DISTRIBUTION RESULTS FOR LOW-WEIGHT BINARY REPRESENTATIONS FOR PAIRS OF INTEGERS

Transcription

1 DISTRIBUTION RESULTS FOR LOW-WEIGHT BINARY REPRESENTATIONS FOR PAIRS OF INTEGERS PETER J. GRABNER, CLEMENS HEUBERGER, AND HELMUT PRODINGER Abstract. We discuss an optimal method for the computation of linear combinations of elements of Abelian groups, which uses signed digit expansions. This has applications in elliptic curve cryptography. We compute the expected number of operations asymptotically (including a periodically oscillating second order term and prove a central limit theorem. Apart from the usual right-to-left (i.e., least significant digit first approach we also discuss a left-to-right computation of the expansions. This exhibits fractal structures that are studied in some detail.. Introduction In several well-known cryptosystems the essential operation is the computation of multiples and linear combinations in an Abelian group law. We discuss the second operation in a context, where subtraction and addition are equally costly. The most prominent example for this situation is the group law on an elliptic curve. The standard method to compute a multiple np is the binary method, see [6]. It uses the operations double and add P. If one writes n in binary notation, the ones correspond to these addition operations. In our context the subtraction of P is not more costly than the addition of P. This leads to the concept of redundant expansions. Now, the possible digits are {, ±}, and corresponds to a subtraction of P, see, e.g., []. The representation is no longer unique, and the goal is to find a representation with as many zeros as possible, in order to have low complexity. This Canonical Sparse Form was independently discovered by many authors, and we refer to [] for a historic account. It is sometimes called nonadjacent form (NAF, since it may be characterized by the fact that from two adjacent digits at least one must be a zero. Only about of the digits are non-zero in contrast to 3 in ordinary binary expansion. The number of non-zero digits in the NAF of n is called the Hamming weight of n. In [3] Solinas discusses the problem of computing mp + nq. Instead of computing mp and nq separately, one can proceed as follows. An approach using unsigned digit expansions would use the doubling operations and occasional additions of P, Q, or P + Q. Date: January 3, 3. Mathematics Subject Classification. Primary: A63; Secondary: 8A8 94A6. Key words and phrases. Elliptic curve cryptography, joint sparse form, signed digit expansions, fractals. This author is supported by the START-project Y96-MAT of the Austrian Science Fund. This author is supported by the grant S837-MAT of the Austrian Science Fund. This author is supported by the grant NRF of the South African National Research Foundation.

2 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER Now, in instances where subtractions are no obstacles, one can allow additions of P, Q, P, Q, P + Q, P Q, P + Q, and P Q. If one has an expansion with digits {, ±}, for both numbers m and n, then a corresponds to an addition of P + Q, a to an addition of P, etc. To keep the complexity low, the goal is to create as many double zeros in the joint expansion as possible. Solinas found a canonical joint expansion, called Joint Sparse Form, which has about of the double digits being a double zero. Again, the number of double digits different from is called the joint Hamming weight. This Joint Sparse Form has minimal joint Hamming weight among all joint expansions of two numbers m. n In this paper, we want to gain a better understanding of the Joint Sparse Form. We start by considering another joint representation that we call Simple Joint Sparse Form. It has always the same Hamming weight as the Joint Sparse Form (even more: the double zeros are in the same positions. As the name suggests, this form is simpler, and created in a less elaborate way than the Joint Sparse Form. In Section we give an algorithm for its computation and characterize it in a syntactic way. Since the joint Hamming weight is the same, we use the Simple Joint Sparse Form exclusively throughout this paper. In Section 3, we are interested in geometric and topological properties of the Simple Joint Sparse Form. We construct a transducer with 9 (essential states that produces the Simple Joint Sparse Form from the binary expansions of two numbers x and y. Now each of these 9 states corresponds to a certain area in the unit square, and we thus find a decomposition of the unit square into 9 regions of fractal type. It can be seen in Figure as any of the four subsquares (ignore the different hatchings for the moment. It is proved that these regions are connected; their respective areas are computed, as well as the Hausdorff dimension of the boundaries (=..... Pairs of numbers on the boundaries have usually two different representations, but eight numbers have even three! The coordinates of these eight points are computed. The regions correspond to digits, and a fortiori to the Hamming weight of a pair of numbers m, n. Five regions contribute one to the Hamming weight h(m, n, while the remaining four (of total area contribute zero to it. In Section 4 we prove that N m,n<n h(m, n log N. Intuitively, that is not surprising, since there are about N log N possible positions, and about half of them are non-zero. The obtained formula is more precise, as it exhibits a periodic oscillation of order N, and an error term that depends on the Hausdorff dimension mentioned before. Such a periodicity phenomenon is not uncommon in digit counting problems. Our approach follows the elegant and elementary method of Delange [5]. Section 5 exhibits a central limit theorem for the Hamming weight h(m, n. It uses the analytic machinery developed in []. With these methods, asymptotic expansions for expectation and variance can also be achieved, but the oscillating term mentioned before would be less explicit in this way. The last Section 6 briefly discusses higher dimensions. Solinas [3] remarks that a generalization would require a higher-order analogue of the Joint Sparse Form. The lack of such an analogue is also regretted by Avanzi []. While it might be less obvious to obtain

3 LOW-WEIGHT BINARY REPRESENTATIONS 3 such a higher dimensional Joint Sparse Form, based on the description given by Solinas, it is completely natural when starting from the ideas of the Simple Joint Sparse Form, introduced and studied in the present paper. And, indeed, we get an algorithm for it, show that it has minimal Hamming weight, and characterize it syntactically. The NAF has at least a zero in two consecutive digits, and the (Simple Joint Sparse Form at least a double zero in three consecutive double digits. Now the d-dimensional Simple Joint Sparse Form guarantees a multiple zero among any consecutive d + multiple digits.. Sparse Forms.. Joint Sparse Form. Solinas [3] calls an expansion ( x l y l x y of integers x y Joint Sparse Form, if their (. (. (.3 (.4 Of any three consecutive positions, at least one is a double zero, Adjacent terms do not have opposite signs, i.e., x j x j+ and y j y j+, If x j x j+, then y j+ = ± and y j =, If y j y j+, then x j+ = ± and x j =. He proves the following result: Theorem (Solinas. Every pair of integers x has a unique Joint Sparse Form. This y Joint Sparse Form minimizes the joint Hamming weight amongst all joint expansions of x. y Solinas also gives an algorithm to compute the Joint Sparse Form for given integers or for given binary expansions as input. His algorithm also accepts reduced signed binary expansions, where reduced means that (. is satisfied. We note that Solinas Algorithm has to know x and y modulo 8 to calculate the least significant pair of digits of the Joint Sparse Form, which means a look-ahead of two positions. The algorithm can be described by a transducer which translates a reduced signed binary expansion into the Joint Sparse Form from right to left... Simple Joint Sparse Form. We describe a simple procedure to obtain a joint expansion of low weight; it will turn out that this form has the same (i.e., minimal Hamming weight as the Joint Sparse Form. The key observation is that an odd integer can be represented as x = (x l... x x with digits x j {, ±} where the parity of x can be prescribed by replacing x by x if necessary. We are given two integers x and y. If both are even, then we have no choice and have to output. If both numbers are odd, we choose x y appropriately so that both, (x x / and (y y / are even, so that a will be written the next step. If, say, x is odd and y is even, then we choose x in such a way that (x x / (y / (mod. This either leads to immediately in the next step or in the following step. This procedure generates a pair after at most 3 steps. It is summarized in Algorithm.

4 4 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER Algorithm Simple Joint Sparse Form Input: x and y integers Output: ( x l y l x y Simple Joint Sparse Form j while x or y do x j x mod, y j y mod if ( x j ( y j = then if (x x j / (mod then x j x j end if if (y y j / (mod then y j y j end if else if x j y j then if (x x j / (y y j / (mod then x j x j, y j y j end if end if x (x x j /, y (y y j / j j + end while It is clear that Algorithm yields a joint expansion ( x l y l x y which satisfies the following syntactical rules: (.5 (.6 If x j y j, then x j+ = y j+, If x j = y j =, then x j+ = y j+ =. We call any joint expansion of x and y with digits {, ±}, which satisfies these two rules a Simple Joint Sparse Form of x and y. Surprisingly, it turns out that these rules are strong enough to determine a unique joint expansion. Theorem. Let x and y be integers. Then there is a unique (up to leading joint expansion ( x l y l x y with digits, ± which satisfies the rules (.5 and (.6. Furthermore, the Simple Joint Sparse Form has the same joint Hamming weight as the Joint Sparse Form. Therefore, its joint Hamming weight is minimal amongst all joint expansions. Proof. The existence is proved by Algorithm. Assume that ( x l ( y l x y and x l x y l y represent the same pair of integers x. Without y loss of generality, min{ x, y } is minimal among all pairs of integers with at least two expansions. Then minimality ensures that ( x ( y x y. Without loss of generality, x = x. This implies x x (mod. If y, then y = y =, and (.5 implies

5 LOW-WEIGHT BINARY REPRESENTATIONS 5 x y y x (mod, a contradiction. Therefore, y. Then (.6 yields ( x y = ( and ( x y = (. This is a contradiction to x x (mod. We already observed that (.5 and (.6 imply (.. It is clear that (.3 and (.4 are fulfilled also. However in general, (. is not satisfied by a Simple Joint Sparse Form. Nevertheless, if x j+ x j =, our rules (.5 and (.6 imply that y j+ = and y j =. Therefore, replacing x j+ x j by x j+ does not change the joint Hamming weight. A finite number of these simple operations transforms a Simple Joint Sparse Form into the Joint Sparse Form without changing the position (and therefore their number of. Minimality follows from the minimality of the Joint Sparse Form. We emphasize that the computation needs information modulo 4 only. It is therefore no more a surprise that it can be realized by a transducer with look-ahead of one only. This motivates the epitheton simple. We now construct this transducer which reads the binary expansion of x from right to left and outputs their Simple Joint Sparse Form. Although y in principle, we could admit arbitrary signed expansions as input, we refrain from doing so since this would lead to an automaton with 6 states. At any stage, the following information has to be available: the previously read pair of digits and the current pair of digits and information about a possible carry, since a may have been replaced by. Since the carry is added to the previously read pair anyway, we represent states by the sum of the previously read pair and the pair of carries. This yields 9 states representing {,, } {,, }. From some initial state, there is an edge into the appropriate state which reads the first pair of digits but does not output anything. It is understood that we read some leading pairs of zeros until no further carries are left, i.e., we reach state. We attach integer labels to states in a more or less arbitrary fashion since we will consider adjacency matrices. The correspondence between these labels and the pairs of carries plus digits is as follows: label state The resulting transducer is shown in Figure. 3. The Geometry of the Simple Joint Sparse Form The aim of this section is to understand the Simple Joint Sparse Form from left to right. We are interested to know in which state we are after k steps. Figure shows the situation for k = and all pairs of integers x, y. Figure suggests that there is an underlying fractal structure. This structure will be studied in this section. We will prove Theorem 3. There exist 9 disjoint open connected subsets of [, ], A,..., A 9, such that the pair of digits (x k, y k of the simple Joint Sparse Form of the pair of integers (x, y can be computed from the index i for which ({x k }, {y k } A i and the pair of digits (ξ k+, η k+ in the (classical binary expansion of (x, y. The union of the sets A i has Lebesgue measure, and their boundaries have Hausdorff-dimension

6 6 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER 8 9 3, 7,, 6 ε, ε 4 5 ε ε Figure. Automaton for calculating the Simple Joint Sparse Form from the binary expansion from right to left. The symbol ε denotes the empty word. Furthermore, the index i decides on the Hamming weight of the output, and the measure of the union of those A i, which yield positive Hamming weight, equals. It is clear that the k-th state when reading x y in their classical binary expansions x = J ξ j j, y = j= J η j j j=

7 LOW-WEIGHT BINARY REPRESENTATIONS x y color Figure. th state and output digits x y up to. when reading all pairs of integers

8 8 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER depends on the k least significant digits, i.e., x y mod k only. The output digits (x k, y k in the Simple Joint Sparse Form J+ J+ x = x j j, y = y j j j= depend on the k + least significant digits, or equivalently, on the k-th state and on (ξ k, η k. Since the state is the interesting information to be found, we renormalize pairs of integers less than k by dividing through k, which yields points in the unit square. The above mentioned fractal would then result from letting k tend to infinity. In order to prove convergence we define functions Φ k on pairs of words of digits {, } of length k as follows ( δ δ Φ k δk = {,..., 9}, ε ε ε k where the expression on the right means application of the pair of words to all states of j= ( δ ε δ ε δk ε k the automaton in Figure. Thus the image of Φ k is a set of states. Furthermore, ( ( δ δ Φ k+ δk+ δ δ Φ k δk, ε ε ε k+ ε ε ε k which implies existence of the limit ( δ δ (3. Φ ε ε ( δ δ = lim Φ k δk. k ε ε ε k The function Φ defined on ({, } {, } is continuous in all points which have a singleton image. Remark. In the above description the sequence Φ k is calculated by the automaton in Figure by reading digits from right to left. Certainly, it would be more desirable to have a description of Φ k in terms of the digits in natural order, i.e., from left to right. This is indeed possible: We construct an automaton with set of states (a subset of the set {,..., 9} {,...,9}. The transition from state g by the pair of digits δ will be denoted by ε g ( δ ε in order to avoid any confusion. It is given by ( ( (( δ δ g (i := g i. ε ε The initial state is the identity map. It turns out ( that 75 states are( actually reached. If we reach a constant map g(i = j after reading δ ε δk ε k, we have Φ δ ε δk ε k = {j}. We now want to prove that Φ descends to a function on [, ] by ( ( Φ δ n n, ε n n δ δ = Φ. ε ε n= For this purpose we note the simple facts that ( δ δ (3. {,..., 9} is a singleton (δ, ε {, } ε ε n=

9 and (3.3 LOW-WEIGHT BINARY REPRESENTATIONS 9 ( k ( δ δ δ δ i = i (δ, ε {, } for all k and all i {,..., 9}. In order to prove that ( ( δ Φ k+l δk δ = Φ k+l δk ε ε k ε k+ ε k+ ε k+3 ε ε k ε k+ ε k+ ε k+3 ε k+l for l 9 it is sufficient by (3. and (3.3 to check ( ( {,..., 9} = ε ε ε 9 ε ε ε 9 {,..., 9} for all choices of (ε,..., ε 9. The same proof applies if the first and second coordinate are interchanged. Thus Φ is well-defined on [, ] and continuous in all points which have a singleton image. We want to describe the sets A j = {(x, y [, ] Φ(x, y = {j}}, V j = {(x, y [, ] j Φ(x, y} topologically. The sets A j are open by the continuity properties of Φ. For a point (x, y V j and any k the suffix after k digits of the digital expansions of (x, y can be altered to ( x, ỹ so that Φ( x, ỹ = {j}. This implies A j V j A j. On the other hand for a point (x, y / V j by a similar argument a neighbourhood of this point is in the complement of V j. Thus V j = A j. Any neighbourhood of a point (x, y with {i, j} Φ(x, y contains points (x, y A i and (x, y A j by the above arguments. This implies that (x, y V j and int(v j A j V j, which yields int(v j = A j. We now want to characterize the sets A j and V j in the language of graph directed sets as introduced in [8]. For this purpose we introduce the maps It is clear from the definition that f δ,ε (x, y = (3.4 Φ(f δ,ε (x, y = Equation (3.4 leads us to the definition ( x + δ, y + ε. ( δ Φ(x, y. ε (3.5 F (S,..., S 9 = (F (S,..., S 9,..., F 9 (S,..., S 9, where F i (S,..., S 9 = j,δ,ε i=(δ,ε j f δ,ε (S j, ε k+l

10 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER where S k [, ]. Since F acts as a contraction on the compact subsets of [, ], there exist unique compact sets K,..., K 9, such that F (K,..., K 9 = (K,..., K 9. These sets can be obtained as the limits of iterates of F of any 9-tuple of compact sets. From (3.4 we conclude that (3.6 (3.7 F i (A,..., A 9 A i, F i (V,..., V 9 = V i and therefore V i = K i for i =,..., 9. Next we want to prove that the sets A j are connected. We introduce the open sets ( ( δ O j = int + + δ 4 6, ε + + ε [ 4 +, ]. 6 6 Φ 4 ( δ ε δ4 ε4 ={j} O 8 O 9 O 3 O 7 O O 6 O O 4 O 5 Figure 3. Left: the sets O i. Right: The dark gray areas represent the left image after one application of the functions f δ,ε. These sets are shown in the left image of Figure 3. The sets O j are connected and The right image in Figure 3 shows that O i F i (O,..., O 9 O j V j. and therefore O i F i (O,..., O 9 is connected. From this it follows by induction that the sets ( B i = F l (O,..., O 9 i l=

11 LOW-WEIGHT BINARY REPRESENTATIONS are connected. Furthermore, B i is a dense open subset of V i, since (V,..., V 9 = lim k F k (O,..., O 9. Therefore the sets A i = int(v i are connected. In the following we want to study intersections of two or three sets V j. Clearly, we have for pairwise distinct i, j, k (3.8 V {i,j} := V i V j = { (x, y [, ] {i, j} Φ(x, y }, V {i,j,k} := V i V j V k = { (x, y [, ] {i, j, k} Φ(x, y }. These sets can be generated by the automata in Figure 4 and Figure 5. These automata have the two (resp. 3 element subsets of {,..., 9} as their states (only those which correspond to non-empty intersections are drawn and the obvious transition functions. In order to generate a point in V {i,j} we start in the state labeled with i, j and follow the arcs in the reverse direction. The triple intersections are singleton sets, which will be called three country borders : {( 5, } {( = V {,,7}, 5 5, 3 } {( = V {,7,8}, 5 5, } {( = V {,,4}, 5 5, 4 } = V {,8,9}, 5 {( 3 5, } {( 3 = V {,4,5}, 5 5, 4 } {( 4 = V {,3,9}, 5 5, } {( 4 = V {,5,6}, 5 5, 3 } = V {,3,6}. 5 Now, we want to compute the measures of the sets V i and the Hausdorff-dimension of V i. It is an immediate consequence of the definition that 9 V i = [, ]. i= Furthermore, from (3.7 we can conclude (3.9 λ(v i 4 j,δ,ε (δ,ε j=i λ(v j. Summing these inequalities for j =,..., 9 we obtain 9 λ(v i j= 9 λ(v i, which implies that equality has to hold in (3.9 for all j =,..., 9. Since ( λ(v i = λ(v j λ(v j V k + triple intersections, 4 j,δ,ε (δ,ε j=i j<k,δ,δ,ε,ε (δ,ε j=i (δ,ε k=i j=

12 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER 3, 6 5, 6, 4, 7 8, 9, 5, 3, 9, 4,, 8 4, 5, 6 3, 9 7, 8, 7 Figure 4. The automaton generating the points in the sets V {i,j}.,, 7, 4, 5,, 4, 7, 8, 8, 9, 3, 6, 5, 6, 3, 9 Figure 5. The automaton generating the three country borders V {i,j,k}.

13 LOW-WEIGHT BINARY REPRESENTATIONS 3 and we know that the triple intersections consist of single points only, we can conclude that λ(v j V k = for j k, and therefore the boundaries of the sets V j have measure. Furthermore, we have i λ(v i =, which yields λ(v = λ(v 3 = λ(v 5 = λ(v 8 = 8, λ(v 4 = λ(v 6 = λ(v 7 = λ(v 9 = 6, λ(v = 4. For computing the Hausdorff-dimension of the boundaries of the sets V j we notice that the sets V {i,j} defined in (3.8 satisfy the relation (3. V {i,j} = f δ,ε (V {k,l}. δ,ε,{k,l} (δ,ε {k,l}={i,j} This observation brings us in the context of graph directed sets as introduced in [8]. The box-dimension can be computed from the dominating eigenvalue of the adjacency matrix of the boundary automaton given in Figure 4. This eigenvalue is the positive root λ of the equation (3. x 3 x + x 4 =. This yields (3. dim B ( A j = α = log λ log = For technical reasons we introduce the set V = [, ]. Then the open sets { } A {i,j} = (x, y int(v i V j k {,..., } \ {i, j} : d((x, y, V {i,j} < d((x, y, V k satisfy (3.3 δ,ε,{k,l} (δ,ε {k,l}={i,j} f δ,ε (A {k,l} A {i,j} with the union being disjoint. This is the open set condition which by [7, Theorem 9.] implies that the Hausdorff-dimension of V {i,j} equals its box-dimension. Thus we have (3.4 dim H ( A j = log λ log = Figure exhibits a rotational structure which has not been discussed yet. This is a natural property of the underlying problem on elliptic curves: since there is a symmetry in the algorithm described in the introduction between the pairs of points (P, Q and (P + Q, P Q the map (x, y (x + y, x y should preserve the structure of the sets A i. We will prove now that this is indeed the case. For this purpose we introduce the map

14 4 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER T : (x, y (x + y mod, x y mod. This map satisfies (3.5 T (A 4 A 6 A 7 A 9 A, T (A A A 3 A 5 A 8, T ((A f (A (A 3 f (A (A 5 f (A (A 8 f (A A 4 A 6 A 7 A 9, T ((A \ f (A (A 3 \ f (A (A 5 \ f (A (A 8 \ f (A A A 3 A 5 A 8. Adding or subtracting two numbers given in their Simple Joint Sparse Form is digit-wise addition (or subtraction and subsequent correction by the rule (, ± (±, by (.6. We demonstrate relation (3.5; the proof of the other relations is similar: let (x, y be given in its Simple Joint Sparse Form. The condition (x, y A is equivalent to x y = (. δ. ε (in Simple Joint Sparse Form!, since is the unique state which produces two non-zero digits as output (cf. Figure. Since δε = we have ( x + y x y =.. (in Simple Joint Sparse Form. Therefore, T (x, y A i for a state i, which produces the output, i.e., i {, 3, 5, 8}. 4. Geometric Approach for Estimating the Joint Hamming Weight In this section we give a derivation for an asymptotic formula for the mean of the Hamming weight of the Joint Sparse Form. The proof follows the ideas used by H. Delange in [5]. Theorem 4. The Hamming weight of the Joint Sparse Form of two positive integers satisfies the following asymptotic formula (4. S(N = m,n<n h(m, n = N log N + N ψ (log N + O(N α, where ψ is a continuous periodic function of period and α is given by (3.. Proof. Theorem 3 states that the contribution of the pair of digits (x k, y k to the Hamming weight of the Joint Sparse Form of the pair (m, n equals ({ m } { n } H,, where H = int(v k+ k+ V 4 V 6 V 7 V 9. Notice that λ (H =. It follows immediately that (4. S(N = K k= m,n<n H ({ m } { n }, = k+ k+ K k= m,n<n ({ m } { n } H k, k+ k+

15 LOW-WEIGHT BINARY REPRESENTATIONS Figure 6. Plot of S(N/N log N over log N for N = 5,..., 48. with K = log N + and (4.3 H k = (m,n k+ H This enables us to rewrite the sum as an integral K ({ m } (4.4 S(N = H k, k+ [m k, (m + k [n k, (n + k. k= [,N] { n k+ } dm dn. Setting t = N K [,, substituting m = 4 K x and n = K y in the integrals, and reversing the order of summation yields K ({ S(N = 4 K H K k k x }, { k y } dx dy. k= [,t] We rewrite this as (4.5 S(N = (K + K (tk + 4 K k= [,t] K + 4 K ( k= [,t] ( H ({ k x }, { k y } dx dy H K k H ({ k x }, { k y } dx dy. We remark that t is a rational number with denominator K and therefore the integral ( ({ H k x }, { k y } dx dy = for k > K, [,t]

16 6 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER since λ (H =. Thus we can extend the second summand in (4.5 to an infinite sum without changing its value. It is natural to define the continuous function Ψ(t = k= [,t] ( H ({ k x }, { k y } dx dy. Simple computations yield Ψ( 4 = 6 and Ψ( = 8. We now treat the third summand in (4.5. For this purpose we have to estimate the integral (4.6 We set ({ ( Hl H k x }, { k y } dx dy [,t] ({ = ( Hl H k x }, { k y } dx dy + [, k+ k t ] β l = [,] ( Hl H (x, y dx dy [,t] \[, k+ k t ] dx dy. and remark that by the definition of the box dimension and the arguments given in Section 3 we have β l = O((λ/4 l, where λ is given by (3.. Thus the first integral in (4.6 equals β l ( k+ k t ; the second integral is O((λ/4 l k, since it can be written as a sum over O( k integrals over squares of side-length k+, and each integral gives a contribution of O((λ/4 l. Summing up we obtain (4.7 S(N = N K ( (K++4K Ψ(t+4 K k K ( t (λ K k β K k+4 K O k. k 4 k= Rewriting this and observing that the last summand is O(λ K = O(N α we obtain (4.8 S(N = N (K + + 4K Ψ(t + 4 K t 4 K t K k= K k= { k t} k β K k + 4 K β K k k= k= K { k t} β 4 k K k + O(N α = N (K + + 4K Ψ(t + N β k + O(N α, k=

17 LOW-WEIGHT BINARY REPRESENTATIONS 7 where we have used that β k = O((λ/4 k. Inserting K = log N {log N} + and using t = {log N} we obtain (4.9 ( S(N = N log N + N 3 {log N} + 4 {log N} Ψ ( {log N} + β k + O(N α. We notice here that a simple computation involving the adjacency matrix of the automaton in Figure proves that k= β k = 3 6. k= The function ψ (x = 7 6 {x} + 4 {x} Ψ ( {x} is a periodic function with period, which is trivially continuous in [,. Furthermore, ψ ( = lim x ψ (x =. Thus the theorem is proved Exponential sums and Central Limit Theorem In this section we will prove a central limit theorem for the Hamming weight of the Joint Sparse Form. Theorem 5. The following equation holds uniformly for all x R and any ε > (5. { } N # < x = x π m, n < N h(m, n log N 4 log N e t dt + O ( (log N 6 +ε. The automaton for calculating the Simple Joint Sparse Form given in Figure can also be used to compute the Hamming weight of the representation (simply map any output different from to. Furthermore, the Hamming weight which results from a transition from i to j depends on i only, cf. Figure. Therefore, there is no look-ahead needed for calculating the Hamming weight. For the proof of Theorem 5 we use exponential sums. For this purpose we calculate f(m, n = e ith(m,n in terms of the binary digits of m and n. For each pair of digits (δ, ε we define a matrix M δ,ε in the following way: its (k, l-th entry equals e ith, if the automaton reads (δ, ε and

18 8 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER writes h while going from state k to state l and otherwise (z = e it M, = M, = z z z z z z z z z z, M, =, M, = z z z z z z z z z z Then it is an immediate consequence of the definition of the matrices M δ,ε that L (5. f(m, n = v T M ml,n l M, v, for m = l= L m l l, n = l= L n l l and v T = (,,,,,,,,. The factor M, adds two leading s to the expansions of m and n to output the possible carries that could still occur. The function f(m, n can be expressed in terms of the bivariate -multiplicative matrix function (cf. [] L (5.3 M(m, n = M ml,n l. We recall here that a (scalar function ϕ is -multiplicative (cf. [4], if ( L L ϕ ε l l = ϕ(ε l. l= We now study the summatory functions E(N = F (N = l= m,n<n m,n<n l= l= e ith(m,n, M(m, n. The function F satisfies the relations F (N = M(m + δ, n + ε = δ,ε= m+δ<n n+ε<n M δ,ε F (N δ,ε=,.

19 and F (N + = = δ,ε= δ,ε= LOW-WEIGHT BINARY REPRESENTATIONS 9 m+δ<n+ n+ε<n+ Setting A = δ,ε= M δ,ε and (5.4 G (N = n<n M(m + δ, n + ε M δ,ε F (N + M(N, n + M(m, N + M(N, N. n<n m<n M(N, n, G (N = m<n M(m, N we can rewrite this as F (N = AF (N (5.5 F (N + = AF (N + B, G (N + B, G (N + M, M(N, N, where B, = M, + M, and B, = M, + M,. The functions G and G satisfy the recurrence relations (5.6 G i (N = B i, G i (N G i (N + = B i, G i (N + C i M(N, N i =,, where B, = M, + M,, B, = M, + M,, C = M,, and C = M,. Iterating (5.6 yields ( L L l L (5.7 G i ε l l = ε l B i,εj C i M εj,ε j. l= l= j= j=l+ Inserting (5.7 into (5.5 and iterating yields F (N = F (N + F (N + F (N with (i =, (5.8 F ( L l= F i ( L l= ε l l = ε l l = L ε l A l M, l= L ε l A l B i, l= L p=l+ L j=l+ M εp,ε p, ε j j k=l+ B i,εk C i L k=j+ M εk,ε k. The matrices M δ,ε only have eigenvalues and. The matrices B i,ε have the characteristic polynomial x 6 (x ( x x e it, where the roots of the last factor are less than in modulus. The characteristic polynomial of the matrix A is x (x ( x x e it ( x 3 x 8e it x 6e it.

20 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER The dominating eigenvalue λ(t is a root of the fourth factor and has the following Taylor expansion around t = (5.9 λ(t = 4 + it 5t 8 5it t O(t5, furthermore, λ(t 4. We will denote the modulus of the second largest eigenvalue by β(t. Numerical studies show that = β( β(t β(π = Since the arguments follow the same lines as in [], we only give a sketch of the proof. We split the sums in (5.8 into the contribution which comes from the dominating eigenvalue and a remainder term, which originates from the other eigenvalues. Let T AT = diag(λ(t,... be the diagonalization of A and Λ = T diag(λ(t,,..., T. We define l Ψ ((x, x,... = x l Λ l M, (5. where b j=a z j Ψ i ((x, x,... = l= p= l x l Λ l B i, l= j= M xp,x p x j l k=j+ j B i,xk C i M xk,x k, = z b z b z a. Furthermore, we set Ψ = v T (Ψ + Ψ + Ψ M, v. The function Ψ is continuous on the infinite product space {, }. Using this notation we can write E(N = λ(t log N λ(t {log N} Ψ((ε L, ε L,..., ε, ( + O(N log N. Since E(N + E(N = O(N by definition, Ψ descends to a continuous function on [, ] by a general argument given in [4]. See also [9]. Thus we have for t = o(log 3 N (5. m,n<n e ith(m,n = N + it log t k= 3 log +O(t3 ψ(t, log N + O ( N log β(t for the continuous periodic function ψ(t, log N = λ(t {log N} Ψ( {log N}. Differentiation with respect to t and inserting t = yields a second proof for Theorem 4 (the justification that this procedure really exhibits the asymptotic expansion uses the same argument as given in []. We notice here that this analytic approach gives better error terms than the geometric approach in Section 3. Nevertheless, we included the geometric proof, since it gives more insight. Differentiating twice yields m,n<n h(m, n = 4 N log N + 6 N log N + N (log Nψ (log N + N ψ (log N + O(N log N,

21 LOW-WEIGHT BINARY REPRESENTATIONS where ψ and ψ are continuous periodic functions related to the derivatives of ψ(t,. From this we compute the variance ( h(m, n h(m, n = N N 6 log N + ψ (log N ψ(log N + o(. m,n<n m,n<n We now use a procedure which is totally similar to the proof of the central limit theorem [, Theorem 3]. From (5. we derive ( (5. exp it h(m, n log N = e N m,n<n 4 t ( + O( t 3 log N. log N An application of the Berry-Esseen inequality (cf. [3, 6, 5] to (5. yields ( Higher Dimensions It is now natural to ask whether it is possible to extend the notion of Joint Sparse Form to higher dimensions. In this section we will generalize the syntactic results obtained in Section.. It is clear that the other methods have such a generalization, too. Let x (,..., x (d be integers, d. A joint expansion of x (,..., x (d is a matrix (x (k j k d j l with entries, ± such that x (k = l j= x(k j j for k d. Its joint Hamming weight is the number of j l such that there is a k d with x (k j. We want to find a joint expansion of the given integers with minimum joint Hamming weight. We will now describe a method for transforming a joint expansion into a minimal joint expansion. For a joint expansion X = (x (k j, we set A j (X := { k d x (k j }. Let now X be a given joint expansion of x (,..., x (d. If A (X =, there is no choice, and the column of zeros is written. If A (X A (X, we replace x (k by x (k for k A (X, which yields a new joint expansion X with A (X =, i.e., the next column will be a zero column. However, if A (X \ A (X, it is impossible to have a zero column in the first two steps. Therefore, we replace x (k by x (k for all k A (X \ A (X. This new expansion X has A (X = A (X A (X, which is good since it may allow a zero column in the third step. This procedure is summarized in Algorithm. It is clear that Algorithm yields a joint expansion X which satisfies the following syntactical rule: (6. A j+ (X A j (X or A j+ (X =, j. We call any joint expansion of x (,..., x (d which satisfies this rule a Simple Joint Sparse Form of x (,..., x (d. It is clear that this notion is a generalization of the non-adjacent form (for d = and the Simple Joint Sparse Form for d =.

22 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER Algorithm d-dimensional Simple Joint Sparse Form Input: x (,..., x (d integers Output: (x (k j Simple Joint Sparse Form of x (,..., x (d k d j l j A {k x (k odd} while k : x (k do x (k j x (k mod, k d A j+ {k (x (k x (k j / (mod } if A j+ A j then for all k A j+ do x (k j x (k j end for A j+ else for all k A j \ A j+ do x (k j x (k j end for A j+ A j A j+ end if x (k (x (k x (k j j j + end while /, k d Theorem 6. Let d and x (,..., x (d be integers. Then there is a unique joint expansion which satisfies (6.. Furthermore, the joint Hamming weight of the Simple Joint Sparse Form is minimal amongst all joint expansions. Proof. The existence of the Simple Joint Sparse Form is proved by Algorithm (6.. We now prove uniqueness. Let X = (x (k j and Y = (y (k j k d be Simple Joint k d j l j l Sparse Forms of the same integers x (,..., x (d. Without loss of generality, we may assume that there is a k d such that x (k y (k. Since x (k +x (k y (k +y (k (mod 4, we get x (k y (k (mod. Without loss of generality, we assume x (k = ±. Since A (X, there is a k A (X \ A (X by (6.. We have x (k = y (k = and x (k y (k (mod. Therefore, A (Y, which implies by (6. that k A (Y A (Y, hence y (k, a contradiction. We now prove minimality. Let X be a joint expansion of x (,..., x (d of minimal Hamming weight. For j we set h j (X := if A j (X and h j (X := otherwise. for j. Without loss of generality, we may assume that (h (X, h (X,... is lexicographically minimal amongst all minimal joint expansions. Moreover, we may assume

23 that LOW-WEIGHT BINARY REPRESENTATIONS 3 A j+ (X A j (X or A j+ =, j. This may be achieved by replacing (x (k j+, x(k j = (, x (k j by (x j+(k, x (k j = (x (k j, x (k j where necessary. Assume now that A j (X = A j+ (X. Let m = min{i j : A i (X = } and set m (k = min{i j : x (k i x (k j } for k A j (X. By definition, j + m (k m. We now replace ( x (k,..., x (k ( (k m (k j by (x + x (k m (k j,,...,, x (k j for k Aj (X and call the new expansion X. By construction, it is a joint expansion (with digits, ±. For any k A j (X, we have x (k j+ = : If m(k > j +, this is clear, if m (k = j +, we and therefore x (k j+ = x(k j+ + x(k j =. This implies A j+ (X =. have x (k j+ = x(k j On the other hand, by minimality of X, we have A m (X. Thus we have constructed an expansion of the same joint Hamming weight which has smaller (h (X, h (X,..., a contradiction to our assumptions on X. Therefore, X is the Simple Joint Sparse Form. Acknowledgment. The authors are indebted to Jörg M. Thuswaldner for suggesting a simplified proof for the connectivity of A j in Section 3. References. R. Avanzi, On multi-exponentiation in cryptography, 3, manuscript, available at nj.nec.com/5453.html.. G. Barat and P. J. Grabner, Digital functions and distribution of binomial coefficients, J. London Math. Soc. 64 (, A. C. Berry, The accuracy of the Gaussian approximation to the sum of independent variates, Trans. Amer. Math. Soc 49 (94, H. Delange, Sur les fonctions q-additive ou q-multiplicatives, Acta Arith. (97, , Sur la fonction sommatoire de la fonction somme des chiffres, l Enseignement Math.( (975, C. G. Esseen, Fourier analysis of distribution functions. A mathematical study of the Laplace-Gaussian law, Acta Math. 77 (945, K. Falconer, Fractal geometry, John Wiley & Sons Ltd., Chichester, 99, Mathematical foundations and applications. 8., Techniques in fractal geometry, John Wiley & Sons Ltd., Chichester, P. J. Grabner and M. Rigo, Additive functions with respect to numeration systems on regular languages, Monatsh. Math. (3, to appear.. P. J. Grabner and J. M. Thuswaldner, On the sum of digits function for number systems with negative bases, Ramanujan J. 4 (,.. C. Heuberger and H. Prodinger, On minimal expansions in redundant number systems: algorithms and quantitative analysis, Computing 66 (, F. Morain and J. Olivos, Speeding up the computations on an elliptic curve using addition-subtraction chains, RAIRO Inform. Théor. Appl. 4 (99, J. A. Solinas, Low-weight binary representations for pairs of integers, Tech. Report CORR - 4, University of Waterloo,, manuscript, available at techreports//corr-4.ps. 4. G. Tenenbaum, Sur la non-dérivabilité de fonctions périodiques associées à certaines formules sommatoires, The Mathematics of Paul Erdős (R. L. Graham and J. Nešetřil., eds., Algorithms Comb., vol. 3, Springer, Berlin, 997.

24 4 P. J. GRABNER, C. HEUBERGER, AND H. PRODINGER 5. J. D. Vaaler, Some extremal functions in Fourier analysis, Bull. Amer. Math. Soc. (985, J. von zur Gathen and J. Gerhard, Modern computer algebra, Cambridge University Press, New York, 999. (P. Grabner Institut für Mathematik A, Technische Universität Graz, Steyrergasse 3, 8 Graz, Austria address: peter.grabner@tugraz.at (C. Heuberger Institut für Mathematik B, Technische Universität Graz, Steyrergasse 3, 8 Graz, Austria address: clemens.heuberger@tugraz.at (H. Prodinger The John Knopfmacher Centre for Applicable Analysis and Number Theory, School of Mathematics, University of the Witwatersrand, P. O. Wits, 5 Johannesburg, South Africa address: helmut@staff.ms.wits.ac.za