$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$.

In the elliptic curve standard, most of the curves use $a=1$ a lot.

Is there any mapping for this such that $y^2 + xy = x^3 + ax^2 + b$ is equal or similar to $y^2 + xy = x^3 + x^2 + b$?


1 Answer 1


The title of your question is wondering why you often see $a = 1$ in the form of the elliptic curve you specified. I would first check the top answer (Thomas Pornin's) to this question.

This form of the curve is called non-supersingular. If $b=1$ and $a \in \{0,1\}$, it's called a Koblitz curve or anomalous binary curve.

The short, quick answer is: if your curve is of the form you specified over $\mathbb{F}_2$, with $a = 0$ or $a = 1$, and $b=1$, it allows you to use the Frobenius endomorphism $\tau: \mathbb{F}_{2^m} \rightarrow \mathbb{F}_{2^m}, \alpha \mapsto \alpha^2$ to very quickly calculate $2P$ for a point $P$; you just square coordinates instead of having to use the usual doubling or addition formula. This is much more efficient than the usual method of doubling.

For a point in $\mathbb{F}_{2^m}$, $\tau$ satisfies $2 = \mu \tau - \tau^2$, where $\mu = (-1)^{1-a}$. So if you want to compute $nP$, with $P \in \mathbb{F}_{2^m}$, first write $n$ as a sum of powers of $\tau$ and then apply those terms to your point $P$: $\tau(P) = (\tau(x), \tau(y))$.

I'm not sure if this is the mapping you're looking for, but you can see you get a lot of mileage out of $a \in \{0,1\}$ on an elliptic curve over $\mathbb{F}_{2^m}$!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.