text:
# Computing the cardinality of CM elliptic curves using torsion points

## 1. Introduction

Let $`𝐊`$ be an imaginary quadratic field of discriminant $`D`$. For any integer $`t`$, let $`𝒪_t`$ be the order of conductor $`t`$ of $`𝐊`$, $`\mathrm{\Delta }_t=t^2D`$ its discriminant, and $`h_t=h(\mathrm{\Delta }_t)`$ its class number. We denote by $`\mathrm{\Omega }_t`$ the ring class field modulo $`t`$ over $`𝐊`$. By class field theory, the extension $`\mathrm{\Omega }_t/𝐊`$ can be constructed using the minimal polynomial of the modular function $`j`$ over a set of representatives $`\{𝔦_1,𝔦_2,\mathrm{},𝔦_{h_t}\}`$ of the class group $`Cl(𝒪_t)`$. An elliptic curve $``$ of invariant $`j(𝔦_r)`$ is defined over $`\mathrm{\Omega }_t`$ and has complex multiplication (CM) by $`𝒪_t`$. We denote by $`H_{\mathrm{\Delta }_t}[j](X)`$ the minimal polynomial of the $`j`$’s, namely

$$H_{\mathrm{\Delta }_t}[j](X)=\underset{r=1}{\overset{h_t}{}}(Xj(𝔦_r))$$

which is known to have rational integer coefficients.

Let $`p`$ be a rational prime number which splits completely in $`\mathrm{\Omega }_t`$, or equivalently which is the norm of an integer of $`\mathrm{\Omega }_t`$ (that is $`p=(U^2+Dt^2V^2)/4`$ for rational integers $`U`$ and $`V`$). Then we can reduce $``$ modulo a prime divisor $`𝔓`$ of $`p`$ to get an elliptic curve $`E/𝔽_p`$ having CM by $`𝒪_t`$. If $`\pi `$ denotes the Frobenius of $`E`$, then it can be viewed as an element of $`𝒪_t`$ of norm $`p`$, that is (assuming that $`\mathrm{\Delta }_t\{3,4\}`$):

(1)
$$\pi =(\pm U\pm tV\sqrt{D})/2.$$

The cardinality of $`E(𝔽_p)`$ is the norm of $`\pi 1`$, or more simply $`p+1U`$.

The $`j`$-invariant of $`E/𝔽_p`$ is the reduction of one of the $`j(𝔦_r)`$’s modulo $`p`$, that is a root of $`H(X)=H_{\mathrm{\Delta }_t}[j](X)`$ modulo $`p`$. Building $`E`$ is done as follows: find a root $`j`$ of $`H(X)`$, and deduce from that the equation of $`E`$. When $`j\{0,1728\}`$, we may take any equation $`E(j,c)`$:

$$Y^2=X^3+a_4(j)c^2X+a_6(j)c^3$$

where $`c`$ is any element of $`𝔽_p`$ and

(2)
$$a_4(j)=\frac{3j}{1728j},a_6(j)=\frac{2j}{1728j}.$$

We will note $`E(j)`$ for $`E(j,1)`$. If its cardinality is $`p+1a`$, then a curve $`E(j,c)`$ has cardinality $`p+1\left(\genfrac{}{}{1.0pt}{}{c}{p}\right)a`$ (where $`\left(\genfrac{}{}{1.0pt}{}{a}{b}\right)`$ stands for the Legendre symbol). A curve with $`\left(\genfrac{}{}{1.0pt}{}{c}{p}\right)=1`$ is a twist of $`E(j)`$. The problem is now to compute $`\mathrm{\#}E(j)`$ modulo $`p`$, or equivalently, fix the sign of $`U`$ in equation (1).

In the course of implementing the ECPP algorithm  or for cryptographic reasons, it is important to compute this cardinality rapidly. We could of course try both signs of $`U`$ yielding cardinalities $`m`$, find some random points $`P`$ on $`E(j)`$ and check whether $`[m]P=O_E`$ on $`E`$. This approach is somewhat probabilistic and we prefer deterministic and possibly faster solutions.

In the case where $`D`$ is fundamental and prime to $`6`$, the solution is to use Stark’s approach , together with tricks described in . This method is efficient, provided we can afford some precomputations. Note that in the special case where $`h_t=1`$, which includes $`j=0,1728`$, one already knows the answer (see  and the references given therein). For $`D=20`$, we have the isolated result of  (see also section 6.2 below). Since the first version***http://arxiv.org/ps/math.NT/0210173 of the present article, Ishii  has given the answer for $`D`$ of class numbers $`2`$ or $`3`$ and divisible by 3, 4, or 5.

Our approach consists in computing the action of the Frobenius of the curve on torsion points of small order, using the techniques of the SEA algorithm . These points are obtained using singular values of functions on $`X_0(\mathrm{})`$ for small prime $`\mathrm{}`$. This will give us algorithmic solutions to our motivating problem when $`\left(\genfrac{}{}{1.0pt}{}{D}{\mathrm{}}\right)1`$.

Section 2 describes properties of the modular equations defining $`X_0(\mathrm{})`$ for prime $`\mathrm{}`$ and their relations to complex multiplication over $`\overline{}`$. In Section 3, we briefly describe the necessary results used in the SEA algorithm. Section 4 contains our main contribution. We treat the special cases $`\mathrm{}=3`$ in Section 5 and $`\mathrm{}=5`$ in Section 6. Section 7 describes the very interesting case of $`\mathrm{}=7`$ and for the sake of completeness that of $`\mathrm{}=11`$. Section 8 is devoted to the particular case $`\mathrm{}=2`$. We provide numerical examples for each case. We conclude with remarks on the use of our results in our implementation of ECPP.

The books  are a good introduction to all the material described above.

## 2. Modular curves and class invariants

### 2.1. Modular polynomials

Let $`\mathrm{}`$ be a prime number. The curve $`X_0(\mathrm{})`$ parametrizes the cyclic isogenies of degree $`\mathrm{}`$ associated to an elliptic curve $`E`$ defined over a field $`𝐤`$. An equation for $`X_0(\mathrm{})`$ can be obtained as the minimal polynomial of a modular function $`f`$ invariant under $`\mathrm{\Gamma }^0(\mathrm{})`$. This modular polynomial, noted $`\mathrm{\Phi }[f](X,J)`$ is such that $`\mathrm{\Phi }[f](f(z),j(z))=0`$ for all $`z`$ such that $`\mathrm{}z>0`$, where $`j(z)`$ is the ordinary modular function.

Dedekind’s $`\eta `$ function is

$$\eta (\tau )=q^{1/24}\underset{m1}{}(1q^m)$$

where $`q=\mathrm{exp}(2i\pi \tau )`$. It is used to build suitable functions for $`\mathrm{\Gamma }^0(\mathrm{})`$ (see for instance ). For example, if

$$𝔴_{\mathrm{}}(z)=\frac{\eta (z/\mathrm{})}{\eta (z)}$$

and $`s=12/\mathrm{gcd}(12,\mathrm{}1)`$, then $`𝔴_{\mathrm{}}^{2s}`$ is a modular function for $`\mathrm{\Gamma }^0(\mathrm{})`$. The equations for small prime values of $`\mathrm{}`$ are given in Table 1 (see for instance ).

Among other classes of functions for other modular groups, we find the classical functions of Weber:

$$\gamma _2(z)=\sqrt[3]{j(z)},\gamma _3(z)=\sqrt{j(z)1728}$$

for which the corresponding modular equations are quite simple.

### 2.2. CM theory

View the class group $`Cl(\mathrm{\Delta }_t)`$ as a set of reduced quadratic primitive binary forms of discriminant $`\mathrm{\Delta }_t`$, say $`Cl(\mathrm{\Delta }_t)=\{(A,B,C),B^24AC=\mathrm{\Delta }_t\}`$ with $`h_t`$ forms in it. For a given $`Q=(A,B,C)`$, let $`\tau _Q=(B+\sqrt{\mathrm{\Delta }_t})/(2A)`$. Then $`j(\tau _Q)`$ is an algebraic integer that generates $`\mathrm{\Omega }_t/𝐊`$. Moreover, the associated curve $`E_Q`$ of invariant $`j(\tau _Q)`$ has CM by $`𝒪_t`$.

Suppose $`j(\tau )\mathrm{\Omega }_t`$. If $`u`$ is some function on some $`\mathrm{\Gamma }^0(\mathrm{})`$, then the roots of $`\mathrm{\Phi }[u](X,j(\tau ))`$ are algebraic integers. They generate an extension of $`\mathrm{\Omega }_t`$ of degree dividing $`\mathrm{}+1`$. The striking phenomenon, known for a long time, is that sometimes these roots lie in $`\mathrm{\Omega }_t`$ itself. We will note $`H_{\mathrm{\Delta }_t}[u](X)`$ for the minimal polynomial of the invariant $`u`$.

Among the simplest results in this direction, we have the following, dating back to Weber . Suppose $`\alpha `$ is a quadratic integer with minimal polynomial

$$A\alpha ^2+B\alpha +C=0$$

such that $`\mathrm{gcd}(A,B,C)=1`$ and $`B^24AC=\mathrm{\Delta }_t`$.

###### Theorem 2.1.

If $`3A`$, $`3B`$, then

$$(\gamma _2(\alpha ))=\{\begin{array}{cc}(j(\alpha ))\hfill & \text{ if }3\mathrm{\Delta }_t,\hfill \\ (j(3\alpha ))\hfill & \text{ if }3\mathrm{\Delta }_t.\hfill \end{array}$$

A companion result is:

###### Theorem 2.2.

Suppose $`2A`$. We assume that

$$B\{\begin{array}{cc}0mod4\hfill & \text{ if }2\mathrm{\Delta }_t,\hfill \\ 1mod4\hfill & \text{ if }2\mathrm{\Delta }_t.\hfill \end{array}$$

Then

$$(\sqrt{D}\gamma _3(\alpha ))=(j(\alpha )),\text{ if }2\mathrm{\Delta }_t,$$

$$(\gamma _3(\alpha ))=(j(2\alpha )),\text{ if }2\mathrm{\Delta }_t.$$

Finding a complete system of conjugate values for $`\gamma _2(\alpha )`$ (resp. $`\gamma _3(\alpha )`$), as well as for a lot of such functions, is explained in .

## 3. The foundations of the SEA algorithm

### 3.1. Division polynomials and their properties

For an elliptic $`E`$, we let $`E[n]`$ denote the group of $`n`$-torsion points of $`E`$ (over $`\overline{}`$). We let $`f_n^E(X)`$ (or simply $`f_n(X)`$) denote the $`n`$-th division polynomial whose roots are the abscissae of the $`n`$-torsion points of $`E`$. See  for its definition and properties. For instance for the curve $`E:Y^2=X^3+aX+b`$, the first values are:

$$f_0(X)=0,f_1(X)=1,f_2(X)=1,$$

$$f_3(X)=3X^4+6aX^2+12bXa^2,$$

$$f_4(X)=2X^6+10aX^4+40bX^310a^2X^28abX2a^316b^2.$$

Recurrence relations for computing $`f_n`$ are given by:

$$f_{2n}=f_n(f_{n+2}f_{n1}^2f_{n2}f_{n+1}^2),$$

$$f_{2n+1}=\{\begin{array}{cc}f_{n+2}f_n^3f_{n+1}^3f_{n1}(16(X^3+aX+b)^2)\hfill & \text{ if }n\text{ is odd},\hfill \\ & \\ 16(X^3+aX+b)^2f_{n+2}f_n^3f_{n+1}^3f_{n1}\hfill & \text{ if }n\text{ is even.}\hfill \end{array}$$

Remember that the discriminant of $`E`$ is $`\mathrm{\Delta }(E)=2^4(4a^3+27b^2)`$. We could not find a reference for the following result, though it may be classical.

###### Proposition 3.1.

Let $`m`$ be an integer. Then

$$\mathrm{Disc}(f_m)=\{\begin{array}{cc}2^4m^{(m^212)/2}(\mathrm{\Delta })^{(m^24)(m^26)/24}\hfill & \text{if }m\text{ is even and }4,\hfill \\ (1)^{(m1)/2}m^{(m^23)/2}(\mathrm{\Delta })^{(m^21)(m^23)/24}\hfill & \text{if }m\text{ is odd and }3.\hfill \end{array}$$

Swan’s theorem  can be used easily to predict the number of irreducible factors of $`f_n(X)`$ other a finite field.

### 3.2. Explicit factors of $`f_n^E(X)`$

Let $`E`$ be an elliptic curve. Suppose that we have some modular polynomial $`\mathrm{\Phi }[f](X,J)`$ for a function $`f`$ on $`\mathrm{\Gamma }^0(\mathrm{})`$. Then a root $`v`$ of $`\mathrm{\Phi }[f](X,j(E))`$ gives rise to a curve which $`\mathrm{}`$-isogenous to $`E`$, and to a factor of $`f_{\mathrm{}}^E(X)`$. This is the essence of the ideas of Elkies and Atkin that improve Schoof’s algorithm for computing the cardinality of curves over finite fields . The computations can be done using Vélu’s formulas  (see also  for technicalities related to the actual computations). We end up with a enable us to compute a factor $`g_{\mathrm{}}^E(X)`$ of $`f_{\mathrm{}}^E(X)`$.

In the table below, for prime $`\mathrm{}`$, we suppose $`v_{\mathrm{}}`$ is a root of $`\mathrm{\Phi }[𝔴_{\mathrm{}}](X,j)`$ and we give the factor $`g_{\mathrm{}}^{E(j)}(X)`$ of $`f_{\mathrm{}}^{E(j)}(X)`$ that can be obtained in Table 2.

### 3.3. The splitting of $`\mathrm{\Phi }[f](X,j(E))`$ in $`𝔽_p`$

We take the following result from  (see also ). Let $`\mathrm{}`$ and $`p`$ be two distinct primes, and $`E/𝔽_p`$ an elliptic curve. Put $`\mathrm{\#}E=p+1U`$, $`𝒟=4pU^2`$. We denote the splitting type of a squarefree polynomial $`P(X)`$ by the degrees of its factors. For instance, a polynomial of degree $`4`$ having two linear factors and one quadratic factor will be said to have splitting type $`(1)(1)(2)`$.

###### Theorem 3.1.

Let $`f`$ be a function for $`\mathrm{\Gamma }_0^{\mathrm{}}`$ and put $`\mathrm{\Psi }(X)\mathrm{\Phi }[f](X,j(E))modp`$.

If $`\left(\genfrac{}{}{1.0pt}{}{𝒟}{\mathrm{}}\right)=0`$, then $`\mathrm{\Psi }`$ splits as $`(1)(\mathrm{})`$ or $`(1)\mathrm{}(1)`$.

If $`\left(\genfrac{}{}{1.0pt}{}{𝒟}{\mathrm{}}\right)=+1`$, then $`\mathrm{\Psi }`$ splits as $`(1)(1)(r)\mathrm{}(r)`$ where $`r\mathrm{}1`$ and $`r>1`$ if $`\mathrm{}2`$.

If $`\left(\genfrac{}{}{1.0pt}{}{𝒟}{\mathrm{}}\right)=1`$, then $`\mathrm{\Psi }`$ splits as $`(r)\mathrm{}(r)`$ where $`r>1`$ and $`r\mathrm{}+1`$.

If $`k`$ denotes the number of factors of $`\mathrm{\Psi }`$, then $`(1)^k=\left(\genfrac{}{}{1.0pt}{}{p}{\mathrm{}}\right)`$.

We can make precise the first part of the theorem as follows:

###### Theorem 3.2.

Let $`p=(U^2+DV^2)/4`$. If $`\mathrm{}V`$, then $`\mathrm{\Psi }(X)`$ has $`\mathrm{}+1`$ roots modulo $`p`$.

Proof: See Kohel’s thesis . $`\mathrm{}`$

### 3.4. Elkies’s ideas

We briefly summarize Elkies’s idea . Let $`\pi `$ be the Frobenius of the curve, sending any point $`P=(x,y)`$ of $`E(\overline{𝔽_p})`$ to $`(x^p,y^p)`$.

###### Theorem 3.3.

Let $`\chi (X)=X^2UX+p`$ denote the characteristic polynomial of the Frobenius $`\pi `$ of the elliptic $`E`$ of cardinality $`p+1U`$. When $`\left(\genfrac{}{}{1.0pt}{}{𝒟}{\mathrm{}}\right)1`$, the restriction of $`\pi `$ to $`E[\mathrm{}]`$ (denoted by $`\pi |_{E[\mathrm{}]}`$) has at least one eigenvalue. To each eigenvalue $`\lambda `$ of $`\pi |_{E[\mathrm{}]}`$ corresponds a factor of degree $`(\mathrm{}1)/2`$ of $`f_{\mathrm{}}`$. We deduce that $`U\lambda +p/\lambda mod\mathrm{}`$.

We will note $`g_{\mathrm{},\lambda }(X)`$ the factor of $`f_{\mathrm{}}^{E(j)}(X)`$ associated to the eigenvalue $`\lambda `$. Let $`\omega `$ denote the order of $`\lambda `$ modulo $`\mathrm{}`$ and $`\sigma =\omega /2`$ if $`\omega `$ is even and $`\omega `$ otherwise. With these notations, one can show the following result:

###### Proposition 3.2.

The splitting type of $`g_{\mathrm{},\lambda }(X)modp`$ is $`(\sigma )(\sigma )\mathrm{}(\sigma )`$ with $`\kappa `$ factors such that $`(\mathrm{}1)/2=\kappa \sigma `$.

From this, we deduce:

###### Corollary 3.1.

The polynomial $`g_{\mathrm{},\lambda }(X)`$ splits completely modulo $`p`$ if and only if $`\lambda =\pm 1mod\mathrm{}`$.

Note also the following result of Dewaghe  in the formulation of .

###### Proposition 3.3.

Let $`r=\mathrm{Resultant}(g_{\mathrm{},\lambda }(X),X^3+a_4(j)X+a_6(j))`$. Then

$$\left(\genfrac{}{}{1.0pt}{}{\lambda }{\mathrm{}}\right)=\left(\genfrac{}{}{1.0pt}{}{r}{p}\right)$$

Classically, this enables us to fix the sign of $`\lambda `$ when $`\mathrm{}3mod4`$.

## 4. Stating the problem

Let $`4p=U^2+DV^2`$. We want to find the equation of a curve $`E/𝔽_p`$ having cardinality $`m=p+1U`$. The general algorithm is the following:

procedure BuildEWithCM($`D,U,V,p`$)

{ Input: $`4p=U^2+DV^2`$ }

1. For some invariant $`u`$, compute the minimal polynomial $`H_D[u](X)`$.

2. Find a root $`x_0`$ of $`H_D[u](X)`$ modulo $`p`$.

3. for all roots $`j`$ of $`\mathrm{\Phi }[u](x_0,J)modp`$ do

a. compute $`E(j)`$.

b. If $`\mathrm{\#}E(j)=p+1+U`$ instead of $`p+1U`$, replace $`E(j)`$ by a twist.

### 4.1. Eliminating bad curves

In general, the degree of $`\mathrm{\Phi }[u](x_0,J)`$ is larger than $`1`$ and we expect several roots in $`J`$, not all of which are invariants of the curves we are looking for.

In order to eliminate bad curves, we can use the following result. First, note that:

$$\mathrm{\Delta }(E(j))=2^{12}3^6j^2/(j1728)^3.$$

###### Proposition 4.1.

Let $`4p=U^2+DV^2`$. The number $`\mathrm{\Delta }(E(j))`$ is a square modulo $`p`$ in the following cases:

(i) $`D`$ odd;

(ii) $`4D`$ and $`2V`$.

Proof:

(i) If $`\alpha `$ is as in Theorem 2.2, we deduce that $`\sqrt{D}\gamma _3(\alpha )`$ is in $`𝒪_K`$, which means that $`H_D[\sqrt{D}\gamma _3]`$ splits modulo $`p`$ and therefore $`j1728=Du^2modp`$ and we have $`\left(\genfrac{}{}{1.0pt}{}{D}{p}\right)=+1`$ by hypothesis.

(ii) Theorem 2.2 tells us that $`(\gamma _3(\alpha ))=(j(2\alpha ))`$. But $`p`$ splits in the order $`𝒪_2`$ and therefore in $`\mathrm{\Omega }_{2t}`$, which shows that the minimal polynomial of $`\gamma _3`$ splits modulo $`p`$, proving the result. $`\mathrm{}`$

Coming back to our problem, we see that when the above result applies, a good curve is such that $`\left(\genfrac{}{}{1.0pt}{}{\mathrm{\Delta }(E(j))}{p}\right)`$ must be equal to $`1`$.

### 4.2. Deciding which curve is good

We can assume that we are left with only one possible $`j`$ and that we want to compute the cardinality of $`E(j)`$ as quickly as possible. Let us explain our idea. Let $`𝒟=DV^2`$. Suppose that $`\mathrm{}p`$ is an odd prime (the case $`\mathrm{}=2`$ will be dealt with later) and $`\left(\genfrac{}{}{1.0pt}{}{D}{\mathrm{}}\right)1`$. In that case, Theorem 3.3 applies and if we can find one eigenvalue $`\lambda `$, we can find $`Umod\mathrm{}`$. If $`U0mod\mathrm{}`$, then we can find the sign of $`U`$. Note that if $`\mathrm{}D`$, then $`U0mod\mathrm{}`$.

The most favorable case is when $`\mathrm{}𝒟`$, because then there is only one eigenvalue $`\lambda `$ (it can be a double one) and $`\lambda U/2mod\mathrm{}`$. Having $`\lambda `$ gives us immediately the sign of $`U`$. A very favorable case is when $`\mathrm{}3mod4`$, using Dewaghe’s idea.

Apart from this, there is another interesting sub-case, when we can find a rational root $`x_0`$ of $`g_{\mathrm{},\lambda }^E`$, using for instance some class invariant. In that case, we can form $`y_0^2=x_0^3+ax_0+bmodp`$ and test whether $`y_0`$ is in $`𝔽_p`$ or not. If it is, then $`\lambda =1`$, since $`(x_0,y_0)`$ is rational and $`\pi (P)=P`$. Otherwise, $`\lambda =1`$.

Our idea is then to use the general framework for some precise values of $`\mathrm{}`$, and use rational roots of $`g_{\mathrm{},\lambda }`$ obtained via class invariants. When $`\mathrm{}=3`$, we are sure to end with a rational root of $`f_3^{E(j)}(X)`$, as is the case for $`\mathrm{}=2`$ and $`f_4^{E(j)}`$. Moreover, we can use some invariant that give us the torsion points directly. We also give examples for $`\mathrm{}=5,7,11`$.

## 5. The case $`\mathrm{}=3`$

We suppose that $`4p=U^2+DV^2`$. The first subsection makes precise the above results.

### 5.1. Using $`3`$-torsion points

We begin with an easy lemma that can be proved by algebraic manipulations:

###### Lemma 5.1.

Let $`v`$ be any root of $`\mathrm{\Phi }_3^c(X,j)=0`$. Then a root of $`f_3^{E(j)}(X)`$ is given by

$$x_3=\frac{(v+27)(v+3)}{v^2+18v27}.$$

###### Proposition 5.1.

Let $`p`$ be a prime representable as $`4p=U_0^2+DV_0^2`$, for which $`3DV_0^2`$ and $`\mathrm{\#}E=p+1U`$. Suppose $`P=(x_3,y_3)`$ is a $`3`$-torsion point on $`E(j)`$ for which $`x_3`$ is rational. Let $`s=x_3^3+a_4(j)x_3+a_6(j)modp`$. Then $`U2\left(\genfrac{}{}{1.0pt}{}{s}{p}\right)mod3`$.

Proof: This is a simple application of Theorem 3.3. $`\mathrm{}`$

### 5.2. Solving the equation $`\mathrm{\Phi }_3^c(X,j(E))=0`$

#### 5.2.1. The case $`\left(\genfrac{}{}{1.0pt}{}{D}{3}\right)1`$

A solution of this equation is given by $`𝔴_3^{12}`$, which lies in $`\mathrm{\Omega }_1`$ with the hypothesis made on $`D`$.

Numerical examples. Let $`H_{15}[𝔴_3^{12}]=X^2+81X+729`$, $`p=109`$, $`4p=14^2+15\times 4^2`$, $`v_3=3`$, $`x_3=104`$, $`E:Y^2=X^3+94X+99`$; $`U=\pm 14`$. Since $`\lambda =1mod3`$, we conclude that $`U=14`$ and $`E`$ has $`109+114`$ points.

Take $`D=20`$ and $`p=349`$. We find $`(U,V)=(\pm 26,\pm 6)`$. We compute:

$$H_{20}[𝔴_3^{12}]=X^2+(7022\sqrt{20})X239154\sqrt{20}.$$

Using $`\sqrt{20}=237modp`$, a root of this polynomial is $`v_3=257`$, from which $`j=224`$ and $`E(j):Y^2=X^3+45X+30`$. Now $`\lambda =1`$, which gives us that $`\mathrm{\#}E=349+1+26`$.

#### 5.2.2. The case $`\left(\genfrac{}{}{1.0pt}{}{D}{3}\right)=1`$

We may solve the degree $`4`$ equation $`\mathrm{\Phi }_3^c(X,j(\alpha ))=0`$ directly.

In Skolem’s approach , to compute the roots of a general quartic (with $`a_1`$ and $`a_3`$ not both zero)

$$P(X)=X^4+a_1X^3+a_2X^2+a_3X+a_4$$

one uses the four roots $`X_i`$ of $`P`$ to define

(3)
$$\{\begin{array}{ccc}z_1\hfill & =& X_1+X_2X_3X_4,\hfill \\ z_2\hfill & =& X_1X_2+X_3X_4,\hfill \\ z_3\hfill & =& X_1X_2X_3+X_4.\hfill \end{array}$$

Writing $`y_i=z_i^2`$, the $`y_i`$’s are roots of

(4)
$$R(y)=y^3+b_1y^2+b_2y+b_3$$

in which

(5)
$$\{\begin{array}{ccc}b_1& =& 8a_23a_1^2,\hfill \\ b_2& =& 3a_1^416a_1^2a_2+16a_1a_3+16a_2^264a_4,\hfill \\ b_3& =& (a_1^34a_1a_2+8a_3)^2.\hfill \end{array}$$

Conversely, if the $`y_i`$’s are the roots of $`R`$ and if the $`z_i`$’s are chosen in such a way that

$$z_1z_2z_3=a_1^34a_1a_2+8a_3,$$

then the $`X_i`$’s defined by (3) (together with $`X_1+X_2+X_3+X_4=a_1`$) are the roots of $`P`$.

In our case, we find that

$$R(Y)=Y^31728Y^2576(j(\alpha )1728)Y64(j(\alpha )1728)^2$$

and the compatibility relation is $`z_1z_2z_3=8(j(\alpha )1728)`$. Since we suppose that $`3D`$, we replace $`j(\alpha )`$ by $`\gamma _2(\alpha )^3`$. In that case, the roots of $`R(Y)`$ are

$$4(\zeta _3^{2i}\gamma _2(\alpha )^2+12\zeta _3^i\gamma _2(\alpha )+144)$$

for $`i=0,1,2`$. Studying the roots of these numbers as class invariants could probably be done. The function

$$\sqrt{\gamma _2(\alpha )^2+12\gamma _2(\alpha )+144}$$

has been introduced via a different route by Birch in  and the theorems proven there could be used in our context, though we refrain from doing so in this article.

Let us summarize the algorithm to find the roots of $`\mathrm{\Phi }_3^c(X,j(E))`$ modulo $`p`$ when $`3D,3V`$ (which implies $`p1mod3`$):

1. compute $`\gamma _2modp`$;

2. compute the values $`y_i=4(\zeta _3^{2i}\gamma _2(\alpha )^2+12\zeta _3^i\gamma _2(\alpha )+144)modp`$ for $`i=1,2`$;

3. compute $`z_i=\sqrt{y_i}modp`$ for $`i=1,2`$ and $`z_3=8(\gamma _2^31728)/(z_1z_2)`$ from which $`X_1=z_1+z_2+z_336`$ is a root of $`\mathrm{\Phi }_3^c(X,j)`$.

Notice that $`\zeta _3modp`$ can be computed as follows (see  for more on this sort of ideas): since $`3p1`$, we can find $`a`$ such that $`a^{(p1)/3}1modp`$. Put $`\zeta _3=a^{(p1)/3}`$. It satisfies $`\zeta _3^2+\zeta _3+10modp`$. Therefore, finding a root costs two squareroots and one modular exponentiation, once $`\gamma _2`$ is known.

Numerical examples. Consider $`(D,p,U,V)=(40,139,\pm 14,\pm 3)`$. A root of $`H_{40}[\gamma _2](X)=X^2780X+20880`$ modulo $`p`$ is $`110`$. Using $`\zeta _3=96`$, we compute $`v_3=109`$ and $`x_3=135`$. Then $`E:Y^2=X^3+124X+129`$ has $`\lambda =1`$ and $`U=14`$.

## 6. The case $`\mathrm{}=5`$

### 6.1. Using $`𝔴_5`$

We assume here that $`\left(\genfrac{}{}{1.0pt}{}{D}{5}\right)1`$ and $`5DV^2`$. In that case, we can use some power of $`𝔴_5`$ as invariant to get a root $`v_5`$ of $`\mathrm{\Phi }_5^c(X,j)`$, thus yielding a factor $`g_5^{E(j)}`$ of $`f_5^{E(j)}`$. Writing:

$$A=v_5^2+22v_5+125,B=v_5^2+4v_51,C=v_5^2+10v_5+5,$$

one has:

$$g_5^{E(j)}(X)=X^2+2(C/B)X+(136/A)(C/B)^2.$$

Putting $`Y=(B/C)X`$ leads us to $`(Y+1)^236/A`$. At this point, since

$$j=\frac{(v_5^2+10v_5+5)^3}{v_5}$$

we also have:

$$j1728=\frac{\left(v_{5}^{}{}_{}{}^{2}+22v_5+125\right)\left(v_{5}^{}{}_{}{}^{2}+4v_51\right)^2}{v_5}$$

or $`A=v_5(j1728)/B^2`$.

#### 6.1.1. The case $`U\pm 2mod5`$

We deduce that $`p1mod5`$ and $`g_5^{E(j)}(X)`$ has two rational roots.

Examples. Take $`D=35`$ for which

$$H_{35}[𝔴_5^6](X)=X^2+50X+125.$$

Take $`(p,U,V)=(281,\pm 33,\pm 1)`$. We first use $`v_5=163`$ to compute $`E(j):Y^2=X^3+32X+115`$ and $`g_5^{E(j)}(X)=X^2+245X+198`$. From this, we get $`x_5=227`$ and find that $`x_5^3+a_4(j)x_5+a_6(j)`$ is a square in $`𝔽_p`$, so that $`\mathrm{\#}E(j)=p+1+33`$.

Consider now $`D=91`$ for which $`\left(\genfrac{}{}{1.0pt}{}{91}{5}\right)=+1`$. We find:

$$H_{91}[𝔴_5^6]=X^2+(13040\sqrt{91})X998\sqrt{91}.$$

Taking $`(p,U,V)=(571,\pm 3,\pm 5)`$, we use $`\sqrt{91}=342modp`$, find $`v_5=216`$ from which $`j=533`$ and $`E(j):Y^2=X^3+181X+311`$. Then $`g_5^{E(j)}(X)=X^2+213X+412`$ which has a root $`x_5=315`$. We find that $`\lambda =1`$ and $`U=3`$.

#### 6.1.2. The case $`U\pm 1mod5`$

One has $`p4mod5`$ and $`g_5^{E(j)}(X)`$ is irreducible; the eigenvalue is $`\lambda =U/2\pm 2mod5`$. We can compute it using the techniques of SEA, that is test the identity

$$(X^p,Y^p)=[\pm 2](X,Y)modg_5^{E(j)}(X).$$

(Actually, checking the equality on the ordinates is enough.) Depending on the implementation, this can cost more than testing $`[m]P`$ on $`E`$.

Example. Consider $`(D,p,U,V)=(35,109,\pm 11,\pm 3)`$. One computes $`v_5=76`$ and $`g_5^{E(j)}(X)=X^2+13X+13`$. We compute

$$(X^p,Y^p)(108X+96,Y(72X+43))=[2](X,Y).$$

Therefore, $`U=11`$.

Consider $`(D,p,U,V)=(91,569,\pm 1,\pm 5)`$. We find $`E(j):Y^2=X^3+558X+372`$, $`g_5^{E(j)}(X)=X^2+100X+201`$ and

$$(X^p,Y^p)[2](X,Y)$$

so that $`U=1`$.

### 6.2. A remark on the case $`D=20`$

We will take a route different from that in . Write $`p=a^2+5b^2`$. Let $`\epsilon _0=(1+\sqrt{5})/2`$ be the fundamental unit of $`(\sqrt{5})`$. We have

$$a_4=\frac{162375}{87362}\frac{89505\sqrt{5}}{174724},a_6=\frac{54125}{43681}\frac{29835\sqrt{5}}{87362}$$

and $`f_5(X)`$ has the factor:

$$X^2+\left(\frac{695}{418}+\frac{225\sqrt{5}}{418}\right)X+\frac{129925}{174724}+\frac{45369\sqrt{5}}{87362}$$

of discriminant:

$$\mathrm{\Delta }=\frac{3^2}{11^219^2}\left(\frac{7+\sqrt{5}}{2}\right)^4\left(\frac{9+\sqrt{5}}{2}\right)^2\frac{\sqrt{5}}{\epsilon _0^5}$$

which is congruent to $`\epsilon _0\sqrt{5}`$ modulo squares. Now, by , we have

$$\left(\frac{\epsilon _0\sqrt{5}}{p}\right)=\left(\frac{p}{5}\right)_4.$$

When $`p1mod20`$, $`\mathrm{\Delta }`$ is a square modulo $`p`$ and there are two abscissas in $`𝔽_p`$. Now, $`a\pm 1mod5`$ and thus

$$\mathrm{\#}E(j)1+1\pm 2mod5.$$

We can distinguish the two cases by computing $`y_5`$: It is in $`𝔽_p`$ if and only if $`m0mod5`$.

## 7. Numerical examples for $`\mathrm{}3mod4`$

### 7.1. The case $`\mathrm{}=7`$

###### Lemma 7.1.

Let $`v_7`$ be a root of $`\mathrm{\Phi }_7^c(X,j)`$ and put

$$A(v_7)=v_7^4+14v_7^3+63v_7^2+70v_77.$$

Then

$$\mathrm{Resultant}(g_{7,\lambda }^{E(j)}(X),X^3+a_4(j)X+a_6(j))=3jv_7A(v_7)S(v_7)^2$$

for some rational fraction $`S`$ with integer coefficients.

Proof: using Maple, we compute:

$$\mathrm{Resultant}(g_{7,\lambda },X^3+a_4(j)X+a_6(j))=2^{12}3^9\left(v_{7}^{}{}_{}{}^{2}+13v_7+49\right)^3\left(v_{7}^{}{}_{}{}^{2}+5v_7+1\right)^9/A^9$$

from which the result follows. $`\mathrm{}`$

Take $`D=91`$ for which

$$H_{91}[𝔴_7^4]=X^2+77X+49.$$

Take $`(p,U,V)=(107,\pm 8,\pm 2)`$. We find $`v_7=62`$ from which $`g_7^{E(j)}(X)=X^3+104X^2+44X+73`$. Using $`E(j):Y^2=X^3+101X+103`$, we find $`r=13`$ and $`\left(\genfrac{}{}{1.0pt}{}{13}{p}\right)=1`$ and therefore $`U=8`$.

For $`(D,p,U,V)=(20,569,\pm 36,\pm 7)`$, we compute:

$$H_{20}[𝔴_7^4](X)=X^2+(15\sqrt{20})X+416\sqrt{20}$$

one of which roots modulo $`p`$ is $`v_7=195`$ (taking $`\sqrt{20}=320`$). Then $`E(j):Y^2=X^3+289X+3`$ has $`g_7^{E(j)}(X)=X^3+111X^2+185X+94`$ from which $`U=36`$.

### 7.2. The case $`\mathrm{}=11`$

In that case, the modular equation is quite large. However, if we restrict to the case where $`3D`$, we can use the modular equation relating $`𝔴_{11}^4`$ and $`\gamma _2`$:

$`X^{12}1980X^9+880\gamma _2X^8+44\gamma _2^2X^7+980078X^6871200\gamma _2X^5+150040\gamma _2^2X^4`$
$`+\left(470665807865\gamma _2^3\right)X^3+\left(154\gamma _2^4+560560\gamma _2\right)X^2+\left(1244\gamma _2^2\gamma _2^5\right)X+121.`$
Consider $`(D,p,U,V)=(88,103,\pm 18,\pm 1)`$. First, we find:

$$H_{88}[𝔴_{11}^4](X)=X^266X+121$$

a root of which is $`w_{11}=21`$. Plugging this into the modular equation, we find $`\gamma _2=63`$, from which $`j=66`$ and $`E(j):Y^2=X^3+73X+83`$. Using the techniques of SEA, we find that

$$g_{11}=X^5+81X^4+22X^3+55X^2+99X+15$$

and the resultant is $`98`$, so that $`U=18`$.

Note that the techniques needed to compute $`g_{11}`$ are probably too heavy to make this case useful. However, we provide it as a non-trivial example.

## 8. The case $`\mathrm{}=2`$

The points of $`2`$-torsion cannot be used in our context, since they have ordinate $`0`$. So we must try to use $`4`$-torsion points instead. We suppose that $`D`$ is fundamental.

### 8.1. Splitting $`f_4^{E(j)}`$

Curves having rational $`2`$-torsion are parametrized by $`X_0(2)`$, or equivalently, $`j(E)=(u+16)^3/u`$. Notice that:

(6)
$$j1728=\gamma _3^2=\frac{\left(u+64\right)\left(u8\right)^2}{u}.$$

Using algebraic manipulations (and Maple), $`f_4^{E(j)}(X)`$ factors as $`P_2(X)P_4(X)`$ where:

$$P_2(X)=X^2+2\frac{u+16}{u8}X+\frac{\left(u80\right)\left(u+16\right)^2}{\left(u8\right)^2\left(u+64\right)},$$

$$P_4(X)=X^42\frac{u+16}{u8}X^312\frac{\left(u+16\right)^2}{\left(u+64\right)\left(u8\right)}X^22\frac{\left(7u+16\right)\left(u+16\right)^3}{\left(u+64\right)\left(u8\right)^3}X$$

$$\frac{\left(5u^2+640u256\right)\left(u+16\right)^4}{\left(u+64\right)^2\left(u8\right)^4}.$$

The polynomial $`P_2`$ has discriminant:

$$\mathrm{\Delta }_2(u)=12^2\frac{\left(u+16\right)^2}{\left(u8\right)^2\left(u+64\right)}.$$

The polynomial $`P_4`$ has the following property. If $`(u+64)/u=v^2`$, then it splits as a product of two quadratic polynomials:

$$G_a(X)=X^2+2\frac{\left(v^2+3\right)}{v\left(v+3\right)}X+\frac{\left(v^2+12v9\right)\left(v^2+3\right)^2}{\left(v+3\right)^2\left(v3\right)^2v^2},$$

$$G_b(X)=X^2+2\frac{\left(v^2+3\right)}{v\left(v3\right)}X+\frac{\left(v^212v9\right)\left(v^2+3\right)^2}{\left(v+3\right)^2\left(v3\right)^2v^2}.$$

###### Proposition 8.1.

Suppose that $`(D,p,V)`$ satisfies one of the conditions of Proposition 4.1 and that $`u`$ is a square. Then $`P_2`$ splits modulo $`p`$.

Proof: Equation (6) tells us that $`u(u+64)`$ is a square modulo $`p`$, which implies that $`\mathrm{\Delta }_2(u)`$ is also a square. $`\mathrm{}`$

Notice that generally, at least one of the roots of $`\mathrm{\Phi }_2^c(X,j)`$, denoted by $`u`$, will be the square of some Weber function, see .

### 8.2. Eigenvalues modulo $`2^k`$

Our idea is to use the roots of the characteristic polynomial $`\chi (X)=X^2UX+p`$ modulo powers of $`2`$ and deduce from this the sign of $`U`$ when possible. This subsection is devoted to properties of these roots.

Since $`p1mod2`$, $`\chi (X)`$ has roots modulo $`2`$ if and only if $`U0mod2`$. Modulo $`4`$, $`\chi (X)`$ has roots if and only if $`U(p+1)mod4`$, which we suppose from now on. It is not enough to look at this case, since we have $`U0mod4`$ or $`U2mod4`$ and in both cases, and we cannot deduce from this alone the sign of $`U`$. We will need to look at what happens modulo $`8`$. We list below the cases where $`\chi (X)`$ has roots modulo 8 and then relate this with the splitting of $`p`$.

###### Lemma 8.1.

The solutions of $`X^24mod8`$ are $`\pm 2`$.

###### Lemma 8.2.

Write $`\epsilon =\pm 1`$. We give in the following table the roots of $`\chi (X)`$ modulo $`8`$:

$$\begin{array}{cccc}& & & \\ pmod8\backslash Umod8& 0& 2\epsilon & 4\\ & & & \\ 1& \mathrm{}& \{\epsilon ,\epsilon +4\}& \mathrm{}\\ & & & \\ 3& \mathrm{}& \mathrm{}& \{\pm 1,\pm 3\}\\ & & & \\ 5& \mathrm{}& \{\epsilon ,\epsilon +4\}& \mathrm{}\\ & & & \\ 7& \{\pm 1,\pm 3\}& \mathrm{}& \mathrm{}\end{array}$$

###### Proposition 8.2.

Let $`4p=U^2+DV^2`$. The polynomial $`\chi (X)`$ has roots modulo $`8`$ exactly in the following cases:

(i) $`4D`$ and $`2V`$;

(ii) $`4D`$ and \[($`4V`$) or ($`2V`$ and $`D7mod8`$)\].

Proof:

(i) If $`V`$ is even, we deduce that $`U^24p4mod8`$, $`\chi (X)`$ is one of $`X^22\epsilon X+1`$ or $`X^22\epsilon X+5`$ by Lemma 8.1. The result follows from Lemma 8.2.

What can be said when $`V`$ is odd? When $`4D`$, this means that $`p=(U/2)^2+(D/4)V^2`$, implying that $`U0mod4`$ and $`p1mod4`$ (since $`D`$ is fundamental, $`D/41mod4`$), but then $`Up+1mod4`$.

When $`8D`$, then $`p=(U/2)^2+(D/4)V^2`$ with $`U\pm 2mod8`$, but $`p3mod4`$ and again $`Up+1mod4`$.

(ii) In that case, $`U`$ and $`V`$ have the same parity. If $`U`$ and $`V`$ are odd, this implies $`m=p+1U`$ is odd, so that we do not have $`2`$-torsion points. If $`U`$ and $`V`$ are even, so is $`m`$ and $`p=(U/2)^2+D(V/2)^2`$.

If $`V/2`$ is even of the form $`2V^{}`$, then $`p=(U/2)^2+4DV_{}^{}{}_{}{}^{2}`$; $`U/2`$ must be odd and $`p1mod4`$ and we conclude as in case (i).

If $`V/2`$ is odd, then $`p=(U/2)^2+DV_{}^{}{}_{}{}^{2}`$ with $`V^{}`$ odd, which implies $`U/2`$ even, that is $`U0mod8`$ or $`U4mod8`$. One has $`p(U/2)^2+Dmod8`$. If $`D7mod8`$, then $`(U,p)=(0,7)mod8`$ or $`(4,3)mod8`$ and the two characteristic polynomials have four roots modulo $`8`$. If $`D3mod8`$, then $`(U,p)=(0,3)`$ or $`(4,7)`$ modulo $`8`$ and $`\chi (X)`$ has no roots. $`\mathrm{}`$

### 8.3. Computing the cardinality of CM-curves

This section makes use of the theory of isogeny cycles described in .

With the notations of the preceding section, we suppose we are in the case where $`U=2\epsilon mod8`$, or equivalently $`4D`$ and $`2V`$, or $`4D`$ and $`4V`$.

From Proposition 8.1, we know that the factor $`P_2(X)`$ of $`f_4^{E(j)}`$ has at least two roots modulo $`p`$. If $`x_4`$ is one of these and $`s=x_4^3+ax_4+b`$, we let $`y_4=\sqrt{s}`$ (a priori in $`𝔽_{p^2}`$) and $`P=(x_4,y_4)`$. Now $`\pi (P)=\pm P`$ according to the fact that $`s`$ is a square or not. We have our eigenvalue $`\lambda _4\pm 1mod4`$. By the theory of isogeny cycles, the eigenspace $`C_4`$ generated by $`P`$ can be lifted to an eigenspace $`C_8`$ of $`E[8]`$ associated to the eigenvalue $`\lambda _8`$ which is congruent to $`\lambda _4`$ modulo $`4`$. Since $`U=2\epsilon mod8`$, we know from Lemma 8.2 that only one of the possible values of $`\lambda _8`$ reduces to a given $`\lambda _4`$, which gives us $`\epsilon `$.

In practice, $`x_4`$ is relatively inexpensive to use when $`u`$ is the square of a Weber function, which happens in the case $`4D`$ or $`D7mod8`$ (for this, one uses an invariant for $`4D`$ instead of $`D`$, and both class groups have the same class number, see ). When $`D3mod4`$, $`h_t=3h_1`$, which is not as convenient; still, a root of $`\mathrm{\Phi }_2^c(X,j)`$ exists, since it is in $`\mathrm{\Omega }_2`$ and $`p`$ splits in it.

Examples. First take $`(D,p,U,V)=(20,29,\pm 6,\pm 2)`$. We find $`u=7`$, $`j=23`$ and $`E(j):Y^2=X^3+3X+2`$. From this, $`P_2`$ has a root $`x_4=7`$ and $`\lambda _8=1`$, so that $`U=6`$.

Now take $`(D,p,U,V)=(40,41,\pm 2,\pm 2)`$. We compute $`u=16`$, $`j=39`$, $`E(j):Y^2=X^3+30X+20`$, $`x_4=19`$ and $`\lambda _8=1`$ implying $`U=2`$.

Let us turn to odd $`D`$’s. Take $`(D,p,U,V)=(15,409,\pm 26,\pm 8)`$. Then $`u=102`$, $`j=93`$, $`E:Y^2=X^3+130X+223`$, $`x_4=159`$ yielding $`\lambda _8=1`$ and $`U=26`$.

### 8.4. The case $`D`$ odd

In that case, $`\mathrm{\Phi }_2^c(X,J)`$ will have three roots in $`𝔽_p`$ or $`𝔽_{p^2}`$, that we can compute directly. This could be useful for the cases not treated by the the preceding section.

Let us try to solve the equation

$$\mathrm{\Phi }_2^c(X,J)=X^3+48X^2+768XJX+4096=0$$

directly. As in  (already used in ), we first complete the cube letting $`Y=X+16`$ to get:

(7)
$$Y^3JY+16J=0.$$

We look for $`\alpha `$ and $`\beta `$ such that this equation can be rewritten:

$$Y^33\alpha \beta Y+\alpha \beta (\alpha +\beta )0.$$

The coefficients $`\alpha `$ and $`\beta `$ are solutions of

$$W^248W+J/3=0$$

whose discriminant is $`\mathrm{\Delta }=(4/3)(J1728)`$. Having $`\alpha `$ and $`\beta `$ (in $`𝔽_p`$ or $`𝔽_{p^2}`$), we solve

$$z^3=\frac{\alpha }{\beta }$$

and we get a root

$$Y=\frac{\beta z\alpha }{z1}$$

of (7).

Since $`D`$ is odd, $`\sqrt{D}\gamma _3`$ is an invariant, so that we can write:

$$\mathrm{\Delta }=\frac{4}{3}\left(\frac{\sqrt{D}\gamma _3}{\sqrt{D}}\right)^2.$$

The computation of the roots then depends on $`\left(\genfrac{}{}{1.0pt}{}{3}{p}\right)=1`$. It is not clear that the above mentionned approach is really faster than the naive one.

## 9. Applications to ECPP and conclusion

In ECPP, the situation is as follows. We are given $`j`$ and $`m=p+1U`$ for some known $`U`$. We have to build an elliptic curve $`E`$ having invariant $`j`$ and cardinality $`m`$. We use the results of the preceding sections in the following way. We build a candidate $`E`$ and compute its cardinality $`m^{}`$. If $`m^{}=m`$, then $`E`$ is the correct answer, otherwise, we have to twist it.

In , a comparison of all possible class invariants for a given $`D`$ was made using the height of their minimal polynomial. Though it is clear that it is easier to use invariants of small height, the results of the present article show that we might as well favor those invariants that give us a fast way of computing the right equation instead.

For instance, if $`(D,6)=1`$, using Stark’s ideas whenever possible is a good thing. When $`3D`$ or $`7D`$, $`𝔴_3`$ or $`𝔴_7`$ should be preferred since we have a fast answer. Note now a new phenomenon. If we are interested in a prescribed $`p`$, we should use an invariant which depends on $`D`$, but also on $`p`$, or more precisely on the small factors of $`V`$. For instance, if $`3V`$, we can use the direct solution of $`\mathrm{\Phi }_3^c(X,J)`$. If not, we may use some case where $`\left(\genfrac{}{}{1.0pt}{}{D}{\mathrm{}}\right)=+1`$, and $`\mathrm{}V`$.

The present work has enlarged the set of $`D`$’s for which the corresponding $`E`$’s are easy to find. Nevertheless, there are cases which are badly covered (for instance odd primes which are non quadratic residues modulo $`8`$, $`3`$, $`5`$, $`7`$, such as $`D=163`$) and that will require new ideas to be treated.

Acknowledgments. The author wants to thank A. Enge for his careful reading of the manuscript and suggesting many improvements.


format: text

text:
# 1 Introduction

## 1 Introduction

The study of single particle distributions of particles produced in heavy-ion collisions gives access to the degree of thermal and chemical equilibrium at freeze-out and allows the determination of the parameters of hydrodynamical expansion models of the source.

The spatio-temporal extension of the interaction region created in such collisions is not directly observable, but the study of Bose-Einstein interferometry between identical particles provides information on the geometry and on the dynamical evolution of the particle emission sources. In particular, the correlations between produced pions give access to the size of the homogeneity region, to the duration of emission, and to various parameters characterizing the spatial extension of the fireball . In addition, by combining information from the source size in momentum-space obtained by interferometry, and from the momentum-space density provided by the single particle distributions, an average phase-space density at freeze-out can be calculated.

Compared to the two-particle correlation, the three-particle correlation can provide additional information on the chaoticity and asymmetry of the source emission . In particular, the three-pion interference produced by a fully chaotic source is sensitive to the phase of the Fourier transform of the source emission function and, hence, to the asymmetry of the source.

In this paper, we present the analysis of single particle production, and of two- and three-pion interferometry measured in the WA98 experiment for central 158$`A`$ GeV 208Pb+208Pb collisions at the CERN SPS. In addition, estimates of hydrodynamical expansion model parameters, temperature and transverse flow velocity are extracted from these results.

## 2 Experimental setup and data processing

The CERN SPS fixed target experiment WA98  combined large acceptance photon detectors with a two arm charged particle tracking spectrometer. The experimental layout is shown in Fig. 1. The 158$`A`$ GeV Pb beam interacted with a Pb target near the entrance of a large dipole magnet. The online trigger centrality selection used a forward calorimeter located at zero degrees and a mid-rapidity calorimeter measuring the total transverse energy in the pseudorapidity interval 3.2 $``$ $`\eta `$ $``$ 5.4. The results presented here have been obtained from an analysis of the complete data set. These data were taken with the most central triggers corresponding to about 10% of the minimum bias cross section of 6300 mb , with an average of 330 participating nucleons per collision. These quantities are estimated to have an overall systematic error of less than 10%.

The charged particle spectrometer made use of a 1.6 Tm dipole magnet with a 2.4$`\times `$1.6 m2 air gap which deflected the charged particles in the horizontal plane into two tracking arms located downstream, one on each side of the beam axis. The results shown here are measurements of $`\pi ^{}`$ and $`K^{}`$ observed in the negative particle tracking arm of the spectrometer. This tracking arm consisted of six multistep avalanche chambers with optical readout . Inside the chambers, triethylamine (TEA) photoemissive vapour produced UV photons along the path of charged particles, these photons being subsequently converted to visible light via wavelength shifter plates. On exit, the light was reflected by mirrors at 45 to CCD cameras equipped with two image intensifiers. The active area of the first chamber was 1.2$`\times `$0.8 m2 and that of the other five 1.6$`\times `$1.2 m2. Each CCD camera pixel viewed a region of about 3.1$`\times `$3.1 mm2 on the chambers. Downstream of the chambers, at a distance of 16.5 m from the target, a 4$`\times `$1.9 m2 time of flight wall allowed for particle identification with a time resolution of better than 120 ps. The resulting particle separation is shown in Fig.2. The $`\pi ^{}`$ rapidity acceptance ranged from $`y=2.1`$ to 3.1 with a rapidity average at 2.7, close to the mid-rapidity value of 2.9. The momentum resolution of the spectrometer was $`\mathrm{\Delta }p/p=0.005`$ at $`p=1.5`$ GeV/$`c`$, resulting in an average precision of better than or equal to 10 MeV/$`c`$ at vanishing $`p_T`$ for all the $`Q`$ variables used in the correlation analysis and defined in sections 4 and 6: $`\sigma (Q_{inv})=7`$ MeV/$`c`$, $`\sigma (Q_{TO})=10`$ MeV/$`c`$, $`\sigma (Q_{TS})=5`$ MeV/$`c`$, $`\sigma (Q_L)=3`$ MeV/$`c`$, $`\sigma (Q_T)=8`$ MeV/$`c`$, $`\sigma (Q_0)=5`$ MeV/$`c`$, $`\sigma (Q_3)=7`$ MeV/$`c`$.

Severe track quality cuts were applied, resulting in a final sample of 7.9$`\times 10^6`$ $`\pi ^{}`$, providing 13.7$`\times 10^6`$ pairs and 13.1$`\times 10^6`$ triplets for the Bose-Einstein correlation analysis.

## 3 Single particle spectra and hydrodynamical model

The study of inclusive distributions of single particles produced in heavy-ion collisions can be interpreted in the context of models of the source using hydrodynamical expansion. Within the context of such models, which assume local thermal equilibration, parameters like the temperature and collective velocity at freeze-out can be determined. In the limit of a stationary fireball, the distribution takes the simple form

$$E\frac{dN}{dp^3}\frac{dN}{m_Tdm_Tdyd\varphi }E\mathrm{e}^{(E\mu )/T}$$
(1)
where $`p`$ is the Cartesian particle momentum, $`m_T\sqrt{p_T^2+m_0^2}`$ is the transverse mass, $`p_T`$ is the transverse momentum, $`m_0`$ is the rest mass, $`y`$ is the rapidity, $`E=m_T\mathrm{cosh}(yy_{fireball})`$, $`\mu `$ is the chemical potential and $`T`$ is the temperature. In the limit where only a narrow rapidity interval close to $`y_{fireball}`$ is measured, the spectrum becomes

$$E\frac{dN}{dp^3}m_T\mathrm{e}^{m_T/T}$$

and in the case of a rapidity-integrated spectrum

$$\frac{dN}{m_Tdm_T}m_TK_1\left(\frac{m_T}{T}\right)\sqrt{m_T}\mathrm{e}^{m_T/T}$$

where $`K_1`$ is a modified Bessel function. The last approximation holds in the limit $`m_TT`$. Plotted against $`m_Tm_0`$, all particles from a thermalized emitter should show the same universal exponential behaviour. However, different additional features like transverse hydrodynamic expansion or particles originating from the decay of resonances will distort the shape of the spectrum. It is noted in  that for the popular fit with a simple exponential in $`m_T`$ (without the $`m_T`$-prefactor)

$$E\frac{dN}{dp^3}=C\mathrm{e}^{m_T/T}$$
(2)
an interpretation of the resulting slope parameter in terms of a temperature is not possible. However, since it is found to fit the measured spectrum better than the previous expressions, it is useful for obtaining an estimate of the inverse slope parameter $`T`$.

### 3.1 Data analysis

A detailed description of the analysis of the single particle spectra presented here can be found in . The correction for detector acceptance and efficiency applied to the measured spectrum is based on a precise simulation of the detector, tuned in order to reproduce the measured detector response as accurately as possible using the VENUS  event generator as input. Multiple scattering, decays and all other reactions within the detector material are taken into account. Efficiency maps depending on the hit position on each chamber, the particle momentum and its identity are applied, together with position resolution and noise simulation. Simulated events are then reconstructed using the same code as for real data, ensuring that any software-induced systematics are also taken into account. The output is then matched to the VENUS input. This correction procedure ensures that the final result is little sensitive to remaining contamination, such as pions in a kaon sample. A detailed study of the systematic uncertainty has been performed and it is found to be small, especially as regards the slope of the spectrum ($``$3%). The absolute normalisation on the other hand is more sensitive to detector instabilities which could not be perfectly simulated and is found to have an estimated uncertainty of at most 20%.

Since the statistical uncertainty on the final $`m_T`$ spectrum is negligible compared to the systematics, it is possible to apply very severe quality cuts on the reconstructed tracks and on the events used. In contrast to the Bose-Einstein analysis, only a subset of all data is kept using only run periods where the detector operation remained particularly stable. The analysis is performed separately for identified $`\pi ^{}`$ and $`K^{}`$. The final data sample consists of 4.7$`\times 10^5`$ $`\pi ^{}`$ tracks and 1.8$`\times 10^4`$ $`K^{}`$ drawn from 3.8$`\times 10^5`$ central events. Figures 3 and 4 show the detector acceptance for negative pions and kaons respectively, obtained from the simulation.

The $`\pi ^{}/\pi ^+`$ ratio and the $`K^{}/K^+`$ ratio of the number of detected pions and kaons have also been measured using two opposite magnetic field polarities. The results will be presented in a separate publication.

### 3.2 Results

Figure 5 shows the final (fully corrected) single particle spectrum for $`\pi ^{}`$ plotted as a function of the two variables $`m_T`$ and $`y`$. The form of the detector acceptance shown in Fig. 3 is clearly noticeable, except for the low $`p_T`$-low $`y`$ lobe, which has been omitted here.

Figure 6 shows the projection on the $`m_T`$ axis (normalized to a unit rapidity interval using the VENUS profile) of the two-dimensional spectrum of Fig. 5. A fit to the exponential form of eq. 2 over the interval $`m_Tm_0=[0.1,1.2]\mathrm{GeV}/c^2`$ (not shown in Fig. 6) yields $`C=5220\pm 80(stat.)\begin{array}{c}+1270\hfill \\ 200\hfill \end{array}\text{ }(syst.)`$, and $`T=0.168\pm 0.001(stat.)\begin{array}{c}+0.001\hfill \\ 0.005\hfill \end{array}\text{ }(syst.)\mathrm{GeV}`$, with a $`\chi ^2`$ per degree of freedom of 1.6. This result is in agreement with the NA49 result .

At high $`p_T`$, where perturbative QCD becomes applicable, the spectra are expected to attain a power-law behaviour as observed in numerous high energy pp measurements (see for example ). The heavy-ion data of this experiment seem to follow that trend even into the lower $`p_T`$ range. Therefore, a parametrization originally inspired by QCD  and successfully applied already to pp data  and heavy-ion data  can be used to fit the spectrum:

$$E\frac{d^3\sigma }{dp^3}=C\left(\frac{p_0}{p_T+p_0}\right)^n$$
(3)
with $`C`$, $`p_0`$, and $`n`$ taken as free parameters. A link to the more familiar exponential slope parameter $`T`$ is obtained from the derivative of this expression according to

$$T_{\mathrm{power}\mathrm{law}}=\frac{f(p_T)}{\frac{f(p_T)}{p_T}}=\frac{p_0}{n}+\frac{p_T}{n}.$$

Thus, $`p_0/n`$ characterizes the slope of the transverse momentum spectrum in the limit $`p_T0`$, while $`1/n`$ characterizes its gradient along $`p_T`$, i.e. the strength of the concave curvature. The extracted parameters are $`C=4150\pm 70`$, $`p_0=4.80\pm 1.04\mathrm{GeV}/c`$ and $`n=29.0\pm 5.9`$, which gives a slope parameter $`Tp_0/n=0.166\pm 0.005\mathrm{GeV}`$. The $`\chi ^2`$ per degree of freedom is 1.0. The same fit performed on the $`\pi ^0`$ spectrum measured by the WA98 experiment  yields $`C=5120\pm 140`$, $`p_0=5.08\pm 0.18\mathrm{GeV}/c`$, $`n=29.3\pm 0.8`$, and so $`T=0.173\pm 0.002\mathrm{GeV}`$. The acceptance for the $`\pi ^0`$ measurement being different, it is interesting to note that fitting only the $`p_T=[0.3,1.4]\mathrm{GeV}/c`$ common interval of both spectra yields $`T=0.169\mathrm{GeV}`$ for the $`\pi ^{}`$ and $`T=0.166\mathrm{GeV}`$ for the $`\pi ^0`$, showing that the result is stable with respect to the fit interval and that the spectra agree quite well.

It has also been shown that fluctuation of the parameter in an exponential distribution leads to a final distribution of the power-like form . This behaviour can be interpreted in terms of a suitable application of the nonextensive statistics of Tsallis . This interpretation is convenient to describe particle production at fluctuating $`T`$, as may occur near the phase transition. These fluctuations would exist in small parts of the hadronic system with respect to the whole system rather than between events. The average $`T`$ around which the temperature fluctuates is given by $`p_0/n=0.166`$ GeV and the relative variance of $`1/T`$ is

$$\omega =\frac{(\frac{1}{T})^2\frac{1}{T}^2}{\frac{1}{T}^2}=\frac{1}{n}=0.034,$$

both for $`\pi ^{}`$ and $`\pi ^0`$. This corresponds to a nonextensivity parameter $`q=1+\omega `$ of 1.034. This result, interpreted in the spirit of , indicates a relative fluctuation $`\mathrm{\Delta }T/T`$ of $`18.4\pm 1.9\%`$ ($`18.4\pm 0.3\%`$) for the $`\pi ^{}`$ ($`\pi ^0`$) measurement. However, this analysis neglects the contributions of resonance decays and of flow velocity distributions. Both of these effects increase the curvature of the pion spectrum. Thus the value of $`\mathrm{\Delta }T/T=18.4\%`$ should be considered an upper limit on the temperature fluctuations.

The averaged negative pion yield per unit rapidity in the acceptance window is $`1/N_{\mathrm{evt}}dN/dy=129\pm 1(stat.)\begin{array}{c}+23\hfill \\ 5\hfill \end{array}\text{ }(syst.)`$.

Figure 7 shows the same plot as above for kaons. A fit to the exponential form 2 yields $`C=1000\pm 120(stat.)\begin{array}{c}+260\hfill \\ 1\hfill \end{array}\text{ }(syst.)`$, and $`T=0.181\pm 0.005(stat.)\begin{array}{c}+0.001\hfill \\ 0.009\hfill \end{array}\text{ }(syst.)\mathrm{GeV}`$. So the inverse slope $`T`$ for kaons and pions are comparable. It should be noted that the rapidity acceptance is quite different for the two particle species, the $`\pi ^{}`$ acceptance being much closer to mid-rapidity. An estimate of the effect induced by this difference in acceptance can be made using the term $`\mathrm{cosh}(\mathrm{\Delta }y)`$ given below eq. 1. The inverse slope for $`K^{}`$ would become of the order of $`0.230\mathrm{GeV}`$. The $`K^{}/\pi ^{}`$ ratio at a common rapidity of 2.3 is $`11.4\pm 0.4(stat.)\begin{array}{c}+0.6\hfill \\ 2.7\hfill \end{array}\text{ }(syst.)\%`$, which is in agreement with the NA49 result .

### 3.3 Hydrodynamical Source Expansion Model

The single pion spectrum has been fitted in the interval $`0.05<m_Tm_0<1.2\mathrm{GeV}/c^2`$ with the Wiedemann-Heinz (W.-H.) model . It relies on the following idea: the main characteristics of the particle phase-space distribution at freeze-out can be quantified by its widths in the spatial and temporal directions, a collective dynamical component (parameterized by a flow field) which determines the strength of the position-momentum correlations in the source, and a second, random dynamical component in momentum space (parameterized by a temperature). The model emission function contains seven parameters, but the shape of the single particle transverse mass spectrum is fully determined by the temperature $`T`$ and the transverse flow rapidity profile $`\eta _T(r)=\eta _f\frac{r}{R}`$ which is assumed to depend linearly on the transverse coordinate $`r`$, where $`\eta _f`$ is the transverse flow rapidity strength, and $`R`$ the Gaussian transverse spatial width. The mean transverse flow velocity $`\beta _T`$ can be easily calculated as the mean value of $`\mathrm{tanh}(\eta _T(r))`$ over the transverse source profile. The results will be given as a function of $`\beta _T`$ rather than $`\eta _f`$, since its physical interpretation is more straightforward.

The three parameters that are allowed to vary freely during the fitting procedure are $`T`$, $`\eta _f`$, and an overall normalization factor. The result of the fit is $`T=0.084\pm 0.003\mathrm{GeV}`$ and $`\beta _T=0.50\pm 0.02`$, the $`\chi ^2/d.o.f.`$ being 1.1. The resulting curve is not shown in Fig. 6 as it is hardly distinguishable from the power-law fit. The temperature and flow parameters are strongly correlated, so it is more interesting to consider a $`\chi ^2`$ contour plot of the fit to the measured single particle spectrum as a function of those two parameters. Figure 8 shows the result assuming a Gaussian transverse spatial profile, and Fig. 9 assuming a box profile of the same rms width as the Gaussian one. Only direct pions are considered in the model. Furthermore, only statistical errors are taken into account during the fit. The curves displayed represent different confidence levels for the $`(T,\beta _T)`$ values.

The dependence of the $`\chi ^2/d.o.f.`$ on the shape of the source is very small, the best $`\chi ^2/d.o.f.`$ being slightly larger for the box profile (1.5). While the best fit temperature appears to be independent of the shape of the source, the best fit flow velocity is considerably smaller ($`\beta _T=0.29`$) for the box profile. Inclusion of the resonance decay contribution in the model calculation would be expected to reduce the extracted flow velocity parameters and increase the temperature parameters. The precise effects do however depend on details of the models used.

## 4 Two-pion correlations

Bose-Einstein interferometry is most commonly used to study pairs of identical particles. The correlation function $`C_2`$ is defined, up to a proportionality factor $`𝒩`$, as the ratio of a two-particle spectrum $`𝒫_2`$ over the product of two single particle spectra $`𝒫_1`$:

$$C_2(\stackrel{}{p}_1,\stackrel{}{p}_2)=𝒩\frac{𝒫_2(\stackrel{}{p}_1,\stackrel{}{p}_2)}{𝒫_1(\stackrel{}{p}_1)𝒫_1(\stackrel{}{p}_2)}$$

with

$$𝒫_1(\stackrel{}{p})=E\frac{dN}{dp^3}$$

and

$$𝒫_2(\stackrel{}{p}_1,\stackrel{}{p}_2)=E_1E_2\frac{dN}{dp_1^3dp_2^3}$$

where $`E_i`$ and $`\stackrel{}{p}_i`$ are the energy and momentum of particle $`i`$, respectively.

Experimentally, the product of one-particle distributions in the denominator is commonly obtained by a mixed event technique whereas the two-particle distribution in the numerator is constructed from all pair combinations of identical particles found in each event. $`C_2`$ is then normalized to unity far away from the interference region.

A fully chaotic source can be seen as a superposition of uncorrelated elementary sources, and one- and two-particle distributions may be expressed through the Wigner function of the source $`S(x,k_{12})`$ . The correlation function is then written

$$C_2(\stackrel{}{p}_1,\stackrel{}{p}_2)=1+\lambda \frac{|d^4xS(x,k_{12})\mathrm{exp}[iq_{12}x]|^2}{|d^4xS(x,k_{12})|^2}$$

with $`q_{12}=p_1p_2`$, the 4–momentum difference of the two particles, $`k_{12}=(p_1+p_2)/2`$ and $`x=(x_1+x_2)/2`$, the mean space-time coordinate of the pair emission point. The chaoticity parameter $`\lambda `$ is inserted to take into account the possibility that the source may not be fully chaotic and also that any wrongly reconstructed tracks, or tracks originating from decays of long-lived resonances, will dilute the Bose-Einstein correlations in the data.

A one-dimensional interferometry analysis is commonly made as a function of $`Q_{inv}\sqrt{q_{12}^2}`$, whereas a multidimensional analysis uses a set of $`Q`$ variables which are defined as various projections of $`q_{12}`$.

### 4.1 Data analysis and results

Two independent analyses were performed with the complete data set recorded in the negative tracking arm  totalling 13.7$`\times 10^6`$ pairs of identified $`\pi ^{}`$. These data were corrected for resolution and Coulomb effects in an iterative way . The Gamow correction was not used as it overcorrects the data in the $`Q_{inv}`$ range of 0.1 to 0.3 GeV/$`c`$. Because the finite resolution in the measurement of the $`Q`$ variables leads to an underestimate of the radii and $`\lambda `$ parameters, a correction has to be implemented in the fitting procedure. This is done by a convolution method, replacing the $`C_2(\stackrel{}{Q})`$ formula expressing the two-particle correlation function used to fit the data by

$$C_2^{rc}(\stackrel{}{Q})=r(\stackrel{}{Q},\stackrel{}{Q^{}})C_2(\stackrel{}{Q^{}})𝑑\stackrel{}{Q^{}}$$

where $`r(\stackrel{}{Q},\stackrel{}{Q^{}})`$ is the resolution function which is chosen to be Gaussian:

$$r(\stackrel{}{Q},\stackrel{}{Q^{}})=1/(2\pi )^{3/2}\mathrm{\hspace{0.25em}1}/|V|^{1/2}$$

$$\times \mathrm{exp}[1/2(\stackrel{}{Q}\stackrel{}{Q^{}})^TV^1(\stackrel{}{Q}\stackrel{}{Q^{}})]$$

The diagonal elements of the covariance matrix $`V`$ are set equal to the square of the various $`Q`$-resolutions, which are estimated by a full simulation of the experimental setup as a function of the $`k_T=|\stackrel{}{p}_{T1}+\stackrel{}{p}_{T2}|/2`$ of the pairs. The non-diagonal elements of $`V`$ are neglected, as the resolution correction has a very small effect compared to the Coulomb correction. Figure 10 shows $`C_2`$, the measured $`\pi ^{}`$$`\pi ^{}`$ correlation function, plotted as a function of $`Q_{inv}`$ before and after the resolution and Coulomb corrections. In the plot, the correction for resolution is obtained by multiplying each data point by $`C_2^{rc}(Q_{inv})/C_2(Q_{inv})`$. $`C_2`$ is clearly exponential . The solid curve is a fit of the form 1+$`\lambda _e`$exp\[-2$`Q_{inv}R_{inv}]`$ which gives $`R_{inv}=7.33\pm 0.08`$ fm and $`\lambda _e=0.788\pm 0.009`$ for $`k_T=0.116`$ GeV/$`c`$. This exponential behaviour appears not to hold in the 3-d analysis, where the projected slices are better represented by Gaussians.

The 3-d analysis of Bose-Einstein correlations has been done using two different parameterizations in the Longitudinally CoMoving System (LCMS): the standard Pratt-Bertsch fit (PB) in the 3-dimensional space of momentum differences $`Q_{TS}`$ (perpendicular to the beam axis and to the transverse momentum of the pair), $`Q_{TO}`$ (perpendicular to the beam axis and parallel to the transverse momentum of the pair), and $`Q_L`$ (parallel to the beam axis) , including a cross term $`R_{outlong}^2`$ as predicted

$$C_2=1+\lambda \mathrm{exp}[Q_{TS}^2R_{TS}^2Q_{TO}^2R_{TO}^2Q_L^2R_L^2$$

$$2Q_{TO}Q_LR_{outlong}^2]$$

and the Yano-Koonin-Podgoretskiĭ fit (YKP)  in the $`Q_0`$ (energy difference of the pair), $`Q_T`$,$`Q_L`$ space

$$C_2=1+\lambda \mathrm{exp}[Q_T^2R_T^2+(Q_0^2Q_L^2)R_4^2(QU)^2(R_0^2+R_4^2)]$$

where $`U=\gamma (1,0,0,v_L)`$, $`\gamma =1/\sqrt{1v_L^2}`$ with $`v_L`$ in units of $`c=1`$. In the YKP parameterization the different radii are invariant under a longitudinal Lorentz boost, and the speed parameter $`v_L`$ connects the local rest frame to the measurement frame (the LCMS in our case). The results as a function of the $`k_T`$ of the pairs are shown in Figs. 11 and 12 and summarized in Table 1. The $`\lambda `$ parameters of the YKP fit (not shown in Table 1) are found compatible with the $`\lambda `$ parameters of the PB fit.

The systematic errors, not included in Figs. 11 and 12, and Table 1, are estimated by varying the different analysis cuts, including the cuts used to identify the pion with the time of flight system. The systematic error on the Coulomb correction due to the error on the determination of the radius parameters is also taken into account. All these variations are added in quadrature. The total relative systematic errors on the radii $`\mathrm{\Delta }R/R`$ amount to 0.8% for $`R_{inv}`$, 1.4% for $`R_{TS}`$, 3.5% for $`R_{TO}`$, 9.1% for $`R_L`$, 0.8% for $`R_T`$, and 9.7% for $`R_4`$. Systematic errors on $`R_{outlong}^2`$ and $`v_L`$ are asymmetric and reach respectively $`\begin{array}{c}+2.2\hfill \\ 1.7\hfill \end{array}`$  fm2 and $`\begin{array}{c}+0.13\hfill \\ 0.08\hfill \end{array}`$ .

The $`R_{TS}`$ and $`R_L`$ parameters from the PB fit are in good agreement respectively with $`R_T`$ and $`R_4`$ from the YKP fit. The cross term $`R_{outlong}^2`$ from the PB fit and $`v_L`$ from the YKP fit deviate from zero. In a source undergoing a boost invariant expansion the local rest frame coincides with the LCMS. Both the cross term and $`v_L`$ expressed in the LCMS are then expected to vanish . As this is not quite the case, it suggests that the source seen within the acceptance does not have a strictly boost invariant expansion. The strong decrease of the longitudinal radius $`R_L`$ or $`R_4`$ with $`k_T`$ compared to the transverse radii $`R_T`$, $`R_{TS}`$, $`R_{TO}`$ shows a longitudinal expansion which is larger than the transverse one. Finally, the $`R_0`$ parameter (not shown in the figures), which corresponds to the duration of emission of particles from the source, is compatible with zero for all $`k_T`$ bins, excluding a long-lived intermediate phase. These results agree with the previously published WA98 results obtained using roughly half of the present data sample . The WA98 analysis is compatible with the NA49 results obtained in a slightly different rapidity range ($`y=3.2`$) with unidentified negative particles .

### 4.2 Comparison with a hydrodynamical model based simulation

The W.-H. model can be used to generate correlation functions which can be compared to the data. For that purpose, all necessary integrations are performed numerically  to get the value of $`C_2`$ in the PB parameterization for given values of $`Q_{TS}`$, $`Q_{TO}`$, $`Q_L`$, $`k_T`$, and the rapidity $`Y=(y_1+y_2)/2`$ of a pair. To simulate properly the acceptance of the negative tracking arm, the mean values of $`k_T`$ and $`Y`$ for each $`(Q_{TS},Q_{TO},Q_L)`$ bin are calculated using real data, and then for each bin the mean values $`(Q_{TS},Q_{TO},Q_L,k_T,Y)`$ are used as input for the hydrodynamical calculation. This procedure is repeated for all five $`k_T`$ intervals used in the data analysis. The correlation functions are generated neglecting contribution from resonances, using $`T=85`$ MeV, $`\eta _f=0.5`$ (values extracted from the single particle spectra analysis), $`R=8`$ fm, $`\tau _0=11`$ fm/$`c`$, $`\mathrm{\Delta }\tau =2`$ fm/$`c`$ and $`\mathrm{\Delta }\eta =1.3`$ (see  for definitions of the parameters). Figure 13 shows the Bose-Einstein radii extracted from fitting the simulated correlation functions with the PB formula. The error bars used to perform these fits are taken to be the same as the ones calculated for the real data in each $`(Q_{TS},Q_{TO},Q_L)`$ bin. The measured results are shown on the same plot, and the agreement is found to be good. The shift in the the cross term $`R_{outlong}^2`$ between data and simulation is compatible with the systematic uncertainty.

## 5 Average pion phase-space density at freeze-out

As the $`m_T`$ spectrum gives the momentum-space density at freeze-out and as the Bose-Einstein correlation radii provide information on the covariant volume for particles of momentum $`\stackrel{}{p}`$, it is possible, by combining these results, to extract the average phase-space density $`f(p_T,y)`$ at freeze-out :

$$f=\frac{\sqrt{\lambda }}{(\frac{E_\pi }{\pi ^{3/2}})R_{TS}\sqrt{R_{TO}^2R_L^2R_{outlong}^4}}\frac{dn}{dyp_Tdp_Td\varphi }$$

with $`E_\pi =\sqrt{m_\pi ^2+p^2}=m_T\mathrm{cosh}y`$. The radii and $`\lambda `$ are functions of $`p_T`$ and $`y`$. The factor $`\lambda `$, which comes from the two-pion correlation analysis, corrects for contributions of pions originating from long-lived resonances decaying close to the primary vertex. A difficulty of this method is to include only the contribution of the real pions in the determination of $`\lambda `$, excluding backgrounds from misidentified particles. This is achieved by applying to $`\lambda `$, separately for each $`k_T`$ bin, a correction factor obtained from a full simulation of the experimental setup, taking into account geometrical acceptance, backgrounds and efficiency of the chamber-camera-time of flight system. The effects can be seen in Fig. 11, bottom right, where $`\lambda `$ with and without correction is displayed.

Figure 14 and Table 2 show the results on the average phase-space density for $`\pi ^{}`$ as a function of $`p_T`$. The error bars reflect the statistical errors only. The systematic uncertainties are dominated by the uncertainty of the correction on the $`\lambda `$ parameter, which is estimated to be 20%, and by the systematic error on $`R_L`$, giving a total of 13.7% systematic error on $`f`$. Within errors, all nuclear collision measurements at the SPS are found to be indistinguishable , and our result at mid-rapidity agrees well with these previous measurements. The dashed lines indicate Bose-Einstein density distributions $`f=[\mathrm{exp}(E_\pi /T)1]^1`$ of static sources of pions ($`E_\pi m_T`$) for three choices of the freeze-out temperature $`T`$: 80 MeV, 100 MeV, and 120 MeV, from the lower to the higher curve. The results are in rough agreement with the 100 MeV distribution at low $`p_T`$, but show a clear deviation from a Bose-Einstein distribution at high $`p_T`$. As pointed out in , this deviation is mainly due to the strong longitudinal expansion of the fireball which reduces the spatially averaged phase-space density and, to a lesser extent, due to the radial collective flow, which adds extra transverse momentum to the particles compared to particles emitted by a static source. Consequently, even in the absence of transverse flow, $`f`$ will be reduced compared to a Bose-Einstein density distribution. This effect may necessitate a positive pion chemical potential in order to match the experimental observation. Such a positive potential can be related to the presence of pions from short-lived resonance decays. The Tomás̆ik-Heinz (T.-H.) model  used to fit the data assumes a thermalized fireball with a longitudinally boost-invariant expansion and a transverse flow rapidity profile which depends linearly on the transverse coordinate. This model includes a pion chemical potential and has three free parameters, the freeze-out temperature $`T`$, the strength of the transverse flow rapidity profile $`\eta _t`$, and $`\mu _0`$, the chemical potential value in the center of the fireball. In Fig. 14, the full line is a fit of the T.-H. model with a box transverse density profile, whereas the point-dashed line is a fit of the same model with a Gaussian transverse profile. Both fits agree well with the data with a $`\chi ^2/d.o.f.`$ of 0.78 and 0.93 for respectively the box and the Gaussian profiles, giving $`T=87\begin{array}{c}+52\hfill \\ 27\hfill \end{array}\text{ }`$ MeV, $`\eta _t=0.49\begin{array}{c}+0.07\hfill \\ 0.22\hfill \end{array}\text{ }`$ and $`\mu _0=57\begin{array}{c}+29\hfill \\ 125\hfill \end{array}\text{ }`$ MeV for the box profile. This $`\eta _t`$ result corresponds to a mean transverse flow velocity $`\beta _T=0.42\begin{array}{c}+0.05\hfill \\ 0.18\hfill \end{array}\text{ }`$.

Due to the lack of experimental points at large $`p_T`$, the T.-H. model with the Gaussian profile provides very loose estimates of these parameters, which are nevertheless compatible with those from the box profile. Figure 15 shows the $`\chi ^2`$ contour plot for the T.-H. model with the box profile for $`T`$ and $`\eta _t`$. The curves represent (starting from the centre) contours at 39%, 70% and 99% confidence level. The best fit is obtained for a pion chemical potential $`\mu _0=57`$ MeV (black square) but a solution with $`\mu _0=0`$ MeV is also possible (full circle). On the other hand, a large pion chemical potential at freeze-out, close to the Bose condensation limit of $`\mu _0=m_\pi `$, as could be speculated given the rather low mass of the pion, seems to be excluded in view of the error bar on $`\mu _0`$. The results of the fit of the W.-H. model on the single $`\pi ^{}`$ spectrum can be compared to the fit of the T.-H. model on the phase-space distribution. The agreement is good for $`T`$, and satisfactory for $`\beta _T`$ when taking into account the systematic error. It should be noted that the constraint provided by the fit of the T.-H. model is weak compared to the one given by the W.-H. model because of the relatively small amount of experimental points in the phase-space distribution. Moreover the T.-H. model uses a pion chemical potential whereas the W.-H. model doesn’t. Finally, as $`f`$ is the pion occupation per 6-d position$``$momentum cell, the obtained values do not provide striking evidence for the presence of an excess of pions or for the presence of large disoriented chiral condensates. This chiral condensate phenomena has been investigated by other means within WA98 .

## 6 Three-pion correlations

In the hypothesis of a fully chaotic source of identical particles, the two-pion correlation function can be written $`C_2=1+|F_{12}|^2`$ where $`|F_{12}|^2`$ is the Fourier transform squared of the space-time source function. The three-pion correlation function is then $`C_3=1+|F_{12}|^2+|F_{23}|^2+|F_{31}|^2+2\text{Re}\{F_{12}F_{23}F_{31}\}`$. The terms $`|F_{ij}|^2`$, which express the contribution of the three combinations of the two-pion correlations contained in the triplet (123), provide the largest contribution to $`C_3`$. The last term only represents the genuine three-body correlation. It can be written $`2|F_{12}||F_{23}||F_{31}|W`$, where $`F_{ij}`$ is defined as $`|F_{ij}|\mathrm{exp}[i\varphi _{ij}]`$ and $`W\mathrm{cos}(\varphi _{12}+\varphi _{23}+\varphi _{31})`$. The simultaneous measurement of $`C_2`$ and $`C_3`$ provides information on $`W`$, the cosine of the sum of the three phases of the Fourier transforms. In contrast, the measurement of $`C_2`$ alone gives access only to the radii of the source and not to the phases. If the emission source is fully chaotic, $`W`$ measures the asymmetry of the source. In the presence of not fully chaotic sources, which is likely to be the case, $`W`$, the strength of the true three-body correlation, is basically sensitive to the coherence. So, in the framework of the partially coherent model , $`W`$ gives information on the degree of chaoticity of the emission source in a manner which is insensitive to backgrounds such as the contributions from resonances. The complete data set recorded with the negative tracking arm yielded a total of 13.1$`\times 10^6`$ triplets of $`\pi ^{}`$.

After correction for resolution and Coulomb effects 111 The Coulomb correction applied to a particular triplet is the product of the Coulomb corrections used for the three pair combinations contained in that triplet., a strong $`C_3`$ signal is observed (Fig. 16) as a function of $`Q_3\sqrt{Q_{12}^2+Q_{23}^2+Q_{31}^2}`$ with $`Q_{ij}\sqrt{(p_ip_j)^2}`$, which can be fitted by a double exponential function

$$C_3=1+\lambda _1\mathrm{exp}[2Q_3R_1]+\lambda _2\mathrm{exp}[2Q_3R_2]$$

with fitted parameters $`R_1=5.08\pm 0.26`$ fm, $`\lambda _1=3.12\pm 0.27`$, $`R_2=1.66\pm 0.08`$ fm, $`\lambda _2=0.341\pm 0.046`$ and $`\chi ^2/d.o.f.=1.10`$. Such non-Gaussian behaviour was in fact predicted by a final-state rescattering model . After the measurement of $`C_2`$ and $`C_3`$, the data are analysed again and the experimental value of $`W`$ is calculated using

$$W=\frac{\{C_3(Q_3)1\}\{C_2(Q_{12})1\}\{C_2(Q_{23})1\}\{C_2(Q_{31})1\}}{2\sqrt{\{C_2(Q_{12})1\}\{C_2(Q_{23})1\}\{C_2(Q_{31})1\}}}$$

individually for each triplet found, characterized by $`Q_3`$ and by the values $`Q_{12}`$, $`Q_{23}`$, and $`Q_{31}`$ corresponding to the three pair combinations contained in the triplet.

As described earlier, the estimate of systematic errors is done by varying the different analysis cuts, both in the two- and three-pion correlation analysis. The effects on $`W`$ of the statistical errors in the measurement of $`C_2`$ and $`C_3`$ are treated as systematic errors by changing $`C_2`$ ($`C_3`$) by $`\pm \sigma _{C_2}`$ ($`\pm \sigma _{C_3}`$). This last source of error dominates the other ones. All these variations are then added in quadrature.

Figure 17 and Table 3 show $`W`$ as a function of $`Q_3`$ for $`Q_360`$ MeV/$`c`$, beyond which the $`W`$ significance is too low. The error bars include statistical and systematic errors. The statistical errors (not shown separately in Fig. 17) are by comparison negligible. In view of the errors, no significant $`Q_3`$ dependence is observed. The genuine three-pion correlation is found to be substantial with a weighted mean over the five bins $`W=0.735\pm 0.004(stat.)\pm 0.146(syst.)`$. 222 The weighted systematic error is obtained by calculating the weighted average over the five $`Q_3`$ bins separately for each kind of systematic error. These errors are then added in quadrature. On the other hand, adding quadratically the systematic errors of the five $`Q_3`$ bins, as done for weighted statistical errors, would give $`\pm 0.078`$ instead of $`\pm 0.146`$ for the systematic uncertainty.

This result is in agreement with the previously published WA98 result obtained using about half of the present data sample , where a more detailed description of the three-pion analysis method can also be found. More recently, the NA44 experiment  obtained with lower statistics a factor $`W`$ which agrees with our results.

## 7 Conclusions

We have studied $`m_T`$ distributions for identified $`\pi ^{}`$ and $`K^{}`$ produced in central Pb+Pb collisions at 158$`A`$ GeV. The W.-H. hydrodynamical model has been fitted to the pion spectrum. The resulting fitted parameters favor a combination of a relatively low temperature $`T`$ $``$85 MeV and an average transverse flow velocity $`\beta _T`$ $``$0.50. The shape of the $`\pi ^{}`$ $`m_T`$ distribution is in good agreement with the $`\pi ^0`$ $`m_T`$ distribution measured in the same experiment.

Bose-Einstein interferometry of $`\pi ^{}`$ pairs gives fitted radii of typically 7 fm. This has to be compared to the equivalent rms radius of the initial Pb ion of 3.2 fm, indicating an expanded emission volume at freeze-out.

The analysis of two-pion correlations has been performed as a function of $`k_T`$ using two different parameterizations in the LCMS. The results are consistent between the standard 3-dimensional Pratt-Bertsch fit and the Yano-Koonin-Podgoretskiĭ fit.

A clear dependence of all radius parameters on $`k_T`$ is observed, with a stronger dependence for the longitudinal radii, indicating a larger longitudinal than transverse expansion. Both the cross term $`R_{outlong}^2`$ from the PB fit and $`v_L`$ from the YKP fit deviate from zero, which suggests that the source seen within the acceptance does not undergo a strictly boost invariant expansion. Moreover the short duration of emission disfavours any long-lived intermediate phase.

A comparison of the data with a hydrodynamical simulation based on the Wiedemann-Heinz model, and taking into account acceptance and resolution effects has been made for the radii parameters as a function of $`k_T`$. The agreement is found to be very good.

The average pion phase-space density at freeze-out has been calculated from measured quantities as a function of $`p_T`$. The results indicate a clear deviation from a Bose-Einstein distribution at high $`p_T`$, but are very well fitted by the Tomás̆ik-Heinz model. The pion chemical potential, which is included in the model, is found to be compatible with zero, while a large pion chemical potential close to the condensation limit of $`m_\pi `$, seems to be excluded.

Finally, we have studied the $`\pi ^{}\pi ^{}\pi ^{}`$ interference and found a substantial contribution of genuine three-pion correlations in central collisions. For $`Q_3`$60 MeV/$`c`$ a weighted mean of the strength of the genuine three-pion correlations $`W=0.735\pm 0.004(stat.)\pm 0.146(syst.)`$ was extracted. This is somewhat smaller than what is expected for a fully chaotic and symmetric source.

Acknowledgements
We would like to thank the CERN-SPS accelerator crew for providing an excellent Pb beam. This work was supported jointly by the German BMBF and DFG, the U.S. DOE, the Swedish NFR, the Dutch Stichting FOM, the Swiss National Fund, the Humboldt Foundation, the Stiftung für deutsch-polnische Zusammenarbeit, the Department of Atomic Energy, the Department of Science and Technology and the University Grants Commission of the Government of India, the Indo-FRG Exchange Programme, the PPE division of CERN, the INTAS under contract INTAS-97-0158, the Polish KBN under the grant 2P03B16815, the Grant-in-Aid for Scientific Research (Specially Promoted Research & International Scientific Research) of the Ministry of Education, Science, Sports and Culture, JSPS Research Fellowships for Young Scientists, the University of Tsukuba Special Research Projects, and ORISE. ORNL is managed by UT-Battelle, LLC, for the U.S. Department of Energy under contract DE-AC05-00OR22725.


text:
# QUANTUM-CLASSICAL INTERACTIONS AND GALOIS TYPE EXTENSIONS This work was partially sponsored by the Polish Committee for Scientific Research (KBN) under Grant No. 5P03B05620.

## 1 Introduction

The study of highly organized structures of matter leads to the investigation of some non-standard physical particle systems and effects. The fractional quantum Hall effect provides an example of a system with a well-defined internal order . Other interesting structures appear in the so-called $`\frac{1}{2}`$-electronic magnetotransport anomaly , high temperature super-conductors or laser excitations of electrons. In these cases, anomalous behaviour of electrons occurs. An example is also given by the concept of statistical-spin liquids (see  and references therein).

It seems interesting to develop an algebraic approach to the unified description of all these new structures and effects. To this purpose, it is natural to assume that the whole world is divided into two parts: a classical particle system and its quantum environment. The classical system represents the observed reality, particles that really exist. The quantum environment represents all quantum possibilities that can become part of reality in the future . The goal of this paper is to sketch a proposal of an algebraic model to describe interactions responsible for the appearance of the aforementioned highly organized structures. This model is based on a general algebraic formalism of Hopf algebras and Galois extensions of rings .

Our construction can be described in two steps. The first step concerns the transformation of the initial particles under interaction into composite systems consisting of quasi-particles and quanta. Such systems represent possible results of interactions . In the second step, we describe the algebra of realizations of quantum possibilities. This step is connected with the construction of an algebra extension and with a ‘decision’ which possibility can be realized and which one cannot. The problem how such ‘decisions’ are made was solved in  with the help of quantum commutativity and generalized Pauli exclusion principle. Our approach is based on the previously developed concept of particle systems with generalized statistics and quantum symmetries .

The paper is organized as follows. In Section 2, we propose our general model within the framework of Hopf algebras and Galois extensions of rings. Then, in the subsequent section, we review Hopf-algebraic generalities. This recalls mathematical concepts employed in our proposal and allows us to specialize in the final section to the setting already appearing in some physical models. Since there are many interesting finite quantum groups related to spin coverings (e.g., ) and the appearance of quantum symmetry in physics is more and more pronounced (e.g., ), our hope is that our general model will help us to understand some physical phenomena that cannot be adequately described by earlier methods.

## 2 The main idea

Let us consider a system of charged particles interacting with an external quantum environment. We assume that every charge is equipped with the ability to absorb and emit quanta of a certain nature. A system that contains a charge and a certain number of quanta as a result of interaction with the quantum environment is said to be a dressed particle . A particle dressed with a single quantum is a fictitious particle called quasi-particle. Our model is based on the assumption that every charged particle transforms under interaction into a composite system consisting of quasi-particles and quanta . This system represents possible results of interactions. Note that the process of absorption of quanta by a charged particle should be described as the creation of quasi-particles, whereas the emission as the annihilation of quasi-particles.

In our model the quantum environment is represented by a tensor category $`𝒞=𝒞(,𝐤)`$ with duals . All possible physical processes are represented as arrows of the category $`𝒞`$. If $`f:𝒰𝒱`$ is an arrow from $`𝒰`$ to $`𝒱`$, then the object $`𝒰`$ represents physical objects before interactions and $`𝒱`$ represents possible results of interactions. Different objects of the category $`𝒞`$ describe physical objects of different nature, charged particles, quasi-particles or different species of quanta of an external field, etc. If $`𝒰`$ is an object of $`𝒞`$ representing particles, quasi-particles or quanta, then the object $`𝒰^{}`$ corresponds to anti-particles, or quasi-holes or dual fields, respectively. In the same fashion, if $`𝒰`$ represents charged particles and $`𝒱`$ describes certain quanta, then the product $`𝒰𝒱`$ encodes a composite system containing both particles and quanta. An arrow $`𝒰𝒰𝒱`$ means an interaction causing the passage from a single particle state to a composite quantum system. Thus the arrow $`𝒰𝒰𝒱`$ describes a process of absorption. Much in the same way, we conclude that the arrow $`𝒰𝒱𝒰`$ describes a process of emission.

In our approach a unital and associative algebra $`𝒜`$ in the category $`𝒞`$ represents the classical states of a system. The multiplication $`m:𝒜𝒜𝒜`$ is a morphism in this category representing the creation of a single object of reality from a composite system of objects of the same species. Quanta are encoded in a finitely generated coquasitriangular Hopf algebra $``$. Quasi-particles are described by a new algebra $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$, which is an extension of $`𝒜`$. Interactions are described by a right action and coaction of $``$ on the algebra $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$. It is natural to assume that the algebra $`𝒜`$ is invariant and coinvariant with respect to the action and coaction of $``$, respectively, i.e., $`𝒜=(𝒜^{\mathrm{𝑒𝑥𝑡}})^{}=(𝒜^{\mathrm{𝑒𝑥𝑡}})^{\mathrm{𝑐𝑜}}.`$ (Here $`(𝒜^{\mathrm{𝑒𝑥𝑡}})^{}`$ is the set of $``$-invariants and $`(𝒜^{\mathrm{𝑒𝑥𝑡}})^{\mathrm{𝑐𝑜}}`$ the set of $``$-coinvariants.)

We would like to represent the interaction of a charged particle with external quanta as a process of creation or annihilation of quasi-particles. A composite system of quasi-particles and quanta is described by a tensor product $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$ representing all possible quantum configurations coming as a result of the quantum absorption process. On the other hand, a composite system of two quasi-particles (related to the same particle) is described by a tensor product $`𝒜_𝒜^{\mathrm{𝑒𝑥𝑡}}𝒜^{\mathrm{𝑒𝑥𝑡}}`$. When $``$ is a group-ring Hopf algebra $`𝐤G`$, our model assumes that an element of $`G`$ can be understood as a specific charge characterizing an internal degree of freedom of a quasiparticle. We also assume that these charges are additive. Mathematically, this means that the algebra $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$ is $`G`$-graded, and that this grading is strong. As explained in the subsequent sections, the strongness of the $`G`$-grading of $`𝒜^{ext}`$ is known to be equivalent to the bijectivity of the canonical map

$$\beta :𝒜_𝒜^{\mathrm{𝑒𝑥𝑡}}𝒜^{\mathrm{𝑒𝑥𝑡}}𝒜^{\mathrm{𝑒𝑥𝑡}}.$$
(1)
The bijectivity of this map means that the coaction $`𝒜^{\mathrm{𝑒𝑥𝑡}}𝒜^{\mathrm{𝑒𝑥𝑡}}`$ is Galois. ($`𝒜^{\mathrm{𝑒𝑥𝑡}}`$ is a Hopf-Galois $``$-extension of $`𝒜`$.)

An advantage of the above Galois condition is that it makes sense for an arbitrary Hopf algebra $``$ and does not force $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$ to be a crossed-product algebra $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$ \[24, p.101\]. Thus, if we think of $``$ as ‘the group algebra of a quantum group’, we have a rather general mathematical formalism capable of describing quasi-particles with the possible charges that are labeled by ‘the elements of a quantum group’ and additive according to the multiplication of $``$. This way the Galois condition corresponds to the additivity of charges.

## 3 Quantum commutativity and Hopf-Galois extensions

Let $``$ be a Hopf algebra over a ground field $`𝐤`$, and let $`m,\eta ,\mathrm{},\epsilon ,S`$ denote its multiplication, unit, comultiplication, counit and antipode, respectively. We use the following notation for the coproduct in $``$. If $`h`$, then $`\mathrm{}(h):=\mathrm{\Sigma }h_{_{(1)}}h_{_{(2)}}`$. We assume that $``$ is a coquasitriangular Hopf algebra (CQTHA) (e.g., see \[24, p.184\]). This means that $``$ is equipped with a convolution invertible homomorphism $`bHom(,𝐤)`$ such that

$`\mathrm{\Sigma }b(h_{_{(1)}},k_{_{(1)}})k_{_{(2)}}h_{_{(2)}}=\mathrm{\Sigma }h_{_{(1)}}k_{_{(1)}}b(h_{_{(2)}},k_{_{(2)}}),`$ (2)
$`b(h,kl)=\mathrm{\Sigma }b(h_{_{(1)}},k)b(h_{_{(2)}},l),`$ (3)
$`b(hk,l)=\mathrm{\Sigma }b(h,l_{_{(2)}})b(k,l_{_{(1)}}),`$ (4)
for every $`h,k,l`$. We call such a bilinear form $`b`$ a coquasitriangular structure on $``$.

Another ingredient of our model is the concept of quantum commutativity . Let $`𝒜`$ be a unital and associative algebra and $``$ be a Hopf algebra. If $`𝒜`$ is a right $``$-comodule such that the multiplication map $`m:𝒜𝒜𝒜`$ and the unit map $`\eta :𝐤𝒜`$ are $``$-comodule maps, then we say that it is a right $``$-comodule algebra. The algebra $`𝒜`$ is said to be quantum commutative with respect to the coaction of $``$ and its coquasitriangular structure $`b`$ if an only if we have the relation

$$\begin{array}{c}ab=\mathrm{\Sigma }b(a_{(1)},b_{(1)})b_{(0)}a_{(0)}.\end{array}$$
(5)
Here $`\rho (a)=\mathrm{\Sigma }a_{(0)}a_{(1)}𝒜`$, and $`\rho (b)=\mathrm{\Sigma }b_{(0)}b_{(1)}𝒜`$ for every $`a,b𝒜`$. The Hopf algebra $``$ is called a quantum symmetry of $`𝒜`$.

Finally, let us recall the definition of a Hopf-Galois extension. An algebra extension $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$ of $`𝒜`$ such that it is a right $``$-comodule algebra and $`𝒜`$ is its coinvariant subalgebra

$$\begin{array}{c}𝒜(𝒜^{\mathrm{𝑒𝑥𝑡}})^{\mathrm{𝑐𝑜}}:=\{a𝒜^{\mathrm{𝑒𝑥𝑡}}:\delta (a)=a1\}\end{array}$$
(6)
is said to be an $``$-extension. If in addition the map $`\beta :𝒜_𝒜^{\mathrm{𝑒𝑥𝑡}}𝒜^{\mathrm{𝑒𝑥𝑡}}𝒜^{\mathrm{𝑒𝑥𝑡}}`$ defined by

$$\begin{array}{c}\beta (a_𝒜b):=(a1)\delta (b)\end{array}$$
(7)
is bijective, then the $``$-extension is called Hopf-Galois. If $`𝒜^{\mathrm{𝑒𝑥𝑡}}`$ is a Hopf-Galois $``$-extension, then there is also a bijection

$$\begin{array}{c}\beta ^n:\underset{n+1}{\underset{}{𝒜_𝒜^{\mathrm{𝑒𝑥𝑡}}\mathrm{}_𝒜𝒜^{\mathrm{𝑒𝑥𝑡}}}}𝒜^{\mathrm{𝑒𝑥𝑡}}\underset{n}{\underset{}{\mathrm{}}}\end{array}$$
(8)
given by

$$\begin{array}{c}\beta ^n:=(\beta id)\mathrm{}(id_𝒜\beta id)(id_𝒜\beta ).\end{array}$$
(9)
In our physical interpretation, the one-to-one correspondence $`\beta ^n`$ means that the $`n`$-th $`{}_{𝒜}{}^{}`$-tensor product representing a composite system of $`n`$ quasi-particles also corresponds to a system of a single quasi-particle and $`n`$ quanta.

## 4 Strongly $`𝑮`$-graded quantum-commutative algebras

Recall first that the group algebra $`𝐤G`$ is a Hopf algebra for which the comultiplication, the counit, and the antipode are given by the formulae

$$\begin{array}{ccc}\mathrm{}(g):=gg,& \epsilon (g):=1,& S(g):=g^1,\end{array}$$

respectively. The coquasitriangular structure on $`𝐤G`$ is given by a commutation factor $`b:G\times G𝐤\{0\}`$ , and the category of right $``$-comodules is equivalent to the category of $`G`$-graded vector spaces.

Next, assume that an algebra $`𝒜^{ext}`$ is an object of this category. This means that it is a $`G`$-graded algebra. Now we come to the crucial theorem \[24, p.126\] stating that, for an arbitrary $`G`$-graded algebra and $`𝐤G`$-coaction compatible with the grading ($`\rho (a)=ag`$ for $`a𝒜_g^{ext}`$), the coaction is Galois if and only if the algebra is strongly $`G`$-graded. The latter means that

$$\begin{array}{ccc}𝒜^{\mathrm{𝑒𝑥𝑡}}=_{gG}𝒜_g^{\mathrm{𝑒𝑥𝑡}},& 𝒜_g^{\mathrm{𝑒𝑥𝑡}}𝒜_h^{\mathrm{𝑒𝑥𝑡}}=𝒜_{gh}^{\mathrm{𝑒𝑥𝑡}},& 𝒜_e^{\mathrm{𝑒𝑥𝑡}}𝒜,\end{array}$$
(10)
where $`e`$ is the neutral element of $`G`$.

As an example, let us consider a $`G`$-graded $`b`$-commutative $``$-algebra $`𝒜^{ext}`$ with the so-called standard gradation . This means that we take as the strongly grading group $`Z^N:=Z\mathrm{}Z`$ and assume

$$b(\xi ^i,\xi ^j)=:b^{ij}=(1)^{\mathrm{\Sigma }_{ij}}q^{\mathrm{\Omega }_{ij}}.$$
(11)
Here $`\xi ^i:=(0,\mathrm{},1,\mathrm{},0)`$ ($`1`$ on the $`i`$-th place) is the set of generators of $`Z^N`$, $`\mathrm{\Sigma }:=(\mathrm{\Sigma }_{ij})`$ and $`\mathrm{\Omega }:=(\mathrm{\Omega }_{ij})`$ are integer-valued matrices such that $`\mathrm{\Sigma }_{ij}=\mathrm{\Sigma }_{ji}`$ and $`\mathrm{\Omega }_{ij}=\mathrm{\Omega }_{ji}`$, and $`q\{0\}`$ is a parameter . Since our Hopf algebra is a group ring, the equation (2) for the bilinear form $`b`$ is automatically satisfied, whereas the equations (3)-(4) uniquely determine $`b`$ once we set its value on the generators. The convolution-invertibility of $`b`$ follows from the fact that $`b^{ij}`$s are always non-zero. (Notice that $`b(\xi ^i,(\xi ^j)^n)=(b^{ij})^n`$, so that for $`q=exp(\frac{2\pi i}{n})`$ and $`n`$ even, the grading group $`Z^N`$ can be reduced to $`Z_n\mathrm{}Z_n`$.) Combining (5) with (11), we obtain the following quantum commutativity relations:

$$a_{\xi ^i}a_{\xi ^j}=b^{ij}a_{\xi ^j}a_{\xi ^i},\text{where}a_{\xi ^i}𝒜_{\xi ^i}^{ext},a_{\xi ^j}𝒜_{\xi ^j}^{ext}.$$
(12)
It is the behaviour of $`b^{ij}`$ that determines whether we obtain a system with the $`q`$-statistics, or Fermi statistics and the Pauli exclusion principle, or whether we obtain bosons. On the other hand, the strong gradation ensures that the internal degrees of freedom of a quasi-particle are labeled by charges ($`N`$-tuples of integers), and that these charges are additive.

Acknowledgments. It is a pleasure to thank Cezary Juszczak for his help with typesetting this article.