Redundant τ-adic expansions I: non-adjacent digit sets and their applications to scalar multiplication

Abstract

Abstract. This paper studies τ -adic expansions of scalars, which are important in the design of scalar multiplication algorithms for Koblitz Curves, but are also less understood than their binary counterparts. At Crypto '97 Solinas introduced the width-w τ -adic non-adjacent form for use with Koblitz curves. It is an expansion of integers z = P ℓ i=0 ziτ i , where τ is a quadratic integer depending on the curve, such that zi = 0 implies zw+i−1 = . . . = zi+1 = 0, like the sliding window binary recodings of integers. We show that the digit sets described by Solinas, formed by elements of minimal norm in their residue classes, are uniquely determined. However, unlike for binary representations, syntactic constraints do not necessarily imply minimality of weight. Digit sets that permit recoding of all inputs are characterized, thus extending the line of research begun by Muir and Stinson at SAC 2003 to the Koblitz Curve setting. Two new digit sets are introduced with useful properties; one set makes precomputations easier, the second set is suitable for low-memory applications, generalising an approach started by Avanzi, Ciet, and Sica at PKC 2004 and continued by several authors since, including Okeya, Takagi and Vuillaume. Results by Solinas, and by Blake, Murty, and Xu are generalized. Termination, optimality, and cryptographic applications are considered. The most important application is the ability to perform arbitrary windowed scalar multiplication on Koblitz curves without storing any precomputations first, thus reducing memory storage to just one point and the scalar itself.

On the number of binary signed digit representations of a given weight

“…It also motivated a generalization of BSDR's of integers using different digits and bases, see e.g. [12], [20].…”

Non-minimality of the width-$w$ non-adjacent form in conjunction with trace one $\tau $-adic digit expansions and Koblitz curves in characteristic two

“…This proposition was proved for q = 2 in Avanzi, Heuberger and Prodinger [4]. The proof there uses a result of Meier and Staffelbach [17], namely their Lemma 2.…”

Symmetric digit sets for elliptic curve scalar multiplication without precomputation

“…In other words, we do not know whether is w -NADS or not. To overcome this problem, in [3, §3.2.1] the authors suggest to step down the window size w in Algorithm 1 for the rest of the computation, whenever the following holds: or equivalently, …”

“…Algorithm 2 is a modified version of Algorithm 1 where a control step has been added (cf. [3, §3.2.1, Alg. 6] with small adjustments): if (9) holds, the algorithm reduces the window size w and tries again until (9) is false, or ; at this point we use the fact that is a k -NADS.…”