Shorter Addition-Subtraction Chain With Signed Composition Method

Addition chain is considered as the solution to large number operation of scalar multiplication in elliptic curve cryptosystem. Recently, a decomposition method was introduced as a new technique to generate addition chain with minimal possible terms. The method which is based on prime power input form was shown to outclass previous methods under certain condition. An earlier study shows that this method can also be used with non-prime integer such that found in composition method. As a result of no extra cost for point negation on elliptic curve, subtraction operation can be included during the generation of the chain as we found in signed decomposition method. As an alternative, in this paper, we proposed a signed composition method. Using this method, we study the properties of the chain against those generated by prime power equivalent. The comparative result between signed composition method against signed decomposition method shows that by allowing a subtraction information into the chain, the resulting chains are nearly of equal length which is very different from the unsigned case, where original decomposition method is by far has outperformed the composition method. Keywords-addition chain, binary method, double and add, non-adjacent form, complementary recoding


II. INTEGER AND PRIME FACTOR
For each composite n, there exists an equivalent prime factor of the form … .Decomposition method was originally designed for prime factor input form.Later it was shown that in some situation composite input produces shorter chain than prime input.
Unlike previous methods which take number as an input, for the purposes of better efficiency, ruleis taken as an input to this method.For every rule, there is a unique n and vice-versa [10].[13] studied the properties of n in a collection of number range given by 2 1 2 .For this reason, we assume a thorough consideration is necessary to examine every n in this form.For each number range, we determine the frequency of minimality as well as the average length of addition chains for SCM over other previous techniques.

III. SIGNED COMPOSITION METHOD
Signed Composition Method, an improved version of CM is introduced as a consequence of bringing in a subtraction operation to elliptic curve point operation at no extra cost.The idea is to reduce the number of addition operations.The development of SCM from CM can also be seen as comparable to the development of NAF from BM.Although in this case, rule is used instead of number.
SCM inherited most of its properties from SDM by considering n of SCM as a single p at prime layer of SDM.SCM generates an addition-subtraction chain similar to that of SDM [11].The doubling, addition and subtraction operations satisfy the same set of conditions as that found in [11,9].The idea of closest value in determining the coming term in the chain is also applicable [11].These conditions determine the permitted components within the generated rule.A proper definition for a signed rule was given for a prime p as in SDM.This definition can also be generalized for any integer n.Definition 3.1.Let ∈ .A signed rule for any integer n is defined as a sequence of dbl's followed by add/sub's of the form rule(n) = dbl(a 0 ), dbl(a 1 ), . . ., dbl(a i−1 ), add/sub(a i , a j1 ), add/sub(a i+1 , a j2 ), . . ., add/sub(a r−1 , a jm ) where (1) a 0 , a 1 = dbl(a 0 ), a 2 = dbl(a 1 ), . . ., a r = add/sub(a r−1 , a jm ) is the respective addition chain for which 0 ≤j m < . . .<j 2 <j 1 ≤i − 1, (2) a jk > 0 for all k such that 1 ≤k≤m.
Similar to CM, the property of uniqueness for SCM rule can easily be deduced from SDM rule [11].Theorem 3.2.An addition subtraction chain a 0 , a 1 , . . ., a r for an integer n can be computed from a given signed rule and each rule is unique to each n.Proof.As a result of generalization p to n from SDM [11].
This section unveils the necessary conditions for SCM, which are mostly related to SDM.SCM rule should be generated with some preset conditions similar to that of SDM.In so doing, the addition chain to be generated is maintained at the minimal length.
Note that, for simplicity, the term addition chain will be used as a generic term for both decomposition based method and composition based method, for unsigned and signed rules, although it should be understood that addition chain refers to anunsigned method and addition subtraction chain refers to signed method.

IV. ALGORITHM DEVELOPMENT
In this section, computer programs will be developed to simulate both CM/SCM and DM/SDM, where each one should work for two different input types.Fortunately, SCM can easily be coded by adding a small variation into CM.Even better, the code for CM/SCM can be in the same program because the additional part added for SCM will not be used for theunsigned rule.In other words, the input type decides on the method in used, and so are for the case of DM and SDM. Algorithm .OUTPUT: a 0 , a 1 , . . ., a r = n Meanwhile, Algorithm 4.2 takes primes rule(p 1 , p 2 , . . ., p s ) both unsigned and signed.Those lines with(*) are rightfully dedicated to SDM.There will be one rule assigned for each prime, p i for 1 ≤i≤s.This rule is executed e i number of times.For each i, let c i = #(dbl + add) i be the number of doubling and addition operations for p i .The output is the complete chain for DM or SDM.The length of this chain can therefore be determined.The code seems a bit more complicated with 3 nested loops but the complexity is approximated to #(dbl + add) i .e i .swhich is again in the similar magnitude as that of f.
V. ANALYSIS In this section, some properties on the boundary related to CM and SCM will be studied.This can be considered as a continuation to the studies of DM [9] and SDM [11].In some cases, theorems related to DM can easily be generalized to CM by means of substituting n for p.At times, n is considered as in the same layer as p, although in this case there is only one layer available.For all n, it is obvious that l CM (n) ≥l(n) where l CM (n) denotes the length of an addition chain generated by CM.

Lemma 5.1. Given an integer
In case r = 0, one small step is needed.Equally, if r = m one-star step is needed.Here it is clear that CM is optimal when n has at most two non-zeros.For the worst case scenario, consider n to be any integer within the range.Again CM executes m number of doublings which generate m number of terms excluding a 0 .Addition operations follow through and in the worst case all terms a m−1 , a m−2 , ...., a 0 are consumed giving another m number of operations.Hence m + 1 ≤l CM (n) ≤ 2m.Lemma 5.1 shows that l CM (n) and l DM (n) are devoted to the same boundaries.Similarly, for SCM, a result from SDM studied earlier can be used to study l SCM (n).[5] stated for every integer n, the optimal length of an addition-subtraction chain is always shorter if not equal to the optimal length of an addition chain such that ≤ l(n).Let l SCM (n)denotes the length of an addition subtraction chain generated by SCM.As a consequence, the following assertion is made true.Lemma 5.2.Let n be an integer, l SCM (n)≤l CM (n).Proof.The proof is deducible from [5].
The relationship of the four different chains follows these inequalities ≤l(n)and l SCM (n)≤l CM (n).It is not necessary that l SCM (n)≤l(n) (or otherwise) always be the case for all n.The boundary for methods developed so far has been equivalent to that of an optimal chain.The following section investigates into individual chain basis in determining the strength of each methods among themselves.

VI. RESULTS
Initially, [10] studied the property of an optimal chain l(n)for every n such that 2 m + 1 ≤n≤ 2 m+1 in relations to m.The studies comprise the analysis on the lower bound and upper bound of l(n).With regardto his works, this section studies the properties of l CM (n)and l DM (n), (l SCM (n)and l SDM (n)respectively) and the relations amongst them in asimilar fashion.By looking at the output, the scope and the outcomesof the studies can be divided into four tasks: 1. l DM (n)against l CM (n); to determine which method outperforms the other, DM or CM. 2. l SCM (n)against l CM (n); to determine the degree of improvement of SCM over CM. 3. l SDM (n)against l DM (n); to determine the degree of improvement of SDM over DM. 4. l SDM (n) against l SCM (n); to determine which method surpasses the other, SDM or SCM.
Before going further, the following notations are required; A DM (n) and A CM (n) denotes an addition chain for n generated by DM and CM respectively, whereas A SDM (n) and A SCM (n) denotes an addition-subtraction chain for n generated by SDM and SCM respectively.
Based on the theoretical findings from previous studies as well as earlier discussion of this article, this section discusses the empirical studies on all (de)composition methods studied so far.For this purpose, two parameters are to be defined and their values are calculated based on the length of generated addition chains.Parameters are evaluated based on every m.Each m represents a set of data concerning the length of addition chains for all n such that 2 m + 1 ≤n≤ 2 m+1 .For every task listed, a favorable method is decided based on the measurement of the two parameters.1. Minimal chain, .For a particular m, thecomparison will be made on the length of the two addition chains of the same n, the shorter chain will be taken into account.The method which produces more minimal chain is considered a preferable method for this particular range.Moreover, from the value of minimal chain, an ancillary graph is plotted to measure the percentage of betterment, ξ between them (for task (1) and task (4)) or percentage of improvement, ζ over their predecessor (for task (2) and task (3)).This value will be of some help in predicting the behavior of this relationship for m> 25. 2. Average length, .For a particular m, the length of all addition chains for each n, for each of the two methods are added together and divided by the number of chains.The method with smaller average length is considered as a preferable method.From the value of these average lengths, an ancillary graph is plotted to measure the percentage of betterment, ξ between them (for task (1) and task (4)) or percentage of improvement, ζ over their predecessor (for task (2) and task (3).This value will also assist in predicting the behaviour for m> 25.
The number range to be used for the purpose of data collection, defined by m is limited to 1 ≤m< 25.This is due to the restriction imposed on computational resource including processing power and memory storage.The followings are results obtained for studies suggested earlier.

A. DM versus CM
In this subsection, DM is investigated against CM to determine which method is better than the other in relation tom.The first result is the counted number of minimal chain generated by each method.For a particular m, l CM (n)and l DM (n)are calculated for all n.Each pair is evaluated and the one with shorter chain is taken into account.For any m, we define  From Figure 1, observe that even from the beginning DM has begun to overtake CM such that| |>| |.This trend seems to be continuing for m> 25.
The second result is the calculated percentage of betterment, ξ between DM and CM obtained in terms of Equation 1.The calculation is achieved by the formula Note that the value of ξ can be positive as well as negative.A positive value shows that DM is better than CM while anegative value shows that CM is better than DM for that particular m.From Figure 2, ξ starts out at 200 percent and is flattening towards 50 percent as m grows larger.Most likely its value will stay above 0 percent for m>> 25, meaning | |>| |.In this case, DM is likely to remain as a preferable method.One interesting fact would be when the ratio is 0, meaning for this particular m, they are equally competitive in which they produce the same number of shorter chains than the other.
The third result is calculated for the average length of addition chains for integers in the same number range.For every m, the calculation with respect to DM and CM follows the formulae /2 ( 3 ) Figure 3 shows that ACM is slightly bigger than ADM and the two plots seem to be increasingly separated as m grows.The fourth result is calculated for the percentage of betterment, ξ between the two methods, derived from the result in Equation 3.This value can be formulated as ξ /2 * 100 4 Note that the value of ξ can be positive as well as negative.Positive value shows that CM is better than DM while negative value shows that DM is better than CM for that particular m, both for having shorter average length.From Figure 4, it can be seen that ξ whose value not exceeding -5 percent is slowly increasing as m gets large.The plot shows that, DM is by far a better method than CM.Clearly, both part of tests agrees that DM is a preferable method for m< 25 and this trend shall remain for some larger m.

B. SCM versus CM
In this subsection, an improved method SCM is to be modeled against its predecessor CM.The objective is to find out how significant can the improvement be.As one might have known, SCM it at worst at par with CM.Theoretical studies show that l SCM (n) l CM (n), for all n.We define  In this experiment, for each m, every l SCM (n)is compared against l CM (n).Affirmatively, Figure 5 shows that l SCM (n) ≤ l CM (n)for all cases of n.There exists no A CM (n) such that l SCM (n)>l CM (n), as expected = ∅.The percentage of improvement, ζ of SCM over CM can be calculated from Equation 5 using the formula From Figure 6, ζ starts out at 0 percent and steadily curving towards 100 percent as m grows, although this value might not be achievable.Nevertheless, this tells that SCM will be much useful as m gets bigger.
For a particular m, the average length of addition chains for SCM and CM can be calculated respectively from the formulae /2 Figure 7 shows that is always smaller than that of .Moreover, the difference in the average length between the two increases with m as can be seen from the distance between the two.To see the percentage of improvement, ζ another graph is plotted based on the formula ζ /2 * 100 8 Note that the value of ζ can be positive as well as negative.Positive value means that SCM hasimproved CM while negative value means that SCM has weakened CM for that particular m.  Figure 8 shows that ζ is well over 10 percent as m gets larger.For m>> 25, the separation between the two plots is predicted to be more distant apart.Therefore, ζ shall increase too.The first part of the results shows that the number of improved chain increases with m, whereas the second part shows that as the number of improved chains increases, the average chain is reaching 10 percent.

C. SDM versus DM
In this subsection, an investigation is carried out to determine the level of improvement introduced by SDM over DM.Earlier studies proved that l SDM (n) l DM (n), for all n on every m.We define The compares l SDM (n)to l DM (n).From Figure 9, the result shows that l SDM (n) l DM (n)for all n.SDM is seen to be increasing with m.As anticipated, the plot labeled DM is always zero suchthat = ∅.In terms of Equation 9 Figure 10 shows that the number of improved chains is proportional to m.This value seems to be increasing towards 90 percent.SDM becomes more efficient a method as m gets large.For a particular m, the average length of addition chains within the same number range can be obtained respectively for SDM and DM from the formulae /2 ( 1 1 ) /2  The second test calculates the percentage of betterment, ξ based on the result from Equation 13, defined by the following formula Note that the value of ξ can as well be positive or negative.A positive value shows that SDM is better than SCM while anegative value shows that SCM is better than SDM for that particular m.From Figure 14, initially ξ starts out at maximum value by favoring SDM and gradually decreases until m = 23 at which SCM begins to outperform SDM but at a very slow pace.For m> 20, ξ stays below 1 percent.This result shows that SCM and SDM is equally competitive.
The third calculates the average length of addition chains for integers defined by every m, and the respective formulae for SCM and SDM are given by /2 Figure 15 shows that overlaps with for all m< 25.A closer look reveals that SDMproduces more minimal chains than SCM only until m = 9, after which SCM begins to outperform SDM.However, the difference is very insignificant when compared to the total number of chains.Note that the value of ξ can be positive as well as negative.Positive value shows that SCM is better than SDM while negative value shows that SDM is better than SCM for that particular m, both for having shorter average length.
From Figure 16, there is a small swing around y = 0 axes for which SDM is a better method from m≤ 8, after which SCM becomes a better method.
Both parts of the result agree on that SDM is preferred to SCM for small m.For larger m, SCM is shown to be better than SDM.As a whole, for randomized input in this experiment, SCM is considered a preferable method to SDM.However, for a chosen input SDM remains the preferable method as it was proven that it could save up more terms when compared to NAF, than that of SCM which is at best only one term shorter.

VII. CONCLUSION
(Signed) Composition method is developed for taking composite unsigned and signed rule as their input.Theoretical foundation showed that CM and SCM are restricted to the same boundaries as that of DM and SDM respectively.An empirical investigation was conducted to cross-examine methods developed so far, although the test was limited to some integer size.Two parameters, minimal chain and average length were defined for the purpose of this assessment.
Our result shows that DM is found to be a preferable method to CM.The improved versions, SCM introduces 10 percent of improvement over CM whereas SDM introduces 8 percent of improvement over DM.Finally, SDM is shown to be considerably par with SCM although, at a very small percentage, the advantage was shown to favor SDM for small m and to SCM for large m.This work concludes the studies on decomposition-based and composition-based methods.

Figure 3 :
Figure 3: Average length of addition chains.Figure 4: Percentage of betterment.

Figure 4 :
Figure 3: Average length of addition chains.Figure 4: Percentage of betterment.

Figure 7 :
Figure 7: Average length of addition chains.
the percentage of improvement, ζ introduced by SDM over DM is given by the formula

Figure 9 :
Figure 9: Number of improved chains.Figure 10: Percentage of improvement.

Figure 10 :
Figure 9: Number of improved chains.Figure 10: Percentage of improvement.

Figure 15 :
Figure 15: Average length of addition chains.Figure 16: Percentage of improvement.The fourth test measures the percentage of betterment, ξ based on Equation 15 using the following formula ξ /2 * 100 16