I've been looking at ristretto.group, and its really cool.

I understand for some protocols we need curve points to behave as if they were from a prime order curve.

I have a few questions on this,

  1. Do we call curves without prime order "composite"?
  2. Why do some protocols demand prime order from the underlying curve?
  3. Why isn't the fact that we work inside a prime order subgroup anyway good enough in the first place, is it that the curve arithmetic is done over the entire curve?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.