Analysis of the Binary Asymmetric Joint Sparse Form Clemens - PowerPoint PPT Presentation

Analysis of the Binary Asymmetric Joint Sparse Form Clemens Heuberger * Sara Kropf Alpen-Adria-Universit¨ at Klagenfurt and TU Graz Supported by the Austrian Science Fund: W1230 Menorca, 2013-05-29 1

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) (1 ) 2 P = P . 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) (10 ) 2 P = 2( P ) + 0 . 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) (100 ) 2 P = 2(2( P ) + 0) + 0 . 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) (100¯ 1 ) 2 P = 2(2(2( P ) + 0) + 0) − P . 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) (100¯ 10 ) 2 P = 2(2(2(2( P ) + 0) + 0) − P ) + 0 . 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) 27 P = (100¯ 10¯ 1) 2 P = 2(2(2(2(2( P ) + 0) + 0) − P ) + 0) − P . 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) 27 P = (100¯ 10¯ 1) 2 P = 2(2(2(2(2( P ) + 0) + 0) − P ) + 0) − P . Number of additions/subtractions ∼ Hamming weight of the binary expansion 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) 27 P = (100¯ 10¯ 1) 2 P = 2(2(2(2(2( P ) + 0) + 0) − P ) + 0) − P . Number of additions/subtractions ∼ Hamming weight of the binary expansion Number of multiplications ∼ length of the expansion 2

Digital Expansions and Scalar Multiplication Scalar multiplication nP in abelian group G ( P ∈ G , n ∈ N ) using digital expansion ℓ − 1 � η j 2 j n = j =0 with digits from some digit set D ⊆ Z : 27 = value 2 (100¯ 10¯ (¯ 1) , 1 := − 1) 27 P = (100¯ 10¯ 1) 2 P = 2(2(2(2(2( P ) + 0) + 0) − P ) + 0) − P . Number of additions/subtractions ∼ Hamming weight of the binary expansion Number of multiplications ∼ length of the expansion Precompute η P for digits η ∈ D . 2

Application: Elliptic Curve Cryptography Elliptic Curve E : y 2 = x 3 + ax 2 + bx + c E 2 R P Q − P R P + Q 3

Application: Elliptic Curve Cryptography Elliptic Curve E : y 2 = x 3 + ax 2 + bx + c For P ∈ E and n ∈ Z , nP can be calculated E easily. No efficient algorithm to calculate n from P 2 R and nP ? P Q Fast calculation of nP desirable! − P R P + Q 3

Application: Elliptic Curve Cryptography Elliptic Curve E : y 2 = x 3 + ax 2 + bx + c For P ∈ E and n ∈ Z , nP can be calculated E easily. No efficient algorithm to calculate n from P 2 R and nP ? P Q Fast calculation of nP desirable! In some elliptic curve cryptosystems (Elliptic Curve Digital Signature Algorithm (ECDSA) − P and El Gamal), the calculation of R ℓ P + mQ or ℓ P + mQ + nR P + Q for ℓ , m , n ∈ Z and P , Q , R ∈ E is also necessary. 3

Joint Expansions for Linear Combinations Instead of computing ℓ P and mQ separately and adding the results ℓ P + mQ : 4

Joint Expansions for Linear Combinations Instead of computing ℓ P and mQ separately and adding the results ℓ P + mQ : Compute digital expansion (“joint expansion”) of the vector � ℓ ℓ − 1 � � η j 2 j = m j =0 where the digits η j are now vectors. 4

Joint Expansions for Linear Combinations Instead of computing ℓ P and mQ separately and adding the results ℓ P + mQ : Compute digital expansion (“joint expansion”) of the vector � ℓ ℓ − 1 � � η j 2 j = m j =0 where the digits η j are now vectors. � η (1) Precompute η (1) P + η (2) Q for all η = � ∈ D . η (2) 4

Joint Expansions for Linear Combinations Instead of computing ℓ P and mQ separately and adding the results ℓ P + mQ : Compute digital expansion (“joint expansion”) of the vector � ℓ ℓ − 1 � � η j 2 j = m j =0 where the digits η j are now vectors. � η (1) Precompute η (1) P + η (2) Q for all η = � ∈ D . η (2) Number of group additions ∼ number of nonzero digit vectors (“joint weight”). 4

Asymmetric Joint Sparse Form For joint expansions of vectors of dimension d , consider the digit set D = { ℓ, . . . , − 1 , 0 , 1 , . . . , u } d for ℓ ≤ 0 and u ≥ 1. 5

Asymmetric Joint Sparse Form For joint expansions of vectors of dimension d , consider the digit set D = { ℓ, . . . , − 1 , 0 , 1 , . . . , u } d for ℓ ≤ 0 and u ≥ 1. For given n ∈ Z d , find a joint expansion over the digit set D minimising the joint weight over all such expansions. 5

Asymmetric Joint Sparse Form For joint expansions of vectors of dimension d , consider the digit set D = { ℓ, . . . , − 1 , 0 , 1 , . . . , u } d for ℓ ≤ 0 and u ≥ 1. For given n ∈ Z d , find a joint expansion over the digit set D minimising the joint weight over all such expansions. The minimal expansion is called the Asymmetric Joint Sparse Form. 5

Asymmetric Joint Sparse Form For joint expansions of vectors of dimension d , consider the digit set D = { ℓ, . . . , − 1 , 0 , 1 , . . . , u } d for ℓ ≤ 0 and u ≥ 1. For given n ∈ Z d , find a joint expansion over the digit set D minimising the joint weight over all such expansions. The minimal expansion is called the Asymmetric Joint Sparse Form. Analyse the joint weight of this expansion. 5

Colexicographically Minimal Expansion Consider two joint expansions η L − 1 . . . η 0 and η ′ L − 1 . . . η ′ 0 of the same integer vector n . 6

Colexicographically Minimal Expansion Consider two joint expansions η L − 1 . . . η 0 and η ′ L − 1 . . . η ′ 0 of the same integer vector n . Set c j = [ η j � = 0] and c ′ j = [ η ′ j � = 0] for all j . 6

Colexicographically Minimal Expansion Consider two joint expansions η L − 1 . . . η 0 and η ′ L − 1 . . . η ′ 0 of the same integer vector n . Set c j = [ η j � = 0] and c ′ j = [ η ′ j � = 0] for all j . We say that η L − 1 . . . η 0 is colexicographically smaller than η ′ L − 1 . . . η ′ 0 if there is a J such that c J < c ′ c J − 1 = c ′ J − 1 , . . . , c 0 = c ′ J , 0 . 6

Colexicographically Minimal Expansion Consider two joint expansions η L − 1 . . . η 0 and η ′ L − 1 . . . η ′ 0 of the same integer vector n . Set c j = [ η j � = 0] and c ′ j = [ η ′ j � = 0] for all j . We say that η L − 1 . . . η 0 is colexicographically smaller than η ′ L − 1 . . . η ′ 0 if there is a J such that c J < c ′ c J − 1 = c ′ J − 1 , . . . , c 0 = c ′ J , 0 . We say that η L − 1 . . . η 0 is a colexicographically minimal expansion if there is no colexicographically smaller expansion of the same integer vector. 6

Colexicographically Minimal Expansion Consider two joint expansions η L − 1 . . . η 0 and η ′ L − 1 . . . η ′ 0 of the same integer vector n . Set c j = [ η j � = 0] and c ′ j = [ η ′ j � = 0] for all j . We say that η L − 1 . . . η 0 is colexicographically smaller than η ′ L − 1 . . . η ′ 0 if there is a J such that c J < c ′ c J − 1 = c ′ J − 1 , . . . , c 0 = c ′ J , 0 . We say that η L − 1 . . . η 0 is a colexicographically minimal expansion if there is no colexicographically smaller expansion of the same integer vector. Example: � 1 � � 0001 � � 0001 � = = . 100¯ 5 0005 3 2 2 First expansion is colexicographically smaller. 6

Colexicographically Minimal Expansions (2) “colexicographically” = “lexicographically from right to left, i.e., least significant to most significant digit” 7

Colexicographically Minimal Expansions (2) “colexicographically” = “lexicographically from right to left, i.e., least significant to most significant digit” colexicographically minimal expansion: greedy for zeros from right to left. 7