id: H03 title: GLV decomposition halves doublings; sub-scalars never exceed 128 bits axis: A kind: algebraic statement: With the published basis, |k1|, |k2| < 2^128 for every k, and [k]P via interleaved wNAF uses ≈ 128 doublings instead of 256, giving ≈ 1.65× fewer group operations than wNAF alone. motivation: Quantify the known constant-factor gain exactly in operation counts (A3). assumptions: Affine operation model; wNAF window 4–5. expected_contribution: Exact operation counts for the paper's baseline table. related_work:

• gallant2001faster
• sica2002analysis
• hankerson2004guide possible_counterexamples: A scalar with a 129-bit component (none found in 2 200 samples; the Sica–Ciet–Quisquater bound guarantees ≤ 128 + small). verification_strategy: experiments/baselines/scalar_mult_opcount.py on 200 random scalars, all methods return the same point. computational_budget: seconds status: evaluated classification: known_reproduced evidence:
• results/baselines/scalar_mult_opcount.json verdict: Max sub-scalar size 128 bits; 184 vs 304 group ops (GLV+wNAF vs wNAF), 2.07× vs double-and-add. commands:
• .venv/bin/python experiments/baselines/scalar_mult_opcount.py

# H03 — GLV decomposition halves doublings; sub-scalars never exceed 128 bits

With the published basis, |k1|, |k2| < 2^128 for every k, and [k]P via interleaved wNAF uses ≈ 128 doublings instead of 256, giving ≈ 1.65× fewer group operations than wNAF alone.