# What is the difference between order of base point and curve order in EC? [duplicate]

This question already has an answer here:

When I was read about the elliptic curve cryptography I found some definition about domain parameter of elliptic curve like the follow. But I did not understand something

$p$: prime number. $a, b$: field elements, they specify the equation of the elliptic curve $E$ over $F_P$,

$y^2 ≡ x^3+a • x+b$

$G$: A base point represented by $G= (xg, yg)$ on $E (F_P)$

$n$: Order of point $G$ , that is $n$ is the smallest positive integer such that $nG = O$.

$h$: cofactor, and is equal to the ratio #E($F_P$)/$n$, where #E($F_P$) is the curve order.

My question

What's diffrence between $n$ & #E($F_P$)? also

I think two are same value. because #E($F_P$) is Curve Order where The number of points on the elliptic curve is called its curve order. and when we do #E * $G$ = $O$.

Is this right or not right?

## marked as duplicate by poncho, e-sushi, Gilles, mikeazoDec 17 '14 at 13:04

The difference is that $n$ is the smallest positive integer where $nG = O$; while you correctly state that $\#E \cdot G = O$, that doesn't mean that $\#E$ is the smallest integer that makes this happen. There may be a smaller integer $n$; $n$ will always be a factor of $\#E$, however it can be smaller.
As for why we would want to make it smaller, that is, why would we want to have an $h = \#E/n > 1$, well, that's exactly what this question addresses.
• @Mhsz: close; it turns out that finite Elliptic Curves need not be cyclic; for example, they can have $Z_2 \times Z_2$ as a subgroup; however that turns out to be cryptographically unimportant, and everything else you said is correct. – poncho Nov 20 '14 at 18:50