# Which safe elliptic curves allow for the fastest scalar multiplication

I'm specifically looking for curves that are safe (ideally on this list: https://safecurves.cr.yp.to/) and which allow for the fastest scalar multiplication operations on arbitrary points.

By 'arbitrary', I mean scalar multiplication with points other than the base point, which are only expected to ever be encountered once, and therefore cannot be precomputed in advance for scalar multiplication in order to speed things up.

• Useful ressources to answerers: This A and this A by Thomas Pornin and the standard ressource for cryptographic measurements on asymmetric primitives. However the measurements lack the desired "with a non-based point" because otherwise one could use the key-generation times of the *DSA schemes. – SEJPM Sep 14 '17 at 10:13
• You might want to examine the DH function measurements for $x$-restricted variable-base scalar multiplication. It might also be helpful to be more specific about what you want to choose a curve for: a Diffie–Hellman key agreement system? A Dual_EC_DRBG-style pseudorandom number generator with a back door? A signature scheme with fast verification? – Squeamish Ossifrage Sep 14 '17 at 13:04
• It's for creating and verifying ring signatures with a large number of ring members. The signing and verification computation costs are overwhelmingly scalar multiplications with non-base points. – knaccc Sep 15 '17 at 7:22