Table Of Content

Addition law structure of elliptic curves 1 1 David Kohel 0 Institut de Mathématiques de Luminy 2 Université de la Méditerranée n 163, avenue de Luminy, Case 907 a J 13288 Marseille Cedex 9 3 France 1 ] T Abstract N Thestudyofalternativemodelsforellipticcurveshasfoundrecentin- . h terest from cryptographic applications, after it was recognized that such t models provide more efficiently computable algorithms for the group law a than thestandard Weierstrass model. Examples of such models arise via m symmetriesinducedbyarationaltorsionstructure. Weanalyzethemod- [ ulestructureofthespaceofsectionsoftheadditionmorphisms,determine explicitdimensionformulasforthespacesofsectionsandtheireigenspaces 2 v under the action of torsion groups, and apply this to specific models of 3 elliptic curveswith parametrized torsion subgroups. 2 6 1 Introduction 3 . 5 0 Letk beafieldandAanabelianvarietyoverkwithagivenprojectivelynormal 0 embedding ι : A → Pr, determined by an invertible sheaf OA(1) := ι∗OPr(1) 1 and denote the addition morphism on A by µ:A×A→A. v: Anadditionlawisan(r+1)-tuples=(p0,...,pr)ofbihomogeneouselements i p of X j k[A]⊗k[A]=k[X ,...,X ]/I ⊗ k[X ,...,X ]/I , 0 r A k 0 r A r a where I is the defining ideal of A, such that the rational map A (x,y)=((x :···:x ),(y :···:y ))7−→(p (x,y):···:p (x,y)) 0 r 0 r 0 r defines µ on the complement of Z = V(p ,...,p ) in A × A. The set Z is 0 r called the exceptional set of s. Lange and Ruppert [16] give a characterization ofadditionlaws,assectionsofaninvertiblesheaf,fromwhichitfollowsthatthe exceptional set of any nonzero addition law is the support of a divisor, which we refer to as the exceptional divisor. An addition law is said to have bidegree (m,n) if p (x,y) arehomogeneousofdegree m and n in x andy , respectively. j i j Theadditionlawsofbidegree(m,n),includingthezeroelement,formak-vector space. 1 A set S of addition laws is said to be complete or geometrically complete if the intersection of the exceptional sets of all s in S is empty, and k-complete or arithmetically complete if this intersection contains no k-rational point. We note that the term complete [6, 16, 17] has more recently been used to denote k-complete, in literature with a view to computational and cryptographic application. The intersection of the exceptional sets for s in S clearly equals the intersection of the exceptional sets for all s in its k-linear span. ThestructureofadditionlawsdependsintrinsicallynotjustonA,butalsoon the embedding ι:A→Pr, determined by globalsections s ,...,s in Γ(A,L), 0 r for the sheaf L = O (1). The hypothesis that ι is a projectively normal A embedding may be defined to be the surjectivity of the homomorphism ∞ ∞ k[X0,...,Xr]= Γ(Pr,OPr(n))−→ Γ(A,Ln) Mn=0 Mn=0 (see Birkenhake-Lange [5, Chapter 7, Section 3] or Hartshorne [10, Chapter I, Exercise 3.18 & Chapter II, Exercise 5.14]). In particular, it implies that {s0,...,sr}spanΓ(A,L). Foranellipticcurve,thesurjectivityofΓ(Pr,OPr(1)) on Γ(E,L) is a necessary and sufficient condition for ι to be projectively normal. We recallthat an invertible sheaf is said to be symmetric if L ∼=[−1]∗L. Lange and Ruppert [16] determine the structure of addition laws, and in particular prove the following main theorem. Theorem 1 (Lange-Ruppert) Let ι : A → Pr be a projectively normal embedding of A, and L =O (1). The sets of addition laws of bidegrees (2,3) and A (3,2) on A are complete. If L is symmetric, then the set of addition laws of bidegree (2,2) is complete, and otherwise empty. Remark. Lange and Ruppert assume that ι is defined with respect to the complete linear system of an invertible sheaf L ∼=Mm where M is ample and m ≥ 3. Their hypothesis implies the projective normality of ι by a result of Sekiguchi [21] and the latter is sufficient for their proof. Following Sekiguchi, Lange and Ruppert require that k be algebraically closed, but the result relies onlyonthedimensionsofsectionsofacertainlinebungleandbase-pointfreeness ofitssections,whichareindependentofthebasefield. Weavoidthisdependence by the direct assumption that ι is projectively normal. Bosma and Lenstra [6] give a precise description of the exceptional divisors of addition laws of bidegree (2,2) when A is an elliptic curve embedded as a Weierstrass model. Using this analysis, they prove that two addition laws are sufficient for a complete system. However, their description of the structure of addition laws applies more generally to other projective embeddings of an elliptic curve. We carryout this analysisto determine the dimensions of spaces ofadditionlawsinfamilieswithrationaltorsionsubgroupsandstudythemodule decomposition of these spaces with respect to the action of torsion. In view of Theorem 1, the simplest possible structure of an addition law we mighthopeforisoneforwhichthepolynomialsp (x,y)arebinomialsofbidegree j 2 (2,2). SuchadditionlawsareknownforHessianmodels[8,Section4],[13],[22], Jacobiquadricintersections[8,Section4],andfor Edwardsmodels [1],[9]ofel- liptic curves. After recalling some backgroundin Sections 2 and 3, and proving resultsabouttheexceptionaldivisorsofadditionlaws,weintroducetheconcept ofadditionlawprojectionsinSection4. InSection5weintroducethenotionof aprojectivenormalclosureofanaffinemodelofanellipticcurveinordertoap- ply the preceding theory. Section 6 gives a formal definition and interpretation ofaffine additionlaws,expressedbyrationalfunctions, in terms ofthe addition lawprojectionsofSection4. InSection7 weintroduce aG-module structureof additionlaws,withrespecttoarationaltorsionsubgrouponE. Inthefinalsec- tion we give examples of addition laws, observing that the simple laws coincide with the uniquely determined one-dimensional eigenspaces for the G-module structure. In the final section we analyze the G-model structure of addition laws for standard families – the degree 3 twisted Hessian models, the Jacobi quadric intersections and twisted Edwards models of degree 4 – and construct an analogous degree 5 model for curves with a rational 5-torsionstructure. 2 Divisors and invertible sheaves on abelian varieties Let A/k be an abelian variety. We denote the addition morphism by µ, the difference morphism by δ, and let π : A×A → A be the projection maps, for i ∗ ∗ ∗ i in {1,2}. We denote by µ , δ , and π the respective pullback morphisms of i divisors and sheaves from E to E×E. We use the bijective correspondence between Weil divisors and Cartier divisors on abelian varieties, and to such a divisor D we associate an invertible subsheafL(D) ofthe sheafK oftotalquotientrings suchthat for D effective, L(D)−1 is the ideal sheaf of D (see Hartshorne [10, Chapter II, Section 6]). We call the invertible sheaf L effective if it is isomorphic to L(D) for some effective divisor D. ForL(D)sodefined,itsspaceofglobalsectionsistheRiemann-Rochspace: Γ(A,L(D))={f ∈k(A) : div(f)≥D}, and an embedding A → Pr given by the complete linear system |L(D)| is determined by P 7−→(x (P):x (P):···:x (P)), 0 1 r for a choice of basis {x ,x ,...,x } of Γ(A,L(D)). If D is an effective Weil 0 1 r divisorwemaytakex =1,inwhichcasewerecoverD asthe intersectionwith 0 the hyperplane X =0 in Pr. 0 3 2.1 Sheaves associated to the addition morphism LangeandRuppert[16]interpretanadditionlawofbidegree(m,n)asahomo- morphism of sheaves µ∗L →π∗Lm⊗π∗Ln, then use the identification 1 2 Hom(µ∗L,π∗Lm⊗π∗Ln)=Γ(A×A,µ∗L−1⊗π∗Lm⊗π∗Ln), 1 2 1 2 to determine their structure. In view of Theorem 1, we will be interested in symmetric invertible sheaves L, and the structure of sections of the sheaves M =µ∗L−1⊗π∗Lm⊗π∗Ln. m,n 1 2 and for the critical case of M we write more concisely M. 2,2 We return to the study of sheaves on E × E after characterizing certain properties of invertible sheaves and morphisms of elliptic curves. 2.2 Invertible sheaves on elliptic curves A Weierstrass model of an elliptic curve E with base point O is determined with respect to L(3(O)) and any other cubic model in P2 is obtained as a projective linear automorphism of the Weierstrass model. As a prelude to the study of models determined by more general symmetric divisors, we recall the characterization of divisors on an elliptic curve. For a divisor D on an elliptic curveletev(D)beitsevaluationonthecurve. Withthisnotation,thefollowing lemma is immediate. Lemma 2 Let L = L(D) be an invertible sheaf of degree d on E. Then L ∼=L((d−1)(O)+(P)) where P =ev(D). Moreover L is symmetric if and only if P is in E[2]. The classification of curves and their addition laws makes use of linear iso- morphismsbetweenspacesofglobalsectionsofaninvertiblesheaf. Inclassifying curvesandtheiradditionlaws,itthereforemakessensetoclassifyellipticcurves up to projective linear isomorphism. Lemma 3 LetE andE beprojectively normalembeddings ofanelliptic curve 1 2 E defined with respect to divisors D and D . Then there exists a projective 1 2 linear isomorphism E →E if and only if deg(D )>deg(D ) or D ∼D . 1 2 1 2 1 2 Proof An equivalence of divisors D ∼ D implies L(D ) ∼= L(D ), and 1 2 1 2 theresultinglinearisomorphismofglobalsectionsinducesalinearisomorphism of the embeddings of the curve with respect to D and D (and whose inverse 1 2 is also linear). If deg(D ) > deg(D ), we may suppose – up to equivalence – 1 2 that D >D >0, and we have an inclusion of vector subspaces of k(E): 1 2 V =Γ(E,L(D ))⊆V =Γ(E,L(D )) 2 2 1 1 such that the restriction from V to V determines the morphism E → E 1 2 1 2 inducedbyasurjectivelinearmaponcoordinatefunctions. SinceV definesthe 2 embedded image E , the restriction morphism is an isomorphism. (cid:3) 2 4 A symmetric embedding gives rise to addition laws of minimal bidegree in Theorem 1. However, the structure of the negation map imposes additional motivation for requiring a symmetric line bundle. Lemma 4 If E ⊂ Pr is a projectively normal embedding with respect to L, then [−1] is induced by a projective linear automorphism if and only if L is symmetric. ProofIf L is symmetric,then [−1]∗ induces anautomorphismofthe space ofglobalsectionsofL. Conversely,sinceE isprojectivelynormalinPr,alinear automorphism of the coordinate functions which determines [−1] also induces an automorphism of global sections, hence of L with [−1]∗L. (cid:3) InSection7weanalyzetheG-modulestructureofadditionlawswithrespect to a finite subgroup G = {T } of rational points on E. For a rational point T i of E we denote by τ the translation-by-T map on E. The following lemma T characterizes when τ acts linearly. T Lemma 5 Let E ⊂ Pr be a projectively normal embedding with respect to L, and let T be in E(k). Then τ is induced by a projective linear automorphism T if and only if [deg(L)]T =O. ProofItisnecessaryandsufficienttoshowthatL ∼=τ∗L. LetL ∼=L(D) T and set D′ =τ∗D. Since deg(D′)=deg(D) and ev(D′)=ev(D)−[deg(D)]T, T bythecanonicalformofLemma2theequivalenceoftheisomorphismL ∼=τ∗L T holds if and only if [deg(D)]T =O. (cid:3) Remark. WenotethatLemma3andLemma4refertoisomorphismsinthecat- egoryofelliptic curves(fixingabasepoint),whilethe isomorphismofLemma5 is not an elliptic curve isomorphism. Lemma 3 is false if an isomorphism in the category of curves is allowed. Suppose that E and E are embedded with 1 2 respect to divisors D and D and that D ∼ τ∗D . Then the morphism τ 1 2 1 T 2 T determines a linear isomorphism E →E sending O to T. 1 2 2.3 Invertible sheaves on E ×E Let µ, δ, π , and π be the addition, difference, and projection morphisms, as 1 2 above. We define V ={O}×E and H =E×{O} as divisors on E×E. Similarly, let ∆ and ∇ be the diagonaland anti-diagonal images of E in E×E, respectively. Lemma 6 With the above notation we have π∗L((O))=L(V), π∗L((O))=L(H), 1 2 µ∗L((O))=L(∇), δ∗L((O))=L(∆). In particular if L =L(d(O)), then µ∗L−1⊗π∗Lm⊗π∗Ln =L(−d∇+dmV +dnH). 1 2 5 Proof This is immediate from V =π∗(O), H =π∗(O), ∇=µ∗(O) and ∆=δ∗(O). (cid:3) 1 2 We note that each of V, H, ∇, and ∆ is an elliptic curve isomorphic to E. In the generalization of the divisor on E from 3(O) to a more general Weil divisor, we obtain translates of these elementary divisors, which motivates the definitions ∇ :=µ∗(P)=∇+(P,O)=∇+(O,P), V :=π∗(P)=V +(P,O), P P 1 ∗ ∗ ∆ :=δ (P)=∆+(P,O)=∆−(O,P), H :=π (P)=H +(O,P). P P 2 For points Q and R in E(k¯), let τ and τ be the translation morphisms Q (Q,R) on E and E×E. The following lemma is immediate from the definitions. Lemma 7 The translation morphism τ on E×E acts by pullback on di- (Q,R) visors by: ∗ ∗ τ(Q,R)(∆P)=∆P−Q+R, τ(Q,R)(VP )=VP−Q, ∗ ∗ τ(Q,R)(∇P)=∇P−Q−R, τ(Q,R)(HP)=HP−R. 2.4 Addition laws of bidegree (2,2) We now classify the sheaves of addition laws of bidegree (2,2). We recall the definition of the invertible sheaf M =µ∗L−1⊗π∗L2⊗π∗L2. 1 2 Following Bosma and Lenstra [6], we let x be a degree 2 function on E with poles only at O, and observe that for x = x ⊗ 1 and x = 1 ⊗ x in 1 2 k(E)⊗ k(E)⊂k(E×E), we have k div(x −x )=∇+∆−2V −2H. 1 2 This relation gives rise to the following more general systems of relations. Lemma 8 For points P and P in E(k¯) we have ∆P−Q+∇P+Q ∼V +V2P +H +H2Q. If T and T are in E[2] and T =T +T , we have 1 2 3 1 2 ∆ +∇ ∼V +V +H +H . T1 T2 T3 T3 Proof The first relation is the homomorphic image of ∇+∆ ∼ 2V +2H underτ∗ ,applyingLemma7,thenusingtheequivalences2V ∼V+V and (P,Q) P 2P 2H ∼H+H , which follow from the pullbacks of the sheaf isomorphisms of P 2P Lemma 2. The second relation follows by taking S and S such that 2S =T , 1 2 i i and specializing to (P,Q)=(−S +S ,S +S ). (cid:3) 1 2 1 2 The above lemma yields the following isomorphisms in terms of symmetric invertible sheaves. 6 Lemma 9 Let L be a symmetric invertible sheaf on E, let T and T be points 1 2 in E[2] and set T =T +T . The sheaves L =τ∗ (L) satisfy 3 1 2 i Ti µ∗L ⊗δ∗L ∼=π∗L ⊗π∗L ⊗π∗L ⊗π∗L , 1 2 1 1 3 2 2 3 and in particular µ∗L ⊗δ∗L ∼=π∗L2⊗π∗L2, 1 2 from which M ∼=δ∗L. Proof By Lemma 2, we have L ∼= L((d−1)(O)+(T)) for some point T in E[2], and hence L2 ∼= L(2d(O)), and similarly for the translates Li. The lemma then follows by the equivalences of Lemma 8, extended linearly to the pullbacks of divisors of the form (d−1)(O)+(T). (cid:3) ThefollowingtheoremextendstheanalysisofBosmaandLenstra[6,Section4], following the lines of proof of Lange and Ruppert [16, Section 2] and [17]. Theorem 10 Let ι :E →Pr be a projectively normal embedding of an elliptic curve, with respect to a symmetric sheaf L ∼= L(D). Then the space of global sections of M is isomorphic to the space of global sections of L. Moreover, the exceptional divisor of an addition law of bidegree (2,2) associated to a section in Γ(E×E,M) is of the form d ∆ where D ∼ (P ). i=1 Pi i i P P ProofInviewofLemma9,andsinceδhasintegralfibers,wededucethatthe difference morphism induces an isomorphism δ∗ : Γ(E,L) → Γ(E ×E,δ∗L). The structure of the exceptional divisor follows since for D ∼ (P ), we have i i δ∗D ∼ i∆Pi. (cid:3) P SincPe each∆Pi is isomorphic to E overthe algebraicclosure of k, this theo- remgivesasimple characterizationofthe exceptionaldivisor,andofarithmetic completeness. Corollary 11 The exceptional divisor of an addition law of bidegree (2,2) is of ∗ ′ ′ the form C =δ (D ) where C ∩ H =D ×{O}. Proof Each component of C is of the form ∆ = δ∗(P) for a uniquely P determined P, and the identity ∆ ∩ H = (P,O) extends linearly to general P sums of divisors of the form ∆ . (cid:3) P Corollary 12 An addition law of bidegree (2,2) with exceptional divisor C = δ∗(D′) is k-complete if and only if D′ has no k-rational point in its support. Proof A component ∆ of C has a rationalpoint (and is isomorphic to E) P if and only if the point P lies in E(k). (cid:3) Remark. For addition laws of bidegree (2,2), Corollary 11 gives an elementary algorithm for characterizing the exceptional divisor and Corollary 12 for characterizing arithmetic completeness. 7 3 Divisors and intersection theory For higher bidegrees, we do not expect to have an isomorphism between the space addition laws and the sections of an invertible sheaf on E. In order to determine the dimensions of these spaces, we require an explicit determination of the Euler-Poincarécharacteristic χ(E×E,L) as a tool for determining the dimension of Γ(E×E,L)=H0(E×E,L). 3.1 Euler-Poincaré characteristic and divisor equivalence For a projective variety X/k and a sheaf F, and let χ(X,F) be the Euler- Poincarécharacteristic: ∞ χ(X,F)= (−1)idim (Hi(X,F)). k Xi=0 For the classification of divisors or invertible sheaves of X, we have considered thelinear equivalenceclassesinPic(X). Inordertodeterminethedimensionsof spaces of addition laws, it suffices to consider the coarser algebraic equivalence class in the Néron-Severi group of X, defined as NS(X)=Pic(X)/Pic0(X). Fora surface X,a divisorD is numerically equivalent to zeroif the intersection product C.D is zero for all curves C on X. This gives the coarsest equivalence relationonX andwedenotethegroupofdivisorsmodulonumericalequivalence by Num(X). We refer to Lang [15, Chapter IV] for the general definition of Num(X), and the equality between Num(X) and NS(X) for abelian varieties: Lemma 13 If X is an abelian variety then NS(X)=Num(X). By the definition of numerical equivalence, the intersection product is nondegenerate on Num(X). In the application to X = E ×E, we can determine the structure of NS(X). Lemma 14 The following diagram is exact. 0 0 (cid:15)(cid:15) (cid:15)(cid:15) 0 // Pic0(E)×Pic0(E) //Pic0(E×E) // 0 0 //Pic(E)×(cid:15)(cid:15) Pic(E) π1∗×π2∗ // Pic(E(cid:15)(cid:15) ×E) // End(cid:15)(cid:15)(E) //0 (cid:15)(cid:15) (cid:15)(cid:15) (cid:15)(cid:15) 0 // NS(E)×NS(E) // NS(E×E) // End(E) //0 (cid:15)(cid:15) (cid:15)(cid:15) (cid:15)(cid:15) 0 0 0 8 Proof Exactness of the middle horizontal sequence is Exercise IV 4.10 of Hartshorne [10], and the vertical sequences are exact by the definition of the Néron-Severi group. Exactness of the upper and lower sequences follows by commutativity of the diagram. (cid:3) We note that since NS(E) and End(E) are free abelian groups, the lower sequence splits, with the splitting sending an endomorphism ϕ to its graphΓ , ϕ where, in particular, Γ[1] = ∆ and Γ[−1] = ∇. Moreover, E×E is isomorphic to Pic0(E×E), with isohomomorphism (P,Q)7→V −V +H −H. P Q SummarizingargumentsfromLangeandRuppert[17],particularlytheproof of Lemma 1.3, we now determine the intersection pairing on NS(E×E). Lemma 15 The Néron-Severi group NS(E × E) is a finitely generated free abelian group, and if End(E) ∼= Z, it is generated by V, H, ∆, and ∇, modulo the relation ∆+∇ ≡ 2V +2H. The intersection product is nondegenerate on NS(E×E) and given by V H ∆ ∇ V 0 1 1 1 H 1 0 1 1 ∆ 1 1 0 4 ∇ 1 1 4 0 ProofThedivisorsV andH arethegeneratorsofπ∗(NS(E))andπ∗(NS(E)). 1 2 Since ∆ and ∇ are the graphs of [1] and [−1], their sum induces the zero homomorphism, thus must lie in the image of π∗×π∗. The expression for ∆+∇ 1 2 follows from the linear equivalence relation of Lemma 8. Each of V, H, ∆ and ∇ has trivial self-intersection, since they have trivial intersections with their translates in E×E. The identities V.H =V.∆=V.∇=H.∆=H.∆=1, holdsinceeachpairhasauniqueintersectionpoint(O,O), andfinally∆.∇=4 follows from |∆∩∇|=|{(T,T) : T ∈E[2]}|=4. (cid:3) In the case of complex multiplication, the generator set can be extended by additional independent divisors Γϕ1,...,Γϕr−1, where {1,ϕ1,...,ϕr−1} is a basis for End(E), by the splitting of the lower sequence of Lemma 14. Theorem 16 Let E bean elliptic curveandL bean invertible sheaf on E×E. The Euler-Poincaré characteristic χ(E×E,L) depends only on the numerical equivalence class of L, and in particular 1 χ(E×E,L(D))= D.D. 2 If L is ample, then χ(E ×E,L) = dim (Γ(E×E,L)). Conversely, if L is k effective and χ(E×E,L) is positive, then L is ample. 9 ProofThefirststatementistheRiemann-Rochtheoremforabeliansurfaces (seeMumford[20,p.150]orHartshorne[10,ChapterV,Theorem1.6]). Forthe latter statements, Mumford’s Vanishing Theorem [20, p. 150] states that when χ(E×E,L) is nonzero, Hi(E×E,L)6=0 for exactly one i=i(L) and that 0 ≤ i ≤ 2. In addition, i(L) = i(Ln) for all n > 0 [20, Corollary, p. 159]. If L is ample it follows that i=0,and since H0(E×E,L)=Γ(E×E,L) gives theonlycontributiontothe Euler-Poincarécharacteristic,theresultfollows. In the otherdirection,forpositiveEuler-Poincarécharacteristic,clearlyi6=1,and by Serre duality [10, Chapter III, Corollary 7.7] we have i(L−1) = 2−i(L). ForL effective, H0(E×E,L−1)=0,hence i=0. Ampleness ofL followsby Application 1 of Mumford [20, p. 60]. (cid:3) The following corollaryof Theorem16 and Lemma 15, which is synthesis of results of Lange and Ruppert [16, 17], allows the effective determination of the Euler-Poincarécharacteristic. Corollary 17 (Lange-Ruppert) Let E be an elliptic curve, then χ(E×E,L(x ∇+x V +x H))=x x +x x +x x . 0 1 2 0 1 0 2 1 2 In particular, if L is an invertible sheaf of degree d>0 on E, then χ(E×E,M )=d2(mn−m−n). m,n As an application, we have a clear criterion for the sheaves M to be m,n effectiveandample. We define the productorderinbidegreesby(k,l)<(m,n) if and only if k<m and l <n. Corollary 18 The sheaf M is ample if and only if (2,2)<(m,n). m,n ProofTheEuler-Poincarécharacteristic,χ(E×E,M )=d2(mn−m−n), m,n is positive if and only if (2,2) < (m,n) by Corollary 17, and this is a necessary condition for ampleness, e.g. by the Nakai-Moishezon Criterion (see Hartshorne [10, Chapter V, Theorem 1.10]). On the other hand, M is iso- m,n morphic to L(d∆+d(m−2)V +d(n−2)H), hence is effective when (2,2)<(m,n), so M is ample by Theorem 16. (cid:3) m,n Next we obtain a characterizationof the critical case χ(E×E,L(D))=0. In view of the roles of ∇, ∆, V, and H in the divisor theory, we define Γ to (a,b) be the image of E in E×E given by P 7→ (aP,bP), for a and b coprime, and for (na,nb) set Γ =n2Γ . We then have equivalent expressions (na,nb) (a,b) ∆=Γ(1,1), ∇=Γ(1,−1), V =Γ(0,1), H =Γ(1,0). Lemma 19 The divisor Γ is numerically equivalent to (a,b) −ab∇+(a2+ab)V +(ab+b2)H. 10