COUNTING OPTIMAL JOINT DIGIT EXPANSIONS. Peter J. Grabner 1. Clemens Heuberger 2.

Transcription

1 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 COUNTING OPTIMAL JOINT DIGIT EXPANSIONS Peter J. Grabner Institut für Mathematik A, Technische Universität Graz, Steyrergasse 3, 8 Graz, Austria peter.grabner@tugraz.at Clemens Heuberger 2 Institut für Mathematik B, Technische Universität Graz, Steyrergasse 3, 8 Graz, Austria clemens.heuberger@tugraz.at Helmut Prodinger 3 Department of Mathematics, University of Stellenbosch, Stellenbosch 76, South Africa hproding@sun.ac.za Received: /9/5, Revised: 5/7/5, Accepted: 8/2/5, Published: 9/8/5 Abstract This paper deals with pairs of integers, written in base two expansions using digits, ±. Representations with minimal Hamming weight (number of non-zero pairs of digits) are of special importance because of applications in Cryptography. The interest here is to count the number of such optimal representations.. Introduction In many public key cryptosystems, raising elements of a given group to large powers is an important issue. Let P be an element of a given group, whose operation will be written additively. We need to form np for large integers n in a short amount of time. A classical way to do this is the binary method, which uses the operations doubling and adding P. If n is written in its binary representation, the number of doublings is log 2 n and an addition corresponds to an occurrence of the digit, so the cost of the multiplication depends on the length and number of ones in the binary representation. If addition and subtraction are equally costly in the underlying group, it makes sense to consider signed binary representations, which additionally use the digit. Clearly, such a digit corresponds to a subtraction. In general, there are many representations of n with digits {, ±}, and This author is supported by the START-project Y96-MAT of the Austrian Science Fund. 2 This author is supported by the grant S837-MAT of the Austrian Science Fund. 3 This author is supported by the grant NRF of the South African National Research Foundation

2 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 2 thus one is interested in those with a low Hamming weight (number of nonzero digits), as it leads to low costs. A prominent representation achieving this is the non-adjacent form (NAF), which was rediscovered many times. It is characterized by the fact that x j x j+ = holds for all j (of two adjacent digits, at least one is zero). On average, only about /3 of the digits are non-zero (as opposed to /2 in standard binary representations). The enumeration of representations with digits {, ±} of minimal Hamming weight was addressed in [4]; without going into technicalities, what came out of that analysis is that most numbers have many optimal representations. (Numbers like 2 n have only one optimal representation, but are extremely rare.) These ideas apply also mutatis mutandis to the computation of n P + n 2 Q; instead of computing n P and n 2 Q separately, one can use doublings and occasional additions of P, Q, orp + Q. Given two integers n and n 2,ajoint expansion of n =( n n 2 ) is a sequence of digit vectors ε l ε l ε with ε j =( x j y j ) {, ±} 2 and n = value(ε l ε l ε )= l 2 j ε j. j= Its (joint) Hamming weight is the number of nonzero digit vectors { j ε j ( )}. This leads to a linear combination algorithm which performs doublings and occasional additions of ±P, ±Q, ±P ± Q (which are precomputed values). Clearly now one is interested in representations leading to as little additions as possible (i.e. low Hamming weight). On average, about /2 of the pairs of digits are and thus require no extra addition. The reader is invited to consult the paper [5] and the references therein. As indicated, representations of minimal Hamming weight are of interest. In [5], a special representation, termed Simple Joint Sparse Form, was introduced. It can be described e.g., by the two syntactic rules if x j y j then x j+ = y j+, if x j = y j =thenx j+ = y j+ =. Earlier, Solinas [4] had introduced the so called Joint Sparse Form (that is less simple) and characterised by another set of syntactic rules: of any three consecutive positions, at least one is double zero, if x j x j+ theny j+ = ± andy j =, if y j y j+ thenx j+ = ± andx j =. Both representations are minimal with respect to their Hamming weight. Another representation of minimal Hamming weight was introduced in the paper [6]. We will not repeat its

3 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 3 definition here but only stress the important fact that it can be constructed from left-to-right by a transducer. This representation as well as the simple joint sparse form can be extended in a straight-forward way to d dimensions (instead of 2); details are given in [5]. Such representations can be used to compute linear combinations n P + +n d P d. In general, all these minimal representations are different, and there exist other ones. Thus, a natural question is to determine the number of minimal representations. The present article is devoted to the enumeration of optimal joint representations. Again, loosely speaking, it will turn out that most pairs of integers have many optimal representations. Precise formulations will come later in the paper. Throughout the paper the norm is the maximum norm. 2. Recognising minimum weight expansions In [5] we gave an algorithm for computing the Simple Joint Sparse Form of an integer vector. This is a joint expansion of minimal weight. It can be implemented as a transducer automaton, which converts any signed binary expansions of two integers into this joint expansion (the transducer shown in [5] gives only the conversion from ordinary binary expansion, but can be extended). The general procedure described in [9, Remark 2] can be used to obtain an automaton recognising expansions of minimal weight. This procedure relies on the fact that optimal expansions correspond to shortest paths in the conversion transducer with edge-weights corresponding to the improvement of the Hamming weight. The resulting automaton is shown in Figure. We call expansions of n which minimise the Hamming weight over all possible expansions of n minimal joint expansions of n. We define the transition matrices A (ε) =(a (ε) i,j ) i,j 2 with ε {, ±} 2 by setting { a (ε) i,j =, if there is a transition from state i to state j labelled with ε,, otherwise. By construction (cf. also Figure ), these matrices satisfy the relation A (ε) (,,...,) T (,,...,) T, (2.) where this inequality has to be interpreted component-wise. The following fact will be used later. Lemma Let (ε L ε ) be a minimal joint expansion and L K. Then(ε L ε K ) and (ε K ε ) are minimal joint expansions. Proof. Since (ε L ε ) is a minimal joint expansion, there is a path in the automaton in Figure from state with this label. Since there is a path from every state to state with

4 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 4 6 ; 7 ; 5 ; ; 5 ; 4 ; 3 ; 8 ; 2 6 ; ; 2 ; ; ; 4 ; 7 ; 8 ; 9 ; ; ; ; 2 Figure : Automaton recognising joint expansions of minimum weight (initial state ).

5 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 5 label, there is a path from state to state with input label (ε K ε ), hence (ε K ε ) is a minimal joint expansion. Let n = value(ε L ε K ). If (ε L ε K ) was not a minimal joint expansion, then there would be a joint expansion (η L η K )ofn of smaller Hamming weight. But this would imply that (η L η K ε K ε ) is a joint expansion of value(ε L ε ) of smaller joint Hamming weight than (ε L ε ), which is a contradiction to the minimality of (ε L ε ). Thus (ε L ε K ) is a minimal joint expansion, too. Lemma 2 Let n Z 2 and (ε K,...,ε ) (ε K ) be an optimal expansion of n. Then K { log 2 n, log 2 n +}. Proof. We have K n = ε l 2 l which yields K log 2 n. l= K ε l 2 l < 2 K+, l= For the opposite inequality we choose L = log 2 n, setε l =forl>k, and consider ε l 2 l ε l 2 l n + n < 2L+2. l=l+ l=l+ We conclude that (ε K,...,ε L+ ) is an optimal joint expansion of an integer vector m with m < 2. All these vectors have a joint expansion of weight at most, which is clearly optimal. If m the non-zero column must be ε L+. 3. Counting frequencies For an integer vector n the number of representations of minimal weight is denoted by p(n). In the following we will study this quantity in detail. For technical purposes we define the functions p j (n) (forj =,...,2) as the number of paths in the automaton in Figure from state j to state with label ε L ε L ε, with the additional requirement that n = value(ε L ε L ε ). By construction of the automaton we have p(n) =p (n). From the definition of p j (n) and the transition matrices A (ε) we obtain the set of recur-

6 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 6 rence equations (j =,...,2) 2 p j (2n, 2n 2 )= l= 2 p j (2n +, 2n 2 )= l= 2 p j (2n, 2n 2 +)= l= 2 p j (2n +, 2n 2 +)= l= a (,) j,l p l (n,n 2 ) a (,) j,l p l (n,n 2 )+ a (,) j,l p l (n,n 2 )+ a (,) j,l p l (n,n 2 )+ 2 + l= 2 l= 2 l= 2 l= a (, ) j,l p l (n,n 2 +)+ a (,) j,l p l (n +,n 2 ) a (, ) j,l p l (n,n 2 +) a (,) j,l p l (n +,n 2 ) 2 l= a (, ) j,l p l (n +,n 2 +). (3.) Note that by (2.) all the sums 2 l= in the above equations actually have only one non-zero term. The following Lemma is of some interest on its own. We state without making further use of it. Lemma 3 Let n Z 2 and j 2 with p j (n).thenp j (n) =p (n). Proof. Let (ε L ε ) be the label of a path from state j to state in the automaton in Figure with value(ε L ε )=n. Since the automaton is strongly connected, there is a path from state to state j with input label (η K η ), say. Thus (ε L ε η K η ) is the label of a path from state to state in the automaton, which implies that (ε L ε η K η ) is a minimal joint expansion. From Lemma we see that (ε L ε ) is the label of a path from state in the automaton. We conclude that p j (n) p (n) andthat(ε L ε ) is a minimal joint expansion of n. Let now (ε L ε ) be some minimal joint expansion of n, hence the joint Hamming weight of (ε L ε )equalsthatof(ε L ε ). This implies that (ε L ε η K η )isajoint expansion of value(ε L ε η K η ) with the same joint Hamming weight as (ε L ε η K η ). Thus (ε L ε η K η ) is the label of a path from state too, which implies that (ε L ε ) is the label of a path from state j in the automaton. This shows that p (n) p j (n) and finishes the proof of the lemma. Lemma 4 The counting function of minimal expansions satisfies p(n) =O( n γ ) (3.2) for γ = 3 log 2 θ = ,whereθ is the positive root of the equation θ 3 4θ 2 θ 2=. The exponent γ is best possible.

7 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 7 Proof. TheproofwillmakeuseoftheSimple Joint Sparse Form introduced in [5]. Here we only use its syntactic properties recalled in the introduction: every pair of integers n has a unique joint expansion satisfying the regular expression W with {( ) ( ) ( ) ( ) ( ) ( )} ± ± ± ± ± W =,,,,,, ± ± ± ± ± where all signs can be chosen independently ( W = 25). This representation allows to reduce the 84 functions p j (n + δ) occurring in (3.) to the 9 functions contained in the vector q(n) = ( p (n),p (n +( )),p (n +( )),p 2 (n +( )),p 3(n +( )), p 5 (n +( )),p 7(n +( )),p 9 (n +( )),p 2(n +( ))) T. Indeed, for any w W, there is a matrix M w such that q(2 w n + value(w)) = M w q(n); the matrices M w can be computed using (3.). Here, w denotes the length of the word w. For instance, we have M ( ) =. 2 2 We note that q() =v =(,,,,,,,, ) T. From this observation it follows that q(value(w L w L w )) = M wl M wl M w v. It turns out that the matrices M w lie in five orbits under the action of the group of permutation matrices. We write the matrices M w = P w S R(w) Q w with certain permutation matrices P w and Q w. The function R is given by R( )=R( R( R( )=R( R( )=R( )=R( )=R( R( )=R( R( )=R( R( )=, )=R( )=R( )=, )=R( )=2, )=R( )=R( )=3, )=R( )=R( )=3, )=R( )=R( )=4, )=R( )=R( )=4,

8 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 8 and the matrices S j are defined as S = S 3 =, S = , S 4 =, S 2 = Note that the characteristic polynomial of S 4 is x 3 4x 2 x 2andθ is its dominant eigenvalue. Furthermore, we can choose the permutation matrices P w and Q w so that Q ( ) = P ( ),Q ( ) = P ( Q ( ) = P ( This shows that r k = q ),Q ( ),Q ( ) = P ( ) = P ( ),Q ( ) = P ( ( value ( (. ),Q ( ),Q ( ) )) k = P ( )S4k from which we deduce that r k θ 4k and lim sup n p(n) n γ >., ) = P ( ), ) = P ( ). 4 Q ( )v, For the upper bound we proceed by induction. For any w W we prove that for at least one of three consecutive values of l the component-wise inequality q(value(w l w l w )) C(w l )θ w l + + w P w l v θ holds. Here v θ is the (Perron-Frobenius) eigenvector (with first component ) associated to the eigenvalue θ of the matrix S 4 and { 9 if R(w l )=, C(w l )= otherwise. The proof of the induction step was performed by studying 47 cases with Mathematica. This verification took seconds. Certainly, this implies p(n) =O( n γ ). 4. Construction of a measure We define a sequence of measures, which reflect the distribution of p(n). It turns out that it is easier to study a modified version of p(n). We define p (K) (n) tobethenumberofjoint expansions of minimal weight of n of length at most K. Lemma 2 implies that p(n) =p (K) (n) for K>log 2 n +andp (K) (n) =fork<log 2 n.

9 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 9 µ K = p (K) (n)δ 2 M K n, (4.) K n Z 2 where δ x denotes the unit point mass concentrated in x and M K is chosen such that µ K has total mass. Note that the support of µ K iscontainedin[, ] 2. In order to derive an expression for the Fourier transform of µ K, we introduce the matrix A(t) by A(t) = e ( ε, t ) A (ε), ε {,±} 2 where e(x) =e 2πix for x R. Obviously, A := A() is the adjacency matrix of the directed multigraph (cf. []) depicted in Figure. Furthermore, we observe that A is primitive. From this it follows immediately that M K =(,,...,)A K (,,...,) T = Cλ K + O( λ 2 K ), (4.2) where λ denotes the dominating and λ 2 the second largest eigenvalue of the matrix A. The characteristic polynomial factors as (x )(x+)(x 2 2x ) 2 (x 3 x 2)(x 3 +2x 2 +3x 2) 2 (x 6 x 5 x 4 56x 3 +27x 2 +33x 2). The two largest eigenvalues are zeros of the sextic factor. Numerically, we have λ = , λ 2 = (4.3) The Fourier transform of µ K is given by µ K (t) = R 2 e ( x, t ) dµ K (x) = M K ( p (K) (n)e 2 K n, t ). (4.4) n Z 2 Since p (K) (n) is the number of paths in the automaton of length K labelled with minimal representations of n, we have µ K (t) = M K (,,...,)A(2 K t)a(2 (K ) t) A(2 t)(,,...,) T. (4.5) Let B(t) be a matrix function mapping real vectors t to square matrices satis- Lemma 5 fying B(t) B C t for t T, (4.6) B i,j (t) B i,j for all i, j (4.7) for some C, T >, some non-negative matrix B, and the matrix norm induced by the maximum norm on the vector space. Assume that B has a simple dominating eigenvalue

10 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 and denote by ρ the modulus of the second largest eigenvalue and by r the size of the largest Jordan-block associated to an eigenvalue of modulus ρ. Then the sequence of matrices converges to a limit P (t) for all t and P K (t) =B(2 K t)b(2 (K ) t) B(2 t) P K (t) P K () t for t 2T, P (t) P K (t) ( + t ) η K r 2 ηk for all t, (4.8) where η = log ρ. log 2 log ρ Proof. By our assumptions on B there exists a constant C 2 > such that B l C 2 for all l. For t 2T we have (setting j = K +) P K (t) P K () = (B +(B(2 K t) B)) (B +(B(2 t) B)) B K ( K l ) = B j k j k (B(2 j k t) B) B j l l= K j > >j l k= K l C2 l+ C l t l 2 j k l= K j > >j l C 2 K l= l! (CC 2 t ) l k= ( K ) l 2 j j= C 2 (exp (CC 2 t ) ) CC 2 2 exp (2CC 2 T ) t. Let t 2 l+ T and observe that (4.7) implies P l (t) B l C 2. Thenwehavefor K>L>l P K (t) P L (t) = P K l (2 l t)p l (t) P L l (2 l t)p l (t) B l ( P K l (2 l t) P K l () + P K l () P L l () + P L l (2 l t) P L l () ) ( C 2 2CC 2 2 exp (2CC 2 T )2 l t + C 3 L r ρ L l), (4.9) where C 3 is a suitable constant coming from the Jordan decomposition of B. Choosing l = ηl we get P K (t) P L (t) ( + t )2 ηl L r. (4.) Therefore, the sequence (P K (t)) K converges uniformly on compact subsets. For t wechoosel = ( η)log 2 t + ηl in (4.9) to obtain Combining this with (4.) gives (4.8). P K (t) P L (t) t η L r 2 ηl. (4.)

11 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 Lemma 6 The sequence of measures µ K defined by (4.) converges weakly to a probability measure µ. The characteristic functions satisfy the estimate µ K (t) µ(t) = O( t η 2 ηk ) (4.2) with log λ log λ 2 η = = log 2 + log λ log λ 2 The constants implied by the O-symbol are absolute. Proof. We apply Lemma 5 to B(t) = A(t) andt =. From (4.2), (4.5), and (4.8) we λ obtain for L>K and t that ( ) K µ K (t) µ L (t) t η 2 ηk λ2 + t η 2 ηk. λ For L>K>l, t, v =(,,...,) T,andv 2 =(,,...,) T we have by (4.2) and (4.8) µ K (t) µ L (t) = λ K v T M P K l(2 l t)p l (t)v 2 λl v T K M P L l(2 l t)p l (t)v 2 L λ K v T M P K l()p l (t)v 2 λl v T K M P L l()p l (t)v 2 L +2 l t = λ K v T M P K l()(p l (t) P l ())v 2 λl v T K M P L l()(p l (t) P l ())v 2 L (4.3) +2 l t ( ( λ2 ) ) K l t +2 l t 2 ηk, λ whereweusedthefact µ K () = µ L () = in (4.3) and we chose l = ηk. Thus µ K (t) converges uniformly on compact subsets of R 2 to a continuous limit µ(t), and the measures µ K tend to a measure µ weakly. Lemma 7 For x y the measure µ satisfies µ([x, y]) = O( y x β ), (4.4) where β =log 2 λ γ = ,whereγ = is defined in Lemma 4. (as usual [x, y] denotes the rectangle with lower left corner x and upper right corner y.)

12 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 2 Proof. Without loss of generality, we may assume that y x < /2 and x, y. We choose n N such that 2 n y x < 2 n. (4.5) Then [x, y] can be covered by 4 squares of the type [2 n a, 2 n (a + )], where a Z 2 and =(, ) T.ForK>nwe obtain µ K ([2 n a, 2 n (a + )]) = p (K) (2 K n a + k). M K k 2 K n If L l= 2l ε l is a minimal joint expansion of 2 K n a + k then there is a δ {, ±} 2 such that K n l= 2 l ε l is a minimal expansion of k 2 K n δ and L K+n l= 2 l ε l+k n is a minimal expansion of a + δ by Lemma. Therefore we have µ K ([2 n a, 2 n (a + )]) M K δ {,±} 2 p(a + δ) a γ M K k 2 K n 2 K n k 2 K+ n p(k 2 K n δ) p(k) a γ M K n+2 M K ( ) 2 γ n. λ A standard argument allows the limit K. Combining this with (4.5) gives the assertion of the lemma. Lemma 8 Let B(,r) denote the Euclidean ball of radius r centred at the origin. Then µ(b(,r+ ε) \ B(,r)) (r + ε)ε β. (4.6) Proof. We need at most 4 n times the area of the annulus B(,r+ε+ 2 2 n )\B(,r 2 2 n ) squares of side-length 2 n to cover the annulus B(,r+ ε) \ B(,r). From (4.4) we get Choosing n = log 2 ε we get µ(b(,r+ ε) \ B(,r)) 2 nβ 4 n π(2r + ε)(ε n ). µ(b(,r+ ε) \ B(,r)) 2 (2 β)n (r + ε)ε (r + ε)ε β. As a first consequence of the weak convergence of the measures µ K (Lemma 6) and the estimate for the measure-dimension (Lemma 7) we formulate the following theorem. In Section 6 we will give an explicit estimate for the error term, if V = B(, ). Theorem Let V be a bounded measurable subset of R 2 with µ( (t V )) = for all t R +. Assume further that t µ(t V ) is monotonically increasing and there exists a T>such that [, ] 2 t V for t>t.then p(n) =N log 2 λ F V (log 2 N)( + o()), (4.7) n N V

13 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 3 where F V is a continuous periodic function of period depending on the set V and λ = isthelargestrootof x 6 x 5 x 4 56x 3 +27x 2 +33x 2=. Remark Examples for sets satisfying the first hypothesis of Theorem are sets whose boundary has Hausdorff dimension <β= (cf. 7), for instance convex sets. The second condition is satisfied, if t V t 2 V for t <t 2. The third condition is satisfied, if V contains a neighbourhood of the origin. Proof. The proof uses standard arguments from the theory of uniform distribution, especially the notion of discrepancy, as discussed in the classical book [2, Chapters 2,3]. By weak convergence of the measures µ K to the limit µ and our assertions on the set V, we have for every fixed t R + lim µ K(t V )=µ(t V ). K We need uniformity in t in this limit relation. By our assumptions on V the function µ(t V ) is continuous. For a fixed positive integer m there exist t k R + (k =,...,m) such that µ(t k V )= k. There exists a K m such that ( ) ( µ(t k V ) µ K (t k V ) + ) µ(t k V ) m m for all K K and k =,...,m. Let t R + then there exists an integer k such that t k t<t k+ (or µ(t V )=). Thenwehave ( ) ( µ(t k V ) µ K (t V ) + ) µ(t k+ V ) m m and therefore µ K (t V ) µ(t V ) 3 m for K K. Thus µ K (t V ) tends to µ(t V ) uniformly in t. We conclude the proof by writing p(n) =M K µ K (2 K N V )=Cλ K ( + o())(µ(2 K N V )+o()) n N V for K = log 2 N +R, where the integer R is chosen large enough to ensure 2 R V [ 2, 2 ]. Setting F V (t) =Cλ R t µ(2 t R V )for t< and extending F V periodically we obtain (4.7).

14 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A Berry-Esseen bounds This section is devoted to a precise study of the error term in Theorem for V = B(, ). We use the notation c(φ) =(cosφ, sin φ) T. Let ν and ν 2 be two probability measures in R 2 with their Fourier trans- ν k (t) = e ( x, t ) dν k (x). Proposition forms defined by R 2 Suppose that ν 2 satisfies ν 2 (B(,r+ ε) \ B(,r)) ε θ (5.) for some <θ< and all r. Then the following inequality holds for all r and T> ν (B(,r)) ν 2 (B(,r)) T 2π where the kernel function K r (t, T ) satisfies K r (t, T ) ν (tc(φ)) ν 2 (tc(φ)) tdφdt+t 2θ θ+2, (5.2) K r (t, T ) T 2 +min ( ) r 2, r 2 t 3 2 The implied constant in (5.2) depends only on the implied constant in (5.).. Proof. The proof makes use of ideas developed in [] as an extension of the Beurling-Selberg extremal functions. We will use a more explicit version as given in [7]. From [7, Lemma 2] we infer the existence of two even entire functions G and G 2 of exponential type T, which satisfy G (x) χ [ r,r] (x) G 2 (x) andg 2 (x) G (x) min (,T 2 x r 2) (5.3) for all x R. By the Paley-Wiener theorem the Fourier transform of U j (x) =G j ( x 2 ) (j =, 2) is supported on the ball of radius T. Furthermore, by [7, (3.8)] we have ( ( )) Û j (t) T +min r 2 r 2,. 2 t We use the functions U j to estimate ν 2 (B(,r)) ν (B(,r)) = χ B(,r) ν 2 () χ B(,r) ν () U 2 ν 2 () U ν () = U (ν 2 ν )()+(U 2 U ) ν 2 () = Û (t)( ν 2 (t) ν (t)) dl(t)+ (U 2 (x) U (x)) dν 2 (x), t 2 T R 2

15 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 5 where is the convolution on R 2 and L denotes the two-dimensional Lebesgue measure. Analogously the inequality ν 2 (B(,r)) ν (B(,r)) Û 2 (t)( ν 2 (t) ν (t)) dl(t) (U 2 (x) U (x)) dν 2 (x) t 2 T R 2 Setting K r ( t 2,T)=max( Û(t), Û2(t) ) (notice that Ûj only depends on t 2 ) and transforming the integral to polar coordinates yields the first summand in (5.2). We now estimate the integral (U R 2 2 (x) U (x)) dν 2 (x) by applying (5.3). This yields (U 2 (x) U (x)) dν 2 (x) R 2 dν 2 (x)+ T 2 (r x 2 ) dν 2(x)+ 2 T 2 ( x 2 r) dν 2(x) 2 B(,r+ε)\B(,r ε) x 2 r ε Choosing ε = T 2 θ+2 gives the second summand in (5.2). x 2 r+ε ε θ + T 2 ε Average frequency in large circles In this section we prove Theorem 2 Let p(n) denote the number of joint expansions of minimal weight of n Z 2. Then the following asymptotic formula holds p(n) =N log 2 λ F (log 2 N)+O(N log 2 λ.229 ), (6.) n 2 <N where λ = isthelargestrootof x 6 x 5 x 4 56x 3 +27x 2 +33x 2= and F is a continuous periodic function of period. Proof. By Lemma 2 and the definition of the measures µ K we write p(n) =M K µ K (B(,N2 K )) (6.2) for N<2 K. n 2 <N

16 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 6 Applying Proposition to the measures µ K and µ and using Lemmas 6 and 8 we get for r< T µ K (B(,r)) µ(b(,r)) K r (t, T )t η 2 ηk β 2 tdt+ T β+. Choosing yields with ξ = log 2 T = η η (β ) β+ K µ K (B(,r)) µ(b(,r)) 2 ξk (6.3) 4η(β ) 2ηβ +2η +5β 2 = Inserting (6.3) and (4.2) into (6.2) yields p(n) =Cλ K µ(b(,n2 K )) + O(λ K 2 )+O(λK 2 ξk ). n 2 <N Setting K = log 2 N +2 and F (t) =Cλ 2 t µ(b(, 2 t 2 )) we obtain the assertion of the theorem. 7. Purity of the measure In this section we study the measure µ introduced in Section 4 in further detail. In particular, we show that it is purely singular continuous. As it is the case for Bernoulli convolutions (cf. [3]) the measure turns out to be pure as a consequence of the Jessen-Wintner theorem. Lemma 9 ([, Theorem 35], [2, Lemma.22 (ii)]) Let Q = n= Q n be an infinite product of discrete spaces equipped with a measure ν, which satisfies Kolmogorov s --law (i.e. every tail event has either measure or ). Furthermore, let X n be a sequence of random variables defined on the spaces Q n, such that the series X = n= X n converges ν-almost everywhere. Then the distribution of X is either purely discrete, or purely singular continuous, or absolutely continuous with respect to Lebesgue measure. Remark 2 We notice that in [2] and [] the additional assumption of mutual independence of the random variables X n is made in the statement of the result instead of the --law. The proofs however only depend on the --law. We define the measure ν on the space K = { (x, x 2,...) ({, ±} 2 ) N n N :(x, x 2,...,x n ) is an optimal expansion }

17 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 7 by where ν([ε,...,ε n ]) = lim #({(x,...,x k )isoptimal} [ε,...,ε n ]), k M k [ε,...,ε n ]={(x, x 2,...) K x = ε,...,x n = ε n }. We notice that the measure µ studied in Section 4 is the image of ν under the map (x, x 2,...) n= 2 n x n. Furthermore, the same arguments as used in [4] show that (x n ) n N form a mixing sequence of random variables and ν therefore satisfies a --law. Thus the measure µ is pure by Lemma 9 and by Lemma 7 it is continuous. In order to compute µ(2 k (, )), we identify the constants C, C 2 and C 3 for our special choice of B in the proof of Lemma 5: C =76, C 2 = C 3 =23.. Inserting T =2, l = and L = 2 into (4.9) we obtain As in [4] we observe that µ(2 k (, )) = lim n v T P (, ) P 2 (, ). λ n P n (2 k (, ))v 2 = lim v T λ n k P n k (, )A() k v 2. M n n M n Since lim n P n k (, ) can be computed by the above estimate, and lim k λ k A() k can be computed by an eigenvector computation, we are able to compute lim k µ(2k (, )) = , which shows that µ is not absolutely continuous. Thus we have proved the following theorem. Theorem 3 The measure µ defined in Lemma 6 is purely singular continuous. 8. Higher dimensions Specific higher dimensional joint expansions of minimal weight have been introduced and studied in [5, 8, 3]. The arguments and methods used in the present paper could also be used for dimensions d 3: the automata can be produced by the same algorithm; for d = 3 the automaton has 9 states and maximal eigenvalue ,ford = 4 it has 577 states and maximal eigenvalue Lemmas, 2, and 3, are still true in higher dimensions.

18 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 8 an analogue to Lemma 4 can be given by the same arguments; however, the computational effort can be expected to be immense. The value of γ cannot be predicted. Assuming the strong connectivity of the automaton the construction of the measures µ K as well as their weak convergence to a limit µ can be carried out as in Section 4. If the value of the exponent γ in Lemma 4 is small enough and therefore β in Lemma 7 is large enough, the arguments in Section 6 can be used to compute the average frequency in large Euclidean balls. References [] R. Diestel, Graph theory, second ed., Graduate Texts in Mathematics, vol. 73, Springer- Verlag, New York, 2. [2] P. D. T. A. Elliott, Probabilistic number theory. I, mean-value theorems, Grundlehren der Mathematischen Wissenschaften, vol. 239, Springer-Verlag, New York, 979. [3] P. Erdős, On a family of symmetric Bernoulli convolutions, Amer. J. Math. 6 (939), [4] P. J. Grabner and C. Heuberger, On the number of optimal base 2 representations of integers, submitted, available at cheub/ publications/countminimal.pdf, 25. [5] P. J. Grabner, C. Heuberger, and H. Prodinger, Distribution results for low-weight binary representations for pairs of integers, Theor. Comput. Sci. 39 (24), [6] P. J. Grabner, C. Heuberger, H. Prodinger, and J. Thuswaldner, Analysis of linear combination algorithms in cryptography, Transactions on Algorithms, to appear. [7] G. Harman, On the Erdős-Turán inequality for balls, Acta Arith. 85 (998), [8] C. Heuberger, R. Katti, H. Prodinger, and X. Ruan, The alternating greedy expansion and applications to left-to-right algorithms in cryptography, Preprint, available at http: // cheub/publications/alg.pdf, 24. [9] C. Heuberger and H. Prodinger, Analysis of alternative digit sets for nonadjacent representations, Preprint, available at cheub/ publications/dnaf-.pdf. [] J. J. Holt and J. D. Vaaler, The Beurling-Selberg extremal functions for a ball in Euclidean space, Duke Math. J. 83 (996), [] B. Jessen and A. Wintner, Distribution functions and the Riemann zeta function, Trans. Amer. Math. Soc. 38 (935),

19 INTEGERS: ELECTRONIC JOURNAL OF COMBINATORIAL NUMBER THEORY 5(3) (25), #A9 9 [2] L. Kuipers and H. Niederreiter, Uniform distribution of sequences, Wiley-Interscience, New York, 974. [3] J. Proos, Joint sparse forms and generating zero columns when combing, Tech.Report CORR 23-23, Centre for Applied Cryptographic Research, 23, available at http: // [4] J. A. Solinas, Low-weight binary representations for pairs of integers, Tech. Report CORR 2-4, University of Waterloo, 2, available at uwaterloo.ca/techreports/2/corr2-4.ps.