Scott Fluhrer edited untitled.tex  almost 9 years ago

Commit id: 34880f51fee69a891e34565cfea589bd396cab5f

deletions | additions      

       

and then perform the computation:  $$kG = d_0G + b \cdot ( d_1 G + b \cdot (d_2 G + ... + b \cdot(d_{i-1}G + b \cdot (d_i G)))...)))$$  In the straight-forward way, this takes $b-2$ additions to evaluate the values $(0G, 1G, 2G, ..., (b-1)G)$, and then $i$ cycles of multiplying by the small integer $b$ and adding the next digit. Of course, there are a number of variants to this approach, both to try to achieve constant time, and to reduce the number of additions required (for example, by using the digits in the range $(-b/2, b/2)$, taking advantage of the fact that with Elliptic Curves, computing we can compute  the inverse $-G$ is cheaply within  an easy operation). Elliptic Curve group).  The obvious choice is to make $b$ a power of two (so $b = 2^m$); this yields two immediate advantages: