While The cofactor of Edwards curve is chosen 4, the cofactor of twisted Edwards curve is chosen 8. I cant understand this reason. Can we choose cofactor 4 for twisted Edwards curve?


1 Answer 1


The trace is $p+1-\#E$, where p is the order of the underlying field and $#E4 is the number of points on the curve.

The reason for the $\{4,8\}$ thing is that trace(E) = -trace(quadratic twist of E). Plugging in the definition, $\#E + \#(twist \ E) = 2p + 2$. When $p == 1\ mod\ 4$, then $2p+2 == 4\ mod\ 8$. This means that #E and #(twist E) can’t both be of the form $4*(large\ prime)$, because then their sum would be $4*(odd + odd)$, which would be divisible by 8. So if E has cofactor 4, then twist-E must have cofactor at least 8 and vice versa.

For X25519 (the usual DH protocol over Curve25519), the protocol has to be secure on the twist as well, because you don’t check if the point is on the curve. So you want to minimize cofactor on both, and $\{4,8\}$ or $\{8,4\}$ is the best you can do. Bernstein chose $\{8,4\}$ so that security measures on the curve would automatically protect the twist as well.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.