SCALAR MULTIPLICATION ON KOBLITZ CURVES USING THE FROBENIUS ENDOMORPHISM AND ITS COMBINATION WITH POINT HALVING: EXTENSIONS AND MATHEMATICAL ANALYSIS

Transcription

1 SCALAR MULTIPLICATION ON KOBLITZ CURVES USING THE FROBENIUS ENDOMORPHISM AND ITS COMBINATION WITH POINT HALVING: EXTENSIONS AND MATHEMATICAL ANALYSIS ROBERTO M. AVANZI, CLEMENS HEUBERGER, AND HELMUT PRODINGER Abstract. In this paper we prove the optimality and other properties of the τ-adic nonadjacent form: this expansion has been introduced in order to efficiently compute scalar multiplications on Koblitz curves. We also refine and extend results about double expansions of scalars introduced by Avanzi, Ciet and Sica in order to further improve scalar multiplications. Our double expansions are optimal and their properties are carefully analysed. In particular we provide first and second order terms for the expected weight, determine the variance and prove a central limit theorem. Transducers for all the involved expansions are provided, as well as automata accepting all expansions of minimal weight.. Introduction In 985 Miller [] and Koblitz [9] independently proposed to design cryptosystems around the group of rational points of an elliptic curve over a finite field. The performance of any such cryptosystem depends on the efficiency of their fundamental operation, the scalar multiplication: Given a point P and an integer s, compute sp. The generic way of computing scalar multiplications is to use a double-and-add method (isomorphic to a Horner scheme) and a (possibly redundant) base 2 representation of the scalar, the representation of choice being the width-w non-adjacent form, or w-naf, independently introduced by Miyaji et al. [2] and Solinas [8] (see also [, 3, ] for more properties and similar methods). Some families of elliptic curves have arithmetic properties which can be successfully exploited to considerably speed up this operation. Noteworthy are the curves defined by () E a : y 2 + xy = x 3 + ax 2 + with a {, } over a finite field F 2 n. They were first proposed by Koblitz [], whence their name Koblitz curves. Solinas [7, 8] called them anomalous binary curves. The benefit of using them comes from the fact that a scalar multiplication can be performed very efficiently using the Frobenius endomorphism τ. This is the map induced on the curve by the Frobenius automorphism of the field extension F 2 n/f 2, which maps a field element to its square. In fact, the evaluation of the Frobenius is much faster than the addition of two distinct points This paper was written while this author was a visitor at the John Knopfmacher Centre for Applicable Analysis and Number Theory, School of Mathematics, University of the Witwatersrand, Johannesburg. He thanks the centre for its hospitality. This paper was written while this author was a visitor at the John Knopfmacher Centre for Applicable Analysis and Number Theory, School of Mathematics, University of the Witwatersrand, Johannesburg. He thanks the centre for its hospitality. He was also supported by the grant S837-MAT of the Austrian Science Fund. This author is supported by the grant NRF of the South African National Research Foundation.

2 2 R. AVANZI, C. HEUBERGER, AND H. PRODINGER on the curve or the computation of the double of a given point: τ consists just in the squaring of the coordinates, and if a suitable representation of the field F 2 n is chosen squarings are computationally almost free operations. Instead of computing sp using a double-and-add method, one uses an expression n i= s iτ i with n n by this it is understood that n n + c for a small absolute constant c and such that sp = n i= s iτ i (P ). Such an expression can be evaluated easily via a Horner scheme, resulting in an algorithm using only repeated applications of τ interspersed with additions of the base point P. Solinas introduced a method for computing the s i s efficiently leading to a representation of any given scalar s where on average n/3 of the s i are nonzero. His representation satisfies the syntactical property s i s i+ =, akin to that of the non adjacent form of any integer. Because of this his recoding is called the τ-naf. Knudsen [8] and Schroeppel [6] independently proposed a technique to speed up scalar multiplication on all elliptic curves over binary fields based on point halving. This method computes the multiple R of any point P of odd order such that 2R = P and R P. The point R is denoted as P. Since for curves of order twice a prime point halving is up to three 2 times as fast as point doubling, it is possible to improve performance of scalar multiplication by expanding the scalar using powers of /2 and replacing the double-and-add algorithm with a halve-and-add method. The present paper deals with properties of integer expansions which are associated to Koblitz curves, as well as with techniques combining point halving and Frobenius expansions introduced in [2]. The latter, which are used to improve the speed of scalar multiplication, are extended in an optimal way, and a complexity analysis of the resulting methods is provided. The techniques in [2] stem from the following observation. Let Q := τ( P ). There exist 2 expressions of the form k i= ε iτ i where ε i {, ±}, ε ε k with the property that k i= ε iτ i (P ) = k i= δ iτ i (Q) for suitable δ i s in {, ±} but the number of non-zero δ i s is considerably smaller than the amount of non-zero ε i s. In [2] three different types of such expressions are presented which are then used to compute sp as (2) n i= s () i τ i (P ) + n 2 i= s (2) i τ i (Q) with n, n 2 n. The difference with Solinas method is that the number of non-zero coefficients among the s (j) i is now about 2n/7. The scalar multiplication can be performed without additional precomputations but doubling the number of Frobenius applications. This still leads to a non-negligible speed-up (cf. [2, Algorithm 3]). Alternatively, Q can be precomputed and the number of Frobenius applications corresponds to Solinas method. All the expressions presented in [2] share the property that only two of the δ i s are nonzero. Ciet s thesis [3] contains a heuristic approach for deriving more complicated expressions from the given ones but the resulting improvement is minimal. A brute-force search on a computer reveals that there is at least another family of τ-adic expressions simplifying to an expression with two non-zero coefficients, and this has been the starting point for the present research. The main aim of this paper is to refine the methods in [2] and [3] giving an optimal splitting of the type (2), and to give a more precise complexity analysis. It also turned out that some information about the τ-naf was apparently missing from the literature. In particular, we found no proof that the τ-naf is a τ-adic recoding of minimal

3 SCALAR MULTIPLICATION ON KOBLITZ CURVES 3 weight. Also, explicit transducers for computing the τ-naf have not been described. Exactly as for the NAF, the τ-naf is some recoding of minimal weight, but it is not the only minimal expansion. However, the non-adjacency property implies that every number has a unique τ-naf. We then provide automata that accept as valid inputs only the recodings of minimal weight. These results are collected in Section 2. In the section that follows we turn our attention to the double expansions of type (2). We introduce a double expansion which we call the wide-double-naf, prove that it has minimal weight among all the double expansions, and provide automata that validate the double expansions of minimal weight. The average weight of the wide-double-naf is n/. Transducers computing the wide-double-naf of scalars are also provided, which can be trivially transformed in recoding algorithms that employ table look-ups. Finally, a complexity analysis with second order terms, variance and a central limit theorem is given. Section contains a refined analysis of the double digits in the wide-double-naf. An appendix contains some illustrations showing fractals that appear when evaluating some τ-nafs, as well as odometers for adding ± to an existing τ-naf. 2. τ-expansions We consider here a curve defined by equation () over a finite field F 2 n and set µ = ( ) a. Let τ denote the Frobenius automorphism of the field extension F 2 n/f 2, i.e., τ(x) = x 2. Since the equation of the curve E a is invariant under τ, this map permutes the F 2 n-rational points of the curve. It is well-known (cf. Solinas [8, Section.]) that for each point P E a (F 2 n), we have (τ 2 + 2)P = µτ(p ), which implies that we can identify τ with the complex number satisfing (3) τ = µτ. Now, for any z Z[τ], a τ-expansion of z is an expression s = (..., s 2, s, s ) {,, } such that only finitely many s j and value τ (s) := j s jτ j = z. We will identify finite and (left) infinite sequences in the natural way by padding with leading zeros. The Hamming weight of s is the number of j such that s j. If m Z has a τ-expansion s and P E a (F 2 n), mp can be computed as j s jτ j (P ). Obviously, the Hamming weight corresponds to the number (plus ) of additions on the curve E a. A τ-nonadjacent-form (τ-naf) of z is a τ-expansion s of z satisfying s j s j+ = for all j, i.e., an expansion that does not contain adjacent nonzero digits. Solinas [8, Section.2, Theorem ] showed that each z Z[τ] has a unique τ-naf. In Figures and 2, there is a transducer which computes the τ-naf of an integer from any other τ-expansion from right to left for µ = and µ =, respectively. In various places, we write for and ε for the empty word. We note that all transducers in this paper read their input and write their output from right to left. For all transitions i d o j in the transducers in Figures and 2, we have d + value τ (i) = τ(value τ (j) + value τ (.o)), where value τ (s k s.s s l ) = k j= l s jτ j. Furthermore, if i has l i and j has l j digits after the τ-point, then o has length +l i l j. This implies that the transducers indeed produce a τ expansion of the value of its input. Obviously, the transducers produce a NAF.

4 R. AVANZI, C. HEUBERGER, AND H. PRODINGER. ε ε ε... ε ε ε ε. ε ε ε. Figure. Transducer to compute the τ-naf from any τ-expansion from right to left, where µ =. As in the case of the binary nonadjacent form introduced by Reitwiesner [5], the τ-naf minimizes the Hamming weight, which implies that the use of the τ-naf of m Z for computing mp minimizes the number of curve additions required. Theorem. Let z Z[τ]. Then the Hamming weight of the τ-naf of z is minimum amongst all τ-expansions of z. Direct proof. We claim that for any τ-expansion s with any (rational) integer digits, we have c(s) c(naf(s)), where c(s) := j s j and NAF(s) denotes the τ-naf of value τ (s).

5 SCALAR MULTIPLICATION ON KOBLITZ CURVES 5. ε ε ε. ε.. ε ε ε. ε ε ε. Figure 2. Transducer to compute the τ-naf from any τ-expansion from right to left, where µ =. It is clear that the theorem is a consequence of this claim, since for expansions with digits {, ±}, the costs c equal the Hamming weight. We prove this claim by induction on c(s). Without loss of generality, we may assume that s >. We choose k Z such that s 2k 2. We have value τ (..., s 3, s 2, s, s ) = value τ (..., s 3, s 2 k, s + µk, s 2k) =: value τ (s ). Of course, c(s ) = c(s) + s 2 k s 2 + s + µk s + (s 2k) s c(s). Since c(..., s 3, s 2, s ) < c(s ) c(s), we may replace this expansion by its τ-naf by induction

6 6 R. AVANZI, C. HEUBERGER, AND H. PRODINGER hypothesis without increasing its cost c. We conclude that value τ (s) = value τ (s ) for some s such that s {, 2}, (..., s 3, s 2, s ) is in τ-naf and c(s ) c(s). We note that for arbitrary t 3, t, we have (a) (b) (c) value τ (,, 2) = value τ (, µ, ), value τ (, µ, 2) = value τ (,, ), value τ (t 3,, µ, 2) = value τ ( µ + t 3,,, ) (note that the cost c of the left hand side is always larger than that of the right hand side) and (5a) (5b) (5c) (5d) value τ (t 3,,, 2) = value τ ( µ + t 3,, µ, ), value τ (t,,,, 2) = value τ ( + t, µ,, µ, ), value τ (t 3,, µ, ) = value τ ( µ + t 3,,, ), value τ (, µ, ) = value τ (,, ). In the last four equalities, the cost c of the left hand side is not smaller than that of the right hand side and the last three or two digits of the right hand side are already in nonadjacent form. We consider the equivalences () and (5) as replacement rules: replace an occurrence of the left hand side by the corresponding right hand side. Applying these rules on s and then using the induction hypothesis for the resulting expansion (in the case of the rules in ()) or on the left part of the resulting expansion (i.e., excluding the last two or three digits) in the case of the rules in (5), our claim is proved. Automatic proof. The same result can also be proved using the argument of [5, Lemma 9] and computations involving the transducers in Figures and 2: We consider the weighted digraph induced by the transducers in Figures and 2, respectively, with edge weights w(i d o j) := c(d) c(o), where c(s) := j s j and c(ε) =. By using the Ford-Bellman algorithm (cf. Cook et al. []), we conclude that there is no negative cost cycle, which implies that the shortest path (in terms of the costs c) from to has weight, i.e., the τ-naf is a τ-expansion of minimal weight. As in [5, Remark 2], we conclude that any optimal τ-expansion corresponds to edges satisfying π(i) + w(i d o j) = π(j), where π(i) denotes the vertex potential of vertex i, i.e., the weight of the shortest path from the initial vertex to vertex i. Therefore, the set of optimal τ-expansions equals the set of expansions recognized by the automata in Figures 3 and for µ = and µ =, respectively. Theorem 2. Let s be a τ-expansion of some z Z[τ]. Then the Hamming weight of s is minimum amongst all τ-expansions of z if and only if s is accepted by the automaton in Figure 3 for µ = or Figure for µ =. 3. New Scalar Decomposition and Scalar Multiplication Avanzi, Ciet, and Sica [2] proposed the following method for computing mp, where m Z and P E a (F 2 n). They set Q := τ( P ), which is easy to compute (cf. [2]), and compute 2

7 SCALAR MULTIPLICATION ON KOBLITZ CURVES Figure 3. Automaton accepting all τ-expansions of minimal weight from right to left for µ =. elements m, m Z[τ] such that mp = m P + m Q, choosing τ-expansions of m and m such that the sum of their Hamming weights is small. We will refine their method giving an optimal such splitting, give a precise analysis involving second order terms, the variance, and a central limit theorem. Equation (3) implies that τ 3 + 2τ = µτ 2 = µ(µτ 2) = τ 2µ, hence (6) 2 = µ( + τ 2 )τ. In particular, this means that we can compute 2P as µ ( + τ 2) τp. This alone is not very useful, since it replaces a point doubling with one addition and three Frobenius operations. However, these relations become interesting if we can make repeated use of them. We consider so-called (( µ)( + τ 2 ), )-double expansions ( s() ), where s () and s (2) are s (2) just any τ-expansions of arbitrary elements of Z[τ]. We call two such expansions ( s() ) s (2) and ( s () s() s (2) ) equivalent and write ( ) ( s () ), if value s (2) s (2) τ (s () )( µ)( + τ 2 ) + value τ (s (2) ) = value τ (s () )( µ)( + τ 2 ) + value τ (s (2) ). If we have a point P E a (F 2 n) and set Q = τ( P ), 2 the relation ( s() ) ( s () ) implies that value s (2) s τ(s () )P + value (2) τ (s (2) )Q = value τ (s () )P + value τ (s (2) )Q. The Hamming weight of a double expansion ( s() ) is defined to be the sum of the Hamming s (2) weights of s () and s (2).

8 8 R. AVANZI, C. HEUBERGER, AND H. PRODINGER Figure. Automaton accepting all τ-expansions of minimal weight from right to left for µ =. Let now s be the τ-naf of an m Z. We will construct a double expansion ( s() ) such s (2) that ( s ) ( s() ) and such that the Hamming weight of ( s() ) is minimum. s (2) s (2) Definition. A double expansion ( ) s () (i) s is called a wide-double-naf, if s (2) j = ± implies that s j+2 = s j+ = ( ) (i and s ) j =, where i = 2 i and j. This means that in the language of regular expressions, a wide-double-naf can be written as ( ε ) ( ). We first prove a uniqueness result. Lemma. If s and s are equivalent wide-double-nafs, then they are equal. The proof relies on the following extension of Solinas [8] Lemma 28, which he used to prove the uniqueness of the τ-naf. Lemma 2. Consider z = j s jτ j Z[τ]. Then () z is divisible by τ in Z[τ] if and only if s (mod 2), (2) z is divisible by τ 2 in Z[τ] if and only if s + 2s (mod ),

9 SCALAR MULTIPLICATION ON KOBLITZ CURVES 9 (3) z is divisible by τ 3 in Z[τ] if and only if s 2µs s 2 (mod 8). Proof of Lemma 2. The first two assertions have been proved by Solinas [8]. To prove the last assertion, we see that by definition, the element z is divisible by τ 3 if and only if there are rational integers a, a such that s + s τ + s 2 τ 2 = τ 3 (a + a τ). Multiplying with the complex conjugate τ 3 of τ 3, we get s τ 3 +2s τ 2 +s 2 τ = 8(a +a τ) using τ τ = 2. Reducing this equation using τ = µ τ and the minimal polynomial, we obtain 8(a + a τ) = 3µ(s 2µs s 2 ) 8s 8µs 2 + τ(s 2µs s 2 ). Thus divisibility is equivalent to s 2µs s 2 (mod 8). Proof of Lemma. Let ( ) ( s () s s () ) (2) s be two wide-double-nafs. Without loss of generality, (2) we may assume that ( s () ) ( s () ) s (i) (2) s and that s (2) = for some i {, 2}, which implies s (i ) = for i = 2 i by definition of a wide-double-naf. By definition of equivalence, we have (7) j (s () j s () j )( µ)( + τ 2 )τ j + (s (2) j s (2) j )τ j =. j From the first assertion of Lemma 2 we conclude that Since s (i) = and s (i ) (s () s () )( µ) + (s (2) s (2) ) (mod 2). =, we conclude that ( s () ) ( (k) ). This implies that s j for j, k 2. We set c = µ(s () s () ) and d = (s(2) s (2) ). From (7) we conclude that c( + τ 2 ) + d is divisible by τ 3, which implies (8) (c + d) c d 3c (mod 8) s (2) = s (k) j = by Lemma 2. By assumption, we have (c, d) (, ) and c + d = 2. This contradicts (8). Now we can prove that a wide-double-naf indeed exists and minimizes the Hamming weight in its equivalence class. Theorem 3. Let s be a (( µ)( + τ 2 ), )-double expansion. Then there exists a unique wide-double-naf which is equivalent to s. Its Hamming weight is not larger than that of s. Proof. We allow arbitrary integer digits in s and prove the theorem by induction on c(s) := ( s () j + s (2) ) j. j By (the direct proof of) Theorem, we may replace (s (i) j ) j by its τ-naf (s (i) j ) j for i {, 2} without increasing the costs c. Of course, we have s s. We easily check that for all t (i) j, we have ( ) ( ) () () t 2 t 2 (9a) t (2) 2 µ ( µ + t (2) 2 ), ( ) ( ) (9b), µ

10 R. AVANZI, C. HEUBERGER, AND H. PRODINGER (9c) (9d) (9e) (9f) (9g) ( t () 5 t (2) 5 t () t (2) ( ) ( ) t () t () µ, ( ) ( ) t (2) 2 t (2), 2 ( ) ( ) t () 2 t () 2, µ ( ) ( ), µ µ ) ( t () () 3 t 5 (µ + t (2) 5 ) t () t (2) t () 3 ). We note that in all the above equivalences, the costs c decrease from the left hand side to the right hand side. This means that if we find one of the left hand sides (or its negatives, of course) as subblocks in our double expansion s, we can replace this subblock by the corresponding right hand side and use the induction hypothesis to convert the resulting expansion to a wide-double-naf not increasing the costs. So we may assume that the left hand sides of (9) do not occur (at least in the rightmost digits). Furthermore, we have ) ( ) () t (a) (b) (c) (d) (e) (f) (g) (h) (i) ( t () 6 t (2) 6 ( t () t (2) t () 5 t (2) 5 t () 3 t (2) 3 t (µ + t (2) ) t (2), 3 ) ( ) () t 6 t () 5 t () t (2) 3 ( µ + t (2) 6 ) t (2) 5 t (2) ( + t (2) 3 ), µ ( ) ( ) t () 3 ( µ + t () 3 ), µ µ ) ( ) () t t (2) 3 (µ + t (2) ) t (2), 3 µ ( ) ( ) t (2) 3 ( + t (2), 3 ) µ ( ) ( ) t () 3 ( + t () 3 ) µ, ( ) ( ) µ µ t (2) 3 ( µ + t (2) 3 ), ) ( ) () µ t µ t (2) 3 ( + t (2) ) t (2), 3 ( ) ( ) () () t 3 t 3 µ t (2) 3 ( µ + t (2) 3 ). t () t (2) ( t () t (2) ( t () t (2) () 3

11 SCALAR MULTIPLICATION ON KOBLITZ CURVES We observe that in each of the above equivalences, the costs do not increase from left to right and that the last three digits of the right hand side is always a block which is allowed in a wide-double-naf. This means that we can apply the induction hypothesis to the right hand sides with the last three digits removed. Finally, we note that for every s found above, exactly one of the listed equivalences (or its negative) can be applied. It is straightforward to write down explicitly a computer program that performs the recoding simply by table look-ups. Of course, the rules (9) and () can also be implemented by a transducer. This transducer has 53 states, hence it is not shown in this paper. The transducer can however be used to give an automatic optimality proof following the lines of the automatic proof of Theorem. As a consequence, we also get a characterization of optimal expansions. In this case, the automaton recognizing the optimal expansions can be simplified to 28 states and is shown in Figures 5 and 6 for µ = and µ =, respectively Figure 5. Automaton accepting all double expansions of minimal Hamming weight for µ = In our situation, we are given the τ-naf s of an integer m Z and we are looking for the wide-double-naf which is equivalent to ( s ). In this case, the above mentioned transducer with 53 states can be considerably reduced only the inputs,, can occur, furthermore,

12 2 R. AVANZI, C. HEUBERGER, AND H. PRODINGER Figure 6. Automaton accepting all double expansions of minimal Hamming weight for µ = the NAF-condition on the input can be imposed: The resulting transducer only has 9 states and is shown in Figures 7 and 8 for µ = and µ =, respectively. The labels of the states correspond to carries (before the τ-point ) and stored input where no decision could be made up to now (after the τ-point ). More precisely, for a transition s.s d o t.t we always have ( ( d ) ) s + s tt o and the sum of the lengths of d and s equals the sum of the lengths of t and o. The output is always a wide-double-naf. Not every wide-double-naf can be reached by applying the transducers in Figures 7 and 8. If we consider the output of these transducers as the input of an nondeterministic

13 SCALAR MULTIPLICATION ON KOBLITZ CURVES 3.. ε ε ε.. ε ε ε.. Figure 7. Transducer computing the wide-double-naf equivalent to the (single) input NAF for µ = automaton, convert it to a deterministic automaton and simplify it, we obtain the automaton in ( Figure 9 (for both values of µ). This means that a wide-double-naf s is equivalent to a t ) for some simple τ-naf t if and only if the number of nonzero entries in the second row is even. We can also ask which elements can be represented by a double expansion, when we define the value of a double expansion ( ) s () s to be (t) valueτ (s () ) + value ( µ)(+τ 2 ) τ(s (2) ), i.e., the value in the P -world. By (6), we see that = τ/2. So double expansions ( µ)(+τ 2 ) represent the elements of Z[τ] + τ Z[τ]. The set Z[τ] equals the set Z + τz, so that we have 2 τ Z[τ] = τ Z + τ 2 Z = τ Z + ( µ τ )Z = Z + τ Z. We conclude that double expansions correspond exactly to the set Z + τ Z. 2 We now want to analyze the Hamming weight of the output of the transducers in Figure 7 and 8. We set a (µ) k,l to be the number of τ-nafs of length l whose output after running the transducers in Figure 7 or 8 has Hamming weight k. We consider the generating function G (µ) (U, Z) defined as G (µ) (U, Z) := a (µ) k,l U k Z l. k l For computing this generating function, we consider the labelled adjacency matrix B (µ) (U, Z, Z ) := ( b (µ) ij (U, Z, Z ) ) i 9, j 9

14 R. AVANZI, C. HEUBERGER, AND H. PRODINGER, ε ε,.. ε ε.. ε ε.. Figure 8. Transducer computing the wide-double-naf equivalent to the (single) input NAF for µ =,,, 2,,, Figure 9. Output of the transducers in Figures 7 and 8 (independent of µ) where b (µ) ij (U, Z, Z ) = { U Hamming weight of s Z, if d {, }, U Hamming weight of s Z, if d =, if there is a transition i d s j. The states of the transducer are numbered in some arbitrary way as follows:

15 SCALAR MULTIPLICATION ON KOBLITZ CURVES 5 For µ =, we have Z Z Z UZ UZ UZ UZ UZ UZ UZ B (µ) UZ Z (U, Z, Z ) = Z Z Z. Z Z Z UZ UZ Z UZ UZ UZ UZ UZ UZ In writing down the generating function, we have to care about the fact that our transducer always reads nonzero digits together with its subsequent zero. Thus we have to label such a transition with Z 2, whereas a transition with input label has to be multiplied by Z. There is one exception to this rule: At the end of our input NAF of given length l, we may have to read a single or without its associated, more precisely, we may of course read the associated, but we are not allowed to count it in the input length. In the language of regular expressions, we can write a NAF (from right-to-left) as ( + + ε) ( + () + ( ) ). Therefore, the generating function is (we have to reverse the direction by definition of the matrix product) where G (µ) (U, Z) = (,,..., ) ( I B (µ) (U, Z 2, Z) ) B(U, Z, )v, v = (, U, U, U, U, U, U, U, U) T takes care of the output which has to be written after the last input digit. We note that by chance, v is independent of µ. Using a computer algebra program, we get G (µ) (U, Z) = + 2UZ Z2 + 2UZ 2 UZ 3 + U 2 Z 3 UZ 2U 2 Z 5 + 2U 3 Z 5, ( + Z)( + Z)( + Z + UZ 3 ) again independently of µ. We will therefore drop the index µ for the remainder of the analysis. We now consider the random variable H l which we define to be the Hamming weight of the output of the transducers in Figures 7 and 8 (i.e., the number of elliptic curve summands) reading a random τ-naf of length l, where we consider equidistribution on the set of all τ-nafs of length l. We note that the number of τ-nafs equals the number of binary NAFs and can be calculated as [ ] Z l G(, Z) = [ Z l] + 2Z (Z + 2Z 2 ) = 3 2l 3 ( )l = 3 2l ( + O(2 l )), cf. for instance [6]. Therefore, each NAF of length l occurs with probability 3 2 l (+O(2 l )).

16 6 R. AVANZI, C. HEUBERGER, AND H. PRODINGER Thus the expectation E(H l ) equals [ E(H l ) = ] ( ) Z l G(U, Z), 3 2l ( + O(2 l )) U U= which can be calculated to be E(H l ) = l O(2 l/2 ).25l O(2 l/2 ). This should be compared with the average Hamming weight of NAF s of length l, being l O(2 l ). For computing the variance V(H l ), we calculate We conclude that E(H l (H l )) = 3 2l ( + O(2 l )) [ ] ( ) Z l 2 G(U, Z) U 2 U= = 6 l l O(2 l/2 ). V(H l ) = E(H l (H l )) + E(H l ) (E(H l )) 2 = l O(l2 l/2 ).325l O(l2 l/2 ). From Hwang s [7] quasi-power theorem, we conclude that we have the following central limit theorem: ( lim P H l l ) l + h 2l = h e t2 /2 dt. 8 2π We summarize our findings in the following theorem. Theorem. Let P be a point on E a (F 2 n), m Z and s a τ-naf of m with l digits. Then the transducers in Figures 7 and 8 compute an expansion ( s() s (2) ) such that mp = value τ (s () )P + value τ (s (2) )τ( 2 P ). The right hand side can be written as a sum of H l summands. The random variable H l (where all τ-nafs of length l are considered to be equally likely) satisfies E(H l ) = l O(2 l/2 ).25l O(2 l/2 ), V(H l ) = l O(l2 l/2 ).325l O(l2 l/2 ), ( lim P H l l ) l + h 2l = h e t2 /2 dt. 8 2π

17 SCALAR MULTIPLICATION ON KOBLITZ CURVES 7. Refined Analysis Instead of considering the Hamming weight of the output of the algorithm, we produce here a refined analysis, by counting the digits in the output. The following four digits will be counted:,,, (in that order). The following two tables give, for µ = resp. µ =, the average and variances of these counts (the second line is always the floating point representation). This is easy to achieve from the transducer, by appropriately labelling the edges with auxiliary variables (instead of just one variable U as before). µ = Average Variance l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) µ = Average Variance l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) l O(2 l/2 25l ) O(l2 l/2 ).625l O(2 l/2 ).8828l O(l2 l/2 ) References [] R. Avanzi, A Note on the Signed Sliding Window Integer Recoding and a Left-to-Right Analogue, Proceedings of Selected Areas in Cryptography 2, Waterloo, ON, Canada, 9 August 2, Lecture Notes in Comput. Sci., Springer-Verlag, Berlin, 2. [2] R. Avanzi, M. Ciet, and F. Sica, Faster scalar multiplication on Koblitz curves combining point halving with the Frobenius endomorphism, Proceedings of Public Key Cryptography 2, Singapore, March, 2, Lecture Notes in Comput. Sci., vol. 297, Springer, 2, pp. 28. [3] M. Ciet, Aspects of secure and efficient implementatation of elliptic curve cryptosystems, Ph.D. thesis, Université Catholique Louvain-la-Neuve, 23. [] W. J. Cook, W. H. Cunningham, W. R. Pulleyblank, and A. Schrijver, Combinatorial optimization, Wiley-Interscience Series in Discrete Mathematics and Optimization, John Wiley & Sons Inc., New York, 998. [5] C. Heuberger and H. Prodinger, Analysis of alternative digit sets for nonadjacent representations, Preprint available at

18 8 R. AVANZI, C. HEUBERGER, AND H. PRODINGER [6], Carry propagation in signed digit representations, European J. Combin. 2 (23), [7] H.-K. Hwang, On convergence rates in the central limit theorems for combinatorial structures, European J. Combin. 9 (998), [8] E. W. Knudsen, Elliptic Scalar Multiplication Using Point Halving, Advances in Cryptology Asiacrypt 99, Lecture Notes in Comput. Sci., vol. 76, Springer-Verlag, Berlin, 999, pp [9] N. Koblitz, Elliptic curve cryptosystems, Math. Comp. 8 (987), no. 77, [] N. Koblitz, CM-curves with good cryptographic properties, Advances in cryptology CRYPTO 9 (Santa Barbara, CA, 99), Lecture Notes in Comput. Sci., vol. 576, Springer, Berlin, 992, pp [] V. S. Miller, Use of elliptic curves in cryptography, Advances in cryptology CRYPTO 85, Lecture Notes in Comput. Sci., vol. 28, Springer-Verlag, Berlin, 986, pp [2] A. Miyaji, T. Ono, and H. Cohen, Efficient elliptic curve exponentiation, Information and communications security. st international conference, ICICS 97, Beijing, China, November, 997. Proceedings (Y. et al. Han, ed.), LNCS, vol. 33, Springer-Verlag, 997, pp [3] J. A. Muir and D. R. Stinson, Minimality and other properties of the width-w nonadjacent form, Tech. Report CORR 2-8, Centre for Applied Cryptographic Research, 2, available at cacr.math.uwaterloo.ca/techreports/2/. [], New minimal weight representations for left-to-right window methods, Tech. Report CACR 2-3, Centre for Applied Cryptographic Research, 2, available at uwaterloo.ca/techreports/2/. [5] G. W. Reitwiesner, Binary arithmetic, Advances in computers, vol., Academic Press, New York, 96, pp [6] R. Schroeppel, Elliptic curve point ambiguity resolution apparatus and method, International Application Number PCT/US/3, filed 9 November 2. [7] J. A. Solinas, An improved algorithm for arithmetic on a family of elliptic curves, Advances in Cryptology - CRYPTO 97. 7th annual international cryptology conference. Santa Barbara, CA, USA. August 7-2, 997. Proceedings (B. S. jun. Kaliski, ed.), LNCS, vol. 29, Springer, Berlin, 997, pp [8], Efficient arithmetic on Koblitz curves, Des. Codes Cryptogr. 9 (2), no. 2-3, 95 29, Towards a quarter-century of public key cryptography. Appendix. Illustrations In this appendix, we illustrate a few properties of the τ-naf, for the reader s benefit. We use the following representations of (double-)digits by colors: Magenta, Blue, Red Green Figure describes all numbers a + bτ, for a, b < 2 and µ =, scaled into a square, and the digit with index (the rightmost digit has index ). Figure describes all numbers a + bτ, for a, b < 2 and µ =, scaled into a square, and the digit with index. Figure 2 describes all numbers a + bτ, for a, b < 2 and µ =, scaled into a square, and the double digit of the wide-double-naf with index.

19 SCALAR MULTIPLICATION ON KOBLITZ CURVES 9 Figure. τ-naf, µ =, k =, M = 2 Figure. NAF, µ = +, k =, M = 2

20 2 R. AVANZI, C. HEUBERGER, AND H. PRODINGER Figure 2. Wide-Double-NAF, µ =, k =, M = 2 Figure 3 describes all numbers a + bτ, for a, b < 2 and µ =, scaled into a square, and the double digit of the wide-double-naf with index. Another interesting construction when dealing with number systems, is the odometer. This is a transducer that describes how to add (or subtract). We will give these odometers for the τ-naf s with µ = ± in the Figures and 5. The meaning of the states is as in Figures and 2. Note that there are two states labelled (and ), since the transducer checks that the input is indeed a nonadjacent form. (R. Avanzi) Institute for Experimental Mathematics (IEM) Universität Duisburg Essen, Ellernstraße 29, D-5326 Essen, Germany, Communication Security (COSY) Electrical Engineering and Information Technology, Ruhr-Universität Bochum, Universitätsstraße 5, D-78 Bochum, Germany address: mocenigo@exp-math.uni-essen.de (C. Heuberger) Institut für Mathematik B, Technische Universität Graz, Steyrergasse 3, 8 Graz, Austria address: clemens.heuberger@tugraz.at (H. Prodinger) The John Knopfmacher Centre for Applicable Analysis and Number Theory, School of Mathematics, University of the Witwatersrand, P. O. Wits, 25 Johannesburg, South Africa address: helmut@maths.wits.ac.za

21 SCALAR MULTIPLICATION ON KOBLITZ CURVES 2 Figure 3. Wide-Double-NAF, µ = +, k =, M = 2

22 22 R. AVANZI, C. HEUBERGER, AND H. PRODINGER. ε ε. ε ε.. ε, ε. ε ε. ε. Figure. Addition of ± for NAFs with µ =. Use initial state for addition of and initial state for addition of.

23 SCALAR MULTIPLICATION ON KOBLITZ CURVES 23. ε ε.... ε ε ε ε, ε ε. ε. Figure 5. Addition of ± for NAFs with µ = +. Use initial state for addition of and initial state for addition of.