Abstract. In most algorithms involving elliptic curves, the most expensive part consists in computing multiples of points. This paper investigates how to extend the τ-adic expansion from Koblitz curves to a larger class of curves defined over a prime field having an efficiently-computable endomorphism φ in order to perform an efficient point multiplication with efficiency similar to Solinas ’ approach presented at CRYPTO ’97. Furthermore, many elliptic curve cryptosystems require the computation of k0P + k1Q. Following the work of Solinas on the Joint Sparse Form, we introduce the notion of φ-Joint Sparse Form which combines the advantages of a φ-expansion with the additional speedup of the Joint Sparse Form. We also present an efficient algorithm to obtain the φ-Joint Sparse Form. Then, the double exponentiation can be done using the φ endomorphism instead of doubling, resulting in an average of l applications of φ and l/2 additions, where l is the size of the ki’s. This results in an important speed-up when the computation of φ is particularly effective, as in the case of Koblitz curves. Keywords. Elliptic curves, fast endomorphisms, Joint Sparse Form. 1

In this work we analyse the GLV method of Gallant, Lambert and Vanstone (CRYPTO 2001) which uses a fast endomorphism # with minimal polynomial X + rX + s to compute any multiple kP of a point P of order n lying on an elliptic curve. First we

Abstract. Elliptic curves have a well-known and explicit theory for the construction and application of endomorphisms, which can be applied to improve performance in scalar multiplication. Recent work has extended these techniques to hyperelliptic Jacobians, but one obstruction is the lack of explicit models of curves together with an efficiently computable endomorphism. In the case of hyperelliptic curves there are limited examples, most methods focusing on special CM curves or curves defined over a small field. In this article we describe three infinite families of curves which admit an efficiently computable endomorphism, and give algorithms for their efficient application.