Prime Numbers

460 Chapter 9 FAST ALGORITHMS FOR LARGE-INTEGER ARITHMETIC
where H denotes the number of 1’s in the exponent y. Since we expect about
“half 1’s” in a random exponent, the average-case complexity is thus
C ∼ (lg y)S +( 1
2 lg y)M.
Note that using (9.4) one can often achieve S ∼ M/2 so reducing the
expression for the average-case complexity of the above ladders to C ∼
(lg y)M. The estimate S ∼ M/2 is not a universal truth. For one thing,
such an estimate assumes that modular arithmetic is not involved, just
straight nonmodular squaring and multiplication. But even in the nonmodular
world, there are issues. For example, with FFT multiplication (for very large
operands, as described later in this chapter), the S/M ratio can be more
like 2/3. With some practical (modular, grammar-school) implementations,
the ratio S/M is about 0.8, as reported in [Cohen et al. 1998]. Whatever
subroutines one uses, it is of course desirable to have fewer arithmetic
operations to perform. As we shall see in the following section, it is possible
to achieve further operation reduction.
9.3.2 Enhancements to ladders
In factorization studies and cryptography it is a rule of thumb that power
ladders are used much of the time. In factorization, the so-called stage
one of many methods involves almost nothing but exponentiation (in the
case of ECM, elliptic multiplication is the analogue to exponentiation).
In cryptography, the generation of public keys from private ones involves
exponentiation, as do digital signatures and so on. It is therefore important
to optimize powering ladders as much as possible, as these ladder operations
dominate the computational effort in the respective technologies.
One interesting method for ladder enhancement is sometimes referred to
as “windowing.” Observe that if we expand not in binary but in base 4, and
we precompute powers x 2 ,x 3 , then every time we encounter two bits of the
exponent y, we can multiply by one of 1 = x 0 ,x 1 ,x 2 ,x 3 andthensquaretwice
to shift the current register to the left by two bits. Consider for example the
task of calculating x 79 , knowing that 79 = 10011112 = 10334. If we express
the exponent y = 79 in base 4, we can do the power as
x 79 =
x 42
x 3 4
x 3 ,
which takes 6S +2M (recall nomenclature S, M for square and multiply). On
the other hand, the left-right ladder Algorithm 9.3.1 does the power this way:
x 79 =
x 23
2
2
2
x x x x,
for a total effort of 6S +4M, more than the effort for the base-4 method. We
have not counted the time to precompute x 2 ,x 3 in the latter method, and so