On average, the square-and-multiply method requires 1.5k multiplicatio
ns to evaluate x(E), where k is the bit length of E. Recently, Wu and
Chang proposed an efficient method for computing x(E), which needs 156
k/128 multiplications. By folding the exponent E in half and combining
Wu and Chang's method, we present a more efficient method for evaluat
ing x(E). On average, our new method needs only 149k/128 + 3 multiplic
ations.