While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the twisted Edwards curve? What happens in this case? Is there any security problem in this case?

  • 1
    $\begingroup$ Here is a good explanation (sorry I can't turn it into a proper answer right now) $\endgroup$
    – Conrado
    Aug 13 '21 at 13:52
  • $\begingroup$ Thank you very much. That was the answer I was looking for. But I can't understand this sentence. "Bernstein chose {8,4} so that security measures on the curve would automatically protect the twist as well". What is the reason for this? This is not obvious. $\endgroup$ Aug 15 '21 at 12:45
  • 1
    $\begingroup$ To avoid small subgroup attacks when doing X25519 Diffie-Hellman, the lower bits of scalar is cleared to make them multiples of 8 (the cofactor). This also works for the twist, since 8 is also a multiple of 4. But it wouldn't work the other way around: if you make then multiple of 4, that won't protect you in the twist (which would required multiplying by 8). $\endgroup$
    – Conrado
    Aug 15 '21 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.