Prime Numbers

9.3 Exponentiation 461
the benefit is not so readily apparent. But a benefit would be seen in most
cases if the exponent 79 were larger, as in many cryptographic applications.
There are many detailed considerations not yet discussed, but before we
touch upon those let us give a fairly general windowing ladder that contains
most of the applicable ideas:
Algorithm 9.3.3 (Windowing ladder). This algorithm computes x y . We
assume a base-(B = 2 b ) expansion (as in Definition 9.1.1), denoted by
(y0,...,yD−1) of y > 0, with high digit yD−1 = 0, so each digit satisfies
0 ≤ yi < B. We also assume that the values {x d : 1 < d < B; d odd}
have been precomputed.
1. [Initialize]
z =1;
2. [Loop over digits]
for(D − 1 ≥ i ≥ 0) {
Express yi =2cd, where d isoddorzero;
z = z(xd ) 2c;
// xd from storage.
if(i >0) z = z2b; }
return z;
To give an example of why only odd powers of x need to be precomputed, let
us take the example of y = 262 = 4068. Looking at this base-8 representation,
we see that
x 262 =
x 4 8 8
x 6 ,
but if x 3 has been precomputed, we can insert that x 3 at the proper juncture,
and Algorithm 9.3.3 tells us to exponentiate like so:
x 262 =
x 48 4 x 3
2 .
Thus, the precomputation is relegated to odd powers only. Another way to
exemplify the advantage is in base 16 say, for which each of the 4-bit sequences:
1100, 0110, 0011 in any exponent can be handled via the use of x 3 and the
proper sequencing of squarings.
Now, as to further detail, it is possible to allow the “window”—essentially
the base B—to change as we go along. That is, one can look ahead during
processing of the exponent y, trying to find special strings for a little extra
efficiency. One “sliding-window” method is presented in [Menezes et al. 1997].
It is also possible to use our balanced-base representation, Definition 9.1.2, to
advantage. If we constrain the digits of exponent y to be
−⌊B/2⌋ ≤yi ≤⌊(B − 1)/2⌋,
and precompute odd powers x d where d is restricted within the range of these
digit values, then significant advantages accrue, provided that the inverse