Join Log in
Score:0
mehdi mahdavi oliaiy avatar Crypto

Why is the cofactor of twisted Edwards curve chosen 8?

ro flag
mehdi mahdavi oliaiy

While The cofactor of Edwards curve is chosen 4, the cofactor of twisted Edwards curve is chosen 8. I cant understand this reason. Can we choose cofactor 4 for twisted Edwards curve?

49
1 + 0
Score:1
mehdi mahdavi oliaiy avatar Crypto
ro flag
mehdi mahdavi oliaiy

The trace is $p+1-\#E$, where p is the order of the underlying field and $#E4 is the number of points on the curve.

The reason for the $\{4,8\}$ thing is that trace(E) = -trace(quadratic twist of E). Plugging in the definition, $\#E + \#(twist \ E) = 2p + 2$. When $p == 1\ mod\ 4$, then $2p+2 == 4\ mod\ 8$. This means that #E and #(twist E) can’t both be of the form $4*(large\ prime)$, because then their sum would be $4*(odd + odd)$, which would be divisible by 8. So if E has cofactor 4, then twist-E must have cofactor at least 8 and vice versa.

For X25519 (the usual DH protocol over Curve25519), the protocol has to be secure on the twist as well, because you don’t check if the point is on the curve. So you want to minimize cofactor on both, and $\{4,8\}$ or $\{8,4\}$ is the best you can do. Bernstein chose $\{8,4\}$ so that security measures on the curve would automatically protect the twist as well.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.