A twist curve is the alternate curve checked when a curve built from a j-invariant does not have the required cardinality. In complex-multiplication curve construction, the sign choice for t in #E = p + 1 − t can leave a candidate with the wrong point count. The twist changes the coefficients so the desired curve can be tested directly. section 14.3 section 14.7
Start with a curve written as y² = x³ + 3cx + 2c, where c = j/(1728 − j). Choose a quadratic nonresidue f, then form y² = x³ + 3cf²x + 2cf³. Operationally, the x coefficient is multiplied by f² and the constant coefficient by f³. section 14.3
Equation 14.4
\[\label{edq3} y^2=x^3+3c f^2 x + 2 c f^3\]Compare the transformed coefficients with the original curve equation: f² scales the x term and f³ scales the constant term. section 14.3
A practical curve-selection flow is:
- Compute candidate coefficients from each Hilbert-polynomial root, treating each root as a j-invariant. section 14.5.2
- Set the target cardinality to p + 1 − t, choose a random point, and multiply it by that cardinality. section 14.5.2
- Accept a candidate when the product is the point at infinity; otherwise try other roots. section 14.3 section 14.5.2
- If no candidate passes, choose a random quadratic nonresidue, compute the twist coefficients, and repeat the same test. section 14.5.2
Coefficient fallback
Given candidate coefficients a4 and a6, select a nonsquare c. Compute a4' = a4c² and a6' = a6c³, construct the resulting curve, then test a random point against p + 1 − t. A point at infinity identifies the twist as the required curve. section 14.5.2 section 14.7
The test matters because a j-invariant supplies curve coefficients but does not by itself settle which cardinality sign is needed. Testing the original curve and, when necessary, its twist turns that ambiguity into a finite implementation check. section 14.3 section 14.7
