3

When I was read about the elliptic curve cryptography I found some definition about domain parameter of elliptic curve like the follow. But I did not understand something

$p$: prime number. $a, b$: field elements, they specify the equation of the elliptic curve $ E$ over $F_P$,

$y^2 ≡ x^3+a • x+b $

$G$: A base point represented by $G= (xg, yg)$ on $E (F_P)$

$n$: Order of point $G$ , that is $n$ is the smallest positive integer such that $nG = O$.

$h$: cofactor, and is equal to the ratio #E($F_P$)/$n$, where #E($F_P$) is the curve order.

My question

What's diffrence between $n$ & #E($F_P$)? also

I think two are same value. because #E($F_P$) is Curve Order where The number of points on the elliptic curve is called its curve order. and when we do #E * $G$ = $O$.

Is this right or not right?

Community
  • 1
Mhsz
  • 451
  • 1
  • 3
  • 13

1 Answers1

5

What's difference between n & #E(FP)?

The difference is that $n$ is the smallest positive integer where $nG = O$; while you correctly state that $\#E \cdot G = O$, that doesn't mean that $\#E$ is the smallest integer that makes this happen. There may be a smaller integer $n$; $n$ will always be a factor of $\#E$, however it can be smaller.

As for why we would want to make it smaller, that is, why would we want to have an $h = \#E/n > 1$, well, that's exactly what this question addresses.

Community
  • 1
poncho
  • 147,019
  • 11
  • 229
  • 360
  • 1
    Can you explain me a real example? or give me link explain that. – Mhsz Nov 20 '14 at 17:11
  • Thank you poncho. you mean n is order of group of points like in finite cyclic group theory n is for the subgroup of order. Is this right or not right? – Mhsz Nov 20 '14 at 18:31
  • @Mhsz: close; it turns out that finite Elliptic Curves need not be cyclic; for example, they can have $Z_2 \times Z_2$ as a subgroup; however that turns out to be cryptographically unimportant, and everything else you said is correct. – poncho Nov 20 '14 at 18:50