Addition-chain exponentiation

In mathematics and computer science, optimal addition-chain exponentiation is a method of exponentiation by positive integer powers that requires a minimal number of multiplications. It works by creating a minimal-length addition chain that generates the desired exponent. Each exponentiation in the chain can be evaluated by multiplying two of the earlier exponentiation results. More generally, "addition-chain exponentiation" may also refer to exponentiation by sub-optimal addition chains constructed by a variety of algorithms (since an optimal addition chain is very difficult to find).

The optimal addition-chain algorithm requires fewer multiplications than binary exponentiation for large exponents. The first example of where it does better is for $a^\{15\}$, where the binary method needs six multiplies but an optimal addition chain requires only five:

:$a^\{15\}\; =\; a\; imes\; (a\; imes\; [a\; imes\; a^2]\; ^2)^2\; !$ (binary, 6 multiplies):$a^\{15\}\; =\; a^3\; imes\; (\; [a^3]\; ^2)^2\; !$ (optimal addition chain, 5 multiplies)

On the other hand, the addition-chain method is much more complicated, since the determination of an optimal addition chain seems quite difficult: no efficient optimal methods are currently known for arbitrary exponents, and the related problem of finding an optimal addition sequence has been proven NP-complete (Downey et al., 1981). Even given an optimal chain, addition-chain exponentiation requires more memory than the binary method, because it must potentially store many previous exponents from the chain simultaneously. In practice, therefore, optimal addition-chain exponentiation is primarily used for small fixed exponents for which the optimal chain can be precomputed and is not too large.

However, there are also several methods to "approximate" an optimal addition chain, and which often require fewer multiplications than binary exponentiation. Indeed, binary exponentiation itself is a suboptimal addition-chain algorithm. The best algorithm choice depends on the context (such as the relative cost of the multiplication and the number of times a given exponent is re-used). See Gordon (1998) for a survey.

Note that the problem of finding the optimal addition chain cannot be solved by dynamic programming, because it does not satisfy the assumption of optimal substructure. That is, it is not sufficient to decompose the power into smaller powers, each of which is computed optimally, since the addition chains for the smaller powers may be related (to share computations). For example, in the optimal addition chain for $a^\{15\}$ above, the subproblem for $a^6$ must be computed as $(a^3)^2$ since $a^3$ is re-used (as opposed to, say, $a^6\; =\; a^2\; (a^2)^2$, which also requires three multiplies).

Addition-subtraction–chain exponentiation

If both multiplication and division are allowed, then an addition-subtraction chain may be used to obtain even fewer total multiplications+divisions (where subtraction corresponds to division). The slowness of division compared to multiplication makes this technique unattractive in general, however. For exponentiation to negative integer powers, on the other hand, since one division is required anyway, an addition-subtraction chain is often beneficial. One such example is $a^\{-31\}$, where computing $1/a^\{31\}$ by the optimal addition chain for $a^\{31\}$ requires 7 multiplications and one division, whereas the optimal addition-subtraction chain requires 5 multiplications and one division:

:$a^\{-31\}\; =\; a\; /\; ((((a^2)^2)^2)^2)^2\; !$ (addition-subtraction chain, 5 mults + 1 div)

For exponentiation on elliptic curves, the inverse of a point $(x,y)$ is available at no cost, since it is simply $(x,-y)$, and therefore addition-subtraction chains are optimal in this context even for positive integer exponents.

References

* Donald E. Knuth, "The Art of Computer Programming, Volume 2: Seminumerical Algorithms", 3rd edition, §4.6.3 (Addison-Wesley: San Francisco, 1998).
* Daniel M. Gordon, " [http://citeseer.ist.psu.edu/519252.html A survey of fast exponentiation methods] ," "J. Algorithms" 27, 129-146 (1998).
* Daniel J. Bernstein, " [http://cr.yp.to/papers/pippenger.pdf Pippenger's Algorithm] ," to be incorporated into author's "High-speed cryptography" book. (2002)
* Peter Downey, Benton Leong, and Ravi Sethi, "Computing sequences with addition chains," "SIAM J. Computing" 10 (3), 638-646 (1981).