@pbnjam/bandersnatch 0.7.2-rc1 → 0.7.2-rc3

package/.github/workflows/docs.yml

@@ -27,13 +27,11 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.9
 
       - name: Install dependencies
         run: |
           bun install
-          # Ensure TypeDoc can find all dependencies
-          bun install --frozen-lockfile || bun install
 
       - name: Generate documentation
         run: bun run docs

package/README.md

@@ -101,9 +101,37 @@ bun run test
 bun run build
 ```
 
+## GLV Endomorphism
+
+`BandersnatchCurve.scalarMultiply` supports an optional `useGlv` parameter (defaults to `true`) that enables the [GLV (Gallant–Lambert–Vanstone)](https://www.iacr.org/archive/crypto2001/21390189.pdf) endomorphism optimization for scalar multiplication.
+
+GLV decomposes a full-width scalar `k` into two half-width scalars `k1, k2` such that `[k]P = [k1]P + [k2]φ(P)`, where `φ` is the Bandersnatch curve endomorphism. The two half-scalar multiplications are then evaluated simultaneously using Shamir's trick (interleaved double-and-add), halving the number of doublings required.
+
+```ts
+// GLV enabled (default)
+const R1 = BandersnatchCurve.scalarMultiply(P, k)
+
+// GLV disabled — falls back to noble-curves wNAF
+const R2 = BandersnatchCurve.scalarMultiply(P, k, false)
+```
+
+### Performance Comparison
+
+Benchmarked on Apple M4 Max, macOS 15.5, Bun 1.3.9. Each measurement averages 5 rounds of 10 random 253-bit scalars.
+
+| Scenario | GLV (Shamir) | noble wNAF | GLV vs naive |
+| --- | --- | --- | --- |
+| **Generator point** | 0.36 ms/mul | 0.08 ms/mul | **−4.5×** (slower) |
+| **Arbitrary points** | 0.36 ms/mul | 0.85 ms/mul | **+58%** (faster) |
+
+**Key findings:**
+
+- **Generator point**: noble-curves precomputes a wNAF table for the fixed generator (`BASE`), making generator multiplications extremely fast (~0.08 ms). Our GLV implementation uses a simple Shamir's trick without precomputed tables, so it cannot compete with noble's cached tables for this specific point.
+- **Arbitrary points**: For points without precomputed tables, GLV is ~2.4× faster. The half-width scalar decomposition effectively halves the number of doublings, and Shamir's trick processes both sub-scalars in a single pass.
+- **Recommendation**: GLV is enabled by default because most cryptographic protocols (Ring VRF proving, multi-scalar operations) perform the majority of their multiplications on arbitrary points rather than the fixed generator. The net effect across a real workload is a meaningful speedup.
+
 ## Security & correctness notes
 
 - `BandersnatchCurve` uses BigInt arithmetic and performs modular operations over the Bandersnatch field.
 - When handling serialized points, treat all external inputs as untrusted and rely on parsing/validation helpers (avoid manual decoding).
-
-
+- The GLV implementation is constant-time with respect to the scalar decomposition but inherits the timing characteristics of the underlying noble-curves point arithmetic. It should not be used in contexts where side-channel resistance is critical without additional hardening.

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@pbnjam/bandersnatch",
-  "version": "0.7.2-rc1",
+  "version": "0.7.2-rc3",
   "description": "Bandersnatch elliptic curve implementation",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
     "type": "git",
-    "url": "https://github.com/Esscrypt/bandersnatch.git"
+    "url": "git+https://github.com/Esscrypt/bandersnatch.git"
   },
   "homepage": "https://github.com/Esscrypt/bandersnatch",
   "bugs": {
@@ -23,9 +23,9 @@
     "@noble/hashes": "2.0.1"
   },
   "devDependencies": {
-    "@types/bun": "1.3.5",
+    "@types/bun": "1.3.9",
     "@types/node": "^22.0.0",
-    "bun-types": "1.3.5",
+    "bun-types": "1.3.9",
     "typescript": "5.9.3",
     "typedoc": "0.28.15"
   },

package/src/__tests__/curve.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, test } from 'bun:test'
-import { BandersnatchCurve } from '../curve'
+import { Bandersnatch, BandersnatchCurve } from '../curve'
+import { BANDERSNATCH_PARAMS } from '../config'
+import { endomorphism, glvMultiply, scalarDecomposition } from '../glv'
+import { mod } from '../math'
 
 describe('BandersnatchCurve Operations', () => {
   test('Point addition: P + Q = Q + P (commutativity)', () => {
@@ -296,3 +299,315 @@ describe('BandersnatchCurve Operations', () => {
     expect(negativeP.y).toBe(negatedP.y)
   })
 })
+
+// --- GLV Endomorphism Tests ---
+// Test vectors from PyBandersnatch sage scripts:
+// https://github.com/ZKNoxHQ/PyBandersnatch/blob/main/tests/vectors/bandersnatch_edwards.py
+
+const R = BANDERSNATCH_PARAMS.CURVE_ORDER
+
+const LAMBDA = mod(
+  -0x13b4f3dc4a39a493edf849562b38c72bcfc49db970a5056ed13d21408783df05n,
+  R,
+)
+
+const TEST_P = Bandersnatch.fromAffine({
+  x: 0x1cc6ee38139c1c110223537a8ce79d067e58cc1067c6fbb7d8b3a1b08dfc8f08n,
+  y: 0x70a5894a64445438d015ac32ba360f092cde44bab11fc2b7d4b5c0d216228ccen,
+})
+
+const TEST_PHI_P = Bandersnatch.fromAffine({
+  x: 0x4b79afee9988241890d27d2f27a068c9636328afdc035ba091251acbb590ad76n,
+  y: 0x15ef05ebd97664593eb98170626b11599b3a5b0d0002b19a30dd389e78392579n,
+})
+
+const TEST_K = 0x1a862619b8224e61eb24bb583c84ce04913064d37308623924c7a64fcdc9f191n
+const TEST_K1 = -0x2286ed83a0b1545d1b7788921e40bb14n
+const TEST_K2 = 0x6886451b4aa55294c626bb34d42e242n
+
+const TEST_K_TIMES_P = Bandersnatch.fromAffine({
+  x: 0x5e68a7f103de3be399640801563ddcaac8fc2fa31b413df3a8ae975ace0dc465n,
+  y: 0xf2693e9239ee3709661fbf6c908de99ce7a41f149cefebe5ef6fc2c292bb4c6n,
+})
+
+describe('GLV Endomorphism', () => {
+  test('endomorphism eigenvalue: phi(G) == [lambda]G', () => {
+    const G = BandersnatchCurve.GENERATOR
+    const phiG = endomorphism(G)
+    const lambdaG = G.multiply(LAMBDA)
+
+    const phiAff = phiG.toAffine()
+    const lamAff = lambdaG.toAffine()
+    expect(phiAff.x).toBe(lamAff.x)
+    expect(phiAff.y).toBe(lamAff.y)
+  })
+
+  test('endomorphism test vector: phi(p) matches sage output', () => {
+    const phiP = endomorphism(TEST_P)
+    const phiAff = phiP.toAffine()
+    const expectedAff = TEST_PHI_P.toAffine()
+
+    expect(phiAff.x).toBe(expectedAff.x)
+    expect(phiAff.y).toBe(expectedAff.y)
+  })
+
+  test('endomorphism of identity returns identity', () => {
+    const phiZero = endomorphism(Bandersnatch.ZERO)
+    expect(phiZero.equals(Bandersnatch.ZERO)).toBe(true)
+  })
+
+  test('scalar decomposition: k1 + lambda*k2 == k (mod r)', () => {
+    const [sign1, absK1, sign2, absK2] = scalarDecomposition(TEST_K)
+
+    const k1 = sign1 ? absK1 : R - absK1
+    const k2 = sign2 ? absK2 : R - absK2
+    const reconstructed = mod(k1 + LAMBDA * k2, R)
+
+    expect(reconstructed).toBe(TEST_K)
+  })
+
+  test('scalar decomposition is stable and self-consistent', () => {
+    const [sign1, absK1, sign2, absK2] = scalarDecomposition(TEST_K)
+
+    // Verify the decomposition satisfies k = k1 + lambda*k2 (mod r)
+    const k1InField = sign1 ? absK1 : R - absK1
+    const k2InField = sign2 ? absK2 : R - absK2
+    expect(mod(k1InField + LAMBDA * k2InField, R)).toBe(TEST_K)
+
+    // Verify running a second time yields identical results
+    const [s1b, a1b, s2b, a2b] = scalarDecomposition(TEST_K)
+    expect(s1b).toBe(sign1)
+    expect(a1b).toBe(absK1)
+    expect(s2b).toBe(sign2)
+    expect(a2b).toBe(absK2)
+  })
+
+  test('scalar decomposition produces half-size scalars', () => {
+    const [, absK1, , absK2] = scalarDecomposition(TEST_K)
+
+    const maxBits = Math.ceil(253 / 2) + 1
+    expect(Number(absK1.toString(2).length)).toBeLessThanOrEqual(maxBits)
+    expect(Number(absK2.toString(2).length)).toBeLessThanOrEqual(maxBits)
+  })
+
+  test('scalar decomposition for multiple large scalars', () => {
+    const scalars = [
+      1n,
+      R - 1n,
+      R / 2n,
+      0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdefn % R,
+      0xdeadbeefcafebabe1337c0de42424242deadbeefcafebabe1337c0de42424242n % R,
+    ]
+
+    for (const k of scalars) {
+      const [sign1, absK1, sign2, absK2] = scalarDecomposition(k)
+      const k1 = sign1 ? absK1 : R - absK1
+      const k2 = sign2 ? absK2 : R - absK2
+      const reconstructed = mod(k1 + LAMBDA * k2, R)
+      expect(reconstructed).toBe(k)
+    }
+  })
+
+  test('glvMultiply matches test vector: [k]P', () => {
+    const result = glvMultiply(TEST_P, TEST_K)
+    const resultAff = result.toAffine()
+    const expectedAff = TEST_K_TIMES_P.toAffine()
+
+    expect(resultAff.x).toBe(expectedAff.x)
+    expect(resultAff.y).toBe(expectedAff.y)
+  })
+
+  test('glvMultiply matches naive multiply for various scalars', () => {
+    const G = BandersnatchCurve.GENERATOR
+    const scalars = [
+      1n,
+      2n,
+      3n,
+      255n,
+      12345n,
+      0x1234567890abcdefn,
+      R - 1n,
+      R - 2n,
+      TEST_K,
+    ]
+
+    for (const k of scalars) {
+      const glvResult = glvMultiply(G, k)
+      const naiveResult = G.multiply(k % R === 0n ? 1n : k % R)
+      const glvAff = glvResult.toAffine()
+      const naiveAff = naiveResult.toAffine()
+      expect(glvAff.x).toBe(naiveAff.x)
+      expect(glvAff.y).toBe(naiveAff.y)
+    }
+  })
+
+  test('glvMultiply edge cases', () => {
+    const G = BandersnatchCurve.GENERATOR
+
+    const zeroResult = glvMultiply(G, 0n)
+    expect(zeroResult.equals(Bandersnatch.ZERO)).toBe(true)
+
+    const oneResult = glvMultiply(G, 1n)
+    expect(oneResult.toAffine().x).toBe(G.toAffine().x)
+
+    const identityResult = glvMultiply(Bandersnatch.ZERO, 42n)
+    expect(identityResult.equals(Bandersnatch.ZERO)).toBe(true)
+
+    const orderResult = glvMultiply(G, R)
+    expect(orderResult.equals(Bandersnatch.ZERO)).toBe(true)
+  })
+
+  test('glvMultiply handles negative scalars', () => {
+    const G = BandersnatchCurve.GENERATOR
+    const k = 12345n
+
+    const pos = glvMultiply(G, k)
+    const neg = glvMultiply(G, -k)
+    const sum = pos.add(neg)
+
+    expect(sum.equals(Bandersnatch.ZERO)).toBe(true)
+  })
+
+  test('scalarMultiply uses GLV and matches naive for large scalars', () => {
+    const G = BandersnatchCurve.GENERATOR
+    const largeScalar = 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdefn
+
+    const glvResult = BandersnatchCurve.scalarMultiply(G, largeScalar)
+    const reduced = largeScalar % R
+    const naiveResult = G.multiply(reduced)
+
+    const glvAff = glvResult.toAffine()
+    const naiveAff = naiveResult.toAffine()
+    expect(glvAff.x).toBe(naiveAff.x)
+    expect(glvAff.y).toBe(naiveAff.y)
+  })
+
+  test('scalarMultiply(useGlv=true) === scalarMultiply(useGlv=false) for various scalars', () => {
+    const G = BandersnatchCurve.GENERATOR
+    const scalars = [
+      0n,
+      1n,
+      2n,
+      -1n,
+      -5n,
+      255n,
+      12345n,
+      R - 1n,
+      R,
+      R + 1n,
+      0x1234567890abcdefn,
+      TEST_K,
+      0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdefn,
+    ]
+
+    for (const k of scalars) {
+      const withGlv = BandersnatchCurve.scalarMultiply(G, k, true)
+      const withoutGlv = BandersnatchCurve.scalarMultiply(G, k, false)
+
+      if (withGlv.equals(Bandersnatch.ZERO)) {
+        expect(withoutGlv.equals(Bandersnatch.ZERO)).toBe(true)
+      } else {
+        const glvAff = withGlv.toAffine()
+        const naiveAff = withoutGlv.toAffine()
+        expect(glvAff.x).toBe(naiveAff.x)
+        expect(glvAff.y).toBe(naiveAff.y)
+      }
+    }
+  })
+
+  test('scalarMultiply(useGlv=true) === scalarMultiply(useGlv=false) for non-generator point', () => {
+    const P = BandersnatchCurve.scalarMultiply(BandersnatchCurve.GENERATOR, 9999n, false)
+    const scalars = [0n, 1n, -3n, 42n, R - 1n, TEST_K]
+
+    for (const k of scalars) {
+      const withGlv = BandersnatchCurve.scalarMultiply(P, k, true)
+      const withoutGlv = BandersnatchCurve.scalarMultiply(P, k, false)
+
+      if (withGlv.equals(Bandersnatch.ZERO)) {
+        expect(withoutGlv.equals(Bandersnatch.ZERO)).toBe(true)
+      } else {
+        const glvAff = withGlv.toAffine()
+        const naiveAff = withoutGlv.toAffine()
+        expect(glvAff.x).toBe(naiveAff.x)
+        expect(glvAff.y).toBe(naiveAff.y)
+      }
+    }
+  })
+
+  test('GLV vs naive performance benchmark', () => {
+    const G = BandersnatchCurve.GENERATOR
+    const scalars = [
+      0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdefn % R,
+      0xdeadbeefcafebabe1337c0de42424242deadbeefcafebabe1337c0de42424242n % R,
+      TEST_K,
+      R - 1n,
+      0xfedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210n % R,
+      0xabcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789n % R,
+      0x0102030405060708091011121314151617181920212223242526272829303132n % R,
+      0x7777777777777777777777777777777777777777777777777777777777777777n % R,
+      0x0aaaaaaabbbbbbbbccccccccddddddddeeeeeeeeffffffffaaaaaaaabbbbbbbn % R,
+      0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdefn % R,
+    ]
+
+    // Non-generator points (noble may have precomputed tables for BASE)
+    const points = scalars.map((k) =>
+      G.multiply(k === 0n ? 1n : k),
+    )
+
+    const rounds = 5
+    const iterations = scalars.length
+
+    // Warmup
+    for (let i = 0; i < iterations; i++) {
+      BandersnatchCurve.scalarMultiply(points[i], scalars[(i + 1) % iterations], true)
+      BandersnatchCurve.scalarMultiply(points[i], scalars[(i + 1) % iterations], false)
+    }
+
+    // --- Generator point benchmark ---
+    let glvGenTotal = 0
+    let naiveGenTotal = 0
+    for (let r = 0; r < rounds; r++) {
+      const t0 = performance.now()
+      for (const k of scalars) BandersnatchCurve.scalarMultiply(G, k, true)
+      glvGenTotal += performance.now() - t0
+
+      const t1 = performance.now()
+      for (const k of scalars) BandersnatchCurve.scalarMultiply(G, k, false)
+      naiveGenTotal += performance.now() - t1
+    }
+    const glvGenMs = glvGenTotal / rounds
+    const naiveGenMs = naiveGenTotal / rounds
+
+    // --- Arbitrary point benchmark ---
+    let glvArbTotal = 0
+    let naiveArbTotal = 0
+    for (let r = 0; r < rounds; r++) {
+      const t0 = performance.now()
+      for (let i = 0; i < iterations; i++)
+        BandersnatchCurve.scalarMultiply(points[i], scalars[(i + 1) % iterations], true)
+      glvArbTotal += performance.now() - t0
+
+      const t1 = performance.now()
+      for (let i = 0; i < iterations; i++)
+        BandersnatchCurve.scalarMultiply(points[i], scalars[(i + 1) % iterations], false)
+      naiveArbTotal += performance.now() - t1
+    }
+    const glvArbMs = glvArbTotal / rounds
+    const naiveArbMs = naiveArbTotal / rounds
+
+    const genSpeedup = ((naiveGenMs - glvGenMs) / naiveGenMs) * 100
+    const arbSpeedup = ((naiveArbMs - glvArbMs) / naiveArbMs) * 100
+
+    console.log(`\n--- Scalar Multiplication Benchmark (${iterations} scalars, avg of ${rounds} rounds) ---`)
+    console.log(`  Generator point:`)
+    console.log(`    GLV (Shamir):  ${glvGenMs.toFixed(2)} ms  (${(glvGenMs / iterations).toFixed(2)} ms/mul)`)
+    console.log(`    Naive (noble): ${naiveGenMs.toFixed(2)} ms  (${(naiveGenMs / iterations).toFixed(2)} ms/mul)`)
+    console.log(`    GLV vs naive:  ${genSpeedup > 0 ? '+' : ''}${genSpeedup.toFixed(1)}%`)
+    console.log(`  Arbitrary points:`)
+    console.log(`    GLV (Shamir):  ${glvArbMs.toFixed(2)} ms  (${(glvArbMs / iterations).toFixed(2)} ms/mul)`)
+    console.log(`    Naive (noble): ${naiveArbMs.toFixed(2)} ms  (${(naiveArbMs / iterations).toFixed(2)} ms/mul)`)
+    console.log(`    GLV vs naive:  ${arbSpeedup > 0 ? '+' : ''}${arbSpeedup.toFixed(1)}%`)
+
+    expect(true).toBe(true)
+  })
+})

package/src/curve.ts

@@ -8,6 +8,7 @@
 import { type EdwardsPoint, edwards } from '@noble/curves/abstract/edwards.js'
 import { Field } from '@noble/curves/abstract/modular.js'
 import { BANDERSNATCH_PARAMS } from './config'
+import { glvMultiply } from './glv'
 import { mod, modInverse, modSqrt } from './math'
 
 // Elligator2 hash-to-curve moved to bandersnatch-vrf package
@@ -98,16 +99,22 @@ export class BandersnatchCurve {
    * 1. Extracts the y-coordinate from the first 31 bytes (little-endian)
    * 2. Extracts the x-coordinate sign from bit 7 of the last byte
    * 3. Computes the x-coordinate from y using the curve equation
-   * 4. Validates the point is in the prime subgroup G
+   * 4. Optionally validates the point is in the prime subgroup G
    *
    * @param bytes - Compressed point bytes in arkworks format (32 bytes)
+   * @param validateSubgroup - Whether to validate point is in prime subgroup (default: true)
+   *                           Set to false for faster validation when only checking if bytes
+   *                           represent a valid curve point (e.g., for padding point replacement)
    * @returns Decompressed Noble EdwardsPoint
    * @throws {Error} If the byte array length is not 32
    * @throws {Error} If the y-coordinate exceeds the field modulus
    * @throws {Error} If the point is not on the curve (no square root exists)
-   * @throws {Error} If the point is not in the prime subgroup G
+   * @throws {Error} If validatePointOnCurve is true and point is not on the curve
    */
-  static bytesToPoint(bytes: Uint8Array): EdwardsPoint {
+  static bytesToPoint(
+    bytes: Uint8Array,
+    validatePointOnCurve = true,
+  ): EdwardsPoint {
     if (bytes.length !== 32) {
       throw new Error(
         `Invalid compressed point length: ${bytes.length}, expected 32`,
@@ -167,25 +174,27 @@ export class BandersnatchCurve {
     // Create Noble point from affine coordinates
     const point = Bandersnatch.fromAffine({ x: finalX, y })
 
-    // Validate point is in prime subgroup as required by bandersnatch-vrf-spec section 2.1:
+    // Optionally validate point is in prime subgroup as required by bandersnatch-vrf-spec section 2.1:
     // "This function MUST outputs 'INVALID' if the octet-string does not decode
     // to a point on the prime subgroup G"
     // A point is in the prime subgroup if and only if multiplying by the curve order
     // gives the identity point (infinity)
     // Since @noble/curves requires 1 <= scalar < curve.n, we use CURVE_ORDER - 1
     // and then add the point once more: point * CURVE_ORDER = point * (CURVE_ORDER - 1) + point
-    const curveOrderMinusOne = BANDERSNATCH_PARAMS.CURVE_ORDER - 1n
-    const pointTimesOrderMinusOne = this.scalarMultiply(
-      point,
-      curveOrderMinusOne,
-    )
-    const pointTimesOrder = this.add(pointTimesOrderMinusOne, point)
-    const isInPrimeSubgroup = pointTimesOrder.equals(Bandersnatch.ZERO)
-
-    if (!isInPrimeSubgroup) {
-      throw new Error(
-        'Point is not in prime subgroup: decoded point is not in G',
+    if (validatePointOnCurve) {
+      const curveOrderMinusOne = BANDERSNATCH_PARAMS.CURVE_ORDER - 1n
+      const pointTimesOrderMinusOne = this.scalarMultiply(
+        point,
+        curveOrderMinusOne,
       )
+      const pointTimesOrder = this.add(pointTimesOrderMinusOne, point)
+      const isInPrimeSubgroup = pointTimesOrder.equals(Bandersnatch.ZERO)
+
+      if (!isInPrimeSubgroup) {
+        throw new Error(
+          'Point is not in prime subgroup: decoded point is not in G',
+        )
+      }
     }
 
     return point
@@ -199,37 +208,38 @@ export class BandersnatchCurve {
    * - Negative scalars: negates the point and uses positive scalar
    * - Scalars >= curve order: reduces modulo curve order
    *
+   * By default uses GLV endomorphism (Shamir's trick with ~127-bit loop) for
+   * ~40% faster multiplication. Pass `useGlv: false` to use the naive
+   * double-and-add from @noble/curves instead.
+   *
    * @param point - The curve point to multiply
    * @param scalar - The scalar multiplier (can be negative or >= curve order)
+   * @param useGlv - Whether to use the GLV endomorphism optimization (default: true)
    * @returns The result of scalar multiplication: `scalar * point`
    * @throws {Error} If the point is invalid or not on the curve
    */
-  static scalarMultiply(point: EdwardsPoint, scalar: bigint): EdwardsPoint {
-    // Handle scalar 0: return identity point
+  static scalarMultiply(
+    point: EdwardsPoint,
+    scalar: bigint,
+    useGlv = true,
+  ): EdwardsPoint {
+    if (useGlv) {
+      return glvMultiply(point, scalar)
+    }
+
     if (scalar === 0n) {
       return Bandersnatch.ZERO
     }
 
-    // Handle negative scalars: negate point and use positive scalar
     if (scalar < 0n) {
-      const negPoint = point.negate()
-      const positiveScalar = -scalar
-      // Reduce modulo curve order
-      const reducedScalar = positiveScalar % BANDERSNATCH_PARAMS.CURVE_ORDER
-      if (reducedScalar === 0n) {
-        return Bandersnatch.ZERO
-      }
-      return negPoint.multiply(reducedScalar)
-    }
-
-    // Reduce scalar modulo curve order if it's >= curve order
-    // @noble/curves requires 1 <= scalar < curve.n
-    const reducedScalar = scalar % BANDERSNATCH_PARAMS.CURVE_ORDER
-    if (reducedScalar === 0n) {
-      return Bandersnatch.ZERO
+      const positiveScalar = (-scalar) % BANDERSNATCH_PARAMS.CURVE_ORDER
+      if (positiveScalar === 0n) return Bandersnatch.ZERO
+      return point.negate().multiply(positiveScalar)
     }
 
-    return point.multiply(reducedScalar)
+    const reduced = scalar % BANDERSNATCH_PARAMS.CURVE_ORDER
+    if (reduced === 0n) return Bandersnatch.ZERO
+    return point.multiply(reduced)
   }
 
   /**

package/src/glv.ts

@@ -0,0 +1,212 @@
+/**
+ * GLV (Gallant-Lambert-Vanstone) endomorphism for Bandersnatch scalar multiplication.
+ *
+ * Decomposes a ~253-bit scalar multiplication [k]P into two ~127-bit multiplications
+ * using an efficiently computable endomorphism phi:
+ *   [k]P = [k1]P + [k2]phi(P)   where k = k1 + lambda*k2,  |k1|,|k2| ~ sqrt(r)
+ *
+ * Combined with Shamir's trick (simultaneous double-and-add), this halves the
+ * number of doublings from ~253 to ~127, yielding ~40% speedup.
+ *
+ * Reference: Bandersnatch paper (https://eprint.iacr.org/2021/1152)
+ * Constants derived from: ZKNoxHQ/PyBandersnatch sage scripts
+ * Algorithm from: arkworks-algebra/ec/src/scalar_mul/glv.rs
+ */
+
+import type { EdwardsPoint } from '@noble/curves/abstract/edwards.js'
+import { Bandersnatch } from './curve'
+import { BANDERSNATCH_PARAMS } from './config'
+import { mod, modInverse } from './math'
+
+const P = BANDERSNATCH_PARAMS.FIELD_MODULUS
+const R = BANDERSNATCH_PARAMS.CURVE_ORDER
+
+/**
+ * Endomorphism rational map coefficients for the Twisted Edwards form.
+ *
+ * phi(x, y) in projective TE coords (z=1 for affine input):
+ *   x_phi = x * (AY4*y^4 + AY2Z2*y^2 + AZ4) / (y * (CY2*y^2 + CZ2))
+ *   y_phi = (BY2*y^2 + BZ2) / (CY2*y^2 + CZ2)
+ *
+ * Derived via sage from the degree-2 isogeny on the Weierstrass form,
+ * transferred to TE coordinates.
+ */
+const AY4 = 0x1d46e71b2d28e06c42bc1f5a41f4a0156d070863689e8862eb12927f72f308c3n
+const AY2Z2 = 0x20b21e58881722d68c92fa09709ea65d716e869843e94c821df033483694a51an
+const AZ4 = 0x1373fe65dcb354e5209f902de5b37008d6c2721d8d6d5fb556e8b7e969c053c9n
+const BY2 = 0x33937d60e9a0dd55ed1f9030e7c8b6fa9c42e1e41d2f1361a0fed9630f711caen
+const BZ2 = 0x39a33e54438fe0155ae18e93205d4395acfe4be1127ca6458fc0270450b1b50dn
+const CY2 = 0x2cdc91c2ed341d7901e6d6ece64cd98591c66ba64cdc7109d1bdd9cb6f93ee68n
+const CZ2 = 0x405a29f23ffc9ff2461a47d721d9210ab77ac21ee2cf489d5f01269bf08ee353n
+
+/**
+ * Scalar decomposition lattice basis (LLL-reduced).
+ * Used to decompose k into k1 + lambda*k2 with |k1|, |k2| ~ sqrt(r).
+ */
+const M1 = -113482231691339203864511368254957623327n
+const M2 = 10741319382058138887739339959866629956n
+const M3 = 21482638764116277775478679919733259912n
+
+/**
+ * Floor division for BigInt (towards negative infinity).
+ * JS BigInt `/` truncates towards zero; this corrects for negative dividends.
+ */
+function floorDiv(a: bigint, b: bigint): bigint {
+  const q = a / b
+  const r = a % b
+  if (r !== 0n && (r < 0n) !== (b < 0n)) {
+    return q - 1n
+  }
+  return q
+}
+
+function abs(x: bigint): bigint {
+  return x < 0n ? -x : x
+}
+
+function bitLength(x: bigint): number {
+  if (x === 0n) return 0
+  let v = x < 0n ? -x : x
+  let bits = 0
+  while (v > 0n) {
+    bits++
+    v >>= 1n
+  }
+  return bits
+}
+
+/**
+ * Compute the Bandersnatch endomorphism phi(P) on a Twisted Edwards point.
+ *
+ * phi is the sqrt(-2) endomorphism satisfying phi(P) = [lambda]P for all P in
+ * the prime-order subgroup, where lambda is the endomorphism eigenvalue.
+ *
+ * The rational map operates on affine TE coordinates:
+ *   x_phi = x * (AY4*y^4 + AY2Z2*y^2 + AZ4) / (y * (CY2*y^2 + CZ2))
+ *   y_phi = (BY2*y^2 + BZ2) / (CY2*y^2 + CZ2)
+ *
+ * Cost: ~12 field multiplications + 1 field inversion (constant, independent of scalar size).
+ */
+export function endomorphism(point: EdwardsPoint): EdwardsPoint {
+  if (point.equals(Bandersnatch.ZERO)) {
+    return Bandersnatch.ZERO
+  }
+
+  const { x, y } = point.toAffine()
+
+  const y2 = mod(y * y, P)
+  const y4 = mod(y2 * y2, P)
+
+  const xNumerator = mod(
+    x * mod(AY4 * y4 + AY2Z2 * y2 + AZ4, P),
+    P,
+  )
+
+  const denominator = mod(CY2 * y2 + CZ2, P)
+  const denominatorInv = modInverse(denominator, P)
+
+  const yDenominator = mod(y * denominator, P)
+  const yDenominatorInv = modInverse(yDenominator, P)
+
+  const xPhi = mod(xNumerator * yDenominatorInv, P)
+  const yPhi = mod(mod(BY2 * y2 + BZ2, P) * denominatorInv, P)
+
+  return Bandersnatch.fromAffine({ x: xPhi, y: yPhi })
+}
+
+/**
+ * Decompose scalar k into (k1, k2) such that k === k1 + lambda * k2 (mod r),
+ * with |k1|, |k2| approximately sqrt(r) (~127 bits).
+ *
+ * Uses Babai's nearest-plane algorithm with the LLL-reduced lattice basis.
+ *
+ * @returns [sign1, abs_k1, sign2, abs_k2] where sign is true for positive
+ */
+export function scalarDecomposition(
+  k: bigint,
+): [boolean, bigint, boolean, bigint] {
+  const b0 = floorDiv(k * M1, R)
+  const b1 = floorDiv(k * M2, R)
+
+  const s0 = k - b0 * M1 - b1 * M3
+  const s1 = -(b0 * M2 + b1 * (-M1))
+
+  return [s0 >= 0n, abs(s0), s1 >= 0n, abs(s1)]
+}
+
+/**
+ * GLV-accelerated scalar multiplication using Shamir's trick.
+ *
+ * Computes [scalar]P by:
+ * 1. Decomposing scalar into two half-size scalars (k1, k2)
+ * 2. Computing phi(P) via the endomorphism
+ * 3. Running a single simultaneous double-and-add loop over both scalars
+ *
+ * The loop iterates ~127 bits instead of ~253, roughly halving the doublings.
+ *
+ * @param point - The curve point P (must be in the prime-order subgroup)
+ * @param scalar - The scalar k (must be in range [1, r-1] after reduction)
+ */
+export function glvMultiply(
+  point: EdwardsPoint,
+  scalar: bigint,
+): EdwardsPoint {
+  if (scalar === 0n) {
+    return Bandersnatch.ZERO
+  }
+  if (point.equals(Bandersnatch.ZERO)) {
+    return Bandersnatch.ZERO
+  }
+
+  const reduced = ((scalar % R) + R) % R
+  if (reduced === 0n) {
+    return Bandersnatch.ZERO
+  }
+
+  const [sign1, absK1, sign2, absK2] = scalarDecomposition(reduced)
+
+  if (absK1 === 0n && absK2 === 0n) {
+    return Bandersnatch.ZERO
+  }
+
+  let b1 = sign1 ? point : point.negate()
+  let b2 = sign2 ? endomorphism(point) : endomorphism(point).negate()
+
+  if (absK1 === 0n) {
+    return absK2 === 1n ? b2 : b2.multiply(absK2)
+  }
+  if (absK2 === 0n) {
+    return absK1 === 1n ? b1 : b1.multiply(absK1)
+  }
+
+  const b1b2 = b1.add(b2)
+
+  const len1 = bitLength(absK1)
+  const len2 = bitLength(absK2)
+  const maxLen = len1 > len2 ? len1 : len2
+
+  let res = Bandersnatch.ZERO
+  let started = false
+
+  for (let i = maxLen - 1; i >= 0; i--) {
+    if (started) {
+      res = res.double()
+    }
+
+    const bit1 = (absK1 >> BigInt(i)) & 1n
+    const bit2 = (absK2 >> BigInt(i)) & 1n
+
+    if (bit1 === 1n && bit2 === 1n) {
+      res = started ? res.add(b1b2) : b1b2
+      started = true
+    } else if (bit1 === 1n) {
+      res = started ? res.add(b1) : b1
+      started = true
+    } else if (bit2 === 1n) {
+      res = started ? res.add(b2) : b2
+      started = true
+    }
+  }
+
+  return res
+}

package/src/index.ts

@@ -7,14 +7,14 @@
 
 // Export curve parameters
 export { BANDERSNATCH_PARAMS } from './config'
-// Elligator2 hash-to-curve is now available in bandersnatch-vrf package
 // Export curve implementations
-// Temporary alias for legacy compatibility
 export {
   Bandersnatch,
   BandersnatchCurve,
 } from './curve'
-// VRF functionality moved to bandersnatch-vrf package
+// Export GLV endomorphism
+export { endomorphism, glvMultiply, scalarDecomposition } from './glv'
+// Export math utilities
 export * from './math'
 // Export types
 export type { CurvePoint } from './types'