1: \begin{abstract}

2:   Efficient scalar multiplication in Abelian groups (which is an important

3:   operation in public key cryptography) can be performed using digital

4:   expansions. Apart from rational integer bases (double-and-add algorithm),

5:   imaginary quadratic integer bases are of interest for elliptic curve

6:   cryptography, because the Frobenius endomorphism fulfils a quadratic

7:   equation. One strategy for improving the efficiency is to increase the digit

8:   set (at the prize of additional precomputations). A common choice is the

9:   width\nbd-$w$ non-adjacent form (\wNAF): each block of $w$ consecutive

10:   digits contains at most one non-zero digit. Heuristically, this ensures a low

11:   weight, i.e.\ number of non-zero digits, which translates in few costly curve

12:   operations. This paper investigates the following question: Is the

13:   \wNAF{}-expansion optimal, where optimality means minimising the weight over

14:   all possible expansions with the same digit set?

15: 

16:   The main characterisation of optimality of \wNAF{}s can be formulated in the

17:   following more general setting: We consider an Abelian group together with an

18:   endomorphism (e.g., multiplication by a base element in a ring) and a finite

19:   digit set.  We show that each group element has an optimal \wNAF{}-expansion

20:   if and only if this is the case for each sum of two expansions of weight $1$.

21:   This leads both to an algorithmic criterion and to generic answers for

22:   various cases.

23: 

24:   Imaginary quadratic integers of trace at least $3$ (in absolute value) have

25:   optimal \wNAF{}s for $w\ge 4$. The same holds for the special case of base

26:   $(\pm 3\pm\sqrt{-3})/2$ and $w\ge 2$, which corresponds to Koblitz curves in

27:   characteristic three.  In the case of $\tau=\pm1\pm i$, optimality depends on

28:   the parity of $w$.  Computational results for small trace are given.

29: 

30: \end{abstract}

31: