The Montgomery ladder and Joye double-add ladder are well-known algorithms for elliptic curve scalar multiplication with a regular structure. The Montgomery ladder is best known for its implementation on Montgomery curves, which requires 5**M** + 4**S** + 1**m** + 8**A**, and 6 field registers. Here (**M**, **S**, **m**, **A**) represent respectively field multiplications, squarings, multiplications by a curve constant, and additions or subtractions. This ladder is also complete, meaning that it works on all input points and all scalars.

Many protocols do not use Montgomery curves, but instead use prime-order curves in short Weierstrass form. As of 2011, the fastest formulas for the Montgomery and Joye ladders on these curves each required 9**M** + 5**S** + 18**A** per bit. In 2017, Kim et al. improved this for the Montgomery ladder only to 8**M** + 4**S** + 12**A** + 1**H** per bit using 9 registers, where the H represents a halving. Hamburg simplified Kim et al.’s formulas to 8**M** + 4**S** + 8**A** + 1**H** using 6 registers.

Here we present improved formulas which compute the Montgomery ladder on short Weierstrass curves using 8**M** + 3**S** + 7**A** per bit, and requiring 6 registers. We also give formulas for the Joye ladder that use 9**M** + 3**S** + 7**A** per bit, requiring 5 registers. We also show a novel technique to make these ladders complete when the curve order is not divisible by 2 or 3, at a modest increase in cost.
Finally, we discuss curve invariants, exceptional points, side-channel protection and how to set up and finish these ladder operations.