Minimality of the hamming weight of the τ-NAF for koblitz curves and improved combination with point halving

Roberto Maria Avanzi, Clemens Heuberger, Helmut Prodinger

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


In order to efficiently perform scalar multiplications on elliptic Koblitz curves, expansions of the scalar to a complex base associated with the Frobenius endomorphism are commonly used. One such expansion is the τ-adic NAP, introduced by Solinas. Some properties of this expansion, such as the average weight, are well known, but in the literature there is no proof of its optimality, i.e. that it always has minimal weight. In this paper we provide the first proof of this fact. Point halving, being faster than doubling, is also used to perform fast scalar multiplications on generic elliptic curves over binary fields. Since its computation is more expensive than that of the Frobenius, halving was thought to be uninteresting for Koblitz curves. At PKC 2004, Avanzi, Ciet, and Sica combined Frobenius operations with one point halving to compute scalar multiplications on Koblitz curves using on average 14% less group additions than with the usual τ-and-add method without increasing memory usage. The second result of this paper is an improvement over their expansion. The new representation, called the wide-double-NAF, is not only simpler to compute, but it is also optimal in a suitable sense. In fact, it has minimal Hamming weight among all τadic expansions with digits {0, ±1} that allow one halving to be inserted in the corresponding scalar multiplication algorithm. The resulting scalar multiplication requires on average 25% less group operations than the Frobenius method, and is thus 12.5% faster than the previously known combination.

Original languageEnglish
Title of host publicationSelected Areas in Cryptography - 12th International Workshop, SAC 2005, Revised Selected Papers
Number of pages13
StatePublished - 2006
Externally publishedYes
Event12th International Workshop on Selected Areas in Cryptography, SAC 2005 - Kingston, ON, Canada
Duration: 11 Aug 200512 Aug 2005

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume3897 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference12th International Workshop on Selected Areas in Cryptography, SAC 2005
CityKingston, ON


  • Integer decomposition
  • Koblitz curves
  • Point halving
  • Scalar multiplication
  • τ-adic expansion

ASJC Scopus subject areas

  • Theoretical Computer Science
  • General Computer Science


Dive into the research topics of 'Minimality of the hamming weight of the τ-NAF for koblitz curves and improved combination with point halving'. Together they form a unique fingerprint.

Cite this