Prime Numbers

9.4 Enhancements for gcd and inverse 463
so the fact of a “stable” value for x really can yield high efficiency, because of
the (lg B) −1 factor. Depending on precise practical setting and requirements,
there exist yet further enhancements, including the use of less extensive
lookup tables (i.e., using only the stored powers such as xBj ), loosening of
the restrictions on the ranges of the for() loops depending on the range of
values of the y digits in base B (in some situations not every possible digit
will occur), and so on. Note that if we do store only the reduced set of powers
xBj , the Step [Loop over digits] will have nested for() loops. There also exist
fixed-y algorithms using so-called addition chains, so that when the exponent
is stable some enhancements are possible. Both fixed-x and fixed-y forms
find applications in cryptography. If public keys are generated as fixed x
values raised to secret y values, for example, the fixed-x enhancements can be
beneficial. Similarly, if a public key (as x = gh ) is to be raised often to a key
power y, then the fixed-y methods may be invoked for extra efficiency.
9.4 Enhancements for gcd and inverse
In Section 2.1.1 we discussed the great classical algorithms for gcd and inverse.
Here we explore more modern methods, especially methods that apply when
the relevant integers are very large, or when some operations (such as shifts)
are relatively efficient.
9.4.1 Binary gcd algorithms
There is a genuine enhancement of the Euclid algorithm worked out by
D. Lehmer in the 1930s. The method exploits the fact that not every implied
division in the Euclid loop requires full precision, and statistically speaking
there will be many single-precision (i.e., small operand) div operations. We
do not lay out the Lehmer method here (for details see [Knuth 1981]), but
observe that Lehmer showed how to enhance an old algorithm to advantage
in such tasks as factorization.
In the 1960s it was observed by R. Silver and J. Terzian [Knuth 1981], and
independently in [Stein 1967], that a gcd algorithm can be effected in a certain
binary fashion. The following relations indeed suggest an elegant algorithm:
Theorem 9.4.1 (Silver, Terzian, and Stein). For integers x, y,
If x, y are both even, then gcd(x, y) =2gcd(x/2,y/2);
If x is even and y is not, then gcd(x, y) =gcd(x/2,y);
(As per Euclid) gcd(x, y) =gcd(x − y, y);
If u, v are both odd, then |u − v| is even and less than max{u, v}.
These observations give rise to the following algorithm:
Algorithm 9.4.2 (Binary gcd). The following algorithm returns the greatest
common divisor of two positive integers x, y. For any positive integer m, let
v2(m) be the number of low-order 0’s in the binary representation of m; that
is, we have 2 v2(m) m. (Note that m/2 v2(m) is the largest odd divisor of m, and