Mfcttrf

How did the IEC decide to create kibibytes?

How to reclaim personal item I've lent to the office without burning bridges?

How should I ask for a "pint" in countries that use metric?

How to say "is going" in Russian in "this game is going to perish"

When is one 'Ready' to make Original Contributions to Mathematics?

Can you create a free-floating MASYU puzzle?

What is the shape of the upper boundary of water hitting a screen?

How to evaluate the performance of open source solver?

Is this car delivery via Ebay Motors on Craigslist a scam?

Why do airports remove/realign runways?

I don't want to be introduced as a "Minority Novelist"

Jimmy needs your help!

Is conquering your neighbors to fight a greater enemy a valid strategy?

What are some bad ways to subvert tropes?

Array or vector? Two dimensional array or matrix?

How do I talk to my wife about unrealistic expectations?

Tesco's Burger Relish Best Before End date number

My professor has told me he will be the corresponding author. Will it hurt my future career?

Where are the Wazirs?

QR codes, do people use them?

Replacing loop with functional style

Why do Martians have to wear space helmets?

Why SQL does not use the indexed view?

Does the Wild Magic sorcerer's Tides of Chaos feature grant advantage on all attacks, or just the first one?

Why are co-factors 4 and 8 so popular when co-factor is more than one?

An Elliptic curve cryptography implementation which can be terminatedWhy would anyone use an elliptic curve with a cofactor > 1?Elliptic curve with non-prime generator?Elliptic Curve Cryptography - When to use p and when to use nWhat's wrong with this curve (generation algorithm)?Pairings over elliptic curves on ringsWhen adding two points on an elliptic curve, why flip over the x-axis?Fastest known Elliptic Curve Cryptography “solution” (coordinate systems (multiple?), algorithms, precomputed values etc)?How does the order of a group, it's torsion subgroup and the co-factor link?Does any problem arise when the order of an elliptic curve is equal to its prime field modulus?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

4

$begingroup$

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group.

Is this a co-incidence? Have we studied ECC for curves which produce cofactor = 3 for example?

elliptic-curves

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

$endgroup$

add a comment | 

4

$begingroup$

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group.

Is this a co-incidence? Have we studied ECC for curves which produce cofactor = 3 for example?

elliptic-curves

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

$endgroup$

add a comment | 

$begingroup$

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group.

Is this a co-incidence? Have we studied ECC for curves which produce cofactor = 3 for example?

elliptic-curves

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

$endgroup$

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

1 Answer
1

active

oldest

votes

3

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrth$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "281"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f71771%2fwhy-are-co-factors-4-and-8-so-popular-when-co-factor-is-more-than-one%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

3

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrth$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

add a comment | 

3

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrth$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

add a comment | 

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrth$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges