An elliptic curve cofactor is the ratio between a curve’s cardinality and the large prime order of its selected cryptographic subgroup. Writing the cardinality as h·r, h is the cofactor and r is the security-determining prime factor. Curves with cofactor 1 have prime cardinality, so every point has the same order and no smaller subgroup structure offers an adversary a shortcut. section 4.1.1 section 14.6
Use the cofactor to assess curve structure and implement subgroup parameters:
- Prefer a large prime factor and a small cofactor when selecting cryptographic curves; cofactor 1 is recommended for ordinary finite-field curves. section 6.3 section 6.5
- Store the cofactor alongside the curve, base point, and subgroup order in public key-generation parameters. section 4.1.3
- For extension curves, compute cofactors by dividing the relevant cardinality by the torsion value or large prime factor before deriving generators. section 18.6.2
Cofactor in key generation
A base-system structure stores cofactor, subgroup order, base point, and curve. Key generation hashes a pass phrase modulo the subgroup order, then multiplies the base point by the resulting private scalar; example curves usually use cofactor 1. section 4.1.3
Listing 4.2 Base key structure
typedef struct
{
long cofactor; #1
mpz_t order; #2
POINT Base; #3
CURVE E; #4
}BASE_SYSTEM;
Inspect the parameter structure that carries the cofactor with the subgroup order and curve used for key generation. section 4.1.3
