# What happens if the Edwards curve isn't quadratic twist secure?

On this webpage, Daniel Bernstein offers that the curve must be quadratic twisted secure. This means that if the curve has $$\#E$$ points on $$Z_p$$ where $$\#E=p+1-t$$, then the quadratic twist curve has $$\#E'=p+1+t$$ points. The condition for quadratic twisted secure curves is that the cofactor of a quadratic twist curve is low. For example, the cofactor of a curve is 8 and the cofactor of a quadratic twist curve is 4 in twisted Edwards curves.

If the above condition isn't satisfied, then which attacks can be applied to the curve? Please list all proposed attacks. Are all of the attacks side-channel?

For Edwards curves the arithmetic is typically implemented using Montgomery ladder, and the algorithm works both for the curve and its quadratic twist. (Note that for Weierstrass curves $$y^2 = x^3 + ax + b$$, the arithmetic formulas depends only on $$a$$ and so the algorithm works for a larger set of curves - arbitrary $$b$$).