Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$.
In the elliptic curve standard, most of the curves use $a=1$ a lot.
Is there any mapping for this such that $y^2 + xy = x^3 + ax^2 + b$ is equal or similar to $y^2 + xy = x^3 + x^2 + b$?
The title of your question is wondering why you often see $a = 1$ in the form of the elliptic curve you specified. I would first check the top answer (Thomas Pornin's) to this question.
This form of the curve is called non-supersingular. If $b=1$ and $a \in \{0,1\}$, it's called a Koblitz curve or anomalous binary curve.
The short, quick answer is: if your curve is of the form you specified over $\mathbb{F}_2$, with $a = 0$ or $a = 1$, and $b=1$, it allows you to use the Frobenius endomorphism $\tau: \mathbb{F}_{2^m} \rightarrow \mathbb{F}_{2^m}, \alpha \mapsto \alpha^2$ to very quickly calculate $2P$ for a point $P$; you just square coordinates instead of having to use the usual doubling or addition formula. This is much more efficient than the usual method of doubling.
For a point in $\mathbb{F}_{2^m}$, $\tau$ satisfies $2 = \mu \tau - \tau^2$, where $\mu = (-1)^{1-a}$. So if you want to compute $nP$, with $P \in \mathbb{F}_{2^m}$, first write $n$ as a sum of powers of $\tau$ and then apply those terms to your point $P$: $\tau(P) = (\tau(x), \tau(y))$.
I'm not sure if this is the mapping you're looking for, but you can see you get a lot of mileage out of $a \in \{0,1\}$ on an elliptic curve over $\mathbb{F}_{2^m}$!
