A Simulated Annealing Algorithm for the Problem of Minimal Addition ...
A Simulated Annealing Algorithm for the Problem of Minimal Addition Chains Adan Jose-Garcia, Hillel Romero-Monsivais, Cindy G. Hernandez-Morales, Arturo Rodriguez-Cristerna, Ivan Rivera-Islas, and Jose Torres-Jimenez Information Technology Laboratory, CINVESTAV-Tamaulipas Km. 5.5 Carretera Cd. Victoria-Soto la Marina, 87130, Cd. Victoria Tamps., Mexico {ajose,hromero,chernandez,arodriguez,rrivera}@tamps.cinvestav.mx, [email protected]
Abstract. Cryptosystems require the computation of modular exponentiation, this operation is related to the problem of finding a minimal addition chain. However, obtaining the shortest addition chain of length n is an NP-Complete problem whose search space size is proportional to n!. This paper introduces a novel idea to compute the minimal addition chain problem, through an implementation of a Simulated Annealing (SA) algorithm. The representation used in our SA is based on Factorial Number System (FNS). We use a fine-tuning process to get the best performance of SA using a Covering Array (CA), Diophantine Equation solutions (DE) and Neighborhood Functions (NF). We present a parallel implementation to execute the fine-tuning process using a Message Passing Interface (MPI) and the Single Program Multiple Data (SPMD) model. These features, allowed us to calculate minimal addition chains for benchmarks considered difficult in very short time, the experimental results show that this approach is a viable alternative to solve the solution of the minimal addition chain problem.
1
Introduction
The modular exponentiation (repetition of modular multiplications) is one of the most important operations for data scrambling and it is used by several public-key cryptosystems such as RSA encryption scheme [1]. Moreover, since cryptographic applications often use very large fields or rings, the cost of one multiplication is rather high and reducing the number of multiplications needed in exponentiation can significantly improve the speed of a cryptosystem. Therefore, the performance of a cryptosystem is determined by the efficiency of the implementation of modular multiplications [9]. The problem of determining the optimal sequence of multiplications required for performing a modular exponentiation can be formulated using the concept of addition chains. An addition chain for a positive integer α is a sequence of positive integers C = (α0 , α1 , . . . , αr ) s.t [10]: L. Antunes and H.S. Pinto (Eds.): EPIA 2011, LNAI 7026, pp. 311–325, 2011. © Springer-Verlag Berlin Heidelberg 2011
312
A. Jose-Garcia et al.
αi =
1 αj + αk
if i = 0 and αr = α if i > 0 for some j, k < i
The integer r is the length of the chain C and is denoted by | C |. The chain length l(α) of α is the minimal length of all possible chains for α. Addition chains for α generate multiplications for the computation xα . For instance, the chain (1, 2, 4, 5, 9, 18, 23) leads to the following scheme for the computation of x23 , xx = x2 , x2 x2 = x4 , xx4 = x5 , x4 x5 = x9 , x9 x9 = x18 , x5 x18 = x23 The addition chain-based methods use a sequence of positive integers s.t. the first number of the chain is 1 and the last is the exponent α, and in which each member is the sum of two previous members of the chain. Clearly this establishes a correspondence between addition chains and such schemes. Therefore, the length of an addition chain α is equal to the corresponding number of multiplications required for the computation of xα . Thus, the smallest of such multiplications is given by the chain length l(α) of α. Addition chains have been studied extensively, Downey et al. have shown that the problem of determining an addition chain for α with the shortest length l(α) belongs to the family of NP-complete [4] problems. Therefore, it is recommended to use some kind of heuristic strategy in order to find an optimal addition chain when dealing with large exponents α. In this paper, we present a Simulated Annealing (SA) to solve the problem of minimal addition chains. We subdivide the remaining of the paper into six sections. Section 2 describes the relevant related work to our research. Section 3 contains the description and the implementation details of our SA. Section 4 presents the experimental design using Covering Array and Diophantine Equation solutions, and describes a parallel approach to execute the SA. Section 5 reports the tuning parameters, the benchmark used to measure the performance of the SA, and the experimental results obtained. Finally, in Section 6 some conclusions are drawn.
2
Relevant Related Work
Let x be an arbitrary integer in the range [1, n − 1], and α an arbitrary positive integer. Then, finding the modular exponentiation is defined as the problem of finding a unique integer β ∈ [1, n − 1] that satisfies β = xα mod n A naive method to compute β requires α − 1 modular multiplications. The sequence of powers is described as: x → x2 → x3 → . . . → xα−1 → xα
A SA Algorithm for the Problem of Minimal Addition Chains
313
For instance, to compute x8 , this method performs seven multiplications: x → x2 → x3 → x4 → x5 → x6 → x7 → x8 . However, x8 can be computed using only three multiplications x → x2 → x4 → x8 . The correct sequence of multiplications required for performing a modular exponentiation can be formulated using the concept of addition chains. One possible way to compute xα for α ∈ N is by the binary method [3]. The Equation 1 presents a recursive description of this method. ⎧ ⎪ if α = 1 ⎨x α α xα = x 2 · x 2 if α is even ⎪ ⎩ α−1 x · x otherwise
(1)
This method is faster than the naive method that computes α−1 multiplications. For example, 7 multiplication are necessary to compute x23 , the powers x2 , x4 , x5 , x10 , x11 , x22 and x23 are computed from previous ones using one multiplication. However, the shortest way to compute x23 requires only 6 multiplications for α = 23, the powers involved are: x2 , x4 , x5 , x9 , x18 and x23 . For some α ∈ N, let B(α) the addition chain corresponding to the binary method, it is defined in Equation 2, i.e. B(α) is the list of integers si where xsi is an intermediary result while computing xα . Therefore, we can describe B(α) as follows: ⎧ ⎪ if α = 1 ⎨1 B(α) = B( α2 ), α if α is even ⎪ ⎩ B(α − 1), α otherwise
(2)
According to the binary method the length of B(α) is log2 (α) + 1 plus the number of bits equal to 1 in the binary representation of α. If we denote this value by ν(α), we get the immediate consequence: l(α) ≤ log2 (α) + v(α) − 1 ≤ 2log2 (α) There are a large number of reported algorithms for finding optimal addition chains. Reported strategies include: binary method, m-ary method, window-based method [3,4]. Those algorithms have in common that they strive to keep the number of required field multiplications as low as possible through the usage of a particular heuristic. Different heuristics for finding short, but not necessarily minimal, addition chains for α large have been proposed [4,5,7]. In the reviewed bibliography we do not find reported a SA approach for computing minimal addition chains. Simulated Annealing algorithms have been successfully applied to solve a broad variety of optimization problems [11,13]. In this paper, we present a SA applied to optimize addition chains. The results obtained using this algorithm suggest that this approach is a competitive alternative to solve the problem of minimal addition chain.
314
3
A. Jose-Garcia et al.
Proposed Approach
In the proposed approach, the search space of the minimal addition chain problem has a lower bound and upper bound, where the lower bound value in the binary representation for an addition chain α is denoted by ϕ, ϕ = log2 (α) while the upper bound is denoted by ψ, ψ = 2log2 (α) The initialization for an addition chain α assures that it has an initial length equal to ϕ + 1, then the minimal length for α is, ϕ≤α 0 Cr(i) = (3) indef inite if i = 0 and
C (i) =
C(i − 1) + C(Cr(i)) 1
if i > 0 if i = 0
(4)
where C (i) is the addition chain generated with our approach. 3.1
The Proposed Simulated Annealing Algorithm
To evaluate the practical usefulness of the evaluation function Ψ , a SA was developed. Next some details of the implementation proposed are presented: Evaluation function. In this implementation we have included the evaluation function Ψ whose formal definition is presented in the subsection 3.2. Neighborhood function. The neighborhood of a solution N (φ) in our implementation contains all the arrangements φ´ obtained by changing one or two random selected places of the current arrangement φ. Initial solution. The initial solution is the starting configuration used as input for the algorithm. This SA implementation generates random the initial arrangement.
A SA Algorithm for the Problem of Minimal Addition Chains
315
Termination condition. The SA finishes with any of the following stop conditions: a) when the temperature reaches the value of 1 × 10−4 ; b) when the maximum number of iterations for the SA is attained; or c) if a number of calls to the evaluation function equals an established limit. 3.2
Evaluation Function
A neighbor of the current possible solution is evaluated by two factors. The first factor L is the length of the addition chain α . The second factor α represents the final value of the addition chain. A solution whose α is near the α value has an evaluation determined by the length of the addition chain, on the other hand a solution whose α is far away the α value has an evaluation determined by the absolute difference between α and α multiplied by the addition chain length. Equation 5 describe the evaluation function denoted by Ψ . Ψ = L | α − α | + L 3.3
(5)
Neighborhood Functions
The Neighborhood Functions (NFs) are used to manipulate the Cr chain modifying their positions bounded by the allowable range. In order to generate C , we use two main neighborhood functions named N1 and N2 , which are used to derivate other two functions N3 and N4 . All these functions are explained below: N1 (s) → (s | s = s) ∧ (si = φ(l)) ∧ (si = si ) ∧ (2 ≤ φ(l) ≤ l) ∧ (2 ≤ i ≤ l) N2 (s) → (s | s = s) ∧ (si = φ(l)) ∧ (sj = φ(l)) ∧ (i = j) ∧ (si = si )∧ (sj = sj ) ∧ (2 ≤ φ(l) ≤ l) ∧ (2 ≤ i, j ≤ l)
N1 (s) N2 (s) N3 (s) N4 (s)
3.4
choose a random i position from Cr and modify it value with another value choosed randomly. choose two different random i positions from Cr and modify its value with another values choosed randomly. it is derived from N1 , but here it is picked up the best value for the i position according to the evaluation function. it is derived from N2 , but here it is picked up the best values for the two i positions according to the evaluation function. Distribution Functions
The NFs allow the construction of solutions where an addition chain of length l for an integer α is a sequence S of positive integers, s0 = 1, s1 , s2 , . . . , sl = α s.t. for each i > 1, si = sj + sk for some j and k with 0 ≤ j ≤ k < i. Therefore, the neighborhood function selects in a randomly way a position i s.t. 2 < i ≤ l − 1, the distribution for i is determinated by:
316
A. Jose-Garcia et al.
τ=
l−1 i=2
i=
(l − 1)× | l | −1 2
The Equation 6 calculate a random value for some x with 0 ≤ x ≤ τ , where F1 and F2 are Distribution Functions (DF) and represents the selection for one point i for neighborhood function N1 , N2 , N3 or N4 . ⎧ √ 1+ 1+8(x+1) ⎪ ⎪ ⎨F 1 = 2 √ φ(l) = (6) 1+ 1+8(x+1) ⎪ ⎪ ⎩F 2 = l − 2
Fig. 1. Distribution functions F1 and F2 to select a position si in an addition chain
It is easy to deduce that a change in the cost of the Cr implies a dramatic change in the required α value, and that a change in the right side of the Cr implies a small change in the α value. Then, we can conclude that the change in the left side of the Cr are more exploitatory and the changes in the right side of the Cr are more exploitatory. We can deduce that a change near the leftmost position of the Cr have more impact in the required since of the chain length, then this kind of changes are more exploratory. The changes made on the right part of the chain are more exploitatory given that this kind of changes does not have a significant effect on the required length of the chain. We expect that in the beginning the algorithm behavior must be more exploratory and at the end of the algorithm the behavior will be more exploitatory.
4
Experimental Design
The process of fine-tune the parameters of an algorithm is generally done through an experimental design. Sometimes, the parameters values are taken from the literature without validating its effectiveness. The methodology followed to tune
A SA Algorithm for the Problem of Minimal Addition Chains
317
the values of the parameters for the SA algorithm is based on the study of the effect over the quality of the solution by the interaction between parameters. In our approach, the tuning of the parameters is based on mathematical structures called Covering Arrays (CA). A Covering Array [11] CA(N ; t, k, v) is a matrix of size N × k where every N × t subarray contains all ordered subsets from v symbols of size t at least once. The value t is called the strength of the CA, the value k is the number of columns or parameters and v is called the alphabet. The value t is called the strength of the CA, the value k is the number of columns or parameters and v is called the alphabet. The tuning process was done using a CA of strength t = 2 with seven parameters k = 7 (Table 1b), four of them of alphabet five and two of alphabet three, v = 54 23 . Then, the resulting CA(25; 2, 7, 5423 )1 consists of 25 rows, each row corresponds to a combination of values for the parameters. Together, all the rows contain all the interactions between pair of parameter values, used during the experiment. Table 1a shows the CA values. The first column indicates the number of configuration, the second to fifth are the probability of use certain distribution function, the sixth is the initial temperature, the seventh indicates the cooling rate and the eighth column is the Markov chain. It is well-known that the performance of a SA algorithm is sensitive to parameter tuning. In this sense, we follow a methodology for a fine tuning of the four NFs used in our SA algorithm. The probabilities to use the neighborhood functions was based in the linear Diophantine Equation, p1 + p2 + p3 + p4 = q
(7)
In the previous Equation 7, every time that a new neighborhood should be created, the used neighborhood function will be N1 with probability p1 , N2 with probability p2 , N3 with probability p3 and N4 with probability p4 , where, pi is a value in {0.1, 0.2, . . . , 1.0} that represents the probability of executing Ni , and q is set to 1.0 which is the maximum probability of executing any Ni . Then, the . Diophantine Equation has 286 solutions that correspond to 10+4−1 4−1 4.1
Parallel Implementation
In this subsection we will define the relevant features of the parallel implementation used to run the experimentation of the implemented SA. Problems solved with a SA algorithm are considered a sequential search process, by the nature of the algorithm each new state involved the selection of a next state. Considering that is necessary to run a finite set of tests with different variables and that the communication between test is null, it is possible implement a parallelization experiment, which will distribute the search for solutions among different processors converging in less time and showing a better performance [13]. The Message Passing Interface (MPI) standard is the most important messagepassing specification supporting parallel programming for distributed memory. 1
Available under request in http://www.tamps.cinvestav.mx/~jtj
318
A. Jose-Garcia et al.
Table 1. CA(25; 2, 7, 54 23 ): c (initial temperature), V (cooling rate), L (Markov chain), and P1 , P2 , P3 and P4 indicates the probability of using certain distribution function F1 and F2 in neighborhood functions N1 , N2 , N3 and N4 . (a) CA values for the parameters of the SA contained in CA(25; 2, 7, 54 23 ) Ind P1
P2
P3
P4
c
V
L
(b) Values for each instance of CA Values
0
1
2
3
4
0
c
1
4
10
-
-
2
V
0.85
0.9
0.99
-
-
1
1
1
3
3
0
1
1
2
1
4
4
4
1
0
3
4
3
3
4
2
0
4
4
4
0
1
0
2
1
5
1
2
2
0
1
0
0
6
4
1
2
2
1
2
1
7
2
0
2
4
0
1
0
8
0
3
1
0
0
0
1
9
3
4
3
0
2
2
2
10
2
2
3
1
1
2
1
11
0
1
4
1
2
0
2
12
0
2
0
4
1
1
2
13
1
3
0
2
2
1
1
14
3
2
4
2
0
0
0
15
1
0
1
1
0
2
2
16
2
1
0
0
2
0
0
17
0
4
2
3
2
1
2
18
3
1
1
4
2
2
1
19
4
0
4
0
2
1
1
20
3
0
0
3
1
0
0
21
0
0
3
2
2
2
0
22
3
3
2
1
1
1
0
23
4
2
1
3
2
2
0
24
2
3
4
3
2
2
0
25
2
4
1
2
1
1
2
L P1 P2 P3 P4
log2 v 5 · log2 v 10 · log2 v
-
-
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
A SA Algorithm for the Problem of Minimal Addition Chains
319
Virtually every commercial parallel computer support MPI, and free libraries meeting the MPI standard are available for “homemade” commodity clusters. The underlying hardware is assumed to be a collection of processors, each with its own local memory. A processor has direct access only to the instruction and data stored in its local memory. However, an interconnection network support message-passing between processors. Processor A may send a message containing some of its local data values to processor B, giving processor B indirect access to these values [12]. The model Single Program Multiple Data (SPMD) is a technique employed to achieve parallelism, tasks are split up and run simultaneously on multiple processors with different input in order to obtain results faster [14]. A SPMD using MPI are used in the development of this algorithm maximizing the potential of a parallel program. Our SPMD has three sections to tackle the problem: – Data distribution. This point considers the reading of CAs and Diophantine Equations Solutions. Each processor read their own environment variables independent of the others (no partitioning). – Computing. In this point each processor calculates the number of threads launched to cover the entire tasks after all threads finish the results will come out in a temporary file with all the information computed. – Collection of results. When each one thread finish alert to main subprocess, and when all subprocess finished alert to main processor and that charge the union of all temporary files generating a SQL (Structured Query Language) file. Once generated SQL file, temporary files generated for threads are removed. Partitioning Model. The election of a correct partition scheme has a significant impact on experimentation about the balance between the weight of each task assignment to each processor and to exploit the available resources efficiently [12]. For those reasons, we decide to use a Static/Cyclic 3D block partition model as show in Figure 2, were the sides of our cube are defined by: CA 1b rows, Diophantine Equation 7 solutions and the required number of iterations. The Scheme Static/Cyclic 3D block is defined by: – Static Variables, CA and Diophantine Equation solutions are static while Algorithm life cycle. – Cyclic. All the task are divided by the total of processors. – Block. The balance of work need be divided the rows by blocks. The SPMD used for the collection stage is master-slave. Within the stages of this model the data loading was suppressed, since each process has the necessary information and calculates its range of blocks to make its computing operations. The stages of this model that are not deleted are independent computing stage and data collection for the master process.
320
A. Jose-Garcia et al.
Fig. 2. Diagram for the parallelization of our SA implementation
4.2
Running Time Analysis: Sequential Program vs Parallel Program
The performance analysis for SA program with running time of O(n) is divided as following: L is the total number of experiments, p indicates the numbers of processors, ts is the latency of the communication channel used, tw is the bandwidth of the communication channel, T p indicates the parallel time, T s indicates the sequential time and S represented the speedup (time savings over the sequential algorithm). The total running time for data loading is determinate by the number of experiments L, while that the computation time is determined by Equation 8. Finally, the total running time for collection results is estimate by Equation 9. The parallel time is obtained from Equation 10. T p2 =
L·n p
(8)
A SA Algorithm for the Problem of Minimal Addition Chains
T p3 = (p − 1)(ts + tw) Tp ≈
L·n +L p
321
(9) (10)
The sequential SA algorithm has a running time of Os (L · n) while running time for parallel algorithm is Os ( L·n p + L). We can see that the analysis of the sequential and parallel SA program is a difference in performance and efficiency. The efficiency of a parallel program is a measure of processor utilization. The analysis of efficiency of parallel SA program is given by the Equation 11. E=
L·n L·n = L·n+L·p + L)
p( L·n p
(11)
Finally, the analysis of SA algorithm can be summarized in Equation 12, where the speed-up is the ratio between sequential running time and parallel running time. S=
5
L·n L·n·p = L·n+L·p +L
L·n p
(12)
Experimental Results
The experiments were run on a cluster with 10 nodes (8 cores per node), where each node has 2 Intel quad core 5550 to 2.67 GHz, 16 GB of RAM and a communication channel infiniband. The SA algorithm and the experimental method were implemented using C language and compiled with mpiicc intel compiler version 11. 5.1
Fine-Tuning the Experiment
The algorithm was tuned using a CA of size 25×7 and the 286 solutions obtained from Diophantine Equation 7. Each combination was executed 31 times (for provide statistical validity to experiment) for α = 14143037 and α = 379, this values is difficult to obtain the minimal addition chain as stated in [5]. The total number of experiments is determinate by Equation 13. T =C×D×B
(13)
where C represents the size of CA, D represents the number of Diophantine Equation Solution and B is the number of times that the experiment was execute. Since C = 25, D = 286, B = 31, then the total number of experiments is 25 × 286 × 31. According to the results of this experiment, the neighborhood functions N2 and N4 that modify two elements at the same time, produce better results than N1 and N3 , while the neighborhood functions considered exploratory N1 and N2 generate
322
A. Jose-Garcia et al.
best results when this modify the end of addition chains, and the exploitatory functions N3 and N4 generate better results when this modify the begin of addition chains. Therefore, the final CA row must be 3 3 1 1 2 0 2 and the solution for Diophantine Equation is 0 9 1 0 , this configuration get the best results. 5.2
Benchmark Description
We calculate the minimal addition chain for α ∈ [1, 1000] using the setup described in the fine-tuning experiment, the results obtained are presented in Table 2. Table 2. Measure for all α ∈ [1, 1000] computed Measure
Results
Optimal value
10808
Best case
10823
Median
10834
Average
10829.53
Standard deviation
3.11
The results obtained with the proposed approach are better compared with other approaches reported [5,9]. A spacial class of exponents difficult to optimize are presented by Edward Thurber and a compilation of them can be found in [15]. These values considered as difficult to obtain were processed, Table 3b presents the results obtained from the experiment described, show the α value, the minimal length (optimal), and the number of times that it was found.
Fig. 3. Comparison of minimum, maximum and optimal values for different α values
A SA Algorithm for the Problem of Minimal Addition Chains
323
Table 3. Best results obtained from computational experiment (a) Addition chains considered difficult to compute, the minimal length, and the number of hits from 32 experiments Id
α
Minimal length
Hits
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
7 11 19 29 47 71 127 191 379 607 1087 1903 3583 6271 11231 18287 34303 65131 110591 196591 357887 685951 1176431 2211837 4169527 7624319 14143037
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 26 26 27 28 30 30
32 32 32 32 32 32 30 30 30 28 13 6 1 1 1 2 1 2 2 2 1 1 1 2 1 1 2
(b) Minimal addition chains obtained using our proposed approach α
Minimal addition chain
Minimal length
2211837
1 - 2 - 3 - 5 - 7 - 14 - 21 - 42 - 63 - 64 - 127 - 254 - 508 1016 - 2032 - 4064 - 8128 - 8636 - 17272 - 34544 - 69088 - 138176 - 276352 - 552704 - 552958 - 1105916 - 1105921 - 2211837 1 - 2 - 4 - 8 - 12 - 13 - 21 - 42 - 84 - 168 - 336 - 672 1344 - 1357 - 2714 - 5428 - 10856 - 21712 - 21724 43436 - 65148 - 130296 - 260592 - 521184 - 1042368 2084736 - 2084757 - 2084770 - 4169527 1- 2 - 3 - 5 - 10 - 20 - 30 - 31 - 61 - 92 - 184 - 368 - 736 1472 - 2944 - 5888 - 8832 - 9568 - 18400 - 36800 - 73600 - 147200 - 220800 - 441600 - 883200 - 1766400 - 3532800 - 7065600 - 7071488 - 14142976 - 14143037
27
4169527
14143037
28
30
324
A. Jose-Garcia et al.
Figure 3 represent the α values computed, the maximum and minimum values of our experiment compared to the optimal value presented in Table 3a.
6
Conclusions
The quality of our experimental results using a Simulated Annealing (SA) algorithm demonstrates the strength of the proposed approach, which is based on: a) a novel representation based on Factorial Number System; b) the use of Diophantine Equation solutions for fine-tuning the probabilities functions F1 and F2 in Neighborhood Functions; c) the use of a Covering Array to finetune the parameters of SA; and d) the use of a parallel implementation based on the Message Passing Interface (MPI) using Single Program Multiple Data model. The results obtained evidence the suitability of our approach to compute minimal addition chains for cases considered difficult. Based on the proposed parallelization implementation, we suggest to follow a parallel mechanism to reduce the time needed in the tuning process of algorithms, using CAs and Diophantine Equations. Acknowledgments. This research was partially funded by the following projects: CONACyT 58554-Cï¿œlculo de Covering Arrays, 51623- Fondo Mixto CONACyT y Gobierno del Estado de Tamaulipas.
References 1. 2.
3. 4. 5.
6.
7.
8.
Michalewicz, Z.: Genetic Algorithms + Data Structures = Evolution Program, 3rd edn. Springer, Heidelberg (1996) Nedjah, N., de Macedo Mourelle, L.: Minimal Addition Chain for Efficient Modular Exponentiation Using Genetic Algorithms. In: Hendtlass, T., Ali, M. (eds.) IEA/AIE 2002. LNCS (LNAI), vol. 2358, pp. 88–98. Springer, Heidelberg (2002) Gordon, D.M.: A Survey of Fast Exponentiation Methods. Journal of Algorithms, 129–146 (1998) Downey, P., Leong, B., Sethi, R.: Computing Sequences with Addition Chains”. SIAM Journal on Computing, 638–646 (1981) Cruz-Cortés, N., Rodríguez-Henríquez, F., Juárez-Morales, R., Coello Coello, C.A.: Finding Optimal Addition Chains Using a Genetic Algorithm Approach. In: Hao, Y., Liu, J., Wang, Y.-P., Cheung, Y.-m., Yin, H., Jiao, L., Ma, J., Jiao, Y.-C. (eds.) CIS 2005. LNCS (LNAI), vol. 3801, pp. 208–215. Springer, Heidelberg (2005) de Castro, L.N., Timmis, J.: An Introduction to Artificial, Immune Systems: A New Computational Intelligence Paradigm. Springer, Heidelberg (2002) ISBN: 9781-85233-594-6 Nedjah, N., Mourelle, L.M.: Efficient Pre-processing for Large Window-Based Modular Exponentiation Using Genetic Algorithms. In: Chung, P.W.H., Hinde, C.J., Ali, M. (eds.) IEA/AIE 2003. LNCS, vol. 2718, pp. 165–194. Springer, Heidelberg (2003) Bos, J.N.E., Coster, M.J.: Addition Chain Heuristics. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 400–407. Springer, Heidelberg (1990)
A SA Algorithm for the Problem of Minimal Addition Chains 9.
10. 11.
12. 13.
14.
15. 16.
325
Bleichenbacher, D., Flammenkamp, A.: An efficient Algorithm for Computing Shortest Additions Chains, Bell Labs (1997), http://www.homes.uni-bielefeld.de/achim/ac.ps.gz Bergeron, F., Berstel, J., Brlek, S.: Efficient Computation of Addition Chains. Journal de Théorie des Nombres de Bordeaux tome 6, 21–38 (1994) Lopez-Escogido, D., Torres-Jimenez, J., Rodriguez-Tello, E., Rangel-Valdez, N.: Strength Two Covering Arrays Construction Using a SAT Representation. In: Gelbukh, A., Morales, E.F. (eds.) MICAI 2008. LNCS (LNAI), vol. 5317, pp. 44–53. Springer, Heidelberg (2008) Quinn Reference, M.J.: Parallel Programming in C with MPI and OpenMP. Mc Graw Hill Higher Education (2004) ISBN 0-07-282256-2 Grabysz, A.D., Rabenseifner, R.: Nesting OpenMP in MPI to Implement a Hybrid Communication Method of Parallel Simulated Annealing on a Cluster of SMP Nodes. In: Nagel, W.E., Walter, W.V., Lehner, W. (eds.) Euro-Par 2006. LNCS, vol. 4128, pp. 1075–1084. Springer, Heidelberg (2006) Strout, M.M., Kreaseck, B., Hovland, P.D.: Data-Flow Analysis for MPI Programs. In: IEEE Computer Society, International Conference on Parallel Processing, pp. 175–184. IEEE Compurer Society (2006) ISBN 0-7695-2636-5 Thurber, E.W.: Shortest Addition Chains, http://wwwhomes.uni-bielefeld.de/achim/addition_chain.html Laisan, C.A.: Sur la Numeration Factorielle, Application Aux Permutations. Bulletin de la Societe Mathematique de France, 176–183 (1888)
Abstract. Cryptosystems require the computation of modular exponentiation, this operation is related to the problem of finding a minimal addition chain. However, obtaining the shortest addition chain of length n is an NP-Complete problem whose search space size is proportional to n!. This paper introduces a novel idea to compute the minimal addition chain problem, through an implementation of a Simulated Annealing (SA) algorithm. The representation used in our SA is based on Factorial Number System (FNS). We use a fine-tuning process to get the best performance of SA using a Covering Array (CA), Diophantine Equation solutions (DE) and Neighborhood Functions (NF). We present a parallel implementation to execute the fine-tuning process using a Message Passing Interface (MPI) and the Single Program Multiple Data (SPMD) model. These features, allowed us to calculate minimal addition chains for benchmarks considered difficult in very short time, the experimental results show that this approach is a viable alternative to solve the solution of the minimal addition chain problem.
1
Introduction
The modular exponentiation (repetition of modular multiplications) is one of the most important operations for data scrambling and it is used by several public-key cryptosystems such as RSA encryption scheme [1]. Moreover, since cryptographic applications often use very large fields or rings, the cost of one multiplication is rather high and reducing the number of multiplications needed in exponentiation can significantly improve the speed of a cryptosystem. Therefore, the performance of a cryptosystem is determined by the efficiency of the implementation of modular multiplications [9]. The problem of determining the optimal sequence of multiplications required for performing a modular exponentiation can be formulated using the concept of addition chains. An addition chain for a positive integer α is a sequence of positive integers C = (α0 , α1 , . . . , αr ) s.t [10]: L. Antunes and H.S. Pinto (Eds.): EPIA 2011, LNAI 7026, pp. 311–325, 2011. © Springer-Verlag Berlin Heidelberg 2011
312
A. Jose-Garcia et al.
αi =
1 αj + αk
if i = 0 and αr = α if i > 0 for some j, k < i
The integer r is the length of the chain C and is denoted by | C |. The chain length l(α) of α is the minimal length of all possible chains for α. Addition chains for α generate multiplications for the computation xα . For instance, the chain (1, 2, 4, 5, 9, 18, 23) leads to the following scheme for the computation of x23 , xx = x2 , x2 x2 = x4 , xx4 = x5 , x4 x5 = x9 , x9 x9 = x18 , x5 x18 = x23 The addition chain-based methods use a sequence of positive integers s.t. the first number of the chain is 1 and the last is the exponent α, and in which each member is the sum of two previous members of the chain. Clearly this establishes a correspondence between addition chains and such schemes. Therefore, the length of an addition chain α is equal to the corresponding number of multiplications required for the computation of xα . Thus, the smallest of such multiplications is given by the chain length l(α) of α. Addition chains have been studied extensively, Downey et al. have shown that the problem of determining an addition chain for α with the shortest length l(α) belongs to the family of NP-complete [4] problems. Therefore, it is recommended to use some kind of heuristic strategy in order to find an optimal addition chain when dealing with large exponents α. In this paper, we present a Simulated Annealing (SA) to solve the problem of minimal addition chains. We subdivide the remaining of the paper into six sections. Section 2 describes the relevant related work to our research. Section 3 contains the description and the implementation details of our SA. Section 4 presents the experimental design using Covering Array and Diophantine Equation solutions, and describes a parallel approach to execute the SA. Section 5 reports the tuning parameters, the benchmark used to measure the performance of the SA, and the experimental results obtained. Finally, in Section 6 some conclusions are drawn.
2
Relevant Related Work
Let x be an arbitrary integer in the range [1, n − 1], and α an arbitrary positive integer. Then, finding the modular exponentiation is defined as the problem of finding a unique integer β ∈ [1, n − 1] that satisfies β = xα mod n A naive method to compute β requires α − 1 modular multiplications. The sequence of powers is described as: x → x2 → x3 → . . . → xα−1 → xα
A SA Algorithm for the Problem of Minimal Addition Chains
313
For instance, to compute x8 , this method performs seven multiplications: x → x2 → x3 → x4 → x5 → x6 → x7 → x8 . However, x8 can be computed using only three multiplications x → x2 → x4 → x8 . The correct sequence of multiplications required for performing a modular exponentiation can be formulated using the concept of addition chains. One possible way to compute xα for α ∈ N is by the binary method [3]. The Equation 1 presents a recursive description of this method. ⎧ ⎪ if α = 1 ⎨x α α xα = x 2 · x 2 if α is even ⎪ ⎩ α−1 x · x otherwise
(1)
This method is faster than the naive method that computes α−1 multiplications. For example, 7 multiplication are necessary to compute x23 , the powers x2 , x4 , x5 , x10 , x11 , x22 and x23 are computed from previous ones using one multiplication. However, the shortest way to compute x23 requires only 6 multiplications for α = 23, the powers involved are: x2 , x4 , x5 , x9 , x18 and x23 . For some α ∈ N, let B(α) the addition chain corresponding to the binary method, it is defined in Equation 2, i.e. B(α) is the list of integers si where xsi is an intermediary result while computing xα . Therefore, we can describe B(α) as follows: ⎧ ⎪ if α = 1 ⎨1 B(α) = B( α2 ), α if α is even ⎪ ⎩ B(α − 1), α otherwise
(2)
According to the binary method the length of B(α) is log2 (α) + 1 plus the number of bits equal to 1 in the binary representation of α. If we denote this value by ν(α), we get the immediate consequence: l(α) ≤ log2 (α) + v(α) − 1 ≤ 2log2 (α) There are a large number of reported algorithms for finding optimal addition chains. Reported strategies include: binary method, m-ary method, window-based method [3,4]. Those algorithms have in common that they strive to keep the number of required field multiplications as low as possible through the usage of a particular heuristic. Different heuristics for finding short, but not necessarily minimal, addition chains for α large have been proposed [4,5,7]. In the reviewed bibliography we do not find reported a SA approach for computing minimal addition chains. Simulated Annealing algorithms have been successfully applied to solve a broad variety of optimization problems [11,13]. In this paper, we present a SA applied to optimize addition chains. The results obtained using this algorithm suggest that this approach is a competitive alternative to solve the problem of minimal addition chain.
314
3
A. Jose-Garcia et al.
Proposed Approach
In the proposed approach, the search space of the minimal addition chain problem has a lower bound and upper bound, where the lower bound value in the binary representation for an addition chain α is denoted by ϕ, ϕ = log2 (α) while the upper bound is denoted by ψ, ψ = 2log2 (α) The initialization for an addition chain α assures that it has an initial length equal to ϕ + 1, then the minimal length for α is, ϕ≤α 0 Cr(i) = (3) indef inite if i = 0 and
C (i) =
C(i − 1) + C(Cr(i)) 1
if i > 0 if i = 0
(4)
where C (i) is the addition chain generated with our approach. 3.1
The Proposed Simulated Annealing Algorithm
To evaluate the practical usefulness of the evaluation function Ψ , a SA was developed. Next some details of the implementation proposed are presented: Evaluation function. In this implementation we have included the evaluation function Ψ whose formal definition is presented in the subsection 3.2. Neighborhood function. The neighborhood of a solution N (φ) in our implementation contains all the arrangements φ´ obtained by changing one or two random selected places of the current arrangement φ. Initial solution. The initial solution is the starting configuration used as input for the algorithm. This SA implementation generates random the initial arrangement.
A SA Algorithm for the Problem of Minimal Addition Chains
315
Termination condition. The SA finishes with any of the following stop conditions: a) when the temperature reaches the value of 1 × 10−4 ; b) when the maximum number of iterations for the SA is attained; or c) if a number of calls to the evaluation function equals an established limit. 3.2
Evaluation Function
A neighbor of the current possible solution is evaluated by two factors. The first factor L is the length of the addition chain α . The second factor α represents the final value of the addition chain. A solution whose α is near the α value has an evaluation determined by the length of the addition chain, on the other hand a solution whose α is far away the α value has an evaluation determined by the absolute difference between α and α multiplied by the addition chain length. Equation 5 describe the evaluation function denoted by Ψ . Ψ = L | α − α | + L 3.3
(5)
Neighborhood Functions
The Neighborhood Functions (NFs) are used to manipulate the Cr chain modifying their positions bounded by the allowable range. In order to generate C , we use two main neighborhood functions named N1 and N2 , which are used to derivate other two functions N3 and N4 . All these functions are explained below: N1 (s) → (s | s = s) ∧ (si = φ(l)) ∧ (si = si ) ∧ (2 ≤ φ(l) ≤ l) ∧ (2 ≤ i ≤ l) N2 (s) → (s | s = s) ∧ (si = φ(l)) ∧ (sj = φ(l)) ∧ (i = j) ∧ (si = si )∧ (sj = sj ) ∧ (2 ≤ φ(l) ≤ l) ∧ (2 ≤ i, j ≤ l)
N1 (s) N2 (s) N3 (s) N4 (s)
3.4
choose a random i position from Cr and modify it value with another value choosed randomly. choose two different random i positions from Cr and modify its value with another values choosed randomly. it is derived from N1 , but here it is picked up the best value for the i position according to the evaluation function. it is derived from N2 , but here it is picked up the best values for the two i positions according to the evaluation function. Distribution Functions
The NFs allow the construction of solutions where an addition chain of length l for an integer α is a sequence S of positive integers, s0 = 1, s1 , s2 , . . . , sl = α s.t. for each i > 1, si = sj + sk for some j and k with 0 ≤ j ≤ k < i. Therefore, the neighborhood function selects in a randomly way a position i s.t. 2 < i ≤ l − 1, the distribution for i is determinated by:
316
A. Jose-Garcia et al.
τ=
l−1 i=2
i=
(l − 1)× | l | −1 2
The Equation 6 calculate a random value for some x with 0 ≤ x ≤ τ , where F1 and F2 are Distribution Functions (DF) and represents the selection for one point i for neighborhood function N1 , N2 , N3 or N4 . ⎧ √ 1+ 1+8(x+1) ⎪ ⎪ ⎨F 1 = 2 √ φ(l) = (6) 1+ 1+8(x+1) ⎪ ⎪ ⎩F 2 = l − 2
Fig. 1. Distribution functions F1 and F2 to select a position si in an addition chain
It is easy to deduce that a change in the cost of the Cr implies a dramatic change in the required α value, and that a change in the right side of the Cr implies a small change in the α value. Then, we can conclude that the change in the left side of the Cr are more exploitatory and the changes in the right side of the Cr are more exploitatory. We can deduce that a change near the leftmost position of the Cr have more impact in the required since of the chain length, then this kind of changes are more exploratory. The changes made on the right part of the chain are more exploitatory given that this kind of changes does not have a significant effect on the required length of the chain. We expect that in the beginning the algorithm behavior must be more exploratory and at the end of the algorithm the behavior will be more exploitatory.
4
Experimental Design
The process of fine-tune the parameters of an algorithm is generally done through an experimental design. Sometimes, the parameters values are taken from the literature without validating its effectiveness. The methodology followed to tune
A SA Algorithm for the Problem of Minimal Addition Chains
317
the values of the parameters for the SA algorithm is based on the study of the effect over the quality of the solution by the interaction between parameters. In our approach, the tuning of the parameters is based on mathematical structures called Covering Arrays (CA). A Covering Array [11] CA(N ; t, k, v) is a matrix of size N × k where every N × t subarray contains all ordered subsets from v symbols of size t at least once. The value t is called the strength of the CA, the value k is the number of columns or parameters and v is called the alphabet. The value t is called the strength of the CA, the value k is the number of columns or parameters and v is called the alphabet. The tuning process was done using a CA of strength t = 2 with seven parameters k = 7 (Table 1b), four of them of alphabet five and two of alphabet three, v = 54 23 . Then, the resulting CA(25; 2, 7, 5423 )1 consists of 25 rows, each row corresponds to a combination of values for the parameters. Together, all the rows contain all the interactions between pair of parameter values, used during the experiment. Table 1a shows the CA values. The first column indicates the number of configuration, the second to fifth are the probability of use certain distribution function, the sixth is the initial temperature, the seventh indicates the cooling rate and the eighth column is the Markov chain. It is well-known that the performance of a SA algorithm is sensitive to parameter tuning. In this sense, we follow a methodology for a fine tuning of the four NFs used in our SA algorithm. The probabilities to use the neighborhood functions was based in the linear Diophantine Equation, p1 + p2 + p3 + p4 = q
(7)
In the previous Equation 7, every time that a new neighborhood should be created, the used neighborhood function will be N1 with probability p1 , N2 with probability p2 , N3 with probability p3 and N4 with probability p4 , where, pi is a value in {0.1, 0.2, . . . , 1.0} that represents the probability of executing Ni , and q is set to 1.0 which is the maximum probability of executing any Ni . Then, the . Diophantine Equation has 286 solutions that correspond to 10+4−1 4−1 4.1
Parallel Implementation
In this subsection we will define the relevant features of the parallel implementation used to run the experimentation of the implemented SA. Problems solved with a SA algorithm are considered a sequential search process, by the nature of the algorithm each new state involved the selection of a next state. Considering that is necessary to run a finite set of tests with different variables and that the communication between test is null, it is possible implement a parallelization experiment, which will distribute the search for solutions among different processors converging in less time and showing a better performance [13]. The Message Passing Interface (MPI) standard is the most important messagepassing specification supporting parallel programming for distributed memory. 1
Available under request in http://www.tamps.cinvestav.mx/~jtj
318
A. Jose-Garcia et al.
Table 1. CA(25; 2, 7, 54 23 ): c (initial temperature), V (cooling rate), L (Markov chain), and P1 , P2 , P3 and P4 indicates the probability of using certain distribution function F1 and F2 in neighborhood functions N1 , N2 , N3 and N4 . (a) CA values for the parameters of the SA contained in CA(25; 2, 7, 54 23 ) Ind P1
P2
P3
P4
c
V
L
(b) Values for each instance of CA Values
0
1
2
3
4
0
c
1
4
10
-
-
2
V
0.85
0.9
0.99
-
-
1
1
1
3
3
0
1
1
2
1
4
4
4
1
0
3
4
3
3
4
2
0
4
4
4
0
1
0
2
1
5
1
2
2
0
1
0
0
6
4
1
2
2
1
2
1
7
2
0
2
4
0
1
0
8
0
3
1
0
0
0
1
9
3
4
3
0
2
2
2
10
2
2
3
1
1
2
1
11
0
1
4
1
2
0
2
12
0
2
0
4
1
1
2
13
1
3
0
2
2
1
1
14
3
2
4
2
0
0
0
15
1
0
1
1
0
2
2
16
2
1
0
0
2
0
0
17
0
4
2
3
2
1
2
18
3
1
1
4
2
2
1
19
4
0
4
0
2
1
1
20
3
0
0
3
1
0
0
21
0
0
3
2
2
2
0
22
3
3
2
1
1
1
0
23
4
2
1
3
2
2
0
24
2
3
4
3
2
2
0
25
2
4
1
2
1
1
2
L P1 P2 P3 P4
log2 v 5 · log2 v 10 · log2 v
-
-
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
0, 1
1 3 4, 4
2 2 4, 4
1 3 4, 4
1, 0
A SA Algorithm for the Problem of Minimal Addition Chains
319
Virtually every commercial parallel computer support MPI, and free libraries meeting the MPI standard are available for “homemade” commodity clusters. The underlying hardware is assumed to be a collection of processors, each with its own local memory. A processor has direct access only to the instruction and data stored in its local memory. However, an interconnection network support message-passing between processors. Processor A may send a message containing some of its local data values to processor B, giving processor B indirect access to these values [12]. The model Single Program Multiple Data (SPMD) is a technique employed to achieve parallelism, tasks are split up and run simultaneously on multiple processors with different input in order to obtain results faster [14]. A SPMD using MPI are used in the development of this algorithm maximizing the potential of a parallel program. Our SPMD has three sections to tackle the problem: – Data distribution. This point considers the reading of CAs and Diophantine Equations Solutions. Each processor read their own environment variables independent of the others (no partitioning). – Computing. In this point each processor calculates the number of threads launched to cover the entire tasks after all threads finish the results will come out in a temporary file with all the information computed. – Collection of results. When each one thread finish alert to main subprocess, and when all subprocess finished alert to main processor and that charge the union of all temporary files generating a SQL (Structured Query Language) file. Once generated SQL file, temporary files generated for threads are removed. Partitioning Model. The election of a correct partition scheme has a significant impact on experimentation about the balance between the weight of each task assignment to each processor and to exploit the available resources efficiently [12]. For those reasons, we decide to use a Static/Cyclic 3D block partition model as show in Figure 2, were the sides of our cube are defined by: CA 1b rows, Diophantine Equation 7 solutions and the required number of iterations. The Scheme Static/Cyclic 3D block is defined by: – Static Variables, CA and Diophantine Equation solutions are static while Algorithm life cycle. – Cyclic. All the task are divided by the total of processors. – Block. The balance of work need be divided the rows by blocks. The SPMD used for the collection stage is master-slave. Within the stages of this model the data loading was suppressed, since each process has the necessary information and calculates its range of blocks to make its computing operations. The stages of this model that are not deleted are independent computing stage and data collection for the master process.
320
A. Jose-Garcia et al.
Fig. 2. Diagram for the parallelization of our SA implementation
4.2
Running Time Analysis: Sequential Program vs Parallel Program
The performance analysis for SA program with running time of O(n) is divided as following: L is the total number of experiments, p indicates the numbers of processors, ts is the latency of the communication channel used, tw is the bandwidth of the communication channel, T p indicates the parallel time, T s indicates the sequential time and S represented the speedup (time savings over the sequential algorithm). The total running time for data loading is determinate by the number of experiments L, while that the computation time is determined by Equation 8. Finally, the total running time for collection results is estimate by Equation 9. The parallel time is obtained from Equation 10. T p2 =
L·n p
(8)
A SA Algorithm for the Problem of Minimal Addition Chains
T p3 = (p − 1)(ts + tw) Tp ≈
L·n +L p
321
(9) (10)
The sequential SA algorithm has a running time of Os (L · n) while running time for parallel algorithm is Os ( L·n p + L). We can see that the analysis of the sequential and parallel SA program is a difference in performance and efficiency. The efficiency of a parallel program is a measure of processor utilization. The analysis of efficiency of parallel SA program is given by the Equation 11. E=
L·n L·n = L·n+L·p + L)
p( L·n p
(11)
Finally, the analysis of SA algorithm can be summarized in Equation 12, where the speed-up is the ratio between sequential running time and parallel running time. S=
5
L·n L·n·p = L·n+L·p +L
L·n p
(12)
Experimental Results
The experiments were run on a cluster with 10 nodes (8 cores per node), where each node has 2 Intel quad core 5550 to 2.67 GHz, 16 GB of RAM and a communication channel infiniband. The SA algorithm and the experimental method were implemented using C language and compiled with mpiicc intel compiler version 11. 5.1
Fine-Tuning the Experiment
The algorithm was tuned using a CA of size 25×7 and the 286 solutions obtained from Diophantine Equation 7. Each combination was executed 31 times (for provide statistical validity to experiment) for α = 14143037 and α = 379, this values is difficult to obtain the minimal addition chain as stated in [5]. The total number of experiments is determinate by Equation 13. T =C×D×B
(13)
where C represents the size of CA, D represents the number of Diophantine Equation Solution and B is the number of times that the experiment was execute. Since C = 25, D = 286, B = 31, then the total number of experiments is 25 × 286 × 31. According to the results of this experiment, the neighborhood functions N2 and N4 that modify two elements at the same time, produce better results than N1 and N3 , while the neighborhood functions considered exploratory N1 and N2 generate
322
A. Jose-Garcia et al.
best results when this modify the end of addition chains, and the exploitatory functions N3 and N4 generate better results when this modify the begin of addition chains. Therefore, the final CA row must be 3 3 1 1 2 0 2 and the solution for Diophantine Equation is 0 9 1 0 , this configuration get the best results. 5.2
Benchmark Description
We calculate the minimal addition chain for α ∈ [1, 1000] using the setup described in the fine-tuning experiment, the results obtained are presented in Table 2. Table 2. Measure for all α ∈ [1, 1000] computed Measure
Results
Optimal value
10808
Best case
10823
Median
10834
Average
10829.53
Standard deviation
3.11
The results obtained with the proposed approach are better compared with other approaches reported [5,9]. A spacial class of exponents difficult to optimize are presented by Edward Thurber and a compilation of them can be found in [15]. These values considered as difficult to obtain were processed, Table 3b presents the results obtained from the experiment described, show the α value, the minimal length (optimal), and the number of times that it was found.
Fig. 3. Comparison of minimum, maximum and optimal values for different α values
A SA Algorithm for the Problem of Minimal Addition Chains
323
Table 3. Best results obtained from computational experiment (a) Addition chains considered difficult to compute, the minimal length, and the number of hits from 32 experiments Id
α
Minimal length
Hits
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
7 11 19 29 47 71 127 191 379 607 1087 1903 3583 6271 11231 18287 34303 65131 110591 196591 357887 685951 1176431 2211837 4169527 7624319 14143037
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 26 26 27 28 30 30
32 32 32 32 32 32 30 30 30 28 13 6 1 1 1 2 1 2 2 2 1 1 1 2 1 1 2
(b) Minimal addition chains obtained using our proposed approach α
Minimal addition chain
Minimal length
2211837
1 - 2 - 3 - 5 - 7 - 14 - 21 - 42 - 63 - 64 - 127 - 254 - 508 1016 - 2032 - 4064 - 8128 - 8636 - 17272 - 34544 - 69088 - 138176 - 276352 - 552704 - 552958 - 1105916 - 1105921 - 2211837 1 - 2 - 4 - 8 - 12 - 13 - 21 - 42 - 84 - 168 - 336 - 672 1344 - 1357 - 2714 - 5428 - 10856 - 21712 - 21724 43436 - 65148 - 130296 - 260592 - 521184 - 1042368 2084736 - 2084757 - 2084770 - 4169527 1- 2 - 3 - 5 - 10 - 20 - 30 - 31 - 61 - 92 - 184 - 368 - 736 1472 - 2944 - 5888 - 8832 - 9568 - 18400 - 36800 - 73600 - 147200 - 220800 - 441600 - 883200 - 1766400 - 3532800 - 7065600 - 7071488 - 14142976 - 14143037
27
4169527
14143037
28
30
324
A. Jose-Garcia et al.
Figure 3 represent the α values computed, the maximum and minimum values of our experiment compared to the optimal value presented in Table 3a.
6
Conclusions
The quality of our experimental results using a Simulated Annealing (SA) algorithm demonstrates the strength of the proposed approach, which is based on: a) a novel representation based on Factorial Number System; b) the use of Diophantine Equation solutions for fine-tuning the probabilities functions F1 and F2 in Neighborhood Functions; c) the use of a Covering Array to finetune the parameters of SA; and d) the use of a parallel implementation based on the Message Passing Interface (MPI) using Single Program Multiple Data model. The results obtained evidence the suitability of our approach to compute minimal addition chains for cases considered difficult. Based on the proposed parallelization implementation, we suggest to follow a parallel mechanism to reduce the time needed in the tuning process of algorithms, using CAs and Diophantine Equations. Acknowledgments. This research was partially funded by the following projects: CONACyT 58554-Cï¿œlculo de Covering Arrays, 51623- Fondo Mixto CONACyT y Gobierno del Estado de Tamaulipas.
References 1. 2.
3. 4. 5.
6.
7.
8.
Michalewicz, Z.: Genetic Algorithms + Data Structures = Evolution Program, 3rd edn. Springer, Heidelberg (1996) Nedjah, N., de Macedo Mourelle, L.: Minimal Addition Chain for Efficient Modular Exponentiation Using Genetic Algorithms. In: Hendtlass, T., Ali, M. (eds.) IEA/AIE 2002. LNCS (LNAI), vol. 2358, pp. 88–98. Springer, Heidelberg (2002) Gordon, D.M.: A Survey of Fast Exponentiation Methods. Journal of Algorithms, 129–146 (1998) Downey, P., Leong, B., Sethi, R.: Computing Sequences with Addition Chains”. SIAM Journal on Computing, 638–646 (1981) Cruz-Cortés, N., Rodríguez-Henríquez, F., Juárez-Morales, R., Coello Coello, C.A.: Finding Optimal Addition Chains Using a Genetic Algorithm Approach. In: Hao, Y., Liu, J., Wang, Y.-P., Cheung, Y.-m., Yin, H., Jiao, L., Ma, J., Jiao, Y.-C. (eds.) CIS 2005. LNCS (LNAI), vol. 3801, pp. 208–215. Springer, Heidelberg (2005) de Castro, L.N., Timmis, J.: An Introduction to Artificial, Immune Systems: A New Computational Intelligence Paradigm. Springer, Heidelberg (2002) ISBN: 9781-85233-594-6 Nedjah, N., Mourelle, L.M.: Efficient Pre-processing for Large Window-Based Modular Exponentiation Using Genetic Algorithms. In: Chung, P.W.H., Hinde, C.J., Ali, M. (eds.) IEA/AIE 2003. LNCS, vol. 2718, pp. 165–194. Springer, Heidelberg (2003) Bos, J.N.E., Coster, M.J.: Addition Chain Heuristics. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 400–407. Springer, Heidelberg (1990)
A SA Algorithm for the Problem of Minimal Addition Chains 9.
10. 11.
12. 13.
14.
15. 16.
325
Bleichenbacher, D., Flammenkamp, A.: An efficient Algorithm for Computing Shortest Additions Chains, Bell Labs (1997), http://www.homes.uni-bielefeld.de/achim/ac.ps.gz Bergeron, F., Berstel, J., Brlek, S.: Efficient Computation of Addition Chains. Journal de Théorie des Nombres de Bordeaux tome 6, 21–38 (1994) Lopez-Escogido, D., Torres-Jimenez, J., Rodriguez-Tello, E., Rangel-Valdez, N.: Strength Two Covering Arrays Construction Using a SAT Representation. In: Gelbukh, A., Morales, E.F. (eds.) MICAI 2008. LNCS (LNAI), vol. 5317, pp. 44–53. Springer, Heidelberg (2008) Quinn Reference, M.J.: Parallel Programming in C with MPI and OpenMP. Mc Graw Hill Higher Education (2004) ISBN 0-07-282256-2 Grabysz, A.D., Rabenseifner, R.: Nesting OpenMP in MPI to Implement a Hybrid Communication Method of Parallel Simulated Annealing on a Cluster of SMP Nodes. In: Nagel, W.E., Walter, W.V., Lehner, W. (eds.) Euro-Par 2006. LNCS, vol. 4128, pp. 1075–1084. Springer, Heidelberg (2006) Strout, M.M., Kreaseck, B., Hovland, P.D.: Data-Flow Analysis for MPI Programs. In: IEEE Computer Society, International Conference on Parallel Processing, pp. 175–184. IEEE Compurer Society (2006) ISBN 0-7695-2636-5 Thurber, E.W.: Shortest Addition Chains, http://wwwhomes.uni-bielefeld.de/achim/addition_chain.html Laisan, C.A.: Sur la Numeration Factorielle, Application Aux Permutations. Bulletin de la Societe Mathematique de France, 176–183 (1888)
