在密碼學中, 計算A^X mod n 與A^XB^Y mod n 常見於許多基於離散對數難題所
設計的簽章, 其中的X、Y 及n 通常都是相當大的數字。因此直接乘X 次A 及
Y 次B 再進行模n 的運算是相當不實際的。加上模指數運算通常是這類簽章中
最耗時的部份, 所以有相當多探討藉由轉換成其他數字系統或採用不同演算法來
減少其運算量的文章。在這篇文章中, 我們提出基於signed-digit number system
下使用區塊演算法(Block method) 來改善其模指數運算, 使用轉換狀態圖來分
析其效能。並將其概念加以延伸, 加強其實用性。由於此方法在預先計算量小的時
候有較好的效能, 因此特別適用於像是智慧卡這類儲存空間受限的裝置。
關鍵字模指數, 稀鬆格式, 區塊演算法

Computing A^X mod n or A^XB^Y mod n for
large X, Y, and n is very important in many ElGamal-like
public key cryptosystems. In this paper, we proposed using block
method in sparse form to improve the performance of modular exponentiation
and analyzing the computational cost
by state transition diagram. We also extended the concept of Block Method and make it more general.
This method is suitable for some devices with limited storage space, such as smart card.

1 緒論1
1.1 研究背景. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 研究動機. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.3 論文架構. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2 編碼演算法4
2.1 Binary Method . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 Binary number system . . . . . . . . . . . . . . . . . . . . . . 5
2.3 Signed-digit number system . . . . . . . . . . . . . . . . . . . 6
2.3.1 Sparse Form . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3.2 DJM . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3.3 Joint Sparse Form(JSF) . . . . . . . . . . . . . . . . . 10
3 多指數運算加速策略12
3.1 m-ary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.2 Sliding window method . . . . . . . . . . . . . . . . . . . . . . 13
3.3 Fibonacci k-ary number system . . . . . . . . . . . . . . . . . 15
iv
4 馬可夫鏈17
4.1 定義與特性. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
5 區塊演算法19
5.1 AX mod n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.2 AXBY mod n . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.3 效率分析. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.4 Extended Block Method . . . . . . . . . . . . . . . . . . . . . 31
6 結論與未來展望33
參考文獻33

[1] 賴溪松楊吳泉. . In 第十七屆全國資訊安全會議, pages 341–351, 2007.
[2] Addition chain heuristics, volume Lecture Notes In Computer Science
435. Advances in Cryptology, Crypto, 1989.
[3] S. Arno and F. S. Wheeler. Signed digit representations of minimal
hamming weight. IEEE Transactions on computers, 42:1007–1010, 1993.
[4] T. ElGamal. A public key cryptosystem and a signature scheme based
on discrete logarithms. IEEE Transactions on Information Theory, IT-
31:469–472, 1985.
[5] DM Gordon. A survay of fast exponentiation methods. Journal of
Algorithms, 27:129–146, 1998.
[6] D. J Guan. Efficient algorithms for computing modular exponentiation
ax modn. In JWIS2008, 2008.
[7] Shmuel T. Klein. Sould one always use repeated squaring for modular
exponentiation? Information Processing Letters, 106:232–237, 2008.
[8] D. E Knuth. The art of computing programming, volume 2. 1969.
[9] A. A. Markov. Rasprostranenie zakona bol’shih chisel na velichiny, zavisyaschie
drug ot druga. Izvestiya Fiziko-matematicheskogo obschestva
pri Kazanskom universitete, pages 135–156, 1906.
[10] C. S. Laih S. M. Yen and A. K. Lenstra. Multi-exponentiation. IEE
Proc., Computers and Digital Techniques, 1:325–326, 1994.
[11] Olivier Semay. Efficient analysis of window methods using markov
chains. Master’s thesis, Fachbereich Informatik Kryptographiche Protokolle
Techniche Universit‥at Darmstadt, 2004.
[12] J. A Solinas. Low-weight binary representations for pairs of integers.
Report CORR 2001-41, 2001.
[13] G. A. Jullien V. S. Dimitrov and W. C. Miller. Complexity and fast
algorithms for multi-exponentiations. IEEE Transactions on Computers,
49:141–147, 2000.
[14] George W.Reitwiesner. Binary arithmetic. Advances inComputers,
1:231–308, 1960.
[15] D. J Guan Wu Chuan Yang and Chi Sung Laih. Fast multicomputation
with asynchronous strategy. IEEE Transactions on Computers, 56:234–
242, 2007.