Double-Base Chains for Scalar Multiplications on Elliptic Curves Wei - PowerPoint PPT Presentation

Double-Base Chains for Scalar Multiplications on Elliptic Curves Wei Yu , Saud Al Musa, and Bao Li Institute of Information Engineering, Chinese Academy of Sciences yuwei_1_yw@163.com May, 2020

Abstract Introduction Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Abstract Introduction The Number of Double-Base Chains Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Abstract Introduction The Number of Double-Base Chains Hamming Weight of Double-Base Chains Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Abstract Introduction The Number of Double-Base Chains Hamming Weight of Double-Base Chains Dynamic Programming to Generate Optimal Double-Base Chains Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Abstract Introduction The Number of Double-Base Chains Hamming Weight of Double-Base Chains Dynamic Programming to Generate Optimal Double-Base Chains Scalar Multiplication using Double-Base Chains Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Introduction:Double-Base Chain Double-base chains (DBCs) are used to speed up scalar multiplications on elliptic curves. A DBC represents an integer n as l c i 2 b i 3 t i � i = 1 c i ∈ C = { ± 1 }, b l ≥ b l − 1 ≥ ... ≥ b 1 ≥ 0 and t l ≥ t l − 1 ≥ ... ≥ t 1 ≥ 0 . 2 b i 3 t i : a term 2 b l 3 t l : the leading term l : the Hamming weight Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Introduction:Double-Base Chain Dimitrov, Imbert, and Mishra: The canonic DBCs of a 1 positive integer n are the ones with minimal Hamming weight. An optimal DBC of n is the DBC with the smallest value in 2 the set { val ( w ) | w ∈ X } where X is the set containing all DBCs of n . w is defined by the cost of scalar multiplication. Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Introduction:Contributions Contributions structure, asymptotic lower bound dynamic programming iterative algorithm Hamming weights of DBCs generate an optimal DBC number of DBCs the first polynomial answer an open question 6 times faster time algorithm Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

The Number of DBCs Counting the number of DBCs: To show DBC is redundant 1 To generate an optimal DBC 2 Each positive integer has at least one DBC such as binary representation. Imbert and Philippe 2010: an elegant algorithm to compute the number of unsigned DBCs for a given integer. Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

The Number of DBCs Doche 2014 calculate the number of DBCs with a leading term dividing 1 2 b 3 t for a positive integer efficient for less than 70 − bit integers with a leading term 2 dividing 2 b 3 t for the most b and t exponential time algorithm 3 Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

The Number of DBCs:The Structure of the Set Containing All DBCs Φ ( b , t , n ) : the set containing all DBCs of an integer n ≥ 0 with a leading term strictly dividing 2 b 3 t . ¯ Φ ( b , t , n ) : the set containing all DBCs of an integer n ≤ 0 with a leading term strictly dividing 2 b 3 t . Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

The Number of DBCs:The Structure of the Set Containing All DBCs Let n be a positive integer, b ≥ 0 , t ≥ 0 , and b + t > 0 . The structure of Φ ( b , t ) and that of ¯ Φ ( b , t ) are described as follows. Figure: The Structure of DBCs Φ ( b , t ) , ¯ Φ ( b , t ) Φ ( b − 1 , t ) , ¯ Φ ( b , t − 1 ) , ¯ Φ ( b − 1 , t ) Φ ( b , t − 1 ) Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

The Number of DBCs:The Structure of the Set Containing All DBCs Figure: The Cardinality of the Set Containing All DBCs | Φ ( b , t ) | , | ¯ Φ ( b , t ) | | Φ ( b − 1 , t ) | , | ¯ | Φ ( b , t − 1 ) | , | ¯ | Φ ( b − 1 , t − 1 ) | , | ¯ Φ ( b − 1 , t ) | Φ ( b , t − 1 ) | Φ ( b − 1 , t − 1 ) | Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

The Number of DBCs: Iterative Algorithm Input : A positive integer n , b ≥ 0 , and t ≥ 0 Output : | Φ ( b , t ) | , | ¯ Φ ( b , t ) | | Φ ( 0 , 0 ) | ← 1 , | ¯ 1. Φ ( 0 , 0 ) | ← 0 For i from 0 to b , | Φ ( i , − 1 ) | = | ¯ 2. Φ ( i , − 1 ) | ← 0 For j from 0 to t , | Φ ( − 1 , j ) | = | ¯ 3. Φ ( − 1 , j ) | ← 0 4. For j from 0 to t 5. For i from 0 to b If i + j > 0 , compute | Φ ( i , j ) | and | ¯ 6. Φ ( i , j ) | return | Φ ( b , t ) | , | ¯ 7. Φ ( b , t ) | �� log n � 3 � The time complexity of our iterative algorithm is in O bit � log n � . operations when both b and t are O Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

The Number of DBCs 100 has 2590 DBCs with a leading term dividing 2 30 3 4 . 1 1000 has 28364 DBCs with a leading term dividing 2 30 3 6 . 2 π × 10 120 � with a leading term � the number of DBCs of 3 dividing 2 240 3 120 is 40569451268980332857047527244802033238443617954504 67273281157843672719846213086211542270726702592261 7970361 05303878574879 . Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Hamming Weight of DBCs:Open Question Open question Whether the average Hamming weight of DBCs � log n � produced by the greedy approach is O or not loglog n Doche and Habsieger 2008 Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Hamming Weight of DBCs Efforts to investigate the lower bound of DBCs Dimitrov and Howe: there exist infinitely many integers n 1 whose shortest double-base number system � � log n representations have Hamming weights Ω . loglog n logloglog n � log n � Lou, Sun, and Tartary: there exists at least one − bit 2 integer such that any DBC representing this integer needs �� terms. at least Ω �� log n Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Hamming Weight of DBCs The number of DBCs of a positive integer is infinite 1 The leading term of its DBC may be infinite 2 Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Hamming Weight of DBCs:The Range of the Leading Term of Optimal DBCs and Canonic DBCs Disanto, Imbert, and Philippe 2014 showed 2 b l 3 t l > n 2 . Let n be a positive integer represented as a DBC. This work shows n 2 < 2 b l 3 t l < 2 n when w is an optimal DBC 1 16 n 21 < 2 b l 3 t l < 9 n 7 when w is a canonic DBC 2 Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Hamming Weight of DBCs An asymptotic lower bound of the average Hamming weights of canonic DBCs for ( log n ) − bit integers is log n 8 . 25 . This answers Doche’s open question. Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Hamming Weight of DBCs Figure: The Hamming weight of canonic DBCs of integers 0 . 2 Hamming weight divided by log n 0 . 19 0 . 18 7 0 1 2 3 4 5 6 8 9 10 hundred bits of integers ( log n ) Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Hamming Weight of DBCs 0 . 182887log n for 1000 − bit integers, 1 0 . 181101log n for 2000 − bit integers, 2 0 . 179822log n for 3000 − bit integers. 3 This value of the Hamming weight given for 3000 − bit integers still has a distance from the theoretical lower bound log n 8 . 25 . Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Dynamic Programming Algorithm to Produce Optimal DBCs algorithm time complexity ( O ) space complexity ( O ) � 2 � log n Doche 2014 exponential � 4 � 3 Capuñay and Thériault 2015 � log n � log n Bernstein, Chuengsatiansup, � 2 . 5 � 2 . 5 � log n � log n and Lange 2017 � 2 loglog n � 2 Dynamic Programming (new) � log n � log n Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Dynamic Programming Algorithm to Produce Optimal DBCs Dynamic programming solves problems by combining the solutions of subproblems. Two key characteristics optimal substructure 1 overlapping subproblems 2 Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves

Dynamic Programming Algorithm to Produce Optimal DBCs:Blueprint Characterize the structure of an optimal solution Recursively define the value of an optimal solution Compute a DBC with the smallest Hamming weight in a bottom-up fashion Construct an optimal DBC from computed information Wei Yu , Saud Al Musa, and Bao Li Double-Base Chains for Scalar Multiplications on Elliptic Curves