Hamming Weight of the Non-Adjacent-Form under Various Input Statistics. Clemens Heuberger and Helmut Prodinger

Transcription

1 FoSP Algorithmen & mathematische Modellierung FoSP Forschungsschwerpunkt Algorithmen und mathematische Modellierung Hamming Weight of the Non-Adjacent-Form under Various Input Statistics Clemens Heuberger and Helmut Prodinger Project Area(s): Analysis of Digital Expansions with Applications in Cryptography Institut für Optimierung und Diskrete Mathematik (Math B) Report 007-, April 007

2 HAMMING WEIGHT OF THE NON-ADJACENT-FORM UNDER VARIOUS INPUT STATISTICS CLEMENS HEUBERGER AND HELMUT PRODINGER Abstract. The Hamming weight of the non-adjacent form is studied in relation to the Hamming weight of the standard binary expansion. In particular, we investigate the expected Hamming weight of the NAF of a n-digit binary expansion with k ones where k is either fixed or proportional to n. The expected Hamming weight of NAFs of binary expansions with large ( n/) Hamming weight is studied. Finally, the covariance of the Hamming weights of the binary expansion and the NAF is computed. Asymptotically, these Hamming weights become independent and normally distributed.. Introduction Signed digit expansions of low Hamming weight are important in various branches of Mathematics and Computer Science, such as efficient arithmetic [6], coding theory [8], and cryptography [5]. A prominent example is the so-called Non-Adjacent-Form (NAF) which uses the digits 0,, and and base : n m = ε j j j=0 with ε j ε j+ = 0 for all j. It is well-known [6] that every integer admits exactly one such representation and that it minimises the Hamming weight (the number of non-zero digits) over all representations of the same integer with digit 0,, (but without imposing the syntactic restriction). The expected Hamming weight of a non-negative integer less than n is known to be n + O(), cf. for instance [, 5, ]. A more detailed analysis can be found in [7], [8], 3 and [9]. The aim of this paper is to study the expected Hamming weight under more refined input models, for instance: Does the expected Hamming weight increase, if the input is known Date: April, Mathematics Subject Classification. A63; 68W40 68Q45 05A6 05A5. Key words and phrases. Non-adjacent form; binary expansion; Hamming weight; transducer; generating function; Omega operator; singularity analysis; quasi-power theorem; multivariate asymptotics. This paper was written while C. Heuberger was a visitor at the Center of Experimental Mathematics at the University of Stellenbosch. He thanks the center for its hospitality. He is also supported by the Austrian Science Foundation FWF, project S9606, that is part of the Austrian National Research Network Analytic Combinatorics and Probabilistic Number Theory. H. Prodinger is supported by the NRF grant of the South African National Research Foundation and by the Center of Experimental Mathematics of the University of Stellenbosch.

3 CLEMENS HEUBERGER AND HELMUT PRODINGER to have a binary expansion of large Hamming weight? How big is the correlation between the Hamming weights of the binary expansion and the NAF? Are they independent? Obviously, the non-negative integers less than n are exactly those with standard binary expansion of length at most n. We study the expected Hamming weight of the NAF of such an integer under the assumption that its binary expansion has Hamming weight k for k/n in a certain range (Theorem ). For instance, if k/n α, the expected Hamming weight is asymptotically equal to ) 4 ( α ( ) α n. For α = /, this equals n/3 as in the unrestricted case, otherwise, the expected Hamming weight is smaller. If k is fixed and only n tends to infinity, Theorem states that the expected Hamming weight is k + O(/n ). The intuitive explanation is that for k small with respect to n, i.e., the ones in the binary expansion are sparse, the NAF tends to agree with the binary expansion. In Theorem 3, we study the expected Hamming weight under the assumption that the Hamming weight of the binary expansion is large, i.e., at least n/. So these are the worst cases of the binary expansion. The NAF, however, is quite immune: the expected Hamming weight is still asymptotic to n (7 + ( ) n ) 9π n + O ( ). n The difference to the unrestricted input model only occurs in the coefficient of / n. Finally, we consider the Hamming weight of the binary expansion and the Hamming weight of the NAF as a random vector and study their covariance as well as its limiting distribution (Theorem 4). The covariance is ( n ) 3 + O, n which is an order of magnitude smaller than the variances, but still non-zero. Asymptotically, however, the coordinates of the random vector become independent and normally distributed. The methods used include transducer automata and generating functions, in particular bivariate rational generating functions. Asymptotics in the central region are derived via Bender and Richmond s [3, 4] method, in the case of fixed k by singularity analysis as introduced by Flajolet and Odlyzko [6], cf. also the forthcoming book of Flajolet and Sedgewick [7]. For the large input Hamming weight case, MacMahon s Omega operator [4] is used to select the relevant terms of the generating function, cf. also []. The coefficients are again estimated by singularity analysis. Finally, the limiting distribution of the random vector outlined above is derived via a variant of Hwang s [3] quasi-power theorem, cf. [0]. Acknowledgement. The authors thank S. Wagner for fruitful discussions on Theorem.

4 HAMMING WEIGHT OF THE NON-ADJACENT-FORM UNDER VARIOUS INPUT STATISTICS 3. Generating Functions As usual, the unsigned (or standard) binary expansion of an integer m is the unique sequence ε j, j 0, with ε j {0, } such that m = j 0 ε j j. We will sometimes omit the words unsigned or standard and just speak about the binary expansion. The nonadjacent-form (NAF) of an integer m is the unique sequence ε j, j 0, with ε j {, 0, } such that m = j 0 ε j j and ε j ε j+ = 0 for j 0. Existence and uniqueness of the NAF have been proved in [6]. The Hamming weight of an expansion ε j, j 0, is the number of nonzero ε j. Let a kln be the number of nonnegative integers less than n whose unsigned binary expansion has Hamming weight k and whose NAF has Hamming weight l. We consider the generating function G(x, y, z) = a k,l,n x k y l z n. k,l,n 0 To compute G(x, y, z), we use the transducer automaton mapping the unsigned binary expansion of an integer to its NAF. It is shown in Figure (for instance, it is equivalent to the transducer in [, Figure ]). The labels of the states correspond to carries. Note that input and output are read resp. written from right to left. An edge with input Hamming ε ε Figure. Transducer mapping a binary expansion of an integer to its NAF. weight k and output Hamming weight l corresponds to an entry x k y l z in the transition matrix M of this transducer: M = z xz 0 yz 0 xyz. 0 z xz Here, the states have been ordered as 0,.,. Given an integer m less than n, the transducer runs from the initial state 0 to some state reading the n-digit unsigned binary input. If this run ends in some state 0 (representing some carry), the output is not yet finished: If ending in state. or, there is an additional output 0 (corresponding to a contribution y) in both cases. Therefore, the generating function G is given by G(x, y, z) = (, 0, 0)(I M) (, y, y) t, where the superscript t indicates transposition of the vector. This can be evaluated to G(x, y, z) = x y z x yz xyz xz + xyz + x yz 3 + xyz 3 + xz xyz xz z +.

5 4 CLEMENS HEUBERGER AND HELMUT PRODINGER We are interested in b kn := l 0 la kln, which corresponds (after division by the mass M kn = l 0 a kln) to the expected Hamming weight of the NAF of an nonnegative integer less than n with Hamming weight k of its unsigned binary expansion. The generating function k,n 0 b knx k z n can be obtained by differentiating G(x, y, z) with respect to y and setting y = : () G y (x,, z) = b kn x k z n = xz (x z + xz ) (xz + z ) (xz ). k,n 0 The mass M kn = l 0 a kln is the number of n-digit unsigned binary expansions with Hamming weight k, thus ( ) n M kn =. k Of course, this corresponds to M kn x k z n = G(x,, z) = z xz k,n 0 which is the generating function of the binomial coefficients by the recursion of Pascal s triangle. In Section 3, we need a quite trivial lower bound for b kn, which shall be derived at this point. Lemma.. For n k, the estimate b kn k(n k + ) holds. Proof. Consider the number m j = ( } 0.{{..0} } 0.{{..0} 00 }.{{..00} n j k+ digits j digits k digits for 0 j n k + given by its unsigned binary expansion. The unsigned binary expansion has Hamming weight k and equals the NAF of m j. Thus the m j, 0 j n k +, contribute (n k + )k to b kn. 3. Asymptotics of b kn The aim of this section is to derive an asymptotic expression for b kn /M kn. Theorem. Let 0 < c < d < be real numbers. Then the expected Hamming weight of the NAF of a nonnegative integer less than n with unsigned binary digit expansion of Hamming weight k is asymptotically b kn () 4 ( k n ) M kn ( ) k n, uniformly for c k/n d. n )

6 HAMMING WEIGHT OF THE NON-ADJACENT-FORM UNDER VARIOUS INPUT STATISTICS 5 Remark 3.. If k/n α for a fixed α in the interval (0, ), then the expected Hamming weight of the NAF of a nonnegative integer less than n with unsigned binary digit expansion of Hamming weight k is asymptotically b kn (3) 4 ( ) α M kn ( ) α n. Remark 3.. The coefficient 4 ( α (4) ( ) α attains its maximum /3 for α = /. Note that the average Hamming weight of a NAF of an integer less than n (without restrictions on the input Hamming weight) is also n/3+o(). The intuitive explanation for that is that M αn,n obviously attains its maximum at α = /, and the decrease of M αn,n is sufficient such that all other b αn,n /M αn,n do not influence the overall outcome too much anyway. It is also worth noting that the expression (4) is independent of the sign of (α /), i.e., b αn,n b ( α)n,n. M αn,n M ( α)n,n On the level of generating functions, this corresponds to (b kn b n k,n )x k z n = G y (x,, xz) G y (/x,, xz) = k,n 0 ) (x )z(xz + z + ) (xz + z ) (xz ). Comparing this with (), we note that in the denominator, the factor (xz + z ) only occurs once instead of twice. The main part of the proof relies the following lemma formulated by Drmota [5], which is a combination of results of Bender [3] and Bender and Richmond [4]. Note that the letters k and n have been switched in comparison to [5]. Lemma 3.3. Let c(x, z) = k,n 0 c knx k z n be a generating function of non-negative numbers c kn and let a < b be positive real numbers such that c(x, b + ε) has positive radius of convergence (as a function in x) for some ε > 0. Suppose that ϕ k (z) = n 0 c kn z n a k g(z)λ(z) k (k ) holds uniformly in R(a, b, φ) = {z : a z b, arg(z) φ} for some φ > 0, where a k > 0, g(z) is continuous and non-zero and λ(z) is non-zero and has bounded third derivative d for z R(a, b, φ). Furthermore suppose that log λ(e s ) ds e s =z 0 for z [a, b] and that there exists a δ > 0 such that c(x, z) is analytic and bounded for z [a, b], z / R(a, b, φ), and x ( + δ)/λ( z ). Then d log λ(e s ) ds e s =z > 0 and we have c kn a k g(h(n/k)) πk σ(h(n/k)) λ(h(n/k)) k h(n/k) n

7 6 CLEMENS HEUBERGER AND HELMUT PRODINGER uniformly for n/k [µ(a), µ(b)], where and h(t) is the inverse function of µ(z). µ(z) = d ds log λ(es ) e s =z, ( ) d / σ(z) = ds log λ(es ) e s =z, Proof of Theorem. We split G y (x,, z) into two summands separating the coprime factors depending on x in its denominator: G y (x,, z) = G () (x, z) + G () (x, z), G () (x, z) = xz5 + xz 4 3xz 3 + z 3 + xz z xz + 3z ( z + z ), ( xz ) G () (x, z) = xz5 + z 5 4xz 4 4z 4 + 6xz 3 + 8z 3 6xz 0z + xz + 7z ( z + z ) ( xz z). and b() kn, respec- These auxiliary functions are generating functions of some numbers b () kn tively, i.e., G (j) (x, z) = b (j) kn xk z n k,n 0 for j {, }. Our first aim is to show that the contributions b () kn are asymptotically smaller than b() kn and, in particular, that the b () kn are nonnegative, as required by Lemma 3.3. For fixed z with z <, the function G () (x, z) has a simple pole at x = /z as a function in x, thus the coefficient of x k of G () (x, z) is the negative residue of G () (x, z)/x k+ at x = /z, and we obtain z k [x k ]G () (x, z) = ( z + z ) for k. Extracting the coefficient of z n in this expansion amounts to summing up the contribution of the poles of /( z + z ). Since these are double poles, we obtain (5) b () kn := [zn ][x k ]G () (x, z) = [z n k+ ] = O(n k) ( z + z ) for n k. Together with Lemma. we conclude that b () nk := [xk ][z n ]G () (x, z) 0 for all n 0 for sufficiently large k (a precise evaluation of b () kn would show that k is sufficient, but we do not need this in order to use Lemma 3.3). Furthermore, we see that b () kn = o(b kn) for k. For the analysis of b () nk, we want to apply Lemma 3.3 on G() (x, z). We set b = c and a = d, respectively. This means 0 < a < b <. From this we see that G () (x, b + ε)

8 HAMMING WEIGHT OF THE NON-ADJACENT-FORM UNDER VARIOUS INPUT STATISTICS 7 has a positive radius of convergence, if we choose 0 < ε < b. Extracting the coefficient of x k in G () (x, z) can be done by routine calculations yielding (6) ϕ k (z) = ( z k b () kn zn = z) (z 4 + kz 3 3z 3 kz + 5z + kz 5z + ) ( z) ( z + z n 0 ). Setting λ(z) = z/( z) and yields g(z) = z ( z) ( z + z ) ϕ k (z) kg(z)λ(z) k (k ) uniformly for a < z < b. We note that g(z) is non-zero and continuous for z [a, b] and λ(z) C [a, b]. We have d ds log λ(es ) e s =z = z ( z) 0 for z [a, b]. Thus the assumptions of Lemma 3.3 are satisfied with φ = π (thus the assumption on z [a, b], z / R(a, b, φ) is empty). The quantities involved are We obtain (7) b () kn µ(z) = z, z σ(z) = z, h(t) = t. t n3/ n k k π(n nk + k ) ( n k k ) k ( ) n n n k uniformly for n/k [, ] = a b [, ]. d c An asymptotic formula for the mass M kn can be obtained from Stirling s formula: ( n ) ( ) k n k n n (8) M kn k n k πk(n k) Dividing (7) by (8) yields (), since b kn b () kn. 4. Asymptotics of b kn for fixed k In Theorem, the asymptotics of b kn were derived under the assumption that k and n both tend to infinity at the same speed. The purpose of this section is to derive the same statement for fixed k.

9 8 CLEMENS HEUBERGER AND HELMUT PRODINGER Theorem. Let k be a fixed positive integer. Then the expected Hamming weight of the NAF of a nonnegative integer less than n with unsigned binary digit expansion of Hamming weight k is asymptotically (9) b kn = k k(k 3k + ) + O M kn n ( n + ), 3 n k whereas the expected Hamming weight of the NAF of a nonnegative integer less than n with unsigned binary digit expansion of Hamming weight (n k) is asymptotically b n k,n (0) = (k + ) k ( (k )k(k + ) + O M n k,n n n n + ). 3 n k Proof of Theorem. We only prove (9). The proof of (0) runs along the same lines, it suffices to replace G y (x,, z) by G y (/x,, xz). By (5), we have b kn = [z n ]ϕ k (z) + O(n) = [z n k ] (z4 + kz 3 3z 3 kz + 5z + kz 5z + ) ( z) k+ ( z + z ) + O(n), where ϕ k (z) is given in (6). We extract the asymptotics of b kn by singularity analysis, see Flajolet and Odlyzko [6] and the forthcoming book of Flajolet and Sedgewick [7]. The simple poles at z = ( ± 3)/ give a contribution of O(). Expanding around the pole at z = gives We have b kn = O(n) + [z n k ] ( k( z) k + ( k)( z) k + O( z) k). () [z n ]( sz) α = sn n α Γ( α) ( α(α + ) α(α + )(α + )(3α + ) + + n 4n + α (α + ) (α + )(α + 3) 48n 3 ( )) + O n 4 for α / {0,,,...} by [6, Eqn. (.)]. The function hidden in the O-term is meromorphic, thus its contribution to b kn does not exceed O(n k ) by [6, Theorem ]. We obtain ( ( )) (n k)k k(k + ) b kn = + + 3k4 + 4k 3 5k + 70k 48 + O + O(n). (k )! n 4n n 3 On the other hand, the mass M kn can be estimated as M kn = (n k)k k! ( k(k + ) + + 3k4 + 4k 3 + 9k k + O n 4n ( n 3 )). This yields (9).

10 HAMMING WEIGHT OF THE NON-ADJACENT-FORM UNDER VARIOUS INPUT STATISTICS 9 5. Binary Expansions of Large Weight In this section, we focus on the NAFs of integers with unsigned binary expansions of high weight, in particular, with a weight greater or equal half of the length of the binary expansion. We set c n := b kn, M n := M kn, k n/ k n/ and we are interested in the asymptotic behaviour of c n /M n. Theorem 3. The expected Hamming weight of a nonnegative integer less than n with unsigned binary expansion of weight n/ equals c n () = n M n (7 + ( ) n ) 6 ( + ( )n ) ( ) 9π n 9π n + O. n 3/ The expected Hamming weight of a nonnegative integer less than n with unsigned binary expansion of weight n/ equals (3) n 3 ( + ( )n ) 3 4 n+ π ( )n 8 + ( ) 8( )n + 3π + 7( ) n π 3π 6 +O. nπ 3/ n Remark 5.. If the assumption on the weight of the unsigned binary expansion is removed, then the expected Hamming weight of a nonnegative integer less than n equals n O( n ). This means that only the third order term is influenced by the additional assumption k n/, but for even n, the influence of the assumption k n/ is much larger. Proof of Theorem 3. We focus on the proof of (). The proof of (3) is quite similar, cf. the comments at the end of this proof. We consider G y (λ,, z/λ) = b kn λ k n z n λ 3 z(λ z + z ) = (z )(z + )(zλ λ + z), k,n 0 where z and λ are in neighbourhoods of 0 and, respectively. We want to extract those summands of the power series with k n 0, i.e., nonnegative exponents of λ, and setting λ = afterwards. This amounts to applying MacMahon s [4] Omega operator Ω (cf. Andrews, Paule and Riese []) to G y (λ,, z/λ): ΩG y (λ,, z/λ) = b kn z n = c n z n. n 0 k,n 0 k n 0 However, the Mathematica r package described in [] cannot handle this type of generating function, so we have to apply the Omega operator manually.

11 0 CLEMENS HEUBERGER AND HELMUT PRODINGER We factorise the quadratic term in λ in the denominator of G y (λ,, z/λ) and perform a partial fraction decomposition (in λ) to obtain (4) G y (λ λz +,, z/λ) = (z )(z + ) + 6z6 4wz 4 40z 4 + 3wz + 7z w (z )(z + )(z ) (z + ) (w λz + ) (z w ) z (z )(z + )(z )(z + )(w λz + ) 6z6 + 4wz 4 40z 4 3wz + 7z + w (z )(z + )(z ) (z + ) (w + λz ) (z + w ) z (z )(z + )(z )(z + )(w + λz ), where the abbreviation w := 4z has been used. We now examine every summand in order to see which contributes to non-negative powers of λ. We rewrite the denominators as keeping in mind that w λz + = ( + w) ( = +w) (λz) m λz ( + w) m+, m 0 w + λz = λz ( w λz ) = m 0 ( w) m (λz) m+, λz + w z, w λz z z = z for z 0 and λ. This implies that Ω deletes the last two summands in (4) since these obviously only contribute negative powers of λ, whereas the first three summands are kept with λ replaced by. Thus we have ΩG y (λ,, z/λ) = c n z n z + = (z )(z + ) n 0 + 6z6 4wz 4 40z 4 + 3wz + 7z w (z )(z + )(z ) (z + ) (w z + ) (z w )z (z )(z + )(z )(z + )(w z + ) = (3z ) (z + z ) (z )(z + )(z ) z4 4z 3 4z + z + (z )(z + ) ( 4z ) 3/.

12 HAMMING WEIGHT OF THE NON-ADJACENT-FORM UNDER VARIOUS INPUT STATISTICS We extract the asymptotics of c n by singularity analysis. The dominant singularities are at z = ±/. The local expansions are (5) c n z n = n ( z)/ for z / and (6) c n z n = n 0 39( + z)/ ( z) + ( z) 3/ + 8( z) ( z) ( z)3/ ( + z) / 44 5 ( + z) / 4 5( + z) 8 57( + z)3/ ( z) 43 45( + z) ( z) / 7 + O (( z) 5/) + O (( + z) 5/) for z /. Furthermore, the function hidden in the O-terms is analytic in a camembert-region, whence their contribution to c n does not exceed O(n 7/ ) by [6, Theorem ]. The contributions of the two poles can be added, cf. [7, Theorem VI.5]. Applying () to (5) and (6) yields ( ( ) n (7) c n = n π + ( )n 5 n 6 + π ( )n π 78 π + n 3/ 7 + 9( )n π 7 π n ( )n π 69 π n 5/ We now compute the total mass M n. We have M n = ( ) ( ) n n = [n even] + (( ) ( )) n n + k n/ k n k k n/ k>n/ ( ) n = [n even] + ( ) ( ) n n = [n even] + n. n/ k n/ k 0 We estimate the binomial coefficient by Stirling s formula and obtain ( (8) M n = n + + ( ( )n π n / n + 3/ 6n + 5 ( 5/ 64n + O 7/ Dividing c n by M n yields (). For proving (3), the operator Ω ( )) + O. n 7/ n 9/ ))). has to be applied, which amounts to removing the second and the third summand in (4). The remaining calculation until (7) is very similar, the only difference being that every square root is replaced by its negative. On division by M n as estimated in (8), however, the term of order n does not cancel, and this yields (3).

13 CLEMENS HEUBERGER AND HELMUT PRODINGER 6. Limit Distribution In the previous sections, we studied b kn, i.e., we considered the length n and the weight k of the binary expansion as parameters and studied the (average) weight of the corresponding NAFs. In this section, however, we only consider n as a parameter, and we study the two random variables H(Binary(X n )) and H(NAF(X n )), where X n is a random nonnegative integer less than n, Binary(m) and NAF(m) denote the binary expansion and the NAF of m, respectively, and H( ) denotes the Hamming weight of an expansion. We are interested in the limiting distribution of the random vector V n := (H(Binary(X n )), H(NAF(X n ))) after appropriate rescaling. We use boldface letters for vectors, the components of a vector x are (x, x ), for instance. Inequalities for vectors have to be taken component-wise. Theorem 4. With the notations above, we have E(H(Binary(X n ))) = n, E(H(NAF(X n ))) = n O( n ), Var(H(Binary(X n ))) = n 4, Var(H(NAF(X n ))) = n O(n n ), Cov(H(Binary(X n )), H(NAF(X n ))) = 3 + O(n n ). The random vector V n is asymptotically normal, i.e. ( Vn ( / ) /3 n (9) P n ) ( x = 54 Φ(x 3 ) ( ) 3 )Φ x + O n, where Φ(x) = π x e t / dt is the distribution function of the standard normal distribution. This means that although H(Binary(X n )) and H(NAF(X n )) are correlated, they are asymptotically independent. Their limiting distribution is the product of two normal distributions.

14 HAMMING WEIGHT OF THE NON-ADJACENT-FORM UNDER VARIOUS INPUT STATISTICS 3 Proof of Theorem 4. The joint probability P(V n = (k, l)) is simply a kln / n in the terminology of Section, thus the probability generating function can be computed as P(x, y, z) = P(V n = (k, l))x k y l z n k,l,n 0 = k,l,n 0 a k,l,n x k y l ( z ) n = G(x, y, z/) = (x y z x yz xyz xz + xyz + 4) x yz 3 + xyz 3 + xz 4xyz 4xz 4z + 8. The denominator of P(,, z) factors as ( z)( z)( + z), thus there are analytic functions ρ j (x, y), j {,, 3}, in a neighbourhood of (x, y) = (, ) such that the denominator of P(x, y, z) exactly vanishes for z = ρ j, j {,, 3}, and we have ρ (, ) =, ρ (, ) =, ρ 3 (, ) = 3. The moment generating function of V n can be obtained by extracting the coefficient of z n in P(e s, e s, z) and has the form with E(e Vn,s ) = k,l 0 P(V n = (k, l))e ks +ls = e u(s)n+v(s) ( + O(κ n )) u(s, s ) = log ρ, ( v(s, s ) = log ( es +s ρ es +s ρ + es +s ρ es ρ + e s +s ) ρ + 4) ρ (3e s +s ρ + 3e s +s ρ + 4e s ρ 8e s +s ρ, 4e s 4) κ n = n( ǫ), where ρ = ρ (e s, e s ) for s, s in a neighbourhood of the origin and ε > 0 with min{ ρ (e s, e s ), ρ (e s, e s ) } ε. Differentiating e u(s)n+v(s) and setting (s, s ) = (0, 0) yields (up to a term O( n )) the means ( n E(V n ) t =, n ) t + O( n ) 9 and the matrix of second moments ) E(V n V t n ) = ( n 4 + n 4 n + n Thus the variance-covariance matrix equals n E(V n V t n) E(V n )E(V n ) t = ( n 4 + n n + 0n n O(n n ). ) + O(n n ). By a two-dimensional analogue [0] of Hwang s quasi-power theorem [3], we obtain the central limit law (9).

15 4 CLEMENS HEUBERGER AND HELMUT PRODINGER References. G. E. Andrews, P. Paule, and A. Riese, MacMahon s partition analysis: the Omega package, European J. Combin. (00), S. Arno and F. S. Wheeler, Signed digit representations of minimal hamming weight, IEEE Trans. Comp. 4 (993), E. A. Bender, Central and local limit theorems applied to asymptotic enumeration, J. Combinatorial Theory Ser. A 5 (973), E. A. Bender and L. B. Richmond, Central and local limit theorems applied to asymptotic enumeration. II. Multivariate generating functions, J. Combin. Theory Ser. A 34 (983), M. Drmota, Asymptotic distributions and a multivariate Darboux method in enumeration problems, J. Combin. Theory Ser. A 67 (994), Ph. Flajolet and A. Odlyzko, Singularity analysis of generating functions, SIAM J. Discrete Math. 3 (990), Ph. Flajolet and R. Sedgewick, Analytic combinatorics, in preparation, preprint available at http: //algo.inria.fr/flajolet/publications/. 8. P. J. Grabner, C. Heuberger, and H. Prodinger, Subblock occurrences in signed digit representations, Glasg. Math. J. 45 (003), P. J. Grabner, C. Heuberger, H. Prodinger, and J. Thuswaldner, Analysis of linear combination algorithms in cryptography, ACM Trans. Algorithms (005), C. Heuberger, Hwang s quasi-power-theorem in dimension two, in preparation.. C. Heuberger and H. Prodinger, On minimal expansions in redundant number systems: Algorithms and quantitative analysis, Computing 66 (00), , Analysis of alternative digit sets for nonadjacent representations, Monatsh. Math. 47 (006), H.-K. Hwang, On convergence rates in the central limit theorems for combinatorial structures, European J. Combin. 9 (998), P. A. MacMahon, Combinatory analysis, Cambridge University Press, Cambridge, 95 96, (Reprinted: Chelsea, New York, 960). 5. F. Morain and J. Olivos, Speeding up the computations on an elliptic curve using addition-subtraction chains, RAIRO Inform. Théor. Appl. 4 (990), G. W. Reitwiesner, Binary arithmetic, Advances in computers, vol., Academic Press, New York, 960, pp J. M. Thuswaldner, Summatory functions of digital sums occurring in cryptography, Period. Math. Hungar. 38 (999), J. H. Van Lint, Introduction to coding theory, nd ed., Graduate Texts in Mathematics, vol. 86, Springer, 99. Institut für Mathematik B, Technische Universität Graz, Austria address: clemens.heuberger@tugraz.at Department of Mathematics, University of Stellenbosch, South Africa address: hproding@sun.ac.za