Algorithm and implementation of signed-binary recoding with asymmetric digit sets for elliptic curve cryptosystems

Signed-binary representations of integer k with symmetric digit set D-s = {-(2(w) - 1),-(2(w) - 3), ..., - 1, 0, 1, ..., 2(w) - 3, 2(w) - 1} may have lower weight than the unsigned-binary expansion of k. The "weight" is the number (if nonzero digits in a binary expansion. Lower weight. leads to fewer number of addition operations in the scalar multiplication, kP, of elliptic curve cryptosystems. Here P is a point on an elliptic curve. On the other hand, computing the minimum-weight signed-binary representation from left (most significant bit) to right (least significant bit) significantly reduces memory requirements because intermediate results do not need to be stored. Since the size of D-s is 2(w) + 1, a (w + 1)-bit data bus is necessary to represent the 2(w) + 1 elements in D-s. This is inefficient because a (w + 1)-bit bus is capable of denoting 2(w+1) cases. We present a new signed-binary recoding algorithm with asymmetric digit set D-a = {- (2(w) - 1), - (2(w) - 3), ..., -1, 0, 1, ..., 2(w) - 3}. For w = 2, our simulation results show that the average weight of signed-binary numbers with digit set {-3, -1, 0, 1} is 0.285 times the length of their unsigned-binary expansions. For the optimal representations with {-1, 0, 1} the average ratio is 0.333. The number of additions is decreased by 14.4%. The encoding circuit requires 7 flip-flops and 22 gates to realize.