On Redundant τ-Adic Expansions and Non-adjacent Digit Sets

Abstract

Abstract. This paper studies τ -adic expansions of scalars, which are important in the design of scalar multiplication algorithms on Koblitz Curves, and are less understood than their binary counterparts.At Crypto '97 Solinas introduced the width-w τ-adic non-adjacent form for use with Koblitz curves. It is an expansion of integers z = È i=0 ziτ i , where τ is a quadratic integer depending on the curve, such that zi = 0 implies zw+i−1 = . . . = zi+1 = 0, like the sliding window binary recodings of integers. We show that the digit sets described by Solinas, formed by elements of minimal norm in their residue classes, are uniquely determined. However, unlike for binary representations, syntactic constraints do not necessarily imply minimality of weight.Digit sets that permit recoding of all inputs are characterized, thus extending the line of research begun by Muir and Stinson at SAC 2003 to Koblitz Curves.Two new useful digit sets are introduced: one set makes precomputations easier, the second set is suitable for low-memory applications, generalising an approach started by Avanzi, Ciet, and Sica at PKC 2004 and continued by several authors since. Results by Solinas, and by Blake, Murty, and Xu are generalized.Termination, optimality, and cryptographic applications are considered. We show how to perform a "windowed" scalar multiplication on Koblitz curves without doing precomputations first, thus reducing memory storage dependent on the base point to just one point.

Extending Scalar Multiplication Using Double Bases

“…In [10], accepted at CHES 2006, the authors present practical measurements on FPGA and show that indeed one achieves a 50% speedup already on the smallest Koblitz curve K-163 by using short decompositions found by a clever extensive search. The paper [2], to appear in the proceedings of SAC 2006, among other things contains results similar to ours, but expressed in the language of expansions with respect to a single base using suitably defined digit sets.…”

“…In order to generalize their approach the digit set itself has to be modified. In [2] it is shown how to do so.…”

Faster and Lower Memory Scalar Multiplication on Supersingular Curves in Characteristic Three

“…Our next goal is to use the digit sets implied by the decomposition of the unit group of Theorem 1 in a precomputationless scalar multiplication algorithm similar to the one presented in [3] for Koblitz curves in characteristic two. In that case the unit group had a much simpler structure than in the present context, that will require a deeper study.…”

“…In order to guarantee that any τ -adic expansion terminates, we follow the same approach as in [3,4], which consists in reducing the value of the parameter w if the norm of the input becomes too small. As in [3,4] it is easy to verify that this has a minimal and asymptotically negligible impact on the weight of the expansion.…”

“…However, one can exploit the structure of the unit group in a more subtle way, to store only about O(3 w/2 ) precomputed points instead of O(3 w ) to perform a width-w windowed scalar multiplication. P ← normal basis(P ) 3.…”