Fast Exponentiation with Precomputation

Abstract

In several crypt,ographic systems, a fixed elcment g of a group (generally z / q z) is repeatedly raised to many different powers. In this paper we present a practical method of speeding u p such systems. using precomputed values to reduce the number of multiplications needed. In practice this provides a substantial improvement over the level of performance that can be obtained using addition chains, and allows the computation of g" for n < N in O(1og Nlloglog N) group multiplications. We also show how these methods can he parallelized. t o c o m p u t e powers in O(1og log iV) group multiplications with o(1og iV/ log log .V) processors.

High-speed high-security signatures

“…There is nothing new in our computation at this level. Computing rB as a sum of precomputed pieces is a special case of a standard scalar-multiplication algorithm published by Pippenger in [64] (subsequently reinvented in [19] and [50]); allowing negative coefficients is a standard tweak. The devil lies in the lower-level details -choosing the optimal radix 16, and computing 16 i r i B and i 16 i r i B as efficiently as possible.…”

Fast Key Exchange with Elliptic Curve Systems

“…We implemented two well-known easy speedups that apply to randomly chosen multipliers. If the starting point P is available ahead of time, preparation of tables of multiples of P is useful [8]. This is the situation for the first two of the four When the starting point P is not known ahead of time, as for the final two key exchange point multiplications, a different speedup is available.…”

Fast batch modular exponentiation with common-multiplicand multiplication

“…As the problem of finding the shortest addition chain is NPcomplete [17], practical algorithms for exponentiation without a division operation have been studied such as the binary method, the m-ary method, window methods [31,34,41,52], exponent-folding methods [33,49], and precomputation methods [7,32]. For a group where the inversion operation is efficient like elliptic curve cryptosystems [30,35], an addition-subtraction chain can yield a good performance [38].…”