Cov(f ) is a polynomial divided by some power of the discriminant. However, one can show that f extends to a certain compactification of A 2 (C) called the toroidal compactification, and this implies that Cov(f ) is well defined on all curve equations with at most one node. Since the complementary of this set has codimension 2, the result follows.

Unlike the graded algebra of vector-valued Siegel modular forms, the graded C-algebra generated by polynomial covariants is finitely generated.

Theorem 3.2.11 ([Cle72, p. 296]). The graded C-algebra of covariants is generated by 26 elements defined over Q. The number of generators of weight det k Sym n is indicated in the following table:

n \ k -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 11 15 0 1 1 1 1 1 2 1 1 1 1 1 1 4 1 1 1 1 1 6 1 1 1 2 8 1 1 1 10 1 12 1
We only need to manipulate a small subset of these generators. Take our scalar generators of even weight to be the Igusa-Clebsch covariants I 2 , I 4 , I 6 , I 10 , in Mestre's notation A , B , C , D [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF], and set

I 6 := (I 2 I 4 -3I 6 )/2.
Denote the generator of weight det 15 by R, and denote by y 1 , y 2 , y 3 the generators of weights det 2 Sym 2 , det 4 Sym 2 , and det 6 Sym 2 respectively; they are constructed explicitly in [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF]§1]. Note that the integers m and n on page 315 of [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF] should be the orders of f and g, and not their degrees. As a sanity check, we mention that the coefficient of a 5 1 a 10 4 in R is 2 -2 3 -6 5 -10 . Finally, the generator of weight det -2 Sym 6 , denoted by X, is the degree 6 polynomial itself.

From q-expansions to covariants

We now explain how to compute the polynomial covariant associated with a Siegel modular form whose q-expansion is known up to a certain precision. The works of Igusa already provide the answer in the case of scalar-valued covariants. Let ψ 4 , ψ 6 , χ 10 and χ 12 be the Siegel modular forms defined in §2.3.2, and let χ 35 be the unique Siegel modular form of weight 35 [START_REF] Igusa | On Siegel modular forms of genus two[END_REF] whose q-expansion starts as follows:

χ 35 (τ ) = q 2 1 q 2 2 (q 1 -q 2 )(q 3 -q -1 3 ) + O(q 4 1 , q 4
2 ).

The modular form χ 35 also has an explicit expression in terms of genus 2 theta constants.

Theorem 3.2.12. We have 4 Cov(ψ 4 ) = I 4 , 4 Cov(ψ 6 ) = I 6 , 2 12 Cov(χ 10 ) = I 10 , 2 15 Cov(χ 12 ) = I 2 I 10 , and 2 37 3 -9 5 -10 Cov(χ 35 ) = I 2 10 R.

Proof. By [Igu62, p. 848], there exists a constant λ ∈ C × such that these relations hold up to a factor of λ k , for k ∈ {4, 6, 10, 12, 35} respectively. Note that Igusa's covariant E is -2 5 3 9 5 10 R. In order to find λ, we apply Thomae's formulae [Mum84, Thm. IIIa.8.1], [Tho70, pp. 216-217] on a hyperelliptic curve C 0 with real roots; for instance

C 0 : y 2 = x(x -1)(x -2)(x -3)(x -4)(x -5).
This yields the values of both the left and right hand sides of theorem 3.2.12 for the curve C 0 . We obtain that λ = 1.

In particular, the Igusa invariants satisfy

Cov(j 1 ) = I 4 I 6 I 10 , Cov(j 2 ) = I 2 I 2 4 I 10 , Cov(j 3 ) = I 5 4 I 2 10 . (3.5)
In order to give an analogue of theorem 3.2.12 for vector-valued modular forms, we compute the q-expansion of the standard curve C(τ ). Recall the Siegel modular form f 8,6 of weight det 8 Sym 6 introduced in example 2.3.10. Proposition 3.2.13. In the notation of §3.2.2, we have Cov(f 8,6 /χ 10 ) = X. In other words, for every τ ∈ H 2 such that χ 10 (τ ) = 0, we have

C(τ ) = f 8,6 (τ ) χ 10 (τ ) .
Proof. Since f 8,6 is a cusp form, by theorem 3.2.10, Cov(f 8,6 /χ 10 ) is a nonzero polynomial covariant of weight det -2 Sym 6 . By theorem 3.2.11, this space of covariants has dimension 1 and is generated by X, so the relation holds up to a factor λ ∈ C × . This yields q-expansions for the coefficients a i (τ ) of C(τ ) up to a factor λ. Then, the relations from theorem 3.2.12 imply λ 4 = λ 6 = λ 35 = 1, hence λ = 1.

Given a Siegel modular form f of weight ρ defined over Q whose qexpansion can be computed, the following algorithm recovers the expression of Cov(f ) as a polynomial.

Algorithm 3.2.14.

1. Compute a basis B of the vector space of polynomial covariants of weight ρ using theorem 3.2.11.

2. Choose a precision n ≥ 1 and compute the q-expansion of f modulo the ideal (q n 1 , q n 2 ) in Q(q 3 )[[q 1 , q 2 ]]. 3. For every B ∈ B, compute the q-expansion of the Siegel modular function τ → B(C(τ )) using proposition 3.2.13.

4. Do linear algebra; if the matrix does not have full rank, go back to step 2 with a larger n.

Sturm-type bounds [BGP17] provide a theoretical limit for the precision n that we need to consider; for the examples given in this thesis, taking n = 3 is sufficient.

We now apply algorithm 3.2.14 to derivatives of Igusa invariants. Recall from proposition 2.3.9 that for each 1 ≤ k ≤ 3, the derivative

dj k dτ := 1 2πi ∂j k ∂z 1 x 2 + ∂j k ∂z 3 x + ∂j k ∂z 2 ,
where we write τ = z 1 (τ ) z 3 (τ ) Proof. Let 1 ≤ k ≤ 3. The function χ 2 10 j k has no poles on A 2 (C). Therefore, the Siegel modular function

z 3 (τ ) z 2 (τ ) ,
f k = χ 3 10 dj k dτ is holomorphic on A 2 (C).
Its q-expansion can be computed from the qexpansion of χ 2 10 j k by formal differentiation. Since

1 2πi ∂ ∂z j = q j ∂ ∂q j
for each 1 ≤ j ≤ 3, we check that f k is a cusp form defined over Q. By theorem 3.2.10, Cov(f k /χ 10 ) is a polynomial covariant of weight det 20 Sym 2 . By theorem 3.2.11, a basis of this space of covariants is given by covariants of the form Iy where y ∈ {y 1 , y 2 , y 3 } and I is a scalar-valued covariant of the appropriate even weight. Algorithm 3.2.14 succeeds with n = 3; the computations were done using Pari/GP [START_REF]Pari/GP version 2[END_REF].

Remark 3.2.16. Theorems 3.2.12 and 3.2.15 can be checked numerically.

Computing big period matrices of hyperelliptic curves using the algorithm of [START_REF] Molin | Computing period matrices and the Abel-Jacobi map of superelliptic curves[END_REF] provides pairs (τ, C(τ )) with τ ∈ H 2 . We can evaluate Igusa invariants and their derivatives at a given τ to high precision using their expression in terms of theta constants (see chapter 6); from this data, we identify the associated covariants to high precision using numerical linear algebra. The computations were done using the libraries hcperiods [START_REF] Molin | Hcperiods: Period matrices and Abel-Jacobi maps of hyperelliptic and superperelliptic curves[END_REF] and cmh [START_REF] Enge | CMH: Computation of Igusa class polynomials[END_REF].

Remark 3.2.17. From theorem 3.2.15, we can compute the covariants associated with derivatives of other modular functions, or even invariants for abelian surfaces with extra structure such as theta constants. For instance, consider the invariants

h 1 = ψ 2 6 ψ 3

Computing the action on tangent spaces

Let ϕ : Jac(C) → Jac(C ) be an -isogeny over C, where is a prime. Using the explicit formula for the Kodaira-Spencer isomorphism provided by theorem 3.2.15, we relate the deformation map of ϕ, computed from derivatives of Siegel modular equations of level , to the tangent map of ϕ. Then we adapt the computations to the Hilbert case, and explain why the results remains valid over any field.

We use an explicit and well-known description of -and β-isogenies over C: namely, they are all described by the Hecke correspondences introduced in §2.4.4. Proposition 3.3.1. Let be a prime number, let F be a real quadratic field, and let β ∈ Z F be a totally positive prime.

1. For every τ ∈ H 2 , the identity map on C 2 induces an -isogeny

A(τ ) → A(τ / ).
Let A, A be principally polarized abelian surfaces over C, and let ϕ : A → A be an -isogeny. Then there exists τ ∈ H 2 such that there is a commutative diagram

A A A(τ ) A(τ / ). ϕ ∼ ∼ z →z
where the vertical arrows are isomorphisms.

2. For every τ = (τ 1 , τ 2 ) ∈ H 2 1 , write τ /β := (τ 1 /β, τ 2 /β). The identity map on C 2 induces a β-isogeny

A F (τ ) → A F (τ /β).
Let A, A be principally polarized abelian surfaces over C with real multiplication by Z F , and let ϕ : A → A be a β-isogeny. Then there exists τ ∈ H 2 1 such that there is a commutative diagram

A A A F (τ ) A F (τ /β) ϕ ∼ ∼ z →z
where the vertical arrows are isomorphisms of principally polarized abelian surfaces with real multiplication.

We used the analogous statement for -isogenies between elliptic curves in chapter 1.

Proof. Let ϕ : A → A be an -isogeny over C. Then there exists a τ ∈ H 2 such that A(τ ) is isomorphic to A. The kernel of ϕ, seen as a subgroup of A(τ )[ ], is maximal isotropic for the symplectic form induced by the polarization; this property characterizes -isogenies [START_REF] Bröker | Modular polynomials for genus 2[END_REF]§3]. If ker ϕ is equal to Λ(τ / ), then we obtain the required diagram. Otherwise, we use the facts that Sp 4 (Z/ Z) acts transitively on maximal isotropic subgroups of A[ ], and that the reduction map Sp 4 (Z) → Sp 4 (Z/ Z) is surjective, to replace τ by a suitable Sp 4 (Z)-conjugate.

The proof in the Hilbert case is similar: if A has real multiplication by Z F , then β-isogenies ϕ with domain A are characterized by the property that ker ϕ is a maximal isotropic subgroup of A[β] (Z/ Z) 2 .

The Siegel case

Let C, C be equations of genus 2 hyperelliptic curves over C, let A, A be their Jacobians, and let ϕ : A → A be an -isogeny. The choice of curve equations encodes a choice of bases of Ω 1 (A) and Ω 1 (A ), or equivalently, by taking dual bases, a choice of bases of the tangent spaces T 0 (A) and T 0 (A ). By an abuse of notation, we identify the tangent map dϕ : T 0 (A) → T 0 (A ) with its matrix written in these bases. Definition 3.3.2. It is convenient to introduce matrix notations.

• For τ ∈ H 2 , we define

∂j(τ ) := 1 2πi ∂j k ∂τ l (τ ) 1≤k,l≤3 •   2 0 0 0 1 0 0 0 2   ,
where we write τ = τ 1 τ 2 τ 2 τ 3 . In other words, if we set

v 1 = 2 0 0 0 , v 2 = 0 1 1 0 , v 3 = 0 0 0 2 ,
then the l-th column of ∂j(τ ) contains (up to 2πi) the derivatives of the three Igusa invariants at τ in the direction v l . More generally, for each r ∈ GL 2 (C), the l-th column of ∂j(τ ) Sym 2 (r) contains the derivatives of Igusa invariants at τ in the direction r v l r t .

Let (A, ω) be a principally polarized abelian surface over C with a basis of differential forms, let η : A → A(τ ) be an isomorphism for some τ ∈ H 2 , and let r be the matrix of η * in the bases ω(τ ) and ω. Since derivatives of Igusa invariants have weight Sym 2 , we have ∂j(A, ω) = ∂j(τ ) Sym 2 (r t ).

We denote by C → ∂j(C) the associated fractional covariant; theorem 3.2.15 expresses the entries of this matrix in terms of the coefficients of C.

• Consider the Siegel modular equations Ψ ,1 , Ψ ,2 , Ψ ,3 of level as elements of the ring Q[J 1 , J 2 , J 3 , J 1 , J 2 , J 3 ], after multiplying by their denominators. We define

DΨ ,L = ∂Ψ ,n ∂J k 1≤n,k≤3 and
DΨ ,R = ∂Ψ ,n ∂J k 1≤n,k≤3 .
Definition 3.3.3. Let ϕ be an -isogeny as above, and write j (resp. j ) as a shorthand for the Igusa invariants (j 1 , j 2 , j 3 ) of A (resp. (j 1 , j 2 , j 3 ) of A ). We say that the isogeny ϕ is generic if the 3 × 3 matrices DΨ ,L (j, j ), DΨ ,R (j, j ), ∂j(C) and ∂j(C ) are invertible. In this case, we define the deformation matrix D(ϕ) of ϕ as

D(ϕ) = -∂j(C ) -1 • DΨ ,R (j, j ) -1 • DΨ ,L (j, j ) • ∂j(C).
The matrix D(ϕ) is the matrix of the deformation map of ϕ in the bases of T A (A 2 ) and T A (A 2 ) associated with ω(C) and ω(C ) via the Kodaira-Spencer isomorphism. Proof. By proposition 3.3.1, there exist τ ∈ H 2 and isomorphisms η, η such that there is a commutative diagram

A A A(τ ) A(τ / ). ϕ η η z →z
Let r be the matrix of η * in the bases ω(τ ) and ω(C), and define r similarly.

Then we have dϕ = r t r -t . By the definition of modular equations, we have

Ψ ,n j 1 (τ ), j 2 (τ ), j 3 (τ ), j 1 (τ / ), j 2 (τ / ), j 3 (τ / ) = 0 for 1 ≤ n ≤ 3.
We differentiate with respect to the entries of τ and obtain

DΨ ,L (j, j ) • ∂j(τ ) + 1 DΨ ,R (j, j ) • ∂j(τ / ) = 0.
We can rewrite this relation as

-DΨ ,L (j, j ) • ∂j(C) • Sym 2 (r t ) = DΨ ,R (j, j ) • ∂j(C ) • Sym 2 (r t ).
Once we compute the deformation matrix D(ϕ), the matrix dϕ can be computed up to sign using proposition 3.3.4. This sign indeterminacy is not an issue in the context of the isogeny algorithm, as the input does not distinguish ϕ from -ϕ.

The Hilbert case

The methods of §3.3.1 can be adapted to modular equations of Hilbert type and level β. In this case, the Kodaira-Spencer isomorphism takes a different form. If A is a principally polarized abelian surface over C with real multiplication by Z F , then T 0 (A) is a Z F ⊗ Z C-module, and we have a canonical isomorphism [Rap78, Prop. 1.6 and 1.9]

T A (A 2,F ) Hom Z F ⊗ Z C T 0 (A), T 0 (A) .
Concretely, this means that we can evaluate Hilbert modular forms on a basis ω of Ω 1 (A) only if ω is Hilbert-normalized. Definition 3.3.5. Let A be a principally polarized abelian surface over C endowed with a real multiplication embedding ι : Z F → End(A) † , and let ω be a basis of Ω 1 (A). We say that (A, ι, ω) is Hilbert-normalized if for every α ∈ Z F , the matrix of ι(α) * : Ω 1 (A) → Ω 1 (A) in the basis ω is ( α 0 0 α ). In more technical terms, we have an isomorphism F ⊗ Q C = F × F via the identity and real conjugation; and ω is Hilbert-normalized if and only if it induces a trivialization of Ω 1 (A) as a F ⊗ Q C-module.

If (A, ι, ω) is Hilbert-normalized and if f is a Hilbert modular form of weight (w 1 , w 2 ), then the quantity f (A, ι, ω) is computed as follows. Choose τ ∈ H 2 1 , and choose an isomorphism η : (A, ι) → A F (τ ), ι F (τ ) , where ι F (τ ) denotes the canonical real multiplication embedding on A F (τ ). Let r be matrix of η * in the bases ω(τ ) and ω. Then r is diagonal; if we write r = r 1 0 0 r 2 , then

f (A, ι, ω) = r w 1 1 r w 2 2 f (τ ).
Given a genus 2 curve C and a real multiplication embedding ι on Jac(C), we say that the equation of C is Hilbert-normalized if (Jac(C), ι, ω(C)) is. Not all curve equations are Hilbert-normalized: the degree of freedom in choosing a Hilbert-normalized curve equation is GL 1 × GL 1 , not GL 2 .

Computing the tangent matrix. For the moment, assume that there exists a β-isogeny ϕ : (A, ι) → (A , ι ) between complex abelian surfaces with real multiplication by Z F , and that we are given curve equations C and C that are Hilbert-normalized with respect to these real multiplication embeddings. We address the question of constructing C and C at the end of this section. Definition 3.3.6. As in the Siegel case, we introduce matrix notations.

• Denote by j 1 , j 2 , j 3 the pullbacks of Igusa invariants to H 2 1 via the Hilbert embedding. For τ ∈ H 2 1 , we define

∂j (F ) (τ ) = 1 πi ∂j k ∂τ l (τ ) 1≤k≤3,1≤l≤2
, where τ = (τ 1 , τ 2 ).

If C is a curve equation such that ω(C) is Hilbert-normalized, then we denote by ∂j (F ) (C) the value of this modular form on C.

• We define the 3 × 3 matrices DΨ β,L and DΨ β,R in the case of Hilbert modular equations of level β in Igusa invariants as in definition 3.3.2.

• Write j as a shorthand for the Igusa invariants (j 1 , j 2 , j 3 ) of A, and j for the invariants (j 1 , j 2 , j 3 ) of A . We say that the isogeny ϕ is generic if the 3 × 2 matrices

DΨ β,L (j, j ) • ∂j (F ) (C) and DΨ β,R (j, j ) • ∂j (F ) (C ) have rank 2.
Since derivatives of Igusa invariants with respect to τ 1 and τ 2 on H 2 1 are Hilbert modular functions of weight (2, 0) and (0, 2) respectively, the weight of the modular function ∂j (F ) is the following.

Lemma 3.3.7. Let (A, ι, ω) be a Hilbert-normalized abelian surface, and let τ ∈ H 2 1 such that there is an isomorphism η : (A, ι) → (A F (τ ), ι F (τ )). Let r be the matrix of η * in the bases ω(τ ) and ω. Then

∂j (F ) (A, ι, ω) = ∂j (F ) (τ ) • r 2 .
In order to compute the value of ∂j (F ) on a curve equation, we relate it with its Siegel analogue ∂j. Proof. Let τ, η, r be as in lemma 3.3.7, and let R ∈ GL 2 (R) be a matrix defining a Hilbert embedding for F . By the expression (2.12) of the Hilbert embedding, the columns of ∂j (F ) (τ ) contain the derivatives of Igusa invariants at H R (τ ) in the directions

1 πi R t 1 0 0 0 R and 1 πi R t 0 0 0 1 R.
Hence we have

∂j (F ) (τ ) = ∂j H R (τ ) • Sym 2 (R t ) • T.

By proposition 3.2.6, we have an isomorphism

ζ : A F (τ ) → A H R (τ ) such that the matrix of ζ * in the bases ω(τ ) and ω H R (τ ) is R. Therefore ∂j (F ) (A, ι, ω) = ∂j (F ) (τ ) • r 2 and ∂j(A, ω) = ∂j(τ ) Sym 2 (rR) t .
It is natural that R does not appear in the result of proposition 3.3.8: the Kodaira-Spencer isomorphisms are intrinsic and independent of the choice of Hilbert embedding. Proposition 3.3.10. Let C be a hyperelliptic curve equation of genus 2 over C whose Jacobian Jac(C) has real multiplication by Z F . Denote the Igusa invariants of Jac(C) by (j 1 , j 2 , j 3 ), and assume that j 3 = 0. Then C is potentially Hilbert-normalized if and only if the two columns of the 3 × 2 matrix ∂j(C) • T where T = 1 0 0 0 0 1 define tangent vectors to the Humbert surface at (j 1 , j 2 , j 3 ).

Proof. Let R ∈ GL 2 (R) be a matrix defining a Hilbert embedding for F , and choose τ ∈ H 2 1 such that there is an isomorphism η : Jac(C) → A F (τ ). Let r be the matrix of η * in the bases ω(τ ) and ω(C). Then the columns of ∂j(C) • T contain, up to πi, the derivatives of Igusa invariants at H R (τ ) in the directions

R t r 1 0 0 0 r t R and R t r 0 0 0 1 r t R.
These directions are tangent to the Humbert surface if and only if r is is either diagonal or anti-diagonal. Moreover, the condition j 3 = 0 ensures that Igusa invariants are local coordinates at H R (τ ) ∈ A 2 (C).

Assume that the equation of the Humbert surface for F in terms of Igusa invariants is given: this precomputation depends only on F . Given Igusa invariants (j 1 , j 2 , j 3 ) on the Humbert surface such that j 3 = 0, the algorithm to reconstruct a potentially Hilbert-normalized curve equation runs as follows.

Algorithm 3.3.11.

1. Construct any curve equation C 0 with Igusa invariants (j 1 , j 2 , j 3 ) using Mestre's algorithm.

2. Compute r ∈ GL 2 (C) such that the two columns of the matrix ∂j(C 0 ) • Sym 2 (r t ) • T are tangent to the Humbert surface at (j 1 , j 2 , j 3 ).

Output det

-2 Sym 6 (r) C 0 .
In step 2, if a, b, c, d denote the entries of r, we only have to solve a quadratic equation in a, c, and a quadratic equation in b, d. Therefore algorithm 3.3.11 involves O F (1) square roots and elementary operations (i.e. a constant number of operations, when F is fixed).

In practice, when computing a β-isogeny ϕ : A → A in the Hilbert case, we are only given the Igusa invariants of A and A . Constructing potentially Hilbert-normalized curves is then equivalent to making a choice of real multiplication embedding for each abelian surface. If these embeddings are incompatible via ϕ, we obtain antidiagonal matrices when computing the tangent matrix using proposition 3.3.9; in this case, we apply the change of variables x → 1/x on one of the curve equations to make them compatible. Even if they are compatible, ϕ will be either a β-or a β-isogeny depending on the choices of real multiplication embeddings. Therefore we really obtain four candidates for the tangent matrix of ϕ up to sign, among which only one is usually correct.

Extension to arbitrary fields

The statements of propositions 3.3.4 and 3.3.9, which we proved over C, make sense over an arbitrary field k, at least if the degree of the isogeny ϕ is prime to the characteristic of k. In fact, they continue to hold in this generalized setting, along with the fundamental property of modular equations: if A and A are abelian surfaces over k with suitable PEL structure satisfying a certain genericity hypothesis, then modular equations of Siegel or Hilbert type vanish at (A, A ) if and only if there exists an isogeny ϕ : A → A of the corresponding type over k.

These extended statements are easily proved if k has characteristic zero using Lefschetz's principle. We can restrict to the case where k is finitely generated over Q; then k embeds in C, so that the complex theory applies.

If k has positive characteristic, then the proof uses more advanced algebraic geometry, namely the notion of moduli stacks that we already mentioned in §3.1. We do not define these objects here, and refer to [START_REF] Laumon | Champs algébriques[END_REF] for the theory; instead, we only look at examples and apply some of their properties in the context of the isogeny algorithm.

Moduli stacks of abelian varieties. The moduli space of abelian varieties of dimension g ≥ 1, denoted by A g , is an algebraic object endowed with a universal family X g → A g such that the following property holds: if S is any scheme, and if X → S is an abelian scheme of dimension g (if S = Spec k, this just means that X is an abelian variety of dimension g over k), then there exists a unique morphism f : S → A g such that X is the pullback of X g via f . In particular we have a bijection between k-points of A g and isomorphism classes of abelian varieties of dimension g over k.

We stress that A g is not a scheme, but its associated coarse moduli scheme A g is; it is even a quasi-projective scheme by geometric invariant theory [START_REF] Mumford | Geometric invariant theory[END_REF]. The k-points of A g still classify isomorphism classes of principally polarized abelian varieties of dimension g over k, but the correspondence may fail to hold over non algebraically closed fields. As an example, take g = 1; the j-invariant realizes an isomorphism from A 1 to the affine space A 1 . Two elliptic curves having the same j-invariant over k are not necessarily isomorphic over k, but they are isomorphic over k.

The set of C-points of A g is identified with the quotient Sp 2g (Z)\H g . Informally, we view A g as the scheme A g endowed with an additional structure of inertia, i.e. the data of a finite group of automorphisms of x, also called stabilizers of x, for each point x of A g . For instance the C-points of A g are identified with the quotient Sp 2g (Z)\H g seen as an orbifold, the same kind of object in the world of complex varieties.

Other examples of moduli stacks are given by the moduli stacks of principally polarized abelian varieties of dimension g endowed with

• a level structure for some fixed ≥ 1,

• the kernel of an -isogeny,

• a real multiplication structure by Z F , where F is a fixed totally real number field of degree g over Q,

denoted by A g ( ), A g, , and A g,F respectively. Not all these moduli problems are well defined over Z. For instance the stacks A g ( ) and A g, classify isomorphism classes of abelian schemes with suitable structure over S when S is a scheme over Z[1/ ], i.e. when S has "characteristic prime to ". Both A g ( ) and A g, can be extended to the whole of Spec Z as algebraic stacks, but giving a modular interpretation becomes more difficult: this is done in [START_REF] Deligne | Les schémas de modules de courbes elliptiques[END_REF] in the case of moduli stacks of elliptic curves.

Smoothness and étaleness. In many aspects, moduli stacks of abelian varieties satisfy nicer properties than their coarse moduli schemes. For instance A g is smooth over Z [FC90], and similarly A g ( ) and A g, are smooth over Z[1/ ]. As smoothness implies formal smoothness [The18, Tag 02GZ], we have the following lifting property. Proposition 3.3.12. Let k be a field of characteristic prime to , and denote by W (k) the Witt ring of k. Let A and A be principally polarized abelian varieties of dimension g ≥ 1 over k, and let ϕ : A → A be anisogeny defined over k. Then there exists an -isogeny ϕ : A → A defined over W (k) between principally polarized abelian varieties A, A over W (k) such that A, A and ϕ have good reduction, and which reduces to the initialisogeny ϕ over k.

As a consequence, the algorithm to compute the tangent matrix dϕ in the Siegel case, presented in §3.3.1, is universally valid over fields of characteristic prime to .

Besides proving the existence of lifts to characteristic zero, moduli stacks help to better understand the geometric situation behind the isogeny algorithm [KPR19, §4]. Indeed, the two maps H ,1 and H ,2 : A g, → A g , that we used to define the deformation map in §3.1, are well-defined and étale everywhere at the level of stacks [KPR19, §4.2.1]. If A is a principally polarized abelian variety of dimension g over k with generic automorphisms, i.e. such that Aut k (A) = {±1}, then the scheme A g and the stack A g are essentially isomorphic locally around A; we refer to [KPR19, §4.1] for more details, notably the statement of Luna's fundamental lemma. From this, we obtain a sufficient condition for an -isogeny to be generic in the sense of definition 3.3.3. Proposition 3.3.13 ([KPR19, §4.5]). Let k be a field, and let U be the open set of A 2 consisting of abelian surfaces A such that Aut k (A) = {±1} and j 3 (A) = 0. Let ϕ : A → A be an -isogeny over k such that A and A lie in U, and such that the subvariety cut out by Siegel modular equations of level is normal at (j(A), j(A )), where j denotes the collection of the three Igusa invariants. Then ϕ is generic in the sense of definition 3.3.3.

In fact, all the computations of §3.3.1 can be interpreted algebraically, and hence make sense over any scheme of characteristic prime to [KPR19, §4.5]; this is arguably a more intrinsic way of showing their universal validity than using Lefschetz's principle.

The Hilbert case. The situation in the Hilbert case is analogous: we have a map

H β = (H β,1 , H β,2 ) : A g,β → A g,F × A g,F
where A g,β denotes the moduli stack of principally polarized abelian varieties of dimension g with real multiplication by Z F endowed with the kernel of a β-isogeny, and both H β,1 and H β,2 are everywhere étale. All these stacks are smooth over Z[1/ ], where = N F/Q (β) [KPR19, §4.2.3], [START_REF] Rapoport | Compactifications de l'espace de modules de Hilbert-Blumenthal[END_REF]. As in proposition 3.3.12, we obtain a sufficient condition for a βisogeny ϕ to be generic, at least if we are using nonsymmetric invariants on the Hilbert surface [KPR19, §4.5].

To interpret the computation of the tangent matrix in proposition 3.3.9 algebraically if ϕ : A → A is a β-isogeny defined over a field k, we consider the tangent spaces of A and A at zero as well as the tangent spaces to the Hilbert surface at A and A as Z F ⊗ Z k-modules of rank 1 [KPR19, §4.3.2]. Up to enlarging k, we fix an isomorphism Z F ⊗ Z k k × k; concretely, we choose a particular value of √ ∆ in k, where ∆ denotes the discriminant of F . Then we define a Hilbert-normalized basis of differential forms on A as a basis of Ω 1 (A) in which the action of Z F ⊗ Z k by multiplication takes the form of the action of k × k by diagonal matrices; when k = C, we recover definition 3.3.5.

If A and A are endowed with Hilbert-normalized bases of differential forms, then dϕ is a diagonal matrix and can be computed as in proposition 3.3.9. Moreover, if (ω 1 , ω 2 ) is a Hilbert-normalized basis of differential forms on A, then (ω 1 ⊗ ω 1 , ω 2 ⊗ ω 2 ) is naturally identified with a basis of T A (A 2,F ) [Rap78, Prop. 1.6]: this provides an algebraic interpretation of proposition 3.3.8, and also shows that algorithm 3.3.11 to construct Hilbert-normalized curve equations is universally valid. When √ ∆ / ∈ k, we could also use another presentation of Z F ⊗ Z k instead of diagonal matrices; since Z F ⊗ Z k has no zero divisors in this case, we should be able to decover ±dϕ from (dϕ) 2 without ambiguity.

Computing isogenies from tangent maps

General strategy

Let A, A be principally polarized abelian varieties of dimension g defined over a field k, and assume that we are given the tangent map dϕ of a separable isogeny ϕ : A → A . In general, the task of computing ϕ explicitly is the following: given models of A and A , i.e. given very ample line bundles L A , L A on A, A and a choice of global sections (a i ) (resp. (a j )) which give a projective embedding of A (resp. A ), express the functions ϕ * a j on A as rational fractions in terms the coordinates (a i ).

One method to determine ϕ given dϕ is to use the formal groups of A and A . Let x 1 , . . . , x g be uniformizers at the neutral point 0 A of A, and let y 1 , . . . , y g be uniformizers at 0 A . Knowing the map dϕ is equivalent to expressing the differential forms ϕ * dy j in term of the differential forms dx i on A. This allows us to write a differential system satisfied by the functions ϕ * a j . We can try to solve this differential system using a multivariate Newton algorithm, possibly over an extension of the formal group. If the algorithm succeeds, we recover the functions ϕ * a j as power series in x 1 , . . . , x g up to some precision. Finally we obtain ϕ as a rational map by multivariate rational reconstruction. In order for the rational reconstruc-tion algorithm to succeed, the power series precision must be large enough when compared to the degrees of the result in the variables (a i ). These degrees can be estimated from the intersection degree of ϕ * L A and L A , or alternatively from the intersection degree of ϕ * L A and L A .

This strategy to compute ϕ is not new: the idea of using a differential equation to compute isogenies in dimension 1 appears in [START_REF] Elkies | Elliptic and modular curves over finite fields and related computational issues[END_REF], and [START_REF] Bostan | Fast algorithms for computing isogenies between elliptic curves[END_REF] uses a Newton algorithm to solve this differential equation, as we explained in §1.2.2. These ideas are extended to dimension 2 in [START_REF] Couveignes | Computing functions on Jacobians and their quotients[END_REF]. The method is further extended to compute endomorphisms of Jacobians over a number field in [START_REF] Costa | Rigorous computation of the endomorphism ring of a Jacobian[END_REF]. In [CMSV19, §6], the endomorphism is represented as a divisorial correspondence; the interpolation of this divisor is done via linear algebra on Riemann-Roch spaces.

A necessary condition for the whole method to work is that ϕ be completely determined by its tangent map. In general, this will be the case when char k is large with respect to the degree of ϕ. For instance, we have the following statement in the case of -isogenies.

Proposition 3.4.1. Let A and A be principally polarized abelian varieties over a field k, and let M : T 0 (A) → T 0 (A ) be a linear map. Assume that either char k = 0 or char k > 4N . Then there exists at most one -isogeny ϕ : A → A with ≤ N such that dϕ = M . Proof. Let ϕ 1 and ϕ 2 be two such isogenies. Then ϕ 1 = ϕ 2 + ψ where ψ is inseparable. If char k = 0, this implies ψ = 0 and hence ϕ 1 = ϕ 2 . Otherwise, write p = char k and denote by ϕ 1 the contragredient isogeny. Then we have

ψ ψ = ϕ 2 ϕ 2 + ϕ 1 ϕ 1 -ϕ 1 ϕ 2 -ϕ 2 ϕ 1 .
If ψ = 0, then ψ ψ is equal to p m for some m ≥ 1, and ϕ 1 ϕ 1 = 1 , ϕ 2 ϕ 2 = 2 with max { 1 , 2 } ≤ N by hypothesis. Therefore we obtain p m ≤ 4N .

In practice, Newton iterations will fail to reach sufficiently high power series precision if char k is too small.

In the rest of this section, we carry out this strategy in detail when A and A are the Jacobians of genus 2 hyperelliptic curves C and C . Concretely, we are given the matrix of dϕ in the bases of T 0 (A) and T 0 (A ) that are dual to ω(C) and ω(C ) respectively; this is precisely the input provided by the algorithm of §3.3. In this case, a nice simplification occurs: the isogeny ϕ is completely determined by the compositum

C Jac(C) Jac(C ) C <2> A 4 Q →[Q-P ] ϕ ∼ m (3.6)
where P is any point on C, and m is the rational map given by

{(x 1 , y 1 ), (x 2 , y 2 )} → x 1 + x 2 , x 1 x 2 , y 1 y 2 , y 2 -y 1 x 2 -x 1 .
The compositum (3.6) is a tuple of four rational fractions s, p, q, r ∈ k(u, v) that we call the rational representation of ϕ at the base point P . We choose a uniformizer z of C around P and perform the Newton iterations and rational reconstruction using univariate power series in z.

We explain how we choose the base point P and solve the differential system in §3.4.2. One difficulty is that the differential system we obtain is singular; therefore we use the geometry of the curves to compute the first few terms in the series before switching to Newton iterations. In §3.4.3, we estimate the degrees of the rational fractions that we want to compute and present the rational reconstruction step.

Solving the differential equation

We write the curve equations C, C and the tangent matrix as

C : v 2 = E C (u), C : y 2 = E C (x), and dϕ = m 1,1 m 1,2 m 2,1 m 2,2 .
We assume that ϕ is separable, so that dϕ is invertible. If P is a base point on C, we denote by η P the associated embedding C → Jac(C), as in §2.1.2. Since C is smooth and C <2> is proper, the compositum

C Jac(C) Jac(C ) C <2> η P ϕ ∼
extends to a morphism from C to C <2> that we denote by ϕ P .

Step 1: choice of base point and power series. Let P be a point on C which is not a point at infinity; after enlarging k, we assume that P ∈ C(k). Since ϕ P (P ) is zero in Jac(C ), we have

ϕ P (P ) = {Q, i(Q)}
for some point Q on C , where i denotes the hyperelliptic involution on C . We say that ϕ P is of Weierstrass type if Q is a Weierstrass point of C , and of generic type otherwise. If z is a local uniformizer of C at P , and if R is an étale extension of k[[z]], then we define a local lift of ϕ P at P with coefficients in R to be a tuple ϕ P = (x 1 , x 2 , y 1 , y 2 ) ∈ R 4 such that we have

a commutative diagram Spec R C 2 Spec k[[z]] C C <2> .
(x 1 ,y 1 ),(x 2 ,y 2 )

ϕ P (3.7)
If the power series x 1 , x 2 , y 1 , y 2 define a local lift of ϕ P , then they satisfy the following differential system:

               x 1 dx 1 y 1 + x 2 dx 2 y 2 = (m 1,1 u + m 1,2 ) du v dx 1 y 1 + dx 2 y 2 = (m 2,1 u + m 2,2 ) du v y 2 1 = E C (x 1 ) y 2 2 = E C (x 2 ), (3.8)
where we consider the coordinates u, v on C as elements of k[[z]], and where the letter d denotes derivation with respect to z. We will show how to solve (3.8) when ϕ P is of generic type. Proposition 3.4.4 below explains how to choose the base point P in order to enforce this condition; in order to prove it, we first study the existence of local lifts for arbitrary base points.

Lemma 3.4.2. Let z be a uniformizer of C at P . Then there exists a quadratic extension k /k and a local lift of ϕ P at P with coefficients in

R = k [[ √ z]]. Moreover, if ϕ P is of generic type, or if P is a Weierstrass point of C, then the same statement holds with R = k [[z]].
Proof. First, we assume that ϕ P is of generic type. Since the unordered pair {Q, i(Q)} is defined over k, there exists a quadratic extension k /k such that Q is defined over k . The map C 2 → C <2> is étale at (Q, i(Q)), so it induces an isomorphism of completed local rings. Therefore a local lift of ϕ P exists over k

[[z]].
Second, we assume that ϕ P is of Weierstrass type. In diagram (3.7), the bottom map Spec k[[z]] → C <2> defines a k((z))-point of C <2> , and there exists a preimage of this point defined over an extension

K of k((z)) of degree 2. Let R be the integral closure of k[[z]] in K. Then R is contained in k [[ √ z]] for some quadratic extension k of k [The18, Tag 09E8].
By the valuative criterion of properness, our K-point of C 2 extends to an R-point uniquely, so a local lift exists over R.

Finally, we assume that ϕ P is of Weierstrass type and that P is a Weierstrass point of C. Let (x 1 , x 2 , y 1 , y 2 ) be a local lift of

ϕ P over k [[ √ z]].
The completed local ring of the Kummer line of C at P is k[[z 2 ]], and the unordered pair {x 1 , x 2 } is defined on the Kummer line; by the same argument as above, x 1 and x 2 are actually defined over k [[z]]. The differential system (3.8) can be written as

1/y 1 1/y 2 = x 1 dx 1 x 2 dx 2 dx 1 dx 2 -1 R 1 (z) R 2 (z)
for some power series

R 1 , R 2 ∈ k[[z]].
Therefore y 1 and y 2 are defined over k [[z]] as well.

Consider the tangent space

T (Q,i(Q)) (C 2 ) of C 2 at (Q, i(Q)). It decom- poses as T (Q,i(Q)) (C 2 ) = T Q (C ) ⊕ T i(Q) (C ) (T Q (C )) 2 (3.9)
where the last isomorphism in (3.9) is given by the hyperelliptic involution on the second term.

Lemma 3.4.3. Assume that a local lift ϕ P of ϕ P to k [[z]] exists. Then under the isomorphism (3.9), the tangent vector d ϕ P /dz at z = 0 is not of the form (v, v) where v ∈ T Q (C ).

Proof. Assume the contrary. Since the direction (1, 1) is contracted to zero in Jac(C ), every differential form on Jac(C ) is pulled back to zero via ϕ P . This is a contradiction because ϕ * is nonzero.

Proposition 3.4.4. The unordered pair {Q, i(Q)} = ϕ P (P ) is uniquely determined by the property that, up to a scalar factor,

ϕ * ω Q = ω P
where ω P (resp. ω Q ) is a nonzero differential form on C (resp. C ) vanishing at P (resp. Q).

Proof. First, assume that a local lift ϕ P exists over k [[z]]. By lemma 3.4.3, the tangent vector d ϕ P /dz at z = 0 is of the form (v + w, w) for some v, w ∈ T Q (C ) such that v = 0. Let ω be the unique nonzero differential form pulled back to ω P by ϕ. Then ω vanishes on (v, 0), in other words ω vanishes at Q. Second, assume that no such lift exists. By lemma 3.4.2, Q is a Weierstrass point on C , and P is not a Weierstrass point on C. After a change of variables, we may assume that Q is not at infinity. Write P = (u 0 , v 0 ) with v 0 = 0, and Q = (x 0 , 0). We have to show that

x 0 = m 1,1 u 0 + m 1,2 m 2,1 u 0 + m 2,2 . Let (x 1 , y 1 , x 2 , y 2 ) be a lift over k [[ √ z]
] as in lemma 3.4.2, and look at the differential system (3.8). Write the lift as

y 1 = v 1 √ z + t 1 z + O(z 3/2 ) and y 2 = v 2 √ z + t 2 z + O(z 3/2 ).
Then the relation y 2 = E C (x) forces x 1 and x 2 to have no term in √ z, so that we can write

x 1 = x 0 + w 1 z + O(z 3/2 ) and x 2 = x 0 + w 2 z + O(z 3/2 ).
Using the relation dx/y = 2 dy/E C (x), we obtain the equalities

       2x 1 dy 1 E C (x 1 ) + 2x 2 dy 2 E C (x 2 ) = (m 1,1 u + m 1,2 ) du v , 2 dy 1 E C (x 1 ) + 2 dy 2 E C (x 2 ) = (m 2,1 u + m 2,2 ) du v .
(3.10)

Inspection of the coefficients in ( √ z) -1 gives the relation v 1 = -v 2 . Write e = E C (x 0 ). Then the constant term of the series on the left hand side of (3.10) are respectively

2x 0 t 1 e + t 2
e and 2 t 1 e + t 2 e . The differential forms on the right hand side do not vanish simultaneously at P , therefore m 2,1 u 0 + m 2,2 is nonzero. Taking the constant term in the quotient of the two lines of (3.10) gives the result. Using proposition 3.4.4, we choose a base point P on C such that ϕ P is of generic type. By lemma 3.4.2, a local lift ϕ

P = (x 1 , x 2 , y 1 , y 2 ) of ϕ P exists over k [[z]],
where k is a quadratic extension of k. By the proof of lemma 3.4.2, k is the field of definition of Q.

Let U and D be the power series in z with respective constant terms u 0 and d 0 such that u = U (z) and du/v = D(z) dz. Then we can rewrite (3.8) as follows:

               x 1 x 1 y 1 + x 2 x 2 y 2 = (m 1,1 U + m 2,1 )D x 1 y 1 + x 2 y 2 = (m 2,1 U + m 2,2 )D y 2 1 = E C (x 1 ) y 2 2 = E C (x 2 ).
(3.11)

where the prime denotes derivation with respect to z.

123

Step 2: initialization. Now we explain how to compute the power series x 1 , x 2 , y 1 , y 2 up to O(z 2 ), keeping the notation above. First, we compute the point Q = (x 0 , y 0 ) using proposition 3.4.4. Write

x 1 = x 0 + v 1 z + O(z 2 ), x 2 = x 0 + v 2 z + O(z 2 ).
Then, using the curve equations, we can compute y 1 , y 2 up to O(z 2 ) in terms of v 1 , v 2 respectively. Then (3.11) gives

v 1 + v 2 = y 0 x 0 (m 1,1 u 0 + m 2,1 )d 0 = y 0 (m 2,1 u 0 + m 2,2 )d 0 .
(3.12)

Combining the two lines of (3.11), we also obtain

(x 1 -x 0 ) x 1 y 1 + (x 2 -x 0 ) x 2 y 2 = R,
where R = r 1 z + O(z 2 ) has no constant term. At order 1, this yields

v 2 1 + v 2 2 = y 0 r 1 . (3.13)
Combining (3.12) and (3.13) yields a quadratic equation satisfied by v 1 and v 2 .

Step 3: Newton iterations. Assume that the series x 1 , x 2 , y 1 , y 2 are known up to O(z n ) for some n ≥ 2. The system (3.11) is satisfied up to O(z n-1 ) for the first two lines, and O(z n ) for the last two lines. We attempt to double the current precision, and write

x 1 = x 0 1 (z) + δx 1 (z) + O(z 2n
), etc. where x 0 1 is the polynomial of degree at most n -1 that has already been computed. The unknown series δx i and δy i for i ∈ {1, 2} start at the term z n . As above, we denote by x the derivative of a power series x with respect to z. Proposition 3.4.5. The power series δx 1 and δx 2 satisfy a linear differential equation of the form

M (z) δx 1 δx 2 + N (z) δx 1 δx 2 = R(z) + O(z 2n-1 ) (3.14) where M, N ∈ Mat 2×2 (k [[z]]) and R ∈ Mat 2×1 (k [[z]]) have explicit expres- sions in terms of x 0 1 , x 0 2 , y 0 1 , y 0 2 , u, v, E C and E C . In particular, M (z) = x 0 1 /y 0 1 x 0 2 /y 0 2 1/y 0 1 1/y 0 2 124
and, writing e = E C (x 0 ), the constant term of N is

   v 1 y 0 - x 0 v 1 2y 3 0 e v 2 y 0 - x 0 v 2 2y 3 0 e - v 1 2y 3 0 e - v 2 2y 3 0 e    .
Proof. Linearize the system (3.11). We omit the calculations.

In order to solve the system (3.11) in quasi-linear time in the required precision, it is enough to solve equation (3.14) in quasi-linear time in n. One difficulty here, that does not appear in similar works [START_REF] Couveignes | Computing functions on Jacobians and their quotients[END_REF][START_REF] Costa | Rigorous computation of the endomorphism ring of a Jacobian[END_REF], is that the matrix M is not invertible in k Proof. We know that y 0 1 and y 0 2 have constant term ±y 0 = 0. The polynomials x 0 1 and x 0 2 have the same constant term x 0 , but they do not coincide at order 1: if they did, then so would y 1 and y 2 because of the curve equation, contradicting lemma 3. Proof. By lemma 3.4.6, the leading term of det(M ) is λz for some nonzero λ ∈ k . By proposition 3.4.5, the constant term of det(A + κ) is λ 2 κ(κ + 1). We omit the calculations. We show that θ can be computed from this kind of equation up to O(z d ) using a divide-and-conquer strategy. If d > 1, write θ = θ 1 + z d 1 θ 2 where d 1 = d/2 . Then we have

zθ 1 + (A + κ)θ 1 = B + O(z d 1 ).
125

By induction, we can recover θ 1 up to O(z d 1 ). Then

zθ 2 + (A + κ + d 1 )θ 2 = E + O(z d-d 1 )
where E can be computed from θ 1 . By induction, we recover θ 2 up to precision O(z d-d 1 ), hence we can recover θ up to O(z d ). We initialize the induction with the case d = 1, where we have to solve for the constant term in an equation of the form

(A + κ)θ = B.
Since

θ

Rational reconstruction

Finally, we want to recover the rational representation (s, p, q, r) of ϕ at P from its power series expansion ϕ P at some finite precision. First, we estimate the degrees of the rational fractions that we want to compute; then we present the reconstruction algorithm.

Degree estimates. The degrees of s, p, q, r as morphisms from C to P 1 can be computed as the intersection numbers of certain divisors on Jac(C ), namely ϕ P (C) and the polar divisors of s, p, q and r as functions on Jac(C ). These degrees are already known in the case of an -isogeny.

Proposition 3.4.10 ([CE15, §6.1]). Let ϕ : Jac(C) → Jac(C ) be anisogeny, and let P ∈ C(k). Let (s, p, q, r) be the rational representation of ϕ at the base point P . Then the degrees of s, p, q and r as morphisms from C to P 1 are 4 , 4 , 12 , and 8 respectively.

Let F be a real quadratic field, and assume that Jac(C) and Jac(C ) have real multiplication by Z F given by embeddings ι : Z F → End(Jac(C)) † and ι . Let ϕ : (Jac(C), ι) → (Jac(C ), ι ) be a β-isogeny. Denote the theta divisors on Jac(C) and Jac(C ) by Θ and Θ respectively, and denote by η

P : C → Jac(C) the map Q → [Q -P ].
Then η P (C) is algebraically equivalent to Θ.

on NS(A) corresponds via the bijection (2.2) to the quadratic form on Z F given by

α → 2 Tr F/Q (α 2 ) - 1 2 Tr F/Q (α) 2 .
Corollary 3.4.14. Let (A, ι) be a principally polarized abelian surface with real multiplication by Z F , and let Θ be its theta divisor. Let α ∈ Z F . Then we have L

ι(α) A • Θ 2 = Tr F/Q (α) 2 .
Proof. Write α = a + b √ ∆, where ∆ denotes the discriminant of F . By proposition 3.4.13, we have

L ι(α) A • Θ 2 -2 L ι(α) A • L ι(α) A = 2 Tr(α 2 ) - 1 2 Tr(α) 2 = 4b 2 ∆.
On the other hand, the Riemann-Roch theorem [START_REF] Milne | Abelian varieties[END_REF]Thm. 11.1] gives

L ι(α) A • L ι(α) A = 2 χ L ι(α) A = 2 deg ι(α) = 2(a 2 -b 2 ∆).
The result follows by combining the two equations.

Proposition 3.4.15. Let ϕ be a β-isogeny as above, and let (s, p, q, r) be the rational representation of ϕ at P . Then the respective degrees of s, p, q, and r considered as morphisms from C to P 1 are 2 Tr F/Q (β), 2 Tr F/Q (β), 6 Tr F/Q (β) and 4 Tr F/Q (β).

Proof. The degrees of s, p, q, r can be computed as the intersection degrees of the polar divisors from lemma 3.4.11 and the divisor ϕ P (C). By lemma 3.4.12, the line bundle associated with ϕ

P (C) is L ι (β)
Jac(C ) up to algebraic equivalence. Its intersection number with Θ is nonnegative, hence by corollary 3.4.14, we have

ϕ P (C) • Θ = Tr F/Q (β) = Tr F/Q (β).
The result follows by lemma 3.4.11.

Rational reconstruction. Let us present the rational reconstruction algorithm, and compute the power series precision that is precisely needed to recover rational representations of -and β-isogenies.

Lemma 3.4.16. Let s : C → P 1 be a morphism of degree d ≥ 1.

If s is invariant under the hyperelliptic involution, then we can write

s(u, v) = X(u) where the degree of the rational fraction X is bounded above by d/2.

2. In general, let X, Y be the rational fractions such that

s(u, v) = X(u) + v Y (u).
Then the degrees of X and Y are bounded above by d and d + 3 respectively.

Proof. The function u : C → P 1 has degree 2; item 1 follows. For item 2, write

s(u, v) + s(u, -v) = 2X(u), s(u, v) -s(u, -v) v = 2Y (u).
The degrees of these morphisms are bounded above by 2d and 2d + 6 respectively, and item 1 applies.

Proposition 3.4.17. Let ϕ P and ϕ i(P ) be local lifts of ϕ P at P and i(P ) in the uniformizers z and i(z), where i denotes the hyperelliptic involution on C. Let n = 8 + 7 in the Siegel case, and n = 4 Tr F/Q (β) + 7 in the Hilbert case. Then, given ϕ P and ϕ i(P ) at precision O(z n ), we can compute the rational representation of ϕ at P within O(n) field operations.

Proof. It is sufficient to recover the rational fractions s and p; afterwards, q and r can be computed from the equation of C . First, assume that P is a Weierstrass point of C. Then s, p are invariant under the hyperelliptic involution. Therefore we have to recover univariate rational fractions in u of degree d ≤ 2 (resp. d ≤ Tr F/Q (β)), by propositions 3.4.10 and 3.4.15. This can be done in O(n) field operations from the power series expansions of s and p up to precision O(u 2d+1 ) [BCG + 17, §7.1]. Since u has valuation 2 in z, we need to compute ϕ P at precision O(z 4d+1 ).

Second, assume that P is not a Weierstrass point of C. Then the series defining s(u, -v) and p(u, -v) are given by ϕ i(P ) . We have to compute rational fractions of degree d ≤ 4 + 3 (resp. d ≤ 2 Tr F/Q (β) + 3) in u, by lemma 3.4.16. Since u has valuation 1 in z, this can be done in O(n) field operations if ϕ P and ϕ i(P ) are known up to precision O(z 2d+1 ).

Summary of the algorithm

We summarize the isogeny algorithm and state precise complexity results in both the Siegel case (theorem 3.5.2) and the Hilbert case (theorem 3.5.3). Let k be any field, and let F be a fixed real quadratic field. Algorithm 3.5.1. Let A and A be principally polarized abelian surfaces over k. Assume either that A and A are -isogenous where is a prime (the Siegel case), or that A and A have real multiplication by Z F and are β-isogenous where β ∈ Z F is a totally positive prime (the Hilbert case). Moreover, assume that the isogeny, called ϕ, is generic in the sense of definition 3.3.3 or definition 3.3.6.

1. Use Mestre's algorithm [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF] to construct curve equations C and C

whose Jacobians are isomorphic to A and A respectively. In the Hilbert case, use algorithm 3.3.11 to ensure that C and C are potentially Hilbert-normalized.

2. Compute at most 4 candidates for the tangent matrix of the isogeny ϕ using proposition 3.3.4 in the Siegel case, or proposition 3.3.9 in the Hilbert case. Run the rest of the algorithm for all these candidates; in general, only one will produce meaningful results.

3. Choose a base point P on C such that ϕ P is of generic type using proposition 3.4.4, and compute the power series ϕ P and ϕ i(P ) up to precision O z 8 +7 , resp. O z 4 Tr(β)+7 using proposition 3.4.9.

4. Recover the rational representation of ϕ at P using proposition 3.4.17.

Theorem 3.5.2. Let be a prime, and let k be a field such that char k = 0 or char k > 8 +7. Assume that there exists an algorithm to evaluate derivatives of Siegel modular equations of level at given Igusa invariants (j, j ) over k using C eval ( ) operations in k.

Let A, A be principally polarized abelian surfaces over k whose Igusa invariants j(A), j(A ) are well defined, and assume that there exists an -isogeny ϕ : A → A defined over k which is generic in the sense of definition 3.3.3. Then, given j(A) and j(A ), algorithm 3.5.1 succeeds and returns square roots. Under our hypotheses, proposition 3.3.4 applies and allows us to recover the matrix Sym 2 (dϕ) using O(C eval ( )) + O(1) operations in k. We recover dϕ up to sign using O(1) square roots and elementary operations; since ϕ is defined over k, extending the base field is not necessary. We choose the base point P on C such that ϕ P is of generic type using proposition 3.4.4, perhaps taking another extension of degree 2. By proposition 3.4.9, we can compute the local lifts ϕ P and ϕ i(P ) up to precision 8 + 7 within O( ) field operations; this is where we use the hypothesis on char k. Finally, we recover the rational representation at P using O( ) field operations by proposition 3.4.17. The total number of quadratic extensions taken is at most 3.

We conclude with the analogue of theorem 3.5.2 in the Hilbert case.

Theorem 3.5.3. Let F be a real quadratic field, and let β ∈ Z F be a totally positive prime. Let k be a field such that either char k = 0 or char k > 4 Tr F/Q (β) + 7. Assume that there exists an algorithm to evaluate derivatives of Hilbert modular equations of level β in Igusa invariants at a given point (j, j ) over k using C eval (β) operations in k.

Let A, A be principally polarized abelian surfaces over k with real multiplication by Z F whose Igusa invariants j(A), j(A ) are well defined, and assume that there exists a β-isogeny ϕ : A → A defined over k which is generic in the sense of definition 3.3.6. Then, given j(A) and j(A ), algorithm 3. Note that C eval (β) also depends on F . We expect that the algorithm returns only one answer for the rational representation of ϕ at P ; if the algorithm outputs several answers, we could implement tests of correctness, but they might be more expensive than the isogeny algorithm itself.

Proof. We use algorithm 3.3.11 to construct the curve equations C and C . We obtain potentially Hilbert-normalized curves, and each of them is defined over an extension of k of degree dividing 4. This requires O F (1) elementary operations and O(1) square roots in k. We may assume that C and C are Hilbert-normalized for some choice of real multiplication embeddings that are compatible via ϕ, which becomes either a β-or a β-isogeny.

Under our hypotheses, proposition 3.3.9 applies and allows us to recover two possible values for (dϕ) 2 within O(C eval (β)) + O(1) operations in k, and hence 4 possible values for dϕ, by taking O(1) square roots. We can now make a change of variables to the (not necessarily Hilbert-normalized) curves output by Mestre's algorithm, so that each curve is defined over an extension of k of degree at most 2. The end of the algorithm is similar to the Siegel case: we take an extension of degree 2 to find the base point, then we try to compute the rational representation for each value of dϕ using O(Tr F/Q (β)) operations in k. For the correct value of dϕ, rational reconstruction will succeed and output fractions of the correct degrees.

An example in the Hilbert case for Q( √ 5)

To conclude this chapter, we present a variant of our algorithm in the case of principally polarized abelian varieties with real multiplication by Z F where F = Q( √ 5). In this case, the Humbert surface is rational: its function field can be generated by only two elements called Gundlach invariants, introduced in §2.3.4. Having only two coordinates reduces the size of modular equations, as we mentioned in §2.4.4.

We work over C, but the methods of §3.3.3 show that the computations remain valid in general. We illustrate the algorithm with an example of cyclic isogeny of degree 11 over a finite field.

Variants in the isogeny algorithm

There are two improvements. First, in the construction of Hilbertnormalized curves, we take advantage of the known structure of the ring of Hilbert modular forms to find an expression for the standard curve C F (τ ) when τ ∈ H 2 1 . Second, reducing the number of variables allows us to compute (dϕ) 2 using only 2 × 2 matrices.

Constructing potentially Hilbert-normalized curves. An alternative method to algorithm 3.3.11 is given by proposition 2.3.17, which gives the expression of the "universal" Siegel modular form f 8,6 as a Hilbert modular form. We keep the notation used in this proposition and in §3.2.1. By propositions 3.2.7 and 3.2.13, the standard curve C F (τ ) attached to τ ∈ H 2 1 is proportional to the curve y 2 = b i (τ )x i . The algorithm to compute a potentially Hilbert-normalized curve C from its Igusa invariants (j 1 , j 2 , j 3 ) runs as follows.

Algorithm 3.6.1.

1. Compute Gundlach invariants (g 1 , g 2 ) mapping to the Igusa invariants (j 1 , j 2 , j 3 ) via the Hilbert embedding using proposition 2.3.16, and compute values for the generators G 2 , F 6 , F 10 giving these values of g 1 , g 2 .

Compute b 2

3 , b 1 b 5 , etc. using proposition 2.3.17. 3. Recover values for the coefficients: let b 3 be any square root of b 2 3 ; choose any value for b 1 , which gives b 5 ; finally, solve a quadratic equation to find b 0 and b 6 .

We can always choose values of G 2 , F 6 , and F 10 in such a way that b 2 3 is a square in k. Then the output is defined over a quadratic extension of k. Even if arbitrary choices are made during algorithm 3.6.1, the output will be potentially Hilbert-normalized.

Computing the tangent matrix. Consider the Hilbert modular equations in Gundlach invariants of level β, denoted by Ψ β,1 and Ψ β,2 , as elements of the ring Q[G 1 , G 2 , G 1 , G 2 ] after multiplication by their denomiators. Define the 2 × 2 matrices

DΨ β,L = ∂Ψ n ∂G k 1≤n,k≤2 and DΨ β,R = ∂Ψ n ∂G k 1≤n,k≤2 .
Then the analogue of proposition 3.3.9 holds, where we replace derivatives of Igusa invariants by derivatives of Gundlach invariants. The relation between these derivatives is given by proposition 2.3.16.

An example of cyclic isogeny

We illustrate our algorithm in the Hilbert case with F = Q( √ 5) by computing a β-isogeny between Jacobians with real multiplication by Z F , where

β = 3 + 1 + √ 5 2 ∈ Z F , so that N F/Q (β) = 11 and Tr F/Q (β) = 7.
We work over the prime finite field k = F 56311 , whose characteristic is large enough for our purposes. We choose a trivialization of Z F ⊗ Z k, in other words a square root of 5 in k, so that β = 26213.

Consider the Gundlach invariants (g 1 , g 2 ) = 23, 56260 , (g 1 , g 2 ) = 8, 36073 .

The corresponding Igusa invariants are (j 1 , j 2 , j 3 ) = 14030, 9041, 56122 , (j 1 , j 2 , j 3 ) = 13752, 42980, 12538 ;

they lie on the Humbert surface as expected.

In order to reconstruct a Hilbert-normalized curve, we apply algorithm 3.6.1. We obtain the curve equations

C : v 2 = 13425u 6 + 34724u 5 + 102u 3 + 54150u + 11111 C : y 2 = 47601x 6 + 35850x 5 + 40476x 3 + 24699x + 40502.
The derivatives of Gundlach invariants are given by the matrices

∂g (F ) (C) = 43658 17394 16028 26656 , ∂g (F ) (C ) = 15131 739 50692 49952 .
After computing derivatives of the modular equations as in proposition 3.3.9, we find that the isogeny ϕ is compatible with the real multiplication embeddings for which C and C are Hilbert-normalized. We do not known whether ϕ is a β-or a β-isogeny, so we have four candidates for the tangent matrix up to sign:

dϕ β,± = 38932α + 19466 0 0 ±(53318α + 26659) , dϕ β,± = 50651α + 53481 0 0 ±(11076α + 5538)
where α 2 + α + 2 = 0. We see that ϕ is only defined over the quadratic extension k(α).

The curve C has the rational Weierstrass point 36392, 0 . We can bring it to (0, 0), so that C is of the more standard form

C : v 2 = 33461u 6 + 7399u 5 + 16387u 4 + 34825u 3 + 14713u 2 + u.
This change of variables multiplies the tangent matrix dϕ on the right by 44206 18649 0 7615 .

Chapter 4

Heights of rational fractions and interpolation

This chapter corresponds to the preprint [START_REF] Kieffer | Height bounds for polynomial and rational fractions from their values[END_REF]. Let F be a univariate polynomial of rational fraction of degree d defined over a number field. We present bounds on the height of F , which encodes the size of the coefficients of F , in terms of the heights of its evaluations at small integers: we review well-known bounds obtained from interpolation algorithms given values of F at d + 1 or 2d + 1 points, and obtain tighter results when considering a larger number of evaluation points. While interesting in their own right, and readable independently, the results of this chapter have a particular purpose in this thesis: they will be essential in proving height bounds for modular equations in chapter 5.

Presentation of the problem

Let F be a univariate rational fraction of degree d defined over Q. To define the height h(F ) of F , write F = P/Q where P, Q ∈ Z[Y ] are coprime; then h(F ) is the maximum value of log |c|, where c runs through the nonzero coefficients of P and Q. In particular, if x = p/q is a rational number in irreducible form, then h(x) = log max{|p| , |q|}.

Heights can be generalized to arbitrary number fields, and are a basic tool in diophantine geometry [START_REF] Hindry | Diophantine geometry[END_REF]Part B]. They are also meaningful from an algorithmic point of view: the amount of memory needed to store F in a computer is in general O(d h(F )), and the cost of manipulating F grows with the size of its coefficients.

As announced, this chapter presents relations between the height of F and the heights of evaluations F (x), where x is an integer. One direction is easy: by [HS00, Prop. B.7.1], we have

h(F (x)) ≤ d h(x) + h(F ) + log(d + 1).
(4.1)

In the other direction, when we want to bound h(F ) from the heights of its values, matters are more complicated. An easy case is when F ∈ Z[Y ] is a polynomial with integer coefficients of degree at most d ≥ 1. Then looking at the archimedean absolute value of the coefficients of F is sufficient to bound h(F ). Moreover, given height bounds on d + 1 values of F , the Lagrange interpolation formula allows us to bound h(F ) in a satisfactory way. For instance, assuming that When F is a rational fraction or even a polynomial with rational coefficients, this nice result breaks down, and surprisingly little information appears in the literature despite the simplicity of the question.

h(F (i)) ≤ H for every i ∈ 0,
Polynomials. First, consider the case where F is a polynomial in Q[Y ] of degree at most d ≥ 1. Then F is determined by its values at d+1 distinct points. Let x 1 , . . . , x d+1 be distinct integers, let H ≥ 1, and assume that h(F (x i )) ≤ H for every i. This time, the Lagrange interpolation formula yields a bound on h(F ) which is roughly O(dH) (see proposition 4.4.2). This is intuitive enough: in general, computing F from its values F (x i ) involves reducing the rational numbers F (x i ) to the same denominator, thus multiplying the heights of the input by the number of evaluation points. But then, inequality (4.1) is very pessimistic at each of the evaluation points x i : massive cancellations occur with the denominator of F , and the "expected" size of F (x i ) is divided by d.

However, if we consider more than d + 1 evaluation points x 1 . . . , x N where h(F (x i )) ≤ H, we will likely find an evaluation point where inequality (4.1) is accurate, and hence obtain a bound on h(F ) of the form O(H) rather than O(dH). We prove the following result in this direction. For instance, we obtain a bound on h(F ) which is linear in H when considering N = 2d evaluation points.

Rational fractions. Second, consider the case where F ∈ Q(Y ) is a rational fraction of degree at most d ≥ 1. Then F is determined by its values at 2d + 1 points. If x 1 , . . . , x 2d+1 are distinct integers which are not poles of F , and h(F (x i )) ≤ H for every i, then a direct analysis of the interpolation algorithm yields a bound on h(F ) which is roughly O(d 2 H) (see proposition 4.5.7). As above, it makes sense to ask for a bound which is linear in H when more evaluation points are given.

In this case we could imagine cases where F = P/Q has a very large height, but massive cancellations happen in all the quotients P (x i )/Q(x i ). This makes the result more intricate.

Proposition 4.1.2. Let L be a number field, and let A, B be an interval in Z. Write D = B -A and M = max{|A| , |B|}. Let F ∈ L(Y ) be a rational fraction of degree at most d ≥ 1. Let S be a subset of A, B containing no poles of F , let η ≥ 1, and let H ≥ max{4, log(2M )}. Assume further that 1. h(F (x)) ≤ H for every x ∈ S.

S contains at least

D/η elements. 3. D ≥ max{ηd 3 H, 4ηdd L }.
Then we have

h(F ) ≤ H + C L ηd log(ηdH) + d log(2M ) + log(d + 1),
where C L is a constant depending only on L. We can take C Q = 960.

The number of evaluation points in this result is quite large, and depends on H. Still, proposition 4.1.2 is the main result that we need in chapter 3, and is strong enough to imply the following.

Proposition 4.1.3. Let c ≥ 1, let d ≥ 1, and let F ∈ Q(Y ) be a rational fraction of degree at most d. Let V ⊂ Z be a finite set such that F has no poles in Z\V . Assume that for every x ∈ Z\V , we have

h(F (x)) ≤ c max{1, d log d + d h(x)}.
Then there exists a constant

C = C(c, #V ) such that h(F ) ≤ Cd log(4d).
We can take C = (4c + 1923) 12 + log max{1, #V } + 2 log(c) .

It would be interesting to know whether we can obtain an efficient bound on h(F ) using only O(d) evaluation points, as in the case of polynomials, instead of O(d 3 H). The constants in propositions 4.1.2 and 4.1.3 are not optimal: tighter bounds can be obtained following the same ideas of proof, at the cost of lengthier expressions. The rest of this chapter is devoted to the definition of heights over number fields and the proofs of propositions 4.1.1 to 4.1.3.

Definition of heights

Let L be a number field of degree d L over Q. We denote by V 0 L (resp. V ∞ L ) the set of all nonarchimedean (resp. archimedean) places of L, and write

V L = V 0 L V ∞
L . Let P Q (resp. P L ) be the set of primes in Z (resp. prime ideals in the ring of integers Z L of L).

For each place v of L, the local degree of

L/Q at v is d v = [L v : Q v ],
where subscripts denote completion. Denote by |•| v the normalized absolute value associated with v: when v ∈ V 0 L , and p ∈ P Q is the prime below v, we have |p| v = 1/p. If p ∈ P L , we denote the p-adic valuation by v p . By convention, the p-adic valuation of zero is +∞.

The (absolute logarithmic Weil) height of projective tuples, affine tuples, polynomials and rational fractions over L is defined as follows [HS00, §B.2 and §B.7]. Definition 4.2.1. Let n ≥ 1, and let a 0 , . . . , a n ∈ L.

The projective height of (a

0 : • • • : a n ) ∈ P n L is h(a 0 : . . . : a n ) = v∈V L d v d L log max 0≤i≤n |a i | v .
2. The affine height of (a 1 , . . . , a n ) ∈ L n is defined as the projective height of the tuple (1 :

a 1 : • • • : a n ): h(a 1 , . . . , a n ) v∈V L d v d L log max{1, max 1≤i≤n |a i | v } .
In particular, for a ∈ L, we have

h(a) = h(1 : a) = v∈V L d v d L log max{1, |a| v } .
3. The height of a polynomial P ∈ L[Y 1 , . . . , Y n ] is the height of the affine tuple formed by all its coefficients: if

P = k=(k 1 ,...,kn)∈N n c k Y k 1 1 • • • Y kn n , then for v ∈ V L , we write |P | v = max k∈N n |c k | v
and we define h(P ) as

h(P ) = v∈V L d v d L log max{1, |P | v } .
If p ∈ P L is a prime ideal, we also define the p-adic valuation of P as

v p (P ) = min k∈N n v p (c k ). 4. Let F ∈ L(Y 1 , .
. . , Y n ) be a multivariate rational fraction over L, and choose coprime polynomials

P, Q ∈ L[Y 1 , . . . , Y n ] such that F = P/Q.
Then we define h(F ) as the height of the projective tuple formed by all the coefficients of P and Q.

Elementary properties of heights.

2. Heights are independent of the ambient field [HS00, Lem. B.2.1(c)]. This is another consequence of the product formula: in particular, we have

v∈V ∞ L d v d L = 1. 3. If x, y ∈ L, then h(xy) ≤ h(x) + h(y); if x = 0, then h(1/x) = h(x).
4. Heights satisfy the Northcott property: for every H ∈ R, the number of projective tuples (a 0 :

• • • : a n ) ∈ P n L such that h(a 0 : • • • : a n ) ≤ H is finite [HS00, Thm. B.2.3].
5. If L = Q, then definition 4.2.1 coincides with the naive definition of heights given in §4.1.

As definition 4.2.1 suggests, in order to obtain height bounds for polynomials and rational fractions, we will try to bound their coefficients from above in all the absolute values associated with places of L.

Heights of values and roots of polynomials

In this section, we relate the height of a univariate polynomial over L with the height of its roots. We also give bounds from above on the height of evaluations of polynomials, generalizing eq. (4.1). The statements are all easy consequences of the formulae in definition 4.2.1, and will be used on several occasions.

Let us start with the evaluation of polynomials; the following proposition is a slight generalization of [HS00, Prop. B.7.1].

Proposition 4.3.1. Let P ∈ L[Y 1 , . . . , Y n ] be a multivariate polynomial of total degree at most d ≥ 1, let 1 ≤ m ≤ n, and let y 1 , . . . , y m ∈ L. Let Q = P (y 1 , . . . , y m , Y m+1 , . . . , Y n ). Then we have

h(Q) ≤ h(P ) + m log(d + 1) + d h(y 1 , . . . , y n ).
More generally, if I 1 • • • I r is a partition of 1, m , and if d k denotes the total degree of P in the variables Y i for i ∈ I k , then we have

h(Q) ≤ h(P ) + r k=1 (#I k ) log(d k + 1) + r k=1 d k h (y i ) i∈I k .
Proof. It is enough to prove the second statement. Each term of Q is a sum of terms of the form

c • y a 1 1 • • • y am m • Y a m+1 m+1 • • • Y an n
where c is a coefficient of P , and

a i ≤ d k for each 1 ≤ i ≤ m and 1 ≤ k ≤ r such that i ∈ I k . For each v ∈ V L , we have |c • y a 1 1 • • • y am m | v ≤ |P | v r k=1 max 1, max i∈I k |y i | v d k . If v ∈ V 0 L , then the ultrametric inequality implies that |P (y 1 , . . . , y m , Y m+1 , . . . , Y n )| v ≤ |P | v r k=1 max 1, max i∈I k |y i | v d k . (4.4) If v ∈ V ∞ L ,
(d k + 1) #I k .
Taking logarithms and summing gives the result.

As a consequence, we can bound the height of a monic polynomial given the height of its roots. Proof. We reproduce the proof given in a lecture by F. Pazuki. We can assume that P is monic. Let v ∈ V L . We want to show that

|α| v ≤ |P | v if v ∈ V 0 L , and |α| v ≤ 2 |P | v if v ∈ V ∞ L . Since P is monic, we always have |P | v ≥ 1. Write P = Y n + n-1 k=0 c k Y k , for some n ≥ 1. If v ∈ V 0 L , we can assume that |α| v ≥ 1.
Then

|α| v = n-1 i=0 c k α k v ≤ |P | v |α| n-1 v , so |α| v ≤ |P | v . If v ∈ V ∞ L , we can assume that |α| v ≥ 2.
Then, by the triangle inequality, we obtain

|α| v ≤ |P | v |α v | n-1 1 + 1 |α| v + • • • + 1 |α| n-1 v ≤ 2 |α| n-1 v |P | v , so |α| v ≤ 2 |P | v .
Taking logarithms and summing over all v ∈ V L yields the result.

Heights of polynomials from their values

This section presents bounds on the height of a polynomial F ∈ L[Y ] of degree at most d ≥ 1 in terms of the heights of evaluations of F . We take our evaluation points to be integers in an interval A, B ⊂ Z, and we write D = B -A and M = max{|A| , |B|}. Our main tool is the Lagrange interpolation formula: if x 1 , . . . , x d+1 ∈ A, B are distinct, then

F = 1 D! d+1 i=0 F (x i )Q i where Q i = D! j =i (Y -x j ) j =i (x i -x j ) ∈ Z[Y ]. (4.5)
Lemma 4.4.1. In the notation of eq. (4.5), we have

|Q i | ≤ D! (2M ) d .
Proof. Since the denominator k =i (x i -x k ) divides D!, we have

Q i = N i j =i (X -x j )
for some

N i ∈ Z dividing D!. Therefore, for every 0 ≤ k ≤ d, if c k denotes the coefficient of X d-k in Q i , we have |c k | ≤ |N i | d k M k ≤ D! 2 d M d .
A straightforward application of the Lagrange interpolation formula on d + 1 evaluation points yields the following result.

Proof. Let v be a place of L. If v ∈ V 0 L , then (4.5) yields max{1, |F | v } ≤ 1 D! v max{1, |F (x 1 )| v , . . . , |F (x d+1 )| v } ≤ 1 D! v n+1 i=1 max{1, |F (x i )| v }. If v ∈ V ∞ L , then lemma 4.4.1 yields max{1, |F | v } ≤ d+1 i=1 |F (x i )| v 2 d M d ≤ (d + 1)2 d M d d+1 i=1 max{1, |F (x i )| v }. Since h(1/D!) = h(D!) ≤ D log(D)
, taking logarithms and summing gives the result.

It is interesting to compare proposition 4.4.2 with [HS00, Cor. B.2.6], using the evaluation maps at x i as linear maps from L[Y ] to L: under the hypotheses of the proposition, the height of the tuple (F (x 1 ), . . . , F (x d+1 )) can be as large as (d + 1)H.

Better bounds on h(F ) can be obtained given height bounds on more than d + 1 values of F : this is the content of proposition 4.1.1, which we recall here for convenience.

Proposition 4.4.3. Let L be a number field, and let A, B be an interval in Z.

Write D = B -A and M = max{|A| , |B|}. Let d ≥ 1, let F ∈ L[Y ] be a polynomial of degree at most d, let N ≥ d + 1, and let x 1 , . . . , x N be distinct elements of A, B . Assume that h(F (x i )) ≤ H for all 1 ≤ i ≤ N . Then we have h(F ) ≤ N N -d H + D log(D) + d log(2M ) + log(d + 1).
We need a lemma.

v ∈ V 0 L (resp. v ∈ V ∞ L ).
Then the number of elements x ∈ A, B satisfying the inequality

|F (x)| v < |D! F | v resp. |F (x)| v < |F | v (2M ) d (d + 1) is at most d.
Proof of lemma 4.4.4. We argue by contradiction. Let (x i ) 1≤i≤d+1 be distinct elements of A, B satisfying the given inequality. If v ∈ V 0 L , then the Lagrange interpolation formula (4.5) gives

|D! F | v ≤ max i |F (x i )| v < |D! F | v which is a contradiction. If v ∈ V ∞ L , then the contradiction is |F | v ≤ (2M ) d d+1 i=1 |F (x i )| v < |F | v by lemma 4.4.1.
Proof of proposition 4.4.3. Let v be a place of L. If v ∈ V 0 L , then by lemma 4.4.4, we have |F

(x i )| v ≥ |D! F | v for at least N -d values of i. Therefore N i=1 max{1, |F (x i )| v } ≥ |D! F | N -d v , hence log max{1, |F | v } ≤ log 1 D! v + 1 N -d N i=1 log max{1, |F (x i )| v }. If v ∈ V ∞ L , then by lemma 4.4.4, at least N -d of the values F (x i ) satisfy the inequality |F (x i )| v ≥ |F | v /(2M ) d (d + 1), hence log max{1, |F | v } ≤ d log(2M )+log(d+1)+ 1 N -d N i=1 log max{1, |F (x i )| v }.
Since h(1/D!) ≤ D log D, summing over V L yields the result.

Heights of fractions from their values

In this section, we study the more difficult question of bounding the height of rational fractions from above in terms of heights of their values. Let F ∈ L(Y ) be a fraction of degree at most d ≥ 1, and write

F = P/Q where P, Q ∈ Z L [Y ] are coprime in L[Y ].
Let S be a collection of evaluation points (in Z, for instance) and assume that h(F (x)) ≤ H for each x ∈ S. If we can prove that both P (x) and Q(x) are "small" for each x ∈ S, then we can apply proposition 4.1.1 to obtain an upper bound on h(F ). However, it can very well happen that P (x) and Q(x) have a large common factor even if F (x) has small height.

In order to prove proposition 4.1.2, we decompose P (x) and Q(x) in ideals. Define ideals s x , n x and d x of Z L as follows:

s x = gcd(P (x), Q(x)), (P (x)) = n x s x , (Q(x)) = d x s x . Then (F (x)) = n x d -1
x . The ideal s x encodes the simplifications that occur when evaluating P/Q at x. The main point of the proof is to show that the ideal s x is "small" for at least some values of x ∈ S. The height of an ideal in Z L is not well defined, but its norm is. Therefore we start by studying the relation between heights and norms of elements in Z L .

Heights and norms of integers

We denote the norm of elements and ideals in L by N L/Q , and we make the following definition. Definition 4.5.1. Let x ∈ L\{0}. Then we define

h(x) = 1 d L log N L/Q (x) = v∈V ∞ L d v d L log |x| v .
If a is a fractional ideal in L, we also write

h(a) = 1 d L log N L/Q (a).
Note that h and h are equal on Z. They are not equal on Z L in general. For instance, h is invariant under multiplication by units; this is not the case for h as soon as L admits a fundamental unit, by the Northcott property.

Lemma 4.5.2. Let x ∈ Z L \{0}. Then we have

0 ≤ h(x) ≤ h(x).

Equality holds on the right if and only if |x|

v ≥ 1 for every v ∈ V ∞ L .
Proof. We have N L/Q (x) ∈ Z\{0}, so N L/Q (x) ≥ 1 and h(x) ≥ 0. The rest is obvious.

Proposition 4.5.3. There exists a constant C depending only on the number field L such that for every x ∈ Z L \{0}, there exists a unit ε ∈ Z × L such that h(εx) ≤ max{C, h(x)}.

We can take C = 2d L max i∈I h(ε i ), where (ε i ) i∈I is any basis of units in Z L .

Proof.

Let m = #V ∞ L .
In R m , we define the hyperplane H s for s ∈ R by

H s = {(t 1 , . . . , t m ) ∈ R m : t 1 + • • • + t m = s},
and we define the convex cone ∆ s by

∆ s = (t 1 , . . . , t m ) ∈ R m : ∀i, t i ≥ -s .
The image of Z × L by the logarithmic embedding

Log = d v d L log |•| v v∈V ∞ L is a full rank lattice Λ in H 0 .
There exists a real number s min such that for every s ≥ s min , the convex set H 0 ∩ ∆ s contains a fundamental cell V of Λ; we can take s min = max i∈I h(ε i ) in the notation above. Translating in the direction (1, . . . , 1), we also have:

1. For every s ≥ ms min , the set H s ∩ ∆ 0 contains a translate of V .

2. For every s ≥ 0, the set H s ∩ ∆ s min contains a translate of V .

Let x ∈ Z L \{0}, and consider the point

Log(x) = d v d L log |x| v v∈V ∞ L ∈ R m .
The sum of its coordinates is h(x). If h(x) ≥ ms min , then by (1) there exists

a unit ε ∈ Z × L such that Log(x) + Log(ε) belongs to ∆ 0 . Then |εx| v ≥ 1 for every v ∈ V ∞ L , so h(εx) = h(εx) = h(x)
by lemma 4.5.2. On the other hand, if 0 ≤ h(x) < ms min , then by (2) we can still find a unit ε such that Log(x) + Log(ε) ∈ ∆ s min , in other words

d v d L log |εx| v ≥ -s min for all v ∈ V ∞ L . Then h(εx) = v∈V ∞ L d v d L log max{1, |εx| v } ≤ h(εx) + v∈V∞ s min ≤ 2ms min .
This proves the proposition with C = 2ms min ≤ 2d L s min .

Corollary 4.5.4. Let C be as in proposition 4.5.3. Then every principal ideal a of Z L admits a generator a ∈ Z L such that h(a) ≤ max{C, h(a)}.

Proof. Apply proposition 4.5.3 with x an arbitrary generator of a.

This allows us to bound the height of a common denominator for a given polynomial

P ∈ Z L [Y ].
Proposition 4.5.5. There exists a constant C depending only on L such that for every polynomial P ∈ L[Y ], there exists an element a ∈ Z L such that aP ∈ Z L [Y ] and max{h(a), h(aP )} ≤ h(P ) + C.

Proof. Let C be a set of ideals of Z L that are representatives for the class group of L, and let P ∈ L[Y ], which we may assume to be nonzero. Let a = p∈P L p max{0,-vp(P )} be the denominator ideal of P . Then

h(a) = p∈P L d p d L log max{1, |P | p } ≤ h(P ).
Let c ∈ C such that ca is principal. By corollary 4.5.4, if C denotes the constant from proposition 4.5.3, we can find a generator a of ca such that

h(a) ≤ max{C, h(ca)} ≤ h(P ) + C with C = max{C, max c∈C h(c)}.
Then aP has integer coefficients, and we have

h(aP ) ≤ v∈V ∞ L d v d L log max{1, |P | v } + log max{1, |a| v } = h(P ) + h(a) - v∈V 0 L d v d L log max{1, |P | v } = h(P ) + h(a) -h(a) ≤ h(P ) + C .

A naive height bound for fractions

Let L be a number field, and let F ∈ L(Y )\{0} be a rational fraction of degree at most d ≥ 1. Write F = P/Q where P, Q are coprime polynomials in L[Y ], and let d P and d Q be the degrees of P and Q respectively. Let x i for 1 ≤ i ≤ d P + d Q + 1 be distinct elements in an interval A, B ⊂ Z that are not poles of F .

Let us recall the interpolation algorithm to reconstruct F given the pairs

(x i , F (x i )) [BCG + 17, §7.1]. Let S ∈ L[Y ] be the polynomial of degree at most d P + d Q interpolating the points (x i , F (x i )).
Let a be a common denominator for the coefficients of S, so that T = aS has coefficients in Z L . We compute the d P -th subresultant of T and the polynomial

Z = s+1 i=1 (Y -x i ) ∈ Z[Y ].
We obtain a Bézout relation of the form

U T + V Z = R where U, V, R ∈ Z L [Y ], and moreover deg(U ) ≤ d Q and deg(R) ≤ d P . Then F = R/aU .
In order to obtain an upper bound on h(F ), we first bound h(S) from above using proposition 4.4.2. Then, we use the following well-known fact about the sizes of subresultants in Z L [Y ].

Lemma 4.5.6. Let P, Q ∈ Z L [Y ]\{0} be polynomials of degrees d P and d Q respectively, and let 0 ≤ k ≤ min{d P , d Q }-1. Let R be the k-th subresultant of P and Q, and let U and V be the associated Bézout coefficients. Write

s = d P + d Q . Then we have h(R) ≤ (d Q -k) h(P ) + (d P -k) h(Q) + s -2k 2 log(s -2k), h(U ) ≤ (d Q -k -1) h(P ) + (d P -k) h(Q) + s -2k -1 2 log(s -2k -1), h(V ) ≤ (d Q -k) h(P ) + (d P -k -1) h(Q) + s -2k -1 2 log(s -2k -1).
For instance, lemma 4.5.6 bounds the sizes of the coefficients appearing in the subresultant version of the Euclidean algorithm in Q(Y ).

Proof. Let v ∈ V ∞ L .
Every coefficient r of R has an expression as the determinant of a square matrix of size d P + d Q -2k ; its entries in the first d Q -k columns are coefficients of P , and its entries in the last d P -k columns are coefficients of Q. By Hadamard's lemma, we can bound |r| v by the product of L 2 -norms of the columns in this determinant. Hence

|r| v ≤ d P + d Q -2k |P | v d Q -k d P + d Q -2k |Q| v d P -k .
Taking logarithms and summing over v, we obtain the desired height bound on R. Similarly, the coefficients of U (resp. V ) are determinants of size d P + d Q -2k -1, with one column less coming from P (resp. Q).

Proposition 4.5.7. Let A, B be an interval in Z, and let d ≥ 1. Write D = B -A and M = max{|A| , |B|}. Let F ∈ L(Y )\{0} be a rational fraction of degree d. Let d P and d Q be the degrees of the numerator and denominator of F respectively. Let x i for 1 ≤ i ≤ d P + d Q + 1 be distinct elements of A, B that are not poles of F , and assume that h(F (x i )) ≤ H for every i. Then we can write

F = P/Q where P, Q ∈ Z L [Y ] satisfy deg P = d P , deg Q = d Q , and
max{h(P ), h(Q)} ≤ (d + 1)(2d + 1)H + (d + 1)D log(D) + (4d 2 + 3d) log(2M ) + (2d + 2) log(2d + 1) + (d + 1)C,
where C denotes the constant from proposition 4.5.5.

Proof. Let S, a, T, R, U, V be as in the interpolation algorithm above; to choose a, we use proposition 4.5.5, so that max{h(a), h(T )} ≤ h(S) + C.

By proposition 4.4.2, we have

h(S) ≤ (2d + 1)H + D log(D) + 2d log(2M ) + log(2d + 1). (4.6)
The absolute values of the coefficients of Z are bounded above by (2M ) 2d+1 , hence h(Z) ≤ (2d + 1) log(2M ).

By lemma 4.5.6, we have

h(R) ≤ (d + 1) h(T ) + d(2d + 1) log(2M ) + 2d + 1 2 log(2d + 1), h(U ) ≤ d h(T ) + d(2d + 1) log(2M ) + d log(2d + 1).
Then F = R/aU . Therefore

h(F ) ≤ max{h(R), h(a) + h(U )} ≤ (d + 1)(h(S) + C) + d(2d + 1) log(2M ) + 2d + 1 2 log(2d + 1).
We conclude using the upper bound (4.6) on h(S).

As mentioned in §4.1, the upper bound on h(F ) in proposition 4.5.7 is roughly O(d 2 H). This motivates a result like proposition 4.1.2, where the dependency on H is only linear.

Some preparatory lemmas

In this section, we state preparatory lemmas for the proof of proposition 4.1.2 in §4.5.4; the reader might wish to skip them until their use in the proof becomes apparent. Recall that the amplitude of A, B is B -A.

Proof. Assume the contrary. We can partition A, B in at most D 2ηk intervals of amplitude at most 2ηk , hence

D η ≤ #S ≤ k D 2ηk < D 2η + k. This is absurd because k ≤ D 2η .
Lemma 4.5.9. Let R ∈ Z L \{0} be a non-unit. Then

p∈P L , p|R p|p∈P Q log(N L/Q (p)) p -1 ≤ d L (2 log log N L/Q (R) + 3.5). (4.7)
The sum is over all prime ideals p of L diving R, and p ∈ P Q denotes the prime lying under p.

Proof. First, we assume that L = Q, so that R ∈ Z and |R| ≥ 2. Let m be the number of prime factors of R, and let (p i ) i≥1 be the sequence of primes in increasing order. It is enough to prove (4.7) for R = m i=1 p i , which has both a greater left hand side, since log(p)/(p -1) is a decreasing function of p, and a smaller right hand side, since R ≤ R. We can assume that m ≥ 2. Then

m i=1 log(p i ) p i -1 = m i=1 log(p i ) p i + m i=1 log(p i ) p i (p i -1)
≤ log(p m ) + 3 by Mertens's first theorem [START_REF] Mertens | Ein Beitrag zur analytischen Zahlentheorie[END_REF], and because the sum of the second series is less than 0.76. By [START_REF] Rosser | Explicit bounds for some functions of prime numbers[END_REF], we have p m < m log m + m log log m if m ≥ 6; so the rough bound p m ≤ m 2 holds. Since m ≤ log(R )/ log(2), the result in the case L = Q follows.

In the general case, if p|R lies above p ∈ P Q , then p divides N L/Q (R), and N L/Q (R) ≥ 2. We apply lemma 4.5.9 to the integer

N L/Q (R) ∈ Z: hence p|R log(N L/Q (p)) p -1 ≤ p|N L/Q (R) p|p log(N L/Q (p)) p -1 = d L p|N L/Q (R) log(p) p -1 ≤ d L (2 log log N L/Q (R) + 3.5).
Lemma 4.5.10. Let p ∈ P L be a prime ideal lying over p ∈ P Q , and let L p be the p-adic completion of L.

Let d ≥ 0, let Q ∈ L p [Y ]
\{0} be a polynomial of degree d, and assume that v p (Q) = 0. Let x 1 , . . . , x n be distinct elements of A, B , and write

D = B -A; assume that D ≥ 1. Let β ∈ N. Then n i=1 min{β, v p (Q(y i ))} ≤ d β + d L log(D) log N L/Q (p) + D p -1 . (4.8)
Proof. We can assume that d ≥ 1. Let λ be the leading coefficient of Q, and let α 1 , . . . , α d be the roots of Q in an algebraic closure of L p , where we extend |•| p and v p . Up to reindexation, we may assume that |α j | p ≤ 1 for 1 ≤ j ≤ t, and |α j | p > 1 for t + 1 ≤ j ≤ d. For every i, we have

|Q(x i )| p = |λ| p d i=1 |x i -α j | p = |λ| p d j=t+1 |α j | p t j=1 |x i -α j | p .
We must have

|λ| p d j=t+1 |α j | p ≥ 1,
for otherwise all the coefficients of Q would belong to p. Therefore

v p (Q(x i )) ≤ t j=1 v p (x i -α j ).
Let k ∈ N such that p k ≤ D < p k+1 . Since the x i are all distinct modulo p k+1 , there are at most d values of i such that v p (x i -α j ) > k for some j. For these indices i, we bound min{β, v p (Q(x i ))} by β. This accounts for the term dβ in inequality (4.8).

For all other values of i (say i ∈ I), we have v p (x i -α j ) ≤ k. Thus, for every 1 ≤ j ≤ t, we have

v p (x i -α j ) = k 0 1 u≤vp(x i -α j ) du.
Any two x i that fall in the same disk {u ≤ v p (x -α j )} coincide modulo p u . Therefore, for a given α j , and a given u ∈ ]l, l + 1], there exist at most D/p l+1 values of i such that x i belongs to this disk. Therefore

i∈I v p (Q(x i )) ≤ i∈I t j=1 v p (x i -α j ) = i∈I t j=1 k-1 l=0 l+1 l 1 u≤vp(x i -α j ) du = t j=1 k-1 l=0 l+1 l i∈I 1 u≤vp(x i -α j ) du ≤ t k-1 l=0 D p l+1 ≤ t k-1 l=0 D p l+1 + 1 ≤ tk + tD p -1 .
We have t ≤ d, and

k ≤ log(D) log(p) ≤ d L log(D) log N L/Q (p)
.

This accounts for the two remaining terms in inequality (4.8).

Main result

Finally, we prove propositions 4.1.2 and 4.1.3. We recall the statements for convenience. Proposition 4.5.11. Let L be a number field, and let A, B be an interval in Z. Write D = B -A and M = max{|A| , |B|}. Let F ∈ L(Y ) be a rational fraction of degree at most d ≥ 1. Let S be a subset of A, B containing no poles of F , let η ≥ 1, and let H ≥ max{4, log(2M )}. Assume further that 1. h(F (x)) ≤ H for every x ∈ S.

S contains at least

D/η elements. 3. D ≥ max{ηd 3 H, 4ηdd L }.
Then we have

h(F ) ≤ H + C L ηd log(ηdH) + d log(2M ) + log(d + 1),
where C L is a constant depending only on L. We can take C Q = 960.

Proof. We can assume that F = 0. We have D ≥ 4ηd, so by lemma 4.5.8 with k = 2d, we can find a subinterval A , B of A, B with amplitude at most 4ηd containing 2d + 1 elements of S, denoted by x 1 , . . . , x 2d+1 . We use these x i as evaluation points in proposition 4.5.7: we can write F = P/Q where P, Q ∈ Z L [X] have the correct degrees and

max{h(P ), h(Q)} ≤ (d + 1)(2d + 1)H + 2d 4ηd log( 4ηd ) + (4d 2 + 3d) log(2M ) + (2d + 2) log(2d + 1) + (d + 1)C 1 ≤ (27 + C 1 )ηd 2 H
where C 1 is the constant from proposition 4.5.3, which depends only on L.

To simplify the right hand side, we use the inequalities 1 ≤ d, 1 ≤ η, 4ηd ≤ D ≤ 2M , 4ηd ≤ 5ηd, and log(2M ) ≤ H. Let x ∈ S, and define the ideals s x , n x and d x of Z L as above:

s x = gcd(P (x), Q(x)), (P (x)) = n x s x , (Q(x)) = d x s x .
Let r be the greatest common divisor of all the coefficients of P and Q.

Claim 4.5.12. There exists a constant C L depending only on L such that the following property holds: there exist at least

2dd L + 1 elements x of S such that h(s x ) ≤ h(r) + C L ηd log(ηdH).
Let us explain how to finish the proof of proposition 4.5.11 if claim 4.5.12 holds. By lemma 4.4.4, we can find an x ∈ S among these 2dd L + 1 values such that for every v ∈ V ∞ L , we have

|P (x)| v ≥ |P | v (2M ) d (d + 1) and |Q(x)| v ≥ |Q| v (2M ) d (d + 1)
.

Then, we can calculate h(F ) as

v∈V ∞ L d v d L log max{|P | v , |Q| v } -h(r) ≤ v∈V ∞ L d v d L log max{|P (x)| v , |Q(x)| v } -h(r) + d log(2M ) + log(d + 1) ≤ v∈V L d v d L log max{|P (x)| v , |Q(x)| v } + h(s x ) -h(r) + d log(2M ) + log(d + 1) ≤ H + C L ηd log(ηdH) + d log(2M ) + log(d + 1),
as claimed.

In order to prove claim 4.5.12, a crucial remark is that s x divides the resultant R of P and Q. By lemma 4.5.6, we have

h(R) ≤ d h(P ) + d h(Q) + d log(2d) ≤ (55 + 2C 1 )ηd 3 H.
Let p ∈ P L be a prime factor of R with valuation β p , and let I be a subset of S with n elements. We claim that

x∈I v p (s x ) ≤ n v p (r) + d β p + d L log(D) log N L/Q (p) + D p -1 . (4.9)
To prove (4.9), we can work in the p-adic completion L p of L. Let π be a uniformizer of L p , and let r = min{v p (P ), v p (Q)} be the p-adic valuation of r. Write P 1 = P/π r , Q 1 = Q/π r . Then one of P 1 and Q 1 is not divisible by π; for instance, assume that π does not divide Q 1 . For every x ∈ S, we have

v p (s x ) ≤ min β p , v p (Q(x))} ≤ v p (r) + min β p , v p (Q 1 (x)) .
Thus inequality (4.9) follows from lemma 4.5.10. Summing over the prime factors p of R, we obtain an upper bound on the product of the norms of the ideals s x , for x ∈ I. We can assume that R is not a unit, otherwise claim 4.5.12 holds trivially. Then

x∈I N L/Q (s x ) ≤ N L/Q (r) n N L/Q (R) d • exp p∈P L , p|R p|p∈P Q dd L log(D) + dD log N L/Q (p) p -1 ≤ N L/Q (r) n N L/Q (R) d • exp dd L log(D) log N L/Q (R) / log(2) + dd L D(log log N L/Q (R) + 3.5) .
Indeed, R has at most log N L/Q (R) / log(2) prime factors, and we can apply lemma 4.5.9. Since h(R) ≤ (55 + 2C 1 )ηd 3 H, we obtain

x∈I h(s x ) ≤ n h(r) + d h(R) + dd L log(D) log(2) h(R) + dD(log log N L/Q (R) + 3.5) ≤ n h(r) + C 2 (ηd 4 H log(D) + dD log(ηdH)) with C 2 = max 3d L (55 + 2C 1 ) 2 log(2) , 6.5 + log(d L ) + log(55 + 2C 1 ) .
Here we use that log(ηdH) ≥ 1, and log(D) ≥ 2 log 2. Now we use the assumption that D and S are sufficiently large. Since D ≥ ηd 3 H ≥ 4 > exp(1), and since the function t/ log(t) is increasing for t > exp(1), we have

D log(D) ≥ ηd 3 H 3 log(ηdH)
.

Moreover,

#S -2dd L ≥ D η - D 2η = D 2η . Therefore, x∈I h(s x ) ≤ n h(r) + 4C 2 dD log(ηdH) ≤ n h(r) + 8C 2 ηd log(ηdH)(#S -2dd L ).
This shows that in every subset of #S -2dd L elements of S, at least one must satisfy h(s x ) ≤ h(r) + 8C 2 ηd log(ηdH). Therefore claim 4.5.12 holds with C = 8C 2 .

If L = Q, we have C 1 = 0, hence we can take C 2 = 120.

We conclude this chapter with the proof of proposition 4.1.3.

Proposition 4.5.13. Let c ≥ 1, let d ≥ 1, and let F ∈ Q(Y ) be a rational fraction of degree at most d. Let V ⊂ Z be a finite set such that F has no poles in Z\V . Assume that for every x ∈ Z\V , we have

h(F (x)) ≤ c max{1, d log d + d h(x)}.
Then there exists a constant

C = C(c, #V ) such that h(F ) ≤ Cd log(4d).
We can take C = (4c + 1923) 12 + log max{1, #V } + 2 log(c) .

Proof. We want to use proposition 4.1.2 on an interval of the form 0, D for some integer D ≥ 4d, with η = 2 and S = 0, D \V . The set S will contain at least D/η elements as soon as D ≥ 2#V . For every x ∈ S, we have h(x) ≤ log(D), hence

h(F (x)) ≤ c max{1, d log d + d log D}.
Hence, if we define H(D) as

H(D) = max{4, log(2D), c(d log d + d log D)},
then we can apply proposition 4.1.2 with H = H(D) as soon as

D ≥ 2d 3 H(D).
We check that we can take

D = max{2#V, 4cd 4 log(4cd 4 ) }.
Then, proposition 4.1.2 yields

h(F ) ≤ H(D) + 1920d log(2dH(D)) + d log(2D) + log(d + 1).
We To simplify this expression further, we write log(5cd 5 log(4cd 4 )) ≤ log(20c 2 d 9 ) ≤ 3 + 2 log(c) + 9 log(d),

hence, after other simplifications,

h(F ) ≤ Cd log(4d) with C = (4c + 1923)(12 + log max{1, #V } + 2 log(c)), as claimed.
Chapter 5

Degree and height bounds for modular equations

This chapter, which corresponds to the preprint [START_REF] Kieffer | Degree and height estimates for modular equations on PEL Shimura varieties[END_REF], presents upper bounds on the size of modular equations on PEL Shimura varieties in terms of their level. Let us recall the notation introduced in chapter 2.

We fix a PEL datum (B, * , V, ψ, G, X + ). Let K be a compact open subgroup of G(A f ), and let Σ be a finite group of automorphisms of V as in §2.2.4. Let n be the complex dimension of X + ; we assume that n ≥ 1. Let S and T be connected components of Sh K (G, X + )(C), and let L be their field of definition. We fix a choice of invariants j 1 , . . . , j n+1 as in §2.4. These modular functions satisfy eq. (2.17):

E(j 1 , . . . , j n+1 ) = 0, (5.1)
where

E = e k=0 E k (J 1 , . . . , J n ) J k n+1 ∈ L[J 1 , . . . , J n+1 ]
and E is irreducible. Our estimates on the size of modular equations involve constants depending only on this data. Let δ ∈ G(A f ) be an element of G defining an absolutely irreducible Hecke correspondence H δ that intersects S × T nontrivially. In §2.4.3, we defined the modular equations Ψ δ,m for 1 ≤ m ≤ n + 1; they are elements of the ring L(J 1 , . . . , J n )[J n+1 , Y 1 , . . . , Y m ] of degree at most e -1 in J n+1 , defining the Hecke correspondence H δ as a subvariety of S × T . The degree of H δ is denoted by d (δ), and the degree of the isogenies described by H δ in the modular interpretation (recall corollary 2.4.2) is denoted by l (δ). Our main theorem, stated as theorem 1.4.3 in chapter 1, is the following.

Theorem 5.0.1. Using the notation above, there exist constants C 1 and C 2 (independent of δ) with the following property. Let δ ∈ G(A f ) be as above, and let F ∈ L(J 1 , . . . , J n ) be a rational fraction obtained as a coefficient of one of the modular equations Ψ δ,m for 1 ≤ m ≤ n + 1. Then the total degree of F is bounded above by C 1 d (δ), and the height of F is bounded above by C 2 d (δ) log(l (δ)).

We refer to §4.2 for the definition of h(F ). This result allows us to bound the complexity of algorithms manipulating modular equations, and was previously known only in the case of elliptic modular polynomials [START_REF] Cohen | On the coefficients of the transformation polynomials for the elliptic modular function[END_REF]. In the case of Siegel modular equations for abelian surfaces, and Hilbert modular equations in Gundlach invariants for F = Q( √ 5) (recall §2.4.4), the constants C 1 and C 2 are explicit: see propositions 5.1.15 and 5.1.17, and theorem 5.2.13. In particular, the degree bounds we obtain match experimental data exactly; on the other hand the constant C 2 is far too pessimistic for algorithmic use.

The strategy to prove the degree bounds is to exhibit a particular modular form that behaves as the denominator of Ψ δ,m , and to control its weight. Then, we show that rewriting quotients of modular forms in terms of the chosen coordinates j 1 , . . . , j n+1 translates bounded weights into bounded degrees. Giving an explicit expression of the denominator will also be useful in chapter 6. The proof of height bounds is inspired by previous works on elliptic modular polynomials [START_REF] Pazuki | Modular invariants and isogenies[END_REF]. We prove height bounds on evaluations of modular equations at certain points using well-known results on the Faltings height of isogenous abelian varieties [START_REF] Faltings | Endlichkeitssätze für abelsche Varietäten über Zahlkörper[END_REF]. Then we use the tight relation between the height of a rational fraction over a number field and the height of its evaluations at sufficiently many points provided by proposition 4.1.2, the main result of chapter 4.

Degree bounds for modular equations

Denominators of modular equations

We keep the notation used in §2.4.3: in particular

K = K ∩ δKδ -1 , K 0 = K Σ,
and K is a normal subgroup of finite index in K, contained in K and stabilized by Σ. The natural action of K 0 on modular functions of level K extends to modular forms.

For each 1 ≤ i ≤ n + 1, fix a nonzero modular form χ i invariant under Σ and defined over L such that χ i j i is again a modular form (i.e. has no poles); we say that χ i is a denominator of j i . This is possible by proposition 2.2.13. For each i, the function

χ i,δ : [x, g] → χ i ([x, gδ])
is a modular form of weight wt(χ i ) on the preimage of S in Sh K (C). We define the functions g δ,m for 1 ≤ m ≤ n + 1 as

g δ,m = m i=1 γ∈K 0 /K γ • χ i,δ .
Lemma 5.1.1. For every 1 ≤ m ≤ n + 1, the function g δ,m is a nonzero symmetric modular form on S, and

wt(g δ,m ) = (#Σ) d(δ) m i=1 wt(χ i ).
Proof. We have #(K 0 /K ) = (#Σ) d(δ). Therefore the function g δ,m is a modular form of level K and weight m i=1 #(K 0 /K ) wt(χ i ) by construction. Each modular form γ • χ i,δ is nonzero on every connected component of Sh K (C) above S, so g δ,m is nonzero as well.

Acting by an element of K 0 permutes the factors in the product defining g δ,m , so g δ,m is in fact a symmetric modular form on S.

Proposition 5.1.2. For every 1 ≤ m ≤ n + 1, the coefficients of the multivariate polynomial g δ,m Ψ δ,m are symmetric modular forms on S.

Proof. By definition 2.4.6, the polynomial Ψ δ,m is a sum of terms of the form

m-1 i=1 γ i Y i -γ i • j i,δ γm∈K m-1 /Km Y m -γγ m • j m,δ
where γ ∈ K 0 is fixed, and the middle product is over all

γ i ∈ K 0 /K i such that γ i = γ modulo K i-1 , but γ i = γ modulo K i .
In this expression, all the cosets γ i and γγ m are simultaneously disjoint as subsets of K 0 /K . Each denominator is accounted for by some factor in the product defining g δ,m , so the coefficients of g δ,m Ψ δ,m are modular forms.

When the invariants j 1 , . . . , j n+1 have similar denominators, it is possible to make a better choice for g δ,m .

Proposition 5.1.3. Assume that there exists a modular form χ on S such that χ i = χ α i for some integer α i ≥ 0, for every 1 ≤ i ≤ n + 1. Let 1 ≤ m ≤ n + 1, and define

g δ,m = γ∈K 0 γ • χ δ α ,
where α = max

1≤i≤m α i .
Then g δ,m is a nonzero symmetric modular form on S, and

wt(g δ,m ) = (#Σ) d(δ) α wt(χ).
Moreover, the coefficients of g δ,m Ψ δ,m are symmetric modular forms on S.

The proof is similar to that of proposition 5.1.2, and omitted.

Writing modular functions in terms of invariants

Let f /g be a quotient of symmetric modular forms of weight w on S. We show that when we rewrite such a quotient in terms of the invariants j 1 , . . . , j n+1 , the degree of the rational fractions we obtain is bounded above linearly in w, with a proportionality constant depending on our choice of invariants. In order to make this dependency explicit, we define the symmetric geometric complexity of our invariants as follows.

Definition 5.1.4. Let f k for 1 ≤ k ≤ r be nonzero generators over L for the graded ring of symmetric modular forms on S, with respective weights w k . For each 1 ≤ k ≤ r -1, let β k ≥ 1 be the minimal integer such that

β k w k ∈ Zw k+1 + • • • + Zw r .
We can find nonzero modular forms

λ k , ξ k ∈ L[f k+1 , . . . , f r ] such that wt(λ k ) -wt(ξ k ) = β k w k . For every 1 ≤ k ≤ r -1, the function ξ k f β k
k /λ k is a quotient of two symmetric modular forms of the same weight on S; hence there exist polynomials

P k , Q k ∈ L[J 1 , . . . , J n+1 ] such that ξ k f β k k λ k = P k (j 1 , . . . , j n+1 ) Q k (j 1 , . . . , j n+1 ) .
We define the symmetric geometric complexity of j 1 , . . . , j n+1 relative to the choice of f k , λ k , ψ k , P k , Q k to be the positive rational number given by, either 1.

1 + max 1≤k≤r-1 wt(ξ k ) β k w k max 1≤k≤r-1 deg(P k ) β k w k + wt(ξ k ) ,
if the following conditions are satisfied: for every 1 ≤ k ≤ r -1, the modular forms λ k and ξ k are powers of f r and f r-1 respectively (in particular ξ r-1 = 1), and

Q k = 1; or 2. r-1 k=1 1 β k w k max deg(P k ), deg(Q k ) k-1 l=1 1 + wt(ξ l ) β l w l , otherwise.
Note that formula 1, when it applies, yields a smaller result than formula 2. We define the symmetric geometric complexity of the chosen coordinates j 1 , . . . , j n+1 , denoted by SGC(j 1 , . . . , j n+1 ), to be the infimum of this quantity over all possible choices of modular forms f k , λ k , ξ k and polynomials P k , Q k . Given definition 5.1.4, explicit upper bounds on the geometric complexity are easy to obtain if a generating set of modular forms is known. Note that the symmetric geometric complexity is invariant under permutations of the invariants j 1 , . . . , j n+1 , in contrast with their geometric complexity to be defined in the next section, which takes into account the fact that j n+1 is considered differently in eq. (5.1).

Proposition 5.1.5. Let f, g be symmetric modular forms on S of weight w such that g = 0. Then there exist polynomials P, Q ∈ L[J 1 , . . . , J n+1 ] of degree at most SGC(j 1 , . . . , j n+1 )w such that f g = P (j 1 , . . . , j n+1 ) Q(j 1 , . . . , j n+1 ) .

Proof. We keep the notation used in definition 5.1.4, and choose gener-

ators f k for 1 ≤ k ≤ r, modular forms λ k , ξ k for 1 ≤ k ≤ r -1, and polynomials P k , Q k ∈ L[J 1 , . . . , J n+1 ] for 1 ≤ k ≤ r -1.
Let C be the symmetric geometric complexity of j 1 , . . . , j n+1 relative to this choice. Let f , g be as in the proposition. Then f and g can be expressed as a sum of monomial terms of the form

cf α 1 1 • • • f αr r with c ∈ L and r k=1 α k w k = w.
We give algorithms to rewrite the fraction P/Q = f /g (currently a rational fraction in terms of the modular forms f k ) as a fraction in the invariants j 1 , . . . , j n+1 , and bound the total degree of the output. Case 1 of definition 5.1.4. We assume that λ k and ξ k are powers of f r and f r-1 respectively for every 1 ≤ k ≤ r-1. In this case, for each k ≤ r-2, the integer β k can be seen as the order of w k in the group Z/(Zw r-1 +Zw r ). We can write

w = r-2 k=1 s k w k (mod Zw r-1 + Zw r )
for some integers 0 ≤ s k < β k , and this determines the integers s k uniquely (if such a linear combination vanishes, considering the smallest nonzero s k yields a contradiction). Then each monomial appearing in P and Q is divisible by

f s 1 1 • • • f s r-2
r-2 . After simplifying by this common factor, we can assume that the common weight w of P and Q satisfies w ∈ Zw r-1 + Zw r . Then, for each 1 ≤ k ≤ r -2, the exponent of f k in each monomial of P and Q is divisible by β k . For convenience, write

a = max 1≤k≤r-1 wt(ξ k ) β k w k .
In order to rewrite P/Q in terms of invariants, we proceed as follows.

1. Multiply P and Q by f aw/ wt(f r-1 ) r-1 . 2. For each 1 ≤ k ≤ r -2, replace each occurence of f β k k by λ k P k /ξ k in P and Q.

3. Let 0 ≤ s r-1 < β r-1 be such that w = s r-1 w r-1 mod w r , and divide P and Q by f

s r-1 r-1 . 4. Replace each occurence of f β r-1
r-1 by λ r-1 P r-1 in P and Q. 5. Finally, divide P and Q by f (w-s r-1 w r-1 )/wr r . This algorithm runs independently on each monomial of P and Q. Let M = c r k=1 f α k k , with c ∈ L, be such a monomial after step 1. Let us show that the exponent of f r-1 in M remains nonnegative after step 2. In this step, we introduce a denominator given by

r-2 k=1 ξ α k /β k k = r-2 k=1 f wt(ξ k )α k wt(f r-1 )β k r-1 . We have r-2 k=1 wt(ξ k )α k wt(f r-1 )β k ≤ a r-2 k=1 α k w k wt(f r-1 ) ≤ aw wt(f r-1 ) , hence r-2 k=1 wt(ξ k )α k wt(f r-1 )β k ≤ aw wt(f r-1 )
≤ α r-1 by step 1 because the left hand side is an integer. Therefore, at the end of step 2, M belongs to the polynomial ring

L[J 1 , . . . , J n+1 ][f r-1 , f r ]. Therefore we have M ∈ L[J 1 , . . . , J n+1 ][f β r-1
r-1 , f r ] after step 3, and finally M ∈ L[J 1 , . . . , J n+1 ] after step 5.

It remains to bound the total degree of M after step 5. To do this, we consider the total weight of M in f 1 , . . . , f r-1 . For each 1 ≤ k ≤ r -1, the modular form λ k is a power of f r ; hence replacing f β k k by λ k P k /ξ k in steps 2 or 4 reduces this weight by β k w k + wt(ξ k ), and increases the total degree of M in J 1 , . . . , J n+1 by at most deg(P k ). At the beginning of step 2, the total weight of M in f 1 , . . . , f r-1 is at most (1 + a)w. Therefore the total degree of M in J 1 , . . . , J n+1 at the end of the algorithm is bounded above by

(1 + a)w max 1≤k≤r-1 deg(P k ) β k w k + deg(ξ k ) = Cw
which is the desired result. Case 2 of definition 5.1.4. In the general case, we perform replacements and simplifications in a sequential way. We start by defining integers z k , d k for 0 ≤ k ≤ r -1 and s k , a k for 1 ≤ k ≤ r -1 by induction as follows:

• z 0 = w and d 0 = 0;

• For each 1 ≤ k ≤ r, the integer 0 ≤ s k < β k is defined by the relation

z k-1 = s k w k (mod Zw k+1 + • • • + Zw r ); • a k = z k-1 β k w k for each 1 ≤ k ≤ r -1; • z k = z k-1 -s k w k + a k wt(ξ k ) for each 1 ≤ k ≤ r -1; • d k = d k-1 + a k max{deg(P k ), deg(Q k )} for each 1 ≤ k ≤ r -1.
In order to rewrite P/Q in terms of invariants, we proceed as follows. For k = 1 up to r -1, do:

1. Divide P and Q by f s k k ;

2. Replace each occurence of f β k k by

λ k P k ξ k Q k in P and Q; 3. Multiply P and Q by ξ a k k Q a k k .
Finally, simplify the remaining occurences of f r . We prove the following statement ( ) k by induction for every 1 ≤ k ≤ r:

At the beginning of the k-th loop, the polynomials P and Q are elements of weight z k-1 in the ring L[J 1 , . . . , J n+1 ][f k , . . . , f r ], with total degree at most d k-1 in J 1 , . . . , J n+1 , such that f g = P (j 1 , . . . , j n+1 ) Q(j 1 , . . . , j n+1 ) .

The statement ( ) 1 is true by definition of z 0 and d 0 ; assume that ( ) k is true. Then we see, in order, that during the k-th loop:

• z k-1 ∈ r
i=k Zw i , hence s k is well defined. • In each monomial of P and Q, the exponent of f k is of the form aβ k +s k for some integer a ≤ a k . Therefore step 1 is an exact division, and after step 2 there are no more occurences of f k in P or Q.

• After step 3, P and

Q are elements of L[J 1 , . . . , J n+1 ][f k+1 , . . . , f r ] of weight z k-1 -s k w k + a k wt(ξ k ) = z k .
It remains to show that the degree of P, Q in J 1 , . . . , J n+1 is bounded by d k after step 3. This comes from the following observation: during the k-th loop, we only multiply the polynomials in J 1 , . . . , J n+1 already present by P b k Q a k -b k for some 0 ≤ b ≤ a k . This proves ( ) k for all 1 ≤ k ≤ r. At the end of the algorithm, all the occurences of f r disappear. Therefore we obtain polynomials P, Q with total degree at most d r-1 such that f g = P (j 1 , . . . , j n+1 ) Q(j 1 , . . . , j n+1 ) .

By induction, we obtain

z k ≤ w k l=1 1 + wt(ξ l ) β l w l and d r-1 ≤ r-1 k=1 w β k w k max{deg(P k ), deg(Q k )} k-1 l=1 1 + wt(ξ l ) β l w l = Cw.

Degree bounds in canonical form

Recall that the modular function j n+1 satisfies eq. (5.1) on S: we have E(j 1 , . . . , j n+1 ) = 0 where

E = e k=0 E k (J 1 , . . . , J n ) J k n+1 ∈ L[J 1 , . . . , J n+1 ]
has degree e in J n+1 and is irreducible. Let d E denote the total degree of E in the variables J 1 , . . . , J n .

In this section, we work in the ring L(J 1 , . . . , J n )[J n+1 ] modulo E. We say that a fraction R ∈ L(J 1 , . . . , J n+1 ) is in canonical form if R is a polynomial in J n+1 of degree at most e -1.

Proposition 5.1.6. Let P, Q ∈ L[J 1 , . . . , J n+1 ] be polynomials with total degree at most d, and assume that Q(j 1 , . . . , j n+1 ) is not identically zero. Let R ∈ L(J 1 , . . . , J n )[J n+1 ] be the fraction in canonical form such that P/Q = R mod E. Then the total degree of R in J 1 , . . . , J n is bounded above by (e + 2d E )d.

Proof. In this proof, degrees and coefficients are taken with respect to the variable J n+1 unless otherwise specified. First, we invert the denominator Q. Consider the resultant

Z = Res J n+1 (Q, E) ∈ L[J 1 , . . . , J n ],
which is nonzero by hypothesis. Let U, V ∈ L[j 1 , . . . , j n+1 ] be the associated Bézout coefficients, so that

Z = U Q + V E. The inverse of Q modulo E is U/Z, hence P/Q = U P/Z mod E.
Recall that Z (resp. Q) has a polynomial expression of degree e (resp. degree e -1) in the coefficients of Q, and degree deg(Q) in the coefficients of E. Since the total degree of Q is at most d, the total degrees of Z and U P in J 1 , . . . , J n are bounded above by d(e + d E ). The degree of U P in J n+1 is at most d + e -1. Now, we reduce U P/Z modulo E to obtain a numerator of degree at most e -1 in J n+1 . We can decrease this degree by 1 by multiplying above and below by E e (J 1 , . . . , J n ) and using the relation

E e J e n+1 = - e-1 k=0 E k J k n+1 mod E.
When doing so, the total degree in J 1 , . . . , J n increases by at most d E . This operation is done at most d times; the result has total degree at most (e + 2d E )d in J 1 , . . . , J n and e -1 in J n+1 .

Definition 5.1.7. The geometric complexity of the invariants j 1 , . . . , j n+1 is defined as GC(j 1 , . . . , j n+1 ) = (e + 2d E ) SGC(j 1 , . . . , j n+1 ) + e -1.

This quantity depends on the choice of j n+1 as a distinguished invariant.

Proposition 5.1.8. Let f and g be symmetric modular forms on S of weight w, and assume that g = 0. Let R ∈ L(J 1 , . . . , J n )[J n+1 ] be the rational fraction in canonical form such that

f g = R(j 1 , . . . , j n+1 ).
Then the degree of R in J 1 , . . . , J n+1 is bounded above by GC(j 1 , . . . , j n+1 )w.

Proof. Combine propositions 5.1.5 and 5.1.6.

We are ready to prove the first part of theorem 5.0.1 on degree bounds for modular equations, with an explicit expression for the constant C 1 .

Theorem 5.1.9. Let H δ be an absolutely irreducible Hecke correspondence on S × T defined by δ ∈ G(A f ), and let d(δ) be the degree of H δ . For each 1 ≤ i ≤ n + 1, let χ i be a denominator of the modular function j i as in §5.1.1. Let F ∈ L(J 1 , . . . , J n )[J n+1 ] be a coefficient of one of the modular equations Ψ δ,m for 1 ≤ m ≤ n + 1. Then the total degree of F is bounded above by C d (δ), where C is a constant independent of δ; more precisely we can take C = GC(j 1 , . . . , j n+1 ) (#Σ) m i=1 wt(χ i ).

Proof. Let g δ,m be the modular form on S defined in §5.1.1. By proposition 5.1.2, the modular function F (j 1 , . . . , j n+1 ) is of the form f /g δ,m , where f is a modular form on S of weight wt(g δ,m ). By lemma 5.1.1, we have

wt(g δ,m ) = (#Σ) d(δ) m i=1
wt(χ i ), so the result follows from proposition 5.1.8.

Complete denominators in dimension 2

In the case of Siegel modular equations for abelian surfaces, and Hilbert modular equations for the real quadratic field F = Q( √ 5), it is possible to refine the choice of denominator g δ,m in such a way that the coefficients of g δ,m Ψ δ,m are defined over Z, i.e. have integral Fourier coefficients. This refinement is not necessary to obtain explicit degree bounds for these modular equations (see §5.1.5), but will be useful in the evaluation algorithm of chapter 6.

Recall from §2.4.4 that for each prime , the Siegel modular equations of level are denoted by

Ψ ,k ∈ Q(J 1 , J 2 , J 3 )[Y ] for 1 ≤ k ≤ 3.
Similarly, for each totally positive prime β ∈ Z F , the Hilbert modular equations of level β in Gundlach invariants are denoted by

Ψ β,1 , Ψ β,2 ∈ Q(J 1 , J 2 )[Y ].
In both cases, the underlying moduli space S is rational.

The Siegel case. We call a polynomial D ∈ Z[J 1 , J 2 , J 3 ] a complete denominator of the Siegel modular equations

Ψ ,k if for each 1 ≤ k ≤ 3, we have D Ψ ,k ∈ Z[J 1 , J 2 , J 3 , Y ].
Our goal is to construct a complete denominator for the Siegel modular equations, given by an analytic formula. Let C be a set of representatives for the quotient Γ 0 ( )\ Sp 4 (Z), the congruence subgroup Γ 0 ( ) being defined by eq. (3.1). For every τ ∈ H 2 , we define

g (τ ) = η∈C det(η * τ ) -20 h 2 10 ( 1 ητ ).
One can check that the function g is independent of the choice of C , and is a Siegel modular form of weight w = 20( 3 + 2 + + 1).

Under the correspondence of §2.3.2, the Siegel modular form g is the classical analogue of the modular form g δ,m for m = 2 or m = 3 defined in proposition 5.1.3, if we choose the modular forms h 10 , h 2 10 , h 2 10 as denominators for the Igusa invariants j 1 , j 2 , j 3 respectively.

For every τ ∈ H 2 and 0 ≤ i ≤ 3 + 2 + + 1, we define f

(i) ,k (τ ) as the coefficient of Y i in the polynomial g (τ )Ψ ,k (j 1 (τ ), j 2 (τ ), j 3 (τ )) ∈ C[Y ].
The functions f Proof. Both the Hecke correspondence and the modular form h 10 are defined over Q, therefore the modular form g is defined over Q as well. This is also the case of the modular forms f (i) ,k , because the coefficients of Siegel modular equations are defined over Q as modular functions. Therefore we only have to show that their Fourier coefficients are algebraic integers.

Let f be a Siegel modular form on H 2 of weight k defined over Z, and let η ∈ C . We claim that the function

h(τ ) = det(η * τ ) -k f ( 1 ητ )
has a Fourier expansion in terms of exp(2πiz j (τ )/ 2 ) for 1 ≤ j ≤ 3, where we write

τ = z 1 (τ ) z 3 (τ ) z 3 (τ ) z 2 (τ ) ,
with coefficients in the ring Z[exp(2πi/ 2 )]. This claim implies proposition 5.1.10 because g and f

(i)
,k are polynomials in such functions. In order to compute the Fourier expansion of h(τ ), we compute a matrix η R ∈ Sp 4 (Z) such that the transformation τ → η R ( 1 ητ ) leaves the cusp at infinity "invariant". More precisely, writing 4 × 4 matrices in 2 × 2 blocks, we require that

η R a b c d = A η B η 0 D η
, where η = a b c d .

To compute η R , we proceed as follows. Denote by •, • the standard alternating form 0 I 2 -I 2 0 on Q 4 . Let u 1 , u 2 ∈ Z 4 be the two columns of the 4 × 2 matrix -c a . Then u 1 , u 2 = 0, hence u 1 and u 2 are contained in an isotropic subspace V ⊂ Q 4 of dimension 2. The two last lines of η R are given by a basis of Z 4 ∩ V , and we complete them into a symplectic basis of Z 4 to obtain η R .

A possible choice of C consists of the 3 + 2 + + 1 following matrices [Dup06, Prop. 10.1]:

• T 1 (a, b, c) = -I 2 a b b c 0 -I 2 for a, b, c ∈ 0, -1 , • T 2 (a, b, c) = 0 -I 2 I 2 -a -b -b -c
for a, b, c ∈ 0, -1 such that ac = b 2 mod ,

• T 3 (a) = -1 -a 0 0 0 0 -a 1 0 0 -1 0 0 -1 0 0 for a ∈ 0, -1 , and

• T 4 = 0 1 0 0 0 1 1 0 1 -1 1 1 -1 1 0 0 .
Let us detail a possible choice of η R for all these matrices.

• If η = T 1 (a, b, c), we take

η R = I 4 , D η = -I 2 , det D η = 2 . • If η = T 2 (a, b, c), we take η R = 0 I 2 -I 2 0 , D η = I 2 , det D η = 1.
• If η = T 3 (a), we take

η R = 0 0 0 -1 1 0 0 0 0 1 0 0 0 0 1 0 , D η = -a 1 -0 , det D η = . • If η = T 4 , we take η R = 1 0 0 0 0 0 1 - 1 1 1 -1 0 0 , D η = 2 -1 0 , det D η = .
Then we have

h(τ ) = det(η * τ ) -k det η R * ( 1 ητ ) -k f (A η τ + B η )D -1 η = 2k det(D η ) -k f (A η τ + B η )D -1 η .
We develop f (A η τ + B η )D -1 η using the Fourier expansion of f , and obtain an expansion with coefficients in Z[exp(2πi/ 2 )] in terms of the quantities exp(2πiz j (τ )/ 2 ) for 1 ≤ j ≤ 3. Moreover det(D η ) -k 2k ∈ Z.

The computations in the proof of proposition 5.1.10 show that g is divisible by 20(2 2 + +1) , but we do not need this fact. We finally define

D (τ ) = 12 w h 4 (τ ) w /6 h 10 (τ ) a h 4 (τ ) b η∈C det(η * τ ) -20 h 2 10 ( 1 ητ ), (5.2)
where a, b are such that 4 w /6 + w = 10a + 4b with 0 ≤ b ≤ 4.

Proposition 5.1.11.

D ∈ Z[J 1 , J 2 , J 3 ], and D Ψ ,k ∈ Z[J 1 , J 2 , J 3 , Y ] for each 1 ≤ k ≤ 3.
Proof. By propositions 2.3.7 and 5.1.10, we know that 12 w g ∈ Z[h 4 , h 6 , h 10 , h 12 ], and 12 w f (i)

,k ∈ Z[h 4 , h 6 , h 10 , h 12 ] for all k, i.

Moreover, using the equalities

h 4 h 6 = j 1 h 10 , h 2 4 h 12 = j 2 h 2 10 , h 5 4 = j 3 h 2 10 ,
one can show (following the proof of proposition 5.1.5) that for every modular form f ∈ Z[h 4 , h 6 , h 10 , h 12 ] of weight k, we have

h k/6 4 f h a 10 h b 4 ∈ Z[j 1 , j 2 , j 3 ]
where a, b are such that 4 k/6 + k = 10a + 4b and 0 ≤ b ≤ 4.

The Hilbert case. Fix F = Q( √ 5), and let β ∈ Z F be a totally positive prime. We call D β ∈ Z[J 1 , J 2 ] a complete denominator of the Hilbert modular polynomials Ψ β,k if for each 1 ≤ k ≤ 2, we have

D β Ψ β,k ∈ Z[J 1 , J 2 , Y ].
We construct a complete denominator given by an analytic formula, as in the Siegel case.

Recall that the subgroup Γ 0 (β) of Γ(1) F = SL(Z F ⊕ ∂ -1 F ) is defined by

Γ 0 F (β) = {( a b c d ) ∈ Γ(1) F : b = 0 mod β} .
Let ∆ = 5 be the discriminant of F , and write = N F/Q (β). A set C β of representatives for the quotient Γ 0 (β)\Γ(1) F consists of the + 1 following matrices:

0 √ ∆ -1/ √ ∆ 0 , and
1 a √ ∆ 0 1 for a ∈ 0, -1 ,
Let σ denote the real conjugation automorphism in F ; it induces an automorphism of H 2 1 given by σ((τ 1 , τ 2 )) = (τ 2 , τ 1 ). A set of representatives for the quotient Γ 0 (β)\ Γ(1) F σ is given by C σ β := C β C β σ. For every τ ∈ H 2 1 , we define

g β (τ ) = η∈C σ β (η * τ ) -10 F 10 ( 1 β ητ ).
We can show that g β is independent of the choice of C β , and that g β is a symmetric Hilbert modular form of weight

w β = 10(2 + 2).
As in the Siegel case, the Hilbert modular form g β is the classical analogue of the modular form g δ,m for m = 1 or m = 2 defined in proposition 5.1.3, if we choose F 10 as the denominator of Gundlach invariants; this choice is valid by proposition 2.3.16. For every 0 ≤ i ≤ 2 +2 and 1 ≤ k ≤ 2, we define f

(i) β,k (τ ) as the coefficient of Y i in the polynomial g β (τ )Ψ β,k (g 1 (τ ), g 2 (τ )) ∈ C[Y ].
It is also a symmetric Hilbert modular form of weight w β .

Proposition 5.1.12. The modular forms g β and f (i) β,k are defined over Z. Proof. As above, both the Hecke correspondence and F 10 are defined over Q, hence g β is defined over Q. This is also the case of the modular forms f

(i) β,k
because the coefficients of Hilbert modular equations are defined over Q as modular functions.

As in proposition 5.1.10, it is enough to show the following: if f is a Hilbert modular form of weight k and η ∈ C σ β , then the function

h(τ ) = (η * τ ) -k f ( 1 β ητ )
on H 2 1 has an expansion in terms of the quantities exp(2πi(nτ 1 + nτ 2 )/ ), where n runs through totally positive elements of Z F , with coefficients in the ring Z[exp(2πi/ )]. The computations are easier than in the Siegel case due to the simpler form of coset representatives:

• If η = 0 √ ∆ -1/ √ ∆ 0
, then we make η act again, and we have

(η * τ ) -k f ( 1 β ητ ) = f (βτ ). • If η = 1 a √ ∆ 0 1
, then we directly have

(η * τ ) -k f ( 1 β ητ ) = f 1 β (t + (a √ ∆, -a √ ∆) .
Therefore the Fourier expansion of h has integer coefficients.

For every τ ∈ H 2 1 , we define

D β (τ ) = 2 w β G 2 (τ ) 2 w β /6 F 10 (τ ) a G 2 (τ ) b η∈C σ β (η * τ ) -10 F 10 ( 1 β ητ ), (5.3)
where a, b are such that 2 w β /6 + w β = 10a + 2b with 0 ≤ b ≤ 4.

Proposition 5.1.13. Let F = Q( √ 5), let β ∈ Z F be a totally positive prime, and define D β as in eq. (5.3). Then D β is a complete denominator of the Hilbert modular equations of level β in Gundlach invariants.

Proof. By propositions 2.3.15 and 5.1.12, we know that

2 w β g β ∈ Z[G 2 , F 6 , F 10 ], and 2 wη f (i) β,k ∈ Z[G 2 , F 6 , F 10 ] for all k, i.
Moreover, using the equalities

G 2 2 F 6 = g 2 F 10 , G 5 2 = g 1 F 10 ,
one can show (following the proof of proposition 5.1.5) that for every modular form f ∈ Z[G 2 , F 6 , F 10 ] of weight k, we have

G 2 k/6 2 f F a 10 G b 2 ∈ Z[g 1 , g 2 ]
where a, b are such that 4 k/6 + k = 10a + 2b and 0 ≤ b ≤ 4.

In the case of Hilbert modular equations in Igusa invariants for a general real quadratic field F , we are not able to determine a complete denominator, because the structure of the ring of Hilbert modular forms defined over Z is not known a priori.

Explicit degree bounds in dimension 2

Our methods provide new results about the degrees of the coefficients of modular equations of Siegel and Hilbert type for abelian surfaces. In the Hilbert case, we restrict to the quadratic field F = Q( √ 5), and we consider modular equations in Gundlach invariants.

In both cases, the variety S is a rational. We can choose j n+1 = 1, and take E = J n+1 -1 as the equation satisfied by j n+1 on S. Then the notions of geometric complexity and symmetric geometric complexity coincide.

Lemma 5.1.14. Let j 1 , j 2 , j 3 denote the Igusa invariants on the Siegel threefold Sp 4 (Z)\H 2 , as defined in §2.3.2. Then we have GC(j 1 , j 2 , j 3 , 1) ≤ 1 6 .

Proof. By theorem 2.3.5, the graded ring of Siegel modular forms is generated by f 1 = I 6 , f 2 = I 12 , f 3 = I 4 , and f 4 = I 10 .

We are in case 1 of definition 5.1.7, since The definition gives

I
SGC(j 1 , j 2 , j 3 , 1) ≤ 1 + 2 3 • 1 10 = 1 6 .
Proposition 5.1.15. Let be a prime number, and let Ψ ,m for 1 ≤ m ≤ 3 denote the Siegel modular equations of level . Let F ∈ Q(J 1 , J 2 , J 3 ) be a coefficient of Ψ ,1 (resp. Ψ ,2 or Ψ ,3 ). Then the total degree of F is bounded above by 5 d ( )/3 (resp. 10 d ( )/3), where d ( ) = 3 + 2 + + 1.

Proof. The integer d ( ) is the degree of the Hecke correspondence. The denominators of j 1 , j 2 , j 3 can be taken to be the Siegel modular forms h 10 , h 2 10 , and h 2 10 . Let g ,m for 1 ≤ m ≤ 3 be the common denominators of the modular equations Ψ ,m as in proposition 5.1.3, so that g ,2 = g ,3 = g 2 ,1

and wt(g ,1 ) = 10 d ( ). The modular form g ,2 corresponds to the classical modular form g studied in §5.1.4.

Let F be a coefficient of Ψ ,1 (resp. Ψ ,2 or Ψ ,3 ). Then F (j 1 , j 2 , j 3 ) is the quotient of two modular forms of degree 10 d ( ) (resp. 20 d ( )) on S, by proposition 5.1.3. Therefore the result follows from lemma 5.1.14 and proposition 5.1.8. Lemma 5.1.16. Let F = Q( √ 5), and let g 1 , g 2 denote the Gundlach invariants on the Hilbert surface SL(Z F ⊕∂ -1 F )\H 2 1 , as defined in §2.3.4. Then we have GC(g 1 , g 2 , 1) ≤ 1 6 .

Proof. Choose F 6 , F 2 , F 10 as generators for the graded ring of Hilbert modular forms for F . We have

F 6 F 2 2 F 10 = g 2 and F 5 2 F 10 = g 1 .
We are in case 1 of definition 5.1.7, and

GC(g 1 , g 2 , 1) ≤ 1 + 2 3 • 1 10 = 1 6 .
Proposition 5.1.17. Let F = Q( √ 5), let β ∈ Z F be a totally positive prime, and let Ψ β,m for m ∈ {1, 2} denote the Hilbert modular equations of level β in Gundlach invariants. Let F ∈ Q(J 1 , J 2 ) be a coefficient of Ψ β,1 or Ψ β,2 . Then the total degree of F is bounded above by 10 d (β)/3, where

d (β) = N F/Q (β) + 1.
Proof. The integer d (β) is the degree of the Hecke correspondence, and the automorphism group Σ used to define the Hilbert modular equations has order 2. We can take the modular F 10 as denominator of both g 1 and g 2 . The common denominator g β,1 = g β,2 from proposition 5.1.3 has weight 20 d (β); it corresponds to the classical Hilbert modular form g β studied in §5.1.4. The result follows from lemma 5.1.14 and proposition 5.1.8.

The degree bounds in propositions 5.1.15 and 5.1.17 are both reached experimentally. In the Siegel case with = 2, the maximum degree is 25; in the Hilbert case with N F/Q (β) = 41, the maximum degree is 140 [Mil]. In particular, the inequalities in lemmas 5.1.14 and 5.1.16 are in fact equalities.

Height bounds for modular equations

We keep the notation introduced at the beginning of chapter 5. We also write S = Γ\X + , where Γ is a subgroup of G(Q) + . As we mentioned above, there are two main steps in the proof of height bounds in theorem 5.0.1: first, we study the heights of evaluations of modular equations; then we apply the results of chapter 4 to obtain height bounds on their coefficients.

Heights of abelian varieties

Different types of heights can be defined for an abelian variety A over a number field L. The Faltings height h F (A) is defined in [START_REF] Faltings | Endlichkeitssätze für abelsche Varietäten über Zahlkörper[END_REF]§3] in terms of Arakelov degrees of metrized line bundles on A. If A is given a principal polarization L, and r ≥ 2 is an even integer, we can also define the theta height of level r of (A, L), denoted by h Θ,r (A, L), as the projective height of level r theta constants of (A, L) [Paz12, Def. 2.6]. Finally, if A is an abelian variety with PEL structure over L given by a point z ∈ S where j 1 , . . . , j n+1 are well defined, we can define the j-height of A as h j (A) = h j 1 (A), . . . , j n+1 (A) .

We also write h F (A) = max{1, h F (A)} and define h, h Θ,r , h j similarly.

The goal of this section is to relate the j-heights of isogenous abelian varieties, under mild conditions related to the geometry of the moduli space. Such a relation is known for instance in the case of elliptic curves, taking the usual j-invariant as coordinate [Paz19, Thm. 1.1]. To this end, we relate the j-height with the Faltings height, since the latter behaves well with respect to isogenies. Theta heights are an intermediate step between concrete values of invariants and the Faltings height. More precisely, we use the two following results. Proposition 5.2.1. Let A, A be abelian varieties over Q, and assume that an isogeny ϕ : A → A exists. Then

h F (A) -h F (A ) ≤ 1 2 log(deg ϕ).
Proof. This is a consequence of [START_REF] Faltings | Endlichkeitssätze für abelsche Varietäten über Zahlkörper[END_REF]Lem. 5].

Theorem 5.2.2 ([Paz12, Cor. 1.3]). For every g ≥ 1, and every even r ≥ 2, there exists a constant C(g, r) such that the following holds. Let (A, L) be a principally polarized abelian variety of dimension g defined over Q. Then

h Θ,r (A, L) -1 2 h F (A) ≤ C(g, r) log min{h F (A), h Θ,r (A, L)} + 2 .
We can take C(g, r) = 1000r 2g log 5 (r 2g ).

Relating the j-height and the Faltings height

Using theorem 5.2.2, we can prove that the j-height and the Faltings height of a generic abelian variety with PEL structure are related.

Proposition 5.2.3. There exists a nonzero polynomial P ∈ L[Y 1 , . . . Y n+1 ] and a positive constant C such that the following holds: if A is the abelian variety with PEL structure associated with a point z ∈ S where j 1 , . . . , j n+1 are well defined and P (j 1 , . . . , j n+1 ) = 0, and if A is defined over Q, then

1 C h F (A) ≤ h j (A) ≤ C h F (A).
Proof. By [START_REF] Milne | Introduction to Shimura varieties[END_REF]Thm. 5.17], we can write S = Γ \X + where Γ is a congruence subgroup of G der . Since G der ⊂ ker(det), it embeds into GSp 2g (Q), where 2g = dim Q V . Therefore, by [START_REF] Milne | Introduction to Shimura varieties[END_REF]Thm. 5.16], we can find a congruence subgroup Γ of G der and an even integer r ≥ 4 such that Γ \X + embeds in the moduli space A Θ,r of principally polarized abelian varieties of dimension g with level r theta structure. We have a diagram

S = Γ\X + S = Γ \X + S = Γ \X + A Θ,r p p ι (5.4)
where Γ = Γ ∩ Γ . The maps p and p are finite coverings, and all the varieties and maps in this diagram are defined over Q.

The modular interpretation of diagram (5.4) is the following. Let (Λ, ψ) be the standard polarized lattice associated with the connected component S, as in proposition 2.2.8. We can find a sublattice Λ ⊂ Λ, and λ ∈ Q × such that (Λ , λψ) is principally polarized. A point z ∈ S defines a complex structure x on Λ ⊗ R = V (R), up to action of Γ. Lifting z to z ∈ S corresponds to considering x up to action of Γ only, and this group leaves Λ and its level r theta structure stable. Then the image of z in A Θ,r is given by (Λ , x, λψ).

In particular, if z ∈ S, and if A and A are the abelian varieties corresponding to the points p ( z) ∈ S and ι • p ( z) ∈ A Θ,r respectively, then A and A are linked by an isogeny of degree d = #(Λ/Λ ). Hence, by proposition 5.2.1 and theorem 5.2.2, we have

h F (A) -2 h Θ,r (A ) ≤ log(d) 2 + C(g, r) log min{h F (A), h Θ,r (A )} + 2 + 1 2 log(d) ≤ C F min{h F (A), h Θ,r (A )} with C F = (2 + log(d))C(g, r). Therefore h F (A) ≤ (2 + C F ) h Θ,r (A ) and h Θ,r (A ) ≤ 1 + C F 2 h F (A).
(5.5)

Now we relate the theta height and the j-height using relations between modular functions; the genericity hypothesis encoded in the polynomial P appears in this step. Denote by θ 0 , . . . , θ k the theta constants of level r. They define a projective embedding of A Θ,r , therefore the pullbacks of the modular functions θ 1 /θ 0 , . . . , θ k /θ 0 generate the function field of S . By definition, j 1 , . . . , j n+1 are coordinates on S. To ease notation, we identify all these functions with their pullbacks to S.

By the primitive element theorem, there exists a function f on S such that both of the tuples (j 1 , . . . , j n+1 , f ) and (θ 1 /θ 0 , . . . , θ k /θ 0 , f ) are generating families for the function field of S over Q. We choose polynomials

P J ∈ Q[Y 1 , . . . , Y n+1 , X] and P Θ ∈ Q[Y 1 , . . . , Y k , X]
such that P J (j 1 , . . . , j n+1 , X) and P Θ (θ 1 /θ 0 , . . . , θ k /θ 0 , X) are (non necessarily monic) minimal polynomials of f over the function fields of S and S respectively. We also choose polynomials

N J,i , D J,i ∈ Q[Y 1 , . . . , Y k , X] for 1 ≤ i ≤ n + 1, and N Θ,i , D Θ,i ∈ Q[Y 1 , . . . , Y n+1 , X] for 1 ≤ i ≤ k
such that the following equalities hold on S:

j i = N J,i D J,i (θ 1 /θ 0 , . . . , θ k /θ 0 , f ) for each 1 ≤ i ≤ n + 1, and
θ i /θ 0 = N Θ,i D Θ,i (j 1 , . . . , j n+1 , f ) for each 1 ≤ i ≤ k.
Let F be the smallest Zariski closed subset of S such that outside F , the following properties are all statisfied:

• all the functions f , j i for 1 ≤ i ≤ n + 1 and θ i /θ 0 for 1 ≤ i ≤ k are well defined;

• the polynomials P J (j 1 , . . . , j n+1 , X) and P Θ (θ 1 /θ 0 , . . . , θ k /θ 0 , X) do not vanish;

• All of the quantities D J,i (θ 1 /θ 0 , . . . , θ k /θ 0 , f ) for 1 ≤ i ≤ n + 1 and D Θ,i (j 1 , . . . , j n+1 , f ) for 1 ≤ i ≤ k do not vanish.

Then F has codimension 1 in S, hence U = S\p ( F ) is open dense in S. Let P ∈ L[Y 1 , . . . , Y n+1
] be a polynomial such that {P (j 1 , . . . , j n+1 ) = 0} ⊂ U.

Let z ∈ S be a point where j 1 , . . . , j n+1 are well defined, take values in Q, and satisfy P (j 1 , . . . , j n+1 ) = 0. We look at the diagram (5.4), from left to right. Lift z to a point z ∈ S; by construction, z / ∈ F . By propositions 4.3.1 and 4.3.3, we have h j 1 ( z), . . . , j n+1 ( z), f ( z) ≤ C h j 1 (z), . . . , j n+1 (z)

(5.6) with C = h(P J ) + (n + 1) log(d J + 1) + d J + 1, where d J denotes the total degree of P J in Y 1 . . . , Y n+1 . Writing z = p ( z), we also have for every

1 ≤ i ≤ k, h(θ i /θ 0 ( z)) ≤ C h j 1 ( z), . . . , j n+1 ( z), f ( z) (5.7) with C = h(N Θ,i ) + h(D Θ,i ) + (n + 2) log(deg(N Θ,i ) + 1) + log(deg(D Θ,i ) + 1) + deg(N Θ,i ) + deg(D Θ,i
). Combining (5.6) and (5.7), we obtain

h θ 1 θ 0 (z ), . . . , θ k θ 0 (z ) ≤ C Θ h j 1 (z), . . . , j n+1 (z)
where the constant C Θ has an explicit expression in terms of the heigts and degrees of the polynomials P J and N Θ,i , D Θ,i for 1 ≤ i ≤ k. Therefore, if A and A denote the abelian varieties associated with z and z respectively, we have h Θ,r (A ) ≤ C Θ h j (A), hence by (5.5)

h F (A) ≤ (2 + C F )C Θ h j (A).
Going through the diagram (5.4) from right to left gives the reverse inequality

h j (A) ≤ (1 + C F )C J 2 h F (A)
where C J is defined in a similar way to C Θ in terms of the polynomials P Θ and N J,i , D J,i for 1 ≤ i ≤ n + 1.

Assume that the integers r and d, the modular function f , and the polynomials P J , P Θ , N J,i , D J,i , N Θ,i , D Θ,i can be explicitly determined. Then both the polynomial P and the constant C in proposition 5.2.3 can be determined explicitly as well. We will do this computation in a slightly different way in §5.2.5 in the case of Igusa invariants on the Siegel threefold.

In the sequel, we define U to be the Zariski open set in S where j 1 , . . . , j n+1 are well defined and P (j 1 , . . . , j n+1 ) = 0.

Corollary 5.2.4. Let C be the constant from proposition 5.2.3, let z and z be points of U, and let A and A be the abelian varieties with PEL structure associated with z and z . Assume that A and A are defined over Q, and are linked by an isogeny of degree . Then h j (A ) ≤ C 2 (h j (A) + log ).

Proof. Combine propositions 5.2.1 and 5.2.3.

Remark 5.2.5. We can presumably do better than corollary 5.2.4. For instance, when studying j-invariants of isogenous elliptic curves, one can prove that | h(j(E)) -h(j(E ))| is bounded by logarithmic terms [Paz19, Thm. 1.1]. This is also the kind of bound provided by theorem 5.2.2. The rough estimate in corollary 5.2.4 is sufficient for our purposes, but has the drawback that the constants we derive from it are very pessimistic.

Heights of evaluated modular equations

Let U (resp. U ) be an open subset of S (resp. T ) where a relation bewteen the j-height and the Faltings height holds, as in proposition 5.2.3. Define U δ ⊂ S to be the Zariski open set of all points [x, g] ∈ S such that [x, g] ∈ U, and moreover the images of [x, g] under the (symmetrized) Hecke correspondence H δ all lie in U : in other words [σ(x), σ(gkδ)] ∈ U for every (k, σ) ∈ K 0 /K n+1 , in the notation of §2.4.3. Finally, we define V δ ⊂ L n to be the Zariski open set of all points (j 1 , . . . , j n ) where the equation (5.1)

given by E(j 1 , . . . , j n , J n+1 ) = 0 has e distinct roots and the following property holds: if j n+1 is a root of (5.1), then (j 1 , . . . , j n+1 ) are the invariants of some point z ∈ U δ . In particular, the modular equations Ψ δ,m do not have poles on V δ . Lemma 5.2.6. There exist a constant C independent of δ, and a nonzero polynomial P δ ∈ L[J 1 , . . . , J n ] of total degree at most Cd(δ) such that {P δ (j 1 , . . . , j n ) = 0} ⊂ V δ .

Proof. Let R be the the resultant of E and its derivative with respect to J n+1 . If R does not vanish at (j 1 , . . . , j n ) ∈ L n , then the polynomial E(j 1 , . . . , j n , J n+1 ) ∈ L[J n+1 ] has e distinct roots.

Similarly, there exists a nonzero polynomial Q ∈ L[J 1 , . . . , J n+1 ] such that every tuple (j 1 , . . . , j n+1 ) ∈ L n+1 that satisfies eq. (5.1) and such that Q(j 1 , . . . , j n+1 ) = 0 lies in the image of S. Let R be the resultant of Q and E with respect to J n+1 . If R does not vanish at (j 1 , . . . , j n ), then for every root j n+1 of E(j 1 , . . . , j n , J n+1 ), the tuple (j 1 , . . . , j n+1 ) lies in the image of S.

Let λ, λ be symmetric modular forms on S and T respectively, defined over L, such that {λ = 0} ⊂ U and {λ = 0} ⊂ U . These modular forms can be chosen independently of δ. As in §5.1.1, we construct the modular form λ δ = λ Modular forms realize a projective embedding of S by theorem 2.2.12; therefore, possibly after increasing the weight by a constant independent of δ, we can find a symmetric modular form ξ defined over L such that wt(λ δ ) = wt(ξ) and such that the divisors of λ δ and ξ have no common codimension 1 components. By proposition 5.1.8, if we write

λ δ ξ = e-1 k=0 R k (j 1 , . . . , j n )j k n+1 where R k ∈ L(J 1 , . . . , J n ),
then deg R k ≤ GC(j 1 , . . . , j n+1 ) wt(λ δ ) for every 0 ≤ k ≤ e -1. Taking the resultant of R k J k n+1 and E with respect to J n+1 yields a rational fraction R ∈ L(J 1 , . . . , J n ) of degree at most

(e -1)d E + e max 0≤k≤e-1 deg(R k ),
where d E denotes the total degree of E in j 1 , . . . , j n . If R and R are well defined and do not vanish at (j 1 , . . . , j n ), then for every root j n+1 of (5.1), the tuple (j 1 , . . . , j n+1 ) comes from a point z ∈ U δ .

We take P δ to be the product of R, R , and the numerator of R . The polynomials R and R are independent of δ, and the degree of R is bounded above linearly in d (δ).

If degree bounds on equations defining U and U are explicitly known, together with the polynomials E and Q, then the proof of lemma 5.2.6 allows us to determine a valid constant C explicitly.

Proposition 5.2.7. There exists a constant C, independent of δ, such that the following holds. Let (j 1 , . . . , j n ) ∈ V δ , and let 1 ≤ m ≤ n + 1. Then h Ψ δ,m (j 1 , . . . , j n ) ≤ C d (δ) h(j 1 , . . . , j n ) + log l (δ) .

Proof. Let J be the set of roots of (5.1) at (j 1 , . . . , j n ), and let j n+1 ∈ J . Let [x, g] be a point of S describing an abelian variety A with PEL structure whose invariants are (j 1 , . . . , j n+1 ). For every σ ∈ Σ, denote by A σ the abelian variety with PEL structure associated with the point [σ(x), σ(g)].

By corollary 2.4.2, for each γ = (σ, k) ∈ K 0 /K m , the point [σ(x), σ(gkδ)] describes an abelian variety A γ which is linked to A σ by an isogeny of degree l (σ(δ)) = l (δ). Therefore, by corollary 5.2.4, we have h γ • j 1,δ ([x, g]), . . . , γ • j n+1,δ ([x, g]) ≤ C(h j 1 , . . . , j n+1 ) + log l (δ) , where the constant C > 0 is independent of δ. By definition 2.4.6, the multivariate polynomial Ψ δ,m (j 1 , . . . , j n , j n+1 ) ∈ L[Y 1 , . . . , Y m ] is the evaluation of a certain multivariate polynomial at the values γ • j i,δ ([x, g]), for 1 ≤ i ≤ m and γ ∈ K 0 /K i , each appearing with degree 1. The number of such values is

d 1 + d 1 d 2 + • • • + d 1 • • • d m ≤ m (#Σ) d (δ).
Therefore, by proposition 4.3.1, we have

h Ψ δ,m (j 1 , . . . , j n+1 ) ≤ m (#Σ) d (δ) log(2) + m (#Σ) d (δ) C h(j 1 , . . . , j n+1 ) + log l (δ) ≤ C d (δ) h(j 1 , . . . , j n+1 ) + log l (δ) ,
where C and C denote explicit constants independent of δ. In order to obtain Ψ δ,m (j 1 , . . . , j n ), we interpolate a polynomial of degree e -1 in j n+1 2. We have M ≥ 2B log 2 (B + 1), where B = 4C 3 5.1.9 C 5.2.7 d (δ) 4 max{1, log l (δ)}.

3. N 1 = 2d and N 2 ≥ M .

4. T has amplitude (4d, 2M ).

5. For every (y 1 , . . . , y n ) ∈ I n (T ), the point

(j 1 , . . . , j n ) = (y 1 y n + a 1 , . . . , y n-1 y n + a n-1 , y n + a n ) belongs to V δ .
6. For every (y 1 , . . . , y n-1 ) ∈ I n-1 (T ), the polynomials P and Q evaluated at (y

1 Y + a 1 , . . . , y n-1 Y + a n-1 , Y + a n ) are coprime in L[Y ]. 7. Q(a 1 , . . . , a n ) = 0.
Lemma 5.2.9. There exists a constant C, independent of δ, such that the following holds. Let F be a coefficient of Ψ δ,m of degree d ≥ 1. Then there exist valid evaluation data (T, a, M ) for F such that

C d (δ) 4 max 1, log 3 (l (δ)) ≤ M < C d (δ) 4 max 1, log 3 (l (δ)) + 1 and M ≥ 4d[L : Q]. We can take C = max {C 1 , C 2 , C 3 }
where C 1 = 24C 3 5.1.9 C 5.2.7 4C log + log(24C 3 5.1.9 C 5.2.7 ) + 1 , C 2 = 14C 2 5.1.9 + 5C 5.2.6 , and C 3 = 4C 5.1.9 [L : Q].

Proof. Let M be as above. We check that condition 2 in the definition of a valid evaluation tree is satisfied because C ≥ C 1 . We start by constructing the vector a. Note that M ≥ 2d + 1. Since Q is nonzero, and has degree at most d in Y 1 , we can find a 1 ∈ Z such that |a 1 | ≤ M and the polynomial Q(a 1 , Y 2 , . . . , Y n ) is nonzero. Iterating, we find a = (a 1 , . . . , a n ) bounded by M such that Q(a 1 , . . . , a n ) = 0.

We now build the evaluation tree T down from the root. Let P δ be an equation for the complement of V δ as in lemma 5.2.6, and define

R δ = P δ (Y 1 Y n + a 1 , . . . , Y n-1 Y n + a n-1 , Y n + a n )
is a way to write F in irreducible form in L(Y ), and has a coefficient equal to 1. Therefore h( F ) is the affine height of the coefficients appearing in the quotient. Hence

h P (y 1 Y n + a 1 , . . . , y n-1 Y n + a n-1 , Y n + a n ) ≤ C d (δ) max {1, log l (δ)}
for every (y 1 , . . . , y n-1 ) ∈ I n-1 (P ), and the same inequality holds for Q.

Since N 1 = 2d, we can interpolate successively the variables y n-1 , . . . , y 1 , using proposition 4.4.3 with 2d evaluation points at each vertex of the tree T . Finally we obtain

h(F ) ≤ 2 n-1 C d (δ) max{1, log l (δ)} + 4d log(4d) + d log(2M ) + log(d + 1)
≤ 2 n-1 C + 4C 5.1.9 (log(C 5.1.9 ) + C log ) + C 5.1.9 (log(2) + C ) + log(2C 5.1.9 ) + 1 d (δ) max {1, log l (δ)} , as claimed.

Explicit height bounds in dimension 2

To conclude this chapter, we derive explicit height bounds for modular equations of Siegel type and level for abelian surfaces in the Igusa invariants j 1 , j 2 , j 3 . Our first aim is to provide an explicit value for the constant in corollary 5.2.4, using theta constants of level 4 as an intermediate step. To relate theta heights and j-heights in this setting, we use Mestre's algorithm and Thomae's formulae instead of writing out polynomials N J,i , D J,i , N Θ,i , D Θ,i as in the proof of proposition 5.2.3. Proposition 5.2.11. Let A be a principally polarized abelian surface defined over Q whose Igusa invariants j 1 , j 2 , j 3 are well defined, and assume that j 3 (A) = 0. Then we have h j (A) ≤ 40 h Θ,4 (A) + 12 and h Θ,4 (A) ≤ 200 h j (A) + 1000.

Proof. Recall the expression of the Igusa invariants in terms of the Siegel modular forms h 4 , h 6 , h 10 , and h 12 ( §2.3.2): For the second inequality, we follow Mestre's algorithm [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF]. Starting from j 1 (A), j 2 (A) and j 3 (A), Mestre's algorithm constructs a hyperelliptic curve y 2 = f (x) whose Jacobian is isomorphic to A over Q. Choosing I 10 = 1 in eq. (3.5), we see that j 1 (A), j 2 (A) and j 3 (A) are realized by covariants I 2 , I 4 , I 6 , and I 10 in Q such that h(I 2 , I 4 , I 6 , I 10 ) ≤ h j (A).

j 1 = h 4 h 6 h 10 , j 2 = h 2 4 h 12 h 2 10 , j 3 = h 5 4 h 2
The roots of f are the intersection points of a conic and a cubic in P 2 whose equations are given explicitly in terms of I 2 , I 4 , I 6 , and I 10 . In order to obtain the equation 3 i,j=1 c ij z i z j = 0 of the conic, we start from Mestre's equation 3 i,j=1 A ij x i x j = 0 and substitute the expressions of A, B, C, and D in terms of I 2 , I 4 , I 6 , and I 10 . Then we multiply by 2 11 3 13 5 14 and make the substitutions

z 1 = 202500x 1 , z 2 = 225x 2 , z 3 = x 3 .
Then, each coefficient c ij has an expression as a multivariate polynomial in I 2 , I 4 , and I 6 (recall that I 10 = 1) of total degree at most 7; its coefficients are integers whose absolute values are bounded by 324 • 10 6 . By proposition 4.3.1, we have h (c ij ) 1≤i,j≤3 ≤ 7(h j (A) + log(3)) + 19.6 + 3 log(8) ≤ 7h j (A) + 33.6.

If we restrict to c 11 , c 12 , and c 22 , then we obtain a smaller upper bound, since the total degree and the height of coefficients are at most 5 and 18.3 respectively. Similarly, the cubic equation, denoted by 1≤i≤j≤k≤3 c ijk z i z j z k = 0, has total degree at most 11 in I 2 , I 4 , and I 6 , and has integer coefficients whose heights are at most 33.5.

In order to find the hyperelliptic curve equation f , we parametrize the conic. Let us show that it contains a point P 0 defined over Q such that h(P 0 ) ≤ 5h j (A) + 29.9. We can assume that c 11 = 0; otherwise we take P 0 = (1 : 0 : 0). Let α be a root of the monic polynomial

α 2 + c 12 c 11 α + c 22 c 11 = 0.
The point P 0 = (α : 1 : 0) belongs to the conic, and by proposition 4.3.3,

h(P 0 ) = h(α) ≤ h(c 11 , c 12 , c 22 ) + log(2)
≤ 5(h j (A) + log(3)) + 18.3 + 3 log(6) + log(2) ≤ 5h j (A) + 29.9.

We parametrize the conic using P 0 as a base point; for simplicity, we continue to assume that c 11 = 0. For (u : v) ∈ P 1 (Q), the point (z 1 : z 2 : z 3 ) defined by

z 1 = α(c 11 u 2 + c 13 uv + c 33 v 2 ) -u((2c 11 α + c 12 )u + (c 13 α + c 23 )v), z 2 = c 11 u 2 + c 13 uv + c 33 v 2 , z 3 = -v((2c 11 α + c 12 )u + (c 13 α + c 23 )v)
runs through the conic. Substituting these expressions in the cubic equation gives the curve equation f . The polynomials we obtain have total degrees at most 29 in I 2 , I 4 , and I 6 ; they have degree at most 3 in α; and their coefficients are integers whose heights are bounded above by 86.9. Therefore, by proposition 4.3.1 (separating I 2 , I 4 , I 6 from α), we have h(f ) ≤ 29(h j (A) + log(3)) + 86.9 + 3(5h j (A) + 29.9) + 3 log(30) + log(4) ≤ 44h j (A) + 220.1.

Making f monic does not change its height. Thomae's formulae [Mum84, IIIa.8.1] give an expression of the theta constants of level 4 of A in terms of roots of f : if θ is one of these theta constants, then θ 4 is a product of 18 differences of roots of f (up to a common multiplicative factor). Therefore, by proposition 4.3.3, we obtain

h Θ,4 (A, L) ≤ 1 4 • 18(h(f ) + log(4)) ≤ 198h j (A) + 997.
As a consequence, we obtain an explicit analogue of corollary 5.2.4 in the case of isogenies between principally polarized abelian surfaces. Proposition 5.2.12. Let A and A be principally polarized abelian surfaces over Q where the Igusa invariants j 1 , j 2 , j 3 are well defined, and assume that j 3 (A)j 3 (A ) = 0. Let ≥ 1 be an integer. If A and A are linked by an isogeny of degree , then we have h j (A ) ≤ 8000 h j (A) + 1.08 • 10 11 log(h j (A)) + 1.67 • 10 12 + 20 log . Proof. By propositions 5.2.1 and 5.2.11 and theorem 5.2.2 (noting that C(2, 4) ≤ 1.35 • 10 9 ), we have

h Θ,4 (A) ≤ 200 h j (A) + 1000, 1 2 h F (A) ≤ h Θ,4 (A) + C(2, 4) log(h Θ,4 (A) + 2) ≤ 200 h j (A) + C(2, 4) log(1202) + C(2, 4) log(h j (A)), 1 2 h F (A ) ≤ 1 2 h F (A) + 1 4 log , h Θ,4 (A ) ≤ 1 2 h F (A ) + C(2, 4) log(h F (A ) + 2) ≤ 200 h j (A) + C(2, 4) log(1202) + 2C(2, 4) log(h j (A)) + 1 4 log + C(2, 4) log 402 + 2C(2, 4) log(1202) + C(2, 4) + 1
2 log , ≤ 200 h j (A) + 2C(2, 4) log(h j (A)) + 4.17 • 10 10 + 1 2 log , and h j (A ) ≤ 40 h Θ,4 (A) + 12 ≤ 8000 h j (A) + 80C(2, 4) log h j (A) + 1.67 • 10 12 + 20 log .

In lemma 5.2.6, we take λ = I 4 and λ = I 4 I 10 . We have wt(λ δ ) = 14 d (δ) + 4, which is greater than 16, the minimum weight for which Siegel modular forms define a projective embedding of S. Hence ξ can be chosen to be a modular form of weight wt(λ δ ). The fraction R has degree at most 7 3 (d (δ) + 1) by lemma 5.1.14; this is also an upper bound on deg(P δ ). We also mimic the proof of proposition 5.2.7 in the Siegel case. Let [x, g] be a point of S with Igusa invariants (j 1 , j 2 , j 3 ) ∈ V δ . For each 1 ≤ m ≤ 3, by remark 2.4.10, the polynomial Ψ δ,m (j 1 , j 2 , j 3 ) is the evaluation of a multivariate polynomial in 2 d (δ) variables. Moreover, the Hecke correspondence describes isogenies of degree 2 . By proposition 5.2.12, h Ψ δ,m (j 1 , j 2 , j 3 ) is bounded above by 2 d (δ) 8000 h(j 1 , j 2 , j 3 )+1.08•10 11 log(h j (A))+1.67•10 12 +40 log . (5.8) Therefore, we can take C 5.2.7 = 3.35 • 10 12 . Moreover, we have d (δ) = 3 + 2 + + 1 and l (δ) = 2 . Hence we can take C log = over Schoof's method described in [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. This unfortunate state of affairs has led to the belief that modular equations for abelian surfaces should be avoided in practice. In [START_REF] Couveignes | Computing functions on Jacobians and their quotients[END_REF], for instance, one can read: "it is unlikely that modular equations will be of any use to accelerate the computation of torsion points for higher genera, since they are all far too big".

However, in most contexts, writing out the modular equations in full is not truly needed. In order to detect isogenies between abelian surfaces, and also to compute these isogenies explicitly using the algorithms of chapter 3, we only need evaluations of modular equations and their derivatives: in the Siegel case, this would be the polynomials

Ψ ,m (j 1 , j 2 , j 3 , Y ) ∈ K[Y ] and ∂ J k Ψ ,m (j 1 , j 2 , j 3 , Y ) ∈ K[Y ]
for 1 ≤ k, m ≤ 3, where j 1 , j 2 , j 3 are fixed elements of a certain field K.

These evaluations can be a lot smaller, because they erase the increase of the number of variables coming from the dimension of the moduli space. For instance, if j 1 , j 2 , j 3 ∈ Q have height O(1), then the size of these polynomials is O( 6 log ) by theorem 5.0.1; if β ∈ Z F is a totally positive prime of norm , then the size of evaluations of Hilbert modular equations of level β in Igusa invariants at (j 1 , j 2 , j 3 ) is only O F ( 2 log ), the same aymptotic estimate (up to constants depending on F ) as in the case of elliptic modular polynomials.

The goal of this chapter is to present an algorithm that directly computes evaluations of modular equations of Siegel or Hilbert type for abelian surfaces, given values of Igusa or Gundlach invariants in a number field. This evaluation algorithm extends to the case of finite fields via lifts. As a special case, we obtain the following result. Theorem 6.0.1 (Under hypothesis 6.2.15 below). There exists an algorithm which, given prime numbers p and , and given (j 1 , j 2 , j 3 ) ∈ F 3 p where the denominators of the Siegel modular equations of level do not vanish and such that j 3 = 0, computes Ψ ,m (j 1 , j 2 , j 3 , Y ) and

∂ J k Ψ ,m (j 1 , j 2 , j 3 , Y ) in F p [Y ] for 1 ≤ k, m ≤ 3 within O( 3 log 2 p + 6 log p) binary operations.
A similar results holds for Hilbert modular equations for F = Q( √ 5) in Gundlach invariants, with a complexity of only O F ( log 2 p+ 2 log p) binary operations. In both cases, we save a factor of log p when j 1 , j 2 and j 3 are quotients of small integers. In the case of Hilbert modular equations for a general F , our algorithm is unfortunately only heuristic.

Let us give a high-level view of the algorithm to evaluate Siegel modular equations, and describe the heuristic assumption that it uses. Let L be a number field, and choose Igusa invariants (j 1 , j 2 , j 3 ) ∈ L 3 where the denominator of Siegel modular equations of level , denoted by D in §5.1.4, does not vanish. Assume for simplicity that j 1 , j 2 , j 3 ∈ Z L . We use complex approximations: for each complex embedding µ of L, we compute a period matrix τ ∈ H 2 whose Igusa invariants are (µ(j 1 ), µ(j 2 ), µ(j 3 )). Then, we compute approximations of the numerator and denominator of Siegel modular equations at τ using analytic formulae (definition 2.4.6 and eq. (5.2)). Finally, we recognize their coefficients as algebraic numbers, more precisely algebraic integers by proposition 5.1.11. During the algorithm, we keep track of precision losses in order to obtain a provably correct result.

An essential subroutine in the evaluation algorithm is to convert back and forth between matrices τ ∈ H 2 and the values of theta constants at τ , defined in eq. (2.10). This can be done in quasi-linear time in the required precision, at least for certain ranges of inputs, using the arithmetic-geometric mean (AGM) to compute τ from its theta constants [Bor88, BM88, Jar08], and an algorithm of Dupont [Dup06, Chap. 10] in the other direction. Dupont's algorithm combines the AGM with Newton iterations, and works very well in practice, but its proper convergence remains heuristic. Hypothesis 6.2.15, on which our main theorem relies, states that Dupont's algorithm converges uniformly in a certain compact subset of H 2 .

This chapter is organized as follows. First, we describe our computational model and analyze precision losses in "basic" operations on complex numbers and polynomials, such as reconstructing polynomials from their roots, Lagrange interpolation, and the reconstruction of integers in number fields from their values in complex embeddings ( §6.1). Then we review the AGM method for theta constants in genus 2 and Dupont's algorithm, and make some new contributions ( §6.2):

• In order to bound precision losses uniformly in τ , we prove the technical result that the relevant AGM sequences are given by good sign choices [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF], a fact that was left as a conjecture in [Dup06, Conj. 9.1] and [Eng09a, Conj. 9];

• Using Dupont's algorithm, we explain how to compute theta constants on a fundamental domain F 2 ⊂ H 2 with uniform quasi-linear cost, in a similar way to [Dup11, §6.3] in the genus 1 case;

• We also bound the precision losses when reducing a general τ ∈ H 2 to F 2 , using techniques inspired from [START_REF] Streng | Computing Igusa class polynomials[END_REF]§6].

Finally, we present the evaluation algorithm in §6.3, focusing on the case of Hilbert modular equations, which is more intricate due to the presence of the Hilbert embedding.

1. Given an approximation of z to precision N , the inverse 1/z can be computed within O M(N + log + |z|) binary operations, with a precision loss of -2 log 2 |z| + O(1) bits.

2. Given an approximation of z to precision N , an approximation of a square root of z can be computed within O M(N + log + |z|) binary operations, with a precision loss of -1 2 log 2 |z| + O(1) bits. In proposition 6.1.1, the assumption on N ensures that the ball approximating z does not contain 0.

Precision losses in additions and multiplications of complex numbers are a special case of the following result for univariate polynomials. Proposition 6.1.2. Let P 1 , P 2 ∈ C[X], and N, N 1 , N 2 ≥ 1. Assume that P 1 , P 2 and their approximations have degree at most d.

1. Given approximations of P 1 , P 2 to precision N , the sum P 1 + P 2 can be computed within

O (d + 1) (N + log max{1, |P 1 | , |P 2 |})
binary operations, with a precision loss of O(1) bits.

2. Given approximations of P i to precision N i for i = 1, 2, the product P 1 P 2 can be computed within

O M (d + 1) max{N 1 + log |P 1 | , N 2 + log |P 2 |}
binary operations, to precision

min{N 1 -log + 2 |P 2 | , N 2 -log + 2 |P 1 |} -log 2 (1 + d) -O(1).

Reconstruction from roots and interpolation

We start with a technical lemma that we will use several times, when we construct polynomials as products of linear factors. Lemma 6.1.3. There exists an algorithm such that the following holds. Let d ≥ 1, B ≥ 1, C ≥ 1, and let x i , y i , z i for 1 ≤ i ≤ d be complex numbers such that

log + |x i | ≤ B, log + |y i | ≤ B, log + |z i | ≤ C,
for all i.

Let N ≥ 1. Then, given approximations of these complex numbers to precision N , the algorithm computes the polynomials

P = d i=1 (x i X + y i ) Q = d i=1 z i j =i (x j X + y j )
within O M d(N +C +dB) log d binary operations, with a precision loss of O(C + dB) bits.

Proof. We use product trees [BCG + 17, §I.5.4]. For each 0 ≤ m ≤ log 2 (d) , the m-th level of the product tree to compute P consists of 2 log 2 (d) -m products of (at most) 2 m factors of the form x i X + y i . Hence, for every polynomial R appearing at the m-th level, we have

deg(R) ≤ 2 m and log + |R| = O(2 m B).
Level 0 is given as input. In order to compute level m + 1 from level m, we compute one product per vertex, for a total cost of O M d(N + dB binary operations; the precision loss is O(2 m B) bits by proposition 6.1.2. Therefore the total precision loss when computing P is O(dB) bits. The number of levels is O(log d), so the total cost is O M d(N + dB) log d binary operations.

The computations are similar for the polynomial Q, with a different product tree. Each vertex at level m + 1 is a polynomial of the form N 1 P 2 + N 2 P 1 where P i is a vertex of the product tree for P satisfying

deg(P i ) ≤ 2 m and log + |P i | = O(2 m B),
and the polynomials N i come from the m-th level, and satisfy

deg(N i ) ≤ 2 m -1 and log + |N i | = O(C + 2 m B).
By induction, the m-th level can be computed to precision N -O(C +2 m B) using a total of O M d(N + C + dB) binary operations.

We apply lemma 6.1.3 to Lagrange interpolation. Proposition 6.1.4. There exists an algorithm such that the following holds. Let P ∈ Z[X] be an irreducible polynomial of degree d ≥ 1, let (α i ) 1≤i≤d be the roots of P , and let (t i ) 1≤i≤d be complex numbers. Let M, C ≥ 1 such that log + |P | ≤ M, and log + |t i | ≤ C for every i.

Let N ≥ 1. Then, given P and approximations of the α i , t i , and 1/P (α i ) to precision N , the algorithm computes the polynomial Q of degree at most d -1 interpolating the points (α i , t Proof. Denote the complex embeddings of L by µ 1 , . . . , µ d . The polynomial Q = d-1 j=0 λ j X j interpolates the points (µ i (α), µ i (x)) for every 1 ≤ i ≤ d. By assumption, we have for each i

log + |µ i (x)| ≤ H + O(dM ).
We are in the situation of proposition 6.1.4: we can compute an approximation of Q with a precision loss of O(H + dM + d log d) bits. Therefore, for an appropriate choice of the constant C that we do not make explicit, the resulting precision is sufficient to obtain Q exactly by rounding the result to the nearest integers.

Let L be a number field of degree d over Q. We endow Z L with the euclidean metric induced by the map Z L → C d given by the d complex embeddings µ 1 , . . . , µ d of L. Then Z L becomes a lattice of volume ∆ L in the Euclidean space Z L ⊗ Z R. Denote by 1 ≤ λ 1 ≤ • • • ≤ λ d the successive minima of Z L . They satisfy the following inequality [NV09, Chap. 2, Thm. 5]:

d k=1 λ k ≤ α d/2 d ∆ L , where α d ≤ 1 + d 4 denotes Hermite's constant [NV09, Chap. 2, Cor. 3].
There exist several definitions of a reduced Z-basis (a 1 , . . . , a d ) of Z L in the literature, which are usually formulated in terms of the coefficients of the base-change matrix from (a 1 , . . . , a d ) to its Gram-Schmidt orthogonalization. We do not need the precise definitions here, and we only state the following properties:

• If (a 1 , . . . , a d ) is HKZ-reduced [NV09, Chap. 2, Thm. 6], then for each 1 ≤ k ≤ d, we have

4 k + 3 ≤ a k λ k 2 ≤ k + 3 4 .
• If (a 1 , . . . , a d ) is LLL-reduced (with parameter δ = 3 4 ) [NV09, Chap. 2, Thm. 9], then for each 1 ≤ k ≤ d, we have

a k ≤ 2 (d-1)/2 λ k . Moreover, d k=1 a k ≤ 2 d(d-1)/4 ∆ L .
HKZ-reduced bases approximate the successive minima closely, but are difficult to compute as the dimension d grows. On the other hand, LLLreduced bases can be computed in polynomial time in d by the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF]. Proposition 6.1.6. There exist an algorithm and an absolute constant C such that the following holds. Let L be a number field of degree d and discriminant ∆ L . Let (a 1 , . . . , a d ) be an LLL-reduced basis of Z L , let µ 1 , . . . , µ d be the complex embeddings of L, and let m L be the matrix (µ i (a j )) 1≤i,j≤d . Let x ∈ Z L , and let H ≥ 1 such that h(x) ≤ H. Let

N ≥ C(log ∆ L + dH + d 2 ).
Then, given approximations of (µ i (x)) 1≤i≤d and m -1 L to precision N , the algorithm computes x within O d 2 M(H + log ∆ L + d 2 ) binary operations.

Proof. Let λ j ∈ Z such that x = λ j a j . By definition of m L , we have

   λ 1 . . . λ d    = m -1 L    µ 1 (x) . . . µ d (x)    . The determinant of m L is ∆ L , so | det m L | ≥ 1.
In order to bound the absolute values of the coefficients of m -1 L from above, we use Hadamard's lemma. Each coefficient of (det m L )•m -1 L is the determinant of a submatrix of m L , and the L 2 -norms of the columns of m L are precisely the a k for 1 ≤ k ≤ d. Moreover a k ≥ 1 for every k. Therefore,

m -1 L ≤ d k=1 a k ≤ 2 d(d-1)/2 ∆ L ,
and hence

log + m -1 L ≤ log ∆ L + O(d 2 ). Since h(x) ≤ H, we have d i=1 log + |µ i (x)| ≤ dH.
Therefore, for some choice of the constant C that we do not make explicit, we can recover the coefficients λ j ∈ Z exactly. On average, we have log + |µ i (x)| ≤ H, so the cost of each multiplication is on average O M(H + log ∆ L + d 2 ) binary operations. Therefore the total cost of the matrix-vector product is only O d 2 M(H + log ∆ L + d 2 ) binary operations.

If (a 1 , . . . , a d ) is instead assumed to be HKZ-reduced in proposition 6.1.6, then a similar proof shows that one can take

N ≥ C(log ∆ L + dH + d log d) with a cost of O d 2 M(H + log ∆ L + d log d) binary operations. Indeed, in this case we have d k=1 a k ≤ d d d k=1 λ k ≤ d d (1 + d 4 ) d/2 ∆ L , hence log + m -1 L ≤ log(∆ L ) + O(d log d).

Computing theta functions in genus 2

In this section, we present the AGM method to compute τ ∈ H 2 from its theta constants, and Dupont's algorithm to go in the reverse direction. For convenience, we recall the expression (2.10) of theta constants in any genus: for a, b ∈ {0, 1} g and τ ∈ H g , we write

θ a,b (τ ) = m∈Z g exp iπ m + a 2 t τ m + a 2 + m + a 2 t b 2
. (6.1)

The AGM method

We start with the easier case of the AGM method in genus 1. Let F 1 be the classical fundamental domain for the action of SL 2 (Z) on H 1 , and assume that the theta quotients θ 0,1 /θ 0,0 and θ 1,0 /θ 0,0 at τ ∈ F 1 are given. Then the sequence

B(τ ) = θ 2 0,0 (2 n τ ) θ 2 0,0 (τ ) , θ 2 0,1 (2 n τ ) θ 2 0,0 (τ ) n≥0
is an AGM sequence, meaning that each term of B(τ ) is obtained from the previous one by the transformation

(x, y) → x + y 2 , √ x √ y ,
for some choice of the square roots. This is a consequence of the duplication formula [Mum83, p. 221], the correct square roots being the theta quotients themselves. In the algorithm, the sign ambiguity is easily removed using the fact that √ for some α 0 ∈ R. We say that the AGM sequence B(τ ) is given by good sign choices. The sequence B(τ ) converges quadratically to 1/θ 2 0,0 (τ ), as the series expansion (6.1) shows.

It turns out that the sequence B(-1/τ ) is also an AGM sequence with good sign choices [START_REF] Dupont | Fast evaluation of modular functions using Newton iterations and the AGM[END_REF]Prop. 7]. Its first term can be computed from theta quotients at τ using the transformation formulae for theta constants under SL 2 (Z). The limit of B(-1/τ ) is 1/θ 2 0,0 (-1/τ ). Finally, we can recover τ using the formula

θ 2 0,0 -1 τ = -iτ θ 2 0,0 (τ ). (6.2)
Since the convergence of both AGM sequences is quadratic, we obtain an algorithm to invert theta functions on F 1 with quasi-linear complexity in the output precision, at least for fixed τ . This method was already known to Gauss [Gau68, X.1, pp. 184-206], and we recommend [Cox84, §3C] for a historical exposition of Gauss's works on the AGM and elliptic functions.

The analogue of this algorithm in genus 2 is based on a generalization of AGM sequences to more than two elements, called Borchardt sequences [START_REF] Borchardt | Theorie des arithmetisch-geometrisches Mittels aus vier Elementen[END_REF]. Definition 6.2.1. A Borchardt sequence is a sequence of complex numbers (s

(n) b ) b∈(Z/2Z) 2 , n≥0
with the following property: for every n ≥ 0, there exist complex numbers t

(n) b for b ∈ (Z/2Z) 2 such that t (n) b is a square root of s (n) b , and s (n+1) b = 1 4 b 1 +b 2 =b t (n) b 1 t (n) b 2 for each b ∈ (Z/2Z) 2 .
1. For each 0 ≤ k ≤ 3, compute the first term of the Borchardt sequence B(γ k τ )/θ 2 0 (γ k τ ) using the transformation formulae for theta constants under Sp 4 (Z) (see [Igu72, Thm. 2 p. 175 and Cor. p. 176], or proposition 6.2.6 below); 2. For each 0 ≤ k ≤ 3, compute 1/θ 2 0 (γ k τ ) as the limit of the Borchardt sequence B(γ k τ )/θ 2 0 (γ k τ ); 3. Use the input and the newly computed θ 2 0 (γ 0 τ ) = θ 2 0 (τ ) to compute all squares of theta constants at τ ; 4. Recover τ = z 1 z 3 z 3 z 2 using the relations given in [Dup06, §6.3.1]:

θ 2 0 (γ 1 τ ) = -iz 1 θ 2 4 (τ ), θ 2 0 (γ 2 τ ) = -iz 2 θ 2 8 (τ ), θ 2 0 (γ 3 τ ) = -det(τ )θ 2 0 (τ ).
We stress that algorithm 6.2.2 is theoretical: in practice, we need a way of determining the correct sign choices, we handle approximations of all the complex numbers involved, and we have to bound the precision losses incurred in the computations.

The correct sign choices in the AGM algorithm are difficult to describe in general, but as in the genus 1 case, things become easier if we restrict to the fundamental F 2 for the action of Sp 4 (Z) on H 2 , defined as follows. Definition 6.2.3. Let Y = y 1 y 3 y 3 y 2 be a symmetric 2 × 2 real matrix, and assume that Y is positive definite. We say that Y is Minkowski-reduced if

y 1 ≤ y 2 and -0 ≤ 2y 3 ≤ y 1 .
The domain F 2 is defined as the set of all matrices τ ∈ H 2 such that

1. Im(τ ) is Minkowski-reduced. 2. |Re(τ )| ≤ 1/2. 3. |det(γ * τ )| ≥ 1 for every γ ∈ Sp 4 (Z).
It is enough to check the last condition for an explicit finite set S ⊂ Sp 4 (Z) consisting of 19 elements [START_REF] Gottschling | Explizite Bestimmung der Randflächen des Fundamentalbereiches der Modulgruppe zweiten Grades[END_REF], [Dup06, Thm. 6.1]. Recall that for every γ = ( a b c d ) ∈ Sp 4 (Z) and τ ∈ H 2 , we write γ * τ := cτ + d. The original reference [START_REF] Dupont | Moyenne arithmético-géométrique, suites de Borchardt et applications[END_REF] makes the observation that the sign choices in the sequences B(γ k τ ) for 0 ≤ k ≤ 3 are always good when τ belongs to F 2 . This fact is proved in the case of γ 0 = I 4 in [Dup06, Prop. 9.1], efficiently only when τ is close to the cusp at infinity, more precisely when Im z 1 (τ ), Im z 2 (τ ), and det Im(τ ) are large. These conditions are satisfied in the case of the sequence B(γ 0 τ ), whose n-th term consists of theta constants at 2 n τ for every n ≥ 0, but not in the other cases.

To solve this problem, we construct specific symplectic matrices that bring the matrices 2 n γ k τ ∈ H 2 for n ≥ 0 and 1 ≤ k ≤ 3 closer to the cusp at infinity, exactly in the same way as we constructed the matrices η R in the proof of proposition 5.1.10. For every n ≥ 0, we define

η (n) 1 =     0 0 -1 0 0 1 0 0 1 0 2 n 0 0 0 0 1     , η (n) 2 =     1 0 0 0 0 0 0 -1 0 0 1 0 0 1 0 2 n     , η (n) 3 =     0 0 0 -1 0 0 -1 0 0 1 2 n 0 1 0 0 2 n     , and η (n) 4 =     0 0 1 0 0 1 0 0 -1 0 0 0 0 0 0 1     η (n) 3 . Proposition 6.2.5. Let n ≥ 0. 1. For every 1 ≤ k ≤ 4, the matrix η (n) k belongs to Sp 4 (Z).

For every

τ = z 1 z 3 z 3 z 2 ∈ H 2 , we have τ (n) 1 := η (n) 1 (2 n γ 1 τ ) = 2 -n z 1 z 3 z 3 2 n z 2 , τ (n) 2 := η (n) 2 (2 n γ 2 τ ) = 2 n z 1 z 3 z 3 2 -n z 2 , τ (n) 3 := η (n) 3 (2 n γ 3 τ ) = 2 -n τ, and
τ (n) 4 := η (n) 4 (2 n γ 3 τ ) = -2 n /z 1 -z 3 /z 1 -z 3 /z 1 2 -n (z 2 -z 2 3 /z 1 ) . (6.4) Proof. 1. The lines of each η (n) k define a symplectic basis of Z 4 .
2. Recall that the action of Sp 4 (Z) on H 2 extends to an action of the group GSp 4 (Q) + . The matrix 2 n γ k τ is the image of τ under

-2 n I 2 -2 n S k S k -I + S 2 i ∈ GSp 4 (Q) + .
Proof. Apply proposition 6.2.6 to the matrices η

(n) k .
The rest of the proof of theorem 6.2.4 involves technical estimates on the tails of series defining theta constants. The computations are similar to those found in [START_REF] Klingen | Introductory lectures on Siegel modular forms[END_REF], [Dup06, §6.2], [HP17, §5.1]. For instance, in the case of the Borchardt sequence B(γ 0 τ ) for τ ∈ F 2 , we can apply the following result. Proposition 6.2.8. Let τ ∈ H 2 .

1. If r(τ ) ≥ 0.4, then the θ j (τ ) for 0 ≤ j ≤ 3 are in good position.

2. If λ 1 (τ ) ≥ 0.6, then the θ j (τ ) for 0 ≤ j ≤ 3 are in good position.

Proof.

1. Write q = exp(-πr(τ )).

For 0 ≤ j ≤ 3, by (6.1), we have

|θ j (τ ) -1| ≤ 4q 2 + n∈Z 2 , n 2 ≥2 exp(-πλ 1 (τ ) n 2 )
≤ 8q 2 + 4q 4 + 8q 5 + 4q 8 + 4 1 + q (1 -q) 2 q 9 . (6.5) In (6.5), the first term 4q 2 comes from the four vectors n ∈ Z 2 with n = 1. Then we separate the terms n = (n 1 , n 2 ) such that |n 1 | ≥ 3 and |n 2 | ≥ 3; this accounts for the term 4q 9 (1 + q)/(1 -q) 2 , as in the proof of [Dup06, Prop. 6.1]. We leave the remaining terms as they are.

If q ≤ 0.287, then the quantity on the right hand side of (6.5) is less than √ 2/2, and the θ j (τ ) are contained in a disk centered at 1 which is itself contained in a quarter plane. We have q ≤ 0.287 when r(τ ) ≥ 0.4.

Write

q = exp(-πλ 1 (τ )).

Then for 0 ≤ j ≤ 3, we have |θ j (τ ) -1| ≤ 4q + 4q 2 + 4q 4 + 8q 5 + 4q 8 + 4 1 + q (1 -q) 2 q 9 . This quantity is less than √ 2/2 when λ 1 (τ ) ≥ 0.6. Proposition 6.2.8 implies that B(γ 0 τ ) for τ ∈ F 2 contains only good sign choices, since

r(2 n τ ) = 2 n r(τ ) ≥ √ 3/4 ≥ 0.4
for every n ≥ 0.

In the study of B(γ k τ ) for 1 ≤ k ≤ 3, we separate different cases according to the value of n. If n is large enough, then 2 n λ 1 (γ k τ ) ≥ 0.6, and hence proposition 6.2.8 shows that the n + 1st term of B(γ k τ ) is obtained by a Borchardt iteration with good sign choices. The precise rank where this happens depends on τ . Proposition 6.2.9. Let τ ∈ H 2 and γ ∈ Sp 4 (Z). Then

λ 1 (γτ ) ≥ det Im(τ ) 8 |γ| 2 |τ | (2 |τ | + 1) 2 .
Proof. We have

λ 1 (γτ ) ≥ det Im(γτ ) Tr Im(γτ )
.

By [Str10, (5.11) p. 57], we have

Im(γτ ) = (γ * τ ) -t Im(τ )(γ * τ ) -1 , hence det Im(γτ ) = det Im(τ ) |det(γ * τ )| 2 , and
Tr Im(γτ ) ≤ 8 (γ * τ ) -1 2 |Im(τ )| ≤ 8 |γ * τ | 2 |τ | |det(γ * τ )| 2 ≤ 8 |γ| 2 (2 |τ | + 1) 2 |τ | |det(γ * τ )| 2 .
One can give more precise versions of proposition 6.2.9 when τ ∈ F 2 and γ ∈ {γ 1 , γ 2 , γ 3 } [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF]. For instance, we have

r(γ 1 τ ) ≥ 9 y 1 (τ ) 34 |z 1 (τ )| 2
for all τ ∈ F 2 . Hence proposition 6.2.8 applies to 2 n γ 1 τ if 2 n ≥ 1.96y 1 (τ ).

On the other hand, when n is smaller, then the matrix

τ (n) 1 = 2 -n z 1 z 3 z 3 2 n z 2
is close to the cusp at infinity. By corollary 6.2.7, in order to prove that B(γ 1 τ ) contains only good choices of signs, we are led to prove that the theta constants θ j τ

(n) 1

for j ∈ {0, 2, 4, 6} are in good position for τ ∈ F 2 and 2 n ≤ 1.96y 1 (τ ). This is done by careful estimates on the tails of the series (6.1) and on the complex arguments of the sum of the first few terms. We refer to [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF] for a full proof of theorem 6.2.4. Lemma 6.2.12 ([Dup06, §7.2]). Let B = s .

Then the sequences (m n ) and (M n ) are nondecreasing and nonincreasing, respectively.

Note that every Borchardt sequence with good sign choices can be rescaled into a Borchardt sequence to which lemma 6.2.12 applies. Finally, the next lemma shows that once a Borchardt sequence with good sign choices starts to converge, it does so quadratically. Lemma 6.2.13 ([Dup06, Prop. 7.1]). Let B = s (n) b b∈(Z/2Z) 2 ,n≥0 be a Borchardt sequence with good sign choices only, and let s ∞ be its limit. Let 0 < ε < 3/2 -1, and let n 0 ∈ N such that for every b ∈ (Z/2Z) 2 , we have s

(n 0 ) b -s (n 0 ) 0 ≤ ε s (n 0 ) 0 .
Then, for every k ≥ 0, we have

s ∞ -s (n 0 +k) 0 ≤ 5M n 0 7ε 2 2 k
, where M n 0 is defined as in lemma 6.2.12.

We are now ready to bound the precision losses in the AGM method in genus 2. The contribution we make compared to [Dup06, §9.2.3], besides showing that the sign choices are good, is that we make the dependency on τ ∈ F 2 explicit. Proposition 6.2.14. Let τ ∈ F 2 and N ≥ 1. Then, given approximations of squares of theta quotients at τ to precision N , algorithm 6. Proof. By theorem 6.2.4, we obtain the quantities (θ 2 j (2 n γ i τ )/θ 2 0 (γ i τ )) 0≤j≤3

after n Borchardt steps with good sign choices. By proposition 6.2.9, we know that log λ 1 (γ i τ ) = O(log |τ |).

Therefore, there exists n 0 = O(log |τ |) such that λ 1 (2 n 0 γ i τ ) ≥ 10, for instance. Even if |τ | is not known explicitly, this moment can be detected during the algorithm: the four values in the Borchardt sequence become close to each other, so that lemma 6.2.13 applies.

Let us estimate the precision losses in these n 0 steps. Let B = s

(n) b
be one of the four Borchardt sequences that we consider. By lemma 6.2.11, after scaling by a complex number of modulus one, we may assume that the absolute values of the arguments of the s

Dupont's algorithm for theta constants

Dupont's thesis [START_REF] Dupont | Moyenne arithmético-géométrique, suites de Borchardt et applications[END_REF] builds a Newton scheme around the AGM method in order to compute theta constants in quasi-linear time. In genus 1, this method yields a provably correct algorithm [START_REF] Dupont | Fast evaluation of modular functions using Newton iterations and the AGM[END_REF]. In genus 2, the convergence of Dupont's algorithm remains heuristic, even using the provably correct AGM algorithm presented in §6.2.3. In this section, we briefly present Dupont's method, we explain the remaining challenges to obtain a provably correct algorithm, and we state hypothesis 6.2.15 according to which Dupont's algorithm converges uniformly on a compact set. This assumption is fundamental in the complexity estimates for the evaluation of modular equations for abelian surfaces.

In genus 1, the algorithm is formulated in terms of the function k (τ ) := θ 0,1 (τ ) θ 0,0 (τ )

2

, for τ ∈ H 1 .

For each z ∈ C with positive real part, we define M 1 (z) as the limit of the AGM sequence with good sign choices whose first term is {1, z}. Define F 1 ⊂ H 1 as in [Dup11, Prop. 7]:

F 1 = {τ ∈ H 1 : |Re τ | < 1, |2τ + 1| > 1, |2τ -1| > 1} .
Note that F 1 contains the fundamental domain F 1 . Then k is a surjective analytic map from F 1 to {z ∈ C : Re(z) > 0} whose derivative does not vanish. Moreover, the equality

M 1 (k (τ )) = 1 θ 2 0,0 (τ )
holds for all τ ∈ F 1 . By the inverse function theorem, the function M 1 is also analytic. The Newton scheme to compute k (τ ) from τ ∈ F 1 uses the fact that the function f τ (z) := iM 1 (z) -τ M 1 ( √ 1 -z 2 ) vanishes at k (τ ); this equality comes from eq. (6.2), the expression of theta constants at -1/τ ∈ F 1 , and the Jacobi identity θ 4 0,0 = θ 4 0,1 + θ 4 1,0 [Dup11, §5.1]. The linearization step in the Newton scheme is based on the equality df τ dz (k (τ )) = -2M 1 (k (τ )) 3 πτ k (τ )(1 -k (τ ) 2 ) . (6.6)

If k (τ ) is currently computed to precision N , then the derivative of f τ at k (τ ) can also be computed to precision roughly N , and this allows in turn to compute a better approximation of k (τ ) to precision roughly 2N . The computations are made precise in [Dup11, §5.2, §6.1, and §6.2]. Before starting the Newton iterations, k (τ ) is computed at low precision using the series expansions of theta constants (the so-called "naive method", which is not quasi-linear in the required precision). The precision losses in each Newton iteration and the initial precision necessary depend on τ , and grow quickly as Im τ → +∞. However, when τ belongs to a compact set of F 1 , these precision losses can be bounded uniformly. When Im(τ ) is large, one can compute theta constants at τ /2 n for some appropriate n and perform n AGM steps to recover theta constants at τ . In this way, we obtain an algorithm to evaluate k (τ ) at precion N ≥ 1 using O(M(N ) log N ) operations, uniformly in τ ∈ F 1 [Dup11, Thm. 5].

The only remaining issue is that in order to implement a provably correct version of Dupont's algorithm in genus 1, one needs explicit upper bounds on the precision losses in a given compact subset of F 1 . No such bound is given in [START_REF] Dupont | Fast evaluation of modular functions using Newton iterations and the AGM[END_REF], or in subsequent works to our knowledge [START_REF] Labrande | Computing Jacobi's θ in quasi-linear time[END_REF][START_REF] Labrande | Computing theta functions in quasi-linear time in genus 2 and above[END_REF]. In practice, a common heuristic strategy is to take an arbitrary error margin; if the Newton iterations do converge in an experimental sense, then one accepts the end value as an approximation of the true result.

In genus 2, Dupont's algorithm to compute theta constants follows an analogous strategy. Given τ ∈ F 2 , we want to compute the theta quotients b j (τ ) := θ j (τ ) 2 /θ 0 (τ ) 2 for j ∈ {1, 2, 3}; this is sufficient, because 1. the duplication formulae express all squares of theta constants at 2τ in terms of these quantities;

2. the theta constants θ j (τ ) 2 themselves can be computed from this data using one further Borchardt mean.

By theorem 6.2.4, computing an approximation of τ ∈ F 2 from the b j (τ ) for 1 ≤ j ≤ 3 can be done using four Borchardt means with good sign choices. This yields, as in the genus 1 case, a function In order to build a Newton scheme to compute τ from its theta quotients, one relies on the following heuristic assumption, which holds in practice [Dup06, §10.2]: the Jacobian matrix of F τ at (b 1 (τ ), b 2 (τ ), b 3 (τ )) is invertible, and can be suitably approximated using finite differences on the function F τ . This yields a heuristic algorithm to compute theta constants at precision N ≥ 1 in O τ (M(N ) log N ) binary operations, for a fixed τ ∈ F 2 . As a by-product, the algorithm computes the Jacobian matrix of F τ at high precision; equivalently, we also recover the values of derivatives of theta constants at τ at precision roughly N/2 for no additional cost.

For our application to the evaluation of modular equations for abelian surfaces, we need to assume more on the behavior of this algorithm, namely that the Newton iterations converge uniformly on a compact subset of F 2 .

1. If D 1 (τ ) ∈ F 2 , then the tuple of theta constants (θ 2 j (τ )) j∈{0,1,2,3} is obtained from the tuple of theta constants θ 2 j (D 1 (τ )) j∈{0,1,2,3} by a Borchardt iteration with good choice of roots.

2. If D 2 (τ ) satisfies (6.3), except that the real part of z 1 (D 2 (τ )) is allowed to be smaller than 1 instead of 1/2, then (θ 2 j (τ )) j∈{0,2,4,6} is obtained from θ 2 j (D 2 (τ )) j∈{0,2,4,6} by a Borchardt iteration with good choice of roots.

Proof. The first item is the classical duplication formula: the choice of roots is given by the theta constants θ j (D 1 (τ )) for 0 ≤ j ≤ 3, and they are in good position by lemma 6.2.10. For the second item, apply the theta transformation formula (proposition 6.2.6) to the symplectic matrix     0 0 -1 0 0 1 0 0 1 0 0 0 0 0 0 1

    .
The theta constants θ j (D 2 (τ )) for j ∈ {0, 2, 4, 6} also are in good position by the proof of [Kie21, Lem. 5.2]. Proposition 6.2.17 (Under hypothesis 6.2.15). There exists an algorithm which, given τ ∈ F 2 to precision N ≥ 1, computes the squares and derivatives of theta constants at τ in O(M(N ) log N ) binary operations with a precision loss of O(1) bits, uniformly in τ .

Proof. Since derivatives of theta constants are uniformly bounded on F 2 , the difference between theta constants at τ and theta constants at the center of the complex ball approximating τ is O(2 -N ). Therefore we may assume that τ is given at arbitrarily high precision.

First, we let k 2 be the smallest integer such that

2 k 2 y 1 (τ ) ≥ min{CN, 2 -k 2 -2 y 2 (τ )}
where C is an absolute constant. Let τ be the matrix obtained after applying k 2 times D 2 to τ and reducing the real part at each step. In order to compute theta constants at τ to precision N , we compute theta constants at τ to some precision N ≥ N , then apply k 2 times the duplication formula from lemma 6.2.16. We have k 2 = O(log N ), and the total precision loss when extracting square roots is O(N ) bits, hence the total precision loss is O(N ) bits. We can take N = C N where C is an absolute constant. by (6.7). Therefore we also have Λ(τ ) = O(Λ(τ )). The remaining bounds follow from lemma 6.2.21.

We are now ready to prove the correctness and running time of algorithm 6.2.19. Proposition 6.2.23. There is an absolute constant C such that the following holds. Let τ ∈ H 2 and ε > 0. Then, given an approximation of τ to precision N ≥ C(Λ(τ ) + |log ε|) as input, algorithm 6.2.19 does not run out of precision, and computes a matrix γ ∈ Sp 4 (Z) such that γτ ∈ F ε 2 and log |γ| = O(Λ(τ )). It costs O(M(N )N log N ) binary operations.

Proof. By lemma 6.2.22, there exists an absolute constant C such that log |γ| ≤ C Λ(τ ) during the execution of algorithm 6.2.19 as long as the absolute precision remains at least |log ε| + 1. Therefore, if C is chosen appropriately, step 4 in algorithm 6.2.19 ensures that the absolute precision is at least |log ε| + 1 at every step. Hence the estimate on log |γ| and Λ(τ ) remains valid until the end of the algorithm, and we can perform the approximate Minkowski reductions using lemma 6.2.20.

By lemma 6.2.22, there are O(Λ(τ )) steps in algorithm 6.2.19, and by lemma 6.2.20, each step costs O(M(N ) log N ) binary operations. Hence the cost is overall O(M(N )N log N ) binary operations. When the algorithm stops, the absolute precision is still greater than |log ε| + 1, hence the final τ belongs to F ε 2 . Given τ ∈ F ε 2 , we can increase the imaginary parts of the coefficients slightly to obtain τ ∈ F 2 such that |τ -τ | ≤ Cε |τ | for some absolute constant C. Theta constants at τ can be computed in quasi-linear time in the precision by proposition 6.2.17; they approximate the value of theta constants at τ . Corollary 6.2.24 (Under hypothesis 6.2.15). There exist an algorithm and an absolute constant C such that the following holds. Let τ ∈ H 2 and N ≥ 1. Then, given an approximation of τ to precision N + CΛ(τ ), the algorithm computes Proof. Fix ε = 0.01, for instance. First, we apply proposition 6.2.23 to compute γ ∈ Sp 4 (Z) such that γτ ∈ F ε 2 , using O M(Λ(τ ))Λ(τ ) log Λ(τ ) binary operations. Then, we recompute τ := γτ to high precision, and reduce it further if necessary to land in F ε 2 where ε = 2 -N exp(-CΛ(τ )) for some appropriate constant C. This costs O(M(N + Λ(τ ))) binary operations. Finally we compute τ which satisfies conditions (6.3) and is close to τ ; the matrix τ is still an approximation of γτ , with O(Λ(τ )) bits of precision lost. We output theta constants at τ to precision N + O(1), which can be computed in time O(M(N ) log N ) by proposition 6.2.17.

Evaluating Hilbert modular equations

Let F be a real quadraic field. In this final section, we detail a heuristic algorithm to evaluate Hilbert modular equations of level β and their derivatives, where β ∈ Z F is a totally positive prime of norm , given Igusa invariants (j 1 , j 2 , j 3 ) in a number field L lying on the Humbert surface. We let R ∈ GL 2 (R) be the matrix chosen as in §2.3.4, defining the Hilbert embedding H R : H 2 1 → H 2 . The algorithm can be adapted to the case of Hilbert modular equations in Gundlach invariants for F = Q( √ 5), and the case of Siegel modular equations. In both of these cases, using complete denominators for modular equations as in §5.1.4 allows us to design an algorithm with provably correct output.

Outline of the algorithm

A high-level view on the algorithm was already given at the beginning of chapter 6. In every complex embedding µ of L, we compute a period matrix τ 0 ∈ F 2 with Igusa invariants (µ(j 1 ), µ(j 2 ), µ(j 3 )), and invert the Hilbert embedding to find τ ∈ H 2 1 such that H R (τ ) is Sp 4 (Z)-equivalent to τ 0 . Then we evaluate the Hilbert modular equations at τ using the analytic formula given by definition 2.4.6. By the expression of Igusa invariants in terms of theta constants given in §2.3.2, this can be done by computing theta constants at all the matrices H R ( 1 β ητ ) ∈ H 2 , where η runs through the set C σ β defined in §5.1.4. Similarly, the derivatives of modular equations at (µ(j 1 ), µ(j 2 ), µ(j 3 )) can be obtained from derivatives of theta constants at the matrices H R ( 1 β ητ ). Finally, we try to recognize the results as elements of the number field L.

The necessary precision to perform this algebraic reconstruction is controlled by the height of the modular equations evaluated at (j 1 , j 2 , j 3 ), which is O F log + h(j 1 , j 2 , j 3 ) by the results of chapter 5. However, we have no general formula for the implied constant in terms of the discriminant of F . Therefore the algebraic reconstruction step can only be heuristic in general. In practice, one could work at a high enough precision N so that an algebraic reconstruction succeeds, and check that the result remains identical when the computations are done at precision 2N .

The situation improves if we can build a complete denominator for the modular equations, as we did in §5.1.4 in the case of Siegel modular equations, and Hilbert modular equations in Gundlach invariants for F = Q( √ 5). In this case, we separately evaluate numerators and denominators of the modular equations using analytic formulae. Then we only have to recognize algebraic integers from their images under the complex embeddings of L, and we can apply the methods of §6.1.3 to obtain a provably correct output.

Assume, for instance, that we want to evaluate Hilbert modular equations of level β for F = Q( √ 5) at a given pair of Gundlach invariants (g 1 , g 2 ) ∈ L. We compute a point τ ∈ H 2 1 realizing these Gundlach invariants by inverting the Hilbert embedding as above. By eq. (5.3), the denominator D β (τ ) has the analytic expression Recall that for every τ = (τ 1 , τ 2 ) ∈ H 2 1 , for every η = ( a b c d ) ∈ C β , and for every λ ∈ F , we write λτ = (λτ 1 , λτ 2 ) and η * τ = (cτ 1 + d)(cτ 2 + d), (ησ) * τ = η * (τ 2 , τ 1 ) .

By definition of the Hilbert modular equations, we also have the formulae: D β (t)Ψ β,1 µ(g 1 ), µ(g 2 ), Y = D β (t) (6.9) By proposition 5.1.13, these quantities (6.8) and (6.9) are the values, in each complex embedding µ of L, of certain elements D ∈ Z[g 1 , g 2 ], and P 1 , P 2 ∈ Z[g 1 , g 2 , Y ].

η∈C σ β Y -g 1 ( 1 β ηt) = 2 w β G 2 (t)
If g 1 and g 2 are integers in L, then D, P 1 and P 2 are elements of Z L as well. In the general case, let c ∈ L be such that both cg 1 and cg 2 are integers; then, by proposition 5.1.17, it is sufficient to multiply D, P 1 , and P 2 by c 10( +1)/3 to obtain algebraic integers. Finally, we output Ψ β,1 (g 1 , g 2 , Y ) = P 1 /D and Ψ β,2 (g 1 , g 2 , Y ) = P 2 /D.

The same idea of using D β to obtain algebraic integers works for derivatives of modular equations too. The proof of correctness follows two steps.

1. In the first step, we assume that we are given approximations of the values µ(j k ) for 1 ≤ k ≤ 3 in a fixed complex embedding µ of L. We analyze the cost and precision losses in the various steps of the algorithm: computing τ 0 ( §6.3.2), inverting the Hilbert embedding ( §6.3.3), reducing the matrices H R ( 1 β ητ ) to the fundamental domain F 2 , computing theta constants, and evaluating modular equations analytically ( §6.3.4). Towards the end, we restrict to the formulae (6.8) and (6.9) for the sake of brevity; otherwise, the computations apply to all cases of modular equations in Igusa invariants discussed above. the µ(j k ) for 1 ≤ k ≤ 3, hence the estimates on the running time and precision losses follow from proposition 6.1.2.

We prove that any period matrix τ ∈ F 2 of C is bounded in terms of B Θ,µ for some Θ. This is done by looking at theta quotients at τ . Lemma 6.3.2. There exists a finite recipe of algebraic extensions Θ such that the following holds. Let C be as in proposition 6.3.1, and let τ ∈ F 2 be a period matrix of C. Then we have

|τ | = O(B Θ,µ ).
Proof. By Thomae's formulae [Mum84, Thm. IIIa.8.1], the theta quotients θ j (τ )/θ 0 (τ ) for j ∈ 1, 15 are algebraic numbers constructed from the coefficients of C, and are nonzero for j ∈ {0, 1, 2, 3, 4, 6, 8, 12}. Therefore, we can choose Θ in such a way that log |θ j (τ )/θ 0 (τ )| ≤ B Θ,µ for j ∈ {4, 8}.

Write τ = ( z 1 z 3 z 3 z 2 ). By lemma 6.2.10, the real numbers Im(z 1 ) and Im(z 2 ) are in O(B Θ,µ ) as well, hence also |Im(z 3 )| because det Im(τ ) > 0. Since |Re(τ )| ≤ 1/2, the result follows. Proposition 6.3.3 (Under hypothesis 6.2.15). There exist an algorithm and a finite recipe of algebraic extensions Θ such that the following holds. Let L be a number field, let j 1 , j 2 , j 3 ∈ L be such that j 3 = 0, let µ be a complex embedding of L, and define B Θ,µ as above. Let N ≥ 1. Then, given approximations of µ(j k ) for 1 ≤ k ≤ 3 to precision N , the algorithm computes a matrix τ ∈ F 2 such that the Igusa invariants at τ are the µ(j k ) for 1 ≤ k ≤ 3. The algorithm involves O M(N + B Θ,µ ) log(N + B Θ,µ ) binary operations, and a precision loss of O(log N + B Θ,µ log B Θ,µ ) bits.

Proof. First, we compute a complex curve C as in proposition 6.3.1. Then, by Thomae's formulae, there is a finite number of possibilities for the values of squares of theta quotients at τ ; one of them corresponds to an actual matrix τ ∈ F 2 , and the others correspond to other elements in the orbit Sp 4 (Z)τ . When we run the algorithm of proposition 6.2.14 on these inputs, we may discard all resulting period matrices that do not belong to F 2 . In order to distinguish between the remaining possible values of τ , it is usually enough to compute theta constants to precision O(1) using the naive algorithm, and match with the input. In extreme cases, we may resort to computing Igusa invariants at all remaining possible values of τ to precision O(N + B µ ), using O M(N + B µ ) log(N + B µ ) binary operations, by proposition 6.2.17; this is where we use hypothesis 6.2.15.

Inverting the Hilbert embedding

Let F be a real quadratic field, and let R ∈ GL 2 (R) be a matrix defining a Hilbert embedding H R , as in §2.3.3. Recall that for every τ ∈ H 2 , we denote by 0 < λ 1 (τ ) ≤ λ 2 (τ ) the two eigenvalues of Im(τ ). Lemma 6.3.4. Let F and R be as above. Then there exists a constant C > 0 depending on F and R such that for every τ = (τ 1 , τ 2 ) ∈ H 2 1 , we have

1 C λ 1 (H R (τ )) ≤ min{Im(τ 1 ), Im(τ 2 )} ≤ Cλ 1 (H R (τ )), 1 C λ 2 (H R (τ )) ≤ max{Im(τ 1 ), Im(τ 2 )} ≤ Cλ 2 (H R (τ )).
Proof. Use the definition (2.12) of the Hilbert embedding. Proposition 6.3.5. Let F be a real quadratic field, and let R be as above. Then there exist an algorithm, a constant C > 0, and a finite recipe of algebraic extensions Θ depending on F and R such that the following holds. Let L be a number field, let j 1 , j 2 , j 3 ∈ L be such that j 3 = 0, let µ be a complex embedding of L, and define B Θ,µ as in §6.3.2. Let C be a genus 2 hyperelliptic curve over C with Igusa invariants µ(j 1 ), µ(j 2 ), µ(j 3 ), and assume that Jac(C) has real multiplication by Z F . Let τ 0 ∈ F 2 be a period matrix of C. Then there exists τ = (τ 1 , τ 2 ) ∈ H 2 1 such that H R (τ ) ∈ H 2 is a period matrix of C, and |log(Im τ i )| ≤ CB Θ,µ for i = 1, 2.

Moreover, given an approximation of τ 0 to precision N + CB Θ,µ , the algorithm computes τ to precision N within O F M(N + B Θ,µ ) log B Θ,µ binary operations.

Proof. By lemma 6.3.2, if Θ is well chosen, we have

|τ 0 | = O(B Θ,µ ).
The result would be obvious from lemma 6.3.4 if there existed τ ∈ H 2 1 such that τ 0 = H R (τ ), but this is not always the case. In general, by [START_REF] Birkenhake | Humbert surfaces and the Kummer plane[END_REF]Lem. 4.1], there exist coprime integers a, b, c, d, and e such that b 2 -4ac -4de = ∆ and az 1 (τ 0 ) + bz 3 (τ 0 ) + cz 2 (τ 0 ) + d det(τ 0 ) + e = 0, (6.10) where ∆ denotes the discriminant of F . Finding the integers a, b, c, d, e will allow us to construct a conjugate of τ 0 under Sp 4 (Z) which admits a preimage under H R .

We claim that the heights of a, b, c, d, e are in O F (B Θ,µ ) for some choice of Θ. We prove this by comparing the analytic and rational representations (see [BL04, §1.2]) of the endomorphism √ ∆ on the complex abelian variety

A(τ 0 ) = C 2 /(Z 2 ⊕ τ 0 Z 2 ).
The rational representation of every endomorphism f in the image of Z F inside End(A(τ 0 )) † is of the form For every f ∈ End(A(τ 0 )), the rational and analytic representations of f are related by the following formula [BL04, Rem. 8.14]:

ρ A,τ 0 (f ) (τ 0 I 2 ) = (τ 0 I 2 ) ρ R,τ 0 (f ).

Taking imaginary parts, we find that there exist m, n ∈ Z such that the LLL algorithm [START_REF] Novocin | An LLL-reduction algorithm with quasi-linear time complexity[END_REF][START_REF] Neumaier | Faster LLL-type reduction of lattice bases[END_REF]. Another possibility to improve the complexities in propositions 6.3.7 and 6.3.9 would be to try to adapt the reduction algorithm for the matrices H R ( 1 β ητ ) ∈ H 2 for η ∈ C σ β , using the known matrix γ ∈ Sp 4 (Z) such that γH R (τ ) ∈ F 2 .

Chapter 7

Elkies's method for abelian surfaces

The previous chapters presented several results and algorithms about higher-dimensional modular equations, and in particular modular equations of Siegel and Hilbert type in dimension 2. We know how to use them to compute isogenies between abelian surfaces (chapter 3), we can bound their degrees and heights (chapter 5), and finally we have efficient algorithms to evaluate them (chapter 6). Thus, all the necessary ingredients to generalize Elkies's method to principally polarized abelian surfaces are gathered. This short chapter details the resulting algorithm, building upon previous works on Schoof's and Atkin's methods for abelian surfaces [GH00, GS12, GKS11, BGLG + 16]. In particular, we obtain a heuristic point-counting algorithm for principally polarized abelian surfaces with real multiplication by a fixed quadratic field F which, up to constants depending on F , has the same asymptotic complexity as the SEA algorithm for elliptic curves.

The characteristic polynomial of Frobenius

Let p be a large prime, let q be a power of p, and let A be a principally polarized abelian surface over F q . Let π A be the Frobenius endomorphism of A, and let χ A ∈ Z[X] be its characteristic polynomial. Let = p be a prime. Then χ A is the characteristic polynomial of π A as an endomorphism of the -adic Tate module T (A). In particular, χ A mod is the characteristic polynomial of π A as an endomorphism of A[ ] (Z/ Z) 4 .

Our goal, as in Elkies's method for elliptic curves ( §1.2.2), is to compute χ A mod using subgroups of A[ ] obtained as kernels of isogenies instead of endomorphisms, in order to reduce the degrees of the polynomi-Proof. In case 1, we write a = P (π A ) and a = P (π A ) as endomorphisms of A[ ]. Then we have a decomposition of A[ ] as ker a ⊕ ker a, both subspaces being of dimension 2. Let us show that ker a is isotropic. By (7.1), a is the adjoint of a; hence ker a, ker a = Im a, Im a = A[ ], Im(a a) = 0.

In case 2, if v is an eigenvector of π A , then v ⊥ is still π A -stable, hence there exists w ∈ v ⊥ such that v ⊕ w is a π A -stable subspace of dimension 2.

The splitting of χ A modulo also determines the number of maximally isotropic subspaces. For instance, if χ A is totally split over F , and if the eigenvalues satisfy the non-equalities r 1 = r 2 , λ 1 = q/λ 1 and λ 2 = q/λ 2 , then there are exactly four of them inside A[ ].

To summarize, if is an Elkies prime, then we can recover χ A mod by computing the characteristic polynomial of π A on the kernel of oneisogeny, by proposition 7.2.1. Heuristically, we expect that about half of the primes will be Elkies given the characterization of proposition 7.2.2, so that it is sufficient to consider Elkies primes = O(log q) to complete the point counting algorithm.

The Hilbert case

In the Hilbert case, the subgroup A[ ] decomposes as the orthogonal direct sum A[β]⊕A[β], and both subspaces are stable under π A and π † A . Since A[β] and A[β] are not isotropic, the determinant of π A on both of these subspaces is q. Hence we have a decomposition of χ A mod as χ A = (X 2 -t β X + q)(X 2 -t β X + q) where t β and t β are the traces of π A on A[β] and A[β] respectively.

We say that β (resp. β) is Elkies if π A admits an eigenvector on A[β] (resp. on A[β]). Equivalently, β is Elkies if there exists a β-isogeny ϕ with domain A defined over F q . In this case, knowing the eigenvalue of π A on ker ϕ is sufficient to reconstruct t β .

However, β and β may not be simultaneously Elkies, hence reconstructing χ A mod is not always possible. Instead, we observe that ξ A ∈ Z F and Z F /βZ F Z/ Z; in this identification, we have t β = ξ A mod β. Instead of using the Chinese remainder theorem to recover the coefficients of χ A as integers, we recover ξ A as an element of Z F . 1. Evaluate the modular equations and their derivatives at A using the algorithms of chapter 6, assuming that hypothesis 6.2.15 holds; this costs O( 5 log 2 p) binary operations in the Siegel case, and O F ( log 2 p) binary operations in the Hilbert case. If the Igusa invariants of A can be written as quotients of integers of height O(1), then the cost of evaluating modular equations drops to O( 6 ) and O F ( 2 ) binary operations respectively.

In the Hilbert case, the rational reconstruction step is heuristic, unless one computes an explicit complete denominator for modular equations, as we did in the case of Gundlach invariants for F = Q( √ 5) ( §5.1.4). It is advisable to use modular equations in nonsymmetric invariants if possible, since they have smaller degrees and allow us to distinguish between β and β-isogenies. At the end, we have computed a point P of C, possibly over an extension of F p , and the rational representation of the isogeny ϕ at the base point P in the sense of §3.4.1. Denote this rational representation by ϕ P : C → C <2> . Following the proof of [Sch95, Prop. 6.1], [BGLG + 16, Prop. 3], one can show that the kernel of ϕ will be defined over F p in generic cases.

It remains to explain how to compute the characteristic polynomial of π A on ker ϕ using ϕ P as input. For simplicity, assume that P is a Weierstrass point of C, and that all the points of A[ ]\{0} can be written in the form [Q 1 + Q 2 -K] where Q 1 , Q 2 are distinct points of C and K denotes the canonical divisor of C. Then such a point lies in ker ϕ if and only if ϕ P (Q 1 ) = -ϕ P (Q 2 ) in Jac(C ).

From this characterization, one derives an ideal of polynomial equations describing the points of ker(ϕ)\{0} in C <2> . In order to compute with the formal point of ker(ϕ)\{0}, we compute a Gröbner basis of this ideal. Asymptotically, the most costly step in this procedure is to compute the resultant of certain bivariate polynomials of degree O(d) over The final step is to compute the characteristic polynomial of π A on ker ϕ. In the Siegel case, where we have to determine two elements of Z/ Z, we perform O( 2 + log p) multiplications modulo polynomials of degree O(d 2 ), for a total cost of O ( 2 + log p) 2 log p binary operations. In the Hilbert case, we only determine one element in Z/ Z, therefore the total cost is only O F ( log 2 p) binary operations.

We conclude by summing the complexities of all the steps in the point counting algorithm, and multiplying by the number O(log p) of auxiliary primes to consider:

Result. We obtain an algorithm which, given a large prime p and given a principally polarized abelian surface A = Jac(C) over F p without extra automorphisms, computes χ A ∈ Z[X]. In the generic case, its heuristic cost is O(log 8 p) binary operations, or O(log 7 p) binary operations if the Igusa invariants of A are quotients of integers of height O(1). If A has real multiplication by Z F where F is a fixed real quadratic field, its heuristic cost is O F (log 4 p) binary operations.

In the Siegel case, the complexity of Schoof's method is already O(log 8 p) binary operations. It can be further decreased using recent algorithms for the computation of bivariate resultants [START_REF] Villard | On computing the resultant of generic bivariate polynomials[END_REF], although the practical effects of this improvement are not demonstrated. Therefore, Elkies's method is (heuristically) asymptotically faster only when A has small invariants. In the Hilbert case, the heuristic complexity of Elkies's method improves on Schoof's method: up to constant factors depending on F , we reach the same asymptotic complexity as the SEA algorithm for elliptic curves.

• In order to evaluate modular equations over a finite field F q , lifting to a number field as in proposition 6.3.7 is not the most natural thing to do. It is interesting to ask if there exists an algorithm to evaluate modular equations in quasi-linear time over unramified extensions of Q p , using canonical lifts of abelian surfaces.

• When constructing complete denominators of modular equations, the structure of the corresponding rings of modular forms over Z plays a central role. This raises the question of finding an algorithm to compute the ring of Hilbert modular forms over Z for Q( √ ∆), when ∆ varies. The result for ∆ = 29 and ∆ = 37 has recently been computed [START_REF] Williams | The rings of Hilbert modular forms for Q( √ 29) and Q( √ 37)[END_REF]. It would also be interesting to compute rings of Hilbert modular forms over Z for totally real cubic fields.

• Finally, beyond abelian surfaces, it would be interesting to extend Elkies's method for point counting to the case of principally polarized abelian threefolds with real multiplication over finite fields. We should obtain strong asymptotic improvements over Schoof's algorithm in this case. A first step in this direction would be to generalize the isogeny algorithm of chapter 3 to Jacobians of quartic curves, using the newly found correspondance between Siegel modular forms in dimension 3 and concomitants of ternary quartics [START_REF] Cléry | Concomitants of ternary quartics and vector-valued Siegel and Teichmüller modular forms of genus three[END_REF].

  2. S contient au moinsD/η éléments. 3. D ≥ max {ηd 3 H, 4ηdd L }. Alors h(F ) ≤ H + C L ηd log(ηdH) + d log(2M ) + log(d + 1)où C L désigne une constante qui dépend uniquement du corps de nombres L. On peut prendre C Q = 960.

  a b c d ) ∈ Γ(1) and τ ∈ H 1 , then γτ = aτ + b cτ + d . (1.1)

  positive involution on B is an "anti-involution" * : B → B (i.e. b * * = b and (bb ) * = b * b * for all b, b ∈ B) such that the bilinear form (b, b ) → Tr B/Q (bb * ) is symmetric and positive definite. If A is simple (i.e. A is not isogenous to products of abelian varieties of smaller dimensions), then End 0 (A) is a division algebra [Mum70, §19, Cor. 2]. Further restrictions on End 0 (A) are given in [Mum70, §21, Thm. 2].

  larized abelian varieties of dimension g over C. This modular interpretation coincides with the classical one [BL04, §8.1]. More generally, choose positive integers D 1 | • • • |D g such that D 1 = 1, and let Λ ⊂ V (Q) be the lattice generated by the vectors e 1 , . . . , e g , D 1 e g+1 , . . . , D g e 2g ,

  d} is a syzygous triple, we write b = (b 1 , b 2 , b 3 , b 4 ) and similarly for c, d; then we define ε(b, c, d) ∈ {±1} as -1 to the power

  denote by S c the connected component of Sh K (C) indexed by c, and consider the lattice with PEL structure (Λ c , x, ι, ψ c , cK) associated with a point [x, c] ∈ S c by proposition 2.2.8.

  Lemma 3.2.1. Let C be a genus 2 hyperelliptic equation over C, and let r = ( a b c d ) ∈ GL 2 (C). Let E C be the image of E C by det -2 Sym 6 (r), and let C be the genus 2 hyperelliptic curve defined by the equation y 2 = E C (x ). Let η : C → C be the isomorphism defined by η(x , y ) = ax + c bx + d , (det r) y (bx + d) 3 .Then the matrix of η * : Ω 1 (C) → Ω 1 (C ) in the bases ω(C) and ω(C ) is r.Proof. Write (x, y) = η(x , y ). Then direct calculation shows that

Proposition 3.2. 5 .

 5 The function τ → C(τ ) is a Siegel modular function of weight det -2 Sym 6 which has no poles on the open set V = {χ 10 = 0} ⊂ H 2 .Proof. Let Z be the set of isomorphism classes of pairs (Jac(C), ω) where C is a genus 2 hyperelliptic curve over C and ω is a basis of Ω 1 (C). By proposition 3.2.3, Z is the quotient of V × GL 2 (C) by the action of Sp 4 (Z) given by γ • (τ, r) = γτ, (γ * τ ) t r , and thus inherits a natural complex structure. Let U ⊂ C 6 [x] be the open set consisting of polynomials with simple roots. Then the Torelli map from U to Z sending C to (Jac(C), ω(C)), which is bijective by proposition 3.2.2, is actually biholomorphic. The map V → Z sending τ to (τ, I 2 ) is holomorphic, therefore τ → C(τ ) is holomorphic on V. Combining proposition 3.2.3 and lemma 3.2.1 shows the transformation rule.

  Proposition 3.3.4. If ϕ is generic in the sense of definition 3.3.3, then we have Sym 2 (dϕ) = D(ϕ).

  Proposition 3.3.8. Let (A, ι, ω) be a Hilbert-normalized abelian surface. Then ∂j (F ) (A, ι, ω) = ∂j(A, ω) • T where T =

  [[z]]. Still, we can adapt the generic divide-and-conquer algorithm from [BCG + 17, §13.2].Lemma 3.4.6. The determinant det M (z) =x

  4.3. By lemma 3.4.6, we can find a matrix I ∈ Mat 2×2 (k [[z]]) such that IM = ( z 0 0 z ). Lemma 3.4.7. Let κ ≥ 1, and assume that char k > κ + 1. Let A = IN . Then the matrix A + κ has an invertible constant term.

  Proposition 3.4.8. Let 1 ≤ m ≤ 2n -1, and assume that char k > m. Then we can solve (3.14) and compute δx 1 and δx 2 up to precision O(z m ) using O(m) operations in k . Proof. Write θ = δx 1 δx 2 . Multiplying (3.14) by I, we obtain the equation zθ + (A + κ)θ = B + O(z d ), where d = 2n -1 and κ = 0.

  1. a tower k /k of at most three quadratic extensions, 2. hyperelliptic curve equations C and C over k whose Jacobians are isomorphic to A and A respectively, 3. a point P ∈ C(k ), 4. the rational representation (s, p, q, r) ∈ k (u, v) 4 of an -isogeny ϕ : Jac(C) → Jac(C ) at P . The cost of algorithm 3.5.1 in the Siegel case is O (C eval ( )) + O( ) elementary operations and O(1) square roots in k . Proof. Mestre's algorithm returns curve equations C and C defined over extensions of k of degree at most 2, and costs O(1) operations in k and O(1)

  5.1 succeeds and returns 1. a tower k /k of at most three quadratic extensions, 2. hyperelliptic curve equations C and C over k whose Jacobians are isomorphic to A and A respectively, 3. a point P ∈ C(k ), 4. at most 4 possible candidates for the rational representation (s, p, q, r) ∈ k (u, v) 4 of a β-or β-isogeny ϕ : Jac(C) → Jac(C ) at P . The cost of algorithm 3.5.1 is O (C eval (β)) + O Tr F/Q (β) + O F (1) elementary operations and O(1) square roots in k ; the implied constants, O F (1) excepted, are independent of F .

  Proposition 4.1.1. Let L be a number field, and let A, B be an interval in Z. Write D = B -A and M = max{|A| , |B|}. Let d ≥ 1, let F ∈ L[Y ] be a polynomial of degree at most d, let N ≥ d + 1, and let x 1 , . . . , x N be distinct elements of A, B . Assume that h(F (x i )) ≤ H for all 1 ≤ i ≤ N . Then we have h(F ) ≤ N N -d H + D log(D) + d log(2M ) + log(d + 1).

  Proposition 4.3.2. Let Q ∈ L[Y ] be monic polynomial of degree d ≥ 1, and let α 1 , . . . , α d be its roots in the algebraic closure of L. Thenh(Q) ≤ d i=1 h(α k ) + d log 2.Proof. Apply proposition 4.3.1 on the multivariate polynomialP = d k=1 (Y d+1 -Y k )with m = d, y k = α k , and I k = {k}. Since the coefficients of P all belong to {-1, 0, 1}, we have h(P ) = 0.Conversely, the height of a univariate polynomial over L controls the height of its roots.

  Proposition 4.3.3. Let P ∈ L[Y ]\{0}, and let α be a root of P . Then h(α) ≤ h(P ) + log(2).

  Proposition 4.4.2. Let d ≥ 1, let F ∈ L[Y ] be a polynomial of degree at most d, and let x 1 , . . . , x d+1 be distinct integers in A, B . Write D = B-A and M = max{A, B}. Assume that h(F (x i )) ≤ H for every 1 ≤ i ≤ d + 1. Then we have h(F ) ≤ (d + 1)H + D log(D) + d log(2M ) + log(d + 1).

Lemma 4.4. 4 .

 4 Keep the notation from proposition 4.4.3, and let

  Lemma 4.5.8. Let A, B ⊂ Z, let D = B -A, and let η ≥ 1. Let S be a subset of A, B containing at least D/η elements, and let 1 ≤ k ≤ D 2η be an integer. Then there exists a subinterval of A, B of amplitude at most 2ηk containing at least k + 1 elements of S.

  have H(D) ≤ 4cd log(dD) and 2dH(D) ≤ D, hence h(F ) ≤ 4cd log(dD) + 1920d log(D) + d log(2D) + log(d + 1) ≤ (4c + 1923)d log(dD) ≤ (4c + 1923)d(log(2d max{1, #V }) + log(5cd 5 log(4cd 4 )))

  holomorphic on H 2 , and also are Siegel modular forms of weight w by proposition 5.1.3. Proposition 5.1.10. The modular forms g and f (i) ,k are defined over Z.

  γ∈K 0 /K γ • λ δwhere λ δ is the modular form [x, g] → λ ([x, gδ]) of level K . The modular form λ δ is defined over L and has weight wt(λ δ ) = wt(λ) + (#Σ) d (δ) wt(λ ).

  i ) within O M d(N + C + dM + d log d) log d binary operations. The precision loss is O(C + dM + d log d) bits. defined by a monic irreducible polynomial P ∈ Z[X], and let M ≥ 1 such that log + |P | ≤ M . Let α be a root of P in L. Let x = d-1 j=0 λ j α j ∈ Z[α] with λ j ∈ Z and log + |λ j | ≤ H for every j. Let N ≥ C(H + dM + d log d). Then, given P and approximations of x, α and 1/P (α) to precision N in every complex embedding of L, the algorithm computes x within O M d(H + dM + d log d) log d binary operations.

  x and √ y lie in a common open quarter plane seen from the origin [Dup11, Thm. 2], i.e. a set of the form {r exp(i(α 0 + α)) | r > 0 and 0 < α < π/2}

  /2Z) 2 ,n≥0 be a Borchardt sequence with good sign choices only, and assume that Re s (n) b > 0 for every b ∈ (Z/2Z) 2 and n ≥ 0. For every n ≥ 0, define m n = min b∈(Z/2Z) 2 Re s (n) b and M n = max b∈(Z/2Z) 2 s (n) b

  2.2 computes an approximation of τ within O M(N + |τ |) log |τ | + M(N ) log N binary operations. The precision loss is O(log N + |τ | log |τ |) bits.

  for b ∈ (Z/2Z) 2 are bounded above by some α < π/2 which is independent of τ . Then, by lemma 6.2.10, we have|log m 0 | = O(|τ |) and |M 0 | = O(1).By lemma 6.2.12, the same estimates hold for m n and M n for every n ≥ 0. Therefore, in the first n 0 Borchardt steps, we perform O(log |τ |) elementary operations on complex numbers z that satisfy |log(|z|)| = O(|τ |), for a total cost of O(M(N + |τ |) log |τ |) binary operations, and a precision loss of O(|τ | log |τ |) bits. Then, we scale the values in such a way that one of the four values of the n 0 -th term in the Borchardt sequence equals 1, and we add O(log N ) Borchardt steps: this O-constant and the accuracy of the result can be made explicit by lemma 6.2.13. This costs O(M(N ) log N ) binary operations, and the precision loss is O(log N ) bits. This allows us to compute the quantities θ 2 0 (γ i τ ) for 1 ≤ i ≤ 3; the precision loss up to now is O(log N + |τ | log |τ |) bits. Finally, we recover the entries of τ in step 4 of algorithm 6.2.2, for a cost of O(N + |τ |) binary operations and a precision loss of O(|τ |) bits.

F

  τ : {z ∈ C : Re z > 0} 3 → C 3 which satisfies F τ b 1 (τ ), b 2 (τ ), b 3 (τ ) = 0.

  to algorithm 6.2.19 with slightly worse constants. This shows that log |τ | and log |det(γ * τ )| remain in O(Λ(τ )).During the algorithm, we also have log + m 2 (τ ) = O(Λ(τ )) by [Str10, Lem. 5.12]. Moreover det Im(τ ) ≥ det Im(τ ), som 1 (τ ) -1 ≤ m 2 (τ ) det Im(τ ) ≤ m 2 (τ ) det Im(τ ) ≤ 4m 2 (τ ) 3m 1 (τ ) 2

  1. a matrix γ ∈ Sp 4 (Z) such that log |γ| = O(Λ(τ )), 2. a matrix τ ∈ F 2 such that τ is an approximation of γτ to precision N , 3. an approximation of squares of theta constants at γτ to precision N , within O M(Λ(τ ))Λ(τ ) log Λ(τ ) + M(N ) log N binary operations.

D

  β (τ ) = 2 w β G 2 (τ ) 2 w β /6 F 10 (τ ) a G 2 (τ ) b η∈C σ β (η * τ ) -10 F 10 ( 1 β ητ ),(6.8)where w β = 10(2 + 2), and the integers a, b ≥ 0 are chosen such that 2 w β /6 + w β = 10a + 2b with 0 ≤ b ≤ 4.

  some m, n ∈ Z, by[START_REF] Birkenhake | Humbert surfaces and the Kummer plane[END_REF] Cor. 4.2]. On the other hand, the analytic representation of √ ∆, denoted by ρ A,τ 0 ( √ ∆), can be computed as follows. Let ω = (ω 1 , ω 2 ) be a basis of differential forms on A(τ 0 ) such that Sym 2 (ω) corresponds by the Kodaira-Spencer isomorphism to a deformation of A(τ 0 ) along the Humbert surface. Then, by proposition 3.3.10, the matrix of ( √ ∆) * in the basis ω is of the form 3.11 shows that such a basis ω exists; moreover the base change matrix m between (dz 1 , dz 2 ) and ω can be chosen in such a way thatlog max{|m| , m -1 } = O F (B Θ,µ )after extending Θ in a suitable way. This proves that the analytic representation of the endomorphism √ ∆ on A(τ 0 ) satisfieslog + ρ A,τ 0 ( √ ∆) = O F (B Θ,µ ).

Im(τ 0

 0 ) n ma -mc mb + n = Im ρ A,τ 0 ( √ ∆)τ 0 ,andIm(τ 0 ) 0 md -md 0 = Im ρ A,τ 0 ( √ ∆) .

  2. Compute roots of modular equations to find an isogenous abelian surface; this step costs O( 3 log 2 p) binary operations in the Siegel case, and O F ( log 2 p) binary operations in the Hilbert case. 3. Compute an explicit representation of the isogeny ϕ using the algorithm of chapter 3; this costs O( log p) binary operations in the Siegel case, and O F ( √ log p) binary operations in the Hilbert case.

  F p [GS12, §3.1], where d is the degree of the rational fractions describing φ P . This costs O(d 3 log p) binary operations; in other words O( 3 log p) and O F ( 3/2 log p) binary operations in the Siegel and Hilbert cases, respectively. The degrees of the polynomials in the resulting Gröbner basis is O(d 2 ).

  Diag(a 1 , . . . , a n )Diagonal n × n matrix with entries a 1 , . . . , a n

	A, B # S 1 P Mat n×m (A) Sp 2g GSp 2g m t m -t P n A n G m Z F ∂ -1 F (x) Tr F/Q , N F/Q P F k I (A B) V (k)	Integer interval {n ∈ Z : A ≤ n ≤ B} Cardinality of S Function with value 1 when property P holds, and 0 otherwise Module of n × m matrices over the ring A Symplectic group of order 2g (p. 66) General symplectic group of order 2g Transpose of the matrix m Inverse of m t Concatenation of matrices A and B Projective space of dimension n ≥ 1 Affine space of dimension n ≥ 1 Multiplicative group Ring of integers of the number field F Inverse different of the number field F (p. 76) Ideal generated by x Trace and norm in the finite extension F/Q Set of finite primes in the number field F Algebraic closure of the field k

n Identity matrix of size n × n

  Variables in Fourier expansions on H 2 (p. 70) θ a,b for a, b ∈ {0, 1} g Theta constants on H g (p. 71) θ j for 0 ≤ j ≤ 15 Theta constants on H 2 (p. 71) h 4 , h 6 , h 10 , h 12 , ψ 4 , ψ 6 , χ 10 , χ 12 Siegel modular forms on H 2 (p. 72) j 1 , j 2 , j 3 Igusa invariants on H 2 (p. 73) det k Sym n Irreducible representations of GL 2 (C) (p. 73) 1 , . . . , j n+1 Modular functions on S, T (p. 158) J 1 , . . . , J n+1 , Y 1 , . . . Resultant of P, Q with respect to the variable X GC(j 1 , . . . , j n+1 ) Fundamental domain in H 2 (p. 203) S ⊂ Sp 4 (Z) Finite set defining the boundary of F 2 (p. 203) z j(τ ) = x j (τ ) + iy j (τ ) for 1 ≤ j ≤ 3Entries of τ ∈ H 2 (p. 204) q j (τ ), λ 1 (τ ), r(τ )

	j 1 , j 2 , j 3 DΨ β,L , DΨ β,R α d	Igusa invariants on A 2 3 × 3 matrices of derivatives of Hilbert modular Hermite's constant (p. 198)
	Φ H 1 j (E), j (τ ) Λ(τ ), where τ ∈ H 1 E(τ ), where τ ∈ H 1 X(1) θ 0 (τ ), θ 1 (τ ) for τ ∈ H 1 E[n] T (E) T 0 (E) E 4 , E 6 G( , F q ) and others Ell(O, k) A 2 A 2,F Ψ ,1 , Ψ ,2 , Ψ ,3 Chapter 2 A t x A[n] Pic 0 (A) NS(A) Jac(C) η 56) Elliptic modular polynomial of level (p. 24) Poincaré upper half plane (p. 22) j-invariant (p. 23) Lattice Z ⊕ τ Z ⊂ C Complex elliptic curve C/Λ(τ ) Modular curve of level one (p. 22) Theta constants on H 1 (p. 22) n-torsion subgroup of the elliptic curve E -adic Tate module of the elliptic curve E (p. 27) Tangent space of E at the neutral point Normalized Eisenstein series on H 1 Isogeny graphs of elliptic curves (p. 30) Set of elliptic curves with endomorphism ring O over k up to isomorphism (p. 31) Siegel moduli space for abelian surfaces (p. 36) Hilbert moduli space for abelian surfaces with real multiplication by Z F , where F is a real quadratic field (p. 36) Siegel modular equations of level for principally polarized abelian surfaces Dual of the abelian variety A (p. 44) Translation by x (p. 43) n-torsion subgroup of the abelian variety A Group of line bundles algebraically equivalent to zero on A, up to linear equivalence (p. 44) Néron-Severi group of A (p. 44) Jacobian of the smooth curve C (p. 45) (Λ c , ψ c ) Standard lattice attached to c ∈ C (p. 58) T p (A) p-adic Tate module of A (p. 60) T (A) Global Tate module of A (p. 60) a n (f ) Fourier coefficient of f (p. 70) q 1 , q 2 , q 3 df dτ Vector-valued derivative of a Siegel modular form f on H 2 (p. 74) f 8,6 Siegel modular form of weight det 8 Sym 6 (p. 75) H R Hilbert embedding (p. 77) G 2 , F 6 , F 10 Hilbert modular forms for F = Q( √ 5) (p. 80) g 1 , g 2 Gundlach invariants for F = Q( √ 5) (p. 81) b j for 0 ≤ j ≤ 6 Coefficients of the pullback of f 8,6 on H 2 1 (p. 81) H δ Hecke correspondence of level δ ∈ G(A f ) (p. 84) d (δ) Degree of the Hecke correspondence H δ (p. 85) l (δ) Degree of the isogenies described by H δ (p. 86) Ψ δ,m Modular equations of level δ (p. 89) Chapter 3 A 2 1 ) (p. 100) Cov(f ) Covariant attached to the Siegel modular form f (p. 101) I 2 , I 4 , I 6 , I 6 , I 10 , R Scalar-valued covariants (p. 103) y 1 , y 2 , y 3 , X Vector-valued covariants (p. 103) ∂j(τ ) 3 × 3 matrix of derivatives of Igusa invariants at τ ∈ H 2 (p. 108) DΨ ,L , DΨ ,R 3 × 3 matrices of derivatives of Siegel modular equations of level (p. 109) ∂j (F ) (τ ) 3 × 2 matrix of derivatives of Igusa invatiants at τ ∈ H 2 1 (p. 111) equations of level β (p. 111) W (k) Witt ring of the field k X g → A g Moduli stack of abelian varieties of dimension g with its universal family (p. 115) A g ( ), A g, , A g,F , A g,β Moduli stacks of abelian varieties of dimension g with suitable structure (pp. 116 and 117) C <2> Symmetric square of the curve C ϕ * Pullback by the isogeny ϕ on line bundles or dif-ferential forms Θ Theta divisor (p. 126) L α A Line bundle on A (up to algebraic equivalence) associated with α ∈ End(A) † (p. 127) L • L Intersection pairing for line bundles on a smooth algebraic surface C eval ( ), C eval (β) Cost of evaluation for modular equations of Siegel type and level (resp. Hilbert type and level β) (p. 130) Chapter 4 h(F ) Height of F (p. 139) d L Degree of the number field L over Q V L , V 0 L , V ∞ L Set of all (resp. all non-archimedean, resp. all archimedean) places of L v p p-adic valuation, where p ∈ P L (p. 139) |•| v Normalized absolute value associated with the place v (p. 139) D! Factorial of D ≥ 1 h(x) 1 d L log N L/Q (x) (p. 146) Chapter 5 Indeterminates E Equation satisfied by j 1 , . . . , j n+1 on S (p. 158) Σ, K 0 , K , K See p. 159 g δ , m Denominator of Ψ δ,m (p. 160) SGC(j 1 , . . . , j n+1 ) Symmetric geometric complexity (p. 161) e Degree of E in J n+1 Γ 0 ( ) Congruence subgroup of Sp 4 (Z) (p. 168) C Set of representatives for Γ 0 ( )\ Sp 4 (Z) (p. 168) g Classical Siegel modular form; denominator of Siegel modular equations of level (p. 168) w Weight of g f (i) ,m (τ ) Coefficient of Y i in g (τ )Ψ ,m j 1 (τ ), j 2 (τ ), j 3 (τ ) D Complete denominator of Siegel modular equa-tions of level (p. 170) Γ 0 F (β) Congruence subgroup of SL(Z F ⊕ ∂ -1 F ) (p. 171) ∆ Discriminant of F C β , C σ β Set of representatives modulo Γ 0 F (β) (p. 171) g β Classical Hilbert modular form; denominator of Hilbert modular equations of level β (p. 171) w β Weight of g β f (i) U Zariski open set of S (p. 179) V Chapter 6 log + 2 (x) log 2 max {1, x} |P | Largest absolute value among the coefficient of P (p. 194) m F Generating matrix of Z F in the complex embed-dings of F (p. 129) B(τ ) Borchardt sequence of theta constants at 2 n τ for n ≥ 0 (pp. 200 and 202) γ k for 0 ≤ k ≤ 3 Matrices in Sp 4 (Z) (p. 202) F 2 See p. 204 F 2 Subset of H 2 containing F 2 (p. 204) F ε 2 Neighborhood of F 2 (p. 216) Λ(τ ) Chapter 7 π A Frobenius endomorphism of A χ A Characteristic polynomial of π A (p. 234) d Geometric complexity (p. 167) C(g, r) ξ A Real endomorphism π A + π † A (p. 234) See p. 176 A Θ,r λ 1 , λ 2 , r 1 , r 2 , s 1 , s 2 See p. 234 Moduli space of principally polarized abelian va-•, • Weil pairing on A[ ] (p. 235) rieties of dimension g with level r theta structure (p. 176) P q-reciprocal of the polynomial P (p. 235).

P Embedding C → Jac(C), Q → [Q -P ] End k (A)

Ring of endomorphisms of A defined over k End 0 (A) Endomorphism algebra of A over k (p. 47) † Rosati involution (p. 47) End(A)

†

Set of real endomorphisms of A (p. 47)

End 0 (A) † Subspace of invariants under † in End 0 (A) A f

Ring of finite adeles of Q (p. 50)

Z Profinite completion of Z (p. 51) G der , Z, G ad , T , ν, G(R) + , G(Q) + See p. 53 (G, X + ) PEL datum (p. 55) Sh K (G, X + ) (or Sh K )

PEL Shimura variety of level K attached to the PEL datum (G, X + ) (p. 55)

C ⊂ G(A f ) Set of representatives for connected components of Sh K (C) (p. 56) S c = Γ c \X + Connected component of Sh K (C) associated with c ∈ C (p. 56) E(G, X + )

Reflex field of the PEL datum (G, X + ) (p. g Moduli space of principally polarized (p.p.) abelian varieties of dimension g A g, Moduli space of p.p. abelian varieties of dimension g endowed with the kernel of an -isogeny

H = (H ,1 , H ,2 ) Map A g, → A g ×A g , (A, K) → (A, A/K) (p.

96) dϕ Tangent map of the isogeny ϕ (p. 96) ω(C) Basis of differential forms on Jac(C) associated with the hyperelliptic equation C (p. 98) A(τ ) P.p. abelian surface C 2 /Λ(τ ) attached to τ ∈ H 2 (p. 99) A F (τ ) P.p. abelian surface C 2 /Λ F (τ ) with real multiplication by Z F attached to τ ∈ H 2 1 (p. 100) ω(τ ) Standard basis of differential forms on A(τ ) or A F (τ ) (p. 99) C(τ ), C F (τ ) Standard genus 2 hyperelliptic equations attached to τ ∈ H 2 (resp. τ ∈ H j E Total degree of E in J 1 , . . . , J n Res X (P, Q)

β,m (τ ) Coefficient of Y i in g β (τ )Ψ β,m g 1 (τ ), g 2 (τ ) D β

Complete denominator of Hilbert modular equations of level

β (p. 172) h F (A)

Faltings height of the abelian variety A h Θ,r (A, L)

Theta height of level r of the principally polarized abelian variety (A, L)

h j (A) j-height of A (p. 175) h F , h Θ,

r , h j max{1, h F }, etc. δ Zariski open set of S; in particular the modular equations Ψ δ,m have no poles on V δ (p. 180) C X.Y.Z Constant ≥ 1 so that prop. X.Y.Z holds with this value of C C log We have log d (δ) ≤ C log max {1, log l (δ)} (p. 182) I k (T ) Evaluation set of the tree T (p. 182) log max {2, |τ | , det(Im τ ) -1 } (p. 217) m 1 (τ ), m 2 (τ ) Successive minima of Im(τ ) on Z 2 (p. 217) Θ Finite recipe of algebraic extensions (p. 223) B Θ,µ

Upper bound on the absolute values of the algebraic numbers in Θ(j 1 , j 2 , j 3 ) in the complex embedding µ of L (p. 223)

  Theorem 1.4.1. Let be a prime, and let k be a field of characteristic zero or p > 8 + 7. Let U be the open subvariety of A 2 consisting of abelian surfaces A without extra automorphisms and such that j 3 (A) = 0. Assume that there exists an algorithm to evaluate derivatives of Siegel modular equations of level at a given point of U × U over k, using C

eval ( ) operations in k. Let ϕ : A → A be an -isogeny defined over k such that A, A lie in U and such that the subvariety of A 2 × A 2 cut out by the Siegel modular equations of level is normal at (A, A ). Then, given the Igusa invariants of A and A , one can compute an explicit representation of the isogeny ϕ using O(C eval ( )) + O( ) operations in k.

  L 1 and L 2 on A, corresponding to divisors D 1 and D 2 , are linearly equivalent if D 1 -D 2 is the divisor of a function; The line bundles L 1 and L 2 are algebraically equivalent if there exists a smooth variety T , a line bundle M on A×T , and closed points t 1 , t 2 of T such that L 1 M |A×{t 1 } and L 2 M |A×{t 2 } . We say that L 1 is algebraically equivalent to zero if it is algebraically equivalent to the trivial line bundle; the group of line bundles algebraically equivalent to zero on A is denoted by Pic 0 (A).

	equivalently, if L 1 ⊗ L -1 2	is globally trivial. We often identify line
	bundles with their linear equivalence classes.
	2. Linearly equivalent line bundles
	are algebraically equivalent. Line bundles up to algebraic equivalence
	on A form a group under the tensor product, called the Néron-Severi
	group NS(A) of A.
	3. Two algebraically equivalent line bundles on A are always numeri-
	cally equivalent, meaning that one can be replaced by the other in
	intersection pairings.

  . Two line bundles on A are algebraically equivalent if and only if they give rise to the same map φ L . The map φ L is zero if and only if L is algebraically equivalent to zero, and φ L is an isogeny if and only L is ample [Mil86a, Prop. 10.1].For every isogeny ϕ : A → B, we have a dual isogeny ϕ : B → A; and the double dual of A is identified with A. Under this identification, isogenies of the form φ L are self-dual.

  2.3.8. The irreducible finite-dimensional holomorphic representations of the group GL 2 (C) are exactly the representations det k Sym n , for k ∈ Z and n ∈ N.

Proof. Since SL 2 (C) is a simply connected Lie group, there is an equivalence between holomorphic finite-dimensional representations of SL 2 (C) and representations of its Lie algebra sl 2 (C) [Bou72, Ch. III, §6.1, Th. 1]. By [Bou75, Ch. VIII, §1.3, Th. 1], irreducible representations of sl 2 (C) are classified by their higher weight; on the Lie group side, this shows that the holomorphic finite-dimensional irreducible representations of SL 2 (C) are exactly the representations Sym n for n ∈ N. The case of GL 2 (C) follows easily.

  is called the Hecke correspondence of level δ on Sh K (C). Alternatively, H δ can be seen as a correspondence on Sh K (C) × Sh K (C) consisting of all pairs of the form [x, g], [x, gδ] for [x, g] ∈ Sh K (C). Hecke correspondences are algebraic: the diagram (2.16) is the analytification of a diagram existing at the level of algebraic varieties. Moreover, Hecke correspondences are defined over the reflex field E(G, X + )[START_REF] Milne | Introduction to Shimura varieties[END_REF] Thm. 13.6].

  1,δ generates the function field on the Hecke correspondence [BL09, Lem. 4.2], so that d 1 = d(δ) and d 2 = d 3 = 1, in the notation of §2.4.3. The modular equations from definition 2.4.6 (or rather remark 2.4.10) are the usual modular equations of Siegel type and level , denoted by

  is a modular function of weight Sym 2 .

	Theorem 3.2.15. In the notation of §3.2.2, we have
	Cov	dj 1 dτ	=	1 I 10	153 8	I 2 2 I 4 y 1 -	135 2	I 2 I 6 y 1 +	135 2	I 2 4 y 1 +	46575 4	I 2 I 4 y 2
					-30375 I 6 y 2 + 1366875 I 4 y 3 ,
	Cov	dj 2 dτ	=	1 I 10	90 I 2 2 I 4 y 1 + 900 I 2 2 y 1 + 40500 I 2 I 4 y 2 , and
	Cov	dj 3 dτ	=	1 10 I 2	225 I 2 I 4 4 y 1 + 101250 I 4 4 y 2 .

  I 10 I 4 + 121500y 2 I 10 I 6 .

	obtain
	Cov	dh 1 dτ	=	1 I 4 4		-	297 8	y 1 I 2 4 I 3 2 + -	54675 4	y 2 I 2 4 I 2 2 +	1701 8	y 1 I 6 I 4 I 2 2 +	135 2	y 1 I 3 4 I 2
				+ 1366875y 3 I 2 4 I 2 +		346275 4	y 2 I 6 I 4 I 2 -	1215 4	y 1 I 2 6 I 2 + -	405 2	y 1 I 6 I 2 4
				-4100625y 3 I 6 I 4 -		273375 2	y 2 I 2 6 ,
	Cov	dh 2 dτ	=	1 4 I 4	-135y 1 I 10 I 2 2 -60750y 2 I 10 I 2 + 900y 1 I 10 I 4 ,
	Cov	dh 3 dτ	=	1 I 5 4		-	747 8	y 1 I 10 I 4 I 2 2 -	155925 4	y 2 I 10 I 4 I 2 + 270y 1 I 10 I 6 I 2
				+	135 2	y 1 I 10 I 2 4 + 1366875y 3
									4	, h 2 =	χ 12 ψ 3 4	, h 3 =	χ 10 ψ 6 ψ 4

  starts at z 2 , the values of κ that occur are 2, . . . , m -1 when solving (3.14) up to precision O(z m ). By lemma 3.4.7, the constant term of A + κ is invertible. This concludes the induction, and the result follows from standard lemmas in computer algebra [BCG + 17, Lem. 1.12].

Proposition 3.4.9. Let n ≥ 1, and assume that char k > n. Then we can compute the lift ϕ P up to precision O(z n ) within O(n) operations in k . Proof. Combine proposition 3.4.8 and [BCG + 17, Lem. 1.12].

  then inequality (4.4) holds after multiplying the right hand side by the number of possible monomials in Y 1 , . . . , Y m , which is

	r
	k=1

10 .

 10 These modular forms have a polynomial expression in terms of the ten even theta constants of level 4, given in definition 2.3.4. The total degrees of the polynomials giving h 4 , h 6 , h 10 and h 12 are 8, 12, 20 and 24 respectively; they contain respectively 10, 60, 1 and 15 monomials, and their height is zero. Up to scaling, we may assume that the first theta constant θ 0 takes the value 1. Then, by proposition 4.3.1, we have

	h(h 5 4 , h 4 h 6 h 10 , h 2 4 h 12 , h 2 10 ) ≤ 5 log(10) + 40 h Θ,4 (A),
	hence the first inequality
	h j (A) ≤ 40 h Θ,4 (A) + 12.

  2 w β /6 F 10 (t) a G 2 (t) b t) -10 F 10 ( 1 β ηt)Y -G 5 2 ( 1 β ηt) ,andD β (t)Ψ β,2 µ(g 1 ), µ(g 2 ), Y = D β (t) = 2 w β G 2 (t) 2 w β /6 F 10 (t) a G 2 (t) b

	η∈C σ β	β (η η∈C σ	g 2 ( 1 β ηt)	η =η	Y -g 1 ( 1 β η t)
		(η * t) -10 G 2 2 ( 1 β ηt)F 6 ( 1 β ηt)
	η∈C σ β
		•	(η
		η =η

* * t) -10 F 10 ( 1 β ηt)Y -G 5 2 ( 1 β ηt) .

Théorème 3. Avec les notations ci-dessus, il existe des constantes C 1 et C 2 (indépendantes de δ) vérifiant la propriété suivante. Soit δ un élément adélique de G, et F une fraction rationnelle obtenue comme coefficient de l'une des équations modulaires de niveau δ. Alors le degré total de F est borné par C 1 d (δ), et la hauteur de F est bornée par C 2 d (δ) log l (δ).Dans le cas des équations modulaires de Siegel de niveau , nous avons d (δ) = 3 + 2 + + 1 et l (δ) = 2 . Ainsi, le degré des équations modulaires de Siegel de niveau est O( 3 ), et leur hauteur est O( 3 log ). Dans le cas du polynôme modulaire elliptique Φ , on retrouve, aux constantes près, les bornes de degré et de hauteur précédemment connues.

where E 4 , E 6 are the normalized Eisenstein series of weight 4 and 6 on H 1 , respectively. The fact that j is an isomorphism between X(1) and P 1 (C)

which are generically well-defined on products of elliptic curves. Then we

The projective height of (a 0 : • • • : a n ) is indeed invariant under multiplication by a common scalar factor, by the product formula [HS00, Lem. B.2.1(a)]. Therefore the height of a fraction is also well defined.

+ log(2) ≤ 2.2.

In the second step ( §6.3.5), we focus on the case of Hilbert modular equations for Q( √ 5) in Gundlach invariants. We consider each of

Remerciements

Proposition 3.3.9. Let ϕ : A → A be a β-isogeny, and let C and C be Hilbert-normalized curve equations as above. Then the tangent matrix dϕ is diagonal, and

Proof. By proposition 3.3.1, we can find τ ∈ H 2 1 as well as isomorphisms η and η such that there is a commutative diagram

Let r be the matrix of η * in the bases ω(τ ) and ω(C), and define r similarly; they are diagonal by definition 3.3.5. We have dϕ = r t r -t = r r -1 . Differentiating the modular equations, we obtain

The result follows by lemma 3.3.7 since ∂j (F ) (τ ) = ∂j (F ) (C) • r 2 and ∂j (F ) (τ /β) = ∂j (F ) (C ) • r 2 .

Proposition 3.3.9 allows us to compute (dϕ) 2 from derivatives of modular equations of level β when ϕ is generic. However, in contrast with the Siegel case, the knowledge of (dϕ) 2 does not allow us to recover the diagonal matrix dϕ up to sign, as we have to perform two a priori uncorrelated root extractions: we obtain two possible candidates for ±dϕ.

Constructing Hilbert-normalized curves. Let (A, ι) be a principally polarized abelian surface over C with real multiplication by Z F . Given the Igusa invariants (j 1 , j 2 , j 3 ) of A, we want to construct a curve equation C such that A Jac(C) and A, ι, ω(C) is Hilbert-normalized. First, we compute any curve equation using Mestre's algorithm [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF]; then we look for a suitable change of variables.

However, we are missing some information, as the two pairs (A, ι) and (A, ι), where ι denotes the real conjugate of ι, have the same Igusa invariants. The best we can hope for is to compute an equation C such that either A, ι, ω(C) or A, ι, ω(C) is Hilbert-normalized. In this case, we say that C is potentially Hilbert-normalized. This ambiguity is a direct consequence of using symmetric invariants on the Hilbert surface.

Lemma 3.4.11. The polar divisors of the rational functions s, p, q and r on Jac(C ) are algebraically equivalent to 2Θ , 2Θ , 6Θ and 4Θ respectively.

Proof. See [CE15, §6.1]. For instance, s = x 1 + x 2 has a pole of order 1 along each of the two divisors {(∞ ± , Q) : Q ∈ C }; here ∞ ± are the two points at infinity on C , assuming that we chose a degree 6 hyperelliptic model. Each of these two divisors is algebraically equivalent to Θ . The proof for p, q, and r is similar.

Recall that linear equivalence classes of divisors on Jac(C ) are in bijective correspondence with isomorphism classes of line bundles ( §2.1.1). Recall from §2.1.4 that if (A, ι) is a principally polarized abelian surface with real multiplication by Z F , then there is a bijection (2.2) between Z F and the Néron-Severi group of A, denoted by α → L ι(α) A . Lemma 3.4.12. Let ϕ be a β-isogeny as above. Then the divisor ϕ P (C) is algebraically equivalent to the divisor corresponding to the line bundle L ι (β) Jac(C ) on Jac(C ). Proof. There exists an α ∈ Z F such that the divisor ϕ P (C) corresponds to the line bundle L ι (α) Jac(C ) up to algebraic equivalence. Consider the pullback ϕ * (ϕ P (C)) as a divisor on Jac(C). By definition, we have ϕ * (ϕ P (C)) = x∈ker ϕ (x + η P (C)) .

Therefore, up to algebraic equivalence, we have

Since ϕ is a β-isogeny, the pullback ϕ * Θ corresponds to the line bundle L ι(β) Jac(C) up to algebraic equivalence. Therefore, for every γ ∈ Z F , we have

The next step is to compute the intersection degree of Θ and the divisor corresponding to L ι(α) Jac(C ) on Jac(C ), for every α ∈ Z F . Proposition 3.4.13 ([Kan19, Rem. 16]). Let (A, ι) be a principally polarized abelian surface with real multiplication by Z F , and let Θ be its theta divisor. Then the quadratic form

Choose P = (0, 0) as a base point on C, and choose z = √ u as a uniformizer; P is a Weierstrass point, and we check that ϕ P is of generic type. We solve the differential system (3.11) up to precision O(z 35 ), or any higher precision. It turns out that the correct tangent matrix is dϕ β,+ as the other powers series do not come from rational fractions of the prescribed degrees. We obtain s(u) = 50255u 6 + 40618u 5 + 17196u 4 + 9527u 3 + 22804u 2 + 49419u + 11726

The degrees of s and p agree with proposition 3.4.15. The isogeny is k-rational at the level of Kummer surfaces, but not on the Jacobians themselves: α appears on the numerator of r(u, v).

where J is the set of interpolation points. By propositions 4.3.1 and 4.3.3, we have h(j n+1 ) ≤ C h(j 1 , . . . , j n ) for every j n+1 ∈ J , where C is another constant independent on δ. The result follows by applying proposition 4.1.1 with N = d + 1; recall that log d (δ) = O(log l (δ)) by proposition 2.4.4.

The proof of proposition 5.2.7 provides an explicit value of C if the constant from corollary 5.2.4 is known.

Heights of coefficients of modular equations

We are ready to prove height bounds on modular equations (the second part of theorem 5.0.1) using proposition 5.2.7 and the results on heights of fractions given in chapter 4. From now on, we add subscripts to constants: for instance C 5.2.3 denotes a constant larger than 1 such that proposition 5.2.3 holds with this value of C. Moreover, we denote by C log a constant independent of δ such that log d (δ) ≤ C log max{1, log l (δ)}. We can take C log = (dim V ) 2 + log(C 2.4.4 ), where V denotes the Q-vector space defining the PEL datum. Definition 5.2.8. We call an (n, N 1 , N 2 )-evaluation tree a rooted tree with depth n, arity N 1 at depths 0, . . . , n -2, and arity N 2 at depth n -1, such that every vertex but the root is labeled by an element of Z and the sons of every vertex are distinct.

Let T be an (n, N 1 , N 2 )-evaluation tree, and let 1 ≤ k ≤ n. The k-th evaluation set I k (T ) of T is the set of points (y 1 , . . . , y k ) ∈ Z k such that y 1 is a son of the root, and y i+1 is a son of y i for every 1 ≤ i ≤ k -1. We say that T is bounded by M if the absolute value of every vertex in T is bounded above by M . We say that T has amplitude (D 1 , D 2 ) if for every vertex y of depth 0 ≤ r ≤ n -2 (resp. depth n -1) in T , the sons of y lie in an integer interval of amplitude at most D 1 (resp. D 2 ); by definition, the amplitude of A, B is B -A.

Let T be an (n, N 1 , N 2 )-evaluation tree, let a = (a 1 , . . . , a n ) ∈ Z n , and let M ≥ 1 be an integer. Let F be a coefficient of Ψ δ,m for some 1 ≤ m ≤ n + 1, seen as a polynomial in the variables J n+1 , Y 1 , . . . , Y m of degree at most e -1 in J n+1 ; hence F ∈ L(J 1 , . . . , J n ). Write F = P/Q in irreducible form where P, Q ∈ L(J 1 , . . . , J n ), and let d = deg(F ); assume that d ≥ 1. We say that T , a and M are valid evaluation data for F if the following conditions are satisfied:

1. T and a are bounded by M . which is a nonzero polynomial of degree at most 2C 5.2.6 d (δ). Let R be the resultant with respect to Y n of the two polynomials

The polynomial R is nonzero and has degree at most 4d 2 . We want to choose 2d values of y 1 , lying in an interval with amplitude at most 4d, such that neither R δ nor R vanishes when evaluated at Y 1 = y 1 ; this nonvanishing condition excludes at most 4d 2 + 2C 5.2.6 d (δ) possible values of y 1 . At least one of the intervals of the form 5kd, (5k + 4)d for 0

We iterate this procedure to construct T up to depth n -1 with the right arity, bound and amplitude, in such a way that the evaluations of R δ and R are nonzero at every (y 1 , . . . , y n-1 ) ∈ I n-1 (T ).

We conclude by constructing n-th level of T . Let (y 1 , . . . , y n-1 ) ∈ I n-1 (T ). Then, as before, at most 4d 2 + 2C 5.2.6 d (δ) ≤ M values for y n are forbidden as they make either R δ or R vanish. This leaves at least M available values for y n in -M, M .

For every tuple (y 1 , . . . , y n ) ∈ I n (T ), the fact that the polynomials R δ and R do not vanish at the point (y 1 , . . . , y n ) guarantees conditions 5 and 6 of definition 5.2.8 respectively. Finally, the inequality

Theorem 5.2.10. Let H δ be an absolutely irreducible Hecke correspondence on S ×T defined by an element δ ∈ G(A f ), and let d(δ) be the degree of H δ . Let F ∈ L(J 1 , . . . , J n ) be a coefficient of one of the modular equations Ψ δ,m for 1 ≤ m ≤ n + 1. Then the height of F is bounded above by C d (δ), where C is a constant independent of δ; more precisely we can take C = 2 n-1 2C 5.2.7 (1 + C ) + 2C 4.5.11 C 5.1.9 log(4C 5.1.9 C 5.2.7 ) + 2C log + 1 + C + 4C 5.1.9 (log(C 5.1.9 ) + C log ) + 2C 5.1.9 (log(2) + C ) + 2 log(2C 5.1.9 ) + 2 , where C = 3 + log(2C 5.2.9 ) + 4C log . Proof. By lemma 5.2.9, we can find valid evaluation data (T, a, M ) for F such that the inequality M ≤ C 5.2.9 d (δ) 4 max 1, log 3 l (δ) +1 holds. After scaling P and Q by an element of L × , we can assume that Q(a 1 , . . . , a n ) = 1.

Let (y 1 , . . . , y n-1 ) ∈ I n-1 (T ), and write

For every son y n of y n-1 in T , we have h y 1 y n + a 1 , . . . , y n-1 y n + a n ≤ log (M + 1)M ≤ 2 log(M + 1). Therefore, by proposition 5.2.7,

Denote this last quantity by H. We have H ≥ 4 and H ≥ log(2M ). Moreover, in the notation of definition 5.2.8, the inequality M ≥ 2B log 2 (B + 1) ensures that

We are in position to apply proposition 4.5.11 for the univariate rational fraction F on the interval -M, M , with η = 2, using the sons of (y 1 , . . . , y n-1 ) in T as evaluation points. We obtain

where C is a constant independent of δ. In order to obtain an explicit expression for C , we note that log(M + 1) ≤ C max {1, log l (δ)} .

We check that we can take C = 2C 5.2.7 (1 + C ) + 2C 4.5.11 C 5.1.9 log(4C 5.1.9 C 5.2.7 ) + 2C log + 1 + C + C 5.1.9 (log(2) + C ) + log(2C 5.1.9 ) + 1.

In the second part of the proof, we relate the height of F with the height of F . The quotient

We also take In lemma 5.2.9, we can take C 5.2.9 = 1.36 • 10 17 and in theorem 5.2.10, we can take C 5.2.10 = 1.42 • 10 15 .

Since d(δ) ≤ 2 3 and max{1, log (δ)} ≤ 2 log( ), we obtain the following result.

Theorem 5.2.13. Let ≥ 1 be a prime number, and let F ∈ Q(J 1 , J 2 , J 3 ) be a coefficient of one of the Siegel modular equations of level in Igusa invariants. Then we have h(F ) ≤ 5.68 • 10 15 3 log( ).

In order to obtain tighter height bounds on Siegel modular equations, we could repeat the computations of §5.2.4 using an expression of the form (5.8) for the height of evaluated modular equations, instead of the simpler formula used in proposition 5.2.7. However we cannot hope to obtain a constant in theorem 5.2.13 that is much lower than the value of C(2, 4) 1.35 • 10 9 using our methods. Experimentally, we observe that the inequalities h(F ) ≤ 48.7 3 log( ) and h(F ) ≤ 43.6 3 log( ) hold for = 2 and = 3 respectively.

We could also give an analogue of theorem 5.2.13 in the case of modular equations of Hilbert type for Q( √ 5) in Gundlach invariants. To replace proposition 5.2.11, we would use the relations between Gundlach and Igusa invariants (proposition 2.3.16) and the explicit curve equation given by proposition 2.3.17. We leave the precise calculations for future work.

Chapter 6 Evaluating modular equations for abelian surfaces

In this chapter, we are interested in the complexity of manipulating modular equations of Hilbert or Siegel type for abelian surfaces. The corresponding preprint is [START_REF] Kieffer | Evaluating modular polynomials in genus two[END_REF]; part of this chapter also covers the article [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF], to appear in Publications Mathématiques de Besançon.

By the main result of chapter 5, theorem 5.0.1, we know that for every prime , the Siegel modular equations of level , denoted by

have degree O( 3 ) in each variable J 1 , J 2 , J 3 , Y , and that each of their coefficients has height O( 3 log ). Therefore the cost of storing these modular equations in full is O( 15 log ). Similarly, if F is a fixed real quadratic field and if β ∈ Z F is a totally positive prime of norm , then the cost of storing Hilbert modular equations of level β in Igusa invariants, or Gundlach invariants if

In analogy with elliptic modular polynomials, we expect that both upper bounds are asymptotically accurate. Experimentally, Siegel modular equations are very difficult to compute: even using optimized invariants, the computations have never been carried out for > 7 to our knowledge [START_REF] Milio | A quasi-linear time algorithm for computing modular polynomials in dimension 2[END_REF]. Indeed, we expect that the Siegel modular equations of level 11 are roughly 10000 times as large as their level 7 analogues. In the Hilbert case for the quadratic field Q( √ 5), the size of a compressed tar file containing the modular equations is close to 30 4 log bytes for ∈ {11, 19, 29, 31, 41}, after which the database [Mil] ends.

Given these bounds, in the context of counting points on principally polarized abelian surfaces over finite fields, using Elkies's method with precomputed modular equations does not bring any asymptotic improvement

Precision losses in polynomial operations

In all algorithms manipulating complex numbers, we use interval arithmetic. Given z ∈ C and N ≥ 0, we define an approximation of z to precision N to be a complex ball centered at some z ∈ C of radius 2 -N containing z. An approximation of a polynomial to precision N is by definition an approximation to precision N coefficient per coefficient.

Approximations of complex numbers centered at dyadic points can be stored in a computer. This model makes more mathematical sense than the usual floating-point or fixed-point approximations; using it, we design algorithms with meaningful input and provably correct output.

Let M ≥ 1. We say that the precision loss in an algorithm A is M bits if the following property holds: for all N ≥ M , if the input of A is given as approximations to precision N , then the output of A is an approximation of its "theoretical" output to precision N -M . For instance, precision losses in elementary operations (additions, multiplications, etc.) can be bounded above in terms of the size of the operands (see §6.1.1). Besides these theoretical upper bounds, precision losses can also be computed on the fly in a precise way. This is done for instance in the Arb library [START_REF] Johansson | Arb: efficient arbitrary-precision midpointradius interval arithmetic[END_REF], which is therefore the library of choice to implement our algorithms. If we run out of precision during the computation, we can simply double the precision and restart. Therefore, in the theoretical analysis, it is enough to bound the precision losses in the O notation.

We let M(N ) be a quasi-linear, superlinear function of N such that two N -bit integers can be multiplied in M(N ) binary operations. We write log (resp. log 2 ) for the natural logarithm (resp. logarithm in base 2), and for x ∈ R, we define

We denote the absolute value of the largest coefficient in a polynomial P by |P |; we also use this notation for vectors and matrices.

Elementary operations

To summarize, additions can be done in linear time with a precision loss of O(1), and multiplications, inversions, and square roots can be done in quasi-linear time with a precision loss given by the size of the input. We state these standard facts without proof.

Proof. We write

We have log + |P | ≤ M + log d. The discriminant Disc(P ) of P is the resultant of P and P . Hence we can write

; the coefficients of U, V have expressions as determinants of size O(d) involving the coefficients of P and P , so by Hadamard's lemma, we have in particular

By the proof of proposition 4.3.3, we have log

Therefore the precision loss taken when computing the d complex numbers

binary operations. We conclude using lemma 6.1.3.

Recognizing integers in number fields

We conclude this section with estimates on the necessary precision to recognize integers in a number field L.

We give two results according to the description of the number field. In the first description, the number field is Q(α) where α is a root of some polynomial P ∈ Z[X] with bounded coefficients, and we want to recognize an element x ∈ Z[α]. This situation arises for instance when lifting from a finite field; not much is known about the number field itself. In the second description, we assume that an LLL-reduced basis of Z L is known, and we want to recognize an element x ∈ Z L . The necessary precision is given in terms of the discriminant ∆ L of L and the height h(x) of x, defined in §4.2. Proposition 6.1.5. There exist an algorithm and an absolute constant C such that the following holds. Let L be a number field of degree d over Q

The duplication formula [START_REF] Mumford | Tata lectures on theta[END_REF]p. 221] states that for every τ ∈ H 2 , the sequence

n≥0 is a Borchardt sequence; the correct choice of square roots at each step is given by the theta constants θ 0,b (2 n τ ) themselves. By the series expansion (6.1), we have

When n tends to infinity, all the terms except m = 0 converge rapidly to zero, because Im(τ ) is positive definite. Therefore the Borchardt sequence B(τ ) converges to (1, 1, 1, 1).

We say that a set of complex numbers is in good position when it is included in an open quarter plane. The property of being in good position is invariant by nonzero complex scaling. A Borchardt sequence is given by good sign choices if for every n ≥ 0, the complex numbers t

In order to present the algorithm to recover τ ∈ H 2 from its theta quotients, we introduce four matrices

and define the matrix γ k ∈ Sp 4 (Z) for 0 ≤ k ≤ 3 by

Also recall from §2.3.2 that the genus 2 theta constants are numbered as follows [Dup06, §6.2]:

Assuming that the correct choices of square roots in the sequences B(γ k τ ) can be determined (for instance, if the sign choices in these Borchardt sequences are always good), we can compute τ ∈ H 2 from its theta quotients as follows.

Algorithm 6.2.2 ([Dup06, §9.2.3]). Input: The vector of squares of theta constants θ 2 j (τ )/θ 2 0 (τ ) for j ∈ 1, 15 , for some τ ∈ H 2 . Output: The matrix τ . but is otherwise left as a conjecture [Dup06, Conj. 9.1], [Eng09a, Conj. 9]. We managed to prove that the other three sequences B(γ k τ ) for 1 ≤ k ≤ 3 are also given by good sign choices when τ ∈ F 2 [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF]; we give the idea of the proof in §6.2.2. Then we bound the precision losses in algorithm 6.2.2 in §6.2.3.

Sign choices in the AGM method

In the sequel, we use the following notation. For τ ∈ H 2 , we write

For 1 ≤ j ≤ 3, we also write q j (τ ) = exp(-πy j (τ )).

We denote by λ 1 (τ ) the smallest eigenvalue of Im(τ ), and define

We often omit the argument τ to ease notation. We define F 2 to be the set of all τ ∈ H 2 such that the following conditions are satisfied:

The domain F 2 contains the classical fundamental domain F 2 introduced in §6.2.1. Assumptions similar to (6.3) are usual when giving analytic estimates on theta constants: for instance, the domain B in [START_REF] Streng | Computing Igusa class polynomials[END_REF] is defined by the first three inequalities of (6.3).

Theorem 6.2.4 ([Kie21]). For every τ ∈ F 2 and every 0 ≤ k ≤ 3, the Borchardt sequence B(γ k τ ) contains only good sign choices.

The proof works by giving estimates on the value of theta constants appearing as the terms of these Borchardt sequences, using the series expansion (6.1). However, the first terms of this series approximate θ a,b (τ )

When we multiply this matrix by η (n) k on the left, we obtain

In order to relate theta constants at 2 n γ k τ with theta constants at τ

k , we use the following transformation formula. For a square matrix m, we denote by m 0 the column vector containing the diagonal of m.

Then, for every τ ∈ H 2 , we have

where

and κ(γ) is an eighth root of unity depending only on γ, with a sign ambiguity coming from the choice of a holomorphic square root of det(Cτ + D).

Corollary 6.2.7. For every τ ∈ H 2 , we have the following equalities of projective tuples:

for all n ≥ 0,

where the τ (n) j are defined as in (6.4).

Precision losses in the AGM method

Once we know that the Borchardt sequences in algorithm 6.2.2 are given by good sign choices when τ ∈ F 2 , we can estimate the precision losses in this algorithm when giving approximations of theta constants at τ as input. We start with four lemmas: the first two give information on the first terms of the Borchardt sequences obtained from the series expansion (6.1), and the other ones are general results on Borchardt sequences. Lemma 6.2.10 ([Str14, Prop. 7.6 and Cor. 7.7]). Let τ ∈ F 2 , and abbreviate y 1 (τ ) as y 1 , z 1 (τ ) as z 1 , etc. Then we have:

In particular, 0.59 < |θ j (τ )| < 1.41 for j ∈ {0, 1, 2, 3}, 1.3 exp -π 4 y 1 < |θ j (τ )| < 1.37 for j ∈ {4, 6}, 1.3 exp -π 4 y 2 < |θ j (τ )| < 1.37 for j ∈ {8, 9} , and 1.05 exp -π 4 (y 1 + y 2 -2y 3 ) < |θ 12 (τ )| < 1.56. Lemma 6.2.11. There exists an angle α < π/2 such that the following holds. Let S be one of the sets {0, 1, 2, 3}, {0, 2, 4, 6}, {0, 1, 8, 9}, or {0, 4, 8, 12}. Then for every τ ∈ F 2 , the theta constants θ j (τ ) for j ∈ S are contained in an open angular sector of angle α seen from the origin.

Proof. Using the estimates of lemma 6.2.10 and the definition of F 2 in (6.3) is sufficient to conclude, except in the case S = {0, 4, 8, 12}. Consider for instance the case of S = {0, 1, 8, 9}. The absolute value of the argument of exp(iπz 2 /4) is at most π/8, hence the angle between the theta constants θ j (τ ) for j ∈ S is bounded above by π 8 + arcsin(0.348) + arcsin(0.405) < π 2 .

In the case of S = {0, 4, 8, 12}, more delicate estimates are needed. We refer to [START_REF] Kieffer | Sign choices in the AGM for genus two theta constants[END_REF] for the proof.

Hypothesis 6.2.15. There exists an algorithm such that the following holds. Let τ ∈ F 2 and N ≥ 1. Assume that max{y 1 (τ ), y 2 (τ )} ≤ 10.

Then, given an approximation of τ to precision N , the algorithm computes squares of theta constants at τ , and derivatives of theta constants at τ with respect to z 1 (τ ), z 2 (τ ), z 3 (τ ), in O(M(N ) log N ) binary operations with a precision loss of O(1) bits.

Derivatives of theta constants are uniformly bounded on the compact set defined by the conditions in hypothesis 6.2.15, hence the precision loss of O(1) bits. In order to implement an algorithm which hopefully satisfies hypothesis 6.2.15, one simply applies the Newton scheme with a large initial precision, say 1000 bits, using the naive evaluation method for theta constants [Dup06, §10.1], and everything works well.

Using hypothesis 6.2.15, we describe in §6.2.5 an algorithm to compute theta functions in uniform quasi-linear time at a given τ ∈ F 2 , using duplication formulae as in the genus 1 case. In general, in order to compute theta constants at a given τ ∈ H 2 , we first reduce τ to the fundamental domain with controlled precision losses, using an adaptation of the classical reduction algorithm for inexact input ( §6.2.6).

Extension to the whole fundamental domain

Here we describe an algorithm to evaluate theta constants and their derivatives at τ ∈ F 2 to precision N ≥ 1 within O(M(N ) log N ) binary operations, uniformly in τ , assuming hypothesis 6.2.15. There are two easy cases:

1. If τ belongs to the compact set defined in hypothesis 6.2.15, then we use Dupont's algorithm directly. For other values of τ ∈ F 2 , we fall back to one of these two cases using duplication formulae. For every τ ∈ H 2 , write

. Lemma 6.2.16. Let τ ∈ F 2 .

There are now two cases. If y 1 (τ ) ≥ CN , then we have y 2 (τ ) ≥ CN as well. Hence we can compute theta constants at τ to precision N using O(M(N )) operations with the naive algorithm. Otherwise, we have

Therefore we can find an integer k 1 = O(log N ) such that D k 1 1 (τ ) belongs to the compact set defined in hypothesis 6.2.15. The precision losses in the duplication formula for D 1 are O(1) bits per step, hence we recover theta constants at τ to precision N in O(M(N ) log N ) binary operations.

An approximate reduction algorithm

In order to evaluate theta constants at a given τ ∈ H 2 , our strategy is to reduce τ to F 2 and to compute theta constants there using the algorithm of proposition 6.2.17. However, the classical reduction algorithm described in [Str14, §6] is based on inequalities, and this causes problems on the boundary when the input is inexact. Therefore, we rather describe reduction algorithms to neighborhoods of F 2 ; we still write inequalities, but they should be understood as inclusions of intervals. Then we show the validity of the reduction algorithm on inexact input provided that the precision remains high enough. We start by defining neighborhoods of F 2 . Definition 6.2.18. Fix ε > 0, and let Y = y 1 y 3 y 3 y 2 be a symmetric 2 × 2 real matrix. Assume that Y is positive definite. We say that Y is ε-Minkowski reduced if

Let S ⊂ Sp 4 (Z) be the set of 19 matrices defining the boundary of F 2 , as in definition 6.2.3. We define the neighborhood F ε 2 of F 2 as the set of all matrices τ ∈ H 2 such that

The fundamental domain F 2 corresponds to the case ε = 0.

The approximate reduction algorithm is copied on [Str14, Alg. 6.8]. The input is a matrix τ ∈ H 2 to precision N ≥ 1, and the output is τ ∈ F ε 2 together with γ ∈ Sp 4 (Z) such that τ = γτ . We assume that the precision remains greater than |log ε| + 1 at any time. If we run out of precision, we stop and output "failure". Algorithm 6.2.19 (Reduction to F ε 2 ). Start with τ = τ and iterate the following three steps until τ ∈ F ε 2 , keeping track of a matrix γ ∈ Sp 4 (Z) such that τ = γτ :

1. Reduce Im(τ ) such that it becomes ε-Minkowski reduced.

Reduce Re

Denote by 0 < λ 1 (τ ) ≤ λ 2 (τ ) the two eigenvalues of Im(τ ), and by 0 < m 1 (τ ) ≤ m 2 (τ ) the successive minima of Im(τ ) on the lattice Z 2 . By [Str10, (5.4) p. 54], we always have

First, we detail the Minkowski reduction step.

Lemma 6.2.20. There exist an algorithm and an absolute constant C such that the following holds. Let τ ∈ H 2 and ε > 0. Then, given an approximation of τ to precision N ≥ C(Λ(τ ) + |log ε|), the algorithm computes a matrix U ∈ SL 2 (Z) such that U t Im(τ )U is ε-Minkowski reduced within O(M(N ) log N ) binary operations.

Proof. Write Im(τ ) = R t R, and consider the matrix R obtained by rounding the coefficients of 2 N R to the nearest integers. If C is chosen appropriately, then the matrix R is still invertible. We apply a quasi-linear version Therefore the matrix U t Im(τ )U is ε-Minkowski reduced provided that C is large enough.

Then, we bound then precision losses during algorithm 6.2.19.

Lemma 6.2.21. Let τ, τ ∈ H 2 , and assume that there exists a matrix γ ∈ Sp 4 (Z) such that τ = γτ . Then we have

Proof. Let R be a real 2 × 2 matrix such that R t R = Im(τ ). Then we have

|R| .

Hence log + |γ * τ | = O(max{Λ(τ ), Λ(τ )}), and a similar bound holds in the case of (γ * τ ) -1 . It remains to bound |γ|. If c, d denote the two lower blocks of γ, then Im(γ * τ ) = c Im(τ ). Therefore log + |c| = O(max{Λ(τ ), Λ(τ )}), and

Finally, we bound the upper blocks a and b of γ in a similar way, using the relation aτ

Lemma 6.2.22. There exists an absolute constant C such that the following holds. Let τ ∈ H 2 and ε > 0, and assume that the precision during algorithm 6.2.19 remains greater than |log ε| + 1. Then the number of iterations is O(Λ(τ )). Moreover, during the algorithm, the quantities log(|det(γ * τ )|) , Λ(τ ) and log |γ| remain in O(Λ(τ )).

Proof. The number of iterations is O(Λ(τ )) by [Str10, Prop. 5.16]: observe that [Str10, Lem. 5.14 and 5.15] still apply, because det Im(τ ) is strictly increasing in algorithm 6.2.19. The proof of [START_REF] Streng | Complex multiplication of abelian surfaces[END_REF]Lem. 5.17] also applies the two situations of §6.1.3 for the reconstruction of integers in L: in each situation, we compute the required precision to recognize D, P 1 and P 2 uniquely, and conclude on the cost of the whole algorithm. The computations in the case of Siegel modular equations are very similar, and we simply point out the differences in running time.

Computing period matrices

Let d L be the degree of L over Q, and fix a complex embedding µ of L. In this section, we investigate the first step of the algorithm to evaluate modular equations: given Igusa invariants (j 1 , j 2 , j 3 ) ∈ L 3 , compute a period matrix τ ∈ F 2 with Igusa invariants (µ(j 1 ), µ(j 2 ), µ(j 3 )). We assume that j 3 = 0: otherwise τ is not uniquely determined.

During the algorithm, we will consider a finite family Θ(j 1 , j 2 , j 3 ) of algebraic numbers constructed from j 1 , j 2 and j 3 . More precisely we consider Θ as a finite family of polynomials Q ∈ Q[X 1 , . . . , X n , Y ], and the algebraic numbers that we consider are constructed as roots of polynomials of the form Q(j 1 , j 2 , j 3 , x 4 . . . , x n , Y ), where x 4 , . . . , x n are previously constructed elements of Θ(j 1 , j 2 , j 3 ). When presented in this way, Θ does not depend on L, j 1 , j 2 , or j 3 . As a toy example, consider the family Θ consisting of the single polynomial X 1 -Y 2 ; then Θ(j 1 , j 2 , j 3 ) = { √ j 1 }. We call Θ a finite recipe of algebraic extensions.

If H denotes the height of (j 1 , j 2 , j 3 ), then the height of all elements of Θ(j 1 , j 2 , j 3 ) is in O Θ (H) by propositions 4.3.1 and 4.3.3.

For every complex embedding µ of L, we define B Θ,µ ≥ 0 as the minimal real number such that

for each nonzero θ ∈ Θ(j 1 , j 2 , j 3 ) and each extension µ of µ to the number field L(Θ(j 1 , j 2 , j 3 )). We can take B Θ,µ = O Θ (d L H); moreover the sum of the bounds B Θ,µ over all the complex embeddings of L is also O Θ (d L H).

A typical example of how we use B Θ,µ is as follows.

Proposition 6.3.1. There exist an algorithm and a finite recipe of algebraic extensions Θ such that the following holds. Let L be a number field, let j 1 , j 2 , j 3 ∈ L such that j 3 = 0, let µ be a complex embedding of L, and define B Θ,µ as above. Let N ≥ 1. Then, given approximations of µ(j k ) for 1 ≤ k ≤ 3 to precision N , the algorithm computes a genus 2 hyperelliptic curve C over C with Igusa invariants µ(j 1 ), µ(j 2 ), µ(j 3 ) within O M(N + B Θ,µ ) binary operations, with a precision loss of O(B Θ,µ ) bits.

Proof. Use Mestre's algorithm [START_REF] Mestre | Construction de courbes de genre 2 à partir de leurs modules[END_REF]. This algorithm involves O(1) elementary operations with complex algebraic numbers constructed from Therefore the heights of a, b, c, d, m and n are in O F (B Θ,µ ). The same is true for the integer e by eq. (6.10). This proves our claim. The algorithm to compute τ is the following. We compute the integers a, b, c, d and e using O F (M(B Θ,µ ) log B Θ,µ ) binary operations with a quasilinear version of the LLL algorithm [NSV11, NS16], using eq. (6.10). Then we apply the algorithm of [START_REF] Birkenhake | Humbert surfaces and the Kummer plane[END_REF]Prop. 4.5] to compute γ ∈ Sp 4 (Z) such that γτ 0 lies in the image of H R ; the matrix γ has a simple expression in terms of a, b, c, d, and e, hence we also have

By proposition 6.2.9, we also have

so the result follows from lemma 6.3.4.

Analytic evaluation of modular equations

We return to the case of Hilbert modular equations in Gundlach invariants for F = Q( √ 5). Let L be a number field, let µ be a complex embedding of L, and let (g 1 , g 2 ) ∈ L. We keep the notation of §6.3.1. In the following proposition, we detail the algorithm to evaluate the numerator and denominator of Hilbert modular equations of level β at (µ(g 1 ), µ(g 2 )). We assume that g 1 = 0, so that the associated Igusa invariants (j 1 , j 2 , j 3 ) satisfy j 3 = 0.

In order to avoid complicated expressions, we hide logarithmic factors in the O notation from now on. Actually O(T ) is always O(M(T log T ) log T ). Proposition 6.3.6 (Under hypothesis 6.2.15). There exist an algorithm, a finite recipe of algebraic extensions Θ, and a constant C > 0 such that the following holds. Let L be a number field, let µ be a complex embedding of L, let (g 1 , g 2 ) ∈ L 2 such that g 1 = 0, and define

Then, given approximations of µ(g 1 ) and µ(g 2 ) to precision N , the al-

Proof. We first compute the associated Igusa invariants µ(j k ) for 1 ≤ k ≤ 3 using proposition 2.3.16. Note that j 3 = 0. Using proposition 6.3.3, we compute a matrix τ 0 ∈ F 2 having these Igusa invariants in O(N + B Θ,µ ) binary operations, with a precision loss of O(log N +B Θ,µ log B Θ,µ ) bits, for a suitable choice of Θ. Then, using proposition 6.3.5, we compute τ ∈ H 2 1 such that τ has Gundlach invariants (g 1 , g 2 ), and

This costs O(N + B Θ,µ ) binary operations, with a precision loss of O(B Θ,µ ) bits. The next step is to compute the points 1 β ητ ∈ H 2 1 for all η ∈ C σ β : this costs O (N + B Θ,µ ) binary operations, with a precision loss of O(log ) bits. By lemma 6.3.4, we have for every η ∈ C σ β :

Then, we reduce the matrices H R ( 1 β ητ ) to the fundamental domain using corollary 6.2.24: we compute matrices τ η ∈ F 2 and γ η ∈ Sp 4 (Z) such that γ η ( 1 β ητ ) = τ η , for every η ∈ C σ β , with a precision loss of O(B Θ,µ + log ) bits. We also compute squares of theta constants at every τ η . This can be done in O( B 2 Θ,µ + N ) binary operations. Moreover, we have

Definition 2.3.4 yields the values of the Siegel modular forms h 4 , h 6 , h 10 , h 12 at all the matrices τ η using O( ) binary operations, and a precision loss of O(1) bits.

At the end, we evaluate D β (τ ) using eq. (6.8), and the equality

for every η ∈ C σ β . By lemma 6.2.21, O (B Θ,µ + log ) bits of precision are lost in this computation; the total cost of computing D β (t) is O (N + B Θ,µ ) binary operations.

The polynomials D β (τ )µ Ψ β,m (g 1 , g 2 , Y ) for m ∈ {1, 2}, given by the formula (6.9), are computed using product trees as in lemma 6.1.3. This also costs O (N + B Θ,µ ) binary operations, and adds a precision loss of O (B σ + log ) bits. We conclude by summing precision losses and binary costs of each step.

In the case of Siegel modular equations of level , the complexity and precision loss estimates are similar to those in proposition 6.3.6, with each occurence of replaced by 3 . A further remark is that in the Siegel case, we can avoid costly reductions to F 2 using the matrices η R from the proof of proposition 5.1.10. This is especially attractive since this reduction step is the only one whose cost is not quasi-linear in the output size.

Algebraic reconstruction

Recall that we fix F = Q( √ 5). Once the Hilbert modular equations of level β and their denominators have been computed at (g 1 , g 2 ) in every complex embedding of L, we recognize their coefficients as algebraic numbers using the methods of §6.1.3. We present two results, one in the case of lifts from a finite field, and one in the case of a general number field.

In the case of a finite field, we are given a prime power q = p d , and a monic polynomial P ∈ Z[X] of degree d, irreducible modulo p. We let M ≥ 1 be such that log |P | ≤ M . We assume that a black box provides us with approximations of the roots of P to any desired precision. Then we represent elements of F q as elements of F p [X]/(P ). Proposition 6.3.7 (Under the conditions of the previous paragraph, and hypothesis 6.2.15). There exists an algorithm such that the following holds: given g 1 , g 2 ∈ F q such that g 1 = 0 and D β (g 1 , g 2 ) = 0, the algorithm computes the polynomials

If dM = O(log p), and if moreover = O(log q), then the cost estimate simplifies to O(log 3 q) binary operations. If q = p is prime (i.e. d = 1), then the cost estimate simplifies to O( log 2 p + 2 log p) binary operations. Theorem 6.0.1 stated at the beginning of this chapter is the analogue of proposition 6.3.7 in the case of F p for Siegel modular equations, where we replace each occurence of by 3 .

Proof. Let L be the number field Q[X]/(P ), and let α be a root of P in L. We lift g 1 and g 2 to elements of Z[α] in such a way that the height of their coefficients is bounded above by log p. Then we have h(α) ≤ M + log 2, and max{h(g 1 ), h(g 2 )} ≤ log(p) + dh(α) + log(d) = O(dM + log p).

Since D β and the coefficients of Ψ β,m for m ∈ {1, 2} are elements of Z[g 1 , g 2 ] of degree O( ) and height O( log ) by theorem 5.0.1, the algebraic integers we have to recognize are all elements of Z[α], and the height of their coefficients is O( log + dM + log p). By proposition 6.1.5, we can recognize each coefficient within O( d 2 M + d log p) binary operations, provided that its values in every complex embedding of L are computed to precision at least C( log + dM + log p), where C is some absolute constant.

Let µ be a complex embedding of L, and start at precision N ≥ 1. Then µ(g 1 ) and µ(g 2 ) are obtained by replacing α by one of the complex roots of P : this can be done within O(d(M + N )) binary operations, and a precision loss of O(dM + log p) bits, via Horner's algorithm. Then we run the algorithm of proposition 6.3.6, for each complex embedding µ of L. It is enough to choose N in

binary operations, and dominates the cost of algebraic reconstruction.

If g 1 , g 2 ∈ Z are small integers, then the complexity of evaluating modular equations is quasi-linear in the output size. Proposition 6.3.8 (Under hypothesis 6.2.15). There exists an algorithm such that the following holds. Given and g 1 , g 2 ∈ Z such that max{|g 1 | , |g 2 |} ∈ O(1) and g 1 D β (g 1 , g 2 ) = 0 mod p, the algorithm computes the polynomials Ψ β,m (g 1 , g 2 ) ∈ Q[Y ] for m ∈ {1, 2} using a total of O(M( 2 log ) log ) binary operations.

Proof. In this case, we have B Θ,µ = O(1). It is sufficient to round the result of proposition 6.3.6 with N = C log , where C is an absolute constant, to the nearest integers.

From another point of view, the complexity of evaluating Hilbert modular equations for F over a number field L can be bounded in terms of the discriminant ∆ L of L and the height of the operands. We assume that an LLL-reduced basis of Z L has been precomputed. Moreover, if m L is the matrix defined in proposition 6.1.6, we assume that a black box provides us with the coefficients of m -1 L to any desired precision.

Proposition 6.3.9 (Under the conditions from the previous paragraph, and hypothesis 6.2.15). There exists an algorithm such that the following holds. Let H ≥ 1, and let g 1 , g 2 ∈ L given as quotients of integers of height at most H such that g 1 D β (g 1 , g 2 ) = 0. Then the algorithm computes

binary operations.

In the case L = Q, the cost estimate simplifies to O( H 2 + 2 H) binary operations.

Proof. For simplicity, assume that g 1 and g 2 are actually integers: in the general case we multiply D β by an appropriate power of a common denominator of g 1 and g 2 in Z L .

We know that D β (g 1 , g 2 ) and the coefficients of D β Ψ β,k (g 1 , g 2 ) are polynomials in Z[g 1 , g 2 ] of degree O( ) and height O( log ), by theorem 5.0.1. Therefore they are algebraic integers of height O( H). By proposition 6.1.6, we can recognize each coefficient within O(d 2 H + d 2 log ∆ L + d 4 ) binary operations, provided that complex approximations are computed at a precision N high enough; it is enough to take N in O(log

In order to obtain these approximations, we run the algorithm of proposition 6.3.6 in each complex embedding µ of L. For each embedding µ, the starting precision is chosen in O(log ∆ L + d H + B Θ,µ + d 2 ), for a suitable recipe of algebraic extensions Θ. Therefore the cost to compute the required complex approximations in the embedding µ is

binary operations. The sum of the bounds B Θ,µ is in O(dH), as well as each individual B Θ,µ . Therefore, the total cost of computing complex approximations in all embeddings is O(

The complexity results of propositions 6.3.7 and 6.3.9 are not entirely satisfactory: the dependence on log p in the finite field case, and on H in the number field case, is quadratic. This comes from the fact that the reduction algorithm to the Siegel fundamental domain (proposition 6.2.23) is quasiquadratic in Λ(τ ), and not quasi-linear. Reduction to the fundamental domain for elements of H 2 is essentially equivalent to lattice reduction for dimension 4 symplectic lattices; it is likely that this reduction can be done in quasi-linear time, as for Gauss's algorithm [START_REF] Schönhage | Fast reduction and composition of binary quadratic forms[END_REF][START_REF] Yap | Fast unimodular reduction: planar integer lattices[END_REF] and for als involved. We consider two cases:

• In the Siegel case, we assume nothing a priori on the ring End(A).

• In the Hilbert case, we fix a real quadratic field F and assume the existence of a real multiplication embedding Z F → End(A) † defined over F q , which is not necessarily explicit or computable.

In the Hilbert case, we further assume that splits in Z F into a product of two principal ideals generated by totally positive elements β, β ∈ Z F . By the Chebotarev density theorem, this condition holds for a constant proportion of 's as q grows to infinity; hence this assumption does not affect the asymptotic complexity of Elkies's method. Moreover, we can choose β in such a way that

. The properties of χ A are intimately related with the Rosati dual π † A of π A . For the moment, we do not make the assumption that A is simple or ordinary. We know that π † A • π A = q in End(A) [Mum70, Thm. 4 p. 206], hence Q(π A ) ⊂ End 0 (A) is a commutative subring stable under †. Moreover, the roots of χ A in C are complex numbers of the form λ 1 , λ 2 , q/λ 1 , q/λ 2 with |λ k | 2 = q for k ∈ {1, 2}. Therefore the characteristic polynomial of π A takes the form

where we set

, s 1 = r 1 + r 2 , and s 2 = r 1 r 2 .

We have |s 1 | ≤ 4 √ q and |s 2 | ≤ 4q; in fact, by the proof of [Rü90, Lem. 3.1],

we also have the inequalities

Note that ξ A ∈ End 0 (A) † . By [Mum70, Thm. 3 p. 202], this ring is either Q, Q × Q, or a real quadratic number field, and is equal to F in the Hilbert case. In the point counting context, we want to compute s 1 and s 2 mod using the action of π A on kernels of isogenies. The methods in the Siegel and Hilbert cases differ.

The Siegel case

Recall that A[ ] is endowed with an alternating, nondegenerate bilinear form denoted by (x, y) → x, y ∈ Z/ Z induced by the principal polarization of A. For all x, y ∈ A[ ], we have π A (x), π A (y) = q x, y .

(7.1)

We say that is an Elkies prime if there exists an -isogeny ϕ with domain A which is defined over F q ; equivalently, is Elkies if A[ ] admits a dimension 2 isotropic subspace which is stable under π A . Let us relate this property with the decomposition of χ A mod .

If P is a monic polynomial of degree d whose constant term a 0 is invertible, then we define its q-reciprocal polynomial as P = 1 a 0 X d P (q/X), and we say that P is q-reciprocal if P = P . If d = 2, this simply means that a 0 = q.

Proposition 7.2.1. Assume that is Elkies, and let ϕ be an -isogeny with domain A defined over F q . Let P be the characteristic polynomial of π A on ker ϕ. Then χ A = P P mod .

Proof. Choose a symplectic basis of A[ ] whose first two vectors generate ker ϕ. By (7.1), the matrix of π A in this basis takes the form M * 0 qM -t , and the characteristic polynomial of qM -t is P . Proposition 7.2.2. Let be a prime, and assume that one of the following properties holds: 1. χ A splits modulo as a product of the form P P where P and P are coprime; or 2. χ A is totally split modulo .

Then is Elkies.

We view Z F as a 2-dimensional lattice, endowed with the Euclidean distance given by the embedding Z F → C 2 , x → (x, x). Then ξ A ∈ Z F has length at most (8q) 1/2 . We claim that ξ A is uniquely determined as soon as we know the value of ξ A mod I, where I is an ideal of norm strictly greater that 16q. Indeed, if ξ, ξ are equal mod I but distinct, then N F/Q (ξ -ξ ) ≥ N (I); therefore

We can stop the point counting algorithm when we have collected the values of ξ A modulo distinct totally positive primes β 1 , . . . , β N of Z F such that N i=1 N F/Q (β i ) > 16q. Heuristically, we expect that a given β is Elkies with probability about one half, so that it is sufficient to consider Elkies primes β such that N F/Q (β) = O(log q) to complete the algorithm.

Computing the action of Frobenius on isogeny kernels

If or β is an Elkies prime, we still have to explain how to find a suitable β-or -isogeny ϕ with domain A defined over F q , and how to compute the characteristic polynomial of π A on ker ϕ. The first part, computing ϕ, is where we apply the results of the previous chapters. The second part involves polynomial systems and is more classical, being already studied in the context of Schoof's algorithm on hyperelliptic curves [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF][START_REF] Abelard | Counting points on hyperelliptic curves in large characteristic: algorithms and complexity[END_REF].

We only give a sketch of the algorithms. For simplicity, we make the following assumptions:

• The base field F q is prime, i.e. q = p; moreover p > 8 + 7 in the Siegel case, and p > 4 Tr F/Q (β) + 7 in the Hilbert case.

• A is the Jacobian of a hyperelliptic genus 2 curve C defined over F p , and has automorphism group {±1} over an algebraic closure of F p (in particular A is absolutely simple).

Moreover, we assume that the various other genericity assumptions used in the algorithms of chapters 3 and 6 hold true. For instance, in the Siegel case, we assume in particular that the denominator D of Siegel modular equations does not vanish at (j 1 (A), j 2 (A), j 3 (A)). If p is very large, say of cryptographic size, and if C is chosen at random, then all these genericity assumptions hold with overwhelming probability. The algorithm to compute ϕ can be sketched as follows; we recall that = O(log p).

Research perspectives

To conclude the thesis, we sketch several directions of research that our results suggest. They concern either improvements or generalizations of our algorithms.

• First and foremost, releasing an implementation of the algorithms of chapters 3 and 6 is in order, and perhaps even a full implementation of Elkies's method over prime finite fields in generic cases. In particular, this would allow us to compare the cost of Elkies's and Schoof's methods in the Siegel case experimentally.

• In order to implement a proved algorithm to compute genus 2 theta constants in quasi-linear time, it would be nice to prove hypothesis 6.2.15 with explicit upper bounds on the necessary initial precision in the Newton iterations. This calculation is perhaps feasible, and would be interesting also in the genus 1 case.

• The complexity of the algorithm of chapter 6 to evaluate modular equations over number fields is not quasi-linear in the output size in general. In particular, the term H 2 in proposition 6.3.9 comes from the fact that reduction to the fundamental domain F 2 ⊂ H 2 is not done in quasi-linear time, as proposition 6.2.23 shows. As we remarked at the end of chapter 6, it should be possible to reformulate this problem in terms of lattice reduction for dimension 4 symplectic lattices, and to adapt existing quasi-linear lattice reduction algorithms [START_REF] Novocin | An LLL-reduction algorithm with quasi-linear time complexity[END_REF][START_REF] Neumaier | Faster LLL-type reduction of lattice bases[END_REF] to this setting.

• In order to assess the complexity of Elkies's method for abelian surfaces, it would be interesting to generalize the known results about the distribution of Elkies primes in the case of elliptic curves [SS14, SS15] to higher dimensions.

• The isogeny algorithm of chapter 3 could be applied to the construction of explicit families of abelian surfaces with real multiplication, besides the examples presented in [GKS11, §4].