Daniel Krenn

Analysis of Width-

We consider digital expansions to the base of an algebraic integer τ. For a w⩾2, the set of admissible digits consists of 0 and one representative of every residue class modulo τw which is not divisible by τ. The resulting redundancy is avoided by imposing the width-w non-adjacency condition. Such constructs can be efficiently used in elliptic curve cryptography in conjunction with Koblitz curves. The present work deals with analysing the number of occurrences of a fixed non-zero digit. In the general setting, we study all w-NAFs of given length of the expansion (expectation, variance, central limit theorem). In the case of an imaginary quadratic τ and the digit set of minimal norm representatives, the analysis is much more refined. The proof follows Delangeʼs method. We also show that each element of Z[τ] has a w-NAF in that setting.

w

Efficient scalar multiplication in Abelian groups (which is an important operation in public key cryptography) can be performed using digital expansions. Apart from rational integer bases (double-and-add algorithm), imaginary quadratic integer bases are of interest for elliptic curve cryptography, because the Frobenius endomorphism fulfils a quadratic equation. One strategy for improving the efficiency is to increase the digit set (at the prize of additional precomputations). A common choice is the width\nbd-

Non-Adjacent Forms to Imaginary Quadratic Bases

w

Optimality of the Width-w Non-adjacent Form: General Characterisation and the Case of Imaginary Quadratic Bases

non-adjacent form (\wNAF): each block of

On linear combinations of units with bounded coefficients and double-base digit expansions.

w

Existence and optimality of w-non-adjacent forms with an algebraic integer base

consecutive digits contains at most one non-zero digit. Heuristically, this ensures a low weight, i.e.\ number of non-zero digits, which translates in few costly curve operations. This paper investigates the following question: Is the \wNAF{}-expansion optimal, where optimality means minimising the weight over all possible expansions with the same digit set? The main characterisation of optimality of \wNAF{}s can be formulated in the following more general setting: We consider an Abelian group together with an endomorphism (e.g., multiplication by a base element in a ring) and a finite digit set. We show that each group element has an optimal \wNAF{}-expansion if and only if this is the case for each sum of two expansions of weight 1. This leads both to an algorithmic criterion and to generic answers for various cases. Imaginary quadratic integers of trace at least 3 (in absolute value) have optimal \wNAF{}s for

Sylow

w\ge 4

p

. The same holds for the special case of base

-groups of polynomial permutations on the integers mod

(\pm 3\pm\sqrt{-3})/2

p^n

and