We need find y for some x on elliptical curve in cases:
- decompressing public key
- restoring public key from signature for given message hash, r and s.
This algorithm uses power twice: first it is y1 = $x^3$ modulo p, and next is very high degree y = $y1^{(p + 1) / 4}$ modulo p. I know way to compute it on logarithmic time, similar to adding-doubling method, where instead adding is multiplying , instead doubling is compute square. I wonder, if is faster method for special exponent, here exponent is not arbitrary but (p + 1) / 4. I'm afraid that restoring public key from signature takes much more time than verify signature.
