Scott Fluhrer edited untitled.tex  over 8 years ago

Commit id: c196ecc6f6375ca06e4189d4656a3fa2c13f25cb

deletions | additions      

       

and then perform the computation:  $$kG = d_0G + b \cdot ( d_1 G + b \cdot (d_2 G + ... + b \cdot(d_{i-1}G + b \cdot (d_i G)))...)))$$  In the straight-forward way, this takes $b-2$ additions to evaluate the values $(0G, 1G, 2G, ..., (b-1)G)$, and then $i$ cycles of multiplying an intermediate point  by the small integer $b$ and adding the point that corresponds to th  next digit. Of course, there are a number of variants to this approach, both to try to achieve constant time, and to reduce the number of additions required (for example, by using the digits in the range $(-b/2, b/2)$, taking advantage of the fact that we can compute the inverse $-G$ cheaply within an Elliptic Curve group). The obvious choice is to make $b$ a power of two (so $b = 2^m$); this yields two immediate advantages: