# Does exponentiation by squaring work on Montgomery curves?

Consider the point multiplication $Q=[d]P$, where $P$ a point on elliptic curve multiplied with an integer $d$ to get another point $Q$ on the same curve. This operation can be computed by a predefined sequence of point additions and point doublings. Is it possible to apply the same technique to Montgomery curves, as group operations in Montgomery form seem simpler than in short Weierstrass form?

## 1 Answer

Yes, exponentiation by squaring can be applied to any associative binary operation with identity (that is, to any monoid, which includes groups like elliptic curves as a special case), independent of the particular representation.

However, the main advantage of Montgomery curves is that there is an improved algorithm (appropriately named Montgomery ladder) for point multiplication, which does not require the $y$ coordinate of the input point and achieves better resistance against side-channel attacks since it performs the same sequence of operations for all exponents of a given length (one addition and one squaring per bit), so you might want to use that instead if you are already going for a Montgomery curve.