## A Survey of Fast Exponentiation Methods (1998)

### Cached

### Download Links

- [www.ccrwest.org]
- [sites.google.com]
- [saluc.engr.uconn.edu]
- [khan.postech.ac.kr]
- [www.ccrwest.org]
- DBLP

### Other Repositories/Bibliography

Venue: | JOURNAL OF ALGORITHMS |

Citations: | 155 - 0 self |

### BibTeX

@ARTICLE{Gordon98asurvey,

author = {Daniel M. Gordon},

title = {A Survey of Fast Exponentiation Methods},

journal = {JOURNAL OF ALGORITHMS},

year = {1998},

volume = {27},

pages = {129--146}

}

### Years of Citing Articles

### OpenURL

### Abstract

Public-key cryptographic systems often involve raising elements of some group (e.g. GF(2 n), Z/NZ, or elliptic curves) to large powers. An important question is how fast this exponentiation can be done, which often determines whether a given system is practical. The best method for exponentiation depends strongly on the group being used, the hardware the system is implemented on, and whether one element is being raised repeatedly to different powers, different elements are raised to a fixed power, or both powers and group elements vary. This problem has received much attention, but the results are scattered through the literature. In this paper we survey the known methods for fast exponentiation, examining their relative strengths and weaknesses.

### Citations

2925 | A method for obtaining digital signatures and public-key cryptosystems
- Rivest, Shamir, et al.
- 1983
(Show Context)
Citation Context ...) for p prime and a relatively prime to p are implemented in most computer algebra systems [23]. 1sAnother application in which exponentiation is heavily used is cryptography. In the RSA cryptosystem =-=[25]-=-, encryption and decryption are accomplished by exponentiation in Z/NZ, for N = pq the product of two large primes. For Diffie-Hellman key exchange [9], exponentiation is done modulo a prime p. Its di... |

2728 | New directions in cryptography
- Diffie, Hellman
- 1976
(Show Context)
Citation Context ...y used is cryptography. In the RSA cryptosystem [25], encryption and decryption are accomplished by exponentiation in Z/NZ, for N = pq the product of two large primes. For Diffie-Hellman key exchange =-=[9]-=-, exponentiation is done modulo a prime p. Its difficulty is based on exponentiation being easy, and its inverse, the discrete logarithm problem, being difficult. Exponentiation can be time-consuming,... |

416 |
Modular multiplication without trial division
- Montgomery
- 1985
(Show Context)
Citation Context ...he time required to perform individual multiplications. Alternative representations of integers modulo N can often result in significant improvements. One well-known technique is Montgomery reduction =-=[20]-=-, which is often used in practice. Hong, Oh and Yoon [12] recently gave algorithms which run faster than Montgomery’s. Bernstein [4] has suggested using an explicit form of the Chinese Remainder Theor... |

285 |
Reducing elliptic curve logarithms to logarithms in a finite field
- Menezes, Okamoto, et al.
- 1993
(Show Context)
Citation Context ...l types of elliptic curves allow for faster addition of points. Supersingular curves were suggested by several authors for use in cryptosystems, but it was discovered by Menezes, Okamoto and Vanstone =-=[19]-=- that the discrete logarithm problem on supersingular curves could be reduced to the discrete logarithm problem in an extension field. Koblitz [14] suggested an alternative, which he called anomalous ... |

284 |
Elliptic curve public key cryptosystems
- Menezes
- 1993
(Show Context)
Citation Context ...aller key lengths seem to be secure. Their main drawback is that adding two points on an elliptic curve involves several multiplies. The exact number depends on the parameterization of the curve. See =-=[18]-=- for information on elliptic curves and their use in cryptography. Certain special types of elliptic curves allow for faster addition of points. Supersingular curves were suggested by several authors ... |

257 |
An Introduction to Coding Theory
- Lint
- 1992
(Show Context)
Citation Context ...tation of x. A Nonadjacent Form (NAF) is a representation with cici+1 = 0 for all i ≥ 0. The following theorem, which has been redisovered many times, is also useful in the theory of arithmetic codes =-=[28]-=-: Theorem 2 Every integer x has exactly one NAF. The number of nonzeros in the NAF is w(x). The advantage of using the NAF is that it in general has fewer nonzeros than the binary representation, redu... |

144 |
Seminumerical Algorithms, volume 2 of The Art of Computer Programming. Addison-Wesley, third edition
- Knuth
- 1997
(Show Context)
Citation Context ...or each i > 1, there is some j and k with 1 ≤ j ≤ k < i and ai = aj + ak. A short addition chain for r gives a fast algorithm for computing g r : compute g a2 , g a3 , . . . , g al−1, g r . See Knuth =-=[13]-=- for an excellent introduction to addition chains. Let l(r) be the length of the shortest addition chain for r. The exact value of l(r) is known only for relatively small values of r. It is known that... |

119 |
CM-curves with good cryptographic properties
- Koblitz
- 1991
(Show Context)
Citation Context ...t it was discovered by Menezes, Okamoto and Vanstone [19] that the discrete logarithm problem on supersingular curves could be reduced to the discrete logarithm problem in an extension field. Koblitz =-=[14]-=- suggested an alternative, which he called anomalous curves. These are the curves and E1 : y 2 + xy = x 3 + x 2 + 1 E2 : y 2 + xy = x 3 + 1 over GF(2 n ). These curves have complex multiplication by K... |

97 | Speeding up the computations on an elliptic curve using additionsubtraction chains
- Morain, Olivos
- 1990
(Show Context)
Citation Context ...ubtraction chains has been around for a long time, but they did not seem practical for exponentiation, since division is generally more expensive to implement than multiplication. 3sMorain and Olivos =-=[21]-=- observed that addition-subtraction chains can be very useful for elliptic curves, on which the inverse of a point can be computed for free. For curves y 2 = x 3 + Ax + B over GF(p) with p > 3, the in... |

87 |
An improved algorithm for arithmetic on a family of elliptic curves
- Solinas
- 1997
(Show Context)
Citation Context ...a contradiction. ✷ The algorithm given for computing the NAF in Theorem 3 was useful for showing that the NAF has minimal weight, but may not be the best method to use in practice. Reiter and Solinas =-=[26]-=- first showed the existence of the NAF using an algorithm that computes the NAF directly. If τ|r, then c0 = 0. Otherwise, τ2 divides either r + 1 or r − 1 (since τ|2), and the NAF ends in (0, −1) or (... |

83 | More flexible exponentiation with precomputation - Lim, Lee - 1994 |

67 |
Fast exponentiation with precomputation
- Brickell, Gordon, et al.
- 1993
(Show Context)
Citation Context ...tructing good addition sequences. A vector addition chain is a sequence of elements vi in N t such that vi = ei for 1 ≤ i ≤ t, and vi = vj + vk for j ≤ k < i. For example, a vector addition chain for =-=[7,15,23]-=- is: [0, 0, 1], [0, 1, 0], [1, 0, 0], [0, 1, 1], [1, 1, 1], [0, 1,2], [1,2, 3], (3) [1, 3, 5], [2, 4, 6], [3, 7, 11], [4, 8, 12], [7, 15, 23]. 4sVector addition chains may be used to compute multinomi... |

45 |
Addition chain heuristics
- Bos, Coster
- 1989
(Show Context)
Citation Context ... showed that the minimal length l(r1, . . . , rt) of an addition sequence for r1, . . . , rt is l(r1, . . .rt) = log r + (t + o(1)) log r , (2) log log r where r = max{r1, . . . , rt}. Bos and Coster =-=[5]-=- give some heuristics for constructing good addition sequences. A vector addition chain is a sequence of elements vi in N t such that vi = ei for 1 ≤ i ≤ t, and vi = vj + vk for j ≤ k < i. For example... |

41 | Detecting perfect powers in essentially linear time
- Bernstein
- 1998
(Show Context)
Citation Context ...ant improvements. One well-known technique is Montgomery reduction [20], which is often used in practice. Hong, Oh and Yoon [12] recently gave algorithms which run faster than Montgomery’s. Bernstein =-=[4]-=- has suggested using an explicit form of the Chinese Remainder Theorem to represent numbers modulo N as a set of single-precision numbers. 2s1.1 Addition Chains The basic question is: what is the fewe... |

34 |
Computing sequences with addition chains
- Downey, Leong, et al.
- 1981
(Show Context)
Citation Context ...dition chains, and vice versa. For example, the addition sequence he gets from (3) is 1, 2, 4, 6, 8, 7, 15, 23, while the sequence that maps to (3) is 1, 2, 3, 4, 7, 8, 15, 23, Doney, Leong and Sethi =-=[10]-=- showed that the problem of finding the shortest addition sequence is NP-complete. 2 Basic Methods 2.1 Binary Method This method is also known as the “square and multiply” method. It is over 2000 year... |

30 |
Speeding up Elliptic Cryptosystems by Using a Signed Binary Window Method
- Koyama, Tsuruoka
- 1993
(Show Context)
Citation Context ...tructing good addition sequences. A vector addition chain is a sequence of elements vi in N t such that vi = ei for 1 ≤ i ≤ t, and vi = vj + vk for j ≤ k < i. For example, a vector addition chain for =-=[7,15,23]-=- is: [0, 0, 1], [0, 1, 0], [1, 0, 0], [0, 1, 1], [1, 1, 1], [0, 1,2], [1,2, 3], (3) [1, 3, 5], [2, 4, 6], [3, 7, 11], [4, 8, 12], [7, 15, 23]. 4sVector addition chains may be used to compute multinomi... |

29 |
Efficient exponentiation using precomputation and vector addition chains
- Rooij
(Show Context)
Citation Context ...m which outperforms one of the general classes in the table. One such example in [7] has {xi} = {±1, −2, 9, 10} · {29 j } and h = 8. 15s5.2 Precomputation with Vector Addition Chains Two 1994 papers (=-=[8]-=-, [16]) independently made the observation that the BGMW method tends to use too much memory. It works best when h is small compared to l, so that (9) does not take too long to compute, and most of th... |

23 |
On the evaluation of powers
- Yao
- 1976
(Show Context)
Citation Context ...1 , . . .g rt are computed first. If they are all small, then just computing g 2 , g 3 , . . .g rt may be fast enough, but if the ri are spaced far apart, an addition sequence can be much faster. Yao =-=[32]-=- showed that the minimal length l(r1, . . . , rt) of an addition sequence for r1, . . . , rt is l(r1, . . .rt) = log r + (t + o(1)) log r , (2) log log r where r = max{r1, . . . , rt}. Bos and Coster ... |

18 |
Efficient Multiplication on Certain Nonsupersingular Elliptic Curves
- Meier, Staffelbach
- 1993
(Show Context)
Citation Context ...+ 1 or r − 1 (since τ|2), and the NAF ends in (0, −1) or (0, 1), respectively. Then r is replaced by r/τ, (r + 1)/τ2 , or (r − 1)/τ2 , and the process continued. The problem with the NAF, as noted in =-=[17]-=-, is that the NAF of r will in general be twice as long as the binary representation of r, since the norm of τ is two, and the norm of r is r2 . However, ϕn = 1 in GF(2n ) (since ϕn · (x, y) = (x2n, y... |

17 | Using smoothness to achieve parallelism - Adleman, Kompella - 1988 |

13 |
On vectorial addition chains
- Olivos
- 1981
(Show Context)
Citation Context ... [7, 15, 23]. 4sVector addition chains may be used to compute multinomial powers g r1 1 g r2 2 · · ·g rt t . Let l([r1, . . . , rt]) be the shortest vector addition chain for [r1, . . . , rt]. Olivos =-=[22]-=- showed that problems of finding good vector addition chains and addition sequences are equivalent: Theorem 1 l([r1, . . . , rt]) = l(r1, . . . , rt) + (t − 1). He does this by giving mappings from ad... |

11 | B.: Fast exponentiation with precomputation: algorithms and lower bounds
- Brickell, Gordon, et al.
- 1993
(Show Context)
Citation Context ...vi = ei for 1 ≤ i ≤ t, and vi = vj + vk for j ≤ k < i. For example, a vector addition chain for [7,15,23] is: [0, 0, 1], [0, 1, 0], [1, 0, 0], [0, 1, 1], [1, 1, 1], [0, 1,2], [1,2, 3], (3) [1, 3, 5], =-=[2, 4, 6]-=-, [3, 7, 11], [4, 8, 12], [7, 15, 23]. 4sVector addition chains may be used to compute multinomial powers g r1 1 g r2 2 · · ·g rt t . Let l([r1, . . . , rt]) be the shortest vector addition chain for ... |

10 | Yoon H.: New modular multiplication algorithms for fast modular exponentiation
- Hong, Oh
(Show Context)
Citation Context ...lternative representations of integers modulo N can often result in significant improvements. One well-known technique is Montgomery reduction [20], which is often used in practice. Hong, Oh and Yoon =-=[12]-=- recently gave algorithms which run faster than Montgomery’s. Bernstein [4] has suggested using an explicit form of the Chinese Remainder Theorem to represent numbers modulo N as a set of single-preci... |

9 |
Some Observations on Parallel Algorithms for Fast Exponentiation
- Stinson
- 1990
(Show Context)
Citation Context ...me groups have added structure that allow much faster exponentiation. In GF(p n ), normal bases allow pth powers to be calculated with just a cyclic shift, greatly speeding the p-ary method. See [2], =-=[27]-=-, [29] for some algorithms for this situation. The most common use of this is in GF(2 n ), where the use of a normal basis allows squarings to be done with just a shift. The 2 k -ary method then takes... |

9 | Fundamentals of Algorithms. 2 nd ed - Knuth - 1973 |

7 |
Remarks on number theory III. On addition chains
- Erdős
- 1960
(Show Context)
Citation Context ... chain for r. The exact value of l(r) is known only for relatively small values of r. It is known that, for r large, l(r) = log r + (1 + o(1)) log r . (1) log log r The lower bound was shown by Erdős =-=[11]-=- using a counting argument, and the upper bound is given by the m-ary method below. Finding the best addition chain is impractical, but we can find nearoptimal ones. We will give several efficient alg... |

7 |
zur Gathen. Computing powers in parallel
- von
- 1987
(Show Context)
Citation Context ...pella [1] showed that powers modulo an nbit number could be computed with a circuit of depth O(log 3 n) and size O(e c√ nlog n ). If all the prime factors of N are less than a bound s, von zur Gathen =-=[30]-=- showed that exponentiation modulo N can be done by circuits with depth O(log 2 s log log s) and polynomial size for log-space uniform families, and depth O(log s) for P-uniform families. Stinson [27]... |

6 |
zur Gathen. Efficient exponentiation in finite fields (extended abstract
- von
- 1991
(Show Context)
Citation Context ...ups have added structure that allow much faster exponentiation. In GF(p n ), normal bases allow pth powers to be calculated with just a cyclic shift, greatly speeding the p-ary method. See [2], [27], =-=[29]-=- for some algorithms for this situation. The most common use of this is in GF(2 n ), where the use of a normal basis allows squarings to be done with just a shift. The 2 k -ary method then takes only ... |

5 |
Lim and Pil Joong Lee. More flexible exponentiation with precomputation
- Hoon
(Show Context)
Citation Context ...ch outperforms one of the general classes in the table. One such example in [7] has {xi} = {±1, −2, 9, 10} · {29 j } and h = 8. 15s5.2 Precomputation with Vector Addition Chains Two 1994 papers ([8], =-=[16]-=-) independently made the observation that the BGMW method tends to use too much memory. It works best when h is small compared to l, so that (9) does not take too long to compute, and most of the cd’s... |

5 |
zur Gathen. Efficient and optimal exponentiation in finite fields
- von
- 1991
(Show Context)
Citation Context ... log-space uniform families, and depth O(log s) for P-uniform families. Stinson [27] showed that in GF(2 n ) free squaring could be used to exponentiate using log n time and O(n/ logn) processors. In =-=[31]-=-, von zur Gathen extended the method to GF(q n ). The precomputation methods lend themselves to parallel implementations. Lim and Lee [16] show that by having one processor handle each of the v column... |

4 |
and Kireeti Kompella. Using smoothness to achieve parallelism
- Adleman
- 1988
(Show Context)
Citation Context ...addition sequences. A vector addition chain is a sequence of elements vi in N t such that vi = ei for 1 ≤ i ≤ t, and vi = vj + vk for j ≤ k < i. For example, a vector addition chain for [7,15,23] is: =-=[0, 0, 1]-=-, [0, 1, 0], [1, 0, 0], [0, 1, 1], [1, 1, 1], [0, 1,2], [1,2, 3], (3) [1, 3, 5], [2, 4, 6], [3, 7, 11], [4, 8, 12], [7, 15, 23]. 4sVector addition chains may be used to compute multinomial powers g r1... |

4 |
Fast Exponentiation
- Agnew, Mullin, et al.
- 1998
(Show Context)
Citation Context ...ce of elements v i in N t such that v i = e i for 1sist, and v i = v j + v k for jsk ! i. For example, a vector addition chain for [7,15,23] is: [0; 0; 1]; [0; 1; 0]; [1; 0; 0]; [0; 1; 1]; [1; 1; 1]; =-=[0; 1; 2]-=-; [1; 2; 3]; (3) [1; 3; 5]; [2; 4; 6]; [3; 7; 11]; [4; 8; 12]; [7; 15; 23]: 4 Vector addition chains may be used to compute multinomial powers g r 1 1 g r 2 2 \Delta \Delta \Delta g r t t . Let l([r 1... |

3 | Some Primality Testing Algorithms
- Pinch
- 1993
(Show Context)
Citation Context ...putational number theory. For example, primality tests based on Fermat’s Little Theorem that a p−1 ≡ 1 (mod p) for p prime and a relatively prime to p are implemented in most computer algebra systems =-=[23]-=-. 1sAnother application in which exponentiation is heavily used is cryptography. In the RSA cryptosystem [25], encryption and decryption are accomplished by exponentiation in Z/NZ, for N = pq the prod... |

2 |
Fast exponentiation in GF(2 n
- Agnew, Mullin, et al.
- 1988
(Show Context)
Citation Context ...ce of elements vi in N t such that vi = ei for 1 ≤ i ≤ t, and vi = vj + vk for j ≤ k < i. For example, a vector addition chain for [7,15,23] is: [0, 0, 1], [0, 1, 0], [1, 0, 0], [0, 1, 1], [1, 1, 1], =-=[0, 1,2]-=-, [1,2, 3], (3) [1, 3, 5], [2, 4, 6], [3, 7, 11], [4, 8, 12], [7, 15, 23]. 4sVector addition chains may be used to compute multinomial powers g r1 1 g r2 2 · · ·g rt t . Let l([r1, . . . , rt]) be the... |

2 |
Private communication
- Poonen
(Show Context)
Citation Context ...(using (8)) ≡ τ 2 + τ This example also demonstrates that the NAF modulo τ n −1 is not unique. ✷ As mentioned in Section 2.3, the average number of nonzeros in an NAF of length n is n/3. Bjorn Poonen =-=[24]-=- has pointed out that we can prove the same bound for the NAFs of rational integers modulo τ n − 1. Let l = norm(τ n − 1), the order of the curve. Theorem 6 As n → ∞, the NAFs of {1, 2, . . .l − 1} gi... |

1 |
Signed digit represenations of minimal Hamming weight
- Arno, Wheeler
- 1993
(Show Context)
Citation Context ...ents vi in N t such that vi = ei for 1 ≤ i ≤ t, and vi = vj + vk for j ≤ k < i. For example, a vector addition chain for [7,15,23] is: [0, 0, 1], [0, 1, 0], [1, 0, 0], [0, 1, 1], [1, 1, 1], [0, 1,2], =-=[1,2, 3]-=-, (3) [1, 3, 5], [2, 4, 6], [3, 7, 11], [4, 8, 12], [7, 15, 23]. 4sVector addition chains may be used to compute multinomial powers g r1 1 g r2 2 · · ·g rt t . Let l([r1, . . . , rt]) be the shortest ... |