# Addition chains for elliptic-curve scalar inversion

An addition chain starts at 1, and every later number is the sum of two earlier ones (doubling counts). Inverting a scalar modulo a curve's group order l can be done by raising it to the power l - 2; a chain ending at l - 2 is a fixed recipe for that power, one squaring or multiplication per step. Tommy Tai's agent swarm searched for short chains. Correctness is exact: a checker confirms the chain starts at 1, every step adds two earlier values, and it ends at the target.

## Results (as of 2026-10-30)

| Target | Our chain | Published comparator | Safe statement |
| --- | --- | --- | --- |
| Curve25519 scalar inversion | 279 steps (247 doublings + 32 other additions) | 283, the addchain project, listed by Clift as best known | Verified upper bound; a shorter chain may exist |
| P-521 scalar inversion | 577 steps (520 doublings + 57 other additions) | No published figure found | Verified upper bound; novelty UNKNOWN |
| P-256 scalar inversion | 284 | 281, Smith, October 2026 | Published result is shorter |
| P-384 scalar inversion | 421 | 420, Smith, October 2026 | Published result is shorter |
| secp256k1 scalar inversion | 288 | 282, Smith, October 2026 | Published result is shorter |

- The P-521 chain improved one step at a time on 2026-10-29: 580, 579, 578, 577.
- Finding no published figure is not proof that a result is new.
- An earlier P-384 post (422 steps, 2026-09-24) has since been overtaken; do not repeat 422 as a current result.

## Verify it yourself

Proof packet with the chains and a short checker that runs with plain Python: https://tommytai.dev/proof/addchain/

Human page: https://tommytai.dev/work/addition-chains/