I've been looking at ristretto.group, and its really cool.
I understand for some protocols we need curve points to behave as if they were from a prime order curve.
I have a few questions on this,
- Do we call curves without prime order "composite"?
- Why do some protocols demand prime order from the underlying curve?
- Why isn't the fact that we work inside a prime order subgroup anyway good enough in the first place, is it that the curve arithmetic is done over the entire curve?