An ordinary elliptic curve over a finite prime field is written as E: y² = x³ + a₄x + a₆ mod p, with a₆ ≠ 0. Its arithmetic supports cryptographic curve selection: the curve’s cardinality must contain one large prime and preferably have cofactor 1. section 6.5 section 3.1.1
Equation 6.1
\[\label{fgc1} E: y^2=x^3+a_4 x + a_6 \text{ mod }p\]Use the defining equation to identify the two coefficients retained from the general elliptic-curve equation and to connect notation with implementation. section 6.2
Curve selection relies on three linked quantities:
- The cardinality satisfies #E = p + 1 − t, where t is the trace of Frobenius and |t| < 2√p. section 6.2 section 6.5
- A search tests candidate curves, removes powers of 2 and selected small factors from #E, and retains curves with a suitable large-prime structure. section 6.2
- Points use coordinate pairs (x, y); negation is −(x, y) = (x, −y), while (0, 0) represents the point at infinity for these curves. section 3.1.1
Searching for a cryptographic curve
Choose a prime p and candidate coefficients a₄ and a₆, compute #E with PARI/gp, remove powers of 2 and tracked small factors, then accept or reject the curve before incrementing a₆. section 6.2 section 6.5
