2

Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. The number of points in the group of the base point is l.

The cofactor results in 4 small subgroups. What are the compressed hex representations of those subgroup points?

1 Answer 1

2

Small subgroup of size 1:

0100000000000000000000000000000000000000000000000000000000000000

Small subgroup of size 2:

ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
0100000000000000000000000000000000000000000000000000000000000000

Small subgroup of size 4:

0000000000000000000000000000000000000000000000000000000000000000
ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
0000000000000000000000000000000000000000000000000000000000000080
0100000000000000000000000000000000000000000000000000000000000000

Small subgroup of size 8:

c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa
0000000000000000000000000000000000000000000000000000000000000000
26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85
ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05
0000000000000000000000000000000000000000000000000000000000000080
c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a
0100000000000000000000000000000000000000000000000000000000000000

Note that the ordering of the points listed above is such that the first member of the group, when added repeatedly, results in the subsequent points in the group.

2
  • How did you find that out? @knacc
    – mti
    Jan 19 at 9:29
  • @mti if you generate random 256-bit sequences, 50% of them will be valid y-coordinates that will be on the curve. Then, if you multiply each random curve point by the group order (the 2^252+... number mentioned above), you will only get 8 possible answers. You can do EC point addition to observe that one of them added together will generate all of the other 8 points.
    – knaccc
    Jan 19 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.