diff --git a/src/crypto/elliptic/internal/nistec/nistec_test.go b/src/crypto/elliptic/internal/nistec/nistec_test.go
index 9ce82a8f290..68879d55d79 100644
--- a/src/crypto/elliptic/internal/nistec/nistec_test.go
+++ b/src/crypto/elliptic/internal/nistec/nistec_test.go
@@ -6,7 +6,9 @@ package nistec_test
 
 import (
 	"bytes"
+	"crypto/elliptic"
 	"crypto/elliptic/internal/nistec"
+	"math/big"
 	"math/rand"
 	"os"
 	"strings"
@@ -90,27 +92,27 @@ type nistPoint[T any] interface {
 
 func TestEquivalents(t *testing.T) {
 	t.Run("P224", func(t *testing.T) {
-		testEquivalents(t, nistec.NewP224Point, nistec.NewP224Generator)
+		testEquivalents(t, nistec.NewP224Point, nistec.NewP224Generator, elliptic.P224())
 	})
 	t.Run("P256", func(t *testing.T) {
-		testEquivalents(t, nistec.NewP256Point, nistec.NewP256Generator)
+		testEquivalents(t, nistec.NewP256Point, nistec.NewP256Generator, elliptic.P256())
 	})
 	t.Run("P384", func(t *testing.T) {
-		testEquivalents(t, nistec.NewP384Point, nistec.NewP384Generator)
+		testEquivalents(t, nistec.NewP384Point, nistec.NewP384Generator, elliptic.P384())
 	})
 	t.Run("P521", func(t *testing.T) {
-		testEquivalents(t, nistec.NewP521Point, nistec.NewP521Generator)
+		testEquivalents(t, nistec.NewP521Point, nistec.NewP521Generator, elliptic.P521())
 	})
 }
 
-func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func() P) {
+func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func() P, c elliptic.Curve) {
 	p := newGenerator()
 
-	// This assumes the base and scalar fields have the same byte size, which
-	// they do for these curves.
-	elementSize := len(p.Bytes()) / 2
+	elementSize := (c.Params().BitSize + 7) / 8
 	two := make([]byte, elementSize)
 	two[len(two)-1] = 2
+	nPlusTwo := make([]byte, elementSize)
+	new(big.Int).Add(c.Params().N, big.NewInt(2)).FillBytes(nPlusTwo)
 
 	p1 := newPoint().Double(p)
 	p2 := newPoint().Add(p, p)
@@ -122,6 +124,14 @@ func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func()
 	if err != nil {
 		t.Fatal(err)
 	}
+	p5, err := newPoint().ScalarMult(p, nPlusTwo)
+	if err != nil {
+		t.Fatal(err)
+	}
+	p6, err := newPoint().ScalarBaseMult(nPlusTwo)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if !bytes.Equal(p1.Bytes(), p2.Bytes()) {
 		t.Error("P+P != 2*P")
@@ -132,6 +142,12 @@ func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func()
 	if !bytes.Equal(p1.Bytes(), p4.Bytes()) {
 		t.Error("G+G != [2]G")
 	}
+	if !bytes.Equal(p1.Bytes(), p5.Bytes()) {
+		t.Error("P+P != [N+2]P")
+	}
+	if !bytes.Equal(p1.Bytes(), p6.Bytes()) {
+		t.Error("G+G != [N+2]G")
+	}
 }
 
 func BenchmarkScalarMult(b *testing.B) {
diff --git a/src/crypto/elliptic/internal/nistec/p256_asm.go b/src/crypto/elliptic/internal/nistec/p256_asm.go
index 2bd3166062c..bf1badd5e00 100644
--- a/src/crypto/elliptic/internal/nistec/p256_asm.go
+++ b/src/crypto/elliptic/internal/nistec/p256_asm.go
@@ -18,37 +18,52 @@ import (
 	_ "embed"
 	"errors"
 	"math/bits"
+	"unsafe"
 )
 
-//go:embed p256_asm_table.bin
-var p256Precomputed string
+// p256Element is a P-256 base field element in [0, P-1] in the Montgomery
+// domain (with R 2²⁵⁶) as four limbs in little-endian order value.
+type p256Element [4]uint64
 
-// P256Point is a P-256 point. The zero value is NOT valid.
+// p256One is one in the Montgomery domain.
+var p256One = p256Element{0x0000000000000001, 0xffffffff00000000,
+	0xffffffffffffffff, 0x00000000fffffffe}
+
+var p256Zero = p256Element{}
+
+// p256P is 2²⁵⁶ - 2²²⁴ + 2¹⁹² + 2⁹⁶ - 1 in the Montgomery domain.
+var p256P = p256Element{0xffffffffffffffff, 0x00000000ffffffff,
+	0x0000000000000000, 0xffffffff00000001}
+
+// P256Point is a P-256 point. The zero value should not be assumed to be valid
+// (although it is in this implementation).
 type P256Point struct {
-	xyz [12]uint64
+	// (X:Y:Z) are Jacobian coordinates where x = X/Z² and y = Y/Z³. The point
+	// at infinity can be represented by any set of coordinates with Z = 0.
+	x, y, z p256Element
 }
 
-// NewP256Point returns a new P256Point representing the point at infinity point.
+// NewP256Point returns a new P256Point representing the point at infinity.
 func NewP256Point() *P256Point {
-	return &P256Point{[12]uint64{
-		0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
-		0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
-		0, 0, 0, 0,
-	}}
+	return &P256Point{
+		x: p256One, y: p256One, z: p256Zero,
+	}
 }
 
 // NewP256Generator returns a new P256Point set to the canonical generator.
 func NewP256Generator() *P256Point {
-	return &P256Point{[12]uint64{
-		0x79e730d418a9143c, 0x75ba95fc5fedb601, 0x79fb732b77622510, 0x18905f76a53755c6,
-		0xddf25357ce95560a, 0x8b4ab8e4ba19e45c, 0xd2e88688dd21f325, 0x8571ff1825885d85,
-		0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
-	}}
+	return &P256Point{
+		x: p256Element{0x79e730d418a9143c, 0x75ba95fc5fedb601,
+			0x79fb732b77622510, 0x18905f76a53755c6},
+		y: p256Element{0xddf25357ce95560a, 0x8b4ab8e4ba19e45c,
+			0xd2e88688dd21f325, 0x8571ff1825885d85},
+		z: p256One,
+	}
 }
 
 // Set sets p = q and returns p.
 func (p *P256Point) Set(q *P256Point) *P256Point {
-	p.xyz = q.xyz
+	p.x, p.y, p.z = q.x, q.y, q.z
 	return p
 }
 
@@ -69,21 +84,22 @@ func (p *P256Point) SetBytes(b []byte) (*P256Point, error) {
 	// Uncompressed form.
 	case len(b) == p256UncompressedLength && b[0] == 4:
 		var r P256Point
-		p256BigToLittle(r.xyz[0:4], b[1:33])
-		p256BigToLittle(r.xyz[4:8], b[33:65])
-		if p256LessThanP(r.xyz[0:4]) == 0 || p256LessThanP(r.xyz[4:8]) == 0 {
+		p256BigToLittle(&r.x, (*[32]byte)(b[1:33]))
+		p256BigToLittle(&r.y, (*[32]byte)(b[33:65]))
+		if p256LessThanP(&r.x) == 0 || p256LessThanP(&r.y) == 0 {
 			return nil, errors.New("invalid P256 element encoding")
 		}
-		p256Mul(r.xyz[0:4], r.xyz[0:4], rr[:])
-		p256Mul(r.xyz[4:8], r.xyz[4:8], rr[:])
-		if err := p256CheckOnCurve(r.xyz[0:4], r.xyz[4:8]); err != nil {
+		// p256Mul operates in the Montgomery domain with R = 2²⁵⁶ mod p. Thus rr
+		// here is R in the Montgomery domain, or R×R mod p. See comment in
+		// P256OrdInverse about how this is used.
+		rr := p256Element{0x0000000000000003, 0xfffffffbffffffff,
+			0xfffffffffffffffe, 0x00000004fffffffd}
+		p256Mul(&r.x, &r.x, &rr)
+		p256Mul(&r.y, &r.y, &rr)
+		if err := p256CheckOnCurve(&r.x, &r.y); err != nil {
 			return nil, err
 		}
-		// This sets r's Z value to 1, in the Montgomery domain.
-		r.xyz[8] = 0x0000000000000001
-		r.xyz[9] = 0xffffffff00000000
-		r.xyz[10] = 0xffffffffffffffff
-		r.xyz[11] = 0x00000000fffffffe
+		r.z = p256One
 		return p.Set(&r), nil
 
 	// Compressed form.
@@ -95,40 +111,37 @@ func (p *P256Point) SetBytes(b []byte) (*P256Point, error) {
 	}
 }
 
-func p256CheckOnCurve(x, y []uint64) error {
+func p256CheckOnCurve(x, y *p256Element) error {
 	// x³ - 3x + b
-	x3 := make([]uint64, 4)
+	x3 := new(p256Element)
 	p256Sqr(x3, x, 1)
 	p256Mul(x3, x3, x)
 
-	threeX := make([]uint64, 4)
+	threeX := new(p256Element)
 	p256Add(threeX, x, x)
 	p256Add(threeX, threeX, x)
 	p256NegCond(threeX, 1)
 
-	p256B := []uint64{0xd89cdf6229c4bddf, 0xacf005cd78843090,
+	p256B := &p256Element{0xd89cdf6229c4bddf, 0xacf005cd78843090,
 		0xe5a220abf7212ed6, 0xdc30061d04874834}
 
 	p256Add(x3, x3, threeX)
 	p256Add(x3, x3, p256B)
 
 	// y² = x³ - 3x + b
-	y2 := make([]uint64, 4)
+	y2 := new(p256Element)
 	p256Sqr(y2, y, 1)
 
-	diff := (x3[0] ^ y2[0]) | (x3[1] ^ y2[1]) |
-		(x3[2] ^ y2[2]) | (x3[3] ^ y2[3])
-	if uint64IsZero(diff) != 1 {
+	if p256Equal(y2, x3) != 1 {
 		return errors.New("P256 point not on curve")
 	}
 	return nil
 }
 
-var p256P = []uint64{0xffffffffffffffff, 0x00000000ffffffff,
-	0x0000000000000000, 0xffffffff00000001}
-
-// p256LessThanP returns 1 if x < p, and 0 otherwise.
-func p256LessThanP(x []uint64) int {
+// p256LessThanP returns 1 if x < p, and 0 otherwise. Note that a p256Element is
+// not allowed to be equal to or greater than p, so if this function returns 0
+// then x is invalid.
+func p256LessThanP(x *p256Element) int {
 	var b uint64
 	_, b = bits.Sub64(x[0], p256P[0], b)
 	_, b = bits.Sub64(x[1], p256P[1], b)
@@ -137,7 +150,8 @@ func p256LessThanP(x []uint64) int {
 	return int(b)
 }
 
-func p256Add(res, x, y []uint64) {
+// p256Add sets res = x + y.
+func p256Add(res, x, y *p256Element) {
 	var c, b uint64
 	t1 := make([]uint64, 4)
 	t1[0], c = bits.Add64(x[0], y[0], 0)
@@ -163,107 +177,152 @@ func p256Add(res, x, y []uint64) {
 	res[3] = (t1[3] & ^t2Mask) | (t2[3] & t2Mask)
 }
 
-// Functions implemented in p256_asm_*64.s
-// Montgomery multiplication modulo P256
+// The following assembly functions are implemented in p256_asm_*.s
+
+// Montgomery multiplication. Sets res = in1 * in2 * R⁻¹ mod p.
 //
 //go:noescape
-func p256Mul(res, in1, in2 []uint64)
+func p256Mul(res, in1, in2 *p256Element)
 
-// Montgomery square modulo P256, repeated n times (n >= 1)
+// Montgomery square, repeated n times (n >= 1).
 //
 //go:noescape
-func p256Sqr(res, in []uint64, n int)
+func p256Sqr(res, in *p256Element, n int)
 
-// Montgomery multiplication by 1
+// Montgomery multiplication by R⁻¹, or 1 outside the domain.
+// Sets res = in * R⁻¹, bringing res out of the Montgomery domain.
 //
 //go:noescape
-func p256FromMont(res, in []uint64)
+func p256FromMont(res, in *p256Element)
 
-// iff cond == 1  val <- -val
+// If cond is not 0, sets val = -val mod p.
 //
 //go:noescape
-func p256NegCond(val []uint64, cond int)
+func p256NegCond(val *p256Element, cond int)
 
-// if cond == 0 res <- b; else res <- a
+// If cond is 0, sets res = b, otherwise sets res = a.
 //
 //go:noescape
-func p256MovCond(res, a, b []uint64, cond int)
+func p256MovCond(res, a, b *P256Point, cond int)
 
-// Endianness swap
+//go:noescape
+func p256BigToLittle(res *p256Element, in *[32]byte)
+
+//go:noescape
+func p256LittleToBig(res *[32]byte, in *p256Element)
+
+//go:noescape
+func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
+
+//go:noescape
+func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
+
+// p256Table is a table of the first 16 multiples of a point. Points are stored
+// at an index offset of -1 so [8]P is at index 7, P is at 0, and [16]P is at 15.
+// [0]P is the point at infinity and it's not stored.
+type p256Table [16]P256Point
+
+// p256Select sets res to the point at index idx in the table.
+// idx must be in [0, 15]. It executes in constant time.
 //
 //go:noescape
-func p256BigToLittle(res []uint64, in []byte)
+func p256Select(res *P256Point, table *p256Table, idx int)
 
-//go:noescape
-func p256LittleToBig(res []byte, in []uint64)
+// p256AffinePoint is a point in affine coordinates (x, y). x and y are still
+// Montgomery domain elements. The point can't be the point at infinity.
+type p256AffinePoint struct {
+	x, y p256Element
+}
 
-// Constant time table access
+// p256AffineTable is a table of the first 32 multiples of a point. Points are
+// stored at an index offset of -1 like in p256Table, and [0]P is not stored.
+type p256AffineTable [32]p256AffinePoint
+
+// p256Precomputed is a series of precomputed multiples of G, the canonical
+// generator. The first p256AffineTable contains multiples of G. The second one
+// multiples of [2⁶]G, the third one of [2¹²]G, and so on, where each successive
+// table is the previous table doubled six times. Six is the width of the
+// sliding window used in p256ScalarMult, and having each table already
+// pre-doubled lets us avoid the doublings between windows entirely. This table
+// MUST NOT be modified, as it aliases into p256PrecomputedEmbed below.
+var p256Precomputed *[43]p256AffineTable
+
+//go:embed p256_asm_table.bin
+var p256PrecomputedEmbed string
+
+func init() {
+	p256PrecomputedPtr := (*unsafe.Pointer)(unsafe.Pointer(&p256PrecomputedEmbed))
+	p256Precomputed = (*[43]p256AffineTable)(*p256PrecomputedPtr)
+}
+
+// p256SelectAffine sets res to the point at index idx in the table.
+// idx must be in [0, 31]. It executes in constant time.
 //
 //go:noescape
-func p256Select(point, table []uint64, idx int)
+func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
 
-//go:noescape
-func p256SelectBase(point *[12]uint64, table string, idx int)
-
-// Montgomery multiplication modulo Ord(G)
+// Point addition with an affine point and constant time conditions.
+// If zero is 0, sets res = in2. If sel is 0, sets res = in1.
+// If sign is not 0, sets res = in1 + -in2. Otherwise, sets res = in1 + in2
 //
 //go:noescape
-func p256OrdMul(res, in1, in2 []uint64)
+func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
 
-// Montgomery square modulo Ord(G), repeated n times
+// Point addition. Sets res = in1 + in2. Returns one if the two input points
+// were equal and zero otherwise. If in1 or in2 are the point at infinity, res
+// and the return value are undefined.
 //
 //go:noescape
-func p256OrdSqr(res, in []uint64, n int)
+func p256PointAddAsm(res, in1, in2 *P256Point) int
 
-// Point add with in2 being affine point
-// If sign == 1 -> in2 = -in2
-// If sel == 0 -> res = in1
-// if zero == 0 -> res = in2
+// Point doubling. Sets res = in + in. in can be the point at infinity.
 //
 //go:noescape
-func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
+func p256PointDoubleAsm(res, in *P256Point)
 
-// Point add. Returns one if the two input points were equal and zero
-// otherwise. (Note that, due to the way that the equations work out, some
-// representations of ∞ are considered equal to everything by this function.)
+// p256OrdElement is a P-256 scalar field element in [0, ord(G)-1] in the
+// Montgomery domain (with R 2²⁵⁶) as four uint64 limbs in little-endian order.
+type p256OrdElement [4]uint64
+
+// Montgomery multiplication modulo org(G). Sets res = in1 * in2 * R⁻¹.
 //
 //go:noescape
-func p256PointAddAsm(res, in1, in2 []uint64) int
+func p256OrdMul(res, in1, in2 *p256OrdElement)
 
-// Point double
+// Montgomery square modulo org(G), repeated n times (n >= 1).
 //
 //go:noescape
-func p256PointDoubleAsm(res, in []uint64)
+func p256OrdSqr(res, in *p256OrdElement, n int)
 
 func P256OrdInverse(k []byte) ([]byte, error) {
-	// TODO: test for values p <= x < 2^256.
 	if len(k) != 32 {
 		return nil, errors.New("invalid scalar length")
 	}
 
-	// table will store precomputed powers of x.
-	var table [4 * 9]uint64
-	var (
-		_1      = table[4*0 : 4*1]
-		_11     = table[4*1 : 4*2]
-		_101    = table[4*2 : 4*3]
-		_111    = table[4*3 : 4*4]
-		_1111   = table[4*4 : 4*5]
-		_10101  = table[4*5 : 4*6]
-		_101111 = table[4*6 : 4*7]
-		x       = table[4*7 : 4*8]
-		t       = table[4*8 : 4*9]
-	)
+	x := new(p256OrdElement)
+	p256OrdBigToLittle(x, (*[32]byte)(k))
+
+	// Inversion is implemented as exponentiation by n - 2, per Fermat's little theorem.
+	//
+	// The sequence of 38 multiplications and 254 squarings is derived from
+	// https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion
+	_1 := new(p256OrdElement)
+	_11 := new(p256OrdElement)
+	_101 := new(p256OrdElement)
+	_111 := new(p256OrdElement)
+	_1111 := new(p256OrdElement)
+	_10101 := new(p256OrdElement)
+	_101111 := new(p256OrdElement)
+	t := new(p256OrdElement)
+
+	// This code operates in the Montgomery domain where R = 2²⁵⁶ mod n and n is
+	// the order of the scalar field. Elements in the Montgomery domain take the
+	// form a×R and p256OrdMul calculates (a × b × R⁻¹) mod n. RR is R in the
+	// domain, or R×R mod n, thus p256OrdMul(x, RR) gives x×R, i.e. converts x
+	// into the Montgomery domain.
+	RR := &p256OrdElement{0x83244c95be79eea2, 0x4699799c49bd6fa6,
+		0x2845b2392b6bec59, 0x66e12d94f3d95620}
 
-	p256BigToLittle(x, k)
-	// This code operates in the Montgomery domain where R = 2^256 mod n
-	// and n is the order of the scalar field. (See initP256 for the
-	// value.) Elements in the Montgomery domain take the form a×R and
-	// multiplication of x and y in the calculates (x × y × R^-1) mod n. RR
-	// is R×R mod n thus the Montgomery multiplication x and RR gives x×R,
-	// i.e. converts x into the Montgomery domain.
-	// Window values borrowed from https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion
-	RR := []uint64{0x83244c95be79eea2, 0x4699799c49bd6fa6, 0x2845b2392b6bec59, 0x66e12d94f3d95620}
 	p256OrdMul(_1, x, RR)      // _1
 	p256OrdSqr(x, _1, 1)       // _10
 	p256OrdMul(_11, x, _1)     // _11
@@ -289,13 +348,13 @@ func P256OrdInverse(k []byte) ([]byte, error) {
 	p256OrdSqr(x, x, 32)
 	p256OrdMul(x, x, t)
 
-	sqrs := []uint8{
+	sqrs := []int{
 		6, 5, 4, 5, 5,
 		4, 3, 3, 5, 9,
 		6, 2, 5, 6, 5,
 		4, 5, 5, 3, 10,
 		2, 5, 5, 3, 7, 6}
-	muls := [][]uint64{
+	muls := []*p256OrdElement{
 		_101111, _111, _11, _1111, _10101,
 		_101, _101, _101, _111, _101111,
 		_1111, _1, _1, _1111, _111,
@@ -303,42 +362,37 @@ func P256OrdInverse(k []byte) ([]byte, error) {
 		_11, _11, _11, _1, _10101, _1111}
 
 	for i, s := range sqrs {
-		p256OrdSqr(x, x, int(s))
+		p256OrdSqr(x, x, s)
 		p256OrdMul(x, x, muls[i])
 	}
 
-	// Multiplying by one in the Montgomery domain converts a Montgomery
-	// value out of the domain.
-	one := []uint64{1, 0, 0, 0}
+	// Montgomery multiplication by R⁻¹, or 1 outside the domain as R⁻¹×R = 1,
+	// converts a Montgomery value out of the domain.
+	one := &p256OrdElement{1}
 	p256OrdMul(x, x, one)
 
-	xOut := make([]byte, 32)
-	p256LittleToBig(xOut, x)
-	return xOut, nil
+	var xOut [32]byte
+	p256OrdLittleToBig(&xOut, x)
+	return xOut[:], nil
 }
 
-// p256Mul operates in a Montgomery domain with R = 2^256 mod p, where p is the
-// underlying field of the curve. (See initP256 for the value.) Thus rr here is
-// R×R mod p. See comment in Inverse about how this is used.
-var rr = []uint64{0x0000000000000003, 0xfffffffbffffffff, 0xfffffffffffffffe, 0x00000004fffffffd}
-
 // Add sets q = p1 + p2, and returns q. The points may overlap.
 func (q *P256Point) Add(r1, r2 *P256Point) *P256Point {
 	var sum, double P256Point
 	r1IsInfinity := r1.isInfinity()
 	r2IsInfinity := r2.isInfinity()
-	pointsEqual := p256PointAddAsm(sum.xyz[:], r1.xyz[:], r2.xyz[:])
-	p256PointDoubleAsm(double.xyz[:], r1.xyz[:])
-	sum.Select(&double, &sum, pointsEqual)
-	sum.Select(r1, &sum, r2IsInfinity)
-	sum.Select(r2, &sum, r1IsInfinity)
+	pointsEqual := p256PointAddAsm(&sum, r1, r2)
+	p256PointDoubleAsm(&double, r1)
+	p256MovCond(&sum, &double, &sum, pointsEqual)
+	p256MovCond(&sum, r1, &sum, r2IsInfinity)
+	p256MovCond(&sum, r2, &sum, r1IsInfinity)
 	return q.Set(&sum)
 }
 
 // Double sets q = p + p, and returns q. The points may overlap.
 func (q *P256Point) Double(p *P256Point) *P256Point {
 	var double P256Point
-	p256PointDoubleAsm(double.xyz[:], p.xyz[:])
+	p256PointDoubleAsm(&double, p)
 	return q.Set(&double)
 }
 
@@ -346,12 +400,11 @@ func (q *P256Point) Double(p *P256Point) *P256Point {
 // endian value, and returns r. If scalar is not 32 bytes long, ScalarBaseMult
 // returns an error and the receiver is unchanged.
 func (r *P256Point) ScalarBaseMult(scalar []byte) (*P256Point, error) {
-	// TODO: test for values p <= x < 2^256.
 	if len(scalar) != 32 {
 		return nil, errors.New("invalid scalar length")
 	}
-	scalarReversed := make([]uint64, 4)
-	p256BigToLittle(scalarReversed, scalar)
+	scalarReversed := new(p256OrdElement)
+	p256OrdBigToLittle(scalarReversed, (*[32]byte)(scalar))
 
 	r.p256BaseMult(scalarReversed)
 	return r, nil
@@ -361,12 +414,11 @@ func (r *P256Point) ScalarBaseMult(scalar []byte) (*P256Point, error) {
 // and returns r. If scalar is not 32 bytes long, ScalarBaseMult returns an
 // error and the receiver is unchanged.
 func (r *P256Point) ScalarMult(q *P256Point, scalar []byte) (*P256Point, error) {
-	// TODO: test for values p <= x < 2^256.
 	if len(scalar) != 32 {
 		return nil, errors.New("invalid scalar length")
 	}
-	scalarReversed := make([]uint64, 4)
-	p256BigToLittle(scalarReversed, scalar)
+	scalarReversed := new(p256OrdElement)
+	p256OrdBigToLittle(scalarReversed, (*[32]byte)(scalar))
 
 	r.Set(q).p256ScalarMult(scalarReversed)
 	return r, nil
@@ -384,9 +436,18 @@ func uint64IsZero(x uint64) int {
 	return int(x & 1)
 }
 
+// p256Equal returns 1 if a and b are equal and 0 otherwise.
+func p256Equal(a, b *p256Element) int {
+	var acc uint64
+	for i := range a {
+		acc |= a[i] ^ b[i]
+	}
+	return uint64IsZero(acc)
+}
+
 // isInfinity returns 1 if p is the point at infinity and 0 otherwise.
 func (p *P256Point) isInfinity() int {
-	return uint64IsZero(p.xyz[8] | p.xyz[9] | p.xyz[10] | p.xyz[11])
+	return p256Equal(&p.z, &p256Zero)
 }
 
 // Bytes returns the uncompressed or infinity encoding of p, as specified in
@@ -405,82 +466,83 @@ func (p *P256Point) bytes(out *[p256UncompressedLength]byte) []byte {
 		return out[:1]
 	}
 
-	zInv := make([]uint64, 4)
-	zInvSq := make([]uint64, 4)
-	p256Inverse(zInv, p.xyz[8:12])
+	zInv := new(p256Element)
+	zInvSq := new(p256Element)
+	p256Inverse(zInv, &p.z)
 	p256Sqr(zInvSq, zInv, 1)
 	p256Mul(zInv, zInv, zInvSq)
 
-	p256Mul(zInvSq, p.xyz[0:4], zInvSq)
-	p256Mul(zInv, p.xyz[4:8], zInv)
+	p256Mul(zInvSq, &p.x, zInvSq)
+	p256Mul(zInv, &p.y, zInv)
 
 	p256FromMont(zInvSq, zInvSq)
 	p256FromMont(zInv, zInv)
 
 	out[0] = 4 // Uncompressed form.
-	p256LittleToBig(out[1:33], zInvSq)
-	p256LittleToBig(out[33:65], zInv)
+	p256LittleToBig((*[32]byte)(out[1:33]), zInvSq)
+	p256LittleToBig((*[32]byte)(out[33:65]), zInv)
 
 	return out[:]
 }
 
 // Select sets q to p1 if cond == 1, and to p2 if cond == 0.
 func (q *P256Point) Select(p1, p2 *P256Point, cond int) *P256Point {
-	p256MovCond(q.xyz[:], p1.xyz[:], p2.xyz[:], cond)
+	p256MovCond(q, p1, p2, cond)
 	return q
 }
 
-// p256Inverse sets out to in^-1 mod p.
-func p256Inverse(out, in []uint64) {
-	var stack [6 * 4]uint64
-	p2 := stack[4*0 : 4*0+4]
-	p4 := stack[4*1 : 4*1+4]
-	p8 := stack[4*2 : 4*2+4]
-	p16 := stack[4*3 : 4*3+4]
-	p32 := stack[4*4 : 4*4+4]
+// p256Inverse sets out to in⁻¹ mod p. If in is zero, out will be zero.
+func p256Inverse(out, in *p256Element) {
+	// Inversion is calculated through exponentiation by p - 2, per Fermat's
+	// little theorem.
+	//
+	// The sequence of 12 multiplications and 255 squarings is derived from the
+	// following addition chain generated with github.com/mmcloughlin/addchain
+	// v0.4.0.
+	//
+	//  _10     = 2*1
+	//  _11     = 1 + _10
+	//  _110    = 2*_11
+	//  _111    = 1 + _110
+	//  _111000 = _111 << 3
+	//  _111111 = _111 + _111000
+	//  x12     = _111111 << 6 + _111111
+	//  x15     = x12 << 3 + _111
+	//  x16     = 2*x15 + 1
+	//  x32     = x16 << 16 + x16
+	//  i53     = x32 << 15
+	//  x47     = x15 + i53
+	//  i263    = ((i53 << 17 + 1) << 143 + x47) << 47
+	//  return    (x47 + i263) << 2 + 1
+	//
+	var z = new(p256Element)
+	var t0 = new(p256Element)
+	var t1 = new(p256Element)
 
-	p256Sqr(out, in, 1)
-	p256Mul(p2, out, in) // 3*p
-
-	p256Sqr(out, p2, 2)
-	p256Mul(p4, out, p2) // f*p
-
-	p256Sqr(out, p4, 4)
-	p256Mul(p8, out, p4) // ff*p
-
-	p256Sqr(out, p8, 8)
-	p256Mul(p16, out, p8) // ffff*p
-
-	p256Sqr(out, p16, 16)
-	p256Mul(p32, out, p16) // ffffffff*p
-
-	p256Sqr(out, p32, 32)
-	p256Mul(out, out, in)
-
-	p256Sqr(out, out, 128)
-	p256Mul(out, out, p32)
-
-	p256Sqr(out, out, 32)
-	p256Mul(out, out, p32)
-
-	p256Sqr(out, out, 16)
-	p256Mul(out, out, p16)
-
-	p256Sqr(out, out, 8)
-	p256Mul(out, out, p8)
-
-	p256Sqr(out, out, 4)
-	p256Mul(out, out, p4)
-
-	p256Sqr(out, out, 2)
-	p256Mul(out, out, p2)
-
-	p256Sqr(out, out, 2)
-	p256Mul(out, out, in)
-}
-
-func (p *P256Point) p256StorePoint(r *[16 * 4 * 3]uint64, index int) {
-	copy(r[index*12:], p.xyz[:])
+	p256Sqr(z, in, 1)
+	p256Mul(z, in, z)
+	p256Sqr(z, z, 1)
+	p256Mul(z, in, z)
+	p256Sqr(t0, z, 3)
+	p256Mul(t0, z, t0)
+	p256Sqr(t1, t0, 6)
+	p256Mul(t0, t0, t1)
+	p256Sqr(t0, t0, 3)
+	p256Mul(z, z, t0)
+	p256Sqr(t0, z, 1)
+	p256Mul(t0, in, t0)
+	p256Sqr(t1, t0, 16)
+	p256Mul(t0, t0, t1)
+	p256Sqr(t0, t0, 15)
+	p256Mul(z, z, t0)
+	p256Sqr(t0, t0, 17)
+	p256Mul(t0, in, t0)
+	p256Sqr(t0, t0, 143)
+	p256Mul(t0, z, t0)
+	p256Sqr(t0, t0, 47)
+	p256Mul(z, z, t0)
+	p256Sqr(z, z, 2)
+	p256Mul(out, in, z)
 }
 
 func boothW5(in uint) (int, int) {
@@ -499,24 +561,14 @@ func boothW6(in uint) (int, int) {
 	return int(d), int(s & 1)
 }
 
-func (p *P256Point) p256BaseMult(scalar []uint64) {
+func (p *P256Point) p256BaseMult(scalar *p256OrdElement) {
+	var t0 p256AffinePoint
+
 	wvalue := (scalar[0] << 1) & 0x7f
 	sel, sign := boothW6(uint(wvalue))
-	p256SelectBase(&p.xyz, p256Precomputed, sel)
-	p256NegCond(p.xyz[4:8], sign)
-
-	// (This is one, in the Montgomery domain.)
-	p.xyz[8] = 0x0000000000000001
-	p.xyz[9] = 0xffffffff00000000
-	p.xyz[10] = 0xffffffffffffffff
-	p.xyz[11] = 0x00000000fffffffe
-
-	var t0 P256Point
-	// (This is one, in the Montgomery domain.)
-	t0.xyz[8] = 0x0000000000000001
-	t0.xyz[9] = 0xffffffff00000000
-	t0.xyz[10] = 0xffffffffffffffff
-	t0.xyz[11] = 0x00000000fffffffe
+	p256SelectAffine(&t0, &p256Precomputed[0], sel)
+	p.x, p.y, p.z = t0.x, t0.y, p256One
+	p256NegCond(&p.y, sign)
 
 	index := uint(5)
 	zero := sel
@@ -529,59 +581,59 @@ func (p *P256Point) p256BaseMult(scalar []uint64) {
 		}
 		index += 6
 		sel, sign = boothW6(uint(wvalue))
-		p256SelectBase(&t0.xyz, p256Precomputed[i*32*8*8:], sel)
-		p256PointAddAffineAsm(p.xyz[0:12], p.xyz[0:12], t0.xyz[0:8], sign, sel, zero)
+		p256SelectAffine(&t0, &p256Precomputed[i], sel)
+		p256PointAddAffineAsm(p, p, &t0, sign, sel, zero)
 		zero |= sel
 	}
 
 	// If the whole scalar was zero, set to the point at infinity.
-	p256MovCond(p.xyz[:], NewP256Point().xyz[:], p.xyz[:], uint64IsZero(uint64(zero)))
+	p256MovCond(p, p, NewP256Point(), zero)
 }
 
-func (p *P256Point) p256ScalarMult(scalar []uint64) {
+func (p *P256Point) p256ScalarMult(scalar *p256OrdElement) {
 	// precomp is a table of precomputed points that stores powers of p
 	// from p^1 to p^16.
-	var precomp [16 * 4 * 3]uint64
+	var precomp p256Table
 	var t0, t1, t2, t3 P256Point
 
 	// Prepare the table
-	p.p256StorePoint(&precomp, 0) // 1
+	precomp[0] = *p // 1
 
-	p256PointDoubleAsm(t0.xyz[:], p.xyz[:])
-	p256PointDoubleAsm(t1.xyz[:], t0.xyz[:])
-	p256PointDoubleAsm(t2.xyz[:], t1.xyz[:])
-	p256PointDoubleAsm(t3.xyz[:], t2.xyz[:])
-	t0.p256StorePoint(&precomp, 1)  // 2
-	t1.p256StorePoint(&precomp, 3)  // 4
-	t2.p256StorePoint(&precomp, 7)  // 8
-	t3.p256StorePoint(&precomp, 15) // 16
+	p256PointDoubleAsm(&t0, p)
+	p256PointDoubleAsm(&t1, &t0)
+	p256PointDoubleAsm(&t2, &t1)
+	p256PointDoubleAsm(&t3, &t2)
+	precomp[1] = t0  // 2
+	precomp[3] = t1  // 4
+	precomp[7] = t2  // 8
+	precomp[15] = t3 // 16
 
-	p256PointAddAsm(t0.xyz[:], t0.xyz[:], p.xyz[:])
-	p256PointAddAsm(t1.xyz[:], t1.xyz[:], p.xyz[:])
-	p256PointAddAsm(t2.xyz[:], t2.xyz[:], p.xyz[:])
-	t0.p256StorePoint(&precomp, 2) // 3
-	t1.p256StorePoint(&precomp, 4) // 5
-	t2.p256StorePoint(&precomp, 8) // 9
+	p256PointAddAsm(&t0, &t0, p)
+	p256PointAddAsm(&t1, &t1, p)
+	p256PointAddAsm(&t2, &t2, p)
+	precomp[2] = t0 // 3
+	precomp[4] = t1 // 5
+	precomp[8] = t2 // 9
 
-	p256PointDoubleAsm(t0.xyz[:], t0.xyz[:])
-	p256PointDoubleAsm(t1.xyz[:], t1.xyz[:])
-	t0.p256StorePoint(&precomp, 5) // 6
-	t1.p256StorePoint(&precomp, 9) // 10
+	p256PointDoubleAsm(&t0, &t0)
+	p256PointDoubleAsm(&t1, &t1)
+	precomp[5] = t0 // 6
+	precomp[9] = t1 // 10
 
-	p256PointAddAsm(t2.xyz[:], t0.xyz[:], p.xyz[:])
-	p256PointAddAsm(t1.xyz[:], t1.xyz[:], p.xyz[:])
-	t2.p256StorePoint(&precomp, 6)  // 7
-	t1.p256StorePoint(&precomp, 10) // 11
+	p256PointAddAsm(&t2, &t0, p)
+	p256PointAddAsm(&t1, &t1, p)
+	precomp[6] = t2  // 7
+	precomp[10] = t1 // 11
 
-	p256PointDoubleAsm(t0.xyz[:], t0.xyz[:])
-	p256PointDoubleAsm(t2.xyz[:], t2.xyz[:])
-	t0.p256StorePoint(&precomp, 11) // 12
-	t2.p256StorePoint(&precomp, 13) // 14
+	p256PointDoubleAsm(&t0, &t0)
+	p256PointDoubleAsm(&t2, &t2)
+	precomp[11] = t0 // 12
+	precomp[13] = t2 // 14
 
-	p256PointAddAsm(t0.xyz[:], t0.xyz[:], p.xyz[:])
-	p256PointAddAsm(t2.xyz[:], t2.xyz[:], p.xyz[:])
-	t0.p256StorePoint(&precomp, 12) // 13
-	t2.p256StorePoint(&precomp, 14) // 15
+	p256PointAddAsm(&t0, &t0, p)
+	p256PointAddAsm(&t2, &t2, p)
+	precomp[12] = t0 // 13
+	precomp[14] = t2 // 15
 
 	// Start scanning the window from top bit
 	index := uint(254)
@@ -590,16 +642,16 @@ func (p *P256Point) p256ScalarMult(scalar []uint64) {
 	wvalue := (scalar[index/64] >> (index % 64)) & 0x3f
 	sel, _ = boothW5(uint(wvalue))
 
-	p256Select(p.xyz[0:12], precomp[0:], sel)
+	p256Select(p, &precomp, sel)
 	zero := sel
 
 	for index > 4 {
 		index -= 5
-		p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-		p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-		p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-		p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-		p256PointDoubleAsm(p.xyz[:], p.xyz[:])
+		p256PointDoubleAsm(p, p)
+		p256PointDoubleAsm(p, p)
+		p256PointDoubleAsm(p, p)
+		p256PointDoubleAsm(p, p)
+		p256PointDoubleAsm(p, p)
 
 		if index < 192 {
 			wvalue = ((scalar[index/64] >> (index % 64)) + (scalar[index/64+1] << (64 - (index % 64)))) & 0x3f
@@ -609,26 +661,26 @@ func (p *P256Point) p256ScalarMult(scalar []uint64) {
 
 		sel, sign = boothW5(uint(wvalue))
 
-		p256Select(t0.xyz[0:], precomp[0:], sel)
-		p256NegCond(t0.xyz[4:8], sign)
-		p256PointAddAsm(t1.xyz[:], p.xyz[:], t0.xyz[:])
-		p256MovCond(t1.xyz[0:12], t1.xyz[0:12], p.xyz[0:12], sel)
-		p256MovCond(p.xyz[0:12], t1.xyz[0:12], t0.xyz[0:12], zero)
+		p256Select(&t0, &precomp, sel)
+		p256NegCond(&t0.y, sign)
+		p256PointAddAsm(&t1, p, &t0)
+		p256MovCond(&t1, &t1, p, sel)
+		p256MovCond(p, &t1, &t0, zero)
 		zero |= sel
 	}
 
-	p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-	p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-	p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-	p256PointDoubleAsm(p.xyz[:], p.xyz[:])
-	p256PointDoubleAsm(p.xyz[:], p.xyz[:])
+	p256PointDoubleAsm(p, p)
+	p256PointDoubleAsm(p, p)
+	p256PointDoubleAsm(p, p)
+	p256PointDoubleAsm(p, p)
+	p256PointDoubleAsm(p, p)
 
 	wvalue = (scalar[0] << 1) & 0x3f
 	sel, sign = boothW5(uint(wvalue))
 
-	p256Select(t0.xyz[0:], precomp[0:], sel)
-	p256NegCond(t0.xyz[4:8], sign)
-	p256PointAddAsm(t1.xyz[:], p.xyz[:], t0.xyz[:])
-	p256MovCond(t1.xyz[0:12], t1.xyz[0:12], p.xyz[0:12], sel)
-	p256MovCond(p.xyz[0:12], t1.xyz[0:12], t0.xyz[0:12], zero)
+	p256Select(&t0, &precomp, sel)
+	p256NegCond(&t0.y, sign)
+	p256PointAddAsm(&t1, p, &t0)
+	p256MovCond(&t1, &t1, p, sel)
+	p256MovCond(p, &t1, &t0, zero)
 }
diff --git a/src/crypto/elliptic/internal/nistec/p256_asm_amd64.s b/src/crypto/elliptic/internal/nistec/p256_asm_amd64.s
index bd16add2417..84e4cee9039 100644
--- a/src/crypto/elliptic/internal/nistec/p256_asm_amd64.s
+++ b/src/crypto/elliptic/internal/nistec/p256_asm_amd64.s
@@ -42,14 +42,22 @@ GLOBL p256ord<>(SB), 8, $32
 GLOBL p256one<>(SB), 8, $32
 
 /* ---------------------------------------*/
-// func p256LittleToBig(res []byte, in []uint64)
+// func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
+TEXT ·p256OrdLittleToBig(SB),NOSPLIT,$0
+	JMP ·p256BigToLittle(SB)
+/* ---------------------------------------*/
+// func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
+TEXT ·p256OrdBigToLittle(SB),NOSPLIT,$0
+	JMP ·p256BigToLittle(SB)
+/* ---------------------------------------*/
+// func p256LittleToBig(res *[32]byte, in *p256Element)
 TEXT ·p256LittleToBig(SB),NOSPLIT,$0
 	JMP ·p256BigToLittle(SB)
 /* ---------------------------------------*/
-// func p256BigToLittle(res []uint64, in []byte)
+// func p256BigToLittle(res *p256Element, in *[32]byte)
 TEXT ·p256BigToLittle(SB),NOSPLIT,$0
 	MOVQ res+0(FP), res_ptr
-	MOVQ in+24(FP), x_ptr
+	MOVQ in+8(FP), x_ptr
 
 	MOVQ (8*0)(x_ptr), acc0
 	MOVQ (8*1)(x_ptr), acc1
@@ -68,13 +76,12 @@ TEXT ·p256BigToLittle(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// func p256MovCond(res, a, b []uint64, cond int)
-// If cond == 0 res=b, else res=a
+// func p256MovCond(res, a, b *P256Point, cond int)
 TEXT ·p256MovCond(SB),NOSPLIT,$0
 	MOVQ res+0(FP), res_ptr
-	MOVQ a+24(FP), x_ptr
-	MOVQ b+48(FP), y_ptr
-	MOVQ cond+72(FP), X12
+	MOVQ a+8(FP), x_ptr
+	MOVQ b+16(FP), y_ptr
+	MOVQ cond+24(FP), X12
 
 	PXOR X13, X13
 	PSHUFD $0, X12, X12
@@ -129,10 +136,10 @@ TEXT ·p256MovCond(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// func p256NegCond(val []uint64, cond int)
+// func p256NegCond(val *p256Element, cond int)
 TEXT ·p256NegCond(SB),NOSPLIT,$0
 	MOVQ val+0(FP), res_ptr
-	MOVQ cond+24(FP), t0
+	MOVQ cond+8(FP), t0
 	// acc = poly
 	MOVQ $-1, acc0
 	MOVQ p256const0<>(SB), acc1
@@ -162,11 +169,11 @@ TEXT ·p256NegCond(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// func p256Sqr(res, in []uint64, n int)
+// func p256Sqr(res, in *p256Element, n int)
 TEXT ·p256Sqr(SB),NOSPLIT,$0
 	MOVQ res+0(FP), res_ptr
-	MOVQ in+24(FP), x_ptr
-	MOVQ n+48(FP), BX
+	MOVQ in+8(FP), x_ptr
+	MOVQ n+16(FP), BX
 
 sqrLoop:
 
@@ -326,11 +333,11 @@ sqrLoop:
 
 	RET
 /* ---------------------------------------*/
-// func p256Mul(res, in1, in2 []uint64)
+// func p256Mul(res, in1, in2 *p256Element)
 TEXT ·p256Mul(SB),NOSPLIT,$0
 	MOVQ res+0(FP), res_ptr
-	MOVQ in1+24(FP), x_ptr
-	MOVQ in2+48(FP), y_ptr
+	MOVQ in1+8(FP), x_ptr
+	MOVQ in2+16(FP), y_ptr
 	// x * y[0]
 	MOVQ (8*0)(y_ptr), t0
 
@@ -524,10 +531,10 @@ TEXT ·p256Mul(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// func p256FromMont(res, in []uint64)
+// func p256FromMont(res, in *p256Element)
 TEXT ·p256FromMont(SB),NOSPLIT,$0
 	MOVQ res+0(FP), res_ptr
-	MOVQ in+24(FP), x_ptr
+	MOVQ in+8(FP), x_ptr
 
 	MOVQ (8*0)(x_ptr), acc0
 	MOVQ (8*1)(x_ptr), acc1
@@ -602,14 +609,11 @@ TEXT ·p256FromMont(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// Constant time point access to arbitrary point table.
-// Indexed from 1 to 15, with -1 offset
-// (index 0 is implicitly point at infinity)
-// func p256Select(point, table []uint64, idx int)
+// func p256Select(res *P256Point, table *p256Table, idx int)
 TEXT ·p256Select(SB),NOSPLIT,$0
-	MOVQ idx+48(FP),AX
-	MOVQ table+24(FP),DI
-	MOVQ point+0(FP),DX
+	MOVQ idx+16(FP),AX
+	MOVQ table+8(FP),DI
+	MOVQ res+0(FP),DX
 
 	PXOR X15, X15	// X15 = 0
 	PCMPEQL X14, X14 // X14 = -1
@@ -667,12 +671,11 @@ loop_select:
 
 	RET
 /* ---------------------------------------*/
-// Constant time point access to base point table.
-// func p256SelectBase(point *[12]uint64, table string, idx int)
-TEXT ·p256SelectBase(SB),NOSPLIT,$0
-	MOVQ idx+24(FP),AX
+// func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
+TEXT ·p256SelectAffine(SB),NOSPLIT,$0
+	MOVQ idx+16(FP),AX
 	MOVQ table+8(FP),DI
-	MOVQ point+0(FP),DX
+	MOVQ res+0(FP),DX
 
 	PXOR X15, X15	// X15 = 0
 	PCMPEQL X14, X14 // X14 = -1
@@ -740,11 +743,11 @@ loop_select_base:
 
 	RET
 /* ---------------------------------------*/
-// func p256OrdMul(res, in1, in2 []uint64)
+// func p256OrdMul(res, in1, in2 *p256OrdElement)
 TEXT ·p256OrdMul(SB),NOSPLIT,$0
 	MOVQ res+0(FP), res_ptr
-	MOVQ in1+24(FP), x_ptr
-	MOVQ in2+48(FP), y_ptr
+	MOVQ in1+8(FP), x_ptr
+	MOVQ in2+16(FP), y_ptr
 	// x * y[0]
 	MOVQ (8*0)(y_ptr), t0
 
@@ -1027,11 +1030,11 @@ TEXT ·p256OrdMul(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// func p256OrdSqr(res, in []uint64, n int)
+// func p256OrdSqr(res, in *p256OrdElement, n int)
 TEXT ·p256OrdSqr(SB),NOSPLIT,$0
 	MOVQ res+0(FP), res_ptr
-	MOVQ in+24(FP), x_ptr
-	MOVQ n+48(FP), BX
+	MOVQ in+8(FP), x_ptr
+	MOVQ n+16(FP), BX
 
 ordSqrLoop:
 
@@ -1729,15 +1732,15 @@ TEXT p256SqrInternal(SB),NOSPLIT,$8
 #define sel_save  (32*15 + 8)(SP)
 #define zero_save (32*15 + 8 + 4)(SP)
 
-// func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
-TEXT ·p256PointAddAffineAsm(SB),0,$512-96
+// func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
+TEXT ·p256PointAddAffineAsm(SB),0,$512-48
 	// Move input to stack in order to free registers
 	MOVQ res+0(FP), AX
-	MOVQ in1+24(FP), BX
-	MOVQ in2+48(FP), CX
-	MOVQ sign+72(FP), DX
-	MOVQ sel+80(FP), t1
-	MOVQ zero+88(FP), t2
+	MOVQ in1+8(FP), BX
+	MOVQ in2+16(FP), CX
+	MOVQ sign+24(FP), DX
+	MOVQ sel+32(FP), t1
+	MOVQ zero+40(FP), t2
 
 	MOVOU (16*0)(BX), X0
 	MOVOU (16*1)(BX), X1
@@ -2041,13 +2044,13 @@ TEXT p256IsZero(SB),NOSPLIT,$0
 #define rptr       (32*20)(SP)
 #define points_eq  (32*20+8)(SP)
 
-//func p256PointAddAsm(res, in1, in2 []uint64) int
-TEXT ·p256PointAddAsm(SB),0,$680-80
+//func p256PointAddAsm(res, in1, in2 *P256Point) int
+TEXT ·p256PointAddAsm(SB),0,$680-32
 	// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
 	// Move input to stack in order to free registers
 	MOVQ res+0(FP), AX
-	MOVQ in1+24(FP), BX
-	MOVQ in2+48(FP), CX
+	MOVQ in1+8(FP), BX
+	MOVQ in2+16(FP), CX
 
 	MOVOU (16*0)(BX), X0
 	MOVOU (16*1)(BX), X1
@@ -2186,7 +2189,7 @@ TEXT ·p256PointAddAsm(SB),0,$680-80
 	MOVOU X5, (16*5)(AX)
 
 	MOVQ points_eq, AX
-	MOVQ AX, ret+72(FP)
+	MOVQ AX, ret+24(FP)
 
 	RET
 #undef x1in
@@ -2221,11 +2224,11 @@ TEXT ·p256PointAddAsm(SB),0,$680-80
 #define tmp(off)  (32*6 + off)(SP)
 #define rptr	  (32*7)(SP)
 
-//func p256PointDoubleAsm(res, in []uint64)
-TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$256-48
+//func p256PointDoubleAsm(res, in *P256Point)
+TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$256-16
 	// Move input to stack in order to free registers
 	MOVQ res+0(FP), AX
-	MOVQ in+24(FP), BX
+	MOVQ in+8(FP), BX
 
 	MOVOU (16*0)(BX), X0
 	MOVOU (16*1)(BX), X1
diff --git a/src/crypto/elliptic/internal/nistec/p256_asm_arm64.s b/src/crypto/elliptic/internal/nistec/p256_asm_arm64.s
index 2b2355d57cf..1ba5df381b3 100644
--- a/src/crypto/elliptic/internal/nistec/p256_asm_arm64.s
+++ b/src/crypto/elliptic/internal/nistec/p256_asm_arm64.s
@@ -64,14 +64,22 @@ GLOBL p256ord<>(SB), 8, $32
 GLOBL p256one<>(SB), 8, $32
 
 /* ---------------------------------------*/
-// func p256LittleToBig(res []byte, in []uint64)
+// func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
+TEXT ·p256OrdLittleToBig(SB),NOSPLIT,$0
+	JMP	·p256BigToLittle(SB)
+/* ---------------------------------------*/
+// func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
+TEXT ·p256OrdBigToLittle(SB),NOSPLIT,$0
+	JMP	·p256BigToLittle(SB)
+/* ---------------------------------------*/
+// func p256LittleToBig(res *[32]byte, in *p256Element)
 TEXT ·p256LittleToBig(SB),NOSPLIT,$0
 	JMP	·p256BigToLittle(SB)
 /* ---------------------------------------*/
-// func p256BigToLittle(res []uint64, in []byte)
+// func p256BigToLittle(res *p256Element, in *[32]byte)
 TEXT ·p256BigToLittle(SB),NOSPLIT,$0
 	MOVD	res+0(FP), res_ptr
-	MOVD	in+24(FP), a_ptr
+	MOVD	in+8(FP), a_ptr
 
 	LDP	0*16(a_ptr), (acc0, acc1)
 	LDP	1*16(a_ptr), (acc2, acc3)
@@ -85,13 +93,13 @@ TEXT ·p256BigToLittle(SB),NOSPLIT,$0
 	STP	(acc1, acc0), 1*16(res_ptr)
 	RET
 /* ---------------------------------------*/
-// func p256MovCond(res, a, b []uint64, cond int)
+// func p256MovCond(res, a, b *P256Point, cond int)
 // If cond == 0 res=b, else res=a
 TEXT ·p256MovCond(SB),NOSPLIT,$0
 	MOVD	res+0(FP), res_ptr
-	MOVD	a+24(FP), a_ptr
-	MOVD	b+48(FP), b_ptr
-	MOVD	cond+72(FP), R3
+	MOVD	a+8(FP), a_ptr
+	MOVD	b+16(FP), b_ptr
+	MOVD	cond+24(FP), R3
 
 	CMP	$0, R3
 	// Two remarks:
@@ -131,10 +139,10 @@ TEXT ·p256MovCond(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// func p256NegCond(val []uint64, cond int)
+// func p256NegCond(val *p256Element, cond int)
 TEXT ·p256NegCond(SB),NOSPLIT,$0
 	MOVD	val+0(FP), a_ptr
-	MOVD	cond+24(FP), hlp0
+	MOVD	cond+8(FP), hlp0
 	MOVD	a_ptr, res_ptr
 	// acc = poly
 	MOVD	$-1, acc0
@@ -161,11 +169,11 @@ TEXT ·p256NegCond(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// func p256Sqr(res, in []uint64, n int)
+// func p256Sqr(res, in *p256Element, n int)
 TEXT ·p256Sqr(SB),NOSPLIT,$0
 	MOVD	res+0(FP), res_ptr
-	MOVD	in+24(FP), a_ptr
-	MOVD	n+48(FP), b_ptr
+	MOVD	in+8(FP), a_ptr
+	MOVD	n+16(FP), b_ptr
 
 	MOVD	p256const0<>(SB), const0
 	MOVD	p256const1<>(SB), const1
@@ -186,11 +194,11 @@ sqrLoop:
 	STP	(y2, y3), 1*16(res_ptr)
 	RET
 /* ---------------------------------------*/
-// func p256Mul(res, in1, in2 []uint64)
+// func p256Mul(res, in1, in2 *p256Element)
 TEXT ·p256Mul(SB),NOSPLIT,$0
 	MOVD	res+0(FP), res_ptr
-	MOVD	in1+24(FP), a_ptr
-	MOVD	in2+48(FP), b_ptr
+	MOVD	in1+8(FP), a_ptr
+	MOVD	in2+16(FP), b_ptr
 
 	MOVD	p256const0<>(SB), const0
 	MOVD	p256const1<>(SB), const1
@@ -207,10 +215,10 @@ TEXT ·p256Mul(SB),NOSPLIT,$0
 	STP	(y2, y3), 1*16(res_ptr)
 	RET
 /* ---------------------------------------*/
-// func p256FromMont(res, in []uint64)
+// func p256FromMont(res, in *p256Element)
 TEXT ·p256FromMont(SB),NOSPLIT,$0
 	MOVD	res+0(FP), res_ptr
-	MOVD	in+24(FP), a_ptr
+	MOVD	in+8(FP), a_ptr
 
 	MOVD	p256const0<>(SB), const0
 	MOVD	p256const1<>(SB), const1
@@ -266,14 +274,11 @@ TEXT ·p256FromMont(SB),NOSPLIT,$0
 
 	RET
 /* ---------------------------------------*/
-// Constant time point access to arbitrary point table.
-// Indexed from 1 to 15, with -1 offset
-// (index 0 is implicitly point at infinity)
-// func p256Select(point, table []uint64, idx int)
+// func p256Select(res *P256Point, table *p256Table, idx int)
 TEXT ·p256Select(SB),NOSPLIT,$0
-	MOVD	idx+48(FP), const0
-	MOVD	table+24(FP), b_ptr
-	MOVD	point+0(FP), res_ptr
+	MOVD	idx+16(FP), const0
+	MOVD	table+8(FP), b_ptr
+	MOVD	res+0(FP), res_ptr
 
 	EOR	x0, x0, x0
 	EOR	x1, x1, x1
@@ -323,12 +328,11 @@ loop_select:
 	STP	(t2, t3), 5*16(res_ptr)
 	RET
 /* ---------------------------------------*/
-// Constant time point access to base point table.
-// func p256SelectBase(point *[12]uint64, table string, idx int)
-TEXT ·p256SelectBase(SB),NOSPLIT,$0
-	MOVD	idx+24(FP), t0
-	MOVD	table_base+8(FP), t1
-	MOVD	point+0(FP), res_ptr
+// func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
+TEXT ·p256SelectAffine(SB),NOSPLIT,$0
+	MOVD	idx+16(FP), t0
+	MOVD	table+8(FP), t1
+	MOVD	res+0(FP), res_ptr
 
 	EOR	x0, x0, x0
 	EOR	x1, x1, x1
@@ -366,10 +370,10 @@ loop_select:
 	STP	(y2, y3), 3*16(res_ptr)
 	RET
 /* ---------------------------------------*/
-// func p256OrdSqr(res, in []uint64, n int)
+// func p256OrdSqr(res, in *p256OrdElement, n int)
 TEXT ·p256OrdSqr(SB),NOSPLIT,$0
-	MOVD	in+24(FP), a_ptr
-	MOVD	n+48(FP), b_ptr
+	MOVD	in+8(FP), a_ptr
+	MOVD	n+16(FP), b_ptr
 
 	MOVD	p256ordK0<>(SB), hlp1
 	LDP	p256ord<>+0x00(SB), (const0, const1)
@@ -565,10 +569,10 @@ ordSqrLoop:
 
 	RET
 /* ---------------------------------------*/
-// func p256OrdMul(res, in1, in2 []uint64)
+// func p256OrdMul(res, in1, in2 *p256OrdElement)
 TEXT ·p256OrdMul(SB),NOSPLIT,$0
-	MOVD	in1+24(FP), a_ptr
-	MOVD	in2+48(FP), b_ptr
+	MOVD	in1+8(FP), a_ptr
+	MOVD	in2+16(FP), b_ptr
 
 	MOVD	p256ordK0<>(SB), hlp1
 	LDP	p256ord<>+0x00(SB), (const0, const1)
@@ -1091,13 +1095,13 @@ TEXT p256MulInternal<>(SB),NOSPLIT,$0
 #define u1(off) (32*10 + 8 + off)(RSP)
 #define u2(off) (32*11 + 8 + off)(RSP)
 
-// func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
-TEXT ·p256PointAddAffineAsm(SB),0,$264-96
-	MOVD	in1+24(FP), a_ptr
-	MOVD	in2+48(FP), b_ptr
-	MOVD	sign+72(FP), hlp0
-	MOVD	sel+80(FP), hlp1
-	MOVD	zero+88(FP), t2
+// func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
+TEXT ·p256PointAddAffineAsm(SB),0,$264-48
+	MOVD	in1+8(FP), a_ptr
+	MOVD	in2+16(FP), b_ptr
+	MOVD	sign+24(FP), hlp0
+	MOVD	sel+32(FP), hlp1
+	MOVD	zero+40(FP), t2
 
 	MOVD	$1, t0
 	CMP	$0, t2
@@ -1288,10 +1292,10 @@ TEXT ·p256PointAddAffineAsm(SB),0,$264-96
 #define zsqr(off) (32*2 + 8 + off)(RSP)
 #define tmp(off)  (32*3 + 8 + off)(RSP)
 
-//func p256PointDoubleAsm(res, in []uint64)
-TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-48
+//func p256PointDoubleAsm(res, in *P256Point)
+TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-16
 	MOVD	res+0(FP), res_ptr
-	MOVD	in+24(FP), a_ptr
+	MOVD	in+8(FP), a_ptr
 
 	MOVD	p256const0<>(SB), const0
 	MOVD	p256const1<>(SB), const1
@@ -1388,12 +1392,12 @@ TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-48
 #define x3out(off) (off)(b_ptr)
 #define y3out(off) (off + 32)(b_ptr)
 #define z3out(off) (off + 64)(b_ptr)
-//func p256PointAddAsm(res, in1, in2 []uint64) int
-TEXT ·p256PointAddAsm(SB),0,$392-80
+// func p256PointAddAsm(res, in1, in2 *P256Point) int
+TEXT ·p256PointAddAsm(SB),0,$392-32
 	// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
 	// Move input to stack in order to free registers
-	MOVD	in1+24(FP), a_ptr
-	MOVD	in2+48(FP), b_ptr
+	MOVD	in1+8(FP), a_ptr
+	MOVD	in2+16(FP), b_ptr
 
 	MOVD	p256const0<>(SB), const0
 	MOVD	p256const1<>(SB), const1
@@ -1524,6 +1528,6 @@ TEXT ·p256PointAddAsm(SB),0,$392-80
 	STx(y3out)
 
 	MOVD	hlp1, R0
-	MOVD	R0, ret+72(FP)
+	MOVD	R0, ret+24(FP)
 
 	RET
diff --git a/src/crypto/elliptic/internal/nistec/p256_asm_table_test.go b/src/crypto/elliptic/internal/nistec/p256_asm_table_test.go
index aab39e4ffa3..dc26e4b70b7 100644
--- a/src/crypto/elliptic/internal/nistec/p256_asm_table_test.go
+++ b/src/crypto/elliptic/internal/nistec/p256_asm_table_test.go
@@ -7,58 +7,43 @@
 package nistec
 
 import (
-	"encoding/binary"
-	"reflect"
+	"fmt"
 	"testing"
 )
 
 func TestP256PrecomputedTable(t *testing.T) {
+	base := NewP256Generator()
 
-	basePoint := []uint64{
-		0x79e730d418a9143c, 0x75ba95fc5fedb601, 0x79fb732b77622510, 0x18905f76a53755c6,
-		0xddf25357ce95560a, 0x8b4ab8e4ba19e45c, 0xd2e88688dd21f325, 0x8571ff1825885d85,
-		0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
-	}
-	t1 := make([]uint64, 12)
-	t2 := make([]uint64, 12)
-	copy(t2, basePoint)
+	for i := 0; i < 43; i++ {
+		t.Run(fmt.Sprintf("table[%d]", i), func(t *testing.T) {
+			testP256AffineTable(t, base, &p256Precomputed[i])
+		})
 
-	zInv := make([]uint64, 4)
-	zInvSq := make([]uint64, 4)
-	for j := 0; j < 32; j++ {
-		copy(t1, t2)
-		for i := 0; i < 43; i++ {
-			// The window size is 6 so we need to double 6 times.
-			if i != 0 {
-				for k := 0; k < 6; k++ {
-					p256PointDoubleAsm(t1, t1)
-				}
-			}
-			// Convert the point to affine form. (Its values are
-			// still in Montgomery form however.)
-			p256Inverse(zInv, t1[8:12])
-			p256Sqr(zInvSq, zInv, 1)
-			p256Mul(zInv, zInv, zInvSq)
-
-			p256Mul(t1[:4], t1[:4], zInvSq)
-			p256Mul(t1[4:8], t1[4:8], zInv)
-
-			copy(t1[8:12], basePoint[8:12])
-
-			buf := make([]byte, 8*8)
-			for i, u := range t1[:8] {
-				binary.LittleEndian.PutUint64(buf[i*8:i*8+8], u)
-			}
-			start := i*32*8*8 + j*8*8
-			if got, want := p256Precomputed[start:start+64], string(buf); !reflect.DeepEqual(got, want) {
-				t.Fatalf("Unexpected table entry at [%d][%d:%d]: got %v, want %v", i, j*8, (j*8)+8, got, want)
-			}
-		}
-		if j == 0 {
-			p256PointDoubleAsm(t2, basePoint)
-		} else {
-			p256PointAddAsm(t2, t2, basePoint)
+		for k := 0; k < 6; k++ {
+			base.Double(base)
+		}
+	}
+}
+
+func testP256AffineTable(t *testing.T, base *P256Point, table *p256AffineTable) {
+	p := NewP256Point()
+	zInv := new(p256Element)
+	zInvSq := new(p256Element)
+
+	for j := 0; j < 32; j++ {
+		p.Add(p, base)
+
+		// Convert p to affine coordinates.
+		p256Inverse(zInv, &p.z)
+		p256Sqr(zInvSq, zInv, 1)
+		p256Mul(zInv, zInv, zInvSq)
+
+		p256Mul(&p.x, &p.x, zInvSq)
+		p256Mul(&p.y, &p.y, zInv)
+		p.z = p256One
+
+		if p256Equal(&table[j].x, &p.x) != 1 || p256Equal(&table[j].y, &p.y) != 1 {
+			t.Fatalf("incorrect table entry at index %d", j)
 		}
 	}
-
 }
diff --git a/src/crypto/elliptic/internal/nistec/p256_asm_test.go b/src/crypto/elliptic/internal/nistec/p256_asm_test.go
new file mode 100644
index 00000000000..5d05561b703
--- /dev/null
+++ b/src/crypto/elliptic/internal/nistec/p256_asm_test.go
@@ -0,0 +1,94 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build amd64 || arm64
+
+package nistec_test
+
+import (
+	"bytes"
+	"crypto/elliptic"
+	"crypto/elliptic/internal/nistec"
+	"math/big"
+	"testing"
+)
+
+func TestP256OrdInverse(t *testing.T) {
+	N := elliptic.P256().Params().N
+
+	// inv(0) is expected to be 0.
+	zero := make([]byte, 32)
+	out, err := nistec.P256OrdInverse(zero)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, zero) {
+		t.Error("unexpected output for inv(0)")
+	}
+
+	// inv(N) is also 0 mod N.
+	input := make([]byte, 32)
+	N.FillBytes(input)
+	out, err = nistec.P256OrdInverse(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, zero) {
+		t.Error("unexpected output for inv(N)")
+	}
+	if !bytes.Equal(input, N.Bytes()) {
+		t.Error("input was modified")
+	}
+
+	// Check inv(1) and inv(N+1) against math/big
+	exp := new(big.Int).ModInverse(big.NewInt(1), N).FillBytes(make([]byte, 32))
+	big.NewInt(1).FillBytes(input)
+	out, err = nistec.P256OrdInverse(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, exp) {
+		t.Error("unexpected output for inv(1)")
+	}
+	new(big.Int).Add(N, big.NewInt(1)).FillBytes(input)
+	out, err = nistec.P256OrdInverse(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, exp) {
+		t.Error("unexpected output for inv(N+1)")
+	}
+
+	// Check inv(20) and inv(N+20) against math/big
+	exp = new(big.Int).ModInverse(big.NewInt(20), N).FillBytes(make([]byte, 32))
+	big.NewInt(20).FillBytes(input)
+	out, err = nistec.P256OrdInverse(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, exp) {
+		t.Error("unexpected output for inv(20)")
+	}
+	new(big.Int).Add(N, big.NewInt(20)).FillBytes(input)
+	out, err = nistec.P256OrdInverse(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, exp) {
+		t.Error("unexpected output for inv(N+20)")
+	}
+
+	// Check inv(2^256-1) against math/big
+	bigInput := new(big.Int).Lsh(big.NewInt(1), 256)
+	bigInput.Sub(bigInput, big.NewInt(1))
+	exp = new(big.Int).ModInverse(bigInput, N).FillBytes(make([]byte, 32))
+	bigInput.FillBytes(input)
+	out, err = nistec.P256OrdInverse(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, exp) {
+		t.Error("unexpected output for inv(2^256-1)")
+	}
+}