As the title says, I have some doubts about the term "cofactor" used to describe elliptic curves.

AFAIK, it's a factor of the curve order, but why is it explicitly specified in some parameter lists then?

How does it apply to the curve point addition / etc. algorithms?

  • $\begingroup$ Is your question addressed by crypto.stackexchange.com/a/51352/49826? The cofactor normally doesn't figure into curve arithmetic (point addition, scalar multiplication, etc.), though it may figure into scalar arithmetic depending on whether you're doing arithmetic in the whole curve's composite-order scalar ring or just the scalar ring of the prime-order subgroup generated by the standard base point. $\endgroup$ Commented Mar 11, 2018 at 19:31

1 Answer 1


In cryptography, an elliptic curve is a group which has a given size $n$. We normally work in a subgroup of prime order $r$, where $r$ divides $n$. The "cofactor" is $h = n/r$.

For every point $P$ on the curve, the point $hP$ is either the "point at infinity", or it has order $r$; i.e., when taking a point, multiplying it by the cofactor necessarily yields a point in the subgroup of prime order $r$.

The cofactor matters in as much as it is not equal to $1$:

  • When the cofactor is $1$, the subgroup is the whole curve. Any non-zero point is a generator. Any incoming point $(x,y)$ that fulfills the curve equation is part of the subgroup. Everything is fine.

  • When the cofactor is not $1$, then the subgroup of prime order is a strict subset of the curve. When considering a point, verifying that the curve coordinates match the curve equation is not sufficient to guarantee that the point is on the appropriate subgroup. Moreover, there will be points whose order is not a multiple of $r$. This is what happens, for instance, with Curve25519, which has a cofactor of $8$. Such curves require some extra care in the protocol that uses them. For instance, when doing a Diffie-Hellman key exchange over Curve25519, the Diffie-Hellman private keys must be chosen as multiples of 8 (which is expressed as: "set the three least significant bits to zero"); this ensures that the points will be in the proper subgroup.

  • $\begingroup$ "when taking a point, multiplying it by the cofactor necessarily yields a point in the subgroup". IMO, "a point" should belong to the subgroup for this statement to be true. Please confirm. An initial impression was that you're talking about any point on the curve. $\endgroup$
    – Oleg Gryb
    Commented Aug 7, 2019 at 23:13
  • $\begingroup$ @OlegGryb there is no problem here. When you multiply with $h$ if the point is not on the subgroup of order $r$ then it will be $\mathcal{O}$ that is in the subgroup of order $r$. This multiplication is used to make sure that we are not in small order. Once you see that it is $\mathcal{O}$ then skip this point. $\endgroup$
    – kelalaka
    Commented Jul 6, 2020 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.