# Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $$4$$ in standards, the cofactor of the twisted Edwards curve is chosen $$8$$. I can't understand the reason for this. Can we choose cofactor $$4$$ for the twisted Edwards curve? What happens in this case? Is there any security problem in this case?

• Here is a good explanation (sorry I can't turn it into a proper answer right now) Aug 13 '21 at 13:52
• Thank you very much. That was the answer I was looking for. But I can't understand this sentence. "Bernstein chose {8,4} so that security measures on the curve would automatically protect the twist as well". What is the reason for this? This is not obvious. Aug 15 '21 at 12:45
• To avoid small subgroup attacks when doing X25519 Diffie-Hellman, the lower bits of scalar is cleared to make them multiples of 8 (the cofactor). This also works for the twist, since 8 is also a multiple of 4. But it wouldn't work the other way around: if you make then multiple of 4, that won't protect you in the twist (which would required multiplying by 8). Aug 15 '21 at 16:33