3

$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$.

In the elliptic curve standard, most of the curves use $a=1$ a lot.

Is there any mapping for this such that $y^2 + xy = x^3 + ax^2 + b$ is equal or similar to $y^2 + xy = x^3 + x^2 + b$?

SEJPM
  • 45,967
  • 7
  • 99
  • 205
Hoo
  • 31
  • 1

1 Answers1

1

The title of your question is wondering why you often see $a = 1$ in the form of the elliptic curve you specified. I would first check the top answer (Thomas Pornin's) to this question.

This form of the curve is called non-supersingular. If $b=1$ and $a \in \{0,1\}$, it's called a Koblitz curve or anomalous binary curve.

The short, quick answer is: if your curve is of the form you specified over $\mathbb{F}_2$, with $a = 0$ or $a = 1$, and $b=1$, it allows you to use the Frobenius endomorphism $\tau: \mathbb{F}_{2^m} \rightarrow \mathbb{F}_{2^m}, \alpha \mapsto \alpha^2$ to very quickly calculate $2P$ for a point $P$; you just square coordinates instead of having to use the usual doubling or addition formula. This is much more efficient than the usual method of doubling.

For a point in $\mathbb{F}_{2^m}$, $\tau$ satisfies $2 = \mu \tau - \tau^2$, where $\mu = (-1)^{1-a}$. So if you want to compute $nP$, with $P \in \mathbb{F}_{2^m}$, first write $n$ as a sum of powers of $\tau$ and then apply those terms to your point $P$: $\tau(P) = (\tau(x), \tau(y))$.

I'm not sure if this is the mapping you're looking for, but you can see you get a lot of mileage out of $a \in \{0,1\}$ on an elliptic curve over $\mathbb{F}_{2^m}$!