3
$\begingroup$

The order of the base point, $l$, is 2^252 + 27742317777372353535851937790883648493

However, the base point group is nested within other large groups, the largest of which is of size $8l$.

There are also nested small subgroups, the largest of which is a small subgroup of size $8$.

Is it therefore correct to say that the total number of possible points (on either Curve25519 or Ed25519), including the identity point that both the small and large subgroups share, is: $8l + 7$

Improve this question
$\endgroup$

1 Answer 1

Reset to default
5
$\begingroup$

No the total number of points on the curve is still $8l$.

The curve order (total number of point on the curve) is simply the subgroup order multiplies the co-factor. This is true for all subgroups.

For the small subgroup of order $8$, its co-factor is $l$.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Is it correct to say that the base point group does not contain any points from any of the small subgroups (other than the identity point), but that the larger subgroups of size 2l, 4l or 8l do contain points (other than the identity point) which are also in the small subgroups? $\endgroup$
    – knaccc
    Commented Jun 22, 2018 at 14:43
  • 1
    $\begingroup$ I think I get this now. Are you saying: the small subgroup of size 1 consists of just the identity point, the small subgroup of size 2 contains an additional point which is also in large subgroups 2l,4l,8l. The small subgroup of size 4 contains 2 further points which are in both 4l and 8l. The small subgroup of size 8 contains 4 further points which are only shared with the large subgroup of size 8l? $\endgroup$
    – knaccc
    Commented Jun 22, 2018 at 14:55
  • $\begingroup$ No, identity element is shared across all sub-groups, but other elements may not. The union of all subgroups gives you the largest group. $\endgroup$
    – Changyu Dong
    Commented Jun 22, 2018 at 15:08
  • $\begingroup$ Thanks, yes that's what I meant: Small subgroup size 1 contains just identity which is in l,2l,4l and 8l. Small subgroup size 2 contains an additional point which is shared with 2l,4l,8l but not with l. Small subgroup size 4 contains two additional points which are shared with large subgroups 4l,8l but those additional points are not shared with subgroups l or 2l. Finally Small subgroup size 8 will contain four additional points which are only shared with large subgroup of size 8l. Is this correct? $\endgroup$
    – knaccc
    Commented Jun 22, 2018 at 15:12
  • $\begingroup$ Sorry I didn't read carefully. Yes you are right. $\endgroup$
    – Changyu Dong
    Commented Jun 22, 2018 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.