# What are the hex representations of the small subgroup curve points on Ed25519?

Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order `l = 2^252 + 27742317777372353535851937790883648493` and the total number of possible points on the curve is `8l`. The number of points in the group of the base point is `l`.

The cofactor results in 4 small subgroups. What are the compressed hex representations of those subgroup points?

Small subgroup of size 1:

``````0100000000000000000000000000000000000000000000000000000000000000
``````

Small subgroup of size 2:

``````ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
0100000000000000000000000000000000000000000000000000000000000000
``````

Small subgroup of size 4:

``````0000000000000000000000000000000000000000000000000000000000000000
ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
0000000000000000000000000000000000000000000000000000000000000080
0100000000000000000000000000000000000000000000000000000000000000
``````

Small subgroup of size 8:

``````c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa
0000000000000000000000000000000000000000000000000000000000000000
26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85
ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05
0000000000000000000000000000000000000000000000000000000000000080
c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a
0100000000000000000000000000000000000000000000000000000000000000
``````

Note that the ordering of the points listed above is such that the first member of the group, when added repeatedly, results in the subsequent points in the group.

• How did you find that out? @knacc
– mti
Jan 19 at 9:29
• @mti if you generate random 256-bit sequences, 50% of them will be valid y-coordinates that will be on the curve. Then, if you multiply each random curve point by the group order (the 2^252+... number mentioned above), you will only get 8 possible answers. You can do EC point addition to observe that one of them added together will generate all of the other 8 points. Jan 19 at 16:37