# Can j-invariants be used to decide which elliptic curves are suiteable for cryptography?

The j-invariants classify the elliptic curves up to isomorphisms (if we suppose to work in the algebraic closure). Is this classification used in some way to decide whether or not an elliptic curve can be used in cryptography?

• If j-invariants can not be used for classification, is there an other classification which responds to my question?

• If j-invariants can be used for classification, what does the j-invariants tell us about the curve so that we know it is save to use it for cryptography?

For example: can a certain j-invariant correspond to a curve where we are sure that it has full-torsion so that it is a possible choice for Weil pairing?

• Try to split your questions into easy to read paragraphs and try to use small sentences with a minimum of (unclear) back references. We can read single paragraphs with long sentences and back references, but we'd rather not. – Maarten Bodewes Oct 22 '15 at 12:00
• There are two special j values: 0 and 1728. Elliptic curves with j=0 are interesting for pairings, because they have twisting isomorphisms of degree 6. This will frequently be used for compact representations of elliptic curve points of Baretto-Naehrig curves. – user27950 Oct 22 '15 at 14:32
• So could I conclude that these are the main j-values? Does this mean that the other j-values are not used? – user28082 Oct 22 '15 at 17:19
• I have only given an example of an interesting j value. From that you cannot conclude that other values are not interesting. – user27950 Oct 22 '15 at 18:24
• In addition to my previous comment: I would use j=0 curves for Tate(Ate,...) pairings only. For standard (i.e. non-pairing) ECC based algorithms I would use random curves, which have random j values – user27950 Oct 22 '15 at 20:14

Giving the j-invariant is basically equivalent to giving a curve equation (up to quadratic twist) (over $\mathbb F_p$ for $p > 3$) : to each j-invariant you can attach a pair of curves $(E, \widetilde E)$. You can easily compute the curve equations of $E$ and $\widetilde E$ from $j$:
$$E: y^2 = x^3 + a x + 2a, \qquad a = -\frac{27j}{j-1728}$$
Now the $j$-invariant is "suitable for crypto" if both curves above are suitable, which you can check using the usual algorithms (SEA, etc.). Since it is easy to go from “curve equation” to “j-invariant” and back, it is also easy to conclude that the j-invariant does not contain anything particularly useful for cryptography.
• This is not quite correct. The j invariant classifies elliptic curves up to isomorphism over an algebraic closure. There are many non $\mathbb F_p$-isomorphic curves with the same j-invariant. – user27950 Oct 30 '15 at 14:33
• Cryptostasis, there are not "many non $\mathbf F_p$-isomorphic curves with the same j-invariant", but only two (in the ordinary case), as already stated in the answer: a curve and its quadratic twist. – Calodeon Oct 31 '15 at 9:22
• @calodeon: The curve and their quadratic twist are the $\mathbb F_p$ isomorphic curves. But there are many non $\mathbb F_p$ isomorphic curves. For instance, all curves of the form $y^2 = x^3 + b$ have j=0. – user27950 Oct 31 '15 at 16:28
• @Cryptostasis: So there are only... at most 6 isomorphism classes for curves of the form $y^2 = x^3 + b$ ("at most" because it depends on the number of cubic roots of unity in the field). That is more than 2, only because $j = 0$ is not ordinary. – Calodeon Oct 31 '15 at 18:54