ISSN 0032-9460, Problems of Information Transmission, 2017, Vol. 53, No. 1, pp. 92–101.
Pleiades Publishing, Inc., 2017.
Original Russian Text
A.V. Bessalov, O.V. Tsygankova, 2017, published in Problemy Peredachi Informatsii, 2017, Vol. 53, No. 1, pp. 101–111.
Number of Curves in the Generalized Edwards Form
with Minimal Even Cofactor of the Curve Order
A. V. Bessalov
and O. V. Tsygankova
Borys Grinchenko Kyiv University, Kyiv, Ukraine
Institute of Physics and Technology, National Technical University of Ukraine
“Kyiv Polytechnic Institute,” Kyiv, Ukraine
Received December 15, 2015; in ﬁnal form, September 23, 2016
Abstract—We analyze properties of points of orders 2, 4, and 8 of a curve in the generalized
Edwards form. Arithmetic for group operations with singular points of these curves is intro-
duced. We propose a classiﬁcation of curves in the Edwards form into three disjoint classes.
Formulas for the number of curves of order 4n of diﬀerent classes are obtained. Works of other
authors are critically analyzed.
Elliptic curves in the Edwards form  over a prime ﬁeld are undoubtedly perspective for modern
cryptography. As is shown in , computation rate of group operations for them is on the average at
least half as large again as for curves in the Weierstrass form. For the ternary NAF(k)representation
of a number k of a point kP , the gain in the computation rate reaches the factor of 1.6. Arithmetic
of these curves is simpler due to the neutral element of the group being a nonsingular point (1, 0)
of the curve. Excluding isomorphic curves, for Edwards curves it is suﬃcient to use a single
parameter d instead of two parameters a and b of a curve in the Weierstrass form.
The authors of  generalized and extended the class of Edwards curves  by introducing
anewparametera and removing the restriction of nonquadraticness of the parameter d of the
curve. They called this class twisted Edwards curves and referred to the curves deﬁned in  as
complete Edwards curves. In  an analysis of some properties of those curves was presented and
an attempt was made to classify curves in the Edwards form and give statistics for the distribution
of orders of curves belonging to diﬀerent classes of these curves for small values of the modulus,
p = 1009 and p = 1019. However, actually, curves in the generalized Edwards form are divided
in  into overlapping classes, so that the same curves fall into diﬀerent classes in statistical
tables [3, Section 4]. Thus, the statistics given in  is unreliable.
In the present paper we analyze properties of points of orders 2, 4, and 8 of curves in the
generalized Edwards form, partition them into nonoverlapping classes, and obtain formulas for the
number of such curves of order 4n. In Section 2 we introduce the arithmetic for group operations
with singular points of these curves, analyze points of small orders, and present formulas relating
them to other points of the curve. In Section 3 we discuss incorrectness of a number of claims,
classiﬁcation of curves, and statistics of their orders in  and propose a classiﬁcation of curves
in the generalized Edwards form into three disjoint classes depending on quadraticness of the
parameters a and d of a curve. We analyze properties of curves in each of the three classes and
possible values of orders of these curves. In Section 4 we obtain precise formulas for the number of