## Differential addition chains (2006)

Citations: | 9 - 3 self |

### BibTeX

@TECHREPORT{Bernstein06differentialaddition,

author = {Daniel J. Bernstein},

title = {Differential addition chains},

institution = {},

year = {2006}

}

### OpenURL

### Abstract

Abstract. Differential addition chains (also known as strong addition chains, Lucas chains, and Chebyshev chains) are addition chains in which every sum is already accompanied by a difference. Low-cost differential addition chains are used to efficiently exponentiate in groups where the operation a, b, a/b ↦ → ab is fast: in particular, to perform x-coordinate scalar multiplication P ↦ → mP on an elliptic curve y 2 = x 3 + Ax 2 + x. Similarly, low-cost two-dimensional differential addition chains are used to efficiently compute the function P, Q, P −Q ↦ → mP +nQ on an elliptic curve. This paper presents two new constructive upper bounds on the costs of two-dimensional differential addition chains. The paper’s new “binary ” chain is very easy to compute and uses 3 additions (14 field multiplications in the elliptic-curve context) per exponent bit, with a uniform structure that helps protect against side-channel attacks. The paper’s new “extended-gcd ” chain takes more time to compute, does not have the uniform structure, and is not easy to analyze, but experiments show that it takes only about 1.77 additions (9.97 field multiplications) per exponent bit. 1 What is a differential addition chain? A differential addition chain is an addition chain in which each sum is already accompanied by a difference: i.e., whenever a new chain element P +Q is formed by adding P and Q, the difference P − Q was already in the chain. Here is an example of a one-dimensional differential addition chain starting from 0 and 1: