Mdthbs

How can I review my manager, who is fine?

Jimmy needs your help!

Uniform initialization by tuple

How do ballistic trajectories work in a ring world?

How to deal with account scam and fraud?

Replacing loop with functional style

What is the highest level of accuracy in motion control a Victorian society could achieve?

Use ContourPlot data in ParametricPlot

Why did Robert F. Kennedy loathe Lyndon B. Johnson?

Why do airports remove/realign runways?

How do I talk to my wife about unrealistic expectations?

What is the average number of draws it takes before you can not draw any more cards from the Deck of Many Things?

Possibility to correct pitch from digital versions of records with the hole not centered

Movie featuring a De Lorean - NOT Back to the Future

Interpretation of non-significant results as "trends"

This LM317 diagram doesn't make any sense to me

Category-theoretic treatment of diffs, patches and merging?

QR codes, do people use them?

Users forgotting to regenerate PDF before sending it

When is one 'Ready' to make Original Contributions to Mathematics?

What was the significance of Spider-Man: Far From Home being an MCU Phase 3 film instead of a Phase 4 film?

How to understand flavors and when to use combination of them?

Does the Wild Magic sorcerer's Tides of Chaos feature grant advantage on all attacks, or just the first one?

What is the meaning of "prairie-dog" in this sentence?

Why are co-factors 4 and 8 so popular when co-factor is more than one?

An Elliptic curve cryptography implementation which can be terminatedWhy would anyone use an elliptic curve with a cofactor > 1?Elliptic curve with non-prime generator?Elliptic Curve Cryptography - When to use p and when to use nWhat's wrong with this curve (generation algorithm)?Pairings over elliptic curves on ringsWhen adding two points on an elliptic curve, why flip over the x-axis?Fastest known Elliptic Curve Cryptography “solution” (coordinate systems (multiple?), algorithms, precomputed values etc)?How does the order of a group, it's torsion subgroup and the co-factor link?Does any problem arise when the order of an elliptic curve is equal to its prime field modulus?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

4

$begingroup$

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group.

Is this a co-incidence? Have we studied ECC for curves which produce cofactor = 3 for example?

elliptic-curves

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

$endgroup$

add a comment | 

4

$begingroup$

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group.

Is this a co-incidence? Have we studied ECC for curves which produce cofactor = 3 for example?

elliptic-curves

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

$endgroup$

add a comment | 

$begingroup$

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group.

Is this a co-incidence? Have we studied ECC for curves which produce cofactor = 3 for example?

elliptic-curves

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

$endgroup$

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

share|improve this question

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

asked 9 hours ago

WeCanBeFriendsWeCanBeFriends

48522 silver badges1111 bronze badges

1 Answer
1

active

oldest

votes

3

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrt{h}$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "281"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f71771%2fwhy-are-co-factors-4-and-8-so-popular-when-co-factor-is-more-than-one%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

3

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrt{h}$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

add a comment | 

3

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrt{h}$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

add a comment | 

$begingroup$

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $sqrt{h}$ (over a curve with approximately same size group order, and $h=1$)




• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves in Edwards notation (and use that point addition logic) - an Edwards curve always has $h$ a multiple of 4 (as it always has a point of order 4); the advantages of the Edwards point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a group of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

$endgroup$

share|improve this answer

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges

answered 8 hours ago

ponchoponcho

96.6k22 gold badges156156 silver badges252252 bronze badges