Add the relaxed NAF

[weikengchen]

Description

This PR adds the relaxed NAF, which differs from the original find_wnaf (should be find_naf?) by allowing the top 2 bits to be both nonzeros. This can, in some cases, reduce the overhead.

The algorithm is indeed quite simple. The only case when the standard NAF may be suboptimal (note: NAF is optimal for hamming weight, but not the length + the hamming weight) is when the NAF ends with "-1 0 1", which can be systematically changed into "1 1". There are no other cases.

---

Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

• Targeted PR against correct branch (master)
• Linked to Github issue with discussion and accepted design OR have an explanation in the PR that describes this work.
• Wrote unit tests
• Updated relevant documentation in the code
• Added a relevant changelog entry to the Pending section in CHANGELOG.md
• Re-reviewed Files changed in the Github PR explorer

[Pratyush]

Is this used anywhere? (Eg: for faster scalar muls?)

[weikengchen]

Is this used anywhere? (Eg: for faster scalar muls?)

I originally planned to use it for Poseidon. Unfortunately, for essentially all the prime numbers being considered, NAF is not better than the original form, because when NAF is better, it needs to use "inverse", and "inverse" here is costly, which requires 3 constraints to compute (it is needed to be compatible with the case that d is zero).

• For all the primes <= 100, it is not better.
• 127 seems to be the only one that is better by a little bit. But for Marlin, we often go to 257, which does not need "-1".
• It becomes extremely useful when the number is very large, something like 47189, 3527, 8813 (randomly typing), but not the common prime numbers considered in Poseidon.

Maybe it would be more useful for EC scalar mul, in which "inverse" (aka negative) is cheap.

[weikengchen]

On a separate note, should we rename find_wnaf to find_naf? there is no window.

[Pratyush]

Yeah, find_naf makes sense.

[Pratyush]

@weikengchen what's the status of this PR?

[weikengchen]

I should be able to revisit this PR today or tomorrow.

[weikengchen]

The PR is ready to go. @Pratyush please take a look

[Pratyush]

Maybe we can add here find_naf(&12u64]) which has a shorter length?

[weikengchen]

Yes. Added. It has a slightly longer len---5.