1. Review of general exponentiation algorithms

Transcription

1 Plas cit this articl as: Artur Jakubski, Robrt Prliński, Rviw of nral xponntiation alorithms, Scintific Rsarch of th Institut of Mathmatics and Computr Scinc, 011, Volum 10, Issu, pas Th wbsit: Scintific Rsarch of th Institut of Mathmatics and Computr Scinc, (10) 011, REVIEW OF GENERAL EXPONENTIATION ALGORITHMS Artur Jakubski, Robrt Prliński Institut of Computr and Information Scincs Czstochowa Univrsity of Tchnoloy, Poland Abstract. Arithmtic on lar intrs is oftn ncssary in cryptoraphy. Many cryptosystms dpnd on th possibility of computin powrs (xponntiation). In this papr w dscrib wll-known xponntiation alorithms with thir complxity analysis. Our alorithm introducs a nw ida of solvin th xponntiation problm. W show cass in which th complxity of our alorithm is bttr than th complxity of any othr alorithms. Introduction Th problm of fficint xponntiation is xtrmly important for th dvlopmnt of modrn cryptoraphy. Many cryptoraphic systms us this opration in th information ncryption procss (. RSA or ElGamal). This work concrns th problm of ffctivly calculatin, whr is an lmnt of roup G, and is a positiv intr numbr [1+]. Gnrally, this problm is considrd whn is a ral numbr. In this papr w analys nral xponntiation alorithms and compar thir ffctivnss. As th critrion of th ffctivnss of th alorithm w adoptd th numbr of roup oprations which th alorithm prforms. Whn this numbr is smallr for a st of valus adoptd by, such an alorithm is considrd to b mor fficint. W ar awar of th fact that analysis of th numbr of alorithm bit oprations would b mor conclusiv. Awar of this fact, w abandond it to simplify th analysis and thus to mak th papr clarr. In this papr w prsnt our own contribution, a nw nral xponntiation alorithm. W calld it th alorithm of zro-on squncs and it is containd in Sction of this work. W compar its ffctivnss to othr alorithms prsntd in th work. 1. Rviw of nral xponntiation alorithms Th problm of xponntiation can b considrd du to th chanin valus of or. W can considr th problm for fixd bas and chanin xponnt or

2 88 A. Jakubski, R. Prliński invrsly, for fixd and arbitrarily chosn. Th third option is whn both th valus ar subjct to chan. Thr ar thrfor thr typs of xponntiation alorithms: nral xponntiation alorithms, xponntiation for arbitrarily chosn and arbitrarily chosn, so-calld nral purpos xponntiation alorithms: simpl binary and k-ary xponntiation slidin-window xponntiation fixd-xponnt xponntiation fixd-bas xponntiation. In this papr w considr th nral xponntiation problm, whr nithr nor ar prdtrmind. In our study, w will analys th valus of in a crtain ran in ordr to compar th ffctivnss of th alorithms Exponntiation - naiv mthod It sms that th asist way to calculat is to prform 1 oprations in roup G. Blow is an xampl of an alorithm psudocod calld th naiv mthod. Alorithm - naïv mthod Input: G, N + Output: 1. A. For i from 1 to 1 do th followin:.1. A A 3. Rturn A This simpl mthod of calculatin powr is oftn inffctiv, spcially whn is of a hih valu. Morovr th complxity of this alorithm rquirs calculatin O() multiplications. For practical applications, whr is of svral hundrd, a thousand, or mor bits, th application of this mthod is impractical. 1.. Lft-to-riht alorithm Th numbr of oprations in th alorithm of th prvious sction can b sinificantly rducd. In this and th nxt sction w will prsnt th alorithms dscribd in litratur as th binary xponntiation alorithm, itratd alorithm for raisin to th squar or th alorithm of fast xponntiation [1+3]. In this alorithm, th valu of A (partial rsults of xponntiation) is raisd to th squar in ach cours of loop, i. t + 1 tims. In ach xcution of loop th alorithm chcks th nxt bit valu, if this valu is qual to 1, w assin multiplyin A and to rsult A.

3 Rviw of nral xponntiation alorithms 89 Alorithm of lft-to-riht binary xponntiation Input: G, a positiv intr = ( tt 1 1 0) Output: 1. A 1. For i from t down to 0 do th followin:.1. A A A.. If i = 1 than A A 3. Rturn A Du to th fact that th most sinificant bit of xponnt is qual to on, w can omit th first xcution of loop and thus assin to variabl A. W tak into account this fact whn analysin th complxity of this alorithm. In mor dtaild analysis, th numbr of multiplications (oprations in th roup), of this alorithm is lo + v( ) 1, whr v( ) is th numbr of ons in th binary rprsntation 15 of [4]. For = 15, this mthod rquirs six multiplications, whil can b dtrmind usin only fiv multiplications. Th alorithm dos not work optimally, particularly for binary xponnts that contain lon squncs of ons. In conclusion, th asymptotic complxity of th lft-to-riht alorithm is O(lo ) Exampl Blow w prsnt th lft-to-riht alorithm. Tabl 1 dscribs th obtaind valus, takn by A in succdin loop courss, for xponnt = 83. Opratin of lft-to-riht alorithm for = 83 Tabl 1 i i () A

4 90 A. Jakubski, R. Prliński 1.3. Riht-to-lft alorithm This alorithm, thouh it diffrs from th prvious on, works vry similarly [1, 3]. Th main diffrnc lis in th us of binary xponnt. Th xponnt bits qual to 1 in this cas ar chckd (in stp.1 of th alorithm) from th last sinificant bit to th most sinificant on, so, from riht to lft. Loop xcuts as lon as 0, that is, d facto, as lon as w hav bits of th xponnt. In ach xcution of loop, S is raisd to th squar. Thus, th st of valus adoptd by S is { 1 lo 4,,,, }. Rsult A is obtaind by multiplyin ths powrs which corrspond to valu 1 in th binary form of xponnt (from th last sinificant bit). Just as in th lft-to-riht alorithm, th asymptotic complxity of this alorithm is O(lo ). Alorithm of riht-to-lft binary xponntiation Input: G, a intr N + Output: 1. A 1, S. Whil 0 do th followin:.1. If is odd thn A A S.. /.3. If 0 thn S S S 3. Rturn A Exampl Th xampl of th riht-to-lft alorithm is shown in Tabl. Variabl A stors th partial rsults of th powrs computd in succdin courss of loop. Column 3 shows th binary xponnt fixd at a ivn sta of th alorithm. Th riht-to-lft alorithm for = 83 (10) () computd xponnt A S Tabl

5 1.4. Montomry Laddr Rviw of nral xponntiation alorithms 91 Th Montomry Laddr [5] is an intrstin modification of th lft-to-riht alorithm. Just as in that alorithm, th Montomry Laddr uss th binary rprsntation of xponnt as wll. Th workin of th Montomry Laddr and th lft-to-riht alorithm, is rlatd to radin th subsqunt bits of th xponnt, from th most to th last sinificant bit. Th diffrnc in th Montomry Laddr is that it bins radin from th scond bit. In th Montomry Laddr, w calculat two possibl partial rsults in on stp, which ar: raisin to th squar and raisin to th squar with multiplyin by. Dpndin on th valu of th nxt xponnt bit, w choos th propr partial rsult. In this alorithm, thr ar two auxiliary variabls - x 1 and x. Th first on ( ) taks succssivly (durin th xcution of th loop ) th valu of t ( t t 1),, ( t t ) tc., and finally rachs th dsird valu of. Th valu of x in subsqunt loop xcutions has a valu of x1. Variabls x 1 and x ar somthin ( t t 1 m ) lik th complmntary runs of a laddr. Whn x 1 is of valu and th nxt bit of th xponnt (th nxt aftr m) is 1, thn x 1 taks th valu of x1 x, so, ( t t 1 m1) x1 x1. This mans that in this cas, th valu of x 1 is. Whn x 1 is ( t t 1 m ) of valu and th nxt bit of th xponnt is 0, thn w assin x1 x1 to ( t t 1 m 0) x 1, thus, w hav computd. Thr ar two multiplications prformd in ach xcution of loop, and th loop runs lo tims. Althouh th Montomry Laddr rquirs a ratr numbr of oprations than th lft-to-riht alorithm, it has an intrstin proprty. Th calculation of x 1 and x in stp.1 can b prformd in paralll. Considrin th asymptotic complxity of this alorithm, thr ar O(lo ) multiplications to prform, th sam as for th two prvious alorithms. Montomry Laddr Input: an lmnt G and a positiv intr = ( t t 1 1 0) Output: 1. x1, x. For i from t 1 down to 0 do th followin:.1. If i = 0 thn: x x1 x and Othrwis: x1 x1 x and 3. Rturn x 1 x x1 x1 x 1.5. Slidin-window alorithm Th ida of th slidin-window [3] alorithm is basd on usin th fact that crtain parts of th binary form of th xponnt ar oftn rpatd. Havin dtrmind th valu of a crtain partial powr, w can us it rpatdly to

6 9 A. Jakubski, R. Prliński calculat th corrct powr. For this rason, w distinuish th prcomputation sta in th slidin-window alorithm. Th prcomputation is to dtrmin all odd 1 powrs of from 1 to k 1 inclusiv, whr k is th siz of th window. Th ratr window siz (th larr k), th mor th oprations ncssary for calculatin th prcomputation, which should rsult in a fwr numbr of oprations in th rlvant part of th alorithm. Howvr, if th window siz is too lar, th cost of th prcomputation will not b compnsatd by a smallr numbr of multiplications in th rlvant part of th alorithm. Th slidin-window alorithm Input:, = ( t t 1 1 0) whr t = 1, intr k 1 Output: 1. Prcomputation: , For i from 1 to k 1 do th followin: i+ 1 i 1. A 1, i t 3. Whil i 0 do th followin: 3.1. If i = 0 thn: A A and x1 x1 Othrwis: Find th lonst bitstrin ii 1 l such that i l + 1 k and = 1, do th followin: i l+ 1 A A ( ii 1 l ), i l 1 4. Rturn A l Th alorithm works similarly to th lft-to-riht alorithm. Th diffrnc is that it movs du to th window siz k, instad of movin bit by bit. Thus, w can sav to k 1 multiplications oprations for all k-bits of th xponnt Exampl W want to count th numbr of In this cas, th binary form of xponnt = (10) = (). As its lnth is 14, valu t = 13. Th siz of th window w st k = 3. Th valu of variabl subscript corrsponds to th valu of its powr. In prcomputation w dtrmin: In stp 1.1: 1, In stp 1.: 3 1, 5 3, 7 5. Th xampl of th alorithm for = is shown in Tabl 3. i runs for 14 valus which corrsponds to th lnth of th binary xponnt (from 0 to 13).

7 Rviw of nral xponntiation alorithms 93 In th cas of th us of a window, w rduc valu i of th window siz. W rais partial rsult A to th squar as many as is th window siz and multiply by th valu of th usd pattrn. If th window is not matchd, variabl i is dcrmntd (partial rsult A is raisd to th squar). Workin of slidin-window alorithm, for = Tabl 3 i computd xponnt A window ( ) = ( ) = ( ) = ( ) = ( ) = Powr tr Th analysis of alorithms for xponntiation can b prformd basd on th powr tr [4]. Th nods of this tr ar valus, which xponnt can adopt. Th followin lvls of th tr ar obtaind as a rsult of th multiplication of nods at th lvls abov th lvl analyzd. Th root of th tr rprsnts th th valu of 1. Th path in th tr is th alorithm cours for a fixd valu of. Th path is thus a squnc of additivs, for a fixd xponnt [4]. Th path lnth (numbr of path branchs) xprsss th numbr of multiplications which th alorithm prforms. Fi. 1. Lft-to-riht alorithm - powr tr

8 94 A. Jakubski, R. Prliński Analysin th cours of th lft-to-riht alorithm for xponnt = 15 (Fi. 1, dashd lin) in th powr tr, w can s that th valu of 15 occurs at th svnth lvl. Thrfor, six branchs connct this lvl with th tr root. This mans that th alorithm rquirs in this cas six multiplications. Th valu of 15 is for th first tim at th sixth lvl, this mans that th optimum numbr of multiplications 15 ncssary to calculat is 5. Th alorithm from lft to riht is not optimal. Fi.. Riht-to-lft alorithm - powr tr Th dashd lin in Fiur shows th analysis of th riht-to-lft alorithm for xponnt = 15. As in th prvious powr tr, th valu of 15 occurs at th svnth lvl. For this xponnt, th alorithm dos not prform an optimum numbr of multiplications. Th riht-to-lft alorithm is not optimal ithr. Fi. 3. Montomry Laddr - powr tr

9 Rviw of nral xponntiation alorithms 95 Lookin at Fiur 3, w can s that usin th Montomry Laddr for xponnt = 15, th alorithm in th powr tr passs throuh th sam nods as th riht-to-lft alorithm. W conclud that for th sam rasons as th abov ivn alorithms, this alorithm is not optimal ithr.. Th alorithm of zro-on squncs Th ida of this mthod coms from th fact that it is bst to rproduc th binary pattrn consistin of bits of valu 1. Such a pattrn (w call it th pattrn of ons) can b obtaind by multiplyin two conscutiv pattrns (whos lnth diffrs by on), consistin of bits 1 and 0 altrnatly (w call thm zro-on squncs). In this alorithm, w mov throuh th bits of xponnt to find th lnth of th lonst squnc of bits of valu 1 (markd by d). Alorithm of zro-on squncs Input:, = ( t t 1 1 0) whr t = 1 Output: 1. Prcomputation: 1.1. Find th lonst strin of ons and assin its lnth to variabl d 1.. 1, n For i from 1 to ( d 1) / do th followin: ni 4ni n i n i,, 4n + 1 4n 4n i ni If d vn thn: nd / 4dd/ 1 + 1, n d / n d /. A 1, i t 3. Whil i 0 do th followin: 3.1. If i = 0 thn: A A and i i 1 Othrwis: Find th lonst bitstrin ii 1 l that matchs th bit pattrn, such that i l + 1 d and do th followin: i l+ 1 A A, i l 1 ( ii 1 l ) 4. Rturn A In th prcomputation, w construct a bas consistin of all th zro-on pattrns and pattrns of ons of a lnth lss than or qual to valu d. Tabl 4 shows th calculation of succssiv zro-on lmnts for a lnth not xcdin 9. Th pattrns of ons ar always obtaind by multiplyin two succssiv pattrns of diffrnt lnths. Th pattrn of ons of lnth 4 will b obtaind by multiplyin th pattrns of No. 4 and No. 5 in Tabl 4. i i

10 96 A. Jakubski, R. Prliński Just as in th lft-to-riht alorithm, w mov hr throuh th bits of xponnt, from th most sinificant to th last sinificant. Whn th pattrn occurs in xponnt, w rproduc it (multiply by th bas lmnt). Whn w hav a squnc composd of bits with valu 0, thn w rais th valu of our tmporary rsult to th squar. Zro-on squncs, prcomputation Tabl 4 No. () (10) cost Exampl 805 Suppos w want to count. In this cas, th binary form of xponnt = (). Bcaus its lnth is 1, valu t = 11. Th lonst strin of ons of th xponnt has a lnth of 4. Tabl 5 prsnts all th lmnts of prcomputation. Prcomputation for xponnt = 805 Tabl 5 () (10) Th xampl of th alorithm for = 805 is shown in Tabl 6. Th first column shows th valus succssivly adoptd by variabl i. Th valu is rducd by th

11 Rviw of nral xponntiation alorithms 97 lnth of th matchd pattrn that w hav in column 4. Variabl A holds th succssivly dtrmind powrs. Alorithm of zro-on squncs for xponnt = 805 Tabl 6 i computd xponnt A window ( ) = ( ) = ( ) = - Blow w prsnt th comparison of th zro-on squncs alorithm, slidinwindow alorithm and lft-to-riht alorithm, for xponnt = 805: 15 multiplications for alorithm of zro-on squncs 16 multiplications for slidin-window alorithm 18 multiplications for lft-to-riht alorithm and for riht-to-lft alorithm. 3. Comparison of prsntd alorithms ffctivnss Th comparison of diffrnt xponntiation alorithms has bn basd on th avra numbr of oprations (multiplications), for 1000 randomly slctd 18-bit xponnts. Th rsults ar prsntd in Tabl 7. Th rsults of th two bst alorithms ar shown in bold. Avra numbr of multiplications prformd for 18-bit xponnts Tabl 7 Alorithm Avra numbr of oprations for 1000 tsts lft-to-riht, binary lft-to-riht, k-ary, k = lft-to-riht, k-ary, k = lft-to-riht, k-ary, k = slidin window, k = slidin window, k = slidin window, k = zro-on squncs As can b sn, th bst rsults wr achivd by th slidin-window alorithm and, by th papr authors' alorithm - th zro-on squncs alorithm. Th bst

12 98 A. Jakubski, R. Prliński position of th zro-on squncs alorithm rsults from a ood slction of prcomputation - th numbr of pr-dsinatd powrs and thir rlationships. Conclusion In practic, th alorithm of zro-on squncs for lar xponnts is lss ffctiv than th slidin-window alorithm for a proprly slctd valu of k. This is bcaus th numbr of matchin and rproducd pattrns for th slidin-window alorithm is ratr than for th zro-on squncs alorithm. This is du to a smallr numbr of lmnts nratd in th th prcomputation of this alorithm. In futur, w intnd to improv th alorithm of zro-on squncs in such a way that it could us a larr numbr of rapidly nratin pattrns. Rfrncs [1] Cohn H., A Cours in Computational Albraic Numbr Thory, Sprinr-Vrla, Brlin [] Bach E., Shallit J.O., Alorithmic Numbr Thory, volum I: Efficint Alorithms, Th MIT Prss, Cambrid [3] Mnzs A., van Oorschot P., Vanston S.A., Handbook of Applid Cryptoraphy, CRC Prss, Boca Raton [4] Knuth D., Th Art of Computr Prorammin, volum. Sminumrical Alorithms, Addison Wsly Lonman, 1998 [5] Joy M., Yn S.M., Th Montomry powrin laddr, Cryptoraphic Hardwar and Embddd Systms-CHES 00, s. 1-11