Efficient computation of addition chains

J

OURNAL DE

T

HÉORIE DES

N

OMBRES DE

B

ORDEAUX

F. B

ERGERON

J. B

ERSTEL

S. B

RLEK

Efficient computation of addition chains

Journal de Théorie des Nombres de Bordeaux, tome

6, n

o

_{1 (1994),}

p. 21-38

<http://www.numdam.org/item?id=JTNB_1994__6_1_21_0>

© Université Bordeaux 1, 1994, tous droits réservés.

L’accès aux archives de la revue « Journal de Théorie des Nombres de Bordeaux » (http://jtnb.cedram.org/) implique l’accord avec les condi-tions générales d’utilisation (http://www.numdam.org/conditions). Toute uti-lisation commerciale ou impression systématique est constitutive d’une infraction pénale. Toute copie ou impression de ce fichier doit conte-nir la présente mention de copyright.

Article numérisé dans le cadre du programme Numérisation de documents anciens mathématiques

Efficient

_computation

of

addition chains

by

F.

_BERGERON~,

J.

BERSTEL~

and S.

_BRLEK~

ABSTRACT - The aim of this paper is to present a _{unifying approach} to the

computation of short addition chains. Our method is based upon continued

fraction _expansions. Most of the popular methods for the _generation of addition _chains, such as the _{binary method,} the factor _{method, etc...,} fit in our framework. _However, we _present new and better _algorithms.

We _give a _{general upper} bound for the _complexity of continued fraction

methods, as a function of a chosen strategy, thus the total number of oper-ations _required for the _generation of an addition chain for all _integers up to n is shown to be

_{O(n log2}

_n03B3n), where 03B3n is the complexity of _computing the set of choices _{corresponding} to the _strategy. We also prove an _analog

of the Scholz-Brauer conjecture.

1. Introduction

An addition chain for a

positive

_integer

n is a _sequence of

_positive

inte-gers C =

(no,

_{nl, ... ,}

ns)

such that

(i)

(ii)

for

_{each i,}

1 i _s, there exist

_{k, j i}

such that ni =

nj + nk.

The

_{integer s}

is the

_length

of the chain C and is denoted

_by

The chain

length

L( n)

of n is the minimal

_length

of all

_possible

chains for n.

Clearly,

this notion extends to sets of numbers as

_well,

and we shall denote the

chain

_length

of

_{mi,....

_mt}

_by

_{L(ml,... , mt ) .}

Brauer

_{(in [1])}

introduced a

special

class of addition

_{chains, namely}

star-chains,

characterized

_by

the condition that

(ii’ )

for

_{each i,}

1

_{i s,}

there exists k i such that ni = _{ni-i + nk .}

These chains

_{play a major}

role in our

study.

Manuscrit recu le 17 _juin 1992.

tWith partial support from NSERC-Canada and _FCAR-Quibec.

twith the _support of PRC "Mathimatiques et _{Informatique"} and _ESPRIT, BRA

Addition chains for n

_generate

_{multiplication}

schemes for the compu-tation of For

_instance,

the chain

_{(1,2,4,8,9,17,34,43)}

leads to the

following

scheme for the

_computation

of

x43:

Clearly

this establishes a

correspondance

between addition chains and such

schemes.

_Furthermore,

the

_length

of an addition chain for n is

equal

to

the

_{corresponding}

number of

_{multiplications required}

for the

_computation

of

_Thus,

the smallest number of such

_{multiplications}

is

_{given by}

the chain

_length

of n.

This

_subject

has a

long history,

a detailed account of which is

_{given by}

Knuth in his second volume

_[9].

_Any

_explicit

_algorithm

for the

_generation

of addition chains

_clearly

sets an _upper bound on the function

~(n).

Thus

the usual

_{binary expansion}

_algorithm

_{(see [9])}

_implies

that

_{l(n) :5 A(n)}

+

v(n) -1,

where

_{A(n) =}

and

_v(n)

is the number of 1 in the

_binary

expansion

of n.

_However,

the

_problem

of

_computing

the exact value of

_l(n)

seems to be difficult.

_Indeed,

a

slightly

more

complex

problem, namely

the

problem

of

_computing

the chain

_length

for a set of

integers,

has been shown

to be

_NP-complete

_(7~.

_Therefore,

it is

_interesting

to consider

_sub-optimal

addition

_chains,

_provided

that

_they

can be constructed in an efhcient _way.

In a

previous

_paper

[3]

(see

also the work of Semba

[11]),

we have

in-troduced such a class of

_sub-optimal

addition chains for

_{positive integers}

n. These were obtained

through

continued fraction

_expansions

for

n/k,

where k is some

_integer

chosen between 2 and n - 1. We call chains of this form continued

_fraction

addition

_chains,

or

simply cf-chains.

We

proved

in this same _paper that the Scholz-Brauer

_conjecture

holds for cf-chains.

This result

_implies

that for an infinite class of

_integers,

cf-chains are much

closer to

_optimal

addition chains than the chains obtained

_by

the usual

binary

method. A

_precise

form of this assertion can be found in

_paragraph

5. Moreover we show

(Theorem 2)

that the

_length

of cf-chains satisfies the same

_asymptotic

bound as

Even

_{though minimal-length}

cf-chains are not

_{optimal, they}

have the nice

property

of

_being

_easy to

_compute

and

_{significantly}

shorter on the

aver-age than chains obtained

by

the

binary

method. This is

clearly important

when the cost of even one

multiplication

is

_high.

_Moreover,

most of the

popular

effective

_strategies

for

_computing

addition chains are obtained as

special

cases of the cf-chain method.

Thus,

minimal

length

cf-chains will

systematically

be shorter than the chains obtained

_by

these other meth-ods. We further _prove that the total number of

_operations

_required

for the

generation

of an addition chain for all

integers up

to n is

_{O(n log2}

_nyn),

where in

is the

_complexity

of

_computing

the set of choices

_{corresponding}

to the

_strategy.

This takes into account the

_complexity

of arithmetics with

multiple-precision integers.

Thus in the case where _in =

O (log n),

one

_gets

the _upper bound This holds for the

_dyadic

_strategy.

2. Continued fraction chains

Let us introduce two

_simple

_operations

on addition chains. Given two

addition chains C =

(no,

_ni,

?

ns)

for n and C’ =

(mo,

7~1,... ~

Mt)

for

m, define the

product C

Q9 C’ to be

It is clear that this chain for nm is of

length

= ₊

IC’I.

_Now,

if

C =

(no, nl, ... ,

ns)

is _a chain for _n,

and j

is one of the

_{integers appearing}

in

_C,

then define

_{C e j}

to be

Obviously

the

_length

of this chain is

_ICI

+ 1.

On the other

_hand,

recall that for an

_{integer n}

and _any k

_belonging

to

{2, 3, ... ,

n -

1~,

the continued fraction

_expansion

of

n/k

is

We shall denote this continued fraction

_by

_ji,’"3r]-

The semi-continuants

_Qi

of this continued fraction are:

Observe that

_by

construction

_Qr

= n.

A similar

_recursion,

also derived from the continued fraction

_expansion

of

_n/k,

_yields

a continued

_{f raction}

addition

_chain,

cf-chain for short. Let

C (d )

be some cf-chain for d =

gcd(n, k);

and for

each i,

1 i

r, let

Ci

=

C(ui)

be _some cf-chain for _{ui .} We define the _sequence of cf-chains

Xt

by:

Hence Xi

is a chain for

Qi,

thus

_X,.

is also a chain for n and we shall denote

it

_C(n).

All chains obtained in this manner will be called

c, f-chains.

Since

for each we have

Clearly,

the construction of a chain

C(n)

for some

_{integer n depends}

on

the choice of k as well as on the choice of the cf-chains

C(d),

C1, C2,

_...,

Cr.

The

_resulting

chain will _vary

_according

to the choices made. In _{any case,} the chain for 2a should

_always

be

_{(l, 2, 4, ... , 2a),}

because it is

_clearly

of minimal

_length.

Observe that _every cf-chain is also a star-chain in Brauer’s

_terminology.

This

_implies

that cf-chains are not

_{always optimal}

since there exist

_integers

for which no

optimal

chain is a star-chain

(12509

is the first

integer

of

this kind

_[9]).

_Conversely,

there are star-chains which are not cf-chains. For n =

367,

_a

_computer

program showed

[3]

that the shortest cf-chain

has

_length

12 whereas a shortest star-chain has

length

11.

However,

the

advantage

of cf-chains over

arbitrary

star-chains is that

they

are easier to

compute.

This is

_precisely

formulated in Theorem 1 below.

Example

1. For n =

86,

let us choose k = 10. The

corresponding

contin-ued fraction is

_[2,1,1,8],

d =

gcd(86,10)

=

_2,

and

(2, 4, 6,10, 86).

Hence the cf-chain

_{produced by}

our method

(provided

we

Observe that this chain has minimal

_length

8,

whereas the

_binary

method

produces

the chain

_{( 1, 2, 4, 5,10, 20, 21, 42, 43, 8fi)}

which has

_length

9.

3.

_Strategies

As we have

already mentioned,

we need to

_specify

how to choose the

auxiliary integer

k E

_{~2, 3, ... , n - 1 ~}

that will be used for the continued

fraction

_expansion.

Thus we shall define a

_strategy

to be a function _y that

determines for each

_{integer n}

_(which

is not a _power of

2)

some

_non-empty

subset

_{of {2,3,....~ - 1 ~ .}

For

_2~,

we

simply

set the minimal

_length

cf-chain to

_{(1, 2, 4, ..., 2°‘).}

We can now

_give

a

precise

form to the method

as an

_{algorithm parametrized}

by

a

_strategy

_y.

Algorithm

( pro d u ces

a sh ort es t cflchaJn for n

according

to

I)

if n = 2C1 then return

(1, 2, 4, ... , 2a)

elif n = 3 then return

(1, 2, 3)

else choose some k E

_-y(n)

such that

Chain(f n, k},

-y)

has minimal

_length

and return the chain endif

end Minchain.

where

Algorithm

(produces

a cf-chain for

{~i, ~2? - "9 nk})

if

n2

1 then return

_{Minchain(nl, y)}

else

_{let q}

=

(n,

div

n2 ); r

=

(nl

rem

n2 )

if r = 0 then return

_{Chain(f n2,}

n3, ... ,

nk}, y )

ø

_{Minchain( q, I)}

else return

_{(Chain(f n2,}

_n3, ... , nk,

r},

I)

0

Minchain(q,

y ) )

EÐ r endif

endif end Chain.

The

_length

of the chain for

_{{~1~2?-" nk),}

_(ni

&#x3E;

_produced

by

this

_algorithm

will be denoted

_by

_{L(~nl, n2, ... , nk}, -y).}

Now if we

further denote

_by

_{l( n, ï)}

the

_length

of the chain for n

_produced

by

algorithm

Minchain,

then one has the

_following

identities

(see [3,

4])

and

where nl =

q n2 + r, with 0 r _n2. In the

sequel

of this _paper, these

functions will

_play

an

_important

role in the

description

of the

_properties

of

the above

_algorithm.

°

The

_following

recursive

_expression

for the

_length

of the cf-chain

_produced

for n follows from these definitions. Denote

_by

_{£( n, I)}

the

_length

of a

shortest cf-chain for n

_according

to the

_{strategy -t,}

and

_by

the

length

of a shortest cf-chain for n

_containing

k and obtained

through

the

continued fraction

_expansion

of

_n/k.

Then

_£(1,¡)

=

0,

and

Many

interesting strategies

can be chosen for the

_generation

of cf-chains.

For each of these

_strategies,

say i, we shall consider the

complexity

of

computing

a i.e. a cf-chain obtained with

_strategy

_i.

Binary

strategies,

[9].

The most

_popular

_strategy

is obtained

by choosing

for all _n,

This is

_exactly

the

_{binary method,}

in Knuth’s

_terminology.

For

_instance,

the cf-chain for 87 obtained with this

_strategy

is:

The

_length

of a

binary

chain is known to be

_{i(n, 0)}

=

A(n)

₊

v(n) -

1. In

fact,

this value also follows from recurrence

(2)

_{with -y}

=

i.

One could also

consider the

_co-binary

_strategy

a:

The cf-chain for 87 obtained with the

_co-binary

_strategy,

is:

Factor

_strategy,

_[9].

The

_factor

method

_(Knuth)

_corresponds

to the

strategy:

if n is

_prime;

tl,

otherwise,

where q

is the smallest

_prime

_dividing

n.

In this case, even

_though

the set of candidates is

_small,

the

_computation

of

_{l( n, 1r)}

is

_{clearly equivalent}

to the factorization of n.

Therefore,

the

efiiciency

of this method is rather bad. A factor chain for 87 is:

Total

strategy,

[2,

3,

11].

The total

_{strategy 0}

_corresponds

to the choice of all

_acceptable

_candidates,

i.e.:

As we shall see

_below,

the

_complexity

of the

_{corresponding algorithm}

is

O(n2 Iog2

n).

One minimal total chain for 87 is obtained with k = 17 :

This is an

optimal

chain for 87.

_However,

it is not

_always

true that a

minimal cf-chain is a shortest star-chain. For

_example,

a shortest

star-chain for 367 has

_length

_11,

whereas the total

_strategy

_yields

_{1(367, 0)}

= 12

(see

[3]).

Dyadic

strategy,

[2,

3].

Because of this

_relatively

_{high complexity,}

it is

_interesting

to introduce faster

_near-optimal

methods. One such is the

dyadic

strategy:

The

_complexity

of this

_strategy

is

_{significantly}

_{smaller, namely}

_O(nlog3

_n).

Observe that C

_b(n).

Therefore minimal

_dyadic

chains are

always

shorter than

_{binary chains,}

that is

_{2(n, b) ~(~, /3)}

for all ~c. For our

running example,

a minimal

dyadic

chain is:

This chain is also an

optimal

chain for 87.

Fermat’s

_strategy.

A

_strategy

which is much faster to

_compute

is

Fer-strategy:

It

_yields

the

_following

_(optimal)

addition chain:

The interest of Fermat’s

_strategy

lies in the

_gain

of

_computation

time since is a set of size

_0(loglogn).

_Computer

calculations have shown that

+ 1 for all n _up to 1000.

Dichotomic

_strategy.

This

_strategy

is defined

_by

Since the set of choices here is a

singleton,

the dichotomic

_strategy

is

de-terministic

_(like

the

_binary

_strategy).

_{Consequently,}

both the chain and the chain

_length

are

computed

without _any backtrack. The

length

of the

chains

_produced

are

logarithmic

in the

_argument,

but the chains are not

always optimal

with these fast

_strategies.

As shown in Theorem 3

below,

the dichotomic

_strategy

_provides

much shorter chains than the

_binary

one

The data

_reported

in Table 1 has been obtained with

MAPLE©

and a

program written in

C++

running

on a MIPS2000. For each

_{strategy i,}

the

table lists the values

.11

JI. T

The values for

_i(n)

were taken from Knuth

[9].

The time shown is the time

required

for

_computing

a table of all chains for

integers

_up to 1000.

Table 1.

_{Comparison of}

the

_strategies.

Remarks. The table shows that on the average, the

binary

(schoolbook)

method is

by

far the worst with

_respect

to the

_length.

The

_computation

for the factor method does not

_really

take into account the

_complexity

of

computing

the

_prime

factorizations involved.

_Indeed,

MAPLE factorization

procedure

has a built-in table of small

_primes

(up

to

_1000).

We have not

produced

a similar table to be used with our

C++

_{program in order} to

compare it but the time obtained with the MAPLE program

gives

a clear

indication of the

_projected

time.

_Also,

the reason for the

_missing

data

about the

_Optimal

_strategy

is clear.

4. Results

Each

_strategy

defines an instantiation of the

_general

_algorithms

for the

generation

of cf-chains.

_Although

the

_complexity

of these

_algorithms

_clearly

depends

on the

complexity

of

_computing

the

_strategy

_y, we are

mainly

interested in

_evaluating

the functions i and L.

Indeed,

the effective

the

_computation

of its

_length.

More

_precisely,

addition chains are

rep-resented

_by

linked lists. Each node

_represents

one term of the

chain,

and two

_pointers

link this node to the terms whose sum

give

this term.

We show in

_Fig.

1 an

_example

of such a

_{representation}

for the chain

(1, 2, 4, 5,10, 20, 40, 80, 85, 87).

Fig.

1. List

_{representation}

_{of (1,2,4,5,10,20,40,80,85,87).}

Observe that the terms of the chain are not

_part

of this

_{representation.}

This allows for a constant time

_{implementation}

of the basic

_operations

0 and e. So the construction of

_optimal

cf-chains reduces in linear time to

the

_computation

of I and L as defined

_by

(1)

and

(2’).

The

_complexity

of

_computing

_{l( n, ~)}

is a function of _n, of the size of

and of the

_complexity

of

_computing

_7(~).

Let _in denote the

_complexity

of

computing

7(~),

then we have the

following

result.

THEOREM 1. Assume that

_{yn is}

an

_increasing

function

_{of n,}

then the

com-plexity

of computing

the function i for aU

_integers

up to n is

log2

n),

if one takes into account the

_complexity

of

_doing

arithmetic with

multiple-precision integers.

Proof.

We assume that all the

_{t(m, -1),}

for m _n, have

already

been

com-puted

and stored in an _array. Thus the

_computation

of

L(~n, k}, 7)

_using

(1)

and

₍₂₎

has the

_complexity

of

_producing

the continued fraction expan-sion of

_{n /k.}

For k in

_¡en),

the

_complexity

of

_expanding

_n/k

as a continued

fraction

_(with

_{multiple-precision}

_integers)

has been shown

_by

G. E. Collins

[6]

to be

_{O(log(k)(I+log(n/d))),}

where d =

gcd(n, k).

Hence,

the

complex-ity

of

_computing

_{L(~n, k}, I)}

is

0(log2

_n)

and the

_complexity

of

_computing

£( n, ~)

out of these is

_log2

_n).

Thus the total

_complexity

we are

look-ing

for is

_2:j=2

_j,

which is

_clearly

in

_n).

..

It is

_{straightforward}

to show that if

_-y(n)

C

_-’(n)

for two

_{strategies y}

and

_-y’,

then

_{~( n, -y’) i(n, -1).}

In

_particular,

_{l( n, 8) :5 l( n, I)}

where 0 is

the total

_strategy.

The

_diagram

in

_Fig.

2 describes the relations between the

_{strategies above,}

where an _{arrow y}

---~ ~y’

between two

_{strategies 7}

and

y

indicates the relation

_y’(n)

C

lug

Fig.

2. The

_hierarchy

of

_strategies.

5.

_Computing

short chains

We

_briefly

recall the

_major

results about the

_length

of addition chains.

Sch6nhage

[10]

established the lower bound

Brauer

_[1]

determined the

_asymptotic

behavior of

_L(n)

_{by producing}

the

upper

bound,

for 1. For a suitable _p,

_(for

instance _p = _we

get

Thurber

_[14]

_improved

Brauer’s result as follows: take first the

_binary

representation

of _n; set m

_{= A(n)}

_{+ 1;}

_then,

_starting

from the

_{leading digit,}

partition

the

_binary

word into

_equal

_parts

of

_length

_p,

_producing

the set

Then,

each ni is in the initial

set f 1, 2,3,...,2P - 1 ~,

Note that

_{multiplication by}

2P is achieved

_by

_shifting,

and if ni is even,

then it can be

replaced by

an odd number

nz

such that _{ni =} for some

j

&#x3E; 1. This does not aSect the total number of shifts.

_Therefore,

_l(n)

is bounded

_by

the total number of

_operations

needed to

_produce

_n,

_namely

where

2(P-1)

stands for the

_computation

of all odd numbers less than 2P. In that same _paper, Thurber

_pointed

out that this construction could be

improved

for small values of n: he

_proposed

to take a non-uniform

_partition

of the

_binary

_{representation}

of _n, based on an

_analysis

of the

_binary

_pattern.

Recently,

Bos and Coster

_[5]

used this method to

_produce

addition chain heuristics in a more restricted context.

_They

_investigated

_applications

to

cryptography,

namely

the

_computation

of powers

appearing

in the

well-known

_algorithm

of

_Rivest,

Shamir and Adleman

_(RSA).

Bos and Coster consider numbers such that

_a(n)

512.

Here,

we shall

only

consider a uniform

_partition

and

replace

the initial

set of

2(P-1)

odd numbers

_{by a chain}

for the set

the _upper bound

Thus,

the

_problem

of

_computing

_{l( n)}

is reduced to the

_computation

of

an

optimal

chain for the This

_suggests

the use of

Yao’s method

_[15].

Yao’s

_algorithm

is

_{asymptotically optimal,}

but there is still

_place

for

_improvements

when the

_{numbers ni}

are small.

Brauer’s bound is

_{easily expressed}

within our context. To do so, we first

define the _m-ary

_strategy.

Let m =

A(n)

₊

1,

A = m -

p(fm/pl - 1),

and

=

_{WPJ -}

1-m-ary

strategy.

The next theorem characterizes the

_asymptotic

behavior of U

r(n),u).

Its

_proof

follows that of Knuth

_[9]

for = 1.

THEOREM 2. The

_length

of a cf-chain obtained with the _m-ary

_strategy

satisfies the

_asymptotic

bound

Proof.

Let We first show that

r

r’, - .. r{}

is an ordered set such 2P - 1.

Set ro =

kt.

Following algorithm Chain,

write div

ko

and _Tl =

n rem

ko .

It follows that _{91 =}

2å

and 2P - 1.

_By

definition

₍₂₎

of L

we have

Then,

for i =

2, ... t

₊

_1,

define

Observe that

_{r~ ~}

2P -

_1,

and that _qi = 2P for all i

excepted perhaps

the

last one.

_Indeed,

_{a(~t_1) - 2a(kt) -}

_{2(p - 1),}

_{and kt}

=

kt-l

div 2P. Let

n2 =

kt-i

rem 2P. Then we have

It is easy now to check that

_i(2P

+

1,

a)

= _{p + 1.} We have thus

Substituting

A

_{and t,}

we obtain the result claimed.

and

The limit follows

_clearly.

Remarks.

1. In the

_proof

of Theorem

_2,

we made use of the dichotomic

_strategy

~ in the

computation

of

t(qi, a)

and

ri, ... ,

r’+Il,

cr).

Clearly,

even

the

_binary

_strategy

is sufficient to

_get

the

_asymptotic

bound.

_However,

we

could also

_{apply recursively}

the

_strategy

r if the numbers are

_{large enough.}

2. In order to

_get

Thurber’s

_method,

one needs to determine the

_parity

of the numbers _ni, and find the

_{corresponding}

non-uniform

_partition

of the

binary representation

of n. Since it can be achieved in

A(n)

_time,

it is

worth

_doing

it in

_{applications,}

such as RSA

_computing,

where one needs to

compute the same _{power many} times.

_Finally,

one can also define a

_strategy

which

_produces

a non-uniform

partition

of the

binary

representation

of n.

Let P =

(pi?p2?" - pt)

be a

partition

of m =

A(n)

₊ 1 such that

Then we define the

P-partition

_strategy

by

6. The Scholz-Brauer

_inequalities

One of the most

_{intriguing problems concerning}

addition chains is the

so called Scholz-Brauer

_conjecture

(see [1,

_{3, 4,}

8, 12]):

In

_[3],

we have

proved

a similar

inequality

in the case of the

_dyadic

_strategy,

This

_clearly

shows that for the

_family

of

_integers

of the form

_{2n - 1,}

the

dyadic

method is

_noticeably

better than the

_binary

method.

_Indeed,

it is

well known

_[9]

that

_i(n,,3)

=

A(n)

₊

v(n) -1,

whence

£(2n -1,,8)

= 2n - 2.

Since 0 is more

general

than

~3,

it follows that

2(rc, B) A(n)

+

_{v(n) -}

1.

Thus,

(4)

implies

that

THEOREM 3. The

_{following equah’ty}

holds for the dichotomic

_strategy

Proof.

Assume first that n = 2m. Then

o’(2" - 1)

= 2’n -1.

Consequently,

in view of

₍₁₎

and,

by

(2)

It is easy to see that

l(2m

₊

_1,

(7)

= 1 + m. It follows from

(5)

that

Assume now that n = 2m ₊ 1. Then

u(2n -

1)

=

2m+l -

_1.

_Again,

whence,

in view of

_(2),

Using

again

(2)

one

_gets

Equations

(6)

and

₍₇₎

show that

We

_conjecture

that another

_inequality

like that of Scholz-Brauer holds for Fermat’s

_strategy,

_namely:

This last

_inequality

has been checked on a

_computer

for n _up to 256.

More-over, Scholz-Brauer like

inequalities

have been derived for vectorial addition

chains

_{(see [4]).}

7.

_Open

_problems

Many

interesting

questions

arise from the work

_presented

above. The

algorithms presented

are based on continued fraction

expansions

from which

it is

_expected

to find

_partial

solutions to

_problems

about

_optimal

addition chains.

Indeed,

each

_strategy

defines a sub-class of the class of star-chains for

which it would be

_interesting

to

_investigate

the

_problems

described here-after. Most of them are

_{existing problems}

about

_optimal

addition chains

but restricted to the class of cf-chains.

Complexity.

So far we know _very little about the chain

_length

obtained

by

the the different methods: the

_asymptotic

_complexity

is known from the work of Brauer

_[1]

and

_improved

_by

Thurber

_[14];

we also know

_quite

well

the case of the

binary

method.

In

_particular,

we can ask for the

following

questions.

- Is the total

strategy

asymptotically optimal?

- What is the worst _case

complexity

for the dichotomic

_strategy?

While

an _upper bound can be found

_easily,

it would be useful to characterize the

worst cases.

-

What is the average case

_complexity

for the dichotomic

_strategy?

This

amounts to a

study

of the distribution of the

partial quotients. Again

an

upper bound can be

_{easily computed using}

the distribution of the

_partial

quotients

(see

Knuth

_[9]

for

_instance),

but an exact value

_requires

more

investigations.

It is

_expected

that some

_improvements

could be achieved

by using

ergodic

theory.

Scholz-Brauer

_{inequalities.}

As stated

_earlier,

the Scholz-Brauer

_inequality

holds for

_star-chains,

and also for the more

_general

class of

to-chains

defined

by

Hansen

_(see

_[9]).

We derived two similar

_inequalities

with the total and dichotomic

_strategies,

but the

_question

remains open for other

strategies.

Density.

Given a

_{strategy y}

the

problem

is to determine the

_density

of the solution set of the

_equation

Misceflaneous. Let = and =

It is not known whether these functions are monotonic

_increasing

in the case of

_optimal

addition chains. What can be said about cf-chains?

Acknowledgements.

This paper is a revised and

augmented

version of

a communication

[2]

that

appeared

in the

proceedings

of the XV Latin

American Conference on

_Informatics,

held in

Santiago

(Chile)

in 1989. The

authors are also thankful to R. Mallette for his

_{programming expertise}

in

writing

C++

programs. He also

spent

a lot of _computer time in order to

obtain

_part

of the data

_presented

in

_paragraph

3. We would like to thank

Jeffrey

Shallit for

_pointing

out the reference to the paper of Ichiro Semba.

REFERENCES

[1] A. Brauer, On addition chains, Bull. Amer. Math. Soc. 45 _(1939), 736-739.

[2]

F. Bergeron, J. _Berstel, S. Brlek, A _{unifying approach} to the _{generation of} addition chains, Proc. XV Latin American Conf. on _{Informatics, Santiago,} Chile July 10-14

(1989), 29-38.

[3]

F. _Bergeron, J. Berstel, S. _Brlek, C. _Duboc, Addition chains _using continued frac-tions, J. _Algorithms 10 _(1989), 403-412.

[4]

F. Bergeron, J. Olivos, Vectorial addition chains _using Euclid’s _algorithm, Research

Report, Dpt. Math., UQAM 105 _(1989).

[5] J. Bos, M. Coster, Addition chain _{heuristics, Proceedings} of CRYPTO 89.

[6]

G. E. Collins, The _computing time _of the Euclidian _algorithm, SIAM J. _Computing

3

_(1974),

1-10.

[7]

P. Downey, B. _Leong, R. _{Sethi, Computing} sequences with addition chains, SIAM J. _Computing 10 _(1981), 638-646.

[8]

A. A. _Gioia, M. V. Subbarao, M. _Sugunama, The Scholz-Brauer _problem in addition

chains, Duke Math. J. 29 _(1962), 481-487.

[9]

D. E. Knuth, The art _{of computer programming,} vol. _{2, Addison-Wesley,} 1981.

[10]

A. _Schönhage, A lower bound for the _{length of} addition _chains, Theoret. _Comput. Sci. 1 _(1975), 1-12.

[11] I.

Semba, Systematic method _{for determining} the number _{of multiplications required}

to _compute xm, where m is a _{positive integer,} J. Information Proc. 6 _(1983), 31-33.

[12]

E. G. Thurber, Addition chains and solutions _{of l(2n) = l(n)} and _{l(2n - 1) =}

n ₊

l(n) -

_1, Discrete Math. 16 _(1976), 279-289.

[13]

E. G. Thurber, The Scholz-Brauer _problem on addition chains, Pacific J. Math. 49

(1973),

229-242.

[14]

E. G. Thurber, On addition chains _{l(mn) ~ l(n) -} b and lower bounds _{for c(r),}

[14]

A. C.-C. _Yao, On the evaluation _of powers, SIAM J. Comp. 9 _(1976), 100-103.

F. _Bergeron et S. Brlek,

LACIM, Université du _Qu6bec a _Montr6al,

CP 8888 Suc. A, Montreal, (Qc), Canada, H3C 3P8. J. Berstel,

LITP, IBP, Iln.iversite Pierre et Marie Curie, Paris 6,

4 _{place Jussieu,} 75252 Paris Cedex 05.

bergeron@lacim.uqam.ca brlek~lacim.uqam.ca berstel@litp.ibp.fr