For performance, don't double/square until we've seen a bit.

src/bls12_381/ec.rs

@@ -475,9 +475,15 @@ macro_rules! curve_impl {
             fn mul_assign<S: Into<<Self::Scalar as PrimeField>::Repr>>(&mut self, other: S) {
                 let mut res = Self::zero();
 
+                let mut found_one = false;
+
                 for i in BitIterator::new(other.into())
                 {
-                    res.double();
+                    if found_one {
+                        res.double();
+                    } else {
+                        found_one = i;
+                    }
 
                     if i {
                         res.add_assign(self);

src/lib.rs

@@ -219,8 +219,15 @@ pub trait Field: Sized +
     {
         let mut res = Self::one();
 
+        let mut found_one = false;
+
         for i in BitIterator::new(exp) {
-            res.square();
+            if found_one {
+                res.square();
+            } else {
+                found_one = i;
+            }
+
             if i {
                 res.mul_assign(self);
             }