I read that in elliptical curve cryptography, the order of the Montgomery Curve is a multiple of 8, this mean that we can't have cofactor one curves which can be problematic in some corner cases because always has a cofactor bigger than 1. When the cofactor is not 1, it means that the subgroup of prime order is only a subset of the curve. This leads to a situation where not all points on the curve can be used for cryptographic operations. Verifying the curve equation alone is not enough to ensure that a point is on the appropriate subgroup.

So, what I can't understand are as following:

  1. What vulnerabilities can arise if the order is not a multiple of 8?
  2. What issue is caused when the resulting points not fall into the correct subgroup? How can the attackers exploit this problem?
  3. Why we can't have cofactor one ? does this mean that the points exist in the group that the base point (Generator point) generates doesn't have all the point of the curve ? does this a problem ?
  4. the three least significant bits (LSB) of the scalar are set to 0, that mean the scalar is also a multiple of 8? Does this have any connection to the order of the curve being a multiple of 8?

Would be very thankful if someone could explain it simply.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.