Prime Numbers

9.8 Research problems 535
less than a power of two. But another is to change the Step [Check breakover
threshold ...] to test just whether len(T )isodd. These kinds of approaches
will ensure that halving of signals can proceed during recursion.
9.8 Research problems
9.77. As we have intimated, the enhancements to power ladders can be
intricate, in many respects unresolved. In this exercise we tour some of the
interesting problems attendant on such enhancements.
When an inverse is in hand (alternatively, when point negations are
available in elliptic algebra), the add/subtract ladder options make the
situation more interesting. The add/subtract ladder Algorithm 7.2.4, for
example, has an interesting “stochastic” interpretation, as follows. Let x
denote a real number in (0, 1) and let y be the fractional part of 3x; i.e.,
y =3x −⌊3x⌋. Then denote the exclusive-or of x, y by
z = x ∧ y,
meaning z is obtained by an exclusive-or of the bit streams of x and y
together. Now investigate this conjecture: If x, y are chosen at random, then
with probability 1, one-third of the binary bits of z are ones. If true, this
conjecture means that if you have a squaring operation that takes time S,
and a multiply operation that takes time M, then Algorithm 7.2.4 takes about
time (S + M/3)b, when the relevant operands have b binary bits. How does
this compare with the standard binary ladders of Algorithms 9.3.1, 9.3.2? How
does it compare with a base-(B = 3) case of the general windowing ladder
Algorithm 9.3.3? (In answering this you should be able to determine whether
the add/subtract ladder is equivalent or not to some windowing ladder.)
Next, work out a theory of precise squaring and addition counts for
practical ladders. For example, a more precise complexity estimate for he
left-right binary ladder is
C ∼ (b(y) − 1)S +(o(y) − 1)M,
where the exponent y has b(y) total bits, of which o(y) are 1’s. Such a theory
should be extended to the windowing ladders, with precomputation overhead
not ignored. In this way, describe quantitatively what sort of ladder would
be best for a typical cryptography application; namely, x, y have say 192 bits
each and x y is to be computed modulo some 192-bit prime.
Next, implement an elliptic multiplication ladder in base B = 16, which
means as in Algorithm 9.3.3 that four bits at a time of the exponent are
processed. Note that, as explained in the text following the windowing ladder
algorithm, you would need only the following point multiples: P, 3P, 5P, 7P .Of
course, one should be precomputing these small multiples also in an efficient
manner.
Next, study yet other ladder options (and this kind of extension to the
exercise reveals just how convoluted is this field of study) as described in