Addition-chain exponentiation


In mathematics and computer science, optimal addition-chain exponentiation is a method of exponentiation by positive integer powers that requires a minimal number of multiplications. This corresponds to the sequence on the Online Encyclopedia of Integer Sequences. It works by creating the shortest addition chain that generates the desired exponent. Each exponentiation in the chain can be evaluated by multiplying two of the earlier exponentiation results. More generally, addition-chain exponentiation may also refer to exponentiation by non-minimal addition chains constructed by a variety of algorithms.
The shortest addition-chain algorithm requires no more multiplications than binary exponentiation and usually less. The first example of where it does better is for a15, where the binary method needs six multiplications but a shortest addition chain requires only five:
Number of
Multiplications		Actual
Exponentiation		Specific implementation of
Addition Chains to do Exponentiation
0a1a
1a2a × a
2a3a × a × a
2a4 × b
3a5 × b × a
3a6 × b × b
4a7 × b × b × a
3a8 × d
4a9 × c × c
4a10 × d × b
5a11 × d × b × a
4a12 × d × d
5a13 × d × d × a
5a14 × d × d × b
5a15 × e × e
4a16 × d→h) × h

On the other hand, the determination of a shortest addition chain is hard: no efficient optimal methods are currently known for arbitrary exponents, and the related problem of finding a shortest addition chain for a given set of exponents has been proven NP-complete. Even given a shortest chain, addition-chain exponentiation requires more memory than the binary method, because it must potentially store many previous exponents from the chain. So in practice, shortest addition-chain exponentiation is primarily used for small fixed exponents for which a shortest chain can be precomputed and is not too large.
There are also several methods to approximate a shortest addition chain, and which often require fewer multiplications than binary exponentiation; binary exponentiation itself is a suboptimal addition-chain algorithm. The optimal algorithm choice depends on the context.
The problem of finding the shortest addition chain cannot be solved by dynamic programming, because it does not satisfy the assumption of optimal substructure. That is, it is not sufficient to decompose the power into smaller powers, each of which is computed minimally, since the addition chains for the smaller powers may be related. For example, in the shortest addition chain for a15 above, the subproblem for a6 must be computed as 2 since a3 is re-used.

Addition-subtraction–chain exponentiation

If both multiplication and division are allowed, then an addition-subtraction chain may be used to obtain even fewer total multiplications+divisions. However, the slowness of division compared to multiplication makes this technique unattractive in general. For exponentiation to negative integer powers, on the other hand, since one division is required anyway, an addition-subtraction chain is often beneficial. One such example is a−31, where computing 1/a31 by a shortest addition chain for a31 requires 7 multiplications and one division, whereas the shortest addition-subtraction chain requires 5 multiplications and one division:
For exponentiation on elliptic curves, the inverse of a point is available at no cost, since it is simply, and therefore addition-subtraction chains are optimal in this context even for positive integer exponents.