2

Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. The number of points in the group of the base point is l.

The cofactor results in 4 small subgroups. What are the compressed hex representations of those subgroup points?

2

Small subgroup of size 1:

0100000000000000000000000000000000000000000000000000000000000000

Small subgroup of size 2:

ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
0100000000000000000000000000000000000000000000000000000000000000

Small subgroup of size 4:

0000000000000000000000000000000000000000000000000000000000000000
ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
0000000000000000000000000000000000000000000000000000000000000080
0100000000000000000000000000000000000000000000000000000000000000

Small subgroup of size 8:

c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa
0000000000000000000000000000000000000000000000000000000000000000
26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85
ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05
0000000000000000000000000000000000000000000000000000000000000080
c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a
0100000000000000000000000000000000000000000000000000000000000000

Note that the ordering of the points listed above is such that the first member of the group, when added repeatedly, results in the subsequent points in the group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.