# EC: Why does $h>200$ need to hold?

From BSI-TR-03111 (PDF), on page 15:

The class number of the principal order belonging to the endomorphism ring of E SHOULD be at least 200.

This value commonly is referred to as $h$ in that publication.

I‘ve got two questions related to this:

1. What does $h$ mean/denote?
2. Why should it be 200 or larger?

## 1 Answer

Don't confuse h which is commonly adopted for the cofactor in EC (Cf p13 of the doc). The class number $\mathcal{H}(K)$ for any number field K is the cardinal of the class group Cl(K). Take a look to any course in algebraic number theory and specially H. COHEN and his famous book " A course in computational Alg. Numb Th ..." The ring theory is very vast, and the link with EC lies in the structure of its endomorphism Ring which can be viewed as an Order in a quadratic field. In H. COHEN you can understand that computing the class number for an random EC is not so easy, this is the reason why this value can't be chosen too small.

• why does it need to be large? safecurves.cr.yp.to/disc.html says "the class number, a quantity related to D," and "there is no evidence of serious problems with either small |D| or large |D|"... – lily wilson Jun 17 '15 at 2:13
• @lilywilson, EC for cryptographic purpose must be selected randomly. Look at the footnote page 15 of the document, that indicate that randomly EC have with a high probability a large class number. To observe the link between D and class number, I recommand you the beautiful book of J. Cox about prime numbers of certain form. Hope this answer to your question. – Robert NACIRI Jun 17 '15 at 7:06
• it doesn't answer my question. for example, the secp256k1 curve (the one used by bitcoin) is not selected randomly and has D very small (so I would assume the class number is also small). is there some problem with using such curves for cryptographic purposes? – lily wilson Jun 17 '15 at 16:15
• "you can understand that computing the class number for an random EC is not so easy, this is the reason why this value can't be chosen too small." I don't get this implication. Why is it the case that only because it's hard to find the number it needs to be high? Are there any attacks if that value's too low? BTW: You may reference the book from here in the future. – SEJPM Jun 17 '15 at 19:15
• @lilywilson, in the ref doc you've mentionned, EC with large Discr. are however prefered for SafeCurves. Yes, Actually no attacks are know against EC with small D, but in the near future no one can garantee. – Robert NACIRI Jun 17 '15 at 22:50