While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the twisted Edwards curve? What happens in this case? Is there any security problem in this case?
$\begingroup$
$\endgroup$
3
-
1$\begingroup$ Here is a good explanation (sorry I can't turn it into a proper answer right now) $\endgroup$– ConradoAug 13, 2021 at 13:52
-
$\begingroup$ Thank you very much. That was the answer I was looking for. But I can't understand this sentence. "Bernstein chose {8,4} so that security measures on the curve would automatically protect the twist as well". What is the reason for this? This is not obvious. $\endgroup$– Mahdi MahdaviAug 15, 2021 at 12:45
-
1$\begingroup$ To avoid small subgroup attacks when doing X25519 Diffie-Hellman, the lower bits of scalar is cleared to make them multiples of 8 (the cofactor). This also works for the twist, since 8 is also a multiple of 4. But it wouldn't work the other way around: if you make then multiple of 4, that won't protect you in the twist (which would required multiplying by 8). $\endgroup$– ConradoAug 15, 2021 at 16:33
Add a comment
|