Use of Sparse and/or Complex Exponents in Batch Verification of Exponentiations

Abstract

Abstract. Modular exponentiation in an abelian group is one of the most frequently used mathematical primitives in modern cryptography. Batch verification is to verify many exponentiations simultaneously. We propose two fast batch verification algorithms. The first one makes use of exponents with small weight, called sparse exponents, which is asymptotically 10 times faster than the individual verification and twice faster than the previous works without security loss. The second one is applied only to elliptic curves defined over small finite fields. Using sparse Frobenius expansion with small integer coefficients, we propose a complex exponent test which is four times faster than the previous works. For example, each exponentiation in one batch requires asymptotically 9 elliptic curve additions in some elliptic curves for 2 80 security.

Batch Verification of Short Signatures

“…They showed how to apply these methods to batch verification of DSA signatures and also introduced a weaker form of batch verification called screening. Later, Cheon and Lee introduced two new methods called the sparse exponents test and the complex exponents test [22], which they claim to be about twice as fast as the small exponents test. In 2000, Boyd and Pavlovski published some attacks against different batch verification schemes, mostly ones based on the small exponents test and related tests [10].…”

Certified Synthesis of Efficient Batch Verifiers

“…One influential work is the one of Bellare, Garay and Rabin [11], who propose three generic techniques for building efficient batch verifiers: the random subset test, the small exponents test, and the bucket test. Later, Cha and Cheon propose [27] two additional techniques: the sparse exponent test, and the complex exponent test, based on similar ideas. When formulated in the setting of an additive group, these techniques exploit the idea of using randomization to reduce verification of an arbitrary number of equations to verification of a single equation on random linear combinations of the equations.…”